A tenant full of other people's money. An insurer and a regulator who know it.
Advice firms, SIPP operators and wealth managers around Bristol and the wider South West. The FD has become the IT department, the cyber form has landed, and the FCA has put a date on incident and third-party reporting.
A named Head of IT and AI, one or two days a week. You keep the MSP. We sit above it.
2026 IS THE YEAR THE FCA GAVE FIRMS TO PREPARE
IFA networks and independents. SIPP and SSAS operators. Discretionary and advisory wealth firms. Usually 50-200 people, or a smaller firm whose client book already carries a 200-person risk.
Bristol first, then Bath, Exeter and the wider South West. A London wealth firm with a South West book is welcome too. And the firms doing the buying: consolidators and PE-backed platforms landing estate after estate, deal by deal.
If yours is a law firm, the sharper page is law firm IT security. The broader page for firms of 50-200 people is professional services IT.
The standard tier of the new rules reaches most FCA-authorised firms, advice firms included. Qualifying operational incidents are reported through the FCA's Connect portal, and a register of material third-party arrangements is kept and stays current.
Your MSP contract, your platform, your back-office system: that register is IT work with a regulatory deadline, and 2026 is the preparation year the FCA gave firms. It is a bounded, board-readable project, and it belongs to whoever owns IT. If nobody does, that is the seat on this page.
Consolidators and PE-backed platforms are buying advice books at pace, and each completion hands the platform another tenant, another MSP contract, another back-office system. Integration is where the record sits: 250+ servers moved to Azure, and ISO 27001 and PCI DSS implemented in 12 months alongside.
If the platform needs a named senior inside an acquired firm, that is the Head of IT seat. If the acquired estate needs folding in on a deadline, the work is scoped to that deadline.
The blockers are real: client data in open shares, permissions nobody has reviewed, a regulator who will ask how the firm governs the tools it adopts. None of them is an argument for waiting. Each is a piece of work with a name on it.
The AI Opportunity Audit finds where AI pays in an advice business and what must be true first. Microsoft Copilot readiness closes oversharing before a 30-day pilot touches client files. And ISO 42001 readiness, part of the CE+ / ISO 27001 sprint from £6,500, gives the board a governance frame it can point to when the FCA, an insurer or a platform asks how AI is run.
All six services, and the framework they belong to, are on one page.
We sit with the FD, the compliance lead and whoever holds the MSP contract. The insurer form, the register and the tenant come first.
The board has an operating model, the insurer has evidence, and the register has an owner. You stop being the IT department.
Estates drift when nobody owns them. The fix is one or two days a week from someone who already knows your firm. Or keep the gains and run it yourselves: either way the firm is stronger.
Someone the MD can put in front of the board.
Documents for the cyber questionnaire, owned.
Third-party arrangements mapped, ahead of the 2027 deadline.
A tenant and controls that let the firm adopt, with evidence.
The detail sits on the proof page.
Yes. In an IFA or SIPP firm the job is client data, access, the tenant, and the evidence pack the insurer asks for, each with a named owner. We implement the controls. We do not pretend to be your compliance officer or your certification body.
No. We do not sell helpdesk or MSP tickets. The number is 0117, and the voice that answers it is our own AI call agent, in production. The offer is a named Head of IT plus the evidence.
The CE+ / ISO 27001 sprint is built for the insurance cyber questionnaire and for buyers who ask for CE+ or ISO 27001. FCA permissions stay with you and your compliance lead.
Final rules land in March 2026 and take force on 18 March 2027. Most FCA-authorised firms, advice firms included, will report qualifying operational incidents and keep a register of material third-party arrangements. Building that register is a bounded piece of IT work, and 2026 is the year to do it.
Yes, when the risk is the client book rather than the headcount. The usual range is 50-200 people, and we say honestly at diagnose whether the fit is real.
You keep the MSP if it works. We sit above it, for the decisions, the evidence and the register.
Yes. The integration record is on the proof page. If you want a named senior inside a platform firm, that is the seat.
Yes, once the tenant and the controls are real. The AI Opportunity Audit finds where AI pays and what must be true first. Copilot readiness closes oversharing before a pilot touches client files. ISO 42001 readiness gives the board a governance frame it can point to.
The first conversation costs nothing and changes what happens next. Bring the insurer form, the platform questionnaire, or the register nobody has started.
Call 0117 456 5486. The voice that answers is our own AI call agent, in production, on our own line. We run our practice on what we sell. Hear it running.
The call button dials the line above.
