Cyber Essentials for UK financial services firms Certified by Fig.

The FCA does not impose Cyber Essentials as a universal certification requirement. It expects firms to manage cyber and operational-resilience risk, and has identified Cyber Essentials as a useful baseline for smaller firms. Certification supports that work but does not replace the wider FCA rules and guidance that apply to the firm.

SJP has publicly described mandatory Cyber Essentials Plus accreditation for Partner Practices or use of its Device as a Service solution. Partner Practices should confirm their current route and reporting instructions with SJP. See /blog/cyber-essentials-for-sjp-partners for practical certification guidance.

Start with the devices, networks, cloud services, and users that access organisational data or services. Include the CRM, back-office and financial-planning tools, document signing, client portals, remote working, administrator accounts, and any personally owned devices that fall within scope.

DORA is a broader regime than CE. CE satisfies parts of DORA's ICT risk management and supply chain expectations but is not a substitute for the full regulation. Most UK firms serving EU counterparties treat CE as foundational and layer DORA-specific controls on top.

Corporate estate only (laptops, M365/Google Workspace, corporate SSO). Home routers used by remote workers are out of scope under v3.3. Production fintech infrastructure is separately assessed under ISO 27001, SOC 2 Type II, or the equivalent. Split scopes deliberately.

Depends on UK headcount. A typical 40-person fintech falls into CE Small (10-49) at £399.99 + VAT, or CE Plus Small at £1,999 + VAT for insurer / enterprise-client use.