Scottish financial services firms operate under intense regulatory scrutiny. The FCA, PRA, and GDPR demand rigorous controls over data security, business continuity, and operational resilience. Your IT infrastructure is not just a business tool — it is a compliance requirement.
Why Settle Technology provides specialised Managed IT Services (MSP) and compliance support for financial services firms across Scotland. We understand the regulatory landscape and design IT systems that meet compliance obligations while supporting business growth.
Regulatory Compliance Requirements
Financial services firms must comply with multiple overlapping regulations:
• FCA Handbook — SYSC requirements for systems and controls, data security, and operational resilience
• PRA Rulebook — IT governance and risk management for regulated firms
• GDPR — Data protection, processing records, subject access requests, breach notification
• Cyber Essentials Plus — Often required for government and institutional contracts
• ISO 27001 — Information security management (increasingly expected by institutional clients)
• Outsourcing regulations — FCA/PRA rules on material outsourcing of IT functions
Failure to meet these requirements results in enforcement action, fines, reputational damage, and potential loss of authorisation. Your IT support provider must understand these obligations and design systems accordingly.
Our Financial Services MSP Services
1. Managed IT Support
• Unlimited remote helpdesk support during business hours (8am–6pm, Monday–Friday)
• Emergency out-of-hours support for critical issues (trading system failures, security incidents)
• On-site support within 4-hour SLA where remote resolution is not possible
• User onboarding and offboarding with proper access controls
• Application support for financial software platforms
• Printer and peripheral support
• Ticketing system with full audit trail for compliance evidence
2. Cybersecurity and Data Protection
• Endpoint Detection and Response (EDR) — Next-generation antivirus with real-time threat detection
• Email security — Advanced threat protection, phishing filtering, email archiving
• Multi-factor authentication (MFA) — Enforced across all systems (FCA expectation)
• Encryption — Full disk encryption on all devices, encrypted email for sensitive communications
• Access controls — Role-based access, privileged access management, least privilege enforcement
• Network security — Firewall management, intrusion detection, secure remote access
• 24/7 security monitoring — SOC oversight, threat intelligence, incident response
3. Backup and Business Continuity
• Automated cloud backup — Daily backups with 365-day retention (minimum FCA expectation)
• Immutable backup storage — Ransomware-proof backup copies
• Recovery testing — Quarterly disaster recovery tests with documented results
• Recovery objectives — RTO: 4 hours, RPO: 1 hour (customisable to your requirements)
• Business continuity planning — Documented procedures for IT failures, cyber incidents, and operational disruptions
• Alternative working arrangements — Support for remote working during disruptions
4. Compliance Documentation and Governance
• IT policies and procedures — Acceptable use, access control, data protection, incident response, remote working
• Asset registers — Complete inventory of hardware, software, and data processing activities
• Processing records — GDPR Article 30 records of processing activities
• Vendor management — Due diligence on third-party providers, outsourcing documentation
• Audit support — Evidence gathering for FCA/PRA visits, internal audits, and external assessments
• Risk registers — IT risk identification, assessment, and mitigation tracking
• Compliance reporting — Monthly/quarterly reports on security posture, patch compliance, incidents
5. Microsoft 365 for Financial Services
• Security hardening — Configuration aligned to FCA expectations and Microsoft best practice
• Data Loss Prevention (DLP) — Policies to prevent accidental or intentional data leakage
• Email archiving — Retention policies meeting regulatory requirements (typically 5–7 years)
• SharePoint/Teams governance — Access controls, sharing restrictions, external collaboration policies
• Licence management — Optimisation and compliance
• eDiscovery support — Tools and processes for regulatory investigations and litigation
6. Strategic IT Advisory
• Virtual CIO (vCIO) service — Quarterly strategic reviews with leadership
• Technology roadmapping — Alignment of IT investment with business strategy
• Regulatory change management — Monitoring and implementation of new FCA/PRA IT requirements
• Outsourcing oversight — Managing relationships with technology providers per FCA/PRA rules
• Budget planning — IT expenditure forecasting and optimisation
• M&A IT due diligence — Technology assessment for acquisitions or mergers
Why Settle Technology for Financial Services
Scottish-based expertise
We understand the Scottish financial services sector, from independent wealth managers in Edinburgh to insurance brokers in Glasgow. Local presence means on-site support when needed and understanding of regional business culture.
Regulatory knowledge
Our team has experience supporting FCA-regulated firms and understands the compliance landscape. We design IT systems with regulatory requirements built in, not bolted on after the fact.
Security-first approach
ISO 27001 aligned processes, Cyber Essentials Plus certification, and security embedded in every service. Your clients data and your regulatory standing are our priority.
Audit-ready documentation
Every service includes comprehensive documentation suitable for regulatory audits. When the FCA visits, you will have evidence ready.
Proven track record
We currently support financial services firms across Scotland with their IT and compliance requirements. References available on request.
Implementation Approach
Phase 1: Discovery and Assessment (Week 1–2)
• Complete IT infrastructure audit
• Security assessment and gap analysis
• Compliance documentation review
• Regulatory obligations mapping
• Risk register creation
Phase 2: Remediation (Week 3–5)
• Critical security fixes
• Backup and disaster recovery implementation
• MFA enforcement across all systems
• Policy and procedure documentation
• Monitoring deployment
Phase 3: Transition (Week 6)
• Helpdesk cutover
• User communications and training
• Knowledge transfer
• Ongoing support begins
Phase 4: Optimisation (Month 2–3)
• Service refinement
• Process optimisation
• Strategic planning
• Quarterly business reviews commence
Investment
Financial services MSP pricing reflects the enhanced security, compliance, and support requirements:
• Essential — £95–125 per user/month (core support, endpoint security, backup, basic compliance)
• Professional — £125–165 per user/month (full security stack, MFA, enhanced compliance documentation, quarterly vCIO)
• Enterprise — £165–225 per user/month (advanced security, dedicated vCIO, audit support, enhanced SLAs)
Pricing depends on user count, device count, complexity of regulatory requirements, and current IT maturity. Third-party subscriptions (Microsoft 365, EDR licences) excluded unless otherwise agreed.
No hidden costs: All monitoring, maintenance, patch management, and remote support included. No surprise bills.
Next Steps
1. Initial consultation — Discuss your firms specific requirements and regulatory obligations
2. Infrastructure assessment — Comprehensive audit of current IT environment
3. Proposal — Customised service scope and pricing
4. Agreement — Contract and SLA confirmation
5. Onboarding — Implementation as per phased plan
Why Settle Technology
Specialist IT support and compliance services for Scottish financial services firms. We understand your regulatory obligations and design IT systems that meet them.
Contact us to discuss your requirements and arrange an initial consultation.
