Ask most compliance teams whether the FCA requires a penetration test and you'll get a confident "yes". The accurate answer is more useful: for most firms the FCA doesn't prescribe pen testing by name, but independent security testing can provide useful evidence for operational resilience.
The rules that matter
The FCA and PRA operational resilience framework (FCA PS21/3, PRA SS1/21) requires in-scope firms to:
- identify their important business services, meaning the services whose disruption would cause intolerable harm to clients or market integrity;
- set an impact tolerance for each one, which is the maximum disruption they can withstand;
- map the people, processes, technology and third parties behind those services;
- test, using severe but plausible scenarios, whether they can stay within tolerance;
- keep a written self-assessment, signed off by the board.
The transition period ended on 31 March 2025. Firms are now expected to be able to remain within their impact tolerances, not just to have a plan for getting there.
Where pen testing fits
A cyber attack is the most obvious severe but plausible scenario for almost every important business service. Your self-assessment has to explain why you are confident that an attacker couldn't push a service past tolerance. "We have a firewall and an annual scan" won't survive a supervisory conversation. Evidence from independent testing will.
The problem is that most pen tests aren't designed to produce that evidence. They're scoped as "test the website" or "test 40 IP addresses", and they come back as a list of CVSS scores that nobody can link to a business service.
How to scope a test that works as resilience evidence
- Start from the service, not the asset. Pick one or two important business services, such as client onboarding, payments or the client portal, and scope the technology that supports them end to end.
- Include the paths attackers actually use. Attackers rarely get in through the portal itself. They come through phished credentials, the Microsoft 365 tenant, a supplier connection or an exposed remote access service. An assumed-breach scenario, starting from a compromised user, often tells you more than another external scan.
- Ask "how far could they get?" The question that matters is whether an attacker could disrupt or corrupt the service, not just whether a vulnerability exists. Your report should show attack paths, not just individual findings.
- Translate the findings. Each significant finding should say which service it affects, what the plausible impact is, and who owns the fix. That's what your board and your self-assessment need.
- Close the loop. Retest and record that the issues are fixed. Record remediation and retest so the evidence reflects the current position.
What a supervisor or auditor will look for
- Testing that is proportionate to the firm's size and the importance of the service.
- A clear link between the test scope and the important business services.
- Independence: the people testing aren't the people who built or run the system.
- Evidence of remediation and retest, not just a report on file.
- Board visibility of the results.
The bottom line
You don't need a CBEST-scale red team to satisfy operational resilience expectations. You do need testing that starts from your important business services, follows realistic attack paths, and produces findings your board can understand. That is a scoping decision more than a budget decision.
FAQs
Does the FCA require penetration testing?
Not by name for most firms. Its operational resilience rules require firms to test their ability to stay within impact tolerances under severe but plausible scenarios, and independent security testing can help provide evidence for cyber scenarios.
How often should FCA-regulated firms pen test?
The FCA requires an up-to-date scenario-testing plan and regular review. Set the frequency of penetration testing according to your risks, services and material changes.
Sources & further reading
Talk to SMARTSEC
Need testing that doubles as resilience evidence?
Fixed-price testing, scoped and delivered by a senior tester, with live findings on the SMARTSEC client platform.
See our financial services testing →