Azure Security and Compliance for UK Financial Services: FCA and ICO Requirements 2026

Azure Security for UK Financial Services: FCA and ICO Compliance 2026

UK financial services firms face a dual compliance burden on cloud infrastructure: FCA operational resilience requirements (PS21/3 and the 2025 implementation deadline extensions) and ICO data protection standards under UK GDPR. Azure provides the tooling to meet both, but it requires deliberate configuration — the default Azure deployment does not meet either framework's requirements out of the box.

FCA Operational Resilience Requirements

FCA PS21/3 requires FCA-regulated firms to: Identify important business services. Set impact tolerances (maximum tolerable disruption) for each. Map the resources (systems, people, third parties) supporting each service. Test that they can remain within impact tolerances during severe but plausible disruption scenarios. Self-assess annually.

For Azure-hosted workloads, the mapping exercise must identify which Azure services support each important business service. Azure's service health history and SLA documentation feed directly into the impact tolerance assessment.

Azure Configuration for FCA Operational Resilience

Availability Zones: Deploy critical workloads across Azure Availability Zones within the UK South region. AZs are physically separate datacentres with independent power, cooling, and networking. AZ-redundant deployments achieve 99.99% availability SLA vs 99.9% for single-zone. This directly supports demonstrating resilience against single datacentre failure.

Azure Site Recovery: For DR beyond AZ failure, use Azure Site Recovery to replicate VMs to UK West (the Azure paired region for UK South). Configure RPO (Recovery Point Objective) and RTO (Recovery Time Objective) targets aligned with your FCA impact tolerances.

Chaos engineering testing: The FCA requires testing resilience scenarios. Use Azure Chaos Studio to inject controlled failures (VM shutdown, network latency, dependency unavailability) and verify the system remains within impact tolerances. Document the test results for FCA self-assessment.

ICO Data Protection Requirements on Azure

Data residency: Personal data must be processed within the UK or a country with adequate data protection. Azure UK South (London) and UK West (Cardiff) are the correct regions for UK personal data processing. Do not deploy workloads containing UK personal data to European or US regions without completing a Transfer Risk Assessment.

Data Processing Agreement: Microsoft's DPA with Azure customers is available and must be in place before processing personal data. This is automatically included in the Microsoft Customer Agreement (MCA) and Enterprise Agreement (EA). Verify the DPA is signed and documented.

Encryption: Data at rest: Azure Storage Service Encryption (enabled by default) with customer-managed keys in Azure Key Vault for sensitive data. Data in transit: Enforce TLS 1.2+ on all endpoints. Disable TLS 1.0 and 1.1 in Azure Application Gateway and App Service. Key management: Customer-managed keys (CMK) via Azure Key Vault with HSM backing for the highest assurance level.

Access control: Microsoft Entra ID (Azure AD) with Privileged Identity Management (PIM) for just-in-time access to sensitive resources. Conditional Access policies requiring MFA for all Azure portal access. No standing access to production data environments — all admin access through approved PIM roles with approval workflow.

Security Monitoring for FCA and ICO

Microsoft Defender for Cloud: Enable at Standard tier across all subscriptions. Defender for Cloud provides continuous security posture assessment against CIS and Azure Security Benchmark, threat detection for VMs, databases, storage, and containers, regulatory compliance dashboard showing status against GDPR, ISO 27001, PCI DSS, and FCA-aligned controls.

Microsoft Sentinel: Deploy Sentinel for SIEM and SOAR capabilities. Connect all Azure resource logs, Microsoft Entra ID sign-in logs, and application logs. Configure detection rules for: privileged account access outside business hours, bulk data access or export events, failed MFA attempts, geographic anomalies in sign-in patterns. ICO breach notification: The UK GDPR requires notification of personal data breaches to the ICO within 72 hours of becoming aware. Sentinel's incident management capabilities support this timeline with automated alerting and evidence collection.

Techseria configures Azure security and compliance for UK financial services firms. Book a Strategy Session to discuss your FCA and ICO compliance requirements.