Financial services
IT support for financial services that must prove control
Regulators expect you to stay in control of the technology and suppliers your services depend on. Our IT support for financial services runs Mac and Windows estates for trading companies and other regulated businesses, and gives you the records to show it.
The regulated business IT review
- Scope agreed with you before we start
- A map of the IT behind your key services
- Patch, backup and recovery evidence
- Supplier and contract points to raise
- A written report you keep
Trusted by teams across UK government, healthcare, education, charities, financial services and global brands
Enforced updates at one trading company
98%
of Macs up to date, up from 65%
4 weeks
to reach that level of update compliance
250 Macs
fixed within 7 days after a failed macOS update
Source: our global trading company case study, a fleet of around 1,000 Macs. Client name withheld.
Where IT risk shows up in a financial business
None of these are unusual. What matters is whether you find out from your own reports or from an incident.
A security update that waits
People postpone updates on busy days, and nobody can say which machines are behind. What we do: enforce updates to a deadline with declarative device management in Jamf, and report status from every device.
A supplier you cannot map
Your important services depend on systems and providers that nobody has written down. What we do: document the IT and third parties behind each service, so resilience testing starts from facts.
Admin rights everywhere
Traders and analysts install their own tools, and every laptop becomes a way in. What we do: remove standing admin rights and give people a controlled way to get the software they need.
Recovery nobody has tested
Backups run every night, but no one knows how long a restore would take. What we do: test restores, write recovery steps and record the results for your resilience file.
The rules that shape IT in a regulated business
This is a general summary of published regulation, not compliance advice. We provide the IT controls, documentation and evidence. Your compliance team decides what the rules require for your business.
Operational resilience
The FCA’s operational resilience rules came into force on 31 March 2022, and in-scope businesses had until 31 March 2025 to show they could stay within impact tolerances for each important business service. For IT, that means an accurate record of the systems behind each service, tested backups and recovery steps, and a plan for communicating during an incident.
Outsourcing to an IT provider
When a regulated business uses an IT provider, the business stays accountable. The FCA’s outsourcing rules in SYSC 8 set expectations for due diligence, written contracts, access and audit rights, data security, business continuity and exit plans. We expect to be asked about all of these, and we answer in writing.
Incident and third-party reporting from March 2027
The FCA’s policy statement PS26/2 on operational incident and third-party reporting takes effect on 18 March 2027. Businesses with a Part 4A permission and payment service providers will need to report operational incidents. Banks, enhanced-scope SM&CR businesses and some infrastructure providers will also need to notify the FCA of material third-party arrangements. Good IT records now make both easier: what happened, when, which systems were affected and which suppliers were involved.
Cyber Essentials
Cyber Essentials is not an FCA rule, but clients, insurers and counterparties may ask for it. The NCSC describes it as the minimum standard of cyber security the government recommends for organisations of all sizes. We prepare Mac and Windows estates for Cyber Essentials and Cyber Essentials Plus.
Mac-heavy trading desks
Some financial businesses put Macs on the desk while operations and finance run Windows. Too often the Macs are the part of the estate with the weakest controls, because the IT team knows Windows best.
We manage Macs with Jamf and Windows with Microsoft Intune, and connect both to Microsoft Entra ID, so one set of conditional access rules decides which devices reach your data. Encryption, updates, endpoint protection and admin rights are reported the same way on both.
Our offices are in Canary Wharf and Dubai, and we also support businesses with teams in the DIFC and the wider Gulf.
Financial businesses we can name
- IG
- YuLife
- A global trading company, in our case studies
Related client work
Financial services · Global
Global trading company
Apple software updates enforced by deadline across around 1,000 Macs, and a failed update fixed across the fleet.
Read the case studyLocation
IT for Canary Wharf businesses
Our Canary Wharf page covers operational resilience, third-party risk and DORA for businesses with EU operations in more detail.
IT support in Canary WharfFrequently asked questions
Can’t see your question? Call us on +44 20 7550 9103 or book a call.
Do you work with FCA-regulated businesses?
Yes. We support financial services organisations, including trading companies, that must meet operational resilience and outsourcing rules. We provide the IT controls, documentation and evidence; your compliance team decides what the rules require.
What does SYSC 8 mean for choosing an IT provider?
The FCA’s outsourcing rules mean your business stays accountable for outsourced IT. Expect to check the provider’s security, business continuity, access and audit rights, and exit arrangements, and to agree them in writing.
What changes in March 2027?
The FCA’s PS26/2 rules on operational incident and third-party reporting take effect on 18 March 2027. Businesses with a Part 4A permission and payment service providers will need to report operational incidents. Banks, enhanced-scope businesses under the Senior Managers and Certification Regime and some infrastructure providers will also need to notify the FCA of material third-party arrangements.
Can you enforce macOS updates on traders’ Macs?
Yes. We use declarative device management in Jamf to set a target version and deadline. For one trading company, around 1,000 Macs went from 65% to 98% up to date in 4 weeks.
Do you support Windows as well as Mac?
Yes. We manage Windows with Microsoft Intune and Macs with Jamf, both connected to Microsoft Entra ID, so one team covers the whole estate. Conditional Access treats Macs and PCs the same way, and the evidence for encryption, updates and sign-in comes straight from Jamf, Intune and Microsoft 365 reports.
How is the work priced?
Managed IT is a fixed monthly fee per device, from £25 per device per month, excluding VAT and licences. Reviews are a fixed price for an agreed scope. See pricing.
Book a regulated business IT review
Tell us which services matter most and who your IT suppliers are. We will agree the scope with you and show you what your records would look like to a regulator.
London head office
Postremo IT Limited
Level 24, One Canada Square
Canary Wharf
London E14 5AB
+44 20 7550 9103
info@postremoit.com
Also in Dubai
Business Bay, Dubai