LicenseCompare

Evidence guide

Cyber and technology evidence for licence applications

How to prepare technology architecture, access controls, cyber resilience, incident response, business continuity, data protection, and platform-control evidence.

Applicant questions

  • - Which systems support onboarding, advice, portfolio management, trading, reporting, registers, client data, and complaints?
  • - Who controls access, changes, incidents, backups, vendors, and recovery?
  • - Could a technology failure affect clients, assets, market conduct, or regulatory reporting?

Why regulators ask

  • - Technology evidence helps regulators assess operational resilience, cyber risk, data protection, and client harm.
  • - Digital financial services models often turn technology design into a licensing evidence issue.
  • - Weak cyber evidence can create doubts about outsourcing, custody, complaint, and reporting controls.

What good looks like

  • - Architecture, data flows, access controls, backups, incident response, and business continuity are documented.
  • - Technology owners and vendors are mapped to regulated workflows.
  • - Testing, access reviews, change control, and incident logs are scheduled.

Documents to prepare

  • - Technology architecture and data flow note.
  • - Access control and privileged-user process.
  • - Cybersecurity and incident response plan.
  • - Business continuity and disaster recovery plan.
  • - Change-control and vendor-security review records.

Red flags

  • - Platform controls are described as product features rather than regulated operating controls.
  • - No one can explain access rights, backups, recovery time, or incident escalation.
  • - A critical vendor stores client data without documented due diligence.

Build steps

  1. 1. Map systems to regulated activities and client harm scenarios.
  2. 2. Assign owners for access, change, incident, vendor, and resilience controls.
  3. 3. Tie technology evidence to outsourcing, custody, complaints, and reporting plans.

Disclaimer

Information on LicenseCompare is for general educational purposes only and does not constitute legal, regulatory, financial, tax, investment, or professional advice. Licensing requirements depend on facts and change over time. Always consult official regulator materials and qualified professional advisers.