Articles - What FCA supervision means for governance and insurance

By Chris Rigg, Executive Director and Richard Langdon, Head of Business Development, Financial Institutions, Howden

The operational resilience conversation has changed. Not because the rules have changed. Because the regulator has.

For several years, alternative investment managers have invested heavily in identifying critical business services, mapping dependencies and testing disruption scenarios. Those capabilities are now embedded across much of the industry.

The FCA has noticed, and in its recent supervisory activity suggested the conversation is moving beyond implementation. Increasingly, the question isn’t whether firms have a framework. It’s whether that framework reflects how the business really operates and whether boards understand where operational risk now sits.¹

As the FCA puts it, firms should treat resilience as “a core business capability, integrated into strategic planning... rather than as a standalone exercise.”¹

That’s a subtle shift, but one with much wider implications than compliance alone.

Portfolio letters, thematic reviews and supervisory observations are more than regulatory updates. Read collectively, they offer an independent view of the operational risks that continue to challenge firms across the market.

Rather than waiting for an incident or a regulatory finding to expose weaknesses, firms can use those observations to test their own assumptions.

The question is no longer simply “Are we compliant?” It’s increasingly “If the regulator continues to identify these weaknesses elsewhere, could they exist within our business too?”

That makes supervisory insight more than a compliance exercise. It becomes a governance tool.

Yet many of the issues attracting regulatory attention, supplier failure, cyber events, technology outages and governance weaknesses, share one characteristic: they can all create significant financial loss.

This is where supervisory insight becomes particularly valuable.

Alternative investment managers have transformed the way they operate. Outsourcing has increased. Technology has become more interconnected. Critical services increasingly depend on external providers rather than internal infrastructure.

Those changes affect far more than operational resilience. They also change the nature of financial risk.

The rapid adoption of generative AI is a good example. Many firms are embedding AI into research, operations and client-facing processes, often through third-party platforms. While these technologies offer clear opportunities, they also introduce new questions around governance, accountability, intellectual property, data security and third-party dependency.

The issue isn’t whether firms should adopt AI. It’s whether the controls, resilience planning and insurance arrangements supporting that adoption are evolving at the same pace. As with cloud technology before it, innovation changes the operational risk profile and supervisory expectations are evolving alongside it.

Verizon’s 2025 Data Breach Investigations Report found that around 30% of breaches involved a third party, highlighting the growing financial impact of supplier-related incidents.2

The question therefore isn’t whether firms have insurance. It’s whether their insurance has evolved at the same pace as their operating model. Insurance shouldn’t be the last conversation after resilience planning. It should be one of the first.

Reviewing insurance once a year as part of the renewal process may have been appropriate when operating models changed slowly. Today’s environment is different. Technology, outsourcing arrangements and supplier ecosystems evolve continuously, meaning firms’ exposures evolve too.

Insurance should therefore be reviewed alongside governance discussions, resilience assessments and scenario testing, not because regulation requires it, but because good governance does.

That doesn’t mean buying more insurance. It means reviewing whether the cover, limits and scope of protection remain aligned with an evolving operating model, changing supplier dependencies and emerging operational risks. In a world where supervision increasingly focuses on outcomes rather than frameworks, regular insurance reviews should become part of good governance, not just good procurement.

Get in touch

If you'd like to discuss how your governance, operational resilience and insurance arrangements align with your current operating model, please get in touch.

[Photo of Chris Rigg]