How UK financial services firms use Microsoft Power Platform while meeting FCA regulatory requirements, covering data governance, audit trails, SMCR accountability, and Consumer Duty obligations.
UK financial services firms operating under FCA supervision can absolutely use Microsoft Power Platform, and hundreds already do. But deploying Power Platform in an FCA-regulated environment requires specific governance controls, data architecture decisions, and documentation practices that most general-purpose Power Platform guides do not cover.
Is Power Platform Suitable for FCA-Regulated Firms?
Yes, with the right governance framework. Power Platform runs on Microsoft Azure, which holds FCA-relevant certifications including ISO 27001, SOC 2 Type II, and PCI DSS. Microsoft's Financial Services Cloud offerings provide additional controls aligned with FCA guidance on operational resilience (PS21/3) and cloud and outsourcing (SS2/21).
The FCA does not prohibit use of cloud-based tools for regulated activities. It requires firms to demonstrate that they understand and manage the risks, particularly around data governance, operational resilience, and third-party dependency.
Key FCA Regulatory Considerations
Operational Resilience (PS21/3) Power Platform solutions supporting important business services must be within scope of your operational resilience framework. Define impact tolerances, map dependencies, and test recoverability. Document Power Platform as a third-party technology dependency in your operational resilience documentation.
Cloud Outsourcing (SS2/21) If Power Platform processes regulated data on behalf of the business, it may trigger outsourcing notification requirements. The FCA's SS2/21 guidance requires documented exit plans, contractual protections, and concentration risk assessment. Microsoft's FSI cloud contract addendum addresses most SS2/21 requirements.
Consumer Duty (PS22/9) Consumer Duty requires firms to monitor customer outcomes and evidence that fair value is being delivered. Power BI dashboards and Power Automate workflows can be powerful tools for the consumer outcome monitoring that Consumer Duty demands, but they must produce auditable, date-stamped evidence.
SMCR Accountability Any Power Platform solution supporting an activity with a Senior Manager Function holder accountable for it must maintain complete audit trails. Dataverse's built-in audit log captures all record changes with user, timestamp, and before/after values. This is the right data store for SMCR-accountable processes.
Data Architecture for FCA Compliance
Use Dataverse, Not SharePoint, for Regulated Data: Dataverse provides row-level security, field-level security, column-level encryption, and an immutable audit trail, all of which are typically required for FCA-regulated process data. SharePoint is appropriate for document storage and collaboration, not for structured regulated data that requires granular access control and audit.
- Enable Dataverse auditing at the environment and table level for all tables holding regulated data
- Configure Dataverse for the UK region (EU Data Boundary) to meet FCA data residency expectations
- Implement column-level security for sensitive fields (account numbers, NI numbers, salary data)
- Use Managed Environments to enforce DLP policies and prevent regulated data flowing to unsanctioned external connectors
Common compliance mistake: Using Power Automate to send customer data to free consumer-tier connectors (Gmail, personal OneDrive, etc.) as part of a workflow. DLP policies must explicitly block these connectors in production environments holding FCA-regulated data.
What FCA-Regulated Firms Are Actually Building
- KYC and AML onboarding workflows with complete audit trail and automated SAR generation
- Consumer Duty outcome monitoring dashboards in Power BI feeding from CRM and product data
- Complaints management systems with FCA-aligned 8-week resolution tracking and FOS escalation workflows
- Regulatory capital and liquidity reporting automation via Power Automate pulling from treasury systems
- Adviser suitability and vulnerability identification tools aligned with Consumer Duty fair value requirements
