Brass wires laid flat as ruled lines across a sheet of cream paper beside a model city
Operational resilience · Third-party risk

Know what your firm depends on. Prove it when asked.

AEDRA is an operational resilience consultancy for payment, e-money and other regulated firms, and the suppliers that serve them. We work out which suppliers your important business services depend on, test what happens if one fails, and keep the evidence ready for your board and the FCA.

Get a free Materiality Snapshot Book a 30-minute call

Every payment you process depends on someone else's system.

Your app runs on a platform. The platform runs on a cloud. The cloud has suppliers of its own.

Some of those arrangements are material. The work is knowing which, and why.

Every arrangement written down, with its reason. Ready when you're asked.

In force nowSYSC 15A: mapping, testing and a self-assessment you keep up to date.
18 March 2027The material third-party register and incident reporting rules apply.
After thatSubmit the register yearly, notify the FCA before material changes, and keep testing.
The 2027 register

Free template.
Hard judgement.

You may have 100 or more suppliers. For each arrangement, you have to decide whether it is material and be able to say why. For the material ones, you also need details that only your suppliers hold.

18.03.27

The timetable

The rules apply from 18 March 2027. Once the FCA tells you the submission window is open, you have 90 calendar days to submit your register through FCA RegData. After that, you submit it every year.

FG26/4

Factors for each arrangement

You judge each arrangement on its own, against the factors in the FCA's guidance and your important business services. An arrangement with the same supplier can be material for you and not for another firm.

?

The borderline cases

Cloud hosting is usually material. Your KYC provider, CRM and specialist software are harder to judge, and those are the decisions you will need to be able to explain.

Materiality Check

Try it on your
own suppliers.

Choose the kinds of supplier you use. Each one is sorted into the group it usually falls in, with a reason.

Likely material

0

Borderline

0

Likely not material

0

That's 0 kinds of supplier sorted. Your firm may have 100 or more. Send us your full list and we'll sort all of it, free, within 48 hours.

Send your supplier list

A guide only, based on the FCA's examples in FG26/4 and on typical arrangements. Your own important business services and contracts can change any of these results. This is not legal advice.

Start with a
free Snapshot.

Send us your supplier list. Supplier names and what each one does are enough, and you can swap any name you'd rather not share for a label such as "Cloud provider A". Within 48 hours you get a first view of where each arrangement sits.

Materiality Snapshot · free

See where you stand before you commit to anything

Every arrangement on your list goes into one of three groups: likely material, borderline, or likely not material. Each one gets a one-line reason. For the borderline ones, we tell you which way each one leans and the one fact that would settle it.

You get a short PDF and a Register starter: a spreadsheet laid out in the FCA template's own columns. It's free, and yours to keep whether or not you work with us.

It's a first view based on your list alone, not a final answer.

Want to see one first? Ask for the sample, built for a fictional e-money firm.

This opens an email to us with your details filled in. Attach your supplier list before you send it, or send the list later. A spreadsheet or a pasted list is fine.

What we do,
and what it costs.

Every fee is fixed in writing before work starts, and each service can be bought on its own. You can start with the free Snapshot or the register, or go straight to a Critical Dependency Review. Fees exclude VAT.

Step 1StartRegister Ready, Incident Readiness, Supplier Ready
Step 2DiagnoseCritical Dependency Review
Step 3TestScenario testing
Step 4ManageChange & Assurance, Resilience Programme
StartFor firms that must submit the register

Register Ready

£4,500fixed

We assess your arrangements, write down the reasons and fill in the FCA's template. It normally takes about two weeks, and three at most. The register is then ready for you to submit. It is for any firm in scope of the register, including authorised payment and e-money institutions, banks, building societies and Solvency II insurers.

What's included
  • Every arrangement on your supplier list assessed for materiality, with a full written reason for each material and borderline one
  • The contracts for your material and borderline arrangements reviewed, with gaps flagged in the exit, subcontracting and data-location terms
  • Your suppliers chased for the details only they hold, in your name and with your written authority, for up to three weeks. Anything still missing is listed in a gap report, so it doesn't hold up your submission
  • The FCA's register template filled in and ready for you to submit, with a list of the material arrangements you must tell the FCA about before they change
Start with the free Snapshot
StartFor any authorised firm

Incident Readiness

£2,500fixed

From 18 March 2027 you must report an operational incident within 24 hours of deciding it meets the FCA's thresholds. If you are a payment service provider, you have 4 hours from first detecting it. The thresholds are principles-based, so the decision is yours to make and defend. We write down what the thresholds mean for your firm and build your decision tree and reporting playbook, so you can make that decision quickly and explain it afterwards.

What's included
  • What the FCA's thresholds mean for your services and your customers, written down
  • A decision tree for deciding whether an incident is reportable, and a log for recording the borderline decisions
  • A reporting playbook: who decides, who submits through FCA Connect, and what information to have ready
  • One facilitated tabletop exercise with your team, and an evidence pack to keep
Ask about Incident Readiness
StartFor suppliers to financial firms

Supplier Ready

from £3,500

From 2027 your UK regulated clients will need the same details from you for their registers. We build one data pack that you can send to all of them.

What's included
  • Covers your services, your subcontractors, what happens if your service fails, and your contract and exit terms
  • Laid out to match the fields in the FCA's register template
  • DORA mapping included if you also serve financial firms in the EU
Ask about Supplier Ready
DiagnoseFor firms under SYSC 15A

Critical Dependency Review

£15,000fixed

We map what each of your important business services depends on, down to your suppliers' own suppliers. You see which dependencies could break a service and where your contracts fall short of your impact tolerances. You get a plan your board can act on, with what to fix first.

Ask about a Dependency Review
TestFor firms under SYSC 15A

Scenario testing

from £8,000

We design and run severe but plausible scenarios, including a supplier failing, against your impact tolerances. You get a full record: the design, who took part, the timings, the gaps found and the fixes agreed.

Ask about testing
ManageFor firms in scope of the register

Third-Party Change & Assurance

£8,000a year

A fixed yearly allowance for new and changed arrangements. It covers a set number of new-arrangement assessments, significant-change reviews and contract reviews, with notifications drafted for you to submit through FCA Connect. It also includes a quarterly review of open actions, and your register refreshed for the annual submission. Extra work is quoted per item before we do it.

Ask about Change & Assurance
ManageFor firms under SYSC 15A

Resilience Programme

from £8,000a year

We do your yearly SYSC 15A work with you: review your important business services and impact tolerances, update your mapping, run a scenario test, and draft your self-assessment for your board to approve. There are three levels, priced on how complex your services and suppliers are, not on the type of firm.

Need a named resilience lead? Ask about Managed Resilience.

Ask about the Programme
Not sure where to start?
The free Snapshot is the simplest place to start. If your question is about incidents, testing or your self-assessment, book a 30-minute call and we'll tell you what you need, and what you don't.

How to
get started.

You see a first answer before you pay anything, and the fee is fixed before any paid work starts.

First

Send your list

Supplier names and what each one does are enough. Nothing confidential is needed. If your question isn't about the register, tell us about your services instead.

Within 48 hours

Snapshot, or a call

We send your free Snapshot, with a reason for every result. If you'd rather talk first, book a 30-minute call.

Before any paid work

Agree a fixed fee

We agree the scope, the fee and how your data is handled, in writing, before you share any contracts.

On delivery

Everything in writing

Every judgement is recorded with its reason. Anything that goes to the FCA, you submit yourself.

Operational resilience
is what we do.

Our background is in sectors where one failed dependency can stop an operation: critical infrastructure, complex supply chains and other heavily regulated industries. The discipline is the same in every sector: know what matters, know what it depends on, and be able to prove it in writing.

How we work

  • Start from what mattersWe judge each arrangement against your important business services and impact tolerances. A supplier matters because of what your important business services rely on it for.
  • Map the chainWe map your suppliers, their subcontractors, and the points where one failure would spread. That shows the dependencies a supplier spreadsheet misses.
  • Assess, and write down whyWe assess every arrangement against the materiality factors in the FCA's guidance. Every material or borderline result comes with a written reason a supervisor can follow.
  • Close the gapsWe find the missing contract terms, supplier details and exit plans, chase your suppliers for them, and report what is still outstanding.
  • Test itWe run severe but plausible scenarios against your impact tolerances and record them in full.
  • Keep it up to dateWe help you update your mapping, tests and self-assessment every year, and whenever a material arrangement changes.

What you can rely on

  • Clear limitsWe don't give legal advice, certify compliance, submit anything to the FCA for you, or respond to live incidents. Your firm makes the final decisions.
  • Fixed feesScope and fee are agreed in writing before work starts. Any extra work is quoted before we do it.
  • A person makes every judgementSoftware helps process the documents. Every judgement is made and signed off by a person.
  • Your data, handled properlyYou get our written data-handling statement before you share any contracts.

Questions
and answers.

Do you submit the register for us?
No. We prepare it so it's ready to go, and you submit it through FCA RegData.
Is this legal advice?
No. You get the assessment, the reasons and the completed template. If a contract question needs a lawyer, we'll tell you.
Are we in scope?
The register applies to banks and building societies, authorised payment and e-money institutions, Solvency II insurers, enhanced-scope SM&CR firms, CASS large firms, and credit unions with at least £50m in total assets, among others. If you're not sure, tell us what kind of firm you are and we'll check.
Do you only do registers?
No. We are an operational resilience consultancy, and the register is one place to start. The wider work is under SYSC 15A: dependency reviews, scenario testing and the annual self-assessment.
We already have a SYSC 15A self-assessment. Where do you help?
With third-party mapping and scenario testing. Those are the areas where the FCA's review of 27 March 2026 asked firms to do more.
What happens after the register is submitted?
You submit the register again every year, and tell the FCA about new or significantly changed material arrangements before you commit to them. Third-Party Change & Assurance covers that work. The Resilience Programme covers your wider SYSC 15A work, and its two higher levels include the Change & Assurance allowance. You only buy what you need.
What do you need from us?
Your supplier list to begin with. For Register Ready we also ask for your important business services and impact tolerances, your existing outsourcing register, and the contracts for material and borderline arrangements. We ask for those later, once the scope and data handling are agreed.
Where are you based?
In the UK. We work with regulated firms, and the suppliers that serve them, across the UK and Europe.
Will you contact our suppliers directly?
Yes, with your written authority and in your name. We ask for the register details only your suppliers hold, and chase for up to three weeks. Anything still missing is listed in a gap report, so one slow supplier doesn't hold up your submission.
How do you handle our data?
The Snapshot only needs supplier names and what each one does, and you can replace any name with a label. Before you share any contracts, you get our written data-handling statement: where data is processed, who can access it, and when it's deleted.
Do you use AI?
Yes. We use it to extract and compare information from documents such as contracts and supplier lists, to fill in templates, to check for gaps and to prepare drafts. Every judgement is made and signed off by a person. Our data-handling statement sets out exactly how we use it, and you get it before you share any contracts. We can work without it if your policy requires that; if that adds hours, the fee is agreed first.
Why not fill in the template ourselves?
You can. The template is the easy part. The hard part is deciding what's material, writing reasons that stand up to a supervisor's questions, and getting details from suppliers you don't control.

Send the list.
See where you stand.

Send us your supplier list and get a Materiality Snapshot back within 48 hours. Or book a 30-minute call and talk it through first.

Get a free Materiality Snapshot Book a 30-minute call
Email[email protected]
BasedUK
Working acrossThe UK and Europe