In short: Security awareness training for financial services firms helps FCA-regulated businesses manage the people side of cyber and operational risk: phishing, impersonation of customers and colleagues, social engineering of service teams and payment fraud. It supports operational resilience and governance expectations, and produces records that show the board and regulators the risk is managed.
The regulatory context
There is no single FCA rule that prescribes a security awareness course, but several parts of the regime make staff awareness important. In general terms:
- Systems and controls: firms are expected to maintain adequate systems and controls for managing the risks they face, and cyber risk is one of them
- Operational resilience: under the FCA's operational resilience rules (PS21/3), firms had to be able to remain within impact tolerances for their important business services in a severe but plausible disruption by 31 March 2025; a cyber incident started by a phishing email is one such scenario
- Incident and third party reporting: the FCA's final rules on operational incident and third party reporting (PS26/2) take effect on 18 March 2027
- Senior management accountability: senior managers need to understand and oversee cyber risk; see cyber security training for board members
- Customer outcomes: fraud and data loss directly harm customers, which the FCA's focus on good customer outcomes makes a board-level matter
For firms with EU operations, the EU's Digital Operational Resilience Act (DORA), which has applied since 17 January 2025, includes ICT security awareness and training requirements for in-scope EU entities. This page is general information, not legal or regulatory advice; check the FCA Handbook and your own obligations.
Fraud and impersonation of customers
Financial services staff face social engineering from two directions: criminals pretending to be customers to take over accounts, and criminals pretending to be the firm to defraud customers.
| Threat | What staff should do |
|---|---|
| A caller or emailer impersonates a customer to change contact details or bank accounts | Follow identity verification procedures fully, every time, and flag unusual urgency |
| Criminals spoof the firm's name to customers | Know how to escalate reports from customers and what the firm will never ask for |
| A 'senior manager' requests an urgent payment or data transfer | Verify through a separate channel; dual authorisation for payments |
| Authorised push payment scams against customers | Recognise warning signs during customer contact and escalate concerns |
| Fake regulator or auditor contact | Verify independently before sharing anything |
The Payment Systems Regulator's mandatory reimbursement rules for authorised push payment fraud, in force since 7 October 2024, give payment firms a direct financial interest in stopping it. Our social engineering training, help desk social engineering training and business email compromise training pages cover these scenarios.
Role-based training in a regulated firm
Map training to roles and to your important business services:
- Customer service and contact centre teams: identity verification, account takeover attempts, vulnerable customers being coached by fraudsters
- Payments and finance operations: payment diversion, CEO fraud, verification and dual authorisation
- IT and service desk: password and MFA reset requests, privileged access; see help desk social engineering training
- Advisers and relationship managers: spear phishing, client impersonation and secure communication
- Senior managers and the board: cyber governance, oversight of resilience and targeted deepfake and spear phishing awareness; see deepfake awareness training
Everyone needs the core curriculum on our cyber security awareness training page, plus GDPR training for customer data.
Evidence the board and regulators can use
Regulated firms need records, not just activity:
- Training assignments and completion by person, role and business area
- Phishing simulation trends, especially report rate and time to report
- Repeat-clicker coaching records
- Policy acknowledgement for information security and acceptable use
- Links between training themes and the scenarios in your operational resilience testing
See measuring security awareness training for a board reporting template and human risk management for risk scoring that goes beyond completion figures.
Choosing a platform
Firms with Microsoft 365 E5 already have Attack Simulation Training, including its predicted compromise rate. Others may prefer a human risk platform such as usecure, or training paired with email security from IRONSCALES, Proofpoint Essentials or Hornetsecurity, now part of Proofpoint. For a tailored, expert-run exercise, such as an executive spear phishing test, the Bitdefender Phishing Simulation Service is consultant-led. Compare them on our platforms compared page.
How we help financial services firms
We map training to your roles and important business services, run simulations themed on the fraud your customers and staff actually see, and produce reports for your board and risk committee. Our managed security awareness training service keeps the programme running and the evidence current.
Contact us to discuss training for your firm.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does the FCA require security awareness training?
There is no single FCA rule that prescribes a specific course, but firms are expected to manage cyber risk through adequate systems and controls and to meet operational resilience requirements. Staff training and its records are a practical part of that. This is not regulatory advice.
Does DORA apply to UK firms?
DORA is EU legislation that has applied since 17 January 2025. It applies to in-scope EU financial entities, so UK firms are mainly affected through EU subsidiaries or operations. UK firms follow the FCA and PRA operational resilience regime.
What is the most important training topic for financial services staff?
Verification. Most fraud against firms and their customers relies on someone acting on an unverified request, whether a change of bank details, a password reset or an urgent payment. Training should make independent verification automatic.
How should we report training to the board?
Show trends rather than single figures: report rate and time to report in simulations, completion by business area, repeat-clicker coaching and how training themes link to your operational resilience scenarios.