DevOps for UK FinTech — FCA PS21/3 Built In

DORA (Digital Operational Resilience Act) and UK FinTech DevOps

DORA (EU Digital Operational Resilience Act): applies to UK FinTechs with EU market access. DORA Article 12 (ICT change management): all ICT changes must be managed, tested, and documented. DORA Article 25 (ICT third-party risk): ICT service providers (including cloud providers) must be assessed. FCA PS21/3 UK equivalent: FCA operational resilience framework for UK-domiciled firms is the UK equivalent of DORA. Practical DevOps implication: (1) change management controls (branch protection, CI/CD pipeline approvals — same as PS21/3), (2) ICT third-party risk (cloud provider SLAs, backup strategies), (3) operational resilience testing (chaos engineering — AWS FIS, quarterly IBS availability tests). ClickMasters configures DevOps for dual compliance (FCA PS21/3 + DORA) simultaneously.

FCA PS21/3 Release Management in DevOps

FCA PS21/3 IBS (Important Business Services) release management: changes to IBS-related services require documented change management. ClickMasters PS21/3 release pipeline: (1) PR created → Jira change request auto-created (PR title → Jira ticket), (2) automated tests pass → CI/CD status check green, (3) 2 engineer approvals required (GitHub branch protection), (4) Change Advisory Board (CAB) approval for high-impact changes (GitHub Environment protection → named CAB approvers), (5) CloudFormation change set reviewed (infrastructure changes require separate approval), (6) deployment (GitHub Actions deploy workflow → CloudFormation apply), (7) post-deployment validation (smoke tests → IBS availability check → if < 99.5% in first 15 minutes → automatic rollback). Immutable audit: every step logged in GitHub audit log + CloudTrail.

FinTech Disaster Recovery and RTO/RPO DevOps

FCA PS21/3 Impact Tolerance: each IBS has a stated maximum tolerable disruption (Impact Tolerance). Typical UK FinTech Impact Tolerances: Payment Initiation IBS: 2 hours maximum disruption. Account Information IBS: 4 hours. DevOps disaster recovery pipeline: (1) multi-region deployment (eu-west-2 primary, eu-west-1 warm standby — DNS failover via Route 53 health checks), (2) RDS Multi-AZ (automated failover < 60 seconds), (3) Automated DR test (monthly scheduled DR drill — Route 53 failover triggered by GitHub Actions scheduled workflow, IBS availability measured from failover to restoration), (4) DR evidence pack (monthly drill results stored in S3 — submitted to FCA as Impact Tolerance evidence). RTO target: < 30 minutes. RPO target: < 1 minute (RDS Multi-AZ synchronous replication).

DevSecOps for FCA-Regulated FinTech

FCA PS21/3 security: every production change must be secure. DevSecOps pipeline: (1) Semgrep SAST (every PR — blocks merge on high-severity security findings), (2) Trivy container scan (every image build — blocks deploy on critical CVEs), (3) OWASP ZAP DAST (weekly scheduled against staging — generates report stored in S3), (4) secrets scanning (Trufflehog — scans all commits for accidental secret exposure), (5) dependency review (GitHub dependency review action — blocks PR if dependency with critical CVE introduced). FCA Consumer Duty: API security controls (WAF OWASP ruleset) protect consumer data — Consumer Duty consumer support outcome. Cyber Essentials Plus annual assessment: CI/CD evidence pack submitted — Dependabot PRs, Trivy scan history, patch compliance report.

FCA PS21/3

FCA PS24/1 (DORA)

Cyber Essentials Plus

ISO 27001

UK GDPR

PCI-DSS