How Can I Assess Technology Concentration Risk Across My Platform Providers?
Short answer
A quick answer first, then the fuller context below.
Concentration risk in platform technology is a growing concern for the FCA. Learn how to assess and manage this risk across your platform providers.
Detailed answer
The fuller context, trade-offs and practical steps behind the short answer.
This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about your choice of platform.
How Can I Assess Technology Concentration Risk Across My Platform Providers?
You have carefully constructed a panel of wrap platforms, diversifying your recommendations to avoid placing all your clients’ eggs in one basket. But what if, beneath the surface, your supposedly diverse panel is all running on the same engine? This is technology concentration risk, and it is one of the most significant, yet least understood, systemic risks in the UK advisory market today.
The UK platform market is dominated by a small number of large, third-party technology providers. Firms like FNZ, SEI, and Bravura provide the underlying technology for a huge number of platforms that, to the end-user, look like separate and competing businesses. This creates a dangerous illusion of diversity.
When one of these major technology providers has a problem – whether it is a major outage, a cyber-attack, or a regulatory intervention from the FCA – the impact is not felt by one platform. It is felt by every platform that uses their technology. It is a systemic risk that can bring a huge swathe of the market to a standstill.
Why This Is Your Problem
As a financial adviser, you have a duty to act in your clients’ best interests. This includes managing the risks associated with the platforms you recommend. If you have, in good faith, spread your clients across three different platforms, believing you have diversified, but all three are powered by the same underlying technology provider, you have not diversified at all. You have simply created a single point of failure for your entire client bank.
The FCA is acutely aware of this issue. Their recent interventions against major technology providers are a clear sign that they are concerned about the systemic risk posed by this concentration.
A Practical Guide to Assessing Concentration Risk
Assessing technology concentration risk needs to become a core component of your platform due to diligence and your firm’s overall risk management framework. Here is a practical, three-step approach:
Step 1: Map Your Dependencies
You need to look “under the bonnet” of every platform on your panel and identify their underlying technology provider. This information is not always publicly available, so you will need to ask the platforms directly. You should create a simple map:
| Platform on Your Panel | Underlying Technology Provider |
|---|---|
| Platform A | FNZ |
| Platform B | Bravura |
| Platform C | FNZ |
| Platform D | SEI |
| Platform E | In-house |
This simple exercise will immediately reveal your exposure to concentration risk. In this example, you have a significant concentration with FNZ.
Step 2: Quantify Your Exposure
Once you have mapped your dependencies, you need to quantify your exposure. For each underlying technology provider, you should calculate:
- The total value of client assets that are held on platforms using their technology.
- The total number of clients who are on those platforms.
- The percentage of your firm’s revenue that is derived from those platforms.
This will give you a clear, data-driven picture of the potential impact on your business if that technology provider were to fail.
Step 3: Mitigate the Risk
Once you understand your exposure, you can take steps to mitigate it. This could include:
- Diversifying your platform panel: You may need to add a new platform to your panel that uses a different technology provider or has its own proprietary technology.
- Setting exposure limits: You could set internal limits on the percentage of your firm’s assets that can be held with any single underlying technology provider.
- Developing a contingency plan: What is your plan if a major technology provider has a prolonged outage? How will you communicate with clients? Do you have an alternative platform ready to go?
The Bottom Line: Diversity is More Than Skin Deep
True diversification is about more than just having a panel of platforms with different brand names. It is about understanding the underlying infrastructure and ensuring that you are not exposed to a single point of failure.
The FCA has put the market on notice. Technology concentration risk is a real and present danger. As a financial adviser, you have a duty to understand it, to measure it, and to manage it.
Ignoring it is no longer an option. It is a failure of due diligence and a failure to act in your clients’ best interests.
Take the Next Step
If you are ready to move from theory to action, I can help. My AI Audit gives you a comprehensive assessment of your firm's AI readiness, identifying the gaps in your governance, the risks in your current tooling, and a clear roadmap to get you where you need to be.
Book a Discovery Call → or learn more about the AI Audit.
FAQs
Direct follow-up answers written for searchers, buyers and internal decision makers.
What should a regulated financial services firm ask a vendor before relying on this system?
Ask what data the system receives, where it is processed, whether it is used for training, how changes are tested, what audit evidence is available and who is responsible when something goes wrong. A useful vendor answer should give evidence, not just reassurance.
What evidence should be kept for due diligence?
Keep the vendor responses, contract terms, data-processing position, security evidence, model or workflow limitations, approval decision, review owner and renewal date. The point is to show why the system was acceptable for the specific client or operational use case.
How often should the review be repeated?
Repeat the review when the vendor changes material terms, adds AI features, changes subprocessors, expands data use or becomes important to a regulated workflow. Annual review is useful, but high-risk tools need event-based review as well.
Where do firms usually get this wrong?
They treat vendor assurance as a procurement exercise rather than an operating control. The risk is not just whether the supplier looks credible. It is whether the firm can prove the tool is suitable for the data, client impact and decision being supported.
Need help implementing this?
If this question points to a live process, policy or supplier decision, the next step is usually to turn the answer into a controlled plan. These services are the most relevant starting points.
AI governance consulting
Create policies, approval routes, ownership and controls that teams can actually use day to day.
AI governance consultingSecure AI implementation
Put privacy, supplier review, data boundaries, testing and staff guidance into the implementation plan from the start.
secure AI implementationAI workflow automation
Turn repeatable admin, client service and reporting work into controlled workflows with clear human review points.
AI workflow automation support