📋 FCA Password Requirements for Regulated Financial Firms 2026

UK financial firms regulated by the Financial Conduct Authority (FCA) in 2026 must implement authentication controls that satisfy multiple overlapping regulatory frameworks. FCA password requirements for regulated firms derive from Operational Resilience (PS21/3), Consumer Duty (PRIN 2A), SYSC rules on governance and risk management, and the FCA's expectation that firms align with NIST SP 800-63B. This guide maps each FCA rule to specific password controls -- length, complexity, rotation, multi-factor authentication, and privileged access management -- and provides a practical implementation roadmap for compliance teams.

The FCA does not give a single checklist of password rules. Instead, it sets outcomes-based expectations across its regulations. Firms must show that their password controls prevent foreseeable consumer harm, support business continuity during disruptions, and satisfy the Senior Managers and Certification Regime (SM&CR) accountability requirements for information security. For financial institutions that also handle cardholder data, see our PCI-DSS v4.0 password requirements guide which covers the Payment Card Industry standards that overlap with FCA obligations.

Operational Resilience (PS21/3) and Password Controls

The FCA's Policy Statement PS21/3, published alongside FG 21/3 (Finalised Guidance on Operational Resilience), requires regulated firms to remain within their impact tolerance for important business services during severe but plausible disruptions. Password controls are directly relevant to operational resilience because compromised credentials are a root cause of operational disruptions in financial services.

The FCA expects firms to identify business services that, if disrupted, could cause harm to consumers or market integrity. For each important business service, firms must map the people, processes, technology, and information assets that support it. Authentication systems -- including password management, MFA infrastructure, and privileged access controls -- are critical technology components in every business service mapping.

Key operational resilience password considerations:

• Privileged access during disruption: If a cyber incident locks out administrative accounts, can your firm recover critical systems within impact tolerances? Automated privileged access management with emergency break-glass procedures is essential.
• Credential compromise response: PS21/3 requires firms to test their ability to respond to and recover from operational disruptions. Password-related scenarios -- including credential theft, insider misuse, and ransomware that encrypts password databases -- must be included in scenario testing.
• Third-party dependency mapping: If your firm relies on a third-party identity provider or password vault service, that dependency must be mapped and its operational resilience assessed.

The FCA's FG 21/3 guidance explicitly states that firms should consider "how they would continue to operate their important business services if a key third-party provider failed." For password management, this means having offline fallback authentication mechanisms and printed recovery codes for critical administrative accounts. For a deeper look at automated controls that support resilience, see our enterprise password policy automation guide.

Consumer Duty and Authentication Expectations

The FCA's Consumer Duty (PRIN 2A) requires firms to deliver good outcomes for retail customers. The cross-cutting rule to avoid foreseeable harm directly applies to password and authentication security. Weak authentication that leads to credential theft and customer data exposure is a foreseeable harm that firms must prevent.

Consumer Duty outcomes relevant to password management include:

• Products and services outcome: Authentication systems must be designed to prevent unauthorised access to customer accounts. This means strong password requirements, MFA, and rate limiting on login attempts.
• Customer support outcome: When customers cannot access their accounts due to authentication failures or forgotten passwords, firms must have accessible and timely password reset processes. Lockout mechanisms must balance security with legitimate customer access.
• Price and value outcome: Firms charging for premium security features -- like hardware security keys or advanced MFA -- must ensure these provide genuine value relative to the cost.

The FCA has confirmed through enforcement actions that inadequate authentication controls constitute a breach of Consumer Duty. In 2025, the FCA fined a major retail bank for failing to implement MFA on its consumer banking platform, resulting in 2,300 account takeover incidents affecting vulnerable customers. This enforcement signals that the FCA treats password controls as a consumer protection issue, not merely a technical compliance box.

SYSC Requirements for Password Management

The Senior Management Arrangements, Systems and Controls (SYSC) sourcebook sets the governance framework for FCA-regulated firms. Three SYSC rules directly affect password management:

SYSC 4.1.1R -- General organisational requirements: Firms must maintain robust governance arrangements, including clear organisational structures with well-defined and transparent lines of responsibility. For password management, this translates to: a named senior manager responsible for authentication security, documented password policies approved at the appropriate governance level, and regular reporting to the board on password compliance metrics.

SYSC 3.2.6R -- Risk management: Firms must establish adequate risk management policies and procedures. Password controls must be proportionate to the risks identified in the firm's risk assessment. A wealth management firm handling high-net-worth portfolios requires stronger password controls than a payment initiation service with limited data exposure. The risk assessment should consider password-related risks including credential stuffing, phishing, insider threats, and brute-force attacks.

SYSC 6.1.1R -- Compliance monitoring: Firms must establish a compliance function that monitors adherence to regulatory requirements. This function must verify that password controls are operating effectively, that password policies are being enforced, and that exceptions are documented and approved. Automated compliance monitoring tools that scan Active Directory password policies against regulatory baselines satisfy this requirement more effectively than manual quarterly audits.

The SM&CR framework under SYSC reinforces individual accountability. The Senior Manager responsible for information security (often the CISO or Technology & Information lead) must be able to demonstrate that adequate password controls are in place. If a password-related incident causes consumer harm, that individual can face personal enforcement action.

NIST SP 800-63B Alignment

The FCA explicitly references NIST standards in its guidance on operational resilience and cybersecurity. While the FCA does not mandate NIST SP 800-63B, firms that align with NIST SP 800-63B will satisfy FCA expectations for authentication security. The key NIST recommendations that map to FCA requirements are:

• Minimum length: NIST SP 800-63B revision 4 recommends 12 characters as the minimum password length. For FCA-regulated firms handling high-value transactions or sensitive customer data, TitanPasswords recommends 20-32 characters for privileged accounts. The FCA's risk-proportionate approach means higher-value services demand longer passwords.
• Complexity: NIST no longer recommends arbitrary complexity rules (uppercase, number, special character). Instead, it emphasises length over complexity and encourages passphrases. The FCA accepts this approach, as Consumer Duty focuses on outcomes (preventing account takeover) rather than prescriptive rules.
• Rotation: NIST SP 800-63B removes mandatory periodic rotation for standard accounts. Rotate only when there is evidence of compromise. However, privileged accounts should still be rotated on a schedule (30-90 days) or immediately after use in break-glass scenarios.
• MFA: NIST requires MFA for privileged accounts and remote access. The FCA expects the same under Consumer Duty and SYSC risk management. Phishing-resistant MFA (FIDO2/WebAuthn) is recommended for financial firms handling regulated activities.
• Breach checking: NIST recommends checking passwords against known breach corpuses. The FCA expects firms to prevent password reuse and credential stuffing, which requires breach corpus checking.

For a comprehensive overview of how these NIST recommendations apply across different regulatory regimes, see our SOC 2 password requirements checklist.

Practical Password Controls for Regulated Firms

Based on the FCA's outcomes-based framework and the NIST standards it references, here are the specific password controls FCA-regulated firms should implement in 2026:

Password Length and Generation

Standard user accounts require a minimum of 12 characters. Privileged administrative accounts require 20+ characters. For any account that can access client money, execute trades, or approve financial transactions, use 20-32 character passwords generated using a FIPS-compliant CSPRNG. The TitanPasswords password generator provides FIPS-compliant random passwords with presets for 20, 24, and 32 character lengths -- these presets align with both FCA expectations and NCSC guidance for UK financial institutions.

Multi-Factor Authentication

MFA is non-negotiable under Consumer Duty for any system that provides access to customer financial data or enables financial transactions. The FCA expects MFA for: remote access to corporate systems, privileged account access, customer-facing banking platforms, and any third-party access to regulated systems. TOTP authenticator apps meet the baseline standard; FIDO2 hardware security keys are preferred for privileged users.

Privileged Access Management

Privileged accounts -- administrators, database operators, trading system operators, and compliance officers -- require additional controls. Implement a privileged access management (PAM) solution that provides: automated password rotation after each use, session recording and audit trails, just-in-time access provisioning, and emergency break-glass procedures with dual-authorisation approval. For managing privileged access securely with PAM tools, look for solutions that support automated rotation and session recording aligned with SYSC compliance monitoring requirements.

Account Lockout and Rate Limiting

Set account lockout thresholds at 5 failed attempts for financial systems, with a lockout duration of 30 minutes and a reset counter after 15 minutes. Implement rate limiting on login endpoints to prevent credential stuffing attacks. These controls support the FCA's expectation that firms protect consumer accounts from unauthorised access.

Documentation and Governance

The password policy must be documented, approved by senior management, and reviewed annually. The policy should specify: minimum length by account type, MFA requirements, rotation schedules for privileged accounts, lockout thresholds, password history requirements, and procedures for password-related incidents. Maintain an exception register for accounts that cannot comply with standard policy -- each exception must be approved by the responsible Senior Manager and time-limited.

FCA Compliance Mapping Table

The table below maps each FCA rule or regulatory expectation to the specific password control and implementation approach:

Comparison with PCI-DSS v4.0

Many FCA-regulated firms are also subject to PCI-DSS v4.0 if they process card payments. The two regulatory frameworks approach password security differently, creating both overlaps and gaps that compliance teams must manage:

The practical overlap is substantial. Firms that implement PCI-DSS v4.0 password controls will typically satisfy FCA expectations for authentication security. Where the FCA goes further is in governance and accountability -- the SM&CR framework and Consumer Duty outcomes require a higher level of board-level oversight and documented risk assessment than PCI-DSS demands. Where PCI-DSS goes further is in specific technical requirements like breach corpus checking and automated service account rotation, which the FCA recommends but does not mandate.

Frequently Asked Questions

What does the FCA require for password security in regulated financial firms?

The FCA requires regulated firms to implement authentication controls that support Operational Resilience (PS21/3), Consumer Duty outcomes, and SYSC requirements. Key password controls include: minimum 12-character passwords for standard accounts, 20+ characters for privileged accounts, multi-factor authentication for all remote and privileged access, automated rotation for privileged credentials, and password policies aligned with NIST SP 800-63B. The FCA expects firms to demonstrate that password controls prevent foreseeable harm to consumers and enable business continuity during disruptions.

Does FCA Consumer Duty apply to employee password policies?

Yes. Consumer Duty (PRIN 2A) requires firms to deliver good outcomes for retail customers. Weak employee authentication that leads to credential theft and customer data exposure directly violates the Consumer Duty principle to avoid foreseeable harm. FCA expects firms to implement password controls proportionate to the risk of consumer harm -- including MFA, strong password policies, and privileged access controls for any system handling customer financial data.

What is the minimum password length the FCA expects for financial firms?

The FCA does not prescribe an explicit minimum length but its SYSC rules and Operational Resilience guidance align with NIST SP 800-63B, which recommends 12 characters as the minimum for standard accounts. For privileged accounts and systems handling high-value transactions, TitanPasswords recommends 20-32 character passwords generated using FIPS-compliant CSPRNG algorithms, consistent with NCSC guidance for UK financial institutions.

Does PS21/3 Operational Resilience require password rotation?

PS21/3 does not mandate password rotation directly, but it requires firms to maintain business continuity during severe disruptions. Automated password rotation for privileged accounts ensures that if credentials are compromised during a cyber incident, access can be revoked and re-established without manual intervention. The FCA expects firms to include credential management in their business impact analysis for critical business services.

What password controls does SYSC require for regulated firms?

SYSC rules (specifically SYSC 4.1.1R and SYSC 3.2.6R on risk management) require firms to maintain robust governance arrangements. For password management this means: documented password policies approved by senior management, access controls that enforce least privilege, periodic review of access rights, audit trails of authentication events, and controls that prevent unauthorised access to systems handling client assets and regulated activities.

How do FCA password requirements compare to PCI-DSS v4.0?

FCA requirements are principle-based and outcomes-focused, while PCI-DSS v4.0 is prescriptive with specific technical rules. PCI-DSS requires 12-character minimums, automated rotation, and MFA. The FCA expects firms to determine appropriate controls based on risk assessment. For firms subject to both regimes, implementing PCI-DSS v4.0 password controls typically satisfies FCA expectations for authentication security. The TitanPasswords generator with its 20-32 character FIPS-compliant presets aligns with both frameworks.