WhatsApp and Telegram +44 7563 115980
[email protected]
We prepare payment, e-money and crypto firms for a System and Organization Controls (SOC) 2 examination, building on the controls the Financial Conduct Authority (FCA) already requires, and run the project through to the auditor's report.
Selected engagements from more than 250 licences obtained since 2013, for payment, e-money and cryptoasset firms.
Volkswagen
Payment InstitutionObtained Nexpay’s FCA Authorised Payment Institution licence.
Electronic Money InstitutionObtained Dzing Finance’s FCA Authorised Electronic Money Institution licence.
Obtained Orbital’s FCA Authorised Payment Institution licence.
The short answer
A SOC 2 report is an independent examination of a firm's controls against the Trust Services Criteria of the American Institute of Certified Public Accountants (AICPA). Payment, e-money and crypto firms are asked for one by bank partners and enterprise clients. A readiness consultant scopes the system, finds gaps, builds controls and evidence, and manages the audit. Only a licensed Certified Public Accountant (CPA) firm can issue the report.
SOC 2 is one of the System and Organization Controls services that the AICPA sets the standards for. In a SOC 2 examination, a Certified Public Accountant (CPA) firm reports on a firm's description of its system and on its controls relevant to five Trust Services Criteria categories: security, availability, processing integrity, confidentiality and privacy. Security is included in every report. The other four are chosen according to what the firm does and what its clients rely on: a payment firm usually adds availability and processing integrity, because clients depend on payments being executed on time and correctly, and often confidentiality.
There are two types of report. A Type 1 report covers whether controls are suitably designed at a single date. A Type 2 report covers whether they were suitably designed and operated effectively throughout a period, known as the observation window or report period, and it is the report most bank partners and enterprise clients ask for. A SOC 3 report is a shorter, general use version that can be published, but it does not replace the detailed SOC 2 report in due diligence.
SOC 2 is not an FCA requirement, and no UK rule obliges a payment institution (PI), e-money institution (EMI) or cryptoasset firm to hold a report. It becomes necessary because of who the firm does business with. Partners who rely on a firm's systems need independent evidence that its controls work, and a SOC 2 Type 2 report is the format many of them already know how to read. The requests usually come from:
An FCA authorised firm does not start SOC 2 from nothing. Much of what an auditor will test is already required by UK rules, and a readiness project should reuse that work rather than build a second control set.
Scope decides the cost, the length and the usefulness of the report, so it is settled first. We agree with you which system the report will describe, for example your payments platform, wallet infrastructure or crypto custody service, and which entities, locations, people and third parties are inside it. We then recommend which Trust Services Criteria categories to include, based on what your bank partners and clients have actually asked for, not on what is easiest to pass.
Where a key supplier, such as a cloud provider or core banking platform, runs part of the system, the report can treat it as a subservice organisation. Your controls over that supplier are then tested, and its own SOC 2 report becomes part of your evidence. We then compare your current controls with the criteria in scope and with the controls your FCA obligations already require. The written gap assessment lists each missing or weak control, the evidence an auditor will expect, the owner and the priority, so the board can see the size of the task before committing to an audit date.
Most first time SOC 2 failures are not about missing policies. They are about controls that exist on paper but cannot be shown to have operated every time, for every person, throughout the period. Our remediation work is built around evidence from the start. We draft or update the policies the criteria require, including information security, access management, change management, incident response, business continuity, vendor management, data retention and risk assessment, and align them with your existing FCA policies so staff follow one set of rules, not two.
We then help you put the controls into operation:
A SOC 2 report can only be issued by a licensed CPA firm performing the examination under AICPA attestation standards. BCC does not issue SOC 2 reports, does not perform the examination and does not provide any form of attestation. We prepare your firm, manage the project and help you choose and work with the auditor, which keeps the readiness work independent of the opinion. Some UK and European auditors offer reports under international assurance standards instead, such as International Standard on Assurance Engagements (ISAE) 3000; these are not SOC 2 reports, so check first which format your partners require.
Timings vary with scope and starting point. Readiness work typically takes from several weeks to a few months. Many firms then obtain a Type 1 report to show progress, followed by a Type 2 report whose observation window commonly runs from three to twelve months; the auditor's fieldwork and reporting follow the end of the window. Once the first report is issued, most firms move to an annual cycle, so each report period follows on from the last without gaps that a bank partner would question.
Every engagement follows the same four stages, scaled to the size of your firm and the deadline set by your partners.
Assessment: we confirm what your bank partners and clients require, agree the system scope and the criteria, and review your current controls against them and against your FCA obligations. Written findings: you receive a gap assessment and a readiness plan, with each action ranked by priority, assigned to an owner and linked to the evidence an auditor will test. Remediation: we draft policies, design controls, set up evidence collection, run a mock audit and help you select a licensed CPA firm. Ongoing support or outsourced roles: we project manage the observation window and the audit, respond to auditor requests with your team, track exceptions to closure and support each annual renewal. Where useful we also act as your outsourced compliance officer, so SOC 2, outsourcing and operational resilience are run as one programme.
Buckingham Capital Consulting (BCC) was established in 2013 and has obtained more than 250 licences in over 60 countries for payment, e-money and crypto firms. That licensing work means we know, from the application stage onwards, the controls, people and documents that regulators, bank partners and auditors expect to find when they test a regulated firm.
We do not stop at the licence. BCC also arranges banking and runs compliance for regulated firms, so our advice reflects how a regulated business actually operates day to day: how its bank partners review it, how its regulator supervises it and how its own board needs to evidence control. Our aim is set out in one line: we open global markets to payment, e-money and crypto businesses, with the licences to enter, the banking to operate and the compliance to scale. If you are weighing your options, use the contact form to describe your firm and what you need, and we will reply with a proposed scope.
No. The FCA does not require SOC 2. UK payment, e-money and crypto firms obtain it because bank partners, banking as a service providers, card programme sponsors and enterprise clients ask for it in due diligence. The FCA's own requirements on outsourcing, operational resilience and systems and controls still apply, and a well run SOC 2 project reuses that work.
A Type 1 report covers whether controls are suitably designed at a single date. A Type 2 report covers whether they were suitably designed and operated effectively throughout a period, usually several months. Bank partners and enterprise clients normally ask for Type 2, though a Type 1 report can show progress while the first observation window runs.
No. Only a licensed Certified Public Accountant (CPA) firm can perform a SOC 2 examination and issue the report. BCC prepares your firm for the examination: scoping, gap assessment, policies, controls and evidence. We also project manage the audit with the CPA firm you appoint, which keeps the readiness work independent of the auditor's opinion.
It depends on scope and on how mature your controls are. Readiness typically takes from several weeks to a few months. A Type 2 observation window then commonly runs from three to twelve months, and the auditor reports after it ends. Firms that already meet FCA operational resilience and outsourcing rules usually start from a stronger position.
Security is included in every SOC 2 report. Payment and e-money firms usually add availability and processing integrity, because clients depend on payments being made on time and accurately, and often confidentiality. Privacy is added where the firm processes personal information in ways clients rely on. The right choice depends on what your partners have actually asked for.
No. ISO/IEC 27001 is a certification of an information security management system, while SOC 2 is a CPA's report on specific controls over a period. Many requests from US partners ask for SOC 2 by name. The two overlap heavily, so a firm with ISO 27001 can reuse much of its evidence in a SOC 2 readiness project.
No. The Payment Card Industry Data Security Standard (PCI DSS) is a separate standard for protecting card data, assessed under its own process. Card issuing and acquiring partners may ask for both. Controls such as access management and logging serve both, so we plan SOC 2 readiness to reuse existing PCI DSS evidence where it applies.
Tell us what you need and where you operate.