AEDRA is an operational resilience consultancy for payment, e-money and other regulated firms, and the suppliers that serve them. We work out which suppliers your important business services depend on, test what happens if one fails, and keep the evidence ready for your board and the FCA.
Every payment you process depends on someone else's system.
Your app runs on a platform. The platform runs on a cloud. The cloud has suppliers of its own.
Some of those arrangements are material. The work is knowing which, and why.
Every arrangement written down, with its reason. Ready when you're asked.
One supplier list, as a firm sends it.
Harbour Lane Payments is a fictional e-money firm. The FCA's template gives it a column for every line. Deciding which ones are material, and why, is the hard part.
| Ref | Arrangement | Part in the chain | Why it matters |
|---|---|---|---|
| S06 | DDoS mitigation and content delivery | Lets it in | Sits in front of the app and API. The FCA lists DDoS mitigation as usually material. |
| S01 | Cloud hosting and infrastructure | Runs the app | Hosts the platform every service runs on. Failure stops payments and account access at once, and it cannot be replaced in weeks. |
| S11 | SMS one-time passcodes | Approves it | If delivery fails and there is no app-based alternative, customers cannot log in or approve payments. |
| S10 | Fraud scoring (real-time) | Scores it | If payments are held when scoring is unavailable, it behaves like part of the payment path. |
| S08 | Sanctions screening and monitoring | Screens it | Material if screening is inline in the payment flow, so payments stop when it fails. If it runs after the payment, payments keep moving, but missed sanctions hits still mean harm and a breach. Decide it on your facts, not the flow alone. |
| S02 | Core e-money ledger and account platform | Records it | System of record for customer balances. Without it the firm cannot show what each customer holds or move money. Migration would take months. |
| S04 | Faster Payments indirect access | Sends it | The route every outbound payment takes. The FCA lists payment and settlement services as usually material. Few alternative sponsors, long onboarding. |
| S03 | Safeguarding account provider | Holds the money | Holds the safeguarded customer funds. Loss of access directly harms customers and puts safeguarding compliance at risk. |
Some questions come on a date. Most arrive on an ordinary day.
Start anywhere. Each service stands alone. Fees exclude VAT.
Show the route for
Materiality SnapshotFree
A first view of your supplier list, with reasons, in 48 hours.
Register Ready£4,500
Every call reasoned, suppliers chased, the FCA template filled in. About two weeks, three at most.
Incident Readiness£2,500
Your reporting thresholds, decision tree and playbook, tested in a tabletop.
Supplier Readyfrom £3,500
One data pack every regulated client can use.
Critical Dependency Review£15,000
Each important business service mapped to your suppliers' own suppliers, with what to fix first.
Scenario testingfrom £8,000
Severe but plausible scenarios, including a supplier failing, recorded in full.
Resilience Programmefrom £8,000 a year
Your SYSC 15A year, through to a self-assessment your board can sign.
Q1Services and tolerances
Q2Mapping refreshed
Q3A severe but plausible test
Q4Self-assessment for the board
Change & Assurance£8,000 a year
New and changed arrangements assessed, notifications drafted, the register refreshed.
Register entrySpecimen, fictional firm
Probably. SYSC 15A covers more firms than the register, including small payment and e-money institutions. From 18 March 2027, incident reporting covers every firm with Part 4A permission and payment service providers.
Banks, building societies, authorised payment and e-money institutions, Solvency II insurers, enhanced-scope SM&CR firms and CASS large firms, among others. Credit unions are in if they hold £50m or more in assets, under the PRA's rules. Third-country branches submit the register but don't notify changes. Not sure? Tell us what kind of firm you are.
You can, and the forms are free. The hard part is judgement: what's material, where a tolerance breaks, and reasons that stand up when someone asks.
No. We prepare it ready to go. You submit the register through RegData, and notifications and incident reports through FCA Connect.
Yes, in your name and with your written authority, for up to three weeks. Anything still missing goes in a gap report, so one slow supplier can't hold you up.
Yes, to extract and compare information from documents and prepare drafts. A person makes and signs off every judgement. We can work without it if your policy requires.
No. If a contract question needs a lawyer, we'll say so.
A Dependency Review, a scenario test, incident readiness, a supplier pack or the yearly Programme. We'll say what you need, and what you don't.
Book a 30-minute callOnly if you want more: a fixed fee, in writing, before any paid work.
See a sample first. The Snapshot for a fictional e‑money firm: 24 arrangements, a call and a reason for each, three pages. Open the PDF