A GCC-native advisory and technology firm serving institutions that answer to two regulatory systems at once: UK groups operating across the Gulf, and Gulf institutions holding UK-regulated entities, listings and assets. We work the corridor as one control environment, not two country desks.
Both sides, one engagement
UK authorities · GCC regulators
Senior specialists, dual-regime experience
Evidence that satisfies both sides
The UK does not need a further generalist consultancy, and we do not pretend to be one. What the market is short of is a firm that understands the Gulf as a home market and the UK as a regulated one and can hold both in a single engagement. That is the corridor: capital, entities, listings and people moving between the GCC and the UK, supervised at each end by authorities that do not map to one another.
The Gulf is where we are built and based. The UK is where a growing share of our clients' entities, capital and counterparties sit and where we work alongside them.
Senior specialists who have built, run and audited these functions inside regulated and government-linked institutions on both sides of the corridor.
Most firms serve the corridor as a UK team and a Middle East team who exchange documents. We design a single control environment that both supervisors can inspect.
Both regimes now demand demonstrable resilience, board-level accountability for controls, and evidenced data governance. But definitions, thresholds, reporting deadlines and supervisory style diverge. Groups that run them as separate programmes pay twice and still cannot answer a consolidated board question.
Conduct and prudential supervision under the FCA and PRA, board-level internal-control declarations under the FRC's Corporate Governance Code, data protection under the ICO, and national cyber expectations shaped by the NCSC — with resilience obligations that now extend to third parties and the wider supply chain.
Prescriptive, control-set-based supervision — SAMA's Cyber Security Framework, the NCA's Essential Cybersecurity Controls, the CBB Rulebook, QCB and QFCRA expectations, CBK instructions alongside data-protection regimes at very different stages of maturity across the six markets.
The practical consequence: a Gulf bank's UK subsidiary must satisfy PRA resilience expectations while its parent satisfies a home-state control framework — on the same systems, the same suppliers and the same incidents. We build the mapping once, and evidence it in both directions.
Corporate and portfolio strategy, operating-model design, digital and AI enablement, and transformation assurance for consequential change.
In the UK: supporting Gulf investors and their UK portfolio companies, and UK groups building or restructuring their Middle East operations.
Board and committee design, ERM, compliance, internal audit and ICFR working as one operating model.
In the UK: Provision 29 material-controls readiness under the 2024 Corporate Governance Code, SM&CR accountability, and economic-crime controls under the ECCTA failure-to-prevent-fraud offence.
Cyber GRC, privacy operating models, technology risk, business continuity and operational resilience.
In the UK: important-business-service resilience and impact tolerances, the critical-third-party and incident-reporting regimes, and UK GDPR as amended by the Data (Use and Access) Act 2025.
Workforce and leadership capability, ESG governance, sustainability reporting and assurance readiness.
In the UK: UK SRS S1 and S2 readiness ahead of any mandatory listing-rule adoption, and one sustainability reporting spine that also serves Gulf exchange disclosure.
Each stage delivers a usable outcome and prepares the next. We shape the answer, embed it as a working system, sustain it as a managed service, and transfer ownership to your people so capability stays in the institution.
Diagnose the priority and design the target operating model — grounded in both the UK regime and the home-state framework it has to reconcile with.
Turn frameworks into live workflows, evidence, dashboards and automation through the platform and FalconryX.
Run the capability with you — capacity, cadence and virtual leadership that keep governance, risk and resilience live in both jurisdictions.
Transfer knowledge to your teams at both ends of the corridor — we build ownership, not dependency.
The UK regime is disclosure-led and outcomes-based rather than checklist-driven — which makes it harder, not easier, for institutions used to prescriptive control sets. Our propositions are designed to help you meet it with evidence, not just intent.
Firms in scope of the operational resilience rules were required to be able to operate important business services within impact tolerances from 31 March 2025. In March 2026 the FCA, PRA and Bank of England published a unified framework for reporting serious operational incidents and material third-party arrangements, taking effect in March 2027 — alongside the critical third parties regime, under which certain technology and service providers are now directly overseen.
Important business service mapping, impact tolerances, scenario testing, third-party and outsourcing registers, incident-reporting readiness and board resilience assurance.
The 2024 UK Corporate Governance Code applies on a comply-or-explain basis, with Provision 29 — the board declaration on the effectiveness of material controls across financial, operational, reporting and compliance activity — applying to financial years beginning on or after 1 January 2026. The first declarations land in the current reporting cycle, and auditors are performing procedures over them.
Material-controls identification, control design and testing, evidence and monitoring architecture, audit committee reporting and the declaration process itself.
UK GDPR, the Data Protection Act 2018 and PECR — as amended by the Data (Use and Access) Act 2025, phased in through June 2026. The Act introduces a recognised legitimate interests basis and a statutory complaints-handling duty, and expands the ICO's investigatory powers, against a backdrop of materially larger security-failure penalties.
Privacy operating models, RoPA, DPIAs, DPO-as-a-service, complaints-handling design, international transfer assessment and breach response.
The National Cyber Security Centre sets national technical guidance and the Cyber Assessment Framework for essential services, with cyber and resilience legislation extending regulatory reach beyond financial services. Separately, the failure-to-prevent-fraud offence under the Economic Crime and Corporate Transparency Act 2023 has been in force since 1 September 2025, making reasonable fraud-prevention procedures a defence rather than an option.
Cyber GRC and CAF alignment, supply-chain assurance, fraud risk assessment and the design and evidencing of reasonable prevention procedures.
Where a proposition references FCA, PRA, FRC, ICO or NCSC alignment, it denotes capability designed to meet those expectations — not certification or endorsement by any UK authority, and not legal advice. Several UK regimes referenced here are in transition; we track changes and map our propositions accordingly.
Every seat gets a flagship engagement — delivered as consulting and sustained through managed services and automation — mapped to the UK regime and reconciled with the home-state framework that leader also answers to.
Provision 29 readiness — material-controls identification, monitoring and the board declaration, with assurance mapped across group entities.
A live material-controls register, monitoring evidence and board-reporting pack, refreshed each cycle.
Strategy & enterprise-risk operating model spanning UK and Gulf entities; transformation assurance for cross-border programmes.
Live strategy-to-risk dashboard with automated performance and risk signals across jurisdictions.
ICFR, controls and internal-audit quality reconciled across UK reporting requirements and home-state expectations.
Managed IA support and ICFR office; automated control testing and evidence health.
ERM, appetite and dual-regime readiness — FCA and PRA expectations reconciled with SAMA, CBUAE, QCB, CBB or CBK frameworks.
Managed GRC Office; automated obligation-to-control mapping across both regimes.
Cyber GRC aligned to NCSC guidance, with a privacy operating model that satisfies UK GDPR as amended and Gulf data regimes together.
Managed Cyber GRC with vCISO/vDPO; automated evidence, breach workflows and control health.
Important business services, impact tolerances, scenario testing and third-party dependency mapping ahead of the 2027 reporting regime.
Managed resilience: service mapping refresh, plan maintenance, exercise cadence and incident-reporting readiness.
Gulf capital holds UK banks, infrastructure, real assets and listed positions. UK institutions hold Gulf branches, subsidiaries and joint ventures. The flows are decades old and deepening — but the advisory market still splits them into a London team and a Middle East team who meet at a status call. We are built the other way round: one firm, one control environment, accountable at both ends.
Sovereign and institutional holdings requiring UK-standard governance and disclosure.
branches, subsidiaries and joint ventures under GCC supervision.
reconciled into one tested, evidenced operating model.
knowledge transfer to your teams at each end of the corridor.
UK branches, subsidiaries and regulated arms of GCC banks, insurers and sovereign investors, supervised by the FCA and PRA.
UK financial and professional groups operating branches, subsidiaries and joint ventures under GCC regulators.
UK-listed companies facing Provision 29 declarations, sustainability reporting and resilience expectations — several with Gulf operations or shareholders.
Real assets, infrastructure and private-market holdings where a Gulf owner needs UK-standard governance across the portfolio.
The Gulf is our home market and the UK is where our clients' entities and counterparties sit — we work the whole line, not one end of it.
We reconcile FCA, PRA, FRC and ICO expectations with SAMA, CBUAE, QCB, CBB and CBK frameworks into one evidenced control set.
Advice that becomes live workflows, evidence and decision intelligence — and can be run for you as a managed service.
Knowledge transfer to your teams at both ends of the corridor — we build ownership, not dependency.
A first Provision 29 declaration, resilience and third-party readiness ahead of 2027, UK data obligations under the new Act, or a Gulf parent and a UK subsidiary that need one answer — we start focused, deliver at both ends, and build capability that lasts.
© 2026 Falconry Solutions. All Rights Reserved.
