Information on FCA proof of concept contract with Palantir - September 2026

The information we hold in relation to questions 1, 2, 6 and 7 can be found within the Data Protection Impact Assessment attached at Annex A and Assurance document attached at Annex B.

For question 3, the information can be found in the Contract Award Recommendation document attached at Annex C.

Some of the information within these documents is exempt from disclosure under section 43 (Commercial interests) of FOIA, as we are of the view that such disclosure would be likely to prejudice the commercial interests of the supplier, and those of the FCA. 

Some additional information within these documents has been withheld as if disclosed, it would be likely to prejudice the exercise by the FCA of its regulatory functions under the Financial Services and Markets Act 2000 (FSMA). The information is therefore exempt from disclosure under Section 31 (Law enforcement) of FOIA.

Some further information within these documents relates to legal advice received on the project, and we are therefore unable to disclose it to you. In respect of this information a claim to legal professional privilege (LPP) could be maintained in legal proceedings and such information is exempt from disclosure under section 42 (Legal professional privilege) of FOIA.

A small amount of information is additionally exempt under Section 40 of FOIA. This is because disclosing this information would reveal the personal information about the individuals concerned.

For a detailed explanation of why these exemptions apply, please see Annex D at the end of this response.

Where multiple pages have been withheld in their entirety, they have been removed from the redacted Annexes for ease of readability.

We do not hold any information within the scope of this part of your request as no social value assessment was undertaken for this short-term proof of concept, and therefore no assessment under, or referring to, the Public Services (Social Value) Act 2012 is held by the FCA.

We did complete a reputational risk and public trust assessment which can be found in the Assurance document attached at Annex B.

We do not hold any information on the other assessments you have listed.

We do not hold the information you are seeking as no discussions took place concerning the Palantir proof of concept with those organisations.

• General right of access to information held by public authorities

Anyone making a request for information to a public authority is entitled to be told in writing by the public authority whether it holds the information the request describes. If the public authority does hold this information, the person requesting it has the right to have the information communicated to them. These rights, in section 1(1)(a) and (b) of FOIA, have some exclusions and exemptions.

• Section 43 (Commercial Interests)

This section of FOIA states that we are exempt from providing this information if disclosing it would be likely to, prejudice the commercial interests of any person, including the public authority that holds the information. 

As this exemption is subject to the public interest test, we have considered relevant factors in favour, and against, disclosing information as required by FOIA.

For disclosure:

• There is a strong public interest in the public being able to see and potentially scrutinise how much the FCA is spending on services.

Against disclosure: 

• Disclosure is likely to undermine the FCA’s commercial interests as disclosure of the information requested could adversely impact our position in future negotiations with suppliers or procurement exercises with similar specifications.
• The commercial interests of the suppliers involved are likely to be harmed by such a disclosure as this may affect the supplier’s ability to negotiate with other potential future customers. Further, disclosure could potentially provide an unfair advantage to competitors of these suppliers when bidding for work with both the FCA and other commercial entities.

On this occasion, and for these reasons, we have concluded that the balance of the public interest is in favour of not disclosing some of the requested information.

• Section 31 (Law enforcement)

The qualified exemption in section 31(1)(a) of FOIA applies to this request because disclosure of the information requested would be likely to prejudice the detection of crime.

As explained in our letter, this exemption applies to questions 1, 2, 3, 6 and 7 of your request in that such information, if disclosed would be likely to, prejudice the prevention or detection of crime as disclosure would enable criminals to draw conclusions about our cyber security capability and in turn, may encourage them to launch cyber-attacks on our systems.

Since section 31 is a ‘qualified exemption’, we have considered relevant factors in favour and against disclosing the information, as required by FOIA.

For disclosure

• There is a strong public interest in favour of transparency and in the public being reassured that we are taking the necessary precautions to ensure that our information systems, some of which hold information of the firms and individuals we regulate, are secure and safe from cyber-attacks.
• Disclosure of the information would demonstrate how the FCA responds to the ever-increasing threat of its systems being compromised.

Against disclosure

• There is a strong public interest in the FCA being able to carry out its functions in the most effective manner possible. This includes the FCA being able to keep its systems safe and secure from cyber-attacks to ensure our role as financial regulator is not compromised.

On the facts of this particular request we have concluded that the balance of the public interest is in favour of applying the exemption under section 31 of FOIA for these reasons.

• Section 42 (Legal professional privilege)

This section states that information that could be legal professional privilege is exempt. This exemption under FOIA includes advice from lawyers to the FCA, including internal legal advice.

Section 42 of FOIA is a qualified exemption which means we have to balance the public interest for and against disclosure as required by FOIA.

For disclosure

• As part of providing wider transparency about the FCA’s work there may be a legitimate public interest in disclosing any legal advice which has been provided.

Against disclosure

• It is strongly in the public interest for the FCA to be able to have open and candid communications with its lawyers to ensure we seek and receive the best possible legal advice, given without fear or favour. This enables us to carry out our statutory functions lawfully as well as effectively. Our ability to seek and receive proper and adequate legal advice, in a free and frank way, would be undermined if the FCA’s exchanges with its lawyers were made publicly available.
• Disclosing the legal advice would prejudice the FCA’s ability to defend its legal interests. This would be both directly, by unfairly exposing our legal position to challenge, and indirectly, by reducing our reliance on legal advice having been fully considered and presented without fear or favour.
• The public interest is generally not served by disclosing material that is covered by legal professional privilege. 

Having balanced the public interest for and against disclosure as required by FOIA, in this case in our view, the public interest lies against disclosure for the reasons set out above.

• Section 40 (Personal Information)

Under section 40(2)(b) of FOIA, information that contains personal data of third-party individuals is exempt from disclosure if any one of three specified conditions is satisfied.

In this instance, we have applied this exemption because the first condition (as stated in section 40(3A) of FOIA) is satisfied. Some of the information you have requested comprises the personal data of individuals other than yourself, whose disclosure would breach one of the data protection principles.

In particular, we are of the view that disclosure would breach the first data protection Principle as set out in Article 5(1) of the UK GDPR that personal data must be processed lawfully, fairly and in a transparent manner, for the following reason/s:

The data subjects would not have had any reasonable expectation that this information would be disclosed into the public domain.

We do not consider that disclosing this information is necessary or justified.

Therefore, this information is exempt from disclosure under section 40(2) of FOIA.

This is an 'absolute' exemption, and so it is not necessary to balance the public interest for and against disclosing the information.