What XCINA LIMITED does

Xcina Consulting Limited is a London-headquartered professional services firm specialising in risk management, information security and regulatory compliance consulting. Founded circa 2005 and located at 32 Threadneedle Street in the City of London, the firm operates as the consulting arm of Brookcourt Solutions Limited, itself a wholly owned subsidiary of AIM-listed Shearwater Group plc, sitting alongside sister entities Pentest Limited and SecurEnvoy Limited within the SWG portfolio. Service delivery is organised across three pillars: Risk Management and Assurance (enterprise risk management, internal audit co-sourcing, ISAE 3402 / SSAE 18 Type II controls attestation, third-party management); Information Security (information governance against ISO 27001 and NIST, data protection and GDPR, PCI DSS Qualified Security Assessor services, cyber consultancy, virtual CISO); and Regulatory Compliance (FCA/PRA regulatory applications, managed compliance, SM&CR, operational resilience under PS21/3 and SS1/21, financial crime compliance, business continuity against ISO 22301).

Xcina's client base is anchored in UK regulated financial services — banks, building societies, wholesale banks, asset managers, payment firms and insurance entities — with adjacent exposure to fintechs pursuing authorisation (including cryptoasset firms), professional services, retail and consumer brands handling cardholder data, and UK telecommunications operators subject to the Telecommunications Security Act. Methodology is bespoke rather than templated: the firm uses proprietary frameworks including an ICO Accountability Tracker gap assessment grouped into ten themes plus PECR, a PCI DSS scope-reduction methodology, and a cyber security risk management framework aligned to internationally recognised standards. Credentials include PCI Security Standards Council QSA authorisation, BSI ISO27001 Platinum Accredited Partnership, Cyber Essentials Plus, IASME Gold GDPR Qualified Practitioner and Carbon Neutral certification.

Commercially, the firm runs a sales-led, senior-consultant-driven model combining direct enterprise outreach with a thought leadership content engine (regulatory calendar, 35+ case studies, whitepapers, podcasts, email newsletter). Revenue is generated through project-based consulting engagements (one-off gap analyses, remediation, regulatory applications), recurring managed compliance retainers, and annual virtual DPO subscriptions, with selective use of group-shared capabilities such as Shearwater's Security Operations Centre as a Service for managed cyber delivery. Distribution is direct, predominantly UK-domiciled, with selected international engagements delivered without channel partners.

Name

XCINA LIMITED

Legal name

Xcina Consulting Limited

Website

https://xcinaconsulting.com

Company type

Private

Founded year

2005

Operating status

Operating

Headcount range

1–10 employees

Short description

Xcina Consulting Limited is a London-based risk management, information security and regulatory compliance consultancy serving UK-regulated enterprise clients in financial services, fintech, payments, retail, telecom and professional services through bespoke advisory, managed compliance and vDPO services.

Ownership category

akta.pro rank

Product category

Risk Management and Regulatory Compliance Consulting

NAICS

Management Consulting Services (54161), Other Management Consulting Services (541618)

SIC

Services-Management Consulting Services (8742), Services-Engineering, Accounting, Research, Management (8700)

akta.pro primary industry

Risk, Compliance & Internal Controls Consulting (BPAHACAJ)

akta.pro secondary industries

Risk Management Consulting (Enterprise & Operational Risk) (FSAEADAG), Cybersecurity & Identity Consulting (BPAHAEAG), Audit & Assurance Services (BPAHABAA), Fraud Risk Management & Anti-Bribery/Anti-Corruption (ABAC) (BPAHAFAL), Third-Party/Vendor Risk & Due Diligence (BPAHAFAG)

Keywords

• Risk management consulting
• Regulatory compliance services
• Information security consulting
• PCI DSS compliance
• Data protection consulting

Headquarters

HQ city

London

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Infrastructure, Others

Revenue model

1. Professional Consulting Services: Xcina Consulting generates revenue through bespoke consulting engagements across risk management, information security, and regulatory compliance. Engagements range from one-off assessments, gap analyses, and remediation projects to ongoing managed compliance services. The firm offers modular service options and flexible access to subject matter expertise, typically billing on a project or retainer basis.
2. Managed Compliance Services: Ongoing retained services providing day-to-day compliance support, compliance monitoring programme design and execution, regulatory reporting assistance, and periodic health checks. Billed through recurring retainer arrangements.
3. Virtual DPO (vDPO) Subscription: Annual upfront subscription providing access to virtual Data Protection Officer services, specialist advice and guidance on request, and data privacy consultancy. Provides flexible access without the cost burden of in-house dedicated subject matter experts.
4. Regulatory Application Support: Project-based consulting engagements supporting firms through FCA, PRA, or overseas regulatory authorisation processes, including application pack preparation, documentation, and project management.
5. PCI DSS QSA Formal Assessment Services: Formal assessment services including Report on Compliance (RoC) execution, Self-Assessment Questionnaire (SAQ) reviews, and PCI DSS compliance certification and validation, delivered by certified Qualified Security Assessors.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels8 records

Core offering

Xcina Consulting delivers bespoke professional services across three pillars: Risk Management and Assurance (Enterprise Risk Management, Internal Audit, Controls and Compliance Attestations, Third Party Management), Information Security (Information Governance, Data Protection/GDPR, PCI-DSS via Qualified Security Assessor authorisation, Cyber Security Consultancy), and Regulatory Compliance (Regulatory Applications, Managed Compliance, SM&CR, Operational Resilience, Financial Crime, Business Continuity, Regulatory Change). Services are sold on a project, retainer, or annual subscription basis to regulated enterprises primarily in UK financial services.

Product overview

Xcina Consulting operates as a professional services firm providing risk management consulting, auditing, and assurance services rather than a software product company. The firm's service portfolio is organized across three core pillars: Risk Management and Assurance (including Enterprise Risk Management, Internal Audit, Controls and Compliance Attestations, and Third Party Management); Information Security (covering Information Governance, Data Protection/GDPR, PCI-DSS, Cyber Security Consultancy, and Virtual CISO services); and Regulatory Compliance (encompassing Managed Compliance Services, SM&CR, Operational Resilience, Financial Crime Compliance, Regulatory Applications, and Business Continuity). Services are delivered through bespoke consulting engagements tailored to each client's needs, with offerings ranging from one-off assessments to ongoing managed services and outsourced function delivery.

Differentiator

Problem solved

Functional benefit

Products and services

• Enterprise Risk Management Independent consulting providing full visibility of an organisation's risks and mitigating their impact on strategic objectives, including risk identification, assessment, mitigation, and management support for enterprise clients.
• Internal Audit Internal audit function management or co-sourcing delivered as an extension of client teams, providing assurance on governance, risk management, and internal controls aligned with CIIA International Standards for the Professional Practice of Internal Auditing.
• Controls and Compliance Attestations Pragmatic development of controls, governance and oversight frameworks including ISAE 3402 and SSAE 18 Type II assessments for SaaS and other organisations requiring SOC attestations.
• Third Party Management and Assurance Outsourcing and third-party management framework development aligned to PRA, European Banking Authority and business requirements for organisations managing third-party and outsourced arrangements.
• Information Governance Management and protection of an organisation's information assets through frameworks aligned to ISO/IEC 27001, NIST Cybersecurity Framework, GDPR, and the UK Data Protection Act 2018, serving enterprises seeking formal information governance maturity.
• Data Protection and Virtual DPO (vDPO) Service GDPR compliance audits, gap assessments, remediation implementation, and an outsourced Virtual Data Protection Officer service providing specialist advice, guidance, and data privacy consultancy on an annual upfront subscription basis.
• PCI-DSS Compliance Services (QSA) Specialist methodology to accurately scope Cardholder Data Environments and, where necessary, redefine scope to reduce data security obligations and compliance costs, plus formal assessment services including Report on Compliance (RoC) execution, Self-Assessment Questionnaire (SAQ) reviews, and PCI DSS certification and validation by certified QSAs.
• Cyber Security Consultancy Cyber security risk analysis and assessments focused on cyber threats, aligned to internationally recognised best practice standards, delivering risk assessments, gap analysis, remediation guidance, breach response plans, and incident response through the Shearwater Group Security Operations Centre as a Service (SoCaaS).
• Regulatory Applications Project-based consulting support for regulatory authorisation processes with the FCA, PRA or overseas regulators, including application pack preparation, documentation, and project management through the licence-application lifecycle.
• Managed Compliance Services and Solutions Ongoing retained compliance support covering day-to-day management, compliance monitoring programme design and execution, policy reviews, periodic health checks, and regulatory reporting assistance, billed through multi-year retainer arrangements.
• Senior Managers and Certification Regime (SM&CR) Support for achieving and maintaining SM&CR compliance including documentation, training, senior manager applications, and remediation activities for firms subject to the UK regime.
• Operational Resilience Development and enhancement of operational resilience frameworks, including strategy definition, identification of important business services, impact tolerances, and scenario testing aligned to FCA, PRA, and DORA expectations.
• Financial Crime Compliance Financial crime risk assessment and framework design covering AML/CTF, KYC/CDD, Anti-Bribery and Corruption, Fraud and Market Abuse for regulated financial services clients.
• Business Continuity and Crisis Management Business continuity planning, crisis management, and disaster recovery framework development and testing aligned to ISO 22301 for organisations building resilience to disruptive events.
• Virtual CISO (vCISO) Outsourced Chief Information Security Officer service providing interim or long-term information security leadership and expertise for organisations requiring senior security guidance without a full-time hire.

Quantifiable outcome

• Supported Perenna in achieving a strong position for their FCA/PRA banking licence application within agreed timescales and budget
• +3 more outcomes

Named customers15 records

Segments5 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature7 records

Partnerships

Four partnerships are on record, tiered core and minor.

• Shearwater Group plccoreOthersShearwater Group plc is the parent AIM-listed company of Xcina Consulting. Xcina is the consulting arm of Brookcourt Solutions Limited, which is a subsidiary of Shearwater Group plc (company number 05059457, registered address 22 Great James Street, London WC1N 3ES). Xcina shares personal data across the SWG portfolio companies as part of its data processing activities.
• Brookcourt Solutions LimitedcoreOthersBrookcourt Solutions Limited (company number 05356175, registered address 22 Great James Street, London WC1N 3ES) is the direct parent company of Xcina Consulting. Xcina is referred to as 'the consulting arm of Brookcourt Solutions Limited.' Xcina shares personal data with Brookcourt and other SWG portfolio companies on a need-to-know basis.
• Pentest LimitedminorOthersPentest Limited (company number 11925182) is a portfolio company within the Shearwater Group plc group of companies. Xcina shares personal data with Pentest as part of the SWG portfolio's data processing arrangements on a need-to-know basis for improving existing services or providing new services.
• SecurEnvoy LimitedminorOthersSecurEnvoy Limited (company number 04866711) is a portfolio company within the Shearwater Group plc group of companies. Xcina shares personal data with SecurEnvoy as part of the SWG portfolio's data processing arrangements on a need-to-know basis.

Scale indicators3 records

Recent moves6 records

Expansion highlights6 records

Regional players

• Waterstons: UK consultancy offering operational resilience, cyber security and business continuity advisory to enterprises, overlapping with Xcina's resilience and information security services.

Broad incumbents

• NCC Group: Cyber security and assurance firm providing PCI DSS QSA services, testing and cyber advisory, overlapping with Xcina's information security and PCI DSS practice.
• Grant Thornton UK: Mid-tier professional services firm offering internal audit, risk assurance and regulatory advisory to financial institutions, competing with Xcina on assurance and controls engagements at larger scale.
• Protiviti: Global internal audit, risk and compliance consulting firm serving financial services, competing with Xcina on internal audit co-sourcing, controls and regulatory engagements.
• BSI Group (Consulting): Standards and consulting body delivering ISO27001, resilience and information security advisory; overlaps directly with Xcina's ISMS work, and Xcina is itself a BSI accredited partner.
• Kroll (Compliance & Regulatory): Global risk and financial crime advisory firm serving regulated financial institutions, overlapping with Xcina's AML/financial crime and regulatory risk work at greater scale.

Direct peers

• Coalfire: Cyber risk advisory and PCI DSS QSA firm serving payments and enterprise clients, directly comparable to Xcina's QSA-led PCI DSS assessment services.
• Thistle Initiatives: UK compliance and regulatory consultancy for financial services and fintech, offering authorisations, AML/financial crime and SM&CR support that mirror Xcina's regulatory compliance offerings.
• Bovill Newgate (Ocorian): UK-based specialist financial services regulatory compliance consultancy serving FCA/PRA-regulated banks, asset managers and payment firms, directly overlapping with Xcina's core regulatory advisory practice.

Emerging players

• Cyberfort Group: UK cyber security and compliance consultancy providing GDPR, ISO27001 and PCI DSS support to mid-market and enterprise clients, overlapping with Xcina's information security niche.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xtwitter.com/share

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about XCINA LIMITED