The situation
A founder I'd worked with previously, now CEO of an FCA-regulated investment platform, brought me in as the business prepared to start development with an outsourced engineering agency. The FCA holds the regulated business itself accountable for the platform it operates, not its development agency, regardless of technology choices or where the engineers are based - so getting technical governance right before writing any code mattered more than it might for an unregulated product.
What I'm doing
I set out a governance framework covering architecture and technology choices up front, and a review of the agency's day-to-day engineering practices - code review, deployment, security process - to check they suit a regulated product. We agreed a baseline for what 'good' looks like (testing, releases, documentation, change management) before development started, rather than inventing it as we go. The most important piece is ownership: making sure the business, not the agency, owns every critical asset from day one - cloud accounts, source code, domains, deployment pipelines, production infrastructure - with the agency given access to build, not ownership of what they build. Alongside that: least-privilege access controls with full traceability, a defined release process (review, test, rollback plan) before any change reaches customers, operational resilience (backups, monitoring, recovery) established ahead of any incident rather than after one, and data protection arrangements formalised for how customer data is accessed, stored and protected. I'm running this as ongoing technical oversight - a regular governance session while the foundations get established, tapering off as the project settles - acting as the business's technical representative and sounding board, so the agency can focus on building while I make sure it's the right thing, built the right way, with the right controls around it.
The outcome
Still an active engagement, but early impact is already concrete: I joined a technical integration call with one of the business's key partners to help clear an engineering requirement that was blocking a funding milestone. The wider governance framework is landing before development starts, which is the point - these controls are straightforward to put in place upfront and considerably more expensive to retrofit once customers are live.