AJ Bell operates one of the UK's largest retail investment platforms - over 673,000 customers trusting it with £108 billion in assets under administration. Founded in 1995 and now FTSE 250-listed, the company runs Stocks and Shares ISAs, SIPPs, Junior ISAs, and dealing accounts across a single-country regulatory perimeter. That scale means the threat surface is substantial: a fintech holding real money for hundreds of thousands of individuals, handling transaction flows and sensitive identity data within UK financial regulation.
For a security team, the challenge is concrete. The platform must defend against account takeover, API abuse, and credential-stuffing attacks targeting high-value financial accounts. The compliance stack runs through FCA requirements, PSD2 strong customer authentication, and GDPR - so security engineering and GRC aren't separate conversations. The operational domain spans web and mobile application security, payment-system hardening, and fraud detection at scale.
AJ Bell has been recognised as a Which? Recommended Provider for seven consecutive years (2019–2025), the only investment provider to hold that status. That kind of consumer trust is only as durable as the controls underneath it, which sets a high bar for incident response, secure development practices, and continuous monitoring across the estate.
