Software as a Service transformed the way financial firms bought and used technology. When Thames Systems launched T100 in 2017, SaaS made sense: rather than managing software, servers, infrastructure and security separately, firms could access everything as a managed service.
But the environment financial services firms operate in has changed.
Cybersecurity threats have increased, operational resilience has become a regulatory priority, and firms are paying far closer attention to their reliance on technology suppliers and the suppliers behind those suppliers.
For T100, that has led to an important change in approach.
Thames Systems is moving clients towards a perpetual licence model that allows firms to deploy T100 within infrastructure they directly control, with access to the source code and the freedom to decide how the system is maintained and developed in the future.
The objective is simple: give regulated firms greater control over critical technology and reduce unnecessary third-party dependency.
Why SaaS made sense in 2017
The attraction of SaaS is straightforward.
The technology provider can take responsibility for:
- the software
- the hosting environment
- the underlying infrastructure
- updates and maintenance
- cybersecurity around the service
The client receives access to the system without needing to manage much of the technology behind it.
That model helped organisations adopt sophisticated systems quickly and reduced the internal technical resources required to operate them.
But it also creates a dependency.
If an important system is entirely operated by an external supplier, the client is relying not only on the application itself, but on the supplier’s infrastructure, security controls, continuity arrangements and potentially its own chain of third-party providers.
The more important that system becomes to day-to-day operations, the more important that dependency becomes.
Operational resilience has changed the conversation
Operational resilience is no longer simply an IT issue.
For regulated financial services firms, it is about understanding what is required to keep important business services functioning when something goes wrong.
The FCA requires firms in scope of its operational resilience rules to identify the people, processes, technology, information and third parties required to deliver important business services. Firms remain responsible for managing the risks associated with those dependencies, even when the technology or service has been outsourced.
That distinction matters.
Outsourcing a system does not outsource responsibility for the consequences if that system becomes unavailable.
And regulators are continuing to focus on this area. In March 2026, the FCA confirmed new operational incident and material third-party reporting requirements that will apply from 18 March 2027 to firms within scope.
For financial firms assessing their technology infrastructure, the question is therefore increasingly:
How much of our operational resilience depends on organisations outside our direct control?
The ION cyber incident showed why third-party risk matters
The financial markets received a practical demonstration of this risk in January 2023.
ION Cleared Derivatives, an important technology provider to derivatives market participants, experienced a cybersecurity incident that disrupted some of its services.
The effects extended beyond ION itself.
The CFTC reported that affected firms had to revert to manual processes, with disruption to trade processing and delays in regulatory reporting. Around 42 institutions relied on the affected applications, and disruption to some mid-office activities lasted for approximately two weeks.
The significance of the incident was not simply that a technology company experienced a cyberattack.
It demonstrated how an incident affecting one supplier can become an operational problem for multiple financial institutions that depend on it.
That is the risk T100’s changing deployment model is designed to address.
Moving T100 from SaaS towards a perpetual licence
T100 contains approximately 670,000 lines of code developed over many years for regulated financial services firms.
Rather than requiring clients to remain dependent on Thames Systems operating that software as a hosted service indefinitely, T100 can now be supplied under a perpetual licence.
This means the firm can deploy T100 within infrastructure under its control and receive access to the source code covered by its licence.
The firm can then decide how that installation is operated over the long term.
Thames Systems can continue to maintain, support and enhance T100.
Alternatively, the client can use its own technology team or another specialist provider.
The important distinction is that continued use of the software is no longer dependent on Thames Systems remaining in the hosting and operational chain.
Reducing the third-party attack path
Moving T100 into a client-controlled environment does not remove cybersecurity risk.
The client’s servers, networks, identities, backups and security controls still need to be properly protected.
What changes is where responsibility and control sit.
Under a traditional SaaS arrangement, a firm needs confidence in:
Client → SaaS provider → hosting/infrastructure providers → other technology suppliers
Every organisation involved potentially introduces another dependency that needs to be understood and managed.
With a client-controlled T100 deployment, Thames Systems can be removed from the critical hosting and data-access path.
The firm already protecting its internal infrastructure can bring T100 within that same security environment.
It can decide where the application runs, who can access it, how it is backed up and how security controls are applied.
Greater control over financial data
There is another important consequence.
When T100 is deployed within the client’s environment, Thames Systems does not need routine access to the firm’s production data simply to provide the service.
The client retains direct control over its information and can determine precisely when external access is permitted.
For firms handling sensitive customer, transaction and compliance information, reducing the number of organisations through which that data passes can simplify both security oversight and vendor-risk management.
This is about control, not abandoning support
A perpetual licence does not mean that a client is left to maintain T100 alone.
Thames Systems can continue to provide:
- maintenance
- technical support
- integrations
- development
- upgrades
- regulatory enhancements
- system customisation
The difference is that these become services the client can choose to use rather than dependencies required simply to keep its core system operational.
The client has greater freedom over how T100 develops within its organisation.
That helps reduce vendor lock-in while preserving access to the people who know the platform best.
From Software as a Service to Software under your control
In some ways, technology has come full circle.
Before SaaS became dominant, organisations commonly purchased enterprise software and operated it themselves.
SaaS solved many genuine problems and remains appropriate in many situations.
But for systems supporting important functions within heavily regulated financial organisations, the balance between convenience and control deserves closer examination.
The question is no longer simply:
“Can somebody else run this system for us?”
It is also:
“What happens to our business if that supplier — or one of its suppliers — becomes unavailable?”
That is fundamentally an operational resilience question.
How T100 approaches operational resilience
T100 is designed for regulated financial services firms that require long-term confidence in the technology supporting their compliance and operational processes.
The platform brings together client onboarding, compliance monitoring, regulatory workflows, data management and reporting within a modular system. T100 can integrate with existing banking, exchange, reference-data and back-office infrastructure rather than forcing firms to replace their entire technology stack.
The perpetual licence model adds another part to that approach:
control over the software itself and how it is deployed.
For firms considering their long-term technology strategy, that can provide:
- reduced dependency on a software vendor for hosting
- greater control over infrastructure and cybersecurity
- direct control over sensitive data
- access to the T100 source code under the licence
- flexibility over future maintenance and development
- the ability to use Thames Systems, internal teams or other specialists
- greater continuity if a supplier relationship changes
It does not remove the need for cybersecurity or operational resilience planning.
It puts more of that responsibility — and more importantly, the ability to act on it — directly in the client’s hands.
Frequently asked questions
Licence clarification:
A perpetual licence grants the client indefinite rights to deploy, use, and enhance the software internally, including full access to the source code to support operational continuity and long-term independence. The licence does not permit resale or redistribution outside the client’s organisation, and ownership of the intellectual property remains with Thames Systems.
Taking control of critical financial technology
T100 gives regulated financial firms the flexibility to run core compliance and operational technology within their own environment — reducing third-party dependency while retaining access to Thames Systems for support, maintenance and development.
