PCD 1834 Decision to accept Home Office funds to facilitate payment for the Cyber Resilience Centre for London for FY2025-26

Executive Summary:  

The Cyber Resilience Centre for London (CRCL) was established to focus on cyber-crime prevention activity for micro, supporting small and medium sized companies across London. This is a National Police Chiefs Council led programme, funded by the Home Office, with money routed through the City of London Corporation.  

London’s Cyber Resilience Centre operates through a private company limited by guarantee, established for such purpose and known as Cyber Resilience Centre for London Limited (‘the CRCL Company’).  

MOPAC owns this company directly, and MOPAC acts as the police body through which Home Office funding for London’s Cyber Resilience Centre is facilitated.  MOPAC will own this company for the until changes set out below come into effect.  MOPAC is the sole member, no costs will be borne by MOPAC, with all money for operating costs refunded to MOPAC (via the City of London Police) from a Home Office grant for Regional Cyber Resilience Centres.  

In the forthcoming year the activity carried out by the CRCL will transfer to a police led national body. However, pending this transfer funding will still be required by the CRCL. As an interim measure, the Home Office has agreed to an extension of the CRC funding for cyber specific personnel for the first quarter of the new financial year, from 1 April to the end of June 2025.  It is likely that this staged approach will continue. 

Recommendation:  

The Deputy Mayor for Policing and Crime is recommended to:  

1. Approve that MOPAC accept grant funding from Home Office (via the City of London Police) for London’s Cyber Resilience Centre.  

2. Approve that the London CRC is provided with up to £171,000 for financial year 2025/26, only as and when funding from the Home Office is confirmed.   

3. The first payment will cover all staff and related costs for the first quarter (Apr-Jun) of 2025/26.  Subsequent payments may be made subject to appropriate funding from the Home Office. 

PART I - NON-CONFIDENTIAL FACTS AND ADVICE TO THE DMPC 

1. Introduction and background 

1. Cyber Resilience Centres (‘CRCs’) provide targeted advice and guidance to small and medium sized companies (‘SMEs’) to reduce and prevent cyber-crimes and cyber-enabled crimes.  

2. The CRCs model is led by the National Police Chiefs Council (‘NPCC’), supported through a central company National CRC Group Limited that provides services to regional CRCs.                 

3. Funding to support the CRC in London and in the regions comes from the Home Office, through the City of London Corporation to policing bodies and on to the regional CRC’s.          

4. The Cyber Resilience Centre for London Limited (the CRCL Company), is wholly owned by MOPAC.           

5. Issues for consideration  

1. The Home Office grant is provided in arrears and there is an expectation that MOPAC, will provide funding to CRCL pending reimbursement from the HO grant, via the City of London Police who are the initial recipient of the Home Office grant.  

2. In the last year a decision has been taken that the regional model will be changed and move from being company based to being part of policing delivery.  The new model will be run on a national basis through the City of London Corporation and City Police as the National lead force. 

3. The implementation of these changes is moving ahead but it will take time.  In order to maintain delivery of these important services the London CRC, as with all the regional CRC’s are continuing to operate.  To facilitate this the Home Office have issued a letter of comfort stating that at least for the first quarter they will meet all the staff and related costs for the CRC’s.  This includes the CRC for London.   

4. For the purposes of this decision, it is assumed the HO grant to CRC’s will remain consistent by awarding cc.£171,000 for FY2025-26.  However, indications are that these national changes will lead to an increase in Home Office funding.  Until the HO provides clarity, they have agreed an extension of the CRC National Cyber Crime Programme (NCCP) funding for cyber specific personnel (staff and officers) for the first Quarter of the new financial year, from 1 April to the end of June 2025.  This is confirmed in an attached letter of comfort. 

5. Receipt of this funding allocation will be conditional on performance and financial reporting, which will be set out in the Grant Agreement that will follow later in the new financial year.    

3. Financial Comments  

1. There is no net financial impact on MOPAC as all costs are reimbursed by the Home Office.  

2. MOPAC will pay London CRC in advance for costs incurred on staffing for the first quarter of 2025/26. The Home Office will then pay MOPAC a grant to cover these costs via the City of London Police (who administer the grant). There is a risk to MOPAC as the costs are paid in advance, but this is mitigated by the letter of comfort from the Home Office confirming they will reimburse MOPAC for costs incurred in the first quarter of 2025/26. 

3. It is likely given the complexity of the proposed structural changes that further quarterly payments will be needed. These will only be agreed once Home Office funding to support the costs is confirmed. 

4. Legal Comments  

Paragraph 4.8 of the MOPAC Scheme of Delegation and Consent provides that the Deputy Mayor for Policing and Crime (DMPC) has delegated authority to approve all bids for grant funding. 

5. Commercial Issues  

1. Funding of £171k for 2025/26 from the Home Office is required to go to the Cyber Resilience Centre for London which is a company wholly owned by MOPAC. 

5.2 This arrangement is exempt from the Procurement Act 2023, as noted within Schedule 2 Part 1, paragraph 2, as it’s a ‘counterparty exempted contract: vertical arrangement’ which exempts if from the full force of the legislation. 

5.3 The actions proposed can be taken in compliance with procurement legislation and MOPAC’s Contract Regulations.  

6. Public Health  

N/A 

7. GDPR and Data Privacy  

1. MOPAC will adhere to the Data Protection Act (DPA) 2018 and ensure that any organisations who are commissioned to do work with or on behalf of MOPAC are fully compliant with the policy and understand their GDPR responsibilities.   

8. Equality Comments  

1. MOPAC is required to comply with the public sector equality duty set out in section 149(1) of the Equality Act 2010. This requires MOPAC to have due regard to the need to eliminate discrimination, advance equality of opportunity and foster good relations by reference to people with protected characteristics. The protected characteristics are: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. 

9. Background/supporting papers 

• Appendix 1: Home Office Letter; National Cyber Crime Programme: Allocation of Funding for 2025/26