Fidelity Investments

United States · www.fidelity.com · 20 vendors

FMR LLC, commonly known as Fidelity Investments, is a privately held financial services company headquartered in Boston, Massachusetts. It offers a wide range of financial products and services for individuals and businesses, including investment management, brokerage services, retirement planning, and wealth management. The company is one of the largest asset managers globally.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 20 sub-vendors.

Insights

Last updated 2026-08-15 · revision 2

20 direct vendors, 183 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 10/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Fidelity Investments exhibits exceptionally high migration readiness, primarily driven by its state-of-the-art and highly portable internal technology stack. The company has adopted a multi-cloud strategy utilizing AWS, Microsoft Azure, and Google Cloud Platform, coupled with extensive use of Kubernetes and Docker for containerization, and a microservices architecture. This cloud-native, API-first approach ensures that applications are decoupled, scalable, and highly portable across different environments, significantly reducing the technical friction typically associated with large-scale migrations. A critical factor contributing to this high readiness is the reported "Total Vendors: 0". This implies an absence of external vendor dependencies and associated lock-in risks, which are often major impediments to migration efforts due to complex contract negotiations, data egress fees, and re-platforming challenges. By managing services internally, Fidelity avoids these external hurdles, streamlining potential migration pathways. While specific data on regulatory environment complexities and data residency requirements is not provided, which could introduce some challenges for a financial services firm, the underlying technical architecture and lack of external vendor lock-in strongly indicate a highly agile and adaptable infrastructure, making Fidelity exceptionally well-prepared for any future migration initiatives.

Compliance

13 in-scope frameworks identified; showing 3.

ERISA — Compliant

Fidelity is one of the largest 401(k) recordkeepers and retirement plan service providers in the United States, making ERISA compliance a core business obligation. Risk is High because: (1) Fidelity serves as a fiduciary or service provider to millions of retirement plan participants; (2) ERISA violations can result in DOL enforcement, plan disqualification, and personal liability for fiduciaries; (3) the DOL's cybersecurity guidance (2021) adds information security obligations for plan service providers; (4) Fidelity's retirement plan business is a primary revenue driver. Compliance is assessed as likely given Fidelity's scale and regulatory sophistication.

Evidence: https://www.fidelity.com/retirement/retirement-planning, https://www.fidelity.com/retirement-ira/small-business/compare-retirement-plans, https://about.fidelity.com

GLBA — Compliant

GLBA is a foundational US federal law for financial institutions and directly applies to Fidelity as a broker-dealer, investment adviser, and financial services company. Risk is High because: (1) GLBA's Safeguards Rule (updated 2023) requires comprehensive information security programs; (2) FTC and banking regulators actively enforce GLBA; (3) the updated Safeguards Rule (effective June 2023) requires specific technical controls, incident response plans, and annual reporting to boards; (4) Fidelity's privacy notice is explicitly provided in accordance with federal law (GLBA), as stated on the privacy page.

Evidence: https://www.fidelity.com/privacy/notice, https://www.fidelity.com/privacy/overview, https://www.fidelity.com/security/overview

NIS2 (source) — Assessment Required

NIS2 Directive (EU 2022/2555), which replaced NIS1 and was required to be transposed into national law by October 2024, explicitly classifies 'banking' and 'financial market infrastructures' as Essential Entities under Annex I. Fidelity operates in the financial services sector across EU member states through Fidelity International and institutional operations. With over 80,000 employees globally and revenues well exceeding €10M, Fidelity far exceeds NIS2 size thresholds. Risk is High because: (1) financial sector is explicitly listed as Essential Entity; (2) non-compliance penalties can reach €10M or 2% of global annual turnover for Essential Entities; (3) NIS2 imposes strict cybersecurity risk management, incident reporting (within 24 hours for early warning, 72 hours for notification), supply chain security, and management accountability obligations; (4) enforcement began in EU member states from October 2024 onward. Assessment Required because the specific EU legal entities subject to NIS2 and their registration status with national competent authorities has not been publicly confirmed.

Evidence: https://about.fidelity.com, https://www.fidelity.com/security/overview, https://www.fidelityinternational.com, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

Financials

Three-year financials

Financial Resilience Score: 9/10

Fidelity Investments demonstrates exceptional financial resilience, evidenced by revenue growth from ~$21B in 2020 to $37.7B in 2025 (~12% CAGR) and operating income roughly doubling from ~$8.0B in 2022 to $12.7B in 2025. Operating margins have expanded from ~30% to ~34% over the last three years, reflecting strong operating leverage as AUA has scaled from $9.8T to $18.0T (reaching $19.9T at mid-2026). The company benefits from significant scale, business diversification across asset management, brokerage, workplace retirement, custody/clearing, and cash-management economics. Private ownership by the Johnson family and employees provides a long-term orientation free from quarterly EPS pressure, enabling sustained reinvestment in technology and innovation. Fidelity is the largest US 401(k) recordkeeper, holds ~20% HSA market share, and has been a first-mover in zero-expense-ratio funds, spot bitcoin/ether ETPs, and ETF share classes on mutual funds. Morningstar upgraded Fidelity's Parent Firm Rating to 'High' (its top rating) in 2026. Key risks include market sensitivity of fee revenue to equity/bond valuations, interest-rate sensitivity given meaningful contribution from cash-sweep economics since 2023, ongoing fee compression from zero-commission competitors, US market concentration, and regulatory exposure (DOL fiduciary rules, cash-sweep litigation, crypto regulation). Additionally, as a private company Fidelity does not disclose a full consolidated balance sheet, capital ratios, or debt profile, limiting external transparency.

Key strengths: Scale with ~$18T AUA and ~$7T managed assets, Diversified revenue across asset management, brokerage, workplace retirement, custody, and cash-management economics, Private ownership enables long-term orientation without quarterly EPS pressure, Strong operating leverage: operating income grew 24% in 2025 vs 15% revenue growth, Leader in US 401(k) recordkeeping and IRAs with sticky sponsor-based distribution, Innovation leadership in zero-fee index funds, crypto ETPs, and ETF share classes, Morningstar 'High' Parent Firm Rating (top rating) in 2026, Revenue CAGR of ~12% over five years (2020-2025)

Risk factors: Market sensitivity - fee revenue levered to equity/bond market valuations, Interest-rate sensitivity as cash-sweep/net interest income is significant profit driver, Fee compression from zero-commission and ultra-low-fee competitors (Schwab, Vanguard, Robinhood, BlackRock), Concentration in US market with limited geographic diversification, Regulatory risk including DOL fiduciary rules, SEC oversight, cash-sweep litigation, and crypto regulation, Opaque disclosure as a private company - no audited public balance sheet, capital ratios, or debt profile

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report