Practical guides, editable templates and clear answers. Choose the support you need, without working through everything.
Seven short guides. Start with the question you need to answer.
Clarify the scope, obligations and immediate priorities.
5 minute readTurn the letter into a controlled response: clear answers, attributable evidence and no surprises at the deadline.
5 minute readUnderstand the different regulatory tools, translate the actual wording into operating controls and prepare a credible route forward.
Connect the records, explanations and tests.
5 minute readBring together the rules, risks, policies and actual operating records so the review can test what the firm does, not just what its manual says.
5 minute readGive every record a place, a date and a purpose. Make screenshots, archives, versions and management answers easy to trace.
5 minute readCheck who you are dealing with, what they can do and why the asset or relationship is acceptable for your firm’s actual role.
Define the corrective work and how it will be verified.
5 minute readReplace “update the policy” with an action that addresses the cause, protects customers and has an objective closure test.
5 minute readTest real decisions and exceptions over a justified period, with traceable results and challenge separate from implementation.
Choose your situation for practical next steps and an optional checklist. No firm details or uploads needed.
Understand the request, assemble a traceable answer and manage the deadline.
Tick an item when you have it available. A tick records your preparation, not a finding that a control is compliant.
0 of 4 preparation items marked available
Only checklist ticks and your selected stage are saved in this browser. No information is sent to MEMA by this checklist.
Six editable files with instructions and fictional examples. Adapt them to your firm and the FCA's actual request.
Track source records, versions, dates, ownership and the question each item supports.
Map every question to a response, supporting evidence, outstanding work and approval.
Define the cause, corrective action, accountable owner and evidence required for closure.
Give management a concise view of progress, risk, decisions, exceptions and challenge.
Set the population, sample, test, acceptance criteria, reviewer and retest approach.
Explain what is supplied, its scope, limitations and any agreed follow-up clearly.
Two short explanations with captions. Prefer reading? Each has a full transcript.
A short animated explanation of deadlines, responsibilities and evidence preparation when the FCA contacts your firm.
Watch with transcriptFollow a fictional issue from the regulatory concern through a specific corrective action and a test of whether it works.
Watch with transcriptSearch all 36 answers or choose a topic. Every answer links to a guide and supporting sources.
36 questions
Read the whole request, establish its basis, deadline and scope, then appoint one response owner and a reviewer. Preserve the original communication and map every question to an answer and supporting evidence.
If it is a formal notice or raises privilege, misconduct or legal-rights questions, obtain appropriate legal advice. An information request is not automatically an enforcement investigation.
You can contact the named FCA contact promptly to explain the specific difficulty, propose a realistic date and offer staged delivery where useful. Include what can be supplied by the original deadline.
Do not assume the deadline has changed because an extension was requested. Retain written confirmation of any agreed change and comply with the operative request or obtain legal advice about a formal notice.
Use a question-by-question response matrix. For each point give the answer, evidence reference, relevant period, limitation and outstanding action. Reconcile figures and distinguish complete populations from samples.
Add a short covering note and an exact attachment list. This is MEMA’s recommended working method, not a prescribed FCA form. Follow the format specified in your actual request.
Sometimes. A legible, attributable screenshot may establish a system field, current setting or workflow step. It may not show the complete history or the document underlying the entry.
Assess the question being answered. Request a source document only where its content, authenticity, context or transaction linkage is still needed; printing every screenshot to PDF does not necessarily strengthen the evidence.
Record what is missing, the searches made, the systems and periods affected, and any alternative evidence. Distinguish not yet located, inaccessible, never created and irrecoverable.
Explain the current risk response without presenting a new check as historic proof. Assess retention, notification and customer-impact implications with the appropriate specialists.
Assess its significance promptly and correct the position transparently through the appropriate FCA channel. Identify the original answer, the correction, why it changed and any wider impact.
Keep both versions and the approval trail. Consider applicable notification duties and legal advice; do not silently replace an attachment and assume the issue is resolved.
VREQ is the common abbreviation for a voluntary requirement: a firm agrees to have a requirement imposed on it. It may require action or restrict particular activities.
Its practical effect comes from its exact wording, effective date and formal clarifications. Once operative, it is not optional simply because it was agreed voluntarily.
A VREQ is agreed voluntarily; an OIREQ is imposed using the FCA’s own-initiative powers. Neither label tells you the full operational scope: read the requirement itself.
Notices, process and legal rights may differ. Obtain advice on the particular instrument rather than treating an OIREQ as merely a different name for an agreed remediation plan.
The FCA may seek a requirement where it identifies actual or potential harm, including concerns about systems and controls. There is no single automatic trigger or universal sequence.
The circumstances, seriousness and protective action needed matter. A particular control weakness does not inevitably result in a VREQ, and generic guidance cannot predict the outcome for an individual firm.
Only within its permissions and the operative requirement. Some requirements limit particular business; others require actions without the same trading restriction. Do not infer the answer from another firm’s case.
Map the wording to products, pipeline transactions, effective times and any permitted exceptions. Resolve ambiguity through the proper channel before carrying out the affected activity.
The applicable process and evidence depend on the requirement and FCA engagement. Track its conditions, demonstrate the relevant corrective work and provide the verification requested.
A completed consultant report or internal sign-off does not itself remove a requirement. Continue complying until a formal variation or removal takes effect; no adviser can guarantee the FCA’s decision or timetable.
No. Requirements are regulatory tools that can protect consumers or address risk. They are distinct from a financial penalty or an enforcement finding, although they may arise alongside other action.
Read the published entry, notice and correspondence carefully. Do not describe the firm as cleared, sanctioned or in breach merely from the abbreviation alone.
No. A section 166 skilled person review uses a specific statutory power and appointment process. A firm-commissioned independent review is not automatically a statutory skilled person review.
Confirm the legal basis and agreed scope. MEMA’s educational resources do not imply that MEMA is appointed to a skilled-person panel or authorised to undertake every statutory engagement.
Usually the relevant risk assessments, current and historic procedures, governance records, population data, selected case files, audit histories, screening decisions, monitoring evidence and remediation records.
The exact list depends on the business and scope. Supply source dates and management responses alongside the documents, and preserve evidence of actual operation rather than only the latest policy.
Not automatically. Agree a defensible population and sampling approach based on the concern, risks, applicable requirement and any need for a wider look-back.
Some issues require a complete affected-population exercise. A risk-based sample can identify weaknesses but should not be presented as a statistically representative error rate unless its design supports that conclusion.
A controlled workspace can organise evidence, link responses to points and retain versions. The important outcome is traceability: the reviewer can see what was supplied, what it proves and what remains.
Portal availability does not itself mean every item has been reviewed or accepted. Access, confidentiality, retrieval and the scope of any platform support are agreed for the engagement. Public demonstrations use fictional data.
Potential conflicts and self-review risk need explicit assessment. Do not describe implementation work as independent assurance without explaining how independence is protected.
Depending on scope and risk, a separate reviewer, separate team or additional independent challenge may be needed. A statutory appointment may have its own requirements. Agree these arrangements before work starts.
A clear scope and methodology, evidence considered, reasoned findings, management responses, limitations and a prioritised remediation plan with objective closure tests.
It should distinguish historical compliance, current implementation and sustained operation. A report should state what has actually been verified and must not imply regulatory acceptance merely because the review is complete.
Scope can include risk assessment, governance, customer due diligence, enhanced measures, screening, monitoring, training, record keeping and assurance. Broader financial-crime risks may also be relevant.
Start with the activities and obligations that apply to your firm. An AML checklist is not a substitute for assessing sanctions, fraud or other material risks where those are in scope.
No. Enhanced measures must reflect the relevant requirements and risk. The specific PEP provisions and the firm’s own approval policy should not be confused with an identical statutory package for every higher-risk customer.
Explain why the measures are appropriate, what was done and who made the decision where approval is required. A high-risk label without a reasoned response is not enough.
It can establish the later screening position, but it does not prove what was checked or decided at onboarding. Keep the historical limitation separate from the current relationship assessment.
Review the complete report, identifiers, coverage and reasoned disposition. A current clean result does not retrospectively establish that the earlier process operated.
An attributable record of the report reviewed, relevant identifiers compared, evidence considered, rationale and the required decision or escalation. A bare “false positive” label may not explain the assessment.
Do not dismiss a result solely because the original search omitted an identifier that appears elsewhere in the file. Escalate sanctions concerns under the applicable regime and procedure; a vendor score is not a legal decision.
Source of funds concerns the origin of money involved in a relationship or transaction. Source of wealth concerns how the person accumulated their overall wealth.
The enquiries and supporting evidence should reflect the applicable obligation and risk. A bank receipt may show a payment arrived without explaining its economic source; a full wealth pack is not automatically required for every customer.
Identify the operative methodology, version, inputs, weights, thresholds, calculation date and any override. Recalculate the case and explain which score is approved and why.
Then identify whether the defect affects other records, their due-diligence treatment or review dates. Simply asking someone to confirm the preferred number does not resolve the underlying conflict.
The verified issue, cause, affected population, corrective action, owner, target date, dependencies, priority and objective closure evidence. Distinguish immediate safeguards from longer-term changes.
Keep management’s progress claim separate from verification. The free tracker provides a starting structure, not a universal FCA-mandated format.
When the agreed closure criteria have been met and verified, with any limitation made explicit. Approval of a policy may close a design action but not a separate affected-book correction or effectiveness test.
If a historic record cannot be recreated, agree a reasoned disposition and current-risk response rather than backdating evidence or keeping an impossible document request open indefinitely.
There is no universal period. The appropriate observation window depends on control frequency, transaction volume, original risk and any specific FCA condition or agreed testing plan.
Explain why the period and sample are sufficient. If a new control has not operated often enough, report implementation separately and set a justified follow-up test.
Point to the exact response, evidence identifier and page, cell or image location. Explain what it answers and ask the reviewer to state any narrower remaining gap.
The controlling register should credit the evidence, revise the assessment where warranted and retain the history. Neither side should need to restart from an unstructured email chain.
Progress against defined milestones, unresolved material risks, overdue work, customer impact, exceptions, assurance results and decisions required. Explain what any completion percentage actually measures.
Record challenge, ownership and follow-through. A meeting or a dashboard alone does not establish that the underlying controls are effective.
Yes, a reasoned review conclusion can distinguish the principal concern from specific follow-up improvements. State what is evidenced, what remains and why the residual work does or does not change the conclusion.
Do not use that judgement to bypass a condition in an operative requirement. Regulatory variation or removal is a separate decision.
No. Check the exact legal entity, status, relevant permissions, limitations and any restrictions. Confirm that these match the activity actually performed.
For an appointed representative or overseas entity, additional scope and responsibility questions may arise. A trading name or group relationship does not establish the necessary authority.
A proportionate assessment can cover entity and regulatory identity, relevant permissions, ownership and control, authorised people, agreements, insurance where relevant, access and ongoing-review triggers.
The exact obligation depends on the relationship and the firm’s role. Evidence for a beneficial owner should not automatically be treated as identification or screening of a different account holder.
No. Fund status is one question; your firm’s permission, limitations, role, product rules and internal approval criteria are separate questions.
Check the exact instrument or share class and the relevant date. Retain the legal or regulatory basis and escalate ambiguity rather than relying on a marketing description or a generic approved list.
Use the rules, permission and evidence relevant at the time, alongside the firm’s approval criteria. Identify the instrument, decision, information relied on, holdings and any client-impact question.
Keep later corrective work separate. A new approval process can improve current controls without proving that each older decision was adequately supported.
Shared documents may explain a group, but each relationship needs clear attribution to the contracting entity and people involved. Establish the basis for any reliance arrangement and access to the relevant records.
Map duplicate references, name changes and ownership links explicitly. Do not assume group membership removes the need to understand the separate entity and its activities.
No. CP26/20 is a SIPP-sector consultation and must not be treated as a set of final rules applying to every regulated firm.
Assess existing obligations and relevant sector guidance, and check any subsequent final policy and commencement dates before changing the legal basis of your controls.
Open an example, or read the anonymised case study.
Explore the stages of an evidence-led review. This is MEMA's approach, not a fixed sequence prescribed by the FCA.
Agree the review basis, relevant obligations, entities, period and intended outcome.
This simplified illustration shows how an organised evidence workflow can connect a record, the firm's explanation, a review assessment and an action. It is not a live client portal or a demonstration of regulatory approval.
The export shows the screening position on the date it was generated. The procedure describes the current process.
Keep the limit clear: Neither record establishes what was reviewed or decided at the earlier onboarding date.
A useful action explains what must change and how someone else can verify the result.
“Improve screening and train staff. Compliance to confirm complete.”
“The financial-crime lead will introduce a named decision record for screening matches, train the people making those decisions and review the affected live-client population. A reviewer who did not make the decisions will test the retained reasons and escalation against the procedure. Record the sample, exceptions and follow-up before closure.”
The sample size and testing period depend on the risk and the change. This example is not a universal FCA requirement.
Build a remediation actionAn anonymised account of MEMA’s approach to an independent review. Identifying details, dates, counts and product specifics are deliberately omitted.
Read how the review was delivered
MEMA supports supervisory responses, independent reviews and remediation. We agree scope and reviewer separation first; the FCA decides on any requirement.
General guidance. Your firm's permissions, applicable rules and the actual FCA request take priority.