VREQs, OIREQs and independent reviews: what firms need to know

Start with the distinction

A voluntary requirement, commonly called a VREQ, is a requirement a firm agrees to have imposed. An own-initiative requirement, or OIREQ, is imposed through the FCA’s own-initiative powers. Requirements can restrict activities or require specific action; the effect depends on their wording. A voluntary label does not make an operative requirement optional.

A skilled person review under section 166 of the Financial Services and Markets Act is a separate statutory mechanism. An independent review commissioned by a firm is not automatically a section 166 review, even if it concerns the same control weaknesses. Establish the legal basis, appointment arrangements, reporting audience and agreed scope before describing the engagement publicly or internally.

There is no single automatic trigger

The FCA explains that requirements can be used where it sees actual or potential harm. Systems-and-controls weaknesses are one possible context; the response depends on the circumstances. A control finding does not automatically produce a VREQ, and a VREQ is not itself a finding of every possible breach. Avoid generic predictions about what the FCA will do to a particular firm.

Gather the operative requirement, any notice, the firm’s permissions, the underlying correspondence and subsequent written clarifications. Separate binding wording from management’s interpretation or informal working assumptions. If a phrase such as new business, acceptance or completion affects a live transaction, obtain clarification through the proper channel rather than relying on this guide.

Translate the requirement into daily controls

MEMA recommends an implementation map showing each obligation, its effective date and time where relevant, affected products, permitted exceptions, system controls, owner and retained evidence. Identify who can authorise exceptions and whether any such discretion is actually allowed. Brief Operations, sales, compliance, technology and customer-facing staff using the same interpretation.

Test the controls at the boundary. For example, distinguish application, approval, receipt of funds and completion when the wording makes those events relevant. Keep time zones explicit. Review the affected pipeline and cancelled or withdrawn cases, not only completed transactions. Record the final client and money or asset position so unresolved cases do not disappear from the monitoring population.

1. Identify each operative obligation and any written clarification.
2. Map it to the relevant workflow and customer population.
3. Apply protective controls and log exceptions.
4. Test transactions and report unresolved interpretation or compliance concerns.

A report is one step, not automatic release

Build the remediation plan around the concern and the evidence needed to address it. Distinguish a redesigned policy, implementation of the change, correction of affected records and testing over a suitable period. The relevant condition may require one or several of these steps; do not invent a standard embedding period that applies to every firm.

Continue to comply with the operative requirement until its variation or removal is formally effective. Neither a consultant’s report nor management’s completion declaration removes it. MEMA can help explain the evidence, challenge the proposed closure position and prepare the response, but cannot promise FCA approval or removal on a fixed timetable. Take legal advice on notices, representations, rights and the precise effect of the restriction.