MEMA Guides / FCA remediation
How do you remove an FCA voluntary requirement (VREQ)?
Move from a restriction and a list of completed actions to a reasoned case for cancellation, backed by root-cause remediation and evidence that your controls work.
- 6 monthsfor a Part 4A firm, the FCA has to determine a complete application to vary or cancel a requirementSource
- VREQa firm can agree a requirement voluntarily; if it will not, the FCA may impose an OIREQSource
- Not automatica request to cancel changes nothing until the FCA formally decidesSource
The guide in 30 seconds
Practical guidance- 01Finished actions are not closureThe FCA has to be satisfied the risk behind the requirement has been addressed.
- 02Evidence follows the concernOrganise proof by the original risk, not by the team that produced it.
- 03Do not pre-empt the decisionKeep complying with the requirement until the change formally takes effect.
Explore the chapters
Read them in order, or jump to the one you need.
01Start with the exact wording of the restrictionDo not plan a closure case from a summary in a board pack. Work from the requirement itself and the FCA's correspondence.
02Trace the root cause before you close the actionsChanging a policy is rarely enough if the failure was in how work was done. Show that the same risk has gone.
03Build an evidence file a supervisor can followOrganise evidence by original concern, not by the team that produced it. Distinguish a control that exists on paper from one that has operated.
04Worked example: a restriction on new advice businessShow what changed in outcomes, not only in the procedure manual.
05How to request variation or cancellationThe process is a decision by the FCA, not an automatic expiry. Agree the route with your supervisor first.
06Closure pack and board decision checklistA credible submission should hold up under questions from someone who knows nothing about your remediation project.
Chapter 01 · What you agreed
Start with the exact wording of the restriction
Do not plan a closure case from a summary in a board pack. Work from the requirement itself and the FCA's correspondence.
The FCA puts requirements and directions on firms to take specific actions or stop certain activities, for example to stop taking on new customers. It says firms can voluntarily agree to a requirement, direction or limitation (a VREQ, VDir or VVOP), and it can use its own-initiative powers to impose one (an OIREQ, OIDir or OIVOP). They are typically published on the Financial Services Register.
In its approach to supervision, the FCA says that where it or a firm has identified risks around systems and controls, it may invite the firm to sign a VREQ that it will not accept new business until the issue is resolved. If the firm does not agree voluntarily, the FCA may impose an OIREQ.
Read the original requirement and all later FCA correspondence. Identify the protected customer group, the restricted activity, any approval or notification conditions, review points and any evidence the FCA said it would expect. If the stated concern has changed, ask your supervisor to confirm what remains outstanding.
| Record | What to capture |
|---|---|
| Restriction | The exact conduct that is prohibited or required, and the effective date. |
| Original concern | The specific risk or harm, and the events or control failures behind it. |
| Relevant obligations | The rules, threshold conditions, Consumer Duty or other standards engaged. |
| Exit criteria | Any written criteria, reporting condition or evidence the FCA asked for. |
| Accountability | Board sponsor, remediation lead, control owners and independent reviewer. |
Chapter 02 · Why it happened
Trace the root cause before you close the actions
Changing a policy is rarely enough if the failure was in how work was done. Show that the same risk has gone.
The FCA expects firms, when things go wrong, to stop actual harm as quickly and proportionately as possible, put things right including redressing customers, and address the root causes. It says firms should take prompt action to put things right, conduct a root cause analysis and take steps to prevent it happening again.
A closure case should therefore show the risk behind the requirement has been removed or adequately reduced. Completing an action tracker does not do that by itself.
From failure to sustained control
Stage 1 of 6
Identify the failure
Describe the failure, the customers or transactions affected and the control that should have prevented it.
- Define the affected population
- Name the control that failed
Stage 2 of 6
Assess customer harm
Review the affected customers, complaints, redress or corrections and whether any ongoing risk remains.
- Quantify harm and redress
- Record any remaining exposure
Stage 3 of 6
Fix the design
Change governance, systems, decision rules, capability, staffing, supplier arrangements or permissions where needed.
- Assign an owner to every change
Stage 4 of 6
Implement and train
Evidence approvals, system changes, procedures issued, training delivered and management ownership.
- Keep dated records of each step
Stage 5 of 6
Test operation
Sample cases, exceptions, outcomes and management information, with independent assurance, should show the control now works.
- Sample real cases
- Record exceptions and findings
Stage 6 of 6
Show sustainability
Set future monitoring, escalation thresholds and board reporting so the control stays effective after the restriction goes.
- Agree re-escalation triggers
Chapter 03 · Proof, by concern
Build an evidence file a supervisor can follow
Organise evidence by original concern, not by the team that produced it. Distinguish a control that exists on paper from one that has operated.
For each evidence item, record the owner, the date range, the population tested, the exceptions, the finding and the board's conclusion. There is no universal observation period. How long a control needs to operate before it proves anything depends on the risk and on how often the process runs.
| Original concern | Evidence of closure |
|---|---|
| Unsuitable advice or weak file quality | Revised advice process, completed staff training, representative quality assurance results, exceptions and trend MI. |
| Financial crime control gaps | Updated risk assessment, changed screening and escalation, tested alerts, suspicious activity report governance and MLRO reporting. |
| Governance or oversight failure | Board minutes, responsibility map, revised management information and escalation decisions. |
| Financial resilience | Forecasts, adequate funding, stress tests, prudential monitoring and credible recovery or wind-down actions. |
| Systems or outsourcing weakness | Supplier controls, incident testing, documented contingency plans and independent review findings. |
Illustrative example Not FCA figures. Use your own.
Chapter 04 · An invented firm
Worked example: a restriction on new advice business
Show what changed in outcomes, not only in the procedure manual.
- Clearly suitable28 files
- Unclear12 files
An invented result. Stopping at "40 files reviewed" would hide that 12 are unclear.
Illustrative example Not FCA figures. Use your own.
The closure case should explain how the files were sampled, what was found, what was corrected, what exceptions remain, who signed it off and which controls will cover future clients. With 12 of 40 cases unclear, calling the exercise complete may be premature.
The board should be able to say why these results support reopening, what the future quality assurance programme will test and who can stop business again if standards fall. Where the original failure was serious or went on for a long time, an independent review may strengthen the assurance.
Chapter 05 · A regulatory decision
How to request variation or cancellation
The process is a decision by the FCA, not an automatic expiry. Agree the route with your supervisor first.
For a firm with a Part 4A permission, section 55L(5) of the Financial Services and Markets Act 2000 lets it apply to the FCA to vary or cancel a requirement the FCA has previously imposed. The FCA's Handbook (SUP 6.3) adds that a firm is advised to discuss its application with the FCA before submitting it, and to include as much detail as possible.
Payments and e-money firms are not Part 4A firms. The FCA's payments pages list a separate route to apply to vary an authorisation, registration, limitation or requirement. Agree the right route and the form with your FCA contact, especially if the requirement was imposed under a different regime.
Timing for Part 4A firms (SUP 6.3)
- Before applyingDiscuss the plan with your supervisory contactAs early as possible, to agree the correct approach.
- On a complete applicationThe FCA has six months to determine itSUP 6.3.35 G, applying section 55V(1).
- If incompleteUp to twelve months from receiptSUP 6.3.36 G, applying section 55V(2).
- If the FCA is lateThe application is not deemed grantedSUP 6.3.38A G.
Send a concise letter that states the change you want, the history, the original risk, the actions taken, the operating-effectiveness evidence, anything outstanding and your proposed future oversight. Add a clearly indexed evidence pack.
Chapter 06 · Put it to work
Closure pack and board decision checklist
A credible submission should hold up under questions from someone who knows nothing about your remediation project.
The strongest cancellation case is a reasoned evidence pack. It shows the risk has changed, and that the board can keep it under control after the activity restarts. Ask for a defined regulatory outcome, not simply for the restriction to go.
Is the closure pack ready?
Tick each item you can evidence. Your ticks stay in this browser only.
| Question | Short answer |
|---|---|
| Will the FCA remove a VREQ once every action is closed? | Not automatically. The FCA must be satisfied the risks are addressed and that the change is appropriate. |
| How much operating-effectiveness evidence do we need? | There is no universal sample size or number of months. Scope the testing to the original concern, the volume of activity and the severity of the risk. |
| Can we restart the restricted activity while the request is pending? | No. Keep complying with the requirement unless and until a formal change takes effect. |
Where this comes from
Sources
Every number and rule in this guide comes from these pages. Check them before you rely on anything, as rules change.
- FCA: FCA updates to requirements, limitations and directions
- FCA: Our approach to supervision
- FCA Handbook, SUP 6: Applications to vary and cancel Part 4A permission and to impose, vary or cancel requirements
- FCA Handbook, SUP 7: Individual requirements
- FCA: Apply to become an e-money or payment institution
- Financial Services and Markets Act 2000, section 55L
This guide is general information, not legal or regulatory advice. Rules and FCA expectations change; check the sources and take advice on your firm's circumstances.