FCA Supervisory Response
A Dear CEO letter, an information request or a thematic review is not correspondence to be answered and filed. The FCA sets the regulatory purpose and expects reliable evidence in return, and how a firm answers shapes what follows. The task is to respond openly under Principle 11 while keeping control of your own governance, evidence and remediation. MEMA supports firms through that from the first letter to closure.
How a supervisory response runs
From the first ten working days through to closure. The FCA sets no standard sequence, so this is MEMA's approach rather than the regulator's.
Mobilisation & Governance
- Confirm sponsor, response lead, committee route and decision rights
- Parse every question, period, entity, product and population in scope
- Preserve relevant records and identify system owners
- Set up one intake and release process for FCA information requests
Evidence Control
- A controlled evidence process that improves completeness and traceability without slowing the response
- Recording the source system, extraction method, period, population, owner and reviewer for each delivery
- Version control on policies, committee papers and management information, so the review sees what applied at the time
- Factual, non-coached interview preparation for staff
Findings To Durable Remediation
- Containing an evident risk without waiting for the final report, and keeping the FCA informed where appropriate
- Connecting each finding to its evidence, affected population, root cause, containment and permanent action
- An independent effectiveness test before any action is closed
- Board and SMF support, including interview preparation
- What applies
- An FCA letter, information request or intervention
- Where it sits in the rules
- Principle 11, SUP 2
Where is the response today?
Choose the point where independent structure and evidence will help most.
Mobilisation
Set governance, scope, owners and information flow.
Evidence control
Organise records, testing and submissions.
Findings
Translate findings into root causes and actions.
Remediation
Embed changes and demonstrate sustainability.
Key FCA Supervisory Response Requirements
What the FCA expects, and the evidence behind it.
What you will need to produce
- Response and mobilisation plan
- Evidence register and secure review process
- Root-cause and remediation analysis
- Board reporting and sustainability testing
Mobilise a controlled response
The early response should create ownership, scope clarity and an evidence route.
Scope and governance
Define workstreams, decision rights, owners, escalation and contact points.
Evidence register
Control requests, sources, periods, populations, reviewers and delivery status.
Secure review process
Provide controlled access, versioning and a clear record of what was supplied.
Move from findings to durable remediation
A credible response explains why the weakness occurred and how it will stay fixed.
Root cause
Separate symptoms from the governance, process, people, system or oversight causes.
Remediation plan
Set actions, owners, dependencies, target evidence and quality-assurance checks.
Sustainability
Use MI and follow-up testing to show the change is embedded and outcomes improve.
How MEMA helps
A supervisory response runs on the firm's evidence. How that evidence is assembled and explained shapes what the FCA concludes, so the response starts before anything is drafted.
- 01
Mobilise the response
A response plan with owners, a single point of contact and an agreed way of handling requests, put in place at the start rather than assembled under pressure.
- 02
Control the evidence
An evidence register and a secure, consistent process for producing material, so what goes out is complete, accurate and traceable.
- 03
Understand the root cause
The firm's own analysis of why the issue arose, which is what separates a remediation plan from a list of fixes.
- 04
Build the remediation
A programme addressing cause rather than symptom, with the governance to show it is being run and not just written down.
- 05
Report and test durability
Board reporting throughout, and testing afterwards that the change held — the question a supervisor asks next.
Mistakes That Increase Regulatory Risk
Defensiveness is not the same as disciplined challenge. Firms may correct factual errors, clarify scope and explain contrary evidence. The risk arises elsewhere.
Related Services
Firms under supervisory scrutiny often need these alongside it
Related FCA Guidance
Primary sources and deeper reading on FCA supervision powers.
PRIN: Principles for Businesses
Principle 11 and the duty to deal with the FCA openly and cooperatively.
HandbookSUP: Supervision & Reporting
FCA supervision powers, regulatory reporting, and notification obligations.
HandbookSYSC: Systems & Controls
Governance, risk management and internal control requirements relevant to remediation.
Tell us where things stand
Whether a Dear CEO letter has just landed, an information request is open, or a thematic review is underway or another supervisory communication, tell us the position and we will come back to you.
Prefer to talk it through first? Call and you will speak to a consultant, not a switchboard.
Frequently Asked Questions
Select a question to view the answer.
What should a firm do first after a Dear CEO letter?
Establish who owns the response before drafting any of it. Confirm the deadline and exactly what has been asked, name a single accountable owner, decide which governance forum signs it off, and agree how evidence will be gathered and recorded. Firms that start by writing the reply tend to discover late that the underlying facts do not support it.
How open does a firm have to be with the FCA?
Principle 11 requires a firm to deal with its regulators in an open and cooperative way, and to disclose anything of which the FCA would reasonably expect notice. In practice that means not waiting to be asked about something you have already found. Being forthcoming about a problem you are actively fixing is a materially better position than the FCA discovering it later.
What makes an evidence process credible?
The firm should record the source system, extraction method, period, population, owner and reviewer for each delivery, with controlled access and clear links between evidence, findings and actions.
How should remediation be sustained after the review?
Actions should address root cause, have accountable owners and be tested through management information, quality assurance and follow-up monitoring so improvement is not limited to the report response.