Skilled Person Reviews (Section 166): What Firms Must Know
A section 166 skilled person review is an independent report the FCA requires or commissions, normally at the firm's cost. This guide covers triggers, appointment, SUP 5...
Read the guideFIX A REGULATORY ISSUE
Respond To The FCAFCA Supervisory Response
Structure, evidence and senior oversight for an FCA supervisory response.
A Dear CEO letter, an information request or a thematic review is not correspondence to be answered and filed. The FCA sets the regulatory purpose and expects reliable evidence in return, and how a firm answers shapes what follows. The task is to respond openly under Principle 11 while keeping control of your own governance, evidence and remediation. MEMA supports firms through that from the first letter to closure.
SERVICE OVERVIEW
FCA Supervisory Response Support
Bring structure, evidence and senior oversight to an FCA supervisory response.
Firms responding to a Dear CEO letter, information request, thematic review or serious control concerns. A controlled response with clear workstreams, evidence ownership and durable remediation.
Evidence we help you build
- Response and mobilisation plan
- Evidence register and secure review process
- Root-cause and remediation analysis
- Board reporting and sustainability testing
Typical timeframe
Depends on the request
The timetable usually follows the deadlines in the FCA's letter or request, so we do not quote a standard duration.
Ideal for
- Firms responding to a Dear CEO letter
- Firms with an open information request
- Firms in a thematic review
- Firms facing serious control concerns
Where is the response today?
- Mobilisation
- Evidence control
- Findings
- Remediation
How MEMA helps you
- Mobilisation & Governance
- Evidence Control
- Findings To Durable Remediation
How a supervisory response runs
From the first ten working days through to closure. The FCA sets no standard sequence, so this is MEMA's approach rather than the regulator's.
- 1Mobilisation & Governance
- Confirm sponsor, response lead, committee route and decision rights
- Parse every question, period, entity, product and population in scope
- Preserve relevant records and identify system owners
- Set up one intake and release process for FCA information requests
- 2Evidence Control
- A controlled evidence process that improves completeness and traceability without slowing the response
- Recording the source system, extraction method, period, population, owner and reviewer for each delivery
- Version control on policies, committee papers and management information, so the review sees what applied at the time
- Factual, non-coached interview preparation for staff
- 3Findings To Durable Remediation
- Containing an evident risk without waiting for the final report, and keeping the FCA informed where appropriate
- Connecting each finding to its evidence, affected population, root cause, containment and permanent action
- An independent effectiveness test before any action is closed
- Board and SMF support, including interview preparation
How MEMA helps
A supervisory response runs on the firm's evidence. How that evidence is assembled and explained shapes what the FCA concludes, so the response starts before anything is drafted.
- 1Mobilise the responseA response plan with owners, a single point of contact and an agreed way of handling requests, put in place at the start rather than assembled under pressure.
- 2Control the evidenceAn evidence register and a secure, consistent process for producing material, so what goes out is complete, accurate and traceable.
- 3Understand the root causeThe firm's own analysis of why the issue arose, which is what separates a remediation plan from a list of fixes.
- 4Build the remediationA programme addressing cause rather than symptom, with the governance to show it is being run and not just written down.
- 5Report and test durabilityBoard reporting throughout, and testing afterwards that the change held — the question a supervisor asks next.
Where is the response today?
Choose the point where independent structure and evidence will help most.
Mobilisation
Set governance, scope, owners and information flow.
Evidence control
Organise records, testing and submissions.
Findings
Translate findings into root causes and actions.
Remediation
Embed changes and demonstrate sustainability.
Key FCA Supervisory Response Requirements
What the FCA expects, and the evidence behind it.
Scope and governance
Clarify workstreams, owners, decisions and escalation.
Evidence
Create a controlled record of facts, testing and actions.
Root cause
Address why the issue happened, not only the symptom.
Sustainability
Show how remediation will be monitored and maintained.
What you will need to produce
- Response and mobilisation plan
- Evidence register and secure review process
- Root-cause and remediation analysis
- Board reporting and sustainability testing
Mobilise a controlled response
The early response should create ownership, scope clarity and an evidence route.
- Scope and governance
- Define workstreams, decision rights, owners, escalation and contact points.
- Evidence register
- Control requests, sources, periods, populations, reviewers and delivery status.
- Secure review process
- Provide controlled access, versioning and a clear record of what was supplied.
Move from findings to durable remediation
A credible response explains why the weakness occurred and how it will stay fixed.
- Root cause
- Separate symptoms from the governance, process, people, system or oversight causes.
- Remediation plan
- Set actions, owners, dependencies, target evidence and quality-assurance checks.
- Sustainability
- Use MI and follow-up testing to show the change is embedded and outcomes improve.
Mistakes That Increase Regulatory Risk
Defensiveness is not the same as disciplined challenge. Firms may correct factual errors, clarify scope and explain contrary evidence. The risk arises elsewhere.
- Challenge that is unsupported, or disclosure that is only partial
- Parallel teams supplying inconsistent data to the FCA
- Re-creating historic evidence rather than preserving it as it stood
- Losing the link between a finding and the customer or market population it affects
- Presenting untested planned controls as though they were already complete
- Letting overdue remediation sit in a project plan instead of being escalated through governance
Related Services
Firms under supervisory scrutiny often need these alongside it
Related FCA Guidance
Primary sources and deeper reading on FCA supervision powers.
- PRIN: Principles for BusinessesPrinciple 11 and the duty to deal with the FCA openly and cooperatively.
- SUP: Supervision & ReportingFCA supervision powers, regulatory reporting, and notification obligations.
- SYSC: Systems & ControlsGovernance, risk management and internal control requirements relevant to remediation.
Explore our other services
Support that often sits alongside a supervisory response.
Frequently Asked Questions
Select a question to view the answer.
What should a firm do first after a Dear CEO letter?
Establish who owns the response before drafting any of it. Confirm the deadline and exactly what has been asked, name a single accountable owner, decide which governance forum signs it off, and agree how evidence will be gathered and recorded. Firms that start by writing the reply tend to discover late that the underlying facts do not support it.
How open does a firm have to be with the FCA?
Principle 11 requires a firm to deal with its regulators in an open and cooperative way, and to disclose anything of which the FCA would reasonably expect notice. In practice that means not waiting to be asked about something you have already found. Being forthcoming about a problem you are actively fixing is a materially better position than the FCA discovering it later.
What makes an evidence process credible?
The firm should record the source system, extraction method, period, population, owner and reviewer for each delivery, with controlled access and clear links between evidence, findings and actions.
How should remediation be sustained after the review?
Actions should address root cause, have accountable owners and be tested through management information, quality assurance and follow-up monitoring so improvement is not limited to the report response.
Practical review and remediation support
A response the evidence can support
We map the FCA's questions to the relevant entities, periods and records, reconcile management's explanations and prepare a response that states both what is evidenced and what remains uncertain.
What you receive: Request and evidence matrix, controlled response pack and clearly owned next steps.
We agree whether MEMA is advising, implementing changes or providing independent assurance. Where roles could conflict, the scope and reviewer separation must address that before the work starts.
Speak to a specialist
Tell us where things stand
Whether a Dear CEO letter has just landed, an information request is open, or a thematic review is underway or another supervisory communication, tell us the position and we will come back to you.
0330 133 0811
Prefer to talk it through first? Call and you will speak to a consultant, not a switchboard.