Prepare for an FCA review by holding an indexed evidence library keyed to your obligations register, not by assembling a pack when the letter arrives. Reviews run on information requests under FSMA section 165 and on Principle 11 cooperation; assessors ask for dated artefacts (minutes, MI, monitoring reports) mapped to the rules they evidence.
Three things this article will leave you able to do
Predict most of the FCA's document request before it arrives.
Test any piece of evidence against the five properties assessors apply.
Set up an evidence library your team can answer from in days, not weeks.
An FCA information request is a test your firm sits before anyone reads a word. The deadline is usually short. The scope is usually broad. And the first thing it measures is not compliance but retrieval: can this firm actually find its own records?
Firms that pass treat evidence as a by-product of controls operating, filed as it is produced. Firms that struggle treat evidence as a deliverable to be created once a review is announced. The difference is visible to an assessor within the first folder.
Who this applies to
Every FCA-authorised firm. Principle 11 requires firms to deal with the regulator in an open and cooperative way and to disclose what the FCA would reasonably expect to know. FSMA section 165 gives the FCA the power to require information and documents; section 166 lets it appoint a skilled person at the firm's cost. SYSC 9 requires records that are sufficient for the FCA to monitor compliance. Preparation is not optional garnish on these duties; it is how a firm performs them under time pressure.
The three doors a review arrives through
Supervision. A firm assessment, a portfolio letter follow-up or a data request. Often framed as routine; always evidence-based.
A thematic or multi-firm review. The FCA examines one topic (Consumer Duty outcomes, safeguarding practices, operational resilience) across a portfolio and compares firms against each other. Your submission is read next to your peers'.
A section 166 skilled person review. The sharpest version: an external reviewer, appointed at your cost, testing whether the evidence supports what the firm has told the regulator.
The requests differ in tone, not in kind. All three come down to the same three-part question: show the rule, the control and the proof.
What assessors ask for
The request list is more predictable than firms expect. The table maps the usual asks to the requirement each one evidences.
If your firm cannot produce any row of this table within a working day, that row is where preparation starts.
The five properties of good evidence
Assessors apply the same tests an auditor does:
Dated. The artefact carries the date it was produced, not the date it was exported.
Attributable. A named author, approver or owner.
Contemporaneous. Produced when the control operated, not reconstructed afterwards. Backdating is a finding in itself.
Complete. The whole record, including the uncomfortable parts. A minute with no challenge recorded reads as a minute that was cleaned.
Retrievable. Locatable by someone other than its author, inside a working day.
The fifth property fails most often and it is the cheapest to fix.
Preparing before any letter exists
Build the evidence library against the obligations register: one register row, one evidence location. File artefacts as controls produce them (the reconciliation output on the day it ran, the minute when it was approved). Index by obligation, not by department, because the request will come framed in rules. Run a retrieval drill twice a year: pick ten register rows, ask someone outside compliance to produce the evidence, time it. The drill costs an afternoon and rehearses exactly what a review demands.
When the letter does arrive: confirm scope, nominate a single coordinator, log every document sent and never send an artefact you have not read. A skilled person will ask about the anomaly on page 40; the firm should not be hearing about it for the first time in that meeting.
How firms handle this
Most firms hold evidence where it was created (inboxes, shared drives, the MLRO's laptop) and discover the cost of that at request time. Some appoint consultants to build the pack under deadline, which produces a tidy submission and no lasting capability. Software keeps the artefacts attached to the obligations they evidence, so the pack already exists; our AuditGeniee assembles review-ready evidence packs from the register itself, mapped ask by ask. Whatever the method, the standard is the one this article started with: retrieval first, because retrieval is what the regulator experiences.
Primary sources
FSMA 2000, section 165 (power to require information) and section 166 (reports by skilled persons).
FCA Handbook, SUP 2 (the FCA's information gathering approach).
Volatile. Re-verify before each republish: the FCA's current supervisory priorities and portfolio letters for your sector · live thematic and multi-firm reviews · any change to the firm assessment model announced in the 2026/27 work programme.