Drafting an FCA Principle 11 notification: SUP 15 submissions that prevent a Section 166
At Compliance Consultant, we frequently see mid-sized financial services firms approach an FCA Principle 11 notification as an unstructured confession rather than a controlled regulatory event. When an operational incident or rule breach occurs, notifying the Financial Conduct Authority | FCA under Chapter 15 of the Supervision manual (SUP 15) requires precise factual containment, not panic. A poorly structured notification signals a loss of management control, practically inviting an expensive Section 166 skilled person review under the Financial Services and Markets Act 2000. Drawing on the 25+ years of UK regulatory experience of our founder, Lee Werrell, our team of seven qualified consultants advises firms to submit notifications that simultaneously satisfy regulatory transparency, isolate the root cause, and prove that senior management already has remediation well underway.
Assessing whether an issue crosses the SUP 15.3 threshold
Not every internal deviation requires a formal notification to the regulator. Before opening the notification system, compliance teams must test the facts against the statutory triggers set out in SUP 15.3 General notification requirements. The rules establish clear thresholds for what constitutes an event with serious regulatory consequences.
Firms are required to notify the regulator immediately when they become aware, or possess information that reasonably suggests, any of the following four conditions have occurred, may have occurred, or could occur in the foreseeable future:
- The firm is failing, or likely to fail, to satisfy one or more of the Threshold Conditions set out in COND.
- Any event occurs that could produce a significant adverse impact on the firm's reputation.
- The firm experiences an issue affecting its ability to provide adequate services, resulting in serious detriment to a customer.
- An event occurs that could lead to serious financial consequences for the wider UK financial system or other regulated entities.
Beyond these four core triggers, Principle 11 of the FCA Principles for Businesses mandates that a firm deal with its regulators in an open and cooperative manner. The principle requires disclosure of anything relating to the firm of which the regulator would reasonably expect notice.
In practice, this means evaluating both the likelihood of an outcome and its severity. A minor calculation error in client reporting that is identified and reversed within hours with zero customer loss does not meet the threshold of serious detriment. Conversely, a systematic flaw in an automated underwriting algorithm that generated incorrect interest charges across hundreds of borrower accounts across six months crosses the line into serious detriment, directly engaging Principle 11 and SUP 15.3.1 R.
Dual-regulated firms must also remember that where a rule appears in both the FCA Handbook and the PRA Rulebook, the term "appropriate regulator" refers to both bodies. In those cases, the PRA firm enquiries team and the designated FCA supervisory team must receive concurrent notifications.
Filtering out inside information and individual conduct breaches
A common operational error during an incident is using the standard firm notification form to report issues that belong in separate regulatory channels. Conflating distinct reporting mechanisms slows down regulatory processing and exposes the firm to procedural challenges.
+---------------------------------------------------------------------------------------+
| REGULATORY EVENT DETECTED |
+---------------------------------------------------------------------------------------+
|
+-----------------------------------+-----------------------------------+
| | |
v v v
[ Market Abuse / MAR ] [ Senior Staff Conduct ] [ Operational / Systemic ]
| | |
v v v
Inside Information? COCON Breach / Action? Firm-wide SUP 15 Trigger?
| | |
v v v
Market Observation Form Form D / Annual REP008 Firm Notification Form
(via Connect System) (SUP 15.11 Regime) (via Connect / Email)
Inside information constraints
Under the official guidance for the Firm notification form (SUP 15) | FCA, firms must not include inside information within a standard SUP 15 form or any of its supporting attachments.
If your internal incident touches on market abuse, insider dealing, or the unlawful disclosure of inside information under the UK Market Abuse Regulation, that data must be routed through the dedicated market observation form on the FCA Connect portal. Mixing sensitive market observations into a standard operational notice creates data handling conflicts within regulatory teams and demonstrates a basic lack of procedural control.
SMCR and COCON breach reporting
Firms must separate firm-level operational failures from individual accountability issues under the Senior Managers and Certification Regime (SMCR). An operational breakdown may highlight an individual mistake, but that does not automatically make it appropriate to name and report that employee inside a firm-level SUP 15 notice.
Breaches of the Code of Conduct sourcebook (COCON) operate under their own explicit notification timeline under SUP 15.11:
- Disciplinary action against a Senior Management Function (SMF) holder for a conduct breach requires formal notification via Form D within seven business days of the disciplinary action concluding.
- Conduct rule breaches resulting in disciplinary action against certified staff or other conduct staff are reported annually via regulatory return REP008 in October.
Naming individual staff members in an operational SUP 15 narrative before an internal disciplinary investigation has concluded creates legal exposure. Keep the SUP 15 notification focused squarely on the systemic failure, governance controls, and consumer outcomes. Address individual conduct questions under the formal SMCR framework on its own track.
Structuring the narrative around facts, not assumptions
When supervisory teams receive an unstructured notification, their default assumption is that the firm's governance has failed. The text of your notification must strictly follow SUP 15.6 Inaccurate, false or misleading information. Under SUP 15.6.1 R, a firm must take reasonable steps to ensure that all information provided to the regulator is factually accurate and complete. For estimates or professional judgments, the information must be fairly and properly based on appropriate enquiries.
A defensible SUP 15 submission uses an unembellished, chronological structure:
- Executive statement: A clear summary of the event, the exact date and time of discovery, the operational area involved, and the specific regulatory rules impacted.
- Chronology of events: A verified timeline outlining when the issue originated, when internal systems detected it, and when the compliance team confirmed the failure.
- Confirmed scope and impact: Verified figures regarding impacted customers, transaction volumes, or financial exposure, clearly distinguishing between audited counts and early estimates.
- Current operational status: Confirmation of whether the underlying process has been stopped, isolated, or repaired.
- Enquiry governance: A note detailing who is leading the internal review, which senior manager has oversight, and the reporting timetable for updates.
Never include speculative theories about what might have caused the error. Supervisors seize on speculative comments, treating them as admissions of wider control failures. If an automated fee run overcharged retail clients, state the exact lines of code or parameter files that failed, the dates the charges ran, and the total cash value affected. Do not comment on whether staff training was inadequate or systems are aging until a proper technical review confirms it.
Our advisory practice at Compliance Consultant is built on the Credibility Establisher of senior execution: delivering City-grade regulatory guidance through structured retainers. We apply the engage, execute, embed methodology to regulatory communications. In this context, engage means establishing regulatory boundaries before drafting, execute means driving root cause analysis in parallel with operational containment, and embed means integrating permanent remediation controls into daily operations. Applying this rigor to your narrative ensures that every statement given to the regulator is supported by verifiable internal records.
| Section | Required Content | Language to Avoid |
|---|---|---|
| Incident Summary | Concrete statement of the operational failure, rule engaged, and discovery date. | "We suspect our systems have suffered a major failure." |
| Chronology | Time-stamped event log verified against system logs and governance minutes. | "The issue has been going on for some time unnoticed." |
| Impact Assessment | Exact numbers of customers affected, confirmed monetary values, or declared data ranges. | "Countless clients could be at risk of financial ruin." |
| Root Cause | Verified technical or operational failure points established through formal analysis. | "Human error and lack of oversight are probably to blame." |
| Remediation Plan | Time-bound remediation milestones owned by a named SMF holder. | "We plan to fix this once we have more time to look into it." |
The containment and remediation section as a Section 166 shield
The FCA typically exercises its powers under Section 166 of FSMA to commission an independent skilled person report when it lacks confidence in a firm's ability to diagnose and fix its own problems. The containment section of your SUP 15 submission is your primary defence against that statutory intervention. If your submission proves that the firm has already ring-fenced the exposure, determined the root cause, and committed to a board-approved remediation plan, the supervisory case for ordering an external review falls away.
Root cause analysis framework
To show command of the issue, compliance officers must apply a structured root cause methodology rather than offering surface-level descriptions. We recommend structuring the technical diagnosis around a five whys analysis tied to our formal nine-category root cause framework:
- Governance and board oversight deficits
- Policy, process, and procedure design flaws
- System architecture, automation, or software logic failures
- Data integrity, migration, and reconciliation errors
- Staff competence, training, and supervision gaps
- Third-party supplier and outsourced vendor failures
- Operational capacity, workflow, and resource bottlenecks
- Management information and early warning signal failures
- Cultural, incentive, and conduct misalignment
Connecting your incident analysis to documented governance records reassures the regulator. If the breach involves customer detriment, demonstrating that your internal reporting systems spotted the anomaly helps protect your standing. For practical guidance on structuring these operational metrics, review our analysis on building a Consumer Duty complaints MI pack that tracks vulnerable customer outcomes.
[Level 1: System Alert]
|
v
[Level 2: 5 Whys Analysis] ---> [Categorised via 9-Category Framework]
|
v
[Level 3: Executive Committee] -> [Remediation Plan + SMF Oversight]
|
v
[Level 4: SUP 15 Notification] -> [Demonstrates Control, Pre-empts S166]
Presenting the senior management response
The final portion of the submission must detail the governance response, establishing that Senior Management Function holders are actively managing the event under their personal duty of responsibility.
State clearly which SMF holder has taken formal operational ownership of the remediation project. Outline the emergency executive meetings held, provide the terms of reference for the internal review, and detail the milestones for client restitution.
Where clients have suffered financial loss, state the compensation methodology and target distribution dates. Presenting a complete remediation package transforms the notification from an open-ended regulatory problem into an active, controlled internal project.
Common errors in FCA Principle 11 notifications
Firms handling a serious compliance incident often stumble on timing and narrative control. Understanding these common traps makes the difference between routine supervisory engagement and an aggressive enforcement investigation.
Confusing completeness with speculation
Many compliance managers believe that being open under Principle 11 means writing down every unverified theory discussed in early crisis meetings. This is a dangerous mistake. SUP 15.6 requires information to be complete regarding facts that the FCA reasonably expects to know, but it expressly prohibits submitting claims that are not properly verified.
When unconfirmed theories are submitted in writing to the regulator, they become official representations. If your subsequent technical review disproves an early theory, you must formally correct the record. That revision can trigger supervisory doubts about whether your systems and controls are reliable.
Stick to established facts. If an internal question remains open, describe the inquiry being conducted to settle it instead of guessing at the outcome.
Delaying notification for a complete investigation
The opposite mistake is waiting until the entire internal investigation is finished before contacting the regulator. Compliance teams frequently hold back notification while waiting for internal audits to conclude, external counsel to sign off, and final customer impact figures to be calculated down to the penny.
SUP 15.3.1 R requires firms to notify the regulator immediately upon obtaining information that reasonably suggests a serious issue has occurred or may occur. The FCA does not require a completed investigation before it is notified. It expects early notification that an incident has taken place, paired with an explanation that a formal investigation is running.
Firms that wait weeks to submit a polished report risk facing an immediate inquiry into why they failed to disclose the matter promptly under Principle 11.
Operational management of regulatory notifications
Drafting and submitting a formal regulatory notification is an intensive process with significant personal stakes for compliance officers and senior executives. Managing regulatory scrutiny requires proven systems, tested templates, and objective advice.
Compliance Consultant helps financial firms throughout the UK, Europe, and the Middle East handle high-pressure regulatory issues. Led by founder Lee Werrell, our team of seven qualified consultants provides expert advisory retainers that keep compliance frameworks operationally sound.
We offer three structured retainer tiers designed to match the oversight needs of growing and mid-sized regulated businesses:
- Bronze Retainer (£1,195/month + VAT on quarterly billing, or £1,075/month + VAT annually): Supplies foundational governance materials, including lite editions of our Compliance Risk Register, Regulatory Horizon Scanning Tracker, Complaints Handling Checklist, and Annual Compliance Calendar.
- Silver Retainer (£1,195/month + VAT on quarterly billing, or £1,075/month + VAT annually): Supplies eight hours of dedicated advisory support each month, access to our priority regulatory helpline, quarterly compliance reviews, and full editions of our core toolkits, including our Compliance Risk Register with Heat Mapping, Regulatory Horizon Scanning Tracker, SMCR Responsibilities Mapping Playbook, Complaints RCA & MI Reporting Template, Compliance Monitoring Programme Builder, and Consumer Duty / Operational Resilience Toolkit (a standalone retail value of £1,194).
- Gold Retainer (£2,395/month + VAT on quarterly billing, or £2,155/month + VAT annually): Designed for comprehensive oversight, providing 16 hours of advisory work monthly, a dedicated named consultant, a 4-hour response guarantee, direct mobile access, board report preparation, and specialized kits such as our Section 166 Preparation Toolkit, Conduct Rules Breach Investigation Toolkit, Fair Value Assessment Framework, and FCA Query Response Pack (retail product value of £3,638).
Our Gold tier provides complete compliance advisory coverage at less than 17% of the cost of hiring an in-house compliance manager, saving firms more than £84,000 per year while removing the risk of relying on a single point of failure.
If your firm is facing a potential Principle 11 notification or needs to overhaul its internal governance before supervisory concerns escalate, contact our specialist team. Visit the Compliance Consultant website to book a free discovery call, email us at info@complianceconsultant.org, or reach our UK team directly on 0800 689 0190.