FCA Supervisory and Enforcement Action Explained

For owners, boards and senior leaders of FCA-regulated firms, the regulator’s interventions come with a vocabulary that can be hard to decode at the moment it matters most — usually when a letter has just arrived. Section 165 requests, feedback letters, requirements, voluntary and own-initiative measures, attestations, skilled-person reviews, Warning Notices, Decision Notices, Final Notices, censures, prohibitions, the Regulatory Decisions Committee, the Upper Tribunal: each is a distinct step with distinct consequences, and confusing one for another can lead a board to over-react or under-react. This guide maps the whole spectrum in plain English — what each tool is, where it sits, how often it is used, and what it means for the firm and the people who run it. Many smaller firms cover SMF16 with a fractional Chief Compliance Officer rather than a full-time hire.

The single most important thing to understand at the outset is that supervision and enforcement are not the same thing, and most regulatory action never reaches enforcement at all. The great majority of the FCA’s interventions are supervisory and are increasingly resolved on a voluntary basis. Enforcement — investigations, fines, bans — is the rare, high-impact escalation, not the norm. Knowing where a given measure sits on that spectrum is the first step to responding proportionately. For employers, see our Chief Compliance Officer recruitment service.

The firms that handle regulatory attention badly are usually the ones that misread where they are on the spectrum — treating a routine information request as a crisis, or a serious supervisory intervention as something that will blow over. Reading the situation accurately, and resourcing the response with credible senior people, is what separates a contained supervisory episode from one that escalates. That judgement, and the people who can deliver it, is what this guide is about.

This is general guidance for the strategic reader, not legal or regulatory advice. The specifics of any actual matter should be handled with your own legal counsel and compliance advisers; our focus is helping boards understand how the regime works and making sure the right senior people are in place to respond to it. For board-level executives at regulated firms, see our SMF3 Executive Director recruitment service.

The shape of FCA intervention: supervision versus enforcement

It helps to picture the FCA’s powers as a spectrum that runs from light-touch supervision to formal enforcement. At the supervisory end sit information requests, feedback letters, requirements on a firm’s permission (voluntary or imposed), attestations and skilled-person reviews. These are the tools the regulator uses to understand a concern and get a firm to fix it while the firm continues to trade. At the enforcement end sit formal investigations and, where they proceed, financial penalties, public censures, prohibitions and — in the most serious cases — criminal prosecution. Enforcement is a distinct process with a different purpose: not to fix a firm, but to hold a firm or individual to account and to deter others.

Most firms that encounter the FCA in a difficult context are dealing with the supervisory end of the spectrum. A matter can move from supervision towards enforcement, but the great majority do not, and the regulator’s stated approach in recent years has been to engage early and encourage firms to put things right voluntarily rather than escalate. The supervisory team that knows the firm is normally the first point of contact; a referral to the Enforcement division is a deliberate decision, usually taken when there is evidence of a serious breach, a pattern of failure, or a risk that the firm cannot or will not fix itself.

There is also a middle ground worth knowing about. The FCA has dedicated teams that use statutory powers to intervene quickly — imposing or agreeing requirements to stop harm — without opening a full investigation. And separate from both, a large volume of authorisations are cancelled each year on what are essentially administrative grounds, such as failure to pay fees or submit returns. Those cancellations sit outside the contested enforcement process, but they show up in the regulator’s published data and are worth reading in context.

How most action is actually resolved — the numbers

The FCA’s own published figures bear this out. Its enforcement data for 2025/26, covering the year to 31 March 2026, shows voluntary requirements heavily outnumbering imposed ones. Across the organisation the FCA reported 321 voluntary requirements, against eight own-initiative requirements and no own-initiative variations of permission. Agreed outcomes, in other words, are the normal way the regulator restricts a firm’s business — the imposed route is the exception.

Formal enforcement is far smaller in scale. The FCA opened 33 enforcement operations in 2025/26, up from 23 in 2024/25, and the number of open operations at the year end edged down from 130 to 127. Final Notices issued by Enforcement went from 37 to 30. Financial penalties moved from 29 penalties totalling about £186m in 2024/25 to 25 penalties totalling about £129m in 2025/26 — figures that swing year to year because a handful of large cases can dominate the total. Criminal convictions rose from five to 17, reflecting the regulator’s continued focus on financial crime and unauthorised business, while prohibitions of individuals went from 30 to 21.

Set against a regulated population of tens of thousands of firms and many more approved individuals, those numbers make the headline point plainly: enforcement is uncommon, slow and high-impact, while supervisory engagement — especially the voluntary kind — is where most firms actually find themselves. Figures change every year, so treat any single year as a snapshot rather than a trend line, and check the FCA’s latest published data before relying on a specific number.

Stage one: information gathering

Most supervisory matters begin quietly, with the regulator gathering information. It may issue a request for documents and explanations — often referred to by its statutory basis as a section 165 request — prompted by a regulatory return, a complaint, a whistleblowing report, a thematic or multi-firm review, a market event or intelligence from another authority. This is frequently followed by a feedback letter setting out the FCA’s concerns and its expectations. At this stage nothing has been decided; the regulator is forming a view.

A firm that responds promptly, completely and credibly — and that can show it has competent senior people engaged — often resolves matters here without anything further. The practical points are simple but often missed:

• Meet the deadline, or agree a new one in advance. A late, partial response invites the conclusion that the firm lacks control of its own information.
• Answer the question that was asked. Supervisors read for candour. Volunteering context is useful; burying the answer is not.
• Make sure the right person signs off. The response should come from, or be owned by, the accountable senior manager — usually the SMF16 for compliance matters or the SMF17 for financial crime.
• Keep a record. Log what was requested, what was provided and when. If the matter escalates, that audit trail matters.

If the information request lands while the compliance or MLRO seat is empty, or held by someone without the experience to lead a regulatory dialogue, this is the point to fix it. Bringing in experienced cover through specialist compliance and risk recruitment before the response goes out is far easier than repairing the impression a weak response creates.

Stage two: requirements and attestations

Where the FCA’s concerns are more material, it may look for a requirement on the firm’s permission to contain a risk while it is addressed. The power sits in section 55L of the Financial Services and Markets Act 2000 (FSMA). A requirement obliges the firm to do something, stop doing something, or refrain from acting without the regulator’s prior agreement — for example, not taking on new customers, not disposing of assets, or not onboarding customers in a particular high-risk category until controls are fixed. There are two routes, and the distinction matters:

• Voluntary requirement (VREQ), and the related VIVOP. The firm agrees to the requirement, typically by applying for it to be imposed. A voluntary variation of permission is sometimes labelled a VIVOP or VVOP. The voluntary route signals cooperation and lets the firm negotiate scope and duration.
• Own-initiative requirement (OIREQ), and the related OIVOP. The FCA imposes the requirement, or varies the permission, using its own powers, without the firm’s agreement. This carries more weight, can be published, and is used far less often.

A VREQ is not a punishment and is not an enforcement outcome, but it is a serious event. Requirements are often shown on the firm’s entry on the Financial Services Register, so counterparties, banks, investors and acquirers can see them. Lifting one usually requires the firm to show the regulator that the underlying problem has been fixed — often with independent verification — which is why remediation work and the people who lead it matter so much. For a fuller treatment of voluntary requirements specifically, see our companion explainer, What Is an FCA VREQ?

A lighter-touch tool in the same family is the attestation, where a named senior individual personally confirms to the regulator that a specified action has been taken or a state of affairs exists. Attestations put personal accountability front and centre, which is why who holds the relevant Senior Manager Function matters so much. A senior manager asked to attest needs to be confident the work has genuinely been done and evidenced — an attestation that later proves unfounded is a direct route to personal scrutiny.

Stage three: skilled-person reviews

Where the FCA wants an independent, expert assessment of part of a firm, it can commission a skilled-person review under section 166 of FSMA. An independent third party, the skilled person, reports to the regulator on defined aspects of the firm, such as its governance, systems and controls, client money arrangements or financial-crime framework. Section 166A provides a related power to require a skilled person to collect or update information. The FCA explains how it uses these powers, and how firms and skilled persons are appointed, on its skilled person reviews page.

The firm bears the cost, which can be substantial, and the report informs how the FCA handles the firm thereafter. A skilled-person review is a supervisory tool, not an enforcement outcome, but its findings can shape both the supervisory relationship and any decision to escalate. Reviews typically run in phases: an initial assessment of the issue, then — if gaps are found — a remediation phase, sometimes with the skilled person staying on to verify that fixes have worked.

Because these reviews almost always drive significant remediation work, they are a major source of demand for senior compliance and financial-crime resource. The firm will need someone senior to own the relationship with the skilled person, to own the remediation plan and to report progress to the board and the regulator. Where the review concerns anti-money laundering controls, that is normally the MLRO, and an interim or fractional MLRO is often brought in where the existing holder has left or lacks capacity. Our sister firm FD Capital covers the mechanics in depth in its Section 166 Skilled Person Reviews guide.

Stage four: enforcement investigations

If the regulator decides a potential breach or offence warrants formal investigation, it opens what it calls an enforcement operation and appoints investigators. Opening an investigation is not a finding of wrongdoing — the FCA is explicit that it does not prejudge the outcome, and many investigations close without any action being taken. Cases are categorised as regulatory, civil or criminal, and where the right route is unclear at the outset, a case may be opened on a dual-track basis.

The subject is usually notified through a memorandum of appointment of investigators, which sets out the scope of the investigation. Investigators can require documents and interviews, including compelled interviews of individuals. Investigations are often lengthy: the FCA’s published data shows a meaningful share of operations closing only after several years, although the regulator has stated an aim of running fewer cases and progressing them faster. For a firm, the practical consequence is that an investigation can run alongside ordinary supervision, a VREQ and a skilled-person review at the same time — and every strand needs senior ownership.

Individuals can be investigated in their own right, separately from the firm. Where a senior manager is the subject of an investigation, the firm may need to consider whether that person can credibly continue to perform the function while it runs, and whether temporary cover is needed. Our guide on compliance hiring during an FCA investigation or enforcement covers how to approach that decision.

The enforcement notice sequence

If an investigation does lead the regulator to propose action, the matter moves through a defined sequence of statutory notices:

• Warning Notice. The FCA’s initial notice setting out the action it proposes to take and why. It is not a final decision, and the recipient has the right to make representations. In some cases the FCA may publish a statement about a Warning Notice.
• Decision Notice. The notice given after those representations have been considered, setting out the action the regulator has decided to take. The recipient can refer a Decision Notice to the Upper Tribunal.
• Final Notice. The notice confirming the action once the process is complete. Final Notices are generally published, which is a large part of their deterrent and reputational effect.

Decisions on contested cases are taken by the Regulatory Decisions Committee (RDC), a committee operationally independent of the FCA’s executive. A firm or individual that disagrees can refer the matter to the Upper Tribunal, an independent judicial body that can uphold, vary or overturn the regulator’s decision, and which considers the matter afresh rather than simply reviewing the FCA’s process. Many cases never reach that stage because they are resolved by settlement, often with a discount on the financial penalty for early agreement. Partly contested cases are also possible, where the subject agrees the facts but contests the penalty or the finding of breach.

Alongside these notices sit supervisory notices, which the FCA uses when it imposes an own-initiative requirement or varies a permission urgently. These can take effect immediately, before any representations, where the risk justifies it — another reason a firm should treat a serious supervisory concern as a matter for the board, not just the compliance team.

Enforcement outcomes

Where enforcement action is taken, the outcomes available to the regulator include:

• Financial penalties (fines) against firms or individuals.
• Public censure — a published statement of misconduct without a fine.
• Prohibition orders banning an individual from performing specified functions in the industry, in part or in full.
• Withdrawal of approval for a senior manager, and suspensions or restrictions on an individual’s approval.
• Cancellation or withdrawal of permission or authorisation, stopping the firm from carrying on regulated activity. Many cancellations are in practice administrative — for example where a firm has repeatedly failed to pay fees or file returns — rather than the product of a contested case.
• Restitution and redress, requiring firms to compensate customers, sometimes through a formal redress scheme.
• Injunctions obtained through the courts to stop conduct or freeze assets.
• Criminal prosecution in the most serious cases, such as insider dealing, unauthorised business or certain money-laundering offences.

The FCA’s approach to these outcomes — how it decides whether to act, how penalties are calculated and when it publishes — is set out in its Decision Procedure and Penalties manual and in the Enforcement Guide in the FCA Handbook. Boards do not need to read either cover to cover, but their advisers will, and it helps to know that penalties are calculated through a structured, step-based framework rather than set at the regulator’s discretion.

How common is enforcement, really?

It is worth restating, because boards often assume the worst: enforcement is the exception. With a few dozen new operations opened in a typical year against a regulated population in the tens of thousands, and with a share of investigations closing without action, the likelihood of any given supervisory concern ending in a fine or a ban is low. That is not a reason for complacency — the consequences when enforcement does land are severe and public — but it is a reason to respond to supervisory attention proportionately and constructively rather than defensively, and to focus energy on resolving matters at the supervisory stage, where most firms have the agency to do so.

The pattern of what does reach enforcement is instructive. Financial crime and anti-money laundering failings, market abuse, unauthorised business, consumer harm and failures of senior oversight recur in published outcomes. Each of those themes maps onto a senior function — the MLRO, the head of compliance, the chief executive — which is why the regulator’s interest so quickly becomes a question about people. Some firms appoint a part-time MLRO for a set number of days each month.

Recent changes to the FCA’s enforcement approach

Two developments from 2025 still shape how enforcement works today, and boards should know about both.

The naming proposal was dropped

In early 2024 the FCA consulted on announcing more of its investigations publicly, including naming regulated firms under investigation where it judged that to be in the public interest. The proposal drew sustained opposition from industry, trade bodies and parliamentarians. In March 2025 the FCA confirmed that it would not proceed with the public interest test for naming regulated firms, and would keep its existing approach: it names a regulated firm under investigation only in exceptional circumstances.

A revised Enforcement Guide from June 2025

The FCA then published a revised, consolidated Enforcement Guide, which took effect on 3 June 2025. It keeps the exceptional circumstances test for regulated firms but allows the FCA, in limited situations, to name the subjects of investigations into suspected unauthorised activity or criminal offences relating to unregulated activity, to reactively confirm that it is investigating in certain circumstances, and to share information about investigations on an anonymised basis. The practical effect for most authorised firms is that an investigation will usually remain confidential until a Warning Notice statement or Final Notice — but that should not be mistaken for low stakes.

Fewer cases, progressed faster

Alongside those changes, the FCA has said it wants to run fewer investigations and progress them more quickly, and it publishes data on how long operations have been open. The number of open operations has come down from the levels seen a few years ago. For firms, that points to a regulator that is more selective about what it takes into enforcement — and correspondingly more likely to use supervisory tools, VREQs and skilled-person reviews to deal with the rest.

What it all means for senior managers

Across the whole spectrum, the Senior Managers and Certification Regime puts named individuals in the frame. Compliance oversight (SMF16), money-laundering reporting (SMF17) and other senior functions carry personal accountability, and the more serious the regulator’s attention, the more that accountability is tested. This is why supervisory and enforcement events so often coincide with senior compliance resignations — the personal exposure is real — and why a firm under scrutiny must keep those functions credibly filled. A vacancy at exactly the moment the regulator is assessing the firm’s management and control is one of the worst signals a firm can send.

Each senior manager has a Statement of Responsibilities setting out what they are accountable for, and that document becomes the starting point when things go wrong. Supervisors and investigators will ask who owned the relevant area, what that person knew, what they did, and whether they took reasonable steps. Senior managers who can show clear records of challenge, escalation and decisions are in a far stronger position than those who cannot.

Prohibitions and individual accountability under SMCR

Individual accountability is the part of the regime that most concentrates minds. Under SMCR a senior manager is subject to a statutory duty of responsibility: if the firm breaches a requirement in an area the senior manager is responsible for, the regulator can take action against that individual where it shows they did not take the steps a person in their position could reasonably be expected to take to prevent the breach. Senior managers and certified staff are also bound by the conduct rules, and the FCA assesses whether approved people remain fit and proper on a continuing basis.

The sanctions for individuals include fines, suspensions or restrictions on approval, withdrawal of approval and, most seriously, a prohibition order under section 56 of FSMA. A prohibition can be full — barring the individual from any function in relation to regulated activity — or partial, limited to particular functions or types of firm. Prohibitions are published, and they follow the individual permanently through their career. The FCA’s figures show prohibitions every year, issued both through contested enforcement and through other regulatory routes.

For the firm, an individual sanction creates an immediate operational problem: someone accountable for a core function may need to step aside, often at short notice, and the replacement will need regulatory approval. Fitness and propriety is the test applied to that replacement, and our guide on fitness and propriety explains what the regulator looks for. SMCR itself has been the subject of reform proposals from the Treasury and the regulators, aimed at reducing administrative burden, but the core principle that named senior individuals are personally accountable for their areas remains in place.

What it means for boards and owners

For a board or owner, the practical takeaways are consistent whatever the stage. Read the situation accurately and proportionately. Engage early and constructively rather than defensively. Take credible legal and compliance advice and let it lead the regulatory strategy. Resource the response properly — including, critically, keeping the senior compliance and MLRO functions in credible, accountable hands. And recognise that for owners and investors there is a value dimension: an unresolved matter or a restrictive requirement can affect financing, transactions and counterparty relationships, so investing early in the right people and a clear plan protects the asset as well as the regulatory relationship.

Boards should also expect their own oversight to be examined. Non-executive directors, and particularly the chair and any chair of the risk or audit committee, will be asked what information they received, whether they challenged it, and how quickly they acted once concerns surfaced. Minutes that record genuine challenge are evidence; minutes that record a slide being noted are not.

What firms should do when the FCA raises concerns

Whatever point on the spectrum a firm finds itself, the same sequence of steps applies. None of it replaces specialist legal advice, but it gives a board a working framework:

• Establish exactly what the regulator has asked for and under which power. A section 165 request, a proposed VREQ, a section 166 appointment and a memorandum of appointment of investigators each call for a different response.
• Appoint a single senior owner. One accountable person should run the regulatory response, with clear reporting to the board.
• Check the accountable seats are filled. If the SMF16 or SMF17 role is vacant, held by someone stretched across too many roles, or held by someone who is themselves under scrutiny, fix that first.
• Take legal advice early. Especially before interviews, before agreeing a VREQ, and before any attestation is given.
• Build a credible remediation plan. Specific actions, named owners, realistic dates and evidence of completion — the regulator, and any skilled person, will test it.
• Communicate carefully. Decide what needs to be said to staff, banks, investors and insurers, and when. Many policies and facility agreements contain notification obligations.
• Keep the board informed and recorded. Regular, minuted updates show the regulator that oversight is real.

The step firms most often underestimate is the third. Regulatory remediation is senior, hands-on work, and an existing compliance team that was not equipped to prevent the problem is rarely equipped to fix it without reinforcement.

Interim and fractional SMF16 and SMF17 cover during remediation

The most common practical need we see across supervisory and enforcement situations is senior compliance and money-laundering reporting cover — quickly, and on terms that suit the firm’s size. For a larger firm that may mean a full-time interim head of compliance or MLRO for the length of the remediation. For a smaller firm — a broker, an adviser, a payments or e-money business, an investment firm — it is often a fractional compliance officer taking the SMF16 role, the SMF17 role, or a combined SMF16/17 position, for a set number of days a month.

Fractional cover works well during remediation because the work is senior but not always full-time: the role holder needs to own the plan, lead the regulatory dialogue, sign off key documents and report to the board, while day-to-day file reviews and control testing are done by others. The points to get right are:

• Approval. SMF16 and SMF17 are controlled functions requiring FCA approval. The 12-week rule allows a person to cover an unexpected or temporary absence for up to 12 weeks in a consecutive 12-month period without approval, but anything longer needs an application, so plan the approval route from the start.
• Relevant experience. The regulator will look for someone who has handled a comparable situation — a VREQ, a skilled-person review, an investigation — in a firm of similar type.
• Enough time. A fractional holder must have sufficient time to perform the function properly. One day a month will not satisfy a supervisor during active remediation.
• Clear scope. The Statement of Responsibilities should say exactly what the fractional or interim holder owns, so there is no ambiguity about accountability.
• An exit plan. Decide early whether the role will move to a permanent hire once the remediation closes, and who will hold it.

Where the need is permanent rather than temporary — for example where the regulator has made clear that the firm’s compliance leadership must be strengthened for the long term — a full search for a SMF16 head of compliance runs in parallel with interim cover. For the practical detail of temporary cover, see our guide on interim SMF16/SMF17 cover during an FCA VREQ.

Where the senior-hiring question fits — and how Exec Capital helps

At every stage of this spectrum, the same practical need recurs: credible, regulator-acceptable senior people to lead the response. At the supervisory stage that usually means interim, fractional or permanent SMF16 and SMF17 cover; during a skilled-person review or remediation it means experienced compliance, financial-crime and file-review resource; and after enforcement it can mean rebuilding a function and replacing individuals who have left or been prohibited.

Exec Capital’s compliance and risk recruitment practice maintains a network of FCA-experienced compliance, MLRO and financial-crime professionals, including people available at short notice who have worked through supervisory, skilled-person and enforcement situations. We can find candidates with the right experience, check their status on the Financial Services Register, and help structure the cover sensibly — interim, fractional or permanent — so that the firm presents a credible senior team to the regulator.

Frequently asked questions

What is the difference between FCA supervision and enforcement?

Supervision is about understanding and fixing concerns while a firm keeps operating, using tools such as information requests, requirements and skilled-person reviews. Enforcement is a separate, more serious process aimed at holding a firm or individual to account through penalties, bans or prosecution. Most regulatory action stays at the supervisory stage.

What is the difference between a VREQ and an OIREQ?

A VREQ (voluntary requirement) is agreed to by the firm; an OIREQ (own-initiative requirement) is imposed by the FCA using its own powers. The voluntary route signals cooperation, can be negotiated, and is far more common. The FCA’s 2025/26 data shows hundreds of voluntary requirements against single figures of own-initiative ones.

Does an FCA investigation mean the firm has done something wrong?

No. Opening an investigation is not a finding of wrongdoing — the FCA does not prejudge the outcome, and many investigations close with no further action. Since the March 2025 decision to drop the naming proposal, investigations into regulated firms are normally announced only in exceptional circumstances.

What is a section 166 skilled-person review?

It is an independent review, carried out by a qualified third party (the skilled person) who reports to the FCA on defined aspects of a firm. It is a supervisory tool, the firm bears the cost, and it usually drives significant remediation led by senior compliance or MLRO staff.

What is a prohibition order?

A prohibition order under section 56 of FSMA bans an individual from performing specified functions in financial services, in part or entirely. It is one of the most serious outcomes for an individual, it is published, and it often creates an urgent need for the firm to replace the person.

Can a fractional SMF16 or SMF17 lead a firm through remediation?

Yes, for many smaller firms. The holder must be FCA-approved, have relevant experience and commit enough time to perform the function properly while remediation is live. Larger or more complex situations may need a full-time interim instead.

This article is general information and does not constitute legal, compliance or regulatory advice. Figures cited are from the FCA’s published enforcement data for the year to 31 March 2026 and the prior year, and will change over time. Any actual supervisory or enforcement matter should be handled with your own legal counsel and compliance advisers.