What Is an FCA VREQ? Voluntary Requirements Explained

What Is an FCA VREQ? Voluntary Requirements Explained

A VREQ — a voluntary requirement — is one of the FCA’s everyday supervisory tools, and one that owners, boards and senior leaders of regulated firms increasingly encounter. It is far more common than formal enforcement, and far less widely understood. For a board or a new owner seeing the term for the first time, often in a letter from the regulator, it can read as more alarming than it usually is. This explainer sets out what a voluntary requirement actually is, where it sits among the FCA’s powers, how firms typically arrive at one, what it means in practice for the firm, its senior managers and its owners, and what separates the firms that handle one well from those that do not. It is written for the strategic reader — the chair, chief executive, owner, investor or general counsel weighing what a VREQ means for the business — rather than as a step-by-step operational manual. For board-level executives at regulated firms, see our SMF3 Executive Director recruitment service.

For the practical side of responding — how to keep the regulated functions covered, the options for interim and permanent senior cover, and how quickly that can be arranged — see our companion Knowledge Centre guide, Interim SMF16/SMF17 Cover During an FCA VREQ.

Most boards first hear the term “VREQ” at a moment of some stress — usually in correspondence from the regulator. It sounds more alarming than it often is. A voluntary requirement is, in the great majority of cases, a managed and recoverable path rather than the start of enforcement. What matters is responding to it credibly and quickly — and, almost always, that includes making sure the right compliance and MLRO leadership is in place to drive the response. For short-notice cover, see our interim MLRO service.

What a voluntary requirement actually is

A VREQ is a requirement that a firm agrees to accept on its regulatory permission. Rather than the FCA imposing a requirement on its own initiative, the firm volunteers to be bound by it, typically by applying for its permission to be varied to include the requirement. In practice the two routes — a voluntary requirement and an imposed one — reach a similar place: a binding obligation or restriction on what the firm may do. The difference lies in how they come about. A voluntary requirement reflects the firm working with the regulator to agree terms, which is generally the stronger position to be in.

A requirement is not the same as a limitation on a firm’s permitted activities in the abstract; it is a specific, often time-bound, obligation attached to the firm’s permission. It can require the firm to do something, to stop doing something, or to refrain from doing something without the regulator’s prior non-objection. The common thread is that it gives the FCA a clear, enforceable line around the firm’s conduct while a concern is addressed.

The statutory basis is section 55L of the Financial Services and Markets Act 2000 (FSMA). Section 55L(3) gives the FCA what the Act calls the own-initiative requirement power — the basis of an OIREQ. Section 55L(5) separately allows the FCA to impose a new requirement, or vary or cancel an existing one, on the application of the authorised firm itself. A VREQ is a requirement made through that second route: the firm applies, the FCA agrees, and the requirement becomes part of the firm’s permission with the same legal force as any other.

The FCA uses the same “voluntary” label for two related instruments: a voluntary variation of permission (VVOP), where a firm agrees to remove or narrow regulated activities on its permission, and a voluntary direction (VDir). It contrasts all three with their own-initiative equivalents — OIREQ, OIVOP and OIDir — as set out in its update on requirements, limitations and directions. In practice, a firm under supervisory pressure may be asked for a VREQ, a VVOP or both: a VVOP takes an activity off the permission altogether, whereas a VREQ leaves the permission in place but attaches conditions to how it is used.

The legal framework: sections 55L, 55M, 55N and 55P

Four provisions in Part 4A of FSMA do most of the work, and it helps a board to know which is which when it reads a draft requirement.

• Section 55L — the FCA’s power. Subsection (2) sets out when the FCA may act on its own initiative. The grounds include that the firm is failing, or is likely to fail, to satisfy the threshold conditions for which the FCA is responsible; that it has not carried on a regulated activity covered by its permission for at least 12 months; and that it is desirable to act in order to advance one or more of the FCA’s operational objectives. Subsection (3) is the own-initiative power itself; subsection (5) is the application route used for a VREQ.
• Section 55M — the PRA’s equivalent power. For dual-regulated firms such as banks and insurers, the Prudential Regulation Authority has its own power to impose, vary and cancel requirements, and must consult the FCA before doing so. A dual-regulated firm can therefore face requirements from either regulator. Section 55M is sometimes described in commentary as the “assets requirement” power; it is not.
• Section 55N — what a requirement can do. A requirement can oblige the firm to take specified action or to refrain from it; can extend to activities that are not regulated activities; can be framed by reference to the firm’s group; can be set to expire after a specified period; and can relate to past conduct, for example by requiring a review of past business and remedial action. That last point is the legal hook for past business reviews.
• Section 55P — assets requirements. An assets requirement prohibits or restricts the disposal of, or other dealing with, a firm’s assets, or requires assets to be transferred to and held by a trustee approved by the regulator. A bank that has been notified of such a requirement does not breach its contract with the firm by refusing a payment it reasonably believes would breach it, and assets held by a trustee cannot be released without the regulator’s consent.

The application process itself sits in the FCA Handbook. SUP 6.3 covers applications to vary a permission and to impose, vary or cancel requirements, and SUP 6.3.2A confirms that a firm may apply for the variation or cancellation of any requirement previously imposed. The same chapter governs the route out of a VREQ, which we cover below.

Where a VREQ sits among the FCA’s powers

The FCA has a graduated set of tools for dealing with concerns about a firm, and a VREQ sits in the supervisory part of that spectrum rather than the enforcement part. At the lighter end are information requests and supervisory correspondence. In the middle sit requirements — voluntary (a VREQ) or own-initiative (an OIREQ) — and independent skilled-person reviews. At the far end sits formal enforcement action, which is a different process with different consequences. Understanding that a VREQ is a supervisory instrument, not a penalty, is the single most useful piece of context a board can hold on to: it is a mechanism for containing and fixing a problem, not a judgment that the firm has failed.

That said, the instruments are not mutually exclusive. A firm can be under a VREQ, subject to a skilled person review and the subject of an enforcement investigation at the same time, and a matter that starts in supervision can be referred to enforcement later. Our explainer on FCA supervisory and enforcement action sets out the wider toolkit; the table below compares the four instruments boards most often confuse.

VREQ vs OIREQ vs section 166 review vs enforcement

The practical difference between the first two rows is control. With a VREQ, the firm has a hand in the wording, the carve-outs and the conditions for lifting. With an OIREQ, the FCA sets the terms and the firm’s remedy lies in representations and, ultimately, the Tribunal — a slower, costlier and more public route. A section 166 review is not a restriction at all; it is an information-gathering tool, but its findings frequently become the remediation plan that a VREQ requires the firm to deliver.

How firms usually arrive at a VREQ

A voluntary requirement rarely appears without warning. The path that leads to one is usually recognisable. It often begins with the regulator gathering information — a request for documents and explanations, sometimes referred to by its statutory basis as a section 165 request — prompted by routine supervision, a regulatory return, a complaint, a whistleblowing report, a market event or a thematic review. That is frequently followed by a feedback letter in which the FCA sets out its concerns and its expectations. Where those concerns are material, the regulator may look for a requirement on the firm’s permission to contain the risk while it is addressed — and, if the firm agrees, that becomes a VREQ. In more serious cases the FCA may also commission an independent skilled-person review, known by its statutory basis as a section 166 review, under which a qualified third party reports on defined aspects of the firm.

For a board, the value of recognising this sequence is that it gives an early read on how serious the situation is and how fast it needs to act. A firm that is still at the information-request stage has more room than one that has received a proposed requirement, and a firm facing both a VREQ and a skilled-person review is in a more demanding position again.

What typically triggers a VREQ

VREQs cluster around a recognisable set of themes. The most common include weaknesses in systems and controls; financial-crime concerns spanning anti-money-laundering frameworks, customer due diligence, sanctions and the documentation of source of wealth and source of funds; client-asset and client-money handling; conduct and customer-outcome issues, including matters now framed through the Consumer Duty; governance and oversight failings; and — a recurring theme for smaller and newly acquired firms — questions about whether the firm is being effectively managed and controlled from the UK. A single trigger can be enough, but often it is a combination, and a gap in senior compliance leadership can turn a contained concern into a broader one.

Common VREQ terms, with examples

No two VREQs are worded the same, but most are built from a familiar set of terms. The examples below are illustrative and generic — they describe the kind of term a firm in that position might agree to, not any particular firm.

The detail inside each term matters as much as the headline. Boards should look closely at four things: whether the trigger for lifting a term is objective (for example, “on completion of the independent review”) or depends on the FCA’s view; whether existing customers are carved out; whether the firm needs the FCA’s consent or only its non-objection to do something; and what reporting obligations come with the term. A requirement that stops new business but carves out servicing of existing customers is a very different commercial proposition from one that does not.

Voluntary versus own-initiative: why the distinction matters

Where a firm agrees to a requirement, it is voluntary; where the FCA imposes one using its own powers, it is an own-initiative requirement. The practical effect on the firm can be similar, but the difference in tone and standing is real. A voluntary requirement signals cooperation, allows the firm to negotiate the scope and duration, and tends to be less damaging to the firm’s reputation and its relationships with clients, counterparties and banking partners. A firm that engages early, takes credible advice and has the right people in post is far better placed to keep a requirement voluntary, proportionate and time-limited. A firm that cannot demonstrate it has its house in order has less room to negotiate and a higher risk of an imposed, broader requirement.

The lifecycle of a VREQ

Most VREQs follow the same broad sequence, from the first sign of concern to the day the requirement comes off the Register. Knowing where the firm sits in that sequence tells the board what it should be doing next.

Stages two and three are where the most value is won or lost. Firms are often given little time to respond to a request for a VREQ, and the temptation is to sign whatever is put in front of them to show cooperation. Cooperation matters, but so does precision: vague exit criteria and missing carve-outs are much harder to fix once the requirement is in force. Legal counsel should lead the negotiation, but the board needs its senior compliance holders in the room, because they will have to live with every word.

How a VREQ appears on the FCA Register

Requirements form part of a firm’s permission, and the FCA’s public Financial Services Register shows a firm’s permissions together with any requirements attached to them. In practice that means a VREQ is usually visible to anyone who looks the firm up — customers, banks, payment providers, insurers, introducers, acquirers and candidates for senior roles. For many firms the Register entry is the single most commercially sensitive consequence of a VREQ, more so than the restriction itself, because counterparties check the Register and a new requirement can quickly prompt questions from banking and insurance partners.

The FCA’s handling of VREQ publication has not always been consistent. In a report issued on 19 July 2024 and published in August 2024, the Financial Regulators Complaints Commissioner upheld a complaint about a VREQ that had stayed on a firm’s Register entry after the firm had met its terms. The firm had not been told it needed to apply to lift the requirement, and the Commissioner found a lack of consistency, transparency and due process in how the FCA imposed, published and lifted VREQs, recommending that the FCA set out a clear policy. In its published response, the FCA accepted that it had made errors, apologised, confirmed it had removed the requirement from the Register in May 2024 and said it would review its approach to training staff on VREQs.

Two practical lessons follow. First, agree with the supervisor during negotiation how the requirement will be described on the Register, and whether and when it will be published. Second, treat removal as something the firm must actively apply for and track, rather than something that happens automatically when the work is done. The FCA has also been tidying the Register more broadly: in May 2025 it announced a review of around 11,000 requirements, directions and limitations on more than 9,000 firms to remove outdated or superseded entries, contacting firms where a change was substantive.

How to have a VREQ varied or lifted

Because a VREQ is a requirement imposed at the firm’s request, it is varied or removed the same way: the firm applies, and the FCA decides. Under SUP 6.3.2A a firm may apply for the variation or cancellation of any requirement previously imposed on it. Applications are made online through the FCA’s application system, must state the change sought, and the Handbook encourages firms to discuss an application with the FCA before submitting it. The FCA has a statutory period of six months to determine a complete application, or twelve months from receipt where an application is incomplete, though most firms will want to have agreed the substance with their supervisor well before the formal application is filed.

In practice, a successful application to lift a VREQ tends to rest on:

• Evidence that each exit condition is met — completed remediation, closed skilled person recommendations, a finished past business review or redress exercise.
• Testing, not just design. Supervisors want to see that new controls have operated over a period, ideally confirmed by second-line monitoring, internal audit or an independent reviewer.
• Stable, credible senior management. An application made while the SMF16 or SMF17 seat is vacant, or filled on a stop-gap basis without a plan, is harder to support.
• A board that owns the outcome. Minutes and management information showing the board challenged the remediation and accepted it on evidence.
• A proportionate ask. Sometimes the right first step is to vary a requirement — for example, allowing onboarding of lower-risk customers — rather than seeking full removal in one go.

The FCA can refuse an application or agree to it only in part. Where it refuses, the firm should treat the reasons as the next remediation plan rather than a setback to argue about.

The FCA’s current approach to VREQs and publicity

The most significant recent development is about publicity rather than supervision. In early 2024 the FCA proposed a “public interest” framework under which it would more often name firms under enforcement investigation. After strong industry opposition, it dropped the proposal. Policy Statement PS25/5, published on 3 June 2025 alongside a revised Enforcement Guide in force the same day, kept the existing “exceptional circumstances” test as the principal basis for announcing an investigation into a regulated firm. It added limited circumstances for naming subjects of suspected unauthorised business, confirming investigations that are already public, and making anonymised announcements.

For firms under supervisory pressure that matters in two ways. Enforcement investigations into regulated firms generally remain private, so a requirement on the Register is often the most visible public sign that something is wrong — which makes the wording and publication of a VREQ even more important. And because supervision and enforcement are separate tracks, a well-handled VREQ does not rule out a later investigation; firms should keep records with that possibility in mind. Our guide to compliance hiring during an FCA investigation or enforcement covers how the senior hiring picture changes once a matter crosses into enforcement.

Section 166 skilled person reviews alongside a VREQ

Section 166 reviews often run in parallel with a VREQ. The FCA explains on its skilled person reviews page that a review can be commissioned where it is concerned about aspects of a firm’s activities or wants further analysis, and that the firm can be required to pay the costs. Either the firm proposes a skilled person for approval and contracts with it, or the FCA contracts directly, using its Skilled Person Panel. The FCA reports that eight skilled person reports were commissioned in the first quarter of 2026/27 (April to June 2026), seven of them in consumer investments.

Where both are in place, the skilled person’s findings usually become the backbone of the remediation the VREQ requires, and closing the review’s recommendations is often a condition for lifting the requirement. That puts the SMF16 and SMF17 holders at the centre of the information flow: they are typically the skilled person’s main counterparts, they own a large share of the actions, and their credibility affects how the reviewer and the supervisor read the firm.

What a VREQ means for the firm

For the firm, a VREQ means operating within the agreed boundaries, delivering any required remediation to an agreed timetable, and keeping the regulator informed of progress. The boundaries vary widely. Some VREQs are narrow and barely affect day-to-day business; others restrict whole categories of new business while allowing the firm to continue servicing existing clients; a few are more far-reaching. A well-advised firm will often seek to shape a limited and temporary requirement — one that protects against the specific risk the regulator is worried about while preserving the firm’s ability to serve its existing clients and continue operating — rather than accept a blanket restriction that damages the business and its customers unnecessarily.

There is also a reputational and disclosure dimension to weigh. Depending on the nature of the requirement, it may appear on the public register, and the firm will need to think carefully about communications with clients, counterparties and partners, in a form and manner appropriate to its obligations. Handled with discipline, a VREQ is a defined period of focused work that ends with the firm’s footing restored. Handled poorly — with drift, weak governance, or gaps in senior accountability — it can escalate.

What it means for senior managers

Under the Senior Managers and Certification Regime, named individuals carry personal accountability for designated functions, including compliance oversight (SMF16) and money-laundering reporting (SMF17). In a VREQ situation those roles become pivotal: they are the firm’s primary interface with the regulator on the matter, the owners of much of the remediation, and the people whose competence and conduct the FCA will be assessing. That personal accountability is also why supervisory events so often coincide with compliance and MLRO resignations — the exposure feels most acute precisely when the firm most needs continuity. A vacancy in either function during a live matter is a serious problem, because it undermines the firm’s ability to show it is being managed and controlled at exactly the moment that question is being asked.

The Duty of Responsibility

The legal source of that exposure is the Duty of Responsibility in section 66A of FSMA. A senior manager can be found guilty of misconduct where the firm contravened a relevant requirement while they were a senior manager, they were responsible for managing the activities in which the contravention occurred, and they did not take the steps a person in their position could reasonably be expected to take to avoid it occurring or continuing. A VREQ is not itself a finding of a contravention, but the issues behind it are exactly the areas where questions about “reasonable steps” tend to be asked. For a senior manager in post, the practical response is a clear record: what they knew, when, what they escalated, and what they did about it. For the board, it means making sure each relevant senior manager’s Statement of Responsibilities reflects who actually owns each part of the remediation.

Resignations and handovers

Resignations during a VREQ are common and understandable, but how they are handled matters. A departing SMF16 or SMF17 should hand over properly: a written account of open issues, regulatory correspondence, outstanding actions and the state of the remediation plan. The firm has to notify the FCA of the change, update its Responsibilities Map where it has one, and produce a regulatory reference for the individual that is accurate and fair. The FCA will notice if a firm loses its compliance leadership at a sensitive moment, and it will want to know who is now accountable. The board’s answer to that question should be ready before the resignation becomes effective.

Hiring under a VREQ: what candidates will ask

Recruiting into a firm under a VREQ is entirely possible — interim and fractional compliance professionals in particular often specialise in exactly this work — but strong candidates will do their own diligence before agreeing to take on personal accountability. Expect questions such as:

• What does the VREQ say, and can I see the full correspondence with the FCA and any skilled person’s scope or report?
• Why did the previous SMF16 or SMF17 leave, and what did they hand over?
• Is there a funded remediation plan, and will I have the people and systems to deliver it?
• Will I report to the board or a committee directly, with access to the chair?
• Does the firm’s directors’ and officers’ insurance cover me, and on what terms?
• What will my regulatory reference look like at the end of this, and how will my handover be documented if I inherit problems I did not create?

Firms that answer those questions openly hire faster and better. Firms that are guarded tend to lose the most experienced candidates, who have the most choice. A senior compliance professional who has led a firm through a VREQ to removal is a valuable hire; one who has been through it and was not given the resources to succeed will be wary of doing it again.

Getting a replacement approved

SMF16 and SMF17 remain pre-approval roles, and the FCA has up to three months to determine a complete application, with the clock stopping while it waits for information it has asked for. Under the SMCR changes in PS26/6, in force from 24 April 2026, a firm covering an unexpected vacancy has 12 weeks to submit an application for the replacement, and the temporary cover can continue until the application is decided. Our guide to how long FCA SMF approval takes sets out a realistic timetable. Expect a supervisor to look carefully at any application made during a VREQ — particularly at the candidate’s experience of remediation work and, for a part-time appointment, whether the time commitment matches the scale of the work.

What it means for owners, controllers and investors

For an owner, controller or investor, a VREQ is both an operational and a strategic matter. A new owner who has recently acquired or taken control of a regulated firm may inherit a supervisory matter rather than create one — and then has to demonstrate effective management and control at precisely the moment the regulator is questioning it. The quality of the firm’s senior compliance leadership becomes part of the owner’s own credibility with the regulator. There are deal and value implications too: an unresolved supervisory matter, or a requirement that restricts the business, can affect valuation, financing, onward transactions and the appetite of banking and counterparty relationships. For an owner, investing early in credible senior cover and a clear remediation plan is not a cost centre — it is how the value of the asset is protected and the path back to growth is reopened.

What separates firms that handle a VREQ well

The firms that come through a voluntary requirement in good shape tend to share a few characteristics. They engage early and constructively with the regulator rather than defensively. They take credible legal and compliance advice and let the skilled person and counsel lead the regulatory strategy. They are realistic about the issues and resource the remediation properly. And — the point most often underestimated — they make sure the SMF16 and SMF17 functions are held by credible, accountable people for the duration, rather than leaving them thinly covered or vacant. A board that treats a VREQ as a project to be led, with the right people in the right seats and a clear plan, is in a fundamentally different position from one that treats it as a problem to be weathered.

A board’s first 30 days under a VREQ

The first month sets the tone with the supervisor. The checklist below is a starting point for the board’s own plan, to be adapted with legal counsel; our companion guide to interim SMF16 and SMF17 cover during FCA supervision sets out the full senior-cover plan, including engagement models.

The single most common failure in the first month is leaving the senior compliance question until later. A supervisor will judge the response in large part by who is leading it, and a vacant or overstretched SMF16 or SMF17 seat makes every other action harder to deliver.

The senior-leadership dimension — and how Exec Capital helps

A firm’s response to a VREQ is led by its board, its legal counsel and, where relevant, its skilled person and compliance consultancy, who own the remediation and regulatory strategy. Running underneath all of that is a recruitment question that is often the most time-critical of the lot: making sure the SMF16 and SMF17 functions are held by credible, regulator-acceptable people for the duration — usually an interim to bridge the immediate gap, then a permanent appointment as the firm moves back towards growth.

That is where Exec Capital fits. We can find candidates at short notice with the right experience — approved SMF16 and SMF17 holders and senior financial-crime operators, many immediately available and experienced in live FCA supervisory and VREQ environments — verify their recent approvals against the FCA Register, sense-check conflicts and availability up front, and help the board structure the cover sensibly, including pairing an approved SMF holder with a hands-on financial-crime lead where that gives the firm approved cover from day one. Because we work from an existing, pre-qualified network rather than a cold search, credible names can be in front of a board quickly. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate. For the detailed mechanics, day-rate ranges and engagement models, see the companion guide: Interim SMF16/SMF17 Cover During an FCA VREQ.

For many smaller firms the right answer is not a full-time hire at all. A fractional compliance officer can hold the SMF16 function for a set number of days a week, and a fractional MLRO can do the same for SMF17 — often with additional days during the remediation period that taper off once the VREQ is lifted. Where the gap is immediate, our urgent SMF appointment service is built for exactly that situation. Larger firms that need a full-time leader for the duration may prefer an interim Chief Compliance Officer, followed by a permanent Head of Compliance once the firm is back on a stable footing. Whatever the model, we can help a board decide which route fits — and our fractional compliance service is where most firms under supervisory pressure start.

Frequently asked questions

What does VREQ stand for?

VREQ stands for voluntary requirement — a requirement a firm voluntarily agrees to accept on its FCA permission, generally in place of one the regulator would otherwise impose.

Is a VREQ the same as enforcement action?

No. A VREQ is a supervisory tool used to contain a risk and drive remediation while a firm continues to operate within agreed limits. Enforcement is a separate, more serious process. A VREQ is best understood as a managed, recoverable path rather than a penalty.

What is the difference between a VREQ and an OIREQ?

A VREQ is agreed to by the firm; an own-initiative requirement (OIREQ) is imposed by the FCA using its own powers. Both bind the firm to similar effect, but the voluntary route signals cooperation, can be negotiated, and tends to be less damaging to the firm’s standing.

Why would the FCA issue a VREQ?

Usually because it has identified a concern — about systems and controls, financial crime, client assets, conduct, governance or management and control — that it wants contained while the firm fixes it. The requirement gives the regulator a clear, enforceable boundary during that period.

Can a firm keep trading under a VREQ?

In most cases yes, within the agreed boundaries. Many VREQs are deliberately shaped to allow a firm to keep servicing existing clients while restricting specific new activity, so that the business and its customers are protected while remediation is carried out.

How long does a VREQ last?

It varies. Some are short and tied to a specific remediation milestone; others remain in place until the regulator is satisfied the underlying issues are resolved. A well-advised firm will usually seek a proportionate, time-limited requirement rather than an open-ended one.

Does a VREQ appear on the public register?

Usually, yes. Requirements form part of a firm’s permission and are generally shown on its Financial Services Register entry, which is one reason firms weigh communications and disclosure carefully. The Complaints Commissioner found in 2024 that the FCA’s practice on publishing and removing VREQs had been inconsistent, so agree the Register wording and timing with your supervisor. The specifics should be handled with legal counsel.

How does a VREQ affect a sale, acquisition or investment?

An unresolved supervisory matter or a restrictive requirement can affect valuation, financing, onward transactions and counterparty relationships. For buyers and investors it is a key diligence item, and for a new owner it makes credible senior compliance leadership and a clear remediation plan especially important.

What should a board do first when it receives a VREQ?

Engage credible legal and compliance advice, understand precisely what the requirement does and does not permit, make sure the SMF16 and SMF17 functions are credibly covered, and put a clear, resourced remediation plan in place. The strategic detail belongs with counsel and the skilled person; the senior-cover question is one we can help with immediately.

Can a firm refuse to agree to a VREQ?

In principle, yes — a VREQ depends on the firm’s application. But if the statutory grounds are met, the FCA can impose an own-initiative requirement instead, on its own terms. Most firms conclude that negotiating a proportionate VREQ is the better course; that decision should be taken with legal counsel.

What is the difference between a VREQ and a VVOP?

A VREQ attaches conditions to a permission the firm keeps. A voluntary variation of permission (VVOP) changes the permission itself, typically by removing or narrowing a regulated activity. A firm may be asked for one or both.

How do we get a VREQ removed?

Apply to the FCA to vary or cancel the requirement under SUP 6.3, with evidence that each exit condition has been met and that new controls are working. Discuss it with your supervisor first. Do not assume the requirement will lapse on its own once the work is done.

Can we hire a new SMF16 or SMF17 while under a VREQ?

Yes. The firm applies for approval in the normal way, and temporary cover can bridge the gap while the application is decided. Expect the FCA to look closely at the candidate’s remediation experience and, for a part-time role, at whether the time commitment is enough.

Will the FCA publicly name a firm under investigation?

Generally not. Under PS25/5, published in June 2025, the FCA kept its “exceptional circumstances” test for announcing investigations into regulated firms and dropped its wider naming proposal. A VREQ on the Register is separate from that and is usually public.

Is a VREQ the same as a section 166 review?

No. A section 166 review is an independent expert report the FCA requires on specified matters; it does not restrict the firm. A VREQ is a binding requirement on the permission. The two often run together, with the review’s findings feeding the remediation the VREQ requires.

Related reading

• Interim SMF16/SMF17 Cover During an FCA VREQ
• What Is Fitness and Propriety? The FCA SMCR Guide
• SMF16 Head of Compliance Hiring Guide
• SMF17 MLRO Hiring Guide
• MLRO (SMF17) Recruitment
• FCA-Regulated Firm Recruitment Hub

This article is general information and does not constitute legal, compliance or regulatory advice. Decisions about a voluntary requirement, regulatory notifications and remediation should be taken with your own legal counsel, compliance consultancy and skilled person.