A Dear CEO letter is not correspondence. It is the FCA telling an entire portfolio of firms what it expects, in writing, on the record, and with the clear implication that any firm later found short will be asked what it did when the letter arrived.
What these letters are and how they are used
The FCA supervises most firms on a portfolio basis. Portfolio letters, commonly issued as Dear CEO letters, set out the harms the FCA has identified in that portfolio, the supervisory priorities that follow, and what the regulator expects firms to do. Recent portfolio correspondence has addressed themes including safeguarding of relevant funds, financial crime controls in payments and cryptoasset firms, Consumer Duty implementation and outcomes evidence, affordability and forbearance in consumer credit, and wind-down planning.
Three features matter.
They are addressed to the CEO deliberately. The expectation is board-level consideration, not compliance-team filing.
They are evidence of notice. Once issued, a firm cannot credibly say it was unaware of the expectation.
They usually specify an action. Many letters ask firms to discuss the content at board level by a stated date, and some require a written response or an attestation.
The response the FCA expects
The FCA is testing whether the firm can translate a general expectation into specific action within its own business model. A defensible response has four components.
A gap assessment against each expectation
Take each expectation in the letter as a separate line. For each, record the current position, the evidence supporting that position, the gap if any, and the required action. Assertions without evidence references are the most common weakness.
| Element | Weak response | Defensible response |
|---|---|---|
| Current position | "Controls are in place" | Named policy, version, date, control owner |
| Evidence | Not referenced | Monitoring output, sample testing, MI extract |
| Gap | "No material gaps identified" | Specific gaps with severity rating |
| Action | "Under review" | Owner, deliverable, date, closure evidence |
A prioritised action plan
Each action needs an accountable owner, usually a senior manager, a target date and a definition of what closure evidence will look like. Actions without a defined closure test do not close.
Board consideration on the record
The minutes should show that the board received the letter and the gap assessment, applied challenge, agreed the plan and set a review point. Minutes recording only that the letter was "noted" are actively unhelpful.
Follow-through and re-testing
The plan should be tracked to completion through the compliance monitoring programme, with a re-test after implementation to confirm the control is operating and not merely documented.
Sector-specific themes to expect
Payments and e-money. Safeguarding records and reconciliation under the interim regime, wind-down planning, agent and distributor oversight, and financial crime controls. See our PS25/12 safeguarding compliance checklist.
Cryptoasset firms. Financial crime systems, financial promotions compliance and readiness for the future authorisation regime. Our guidance on the UK cryptoasset regime sets out the direction of travel.
Consumer credit. Affordability assessments, treatment of customers in financial difficulty, and fees and charges. See affordability and responsible lending.
All portfolios. Consumer Duty outcomes evidence and the annual board report, and the quality of management information supporting both.
Where firms go wrong
Delegating it downwards. A letter addressed to the CEO answered solely by a compliance manager tells supervision what the firm's governance looks like.
Answering the theme, not the firm. Generic descriptions of good practice do not demonstrate that this firm has assessed its own exposure.
Over-claiming. Stating that a control is fully effective when monitoring has not tested it creates a second issue if the control later fails.
Failing to retain the work. The gap assessment, the plan and the closure evidence should be retained and easy to produce. When the theme returns, whether through a follow-up letter, a multi-firm review or an information request, that pack is the first thing requested.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
We support firms responding to Dear CEO and portfolio letters, including structured gap assessments, board papers and challenge material, remediation planning and tracking, closure evidence packs, and drafting of formal responses and attestations.
Contact our regulatory team at info@regulatorycounsel.co.uk.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently Asked Questions
It is supervisory correspondence sent to the chief executives of a defined portfolio of firms setting out the harms the FCA has identified, its supervisory priorities and what it expects firms to do in response.
Not always. Some letters request a written response or attestation and others do not. In every case the firm is expected to consider the letter at board level and to be able to evidence what it did in response.
A gap assessment against each expectation with supporting evidence, a prioritised action plan with named owners and dates, board minutes evidencing challenge, and a plan for re-testing controls after implementation.
A named senior manager, usually the CEO or the holder of the relevant prescribed responsibility, with the compliance function coordinating delivery and the board retaining oversight.
The letter is evidence that the firm was on notice of the expectation. Where a related failing later emerges, the absence of any documented response is treated as a governance failing in its own right and increases the likelihood of further supervisory intervention.