Principle 11 requires an FCA-regulated firm to deal with its regulators in an open and cooperative way and disclose appropriately anything relating to the firm of which the FCA would reasonably expect notice. SUP 15 then contains more detailed notification requirements and guidance covering significant events, breaches and other matters. The difficult question is rarely whether a catastrophic event should be notified. It is how to decide when an emerging issue, customer-impact problem, control failure or breach becomes significant enough that the FCA should be told before every fact is known.
The FCA updated important SUP 15 guidance during 2026. The current framework contains numerical examples relating to customer impact, redress and financial loss, but those figures should not be treated as safe harbours. A problem affecting fewer customers or involving a smaller amount can still be notifiable depending on the seriousness, nature and wider regulatory implications.
Principle 11 is broader than a list of notification rules
A firm should not approach notification by searching SUP 15 for an exact factual match and concluding that silence is permitted if none appears. Principle 11 creates a broader obligation of openness and cooperation, while SUP 15 guidance gives examples of matters that can be relevant under that Principle, including significant changes in the firm's business or systems and controls and matters affecting its ability to satisfy regulatory requirements.
This means the firm should consider the substance of the issue rather than only whether a specific notification line can be found. A control failure can be significant because of potential customer harm, market impact, prudential risk or because it reveals that the firm's governance is materially weaker than the FCA would reasonably assume.
Specific notification rules remain important because they create more precise triggers. A strong governance process therefore asks two questions: is there a specific rule requiring notification, and separately, would the FCA reasonably expect to know under Principle 11? That dual analysis should be recorded for material cases.
Significant business and systems changes can be notifiable before harm occurs
SUP 15.3 contains guidance on significant changes to a firm's business, organisation and systems and controls. The current guidance includes matters such as significant expansion, reorganisation, new services, material outsourcing changes and relevant changes in the firm's oversight of Appointed Representatives.
The regulatory concern is prospective as well as historical. A rapidly growing AR network, transfer of a critical function to a new outsourced provider or major technology migration can alter the firm's risk profile or ability to meet its obligations even before customers have suffered harm.
The assessment should consider scale, complexity, customer dependence and the strength of the firm's existing controls. Not every supplier change or product launch requires a Principle 11 notification, but material changes should have a documented notification assessment and appropriate senior oversight before implementation.
The 40 percent customer-impact guidance is not a bright line
The June 2026 SUP 15 guidance gives an example of circumstances that may have a serious regulatory impact where an issue adversely impacts, or may adversely impact, at least 40 percent of customers of a particular product or service. This is useful guidance, but it should not be read backwards as a non-notification threshold.
An issue affecting 39 percent of customers is not automatically non-notifiable, and a much smaller population can still be serious where the harm is severe, the customers are vulnerable or the problem reflects a fundamental control failure. The denominator also matters because the guidance refers to customers of the affected product or service rather than necessarily the firm's entire customer population.
Management should therefore use the figure as one indicator in a broader significance assessment. Nature, duration, severity, potential losses, recurrence and wider regulatory implications all matter. A governance framework that automatically suppresses notification below a numerical threshold replaces regulatory judgement with a mechanical rule the Handbook does not provide.
Redress guidance can make financial exposure a notification indicator
Current SUP 15 guidance also gives examples of when a redress exercise may be significant. It refers to circumstances where the amount of redress paid or payable is £10 million or more, or represents 50 percent or more of the firm's annual revenue from the affected product or service in the previous financial year.
Those figures should again be treated as significance indicators rather than safe harbours. A lower redress amount can still be significant depending on the nature of the underlying conduct, the customer group, the regulatory breach and the impact on the firm. The analysis should also consider whether the liability is still being estimated rather than waiting automatically for every customer to be assessed.
Financial resources can create a separate issue. A redress programme that threatens the firm's ability to meet liabilities or continue operating may justify notification for reasons beyond the conduct problem itself. Management should therefore connect complaints, remediation and financial planning when deciding what the FCA would reasonably expect to know.
Complaint increases can reveal a systemic issue
SUP 15 guidance recognises that a comparatively high increase in complaints can be relevant where the increase indicates a recurring or systemic problem, including by comparison with the firm's previous DISP reporting period. The useful question is not only how many complaints were received, but what they reveal about the underlying control.
A sharp rise in one product, AR, claims process or fee can be significant even where the firm's overall complaint numbers remain modest. Root-cause analysis should therefore identify whether several complaints arise from the same design, system or governance weakness and whether customers who did not complain may also have been affected.
A low complaint rate is not proof that notification is unnecessary because customers may not recognise the harm or may be unable to complain. Complaint evidence should be considered alongside customer outcomes, control data and the seriousness of the issue.
Substantial individual loss can matter even where the population is small
The 2026 SUP 15 guidance also provides an example of substantial financial loss where an individual consumer would suffer loss exceeding £10,000 and two or more consumers may be affected. This helps firms assess materiality where the customer population is relatively small but individual impact is significant.
The same caution applies to this figure. It is guidance rather than a universal permission to ignore lower losses, and factors such as vulnerability, unfair treatment, repeat control failure or a serious regulatory breach can make a smaller amount significant.
The firm should document the methodology used to estimate customer loss and distinguish between gross exposure, potential loss and actual or likely customer detriment where relevant. A sound notification framework considers both widespread lower-level harm and concentrated severe harm.
Significant breaches must be notified immediately
SUP 15.3.11 requires firms to notify the FCA of specified significant breaches of rules and other requirements. Current guidance explains that the notification should be made immediately when the firm becomes aware, or has information that reasonably suggests, that the significant breach has occurred, may have occurred or may occur in the foreseeable future.
This matters because firms sometimes wait for a full internal investigation before notifying. The rule does not require certainty in every case, and the significance assessment can take account of potential financial losses, frequency, implications for systems and controls and delays in identifying or rectifying the problem.
The firm should distinguish between knowing every fact and knowing enough to recognise a significant regulatory issue. An initial notification can be updated as the investigation develops. Waiting for the final root-cause report can create a separate timeliness problem where the evidence already met the notification threshold much earlier.
Early notification can distinguish facts, suspicion and unknowns
A well-constructed early notification does not need to pretend that the investigation is complete. It can identify what the firm knows, what it currently suspects, which questions remain open and what immediate action is being taken.
Population estimates, financial exposure and root cause should be labelled appropriately where they remain provisional. The firm should avoid speculation presented as fact, while also avoiding the opposite problem of saying almost nothing because the final numbers are not yet available.
The FCA is likely to need information about immediate customer or market protection measures. If the firm has paused a process, restricted a product, preserved data or started a customer review, those actions can be described together with a timetable for investigation and further updates.
Open communication is not the same as notifying every minor internal error. The judgement remains whether the matter is significant or otherwise something of which the FCA would reasonably expect notice.
The notification should explain impact, rule position and action
SUP 15 guidance indicates that breach notifications should include information such as the circumstances, the rule or requirement involved and the steps the firm has taken or intends to take to remedy the breach and prevent recurrence. A vague statement that "an issue has been identified" may therefore be insufficient for the FCA to understand the regulatory significance.
Customer impact should be quantified where reasonably possible, including the affected or potentially affected population and relevant vulnerability considerations. The firm should identify whether the issue is continuing and what interim control is in place.
Where the process has been paused, the notification should say so. Where it has not been paused despite continuing potential harm, management should be able to explain the basis for that decision. Material uncertainty and the expected timetable for further updates should also be made clear.
Oral and written notification routes should be controlled
SUP 15 guidance recognises that Principle 11 notifications can be made orally or in writing depending on the circumstances, while specific rules and FCA forms can prescribe particular notification methods. For a complex or significant matter, written evidence is normally important even where the firm first contacts its supervisor urgently by telephone.
The FCA's SUP 15 notification form is available for relevant notifications and was updated in March 2026. Firms should use the method required for the particular obligation and preserve confirmation of submission.
Internal procedures should identify who is authorised to make the notification and who reviews the wording. The control should also cover urgent incidents where the normal committee timetable would cause delay, so uncertainty about process does not postpone escalation of a serious issue.
Decisions not to notify should also be recorded
Material issues that reach a senior notification forum should produce a documented conclusion even where the firm decides notification is not required. The record should explain the facts known at the time, the relevant rule or Principle 11 analysis, the significance factors considered and any conditions that would cause the decision to be revisited.
This is particularly useful for developing incidents. A technology issue may initially affect very few customers but expand rapidly, or an early estimate of customer loss may change materially as the population analysis develops.
The purpose is not to create legalistic files for every operational incident. It is to preserve regulatory judgement on matters close enough to the threshold that management considered them formally and to make sure previous non-notify decisions are reopened when the facts change.
Multiple notification regimes may apply to the same event
One incident can create several regulatory obligations. A cyber incident, for example, may engage FCA notification, data protection reporting and other sector-specific rules, while a control failure involving an AR may create SUP 12 reporting implications as well as Principle 11 considerations.
The firm should therefore use an incident matrix rather than assume one notification discharges every obligation. Content and timing can differ between regimes, and teams should coordinate facts and figures so regulators do not receive inconsistent descriptions of the same event.
Third parties also need to be considered. An outsourced provider may hold information necessary for the regulated firm's notification, but responsibility for deciding what the FCA should be told remains with the firm where the obligation applies to it.
How Regulatory Counsel can support
Regulatory Counsel supports FCA-regulated firms with Principle 11 and SUP 15 assessments, breach and incident notifications, customer-impact analysis, redress issues, governance and FCA correspondence. We can advise on a live event or review the firm's notification framework, escalation criteria and decision records.
Speak to Regulatory Counsel to discuss an FCA notification issue.
Frequently Asked Questions
Principle 11 requires a firm to deal with regulators in an open and cooperative way and disclose appropriately anything relating to the firm of which the FCA would reasonably expect notice.
No. Current SUP 15 guidance uses 40 percent as an example of circumstances that may have serious regulatory impact. A smaller affected population can still be notifiable depending on severity and context.
No. SUP 15.3.11 requires notification when the firm becomes aware or has information reasonably suggesting that a significant breach has occurred, may have occurred or may occur in the foreseeable future.
Yes. Current guidance includes examples involving redress of £10 million or more or 50 percent or more of annual revenue from the affected product or service. These are significance indicators, not universal safe harbours.
Yes. We can assess the relevant rule, Principle 11, customer impact, significance, notification timing and the evidence supporting the firm's decision.