An FCA review should be treated as a regulatory evidence exercise, not as an emergency document-production project. The regulator may begin with a focused information request, a supervisory meeting, a thematic or multi-firm exercise or a concern arising from data, complaints or other intelligence. Whatever the route, the firm's response needs to be accurate, controlled and consistent with how the business actually operates.
For insurance firms in 2026, the FCA's Regulatory Priorities make the likely areas of attention more visible. Consumer understanding, claims handling and service quality are prominent, while the regulator is also examining delegated claims arrangements, product value and wider customer outcomes. A firm should therefore assume that policies alone will not answer the most important questions. Supervisors are likely to want evidence showing what customers receive, how management identifies weaker outcomes and what happens when a control fails.
Preparation should not mean attempting to manufacture a perfect record once the FCA makes contact. The strongest response is an organised explanation of the real position, including weaknesses the firm has already identified and credible remediation where necessary. Inconsistency between documents, data and management explanations creates more risk than a properly governed issue that the firm can demonstrate it understands.
First establish exactly what the FCA is asking
The firm should begin by reading the request carefully and defining its scope. A broad reference to claims, Consumer Duty or product governance can contain several separate questions, and different teams may interpret the request differently if no central response structure is established.
A response matrix can help. Each FCA question should be mapped to an internal owner, relevant evidence, due date, reviewer and status. This reduces duplication and creates a record of what has been supplied. It also helps management identify where the firm does not currently hold the information necessary to answer a question confidently.
The legal basis of the request should be understood. The FCA can seek information through ordinary supervisory engagement and has formal information-gathering powers, including section 165 of the Financial Services and Markets Act 2000. The firm should not assume that every request has the same legal status or consequences.
Deadlines should be managed constructively. If a request is genuinely impossible to complete accurately within the time available, the firm should engage with the FCA rather than submit unreliable information or ignore the deadline. Principle 11 requires firms to deal with the regulator in an open and cooperative way.
The central objective is precision. Answer the question asked, identify necessary qualifications and avoid supplying large volumes of unrelated material that make the firm's position harder to understand.
Build one controlled evidence set
FCA reviews become difficult when different teams produce inconsistent versions of the same story. Compliance may provide a policy, product may provide a later working document and operations may produce MI based on a different definition. A central evidence set helps prevent contradictions.
The firm should identify the current approved version of each material document and preserve the evidence relevant to the review period. Policies, committee papers, product files, claims data, complaints, regulatory returns, contracts and customer communications may all become relevant depending on scope.
Version control matters. The response should distinguish between what applied during the period under review and what applies now. Replacing an old policy shortly before submission does not change the process that customers experienced historically.
Data should receive the same discipline. If the FCA asks for claims acceptance, complaint or outcome information, the firm should define the population, period and calculation method. Material exclusions or limitations should be disclosed rather than hidden within a spreadsheet.
The firm should also preserve the working papers used to validate the response. If the FCA asks how a number was produced, management should be able to reconstruct it without beginning the analysis again.
Test policy against operating practice before sending it
One of the most important preparatory exercises is comparing what the firm's policy says with what employees and systems actually do. A policy can be technically strong while the live process has drifted substantially.
For an MGA, this can arise in delegated underwriting, broker oversight, product governance or claims. For a broker, it can arise in demands and needs, customer fees, client money or AR monitoring. The review team should therefore test a sample of real activity before describing the control as effective.
This is not an invitation to conduct an unlimited internal investigation before answering a simple FCA question. The review should be proportionate to the subject and the risk. The purpose is to avoid making an assertion that the firm's own evidence immediately contradicts.
Where a gap is identified, management should decide how it will be presented and remediated. Attempting to conceal a known weakness can create a more serious regulatory issue than explaining the problem accurately and showing credible action.
The same applies to historic documents. If a control improved during the period, the response should explain the change rather than present the current process as though it existed throughout.
Customer outcome evidence should be ready to explain
Insurance supervision is increasingly outcome focused. The firm should therefore expect questions about what customers actually experienced, not only whether the relevant policy or committee existed.
For product governance, this can mean target-market evidence, fair value, claims, complaints and distribution information. For Consumer Duty, it can mean how the firm monitors products and services, price and value, consumer understanding and support. For claims, supervisors may be interested in declines, complaints, customer communication, vulnerability and oversight of third parties.
The 2026 Insurance Regulatory Priorities provide a useful lens because they identify the areas in which the FCA is concentrating work. Firms should review those priorities against their own business model before a supervisory engagement rather than waiting for the FCA to point out the connection.
Segmentation may be important. A firm-wide average can appear satisfactory while one product, broker, AR or customer group receives weaker outcomes. Management should know whether its MI is capable of identifying those differences and what thresholds or triggers lead to action.
Where evidence is incomplete, that limitation should be understood. Claiming that outcomes are good because the firm has few complaints can be difficult to defend where the business has not considered other evidence.
Management and SMF ownership should be clear
An FCA review is rarely a compliance-only exercise. The regulator may want to understand who owns the relevant risk, what senior management knew and what challenge occurred when issues emerged.
Statements of Responsibilities and the firm's governance arrangements should correspond with actual ownership. The senior manager responsible for a relevant area should understand the framework sufficiently to explain it rather than rely entirely on the compliance team.
Board and committee papers can become important evidence. They should show what information management received, what questions were asked and what decisions followed. A risk that appears repeatedly in MI without meaningful challenge can raise questions about the effectiveness of governance even where the underlying issue was visible.
Meeting preparation should therefore include the people who actually run the business process. The objective is not to script identical answers, but to ensure that senior managers understand the evidence, terminology and known weaknesses consistently.
Inaccurate confidence can be more damaging than a measured answer. If a manager does not know a factual point during a meeting, it can be better to confirm the position after checking than to guess and create an inconsistency with the written record.
Remediation should continue while the review is open
A firm does not need to wait for the FCA to complete its review before correcting a weakness it has identified. Where the issue is clear and the appropriate action is understood, continuing remediation can demonstrate effective governance.
The firm should nevertheless preserve the historic evidence and be transparent about timing. A control implemented after the FCA's request should not be described as though it operated during the period being reviewed.
A remediation log should identify the issue, root cause, customer impact, owner, action, target date and evidence required for closure. Material actions should be prioritised according to regulatory significance and potential harm rather than ease of completion.
Customer impact requires particular attention. If the internal review indicates that customers may have been harmed, the firm should assess the affected population and whether redress or wider remediation is required. The analysis should not be postponed solely because the FCA has not yet asked the question explicitly.
Where the issue may be notifiable, Principle 11 and SUP 15 should be considered separately. The existence of an FCA review does not remove the firm's ordinary obligation to notify the regulator of matters it would reasonably expect notice of.
Data quality can determine the credibility of the response
A strong narrative can be undermined quickly if the underlying data is inconsistent. The FCA increasingly uses regulatory and supervisory data to identify outliers, which means a firm should understand how its figures compare across internal MI, regulatory returns and information submitted during the review.
The response team should define each dataset before analysis. Population, time period, exclusions, duplicate treatment and calculation methodology should be documented so that different teams do not produce different answers to the same question.
Reconciliations should be performed where appropriate. If complaint numbers differ between the FCA return and the firm's Consumer Duty dashboard, management should know why. If claims information differs between the MGA and the third-party administrator, the discrepancy should be resolved or explained before submission.
Manual adjustments need particular care. A spreadsheet correction can be legitimate, but it should be controlled and supported. Unexplained changes made shortly before an FCA submission can raise questions about data governance even where the final number is correct.
The standard is explainability. The firm should be able to show where the information came from, how it was validated and what limitations remain.
Prepare for interviews and meetings as evidence sessions
FCA meetings are an opportunity for the regulator to test whether the written framework is understood by the people responsible for it. Senior managers should therefore prepare by reviewing the actual evidence, open issues and regulatory context rather than memorising a set of polished messages.
The person attending should understand what falls within their responsibility and how the control works operationally. If the discussion concerns claims, for example, management should be able to explain the MI used, how decline outliers are investigated and how outsourced providers are overseen.
Consistency matters, but over-coordination can be counterproductive. Different employees may naturally describe the same process in different language. The risk arises when those descriptions reveal materially different understandings of responsibility or process.
The firm should also keep a record of material questions, commitments and follow-up items arising from the meeting. Actions promised to the FCA should be tracked with the same discipline as formal remediation.
If a factual answer needs verification, the firm should confirm it after the meeting rather than speculate.
Understand when a review can escalate
Most supervisory engagement does not automatically become enforcement or a skilled person review. Firms should avoid treating every FCA question as evidence that formal action is inevitable.
The FCA nevertheless has a range of tools where it needs further assurance. Section 166 of FSMA allows the regulator to obtain an independent view of activities that cause concern or require further analysis. The FCA can use different appointment approaches, including requiring the regulated firm to propose a skilled person for approval or contracting with a skilled person directly.
The FCA's 2025/26 data shows that skilled person reviews remain an active supervisory tool, including within the insurance sector. A firm should therefore understand what a section 166 review would involve without assuming that one will follow ordinary supervisory contact.
Other tools can include requirements or restrictions where the FCA considers action necessary. The correct response is not to become defensive, but to ensure that the firm's evidence and remediation are credible enough for the regulator to understand the current risk.
Regulatory Counsel should never be described as an FCA-appointed skilled person unless formally appointed in that capacity for a particular matter.
The review is not finished when the response is submitted
FCA engagement can continue through follow-up questions, meetings, feedback and remediation commitments. The firm should keep ownership of the process until every material action and regulatory commitment has been resolved.
A central log should record information supplied, outstanding questions, FCA feedback and internal actions. This reduces the risk that commitments made in different meetings are lost or managed by separate teams without central oversight.
Management should also consider what the review reveals about the wider control environment. A narrow issue may expose a broader weakness in data governance, product oversight or escalation that should be corrected beyond the immediate scope of the FCA request.
Once remediation is complete, material actions should be retested where appropriate. The firm should be able to demonstrate not only that an action was completed but that the underlying weakness no longer operates.
The strongest outcome from an FCA review is therefore not simply closure of the regulator's questions. It is a stronger control framework with a clear evidence trail showing how management responded.
How Regulatory Counsel can support
Regulatory Counsel supports insurers, MGAs and insurance brokers preparing for and responding to FCA supervisory reviews. Our work can include scope analysis, evidence review, information-request management, regulatory gap analysis, management preparation, remediation planning and support with FCA correspondence.
We can assist with a defined supervisory request or undertake an independent readiness review before regulatory engagement.
Speak to Regulatory Counsel to discuss FCA review support for an insurance firm.
Frequently Asked Questions
The FCA can engage with firms for many reasons, including ordinary supervision, thematic or multi-firm work, regulatory data, complaints, intelligence or concerns about a particular control or customer outcome. An FCA review does not automatically mean enforcement action.
The firm should define the scope, legal basis, owners, evidence and deadline, establish a controlled response process and identify any areas where the requested information is incomplete or requires verification.
Yes. Section 166 of FSMA allows the FCA to obtain an independent view of activities that cause concern or require further analysis. A skilled person review is a supervisory tool and is not automatic in every FCA review.
Where the firm has identified a clear weakness and appropriate remediation, it generally should not leave customers exposed merely because the FCA review is ongoing. Historic evidence and the timing of changes should be preserved and described accurately.
Yes. We can help management understand the regulatory issues, evidence, open weaknesses and likely areas of challenge so that discussions with the FCA are accurate and well controlled.