A section 165 information request should be treated as a formal regulatory production exercise. Section 165 of the Financial Services and Markets Act 2000 gives the FCA power, by notice in writing, to require an authorised person and certain other persons within scope to provide specified information or documents that the regulator reasonably requires in connection with the exercise of its functions.
The existence of a section 165 request does not by itself mean that the FCA has opened an enforcement investigation or concluded that the firm has breached a rule. The power is used for supervisory and information-gathering purposes in a range of circumstances. The risk for the firm comes from responding inaccurately, incompletely or without sufficient control over the data and evidence supplied.
The practical standard is therefore precision. The firm should understand exactly what the notice requires, establish a controlled evidence population, preserve the audit trail behind the response and ensure that narrative explanations are consistent with the underlying documents and data.
Read the notice as a legal specification
The response team should begin with the exact wording of the notice. Each request should be broken down by information type, population, period, format, deadline and any definitions supplied by the FCA.
A broad request can contain several different obligations. The regulator may ask for a policy, a customer population, transaction-level data and a narrative explanation of governance within the same notice. Treating those as one task can make ownership unclear and increase the risk of omissions.
Definitions require particular attention. A term used by the FCA may not match the firm's internal system label. "Customer", "complaint", "active account" or another seemingly ordinary term can produce materially different data depending on how the population is constructed.
The legal and compliance teams should identify any genuine ambiguity before production begins. Where clarification is necessary, the firm should engage with the FCA rather than make an undocumented assumption that changes the scope of the response.
The notice should then be converted into a response matrix showing each requirement, owner, evidence source, reviewer, due date and status.
Establish one accountable response structure
Section 165 responses often fail operationally because several teams work independently. Data may come from technology, customer operations and finance, while policies and governance documents sit with compliance and legal. Without central coordination, the firm can submit information that is individually correct but collectively inconsistent.
A senior internal owner should therefore oversee the response. That person does not need to produce every item, but should have authority to resolve scope questions, escalate missing evidence and ensure that the final submission is coherent.
The response matrix should identify preparers and reviewers separately where proportionate. Material datasets and regulatory narratives deserve independent challenge before submission.
The firm should also control communications with the FCA. Different employees should not provide informal explanations to the supervisor that conflict with the formal response because they are unaware of the agreed methodology.
Governance should be proportionate to the request. A narrow one-field data request does not need the same structure as a multi-year customer-outcome production involving several million records.
Preserve the relevant historic evidence
A section 165 request may concern a period before the firm's current procedures were introduced. The firm should therefore preserve and identify the version of policies, customer communications, system logic and governance that applied during the requested period.
Updating a weak procedure after receipt of the notice can be appropriate remediation. It does not change the historic position. The response should distinguish clearly between what operated at the time and what the firm has since changed.
Document preservation should include relevant working papers where they explain how a control operated. Committee packs, product files, compliance reviews, complaint records and system specifications can become important if the FCA tests whether the submitted narrative is supported.
The firm should avoid uncontrolled deletion or overwriting while the response is being prepared. Normal retention policies may need to be considered in light of the regulatory request.
A clean historical evidence set also makes later follow-up easier because the firm can reproduce the basis of its answer rather than search again after the original response team has dispersed.
Define the data population before extracting it
Data is often the highest-risk part of a section 165 response. The firm should define the requested population before extraction, including relevant entities, products, customer status, dates, exclusions and duplicate treatment.
The methodology should be written down. If the FCA asks for all customers who experienced a particular event, the firm should be able to explain how the event was identified across each system and whether any systems were excluded.
Data lineage should then show how the source moved into the submitted file. Where transformations, joins, calculations or manual adjustments occur, the working papers should preserve those steps.
The firm should also consider completeness. A system migration, archived database or outsourced provider can create gaps that are not obvious from the current platform. A dataset that covers only the new system should not be described as the complete population unless that is genuinely true.
Where the population cannot be reconstructed perfectly, the limitation should be escalated and explained rather than concealed.
Reconcile the response against other regulatory and management data
Section 165 data should be tested for logical consistency with information the firm has already provided to the FCA and information senior management uses internally.
A customer count may not equal a regulatory return because definitions differ, but the firm should understand why. Complaint data supplied under section 165 should make sense against DISP reporting. Revenue, assets or transaction volumes should be explainable against financial and regulatory reporting where relevant.
Large unexplained differences can undermine confidence in the response even where the new dataset is ultimately correct.
Reconciliation can also identify hidden control weaknesses. If two internal systems give materially different answers to the same population question, the section 165 exercise may expose a broader data-governance issue that management needs to address.
The firm should document material reconciliations and unresolved differences so reviewers know which issues have been challenged.
Narrative responses should describe practice, not policy intention
The FCA may ask the firm to explain how a control operates. The response should describe what actually happens, supported by evidence, rather than repeat what the policy says should happen.
This is particularly important where operations have evolved informally. A policy may require quarterly review while the business has moved to a risk-based process, or the document may assign responsibility to a committee that no longer exists.
The response should not hide those differences. It should identify the current or historic operating practice accurately and assess whether the divergence itself creates a regulatory issue.
Examples can be useful where they demonstrate how the control operates, but they should not be selected in a way that creates a misleading impression of the wider population.
The narrative should also avoid unnecessary advocacy. A section 165 response is stronger when it answers the FCA's question directly, explains limitations and uses evidence rather than filling the submission with general statements about the firm's commitment to compliance.
Quality assurance should test both accuracy and interpretation
Before submission, reviewers should test whether every item required by the notice is present and whether the response uses the FCA's definitions consistently.
For data, QA can include row counts, field validation, duplicate checks, date-range testing, sample tracing to source and reconciliation against known totals. The depth should reflect the size and risk of the production.
For documents, the firm should confirm that the correct historic version is being supplied and that attachments are complete and readable.
For narrative responses, reviewers should compare assertions against policies, system evidence and management information. If the response says complaints are monitored monthly, there should be evidence that this happened during the relevant period.
Legal and regulatory interpretation should also be challenged where the answer depends on scope. A confident response based on the wrong rule population can be more damaging than a properly qualified explanation.
Manage the deadline early
Section 165 notices specify the period within which the information or documents must be provided. The firm should assess delivery risk as soon as the notice is received rather than discover shortly before the deadline that historic data cannot be reconstructed.
Where a genuine issue exists, early engagement is preferable to silent delay. The firm can explain the problem, the work already undertaken and a realistic proposed timetable or clarification request.
Principle 11 is relevant to the way the firm deals with the FCA. Open and cooperative engagement does not mean agreeing to an impossible interpretation without discussion. It means raising material difficulties candidly and working to provide reliable information.
The firm should avoid using deadline pressure as a reason to reduce QA on material data. An inaccurate on-time submission can create more problems than a controlled discussion about how to provide the information properly.
Any revised timetable or scope agreed with the FCA should be documented.
Internal findings and remediation should be handled transparently
The process of preparing the response can reveal a regulatory weakness. The firm may discover missing data, a control that did not operate as described or customer harm outside the original issue.
That finding should be escalated internally and assessed on its own merits. The fact that the FCA has not explicitly asked about the weakness does not mean the firm should ignore it.
Where remediation is clear, the firm can begin correcting the control while preserving the historical record. The response should distinguish the old process from the remediation rather than suggesting the improved control existed throughout.
Potential customer harm should be assessed for scale and population. If the weakness may have affected more customers than the FCA's original sample, management should determine whether wider review or redress is necessary.
Separate notification obligations under Principle 11 or SUP 15 may also arise depending on significance. A section 165 response is not automatically a substitute for another notification route.
Sign-off should reflect the significance of the response
The final response should have an identified sign-off owner. Material data and narratives should not be submitted solely because each contributor confirmed their own section was complete.
Senior management involvement should reflect the request. If the FCA is asking about a major customer-outcome issue, the relevant accountable senior manager should understand what the firm is saying and what weaknesses have been identified.
The sign-off pack can include the response matrix, material reconciliation results, limitations, open remediation and the final list of attachments.
The firm should retain a complete copy of what was submitted. File names, versions and dates matter because later FCA questions may refer to a specific attachment or field.
The response record should also capture material judgement calls, including any exclusions or estimates agreed with the regulator.
Prepare for follow-up rather than treating submission as closure
A section 165 response can lead to further questions where the FCA identifies anomalies, incomplete information or issues requiring deeper analysis. The response team should therefore remain available until the regulator confirms that no further production is required or the supervisory workstream moves to another stage.
Follow-up questions should use the same controlled methodology. The firm should not create a second, inconsistent dataset because a different team answered the later request.
The firm should also consider what it learned from the exercise. If data extraction was extremely difficult, regulatory reporting and supervisory readiness may need to be improved even where the FCA accepts the response.
A strong section 165 process leaves the firm with better data lineage, clearer ownership and a record of any control weaknesses identified through the production.
A section 165 request does not automatically mean section 166 or enforcement
The FCA has several supervisory tools, including skilled person reviews under section 166, voluntary or own-initiative requirements and enforcement investigation. A section 165 request can inform decisions about further supervisory action, but escalation is not automatic.
The firm should therefore avoid either extreme. It should not treat the notice as a routine questionnaire, but it should also not assume that formal intervention is inevitable.
The best response is accurate, complete and proportionate. Where the evidence identifies a weakness, credible remediation and open governance are generally more useful than defensive drafting designed to make the issue appear smaller than it is.
How Regulatory Counsel can support
Regulatory Counsel supports FCA-regulated firms with section 165 response management, scope analysis, data and document QA, regulatory interpretation, evidence review, management sign-off and remediation.
We can support a live notice from initial scoping through final submission and follow-up, or undertake a readiness review where a firm expects supervisory data requests.
Speak to Regulatory Counsel to discuss a section 165 information request.
Frequently Asked Questions
Section 165 of FSMA gives the FCA power, by written notice, to require authorised persons and certain other persons within scope to provide specified information or documents reasonably required in connection with the FCA's functions.
No. Section 165 is a general information-gathering power and can be used in supervision without a formal enforcement investigation.
Where the scope, definition or format is genuinely unclear, the firm should engage with the FCA promptly rather than make an undocumented assumption that could produce the wrong response.
The issue should be escalated and assessed separately, including customer impact, remediation and any applicable notification obligation. Historic evidence should be preserved accurately.
Yes. We can coordinate the response matrix, test regulatory scope, challenge data methodology and narratives and support management through submission and follow-up.