Thematic and multi-firm reviews are the FCA's main tool for setting expectations at scale. A sample of firms is examined in depth, findings are published, and the whole portfolio is then expected to have read, assessed and acted. Understanding the mechanics changes how a firm responds, whether or not it is in the sample.
How the process works
Scoping. The FCA identifies a harm or a theme, often from supervisory intelligence, complaints data, regulatory returns or previous thematic work.
Sample selection. Firms are selected to give a representative view of the portfolio. Selection criteria typically include size, business model, growth rate, distribution model and position relative to portfolio averages in reported data.
Information request. Selected firms receive a detailed request, usually under the FCA's information-gathering powers, with a short deadline.
Deep dives. Some firms receive follow-up interviews, systems demonstrations or file reviews.
Individual feedback. Selected firms typically receive firm-specific feedback, which may include required actions.
Publication. The FCA publishes aggregated findings, usually with examples of good and poor practice, and often accompanied by a portfolio letter.
What the information request actually tests
The content of the answers matters. So does everything around them.
| What is requested | What it reveals |
|---|---|
| Policies and procedures | Whether the framework is current, owned and version controlled |
| Management information | Whether the board sees data capable of supporting a decision |
| Monitoring output | Whether controls are tested, and whether failures are recorded honestly |
| Customer or transaction samples | Whether the practice matches the policy |
| Governance minutes | Whether challenge occurs and is recorded |
The speed and consistency of production also carry signal. A firm that takes six weeks to assemble basic control evidence has told supervision something about its data architecture before a single answer is read.
Practical steps for a selected firm
Read the request against the rulebook. Identify which obligation each question maps to. Answers that address the question but not the obligation invite follow-up.
Sample your own files first. Test the sample the FCA will see. Where a file is deficient, say so, explain the root cause and set out the remediation. Volunteered issues with a plan are treated differently from issues discovered by the reviewer.
Maintain internal consistency. Numbers given in the response must reconcile to regulatory returns and to board MI. Unexplained variances become their own line of enquiry.
Do not overstate. Describing a control as embedded when it was implemented last quarter is the single most common credibility failure.
Brief the board. Selection should be reported to the board with the response and any subsequent feedback.
What firms not selected must do
Published findings are directed at the whole portfolio. The expected response is a self-assessment against each finding and each good practice example, recorded in writing, considered by the board, and converted into actions where gaps exist.
This is the same discipline as responding to a Dear CEO letter, and our guidance on responding to a Dear CEO letter sets out the structure. The self-assessment is the document supervision will ask for if the theme resurfaces at the firm.
Turning findings into evidence
A finding is closed when three things exist: a control change that addresses the root cause, monitoring that tests the changed control, and a re-test result showing the control operating. Anything short of that is an action item, not a closure.
Firms that run this discipline consistently build something valuable: a documented record of self-identification and correction, which is the strongest possible position going into any future supervisory contact. Our guidance on regulatory health checks covers how to run that assessment proactively.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
We support firms selected for multi-firm and thematic work, including information request project management, pre-submission file sampling and quality control, consistency checks against regulatory returns and board MI, remediation planning, and portfolio-wide self-assessments against published findings.
Contact our regulatory team at info@regulatorycounsel.co.uk.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently Asked Questions
It is a supervisory exercise in which the FCA examines a sample of firms within a portfolio against a defined theme, provides firm-specific feedback, and publishes aggregated findings that set expectations for the whole portfolio.
Selection usually reflects business model, size, growth rate, distribution arrangements or an outlier position in reported data. It is not in itself an allegation of failure.
Deadlines are typically short, often two to four weeks, which is why the ability to produce control evidence quickly matters as much as the content of the response.
Yes. The FCA expects every firm in the portfolio to self-assess against the findings and good practice examples, to act on any gaps, and to be able to evidence that it did so.
By showing a control change that addresses the root cause, a monitoring test of the changed control, and a re-test result demonstrating that the control is operating effectively.