A VREQ or OIREQ can change the operating perimeter of an FCA-regulated firm immediately. The requirement may restrict new business, prevent a particular activity, impose customer-remediation obligations, require additional reporting or place another condition on the firm's Part 4A permission. Management therefore needs to treat the wording as an operational control, not simply as supervisory correspondence held by compliance.
The two terms describe different routes. A VREQ is a requirement voluntarily agreed with the FCA, while an OIREQ is imposed using the FCA's own-initiative powers. The FCA also uses related voluntary and own-initiative tools for variations of permission and directions. Requirements, directions and limitations are typically visible on the Financial Services Register.
The practical challenge is the same once a requirement is in force: the firm must understand precisely what it prohibits or requires, implement controls capable of preventing breach and build a remediation programme that produces the evidence needed for the FCA to consider variation or removal.
Understand the exact legal instrument
The first step is to read the final requirement rather than rely on the description used during negotiations or supervisory meetings. Small differences in wording can materially change what the firm can do.
A requirement may prohibit onboarding new customers, restrict particular products, prevent holding client money, impose asset restrictions, require consent before taking specified actions or oblige the firm to complete a remediation exercise. The scope may be limited to one business line or apply across the legal entity.
Definitions matter. "New business", "customer", "arranging", "payment service" or another operative term can determine whether pipeline cases can continue and whether a seemingly ordinary operational step would breach the requirement.
The firm should map every clause into a practical control. Compliance, legal, operations, product, sales, finance and technology may each need to understand different parts of the instrument.
Where the meaning is genuinely uncertain, the firm should resolve that uncertainty with the FCA rather than allow business teams to make inconsistent interpretations.
VREQ and OIREQ are different routes to a similar operational problem
The FCA's supervision material explains that firms can agree a voluntary requirement and that the regulator can use own-initiative powers where a voluntary agreement is not reached or where intervention is otherwise appropriate.
A VREQ should not be treated as commercially optional merely because the word voluntary appears in the name. Once the requirement is imposed following the firm's application or agreement, the firm needs to comply with its terms.
An OIREQ involves formal own-initiative action by the FCA. The statutory and procedural position can be different, including the role of supervisory notices and potential challenge rights. Firms facing an OIREQ should obtain appropriate legal advice on the specific notice and procedure rather than assume the VREQ process applies identically.
For compliance purposes, both require immediate translation into the operating model. The firm needs one controlled interpretation, clear ownership and assurance that systems and staff cannot continue activity outside the permitted scope.
Map the immediate impact before business continues
The first operational assessment should identify every process that could be affected. If new business is restricted, the firm should define the point at which a customer becomes new business for the purpose of the actual wording and determine how pipeline applications are treated.
Sales and onboarding systems may need a hard stop. Website application routes may need to be disabled. Partners, ARs, distributors or introducers may need instructions. Staff incentives may need to be suspended where they encourage activity the requirement now prevents.
Existing customers create a separate question. A restriction on new business does not necessarily prevent servicing existing customers, but the exact requirement may impose conditions on variations, renewals, additional products or other activity. The firm should not infer the answer from the headline.
Finance and liquidity should also be assessed. A restriction on new business can change revenue rapidly, while remediation or redress obligations can create additional cash outflow. The board should understand the effect on the firm's ability to meet regulatory and customer obligations throughout the restricted period.
The firm should document these decisions because later FCA questions may test how quickly and comprehensively the requirement was implemented.
Technology controls should prevent accidental breach
A requirement that depends solely on staff remembering a restriction is fragile. Where possible, systems should enforce the requirement automatically.
A customer-acquisition restriction may require disabling application pathways or preventing account creation. A client-money restriction may require account-level controls. A requirement to obtain FCA consent before a transaction may need workflow approval that cannot be bypassed.
Manual controls can still be appropriate for smaller firms or exceptional processes, but they should be documented and independently checked. The firm should know how it would detect a breach if one occurred.
Testing should include edge cases. A returning customer, renewal, product variation, failed application resubmission or transaction initiated through a partner may fall outside the simple standard journey.
Technology change should also be controlled. A later software release can accidentally reopen a blocked route unless the requirement has been built into change management and regression testing.
Customer communication should be accurate without creating new risk
A requirement can affect customers, prospective customers and commercial partners. The firm should decide what each audience needs to know and ensure communications are accurate.
The FCA requirement itself may be visible on the Financial Services Register, so inconsistent public messaging can create credibility problems. The firm should not claim that business is operating normally where a material restriction is publicly recorded.
At the same time, communications should avoid speculation about regulatory findings that the FCA has not made. Customers need clear information about the service available to them and any action they need to take.
Where remediation affects existing customers, the communication should explain the process, expected timing and contact route. Consumer Duty and complaint obligations remain relevant during a period of restriction.
Staff and customer-support teams should receive consistent guidance so customers do not receive materially different explanations depending on who answers the call.
Governance should separate requirement compliance from root-cause remediation
A firm needs two related workstreams. The first is ensuring immediate compliance with the requirement. The second is resolving the underlying issue that led to it.
The board or governing body should have clear oversight of both. Requirement compliance should include breach monitoring, operational controls and any FCA reporting deadlines. Remediation should address root cause, customer impact, control design and evidence of sustainable improvement.
Combining the two into one project can obscure risk. A firm may be making good remediation progress while still exposing itself to a direct breach of the requirement because an operational control failed.
Senior management should receive regular information on both dimensions. Material exceptions should be escalated immediately rather than waiting for the next scheduled committee.
Where SMCR applies, responsibility mapping should reflect who owns the affected business, remediation and regulatory relationship.
Remediation should address the cause identified by the evidence
The FCA is unlikely to be satisfied by policy changes alone where the underlying problem involved operational failure or customer harm. The remediation plan should identify why the issue occurred and what evidence will demonstrate that it is no longer likely to recur.
If poor customer outcomes resulted from weak affordability controls, the solution may involve model changes, data, training and retrospective review. If the issue was AR oversight, the firm may need stronger due diligence, monitoring, resource and network remediation. If the issue was safeguarding or client assets, systems, reconciliation, bank arrangements and governance may all require change.
Each action should have an owner, deadline and closure test. The firm should avoid long remediation plans containing low-value administrative actions while the main control weakness remains unresolved.
Customer impact should be assessed separately. Where the issue may have affected a wider population, the firm should establish the scope and determine whether redress or other remediation is required.
The remediation plan should also identify dependencies that could delay removal of the requirement, such as a technology release or third-party assurance review.
Independent assurance can strengthen the evidence where appropriate
The FCA may want confidence that remediation has been tested independently. That does not mean every VREQ or OIREQ automatically requires a section 166 skilled person review or external consultant.
The right assurance model depends on the issue and the FCA's expectations. Internal audit, independent compliance testing, specialist external review or another form of assurance can be appropriate depending on the firm's governance and the severity of the problem.
The assurance scope should test whether the control operates, not merely whether the remediation actions were completed. A new procedure can be present without staff following it, and a system change can be deployed without producing the intended customer outcome.
Evidence should be reproducible. Testing populations, samples, exceptions and conclusions should be retained so the FCA can understand the basis of the assurance.
Regulatory Counsel should not be described as an FCA-appointed skilled person unless formally appointed in that capacity for the particular matter.
FCA reporting during the restriction should be controlled
A requirement may include periodic reporting or specific milestones. The firm should treat those submissions with the same discipline as any formal regulatory production.
Data definitions, source systems and sign-off should be clear. Progress updates should distinguish completed actions from effective remediation and identify material delays or new findings openly.
The firm should avoid presenting every action as green merely to demonstrate momentum. An accurate report showing a controlled delay and the reason can be more credible than a status that the underlying evidence does not support.
Where the requirement does not specify periodic reports, Principle 11 and the supervisory relationship can still make material developments relevant. The firm should understand what the FCA expects to be told as remediation progresses.
All communications should be preserved as part of the evidence supporting eventual variation or cancellation.
Applying to vary or cancel a requirement requires evidence
SUP 6.3 explains that a firm with Part 4A permission may apply to the FCA for the imposition of a new requirement or the variation or cancellation of a requirement previously imposed by the FCA.
The firm should not assume that completing the final action in its internal project plan automatically removes the restriction. The requirement remains in force until it is formally varied or cancelled through the applicable process.
An application should explain what has changed, why the original risk has been addressed and what evidence supports that conclusion. The FCA may require additional information or third-party assurance depending on the significance of the issue.
Where the business model has changed materially during remediation, the firm should also explain the current position rather than focus only on historic controls. A remediation framework designed for the old business may not be sufficient for the firm that now exists.
Early engagement with the supervisory team can help identify the evidence the FCA expects before a formal application is made.
Removal should be followed by a period of enhanced monitoring
Once a requirement is removed or varied, the firm should not immediately dismantle the controls that produced the improvement. The underlying risk often deserves enhanced monitoring for a period after formal restriction ends.
Senior management should agree which indicators will demonstrate that the remediation remains effective. These can include customer outcomes, complaints, control exceptions, regulatory data or targeted file reviews depending on the issue.
The firm should also review temporary controls. Some may be unnecessary after removal, while others should become part of the permanent framework.
A post-removal review can identify whether commercial growth is recreating the same pressure that contributed to the original problem.
The best evidence of successful remediation is not only that the FCA removed the requirement, but that the business remains controlled after normal activity resumes.
How Regulatory Counsel can support
Regulatory Counsel supports FCA-regulated firms subject to VREQs, OIREQs and related supervisory restrictions. We can help interpret the requirement, map operational impact, design remediation, prepare evidence, undertake independent assurance and support applications to vary or cancel requirements.
We can also support management and board governance throughout the remediation period.
Speak to Regulatory Counsel to discuss VREQ or OIREQ support.
Frequently Asked Questions
A VREQ is a voluntary requirement agreed with the FCA and imposed on the firm. It can restrict activities or require specified actions and remains binding once in force.
An OIREQ is a requirement imposed by the FCA using its own-initiative powers. The procedural position differs from a voluntarily agreed requirement and firms should take advice on the specific notice.
The FCA states that requirements, directions and limitations are typically published on the Financial Services Register.
A firm can apply under the relevant SUP 6 process for variation or cancellation of a requirement previously imposed by the FCA. Removal is not automatic when the firm's internal remediation plan is completed.
No. The appropriate assurance depends on the requirement, underlying issue and FCA expectations. A section 166 review should not be assumed unless the FCA requires or commissions one.