How to Prepare a Credible Response to a Dear CEO Letter
This guide sets out how boards and executive teams should structure, evidence, and deliver a response to a Dear CEO letter. After reading it, you will know what supervisors are actually testing, how to sequence the work, and how to produce a reply that stands up to challenge.
A Dear CEO letter is not correspondence. It is a supervisory instrument, and the response you file becomes part of your firm's permanent record with the regulator. Treat it as a test of governance maturity, not a drafting exercise.
Key Executive Takeaways
- A Dear CEO response is judged on evidence of action and ownership, not polished prose or restated policy.
- The CEO must visibly own the response, with the board sighted and challenged, before anything is submitted.
- Weak responses either over-claim comfort the firm cannot evidence, or hide behind generic framework language that signals the issues have not been genuinely absorbed.
Read the letter the way the supervisor wrote it
Start by separating what the letter actually asks for from what it signals. Most Dear CEO letters contain three layers: explicit asks (attestations, gap analyses, board discussion), thematic concerns the regulator expects every firm to self-assess against, and tone indicators about where supervisory attention is heading. All three need a response, but only the first is usually spelled out.
Read the letter alongside the regulator's recent speeches, portfolio letters to adjacent sectors, and any prior supervisory correspondence to your firm. If the themes echo issues raised in your last periodic summary meeting or a Section 166, assume the supervisor is already testing whether you have moved.
Decide the governance route before you start drafting
The single biggest predictor of a credible response is who owns it internally. Default to CEO ownership, with a named executive sponsor per thematic area, and the board or a designated committee reviewing the draft before submission. Compliance or risk can coordinate, but they should not be the signatory on substance that sits with the first line.
Agree three things in the first week: who signs, which board or committee reviews, and what the internal evidence standard is. Firms that skip this step end up with a response written by consultants or junior staff, lightly reviewed, and visibly thin when challenged.
Do the self-assessment honestly
For each theme in the letter, run a structured gap analysis. The useful format is: what the regulator expects, what we currently do, where the gap is, what we are changing, by when, and how we will know it worked. Resist the temptation to score yourself green everywhere. Supervisors read dozens of responses in parallel and can spot uniform self-congratulation immediately.
If a theme does not apply to your business model, say so clearly and explain why. Silence or vague acknowledgement is worse than a reasoned carve-out.
Evidence beats assertion
For every material claim, know what sits behind it. If you say the board has debated a topic, cite the meeting and the minuted conclusion. If you say controls have been strengthened, name the control, the owner, and the testing cycle. If a remediation is in flight, give the milestone plan and the accountable executive.
The test is simple: if the supervisor asks for the underlying pack, can you produce it the same day without rewriting history? If not, soften the claim.
Calibrate the tone
Avoid two failure modes. The first is defensive minimisation, framing issues as isolated or already resolved when they are neither. The second is performative contrition, long passages of self-criticism without a credible plan. Supervisors want to see that you understand the issue, have realistic ambition, and are gripping delivery. Confident, specific, and plan-led is the right register.
Sequence the final mile
Build in time for board challenge that is real, not ceremonial. Share the draft with non-executives at least a week before sign-off, with the underlying evidence pack. Expect the board to push back on at least one area, and treat that as the system working. The CEO's covering letter should reflect genuine ownership, not a template.
Submit on time. Where the deadline is tight and the work genuinely needs longer to be done well, ask for an extension early and explain why. A credible request lands better than a rushed submission.
The next decision
Before you commission a single workstream, decide who signs, who reviews, and what evidence standard the response will meet. Everything else follows from that.
Frequently Asked Questions
Should we respond even if the letter is addressed to the sector rather than our firm?
Yes. A thematic Dear CEO letter still expects firms to self-assess and be able to discuss their position at the next supervisory meeting, even if a written response is not formally required. Document the board discussion and conclusions.
How much detail should go into the written response versus the supporting pack?
The response should be specific enough to be meaningful, usually ten to twenty pages, with a clearly indexed evidence appendix. Avoid burying the regulator in volume. They want to see you have made judgements, not that you have attached everything.
Who should sign the response?
The CEO, personally. Co-signing with the Chair is appropriate where the letter raises governance or culture themes. Delegating signature to a function head signals the firm has not taken the letter seriously.
What if our self-assessment reveals a material issue the regulator did not ask about?
Disclose it, with a plan. Supervisors value firms that surface issues proactively. Finding something later that you should have flagged now damages trust far more than the issue itself.
How do we handle disagreement with the regulator's framing?
Engage with it directly and respectfully. If you believe a concern is misdirected for your business model, say so and evidence why. Silent compliance with a framing you disagree with stores up problems for the next cycle.
Frequently asked questions
Should we respond even if the letter is addressed to the sector rather than our firm?
Yes. A thematic Dear CEO letter still expects firms to self-assess and be able to discuss their position at the next supervisory meeting, even if a written response is not formally required. Document the board discussion and conclusions.
How much detail should go into the written response versus the supporting pack?
The response should be specific enough to be meaningful, usually ten to twenty pages, with a clearly indexed evidence appendix. Avoid burying the regulator in volume. They want to see you have made judgements, not that you have attached everything.
Who should sign the response?
The CEO, personally. Co-signing with the Chair is appropriate where the letter raises governance or culture themes. Delegating signature to a function head signals the firm has not taken the letter seriously.
What if our self-assessment reveals a material issue the regulator did not ask about?
Disclose it, with a plan. Supervisors value firms that surface issues proactively. Finding something later that you should have flagged now damages trust far more than the issue itself.
How do we handle disagreement with the regulator's framing?
Engage with it directly and respectfully. If you believe a concern is misdirected for your business model, say so and evidence why. Silent compliance with a framing you disagree with stores up problems for the next cycle.
Related guides
What Makes a Decision Defensible to Regulators: A Practical Guide
This guide explains what regulators actually look for when they test whether a decision was sound, and how senior leaders should structure and document decisions so they hold up under later scrutiny. After reading, you will know what to build into your decision process now to withstand a supervisory review, enforcement inquiry, or section 166 later.
Structuring an MLRO Annual Report That Satisfies SYSC 6 Without Triggering FCA Intervention
This guide sets out how to structure and write the MLRO annual report so it meets SYSC 6.3.9G expectations and gives the board a defensible record of financial crime oversight. After reading it, senior decision-makers will know what to include, what to leave out, and how to frame weaknesses without inviting supervisory follow-up.
What Makes a Decision Defensible to Regulators: A Practical Guide
This guide explains what regulators actually look for when they test a major decision after the fact, and how to build defensibility into the decision itself rather than reconstruct it later. You will finish with a clear view of what to document, who to involve, and where most firms leave themselves exposed.
How to Handle a Pre-Emptive Regulator Meeting After a Governance Failure
This guide covers how to prepare for and run a self-initiated regulator meeting when you have discovered a material governance failure inside your firm. After reading, you will know how to sequence the disclosure, frame the failure, and position remediation in a way that preserves credibility and controls the supervisory response.
How to Structure a Section 166 Response That Preserves Board Credibility
A practical guide to responding to a Skilled Person review in a way that protects the board's standing with the regulator. Covers how to sequence the engagement, where boards typically damage their own credibility, and how to convert findings into a credible remediation posture.
Where internal confidence may exceed external evidence
Polar Insight helps leadership teams test critical assumptions against stakeholder, market, regulatory, and operational reality before risk compounds.
Explore Stakeholder Proximity