How to Prepare a Credible Response to a Section 165 Request

A Section 165 notice is not a routine data pull. It is a formal use of statutory powers, and the quality of your response shapes how the regulator reads your firm for months or years afterwards. Treat it as a test of your governance, your records, and your candour. The firms that come out of these exercises well are the ones that organise fast, produce accurately, and resist the urge to curate.

Key Executive Takeaways

• A Section 165 response is judged as much on completeness, accuracy and timeliness as on content; errors and omissions are harder to recover from than uncomfortable facts.
• Treat the request as a governed project from day one, with a named owner, legal oversight, a defensible search methodology, and a clear chain of custody for every document produced.
• Engage the supervisor early on scope, format and timing; silence followed by a late or partial response damages credibility more than the underlying issue usually does.

Read the notice properly before doing anything else

Start with the exact wording. Section 165 notices vary in breadth, specificity and deadline, and the drafting usually signals what the supervisor is actually worried about. Identify the legal basis, the recipient (firm or individual), the time period, the categories of information, the format required, and the deadline. Note any explicit reference to attestations, personal responsibility, or SMF accountability. If the notice names an SMF, that person needs to be briefed within hours, not days.

Most firms misread the scope at this stage. They either interpret it too narrowly, producing a response that looks evasive, or too broadly, drowning the supervisor in material and signalling poor information management. Get this calibration right at the outset.

Stand up a governed response team

Appoint a single accountable owner, usually the General Counsel, Head of Compliance, or a senior SMF depending on subject matter. Around them, build a small core team: legal, compliance, the relevant business line, technology and records, and company secretariat. Document the governance: who approves scope decisions, who signs the final submission, how legal privilege is managed, and how the board or relevant committee is kept informed.

Engage external counsel early if the request touches potential enforcement, individual accountability, or legally privileged material. Do not wait until you discover something awkward.

Define search methodology and preserve evidence

Issue a legal hold immediately covering all custodians and systems in scope. Agree a defensible search protocol: custodians, date ranges, keywords, systems, and review process. Record every decision. If you later need to explain why a document was not produced, the methodology is your defence.

This is where firms most often come unstuck. Informal searches, missed archives, personal devices overlooked, chat platforms excluded: each becomes a credibility problem if the regulator finds the gap first.

Produce accurately, not favourably

The temptation to shape, summarise or contextualise is strong. Resist it. Produce the information requested, in the format requested, with clear indexing. Where context is genuinely needed to prevent misunderstanding, provide it in a short covering note, factual and sourced. Do not editorialise. Do not omit material because it is embarrassing. Supervisors notice both.

If you discover errors in previous submissions or in the firm's regulatory data during the exercise, flag them. Self correction is almost always treated better than concealment later uncovered.

Engage the supervisor in real time

If the deadline is unrealistic, say so early with a proposed alternative and a reason. If scope is ambiguous, ask. If you will produce in tranches, agree the sequencing. Supervisors generally respond well to firms that engage transparently about process; they respond badly to silence followed by missed deadlines or partial deliveries.

Prepare the follow up

Assume the response triggers further questions, interviews, or a skilled persons review. Keep the response team together for at least four weeks after submission. Debrief internally: what did the exercise reveal about your records, controls, or culture that needs fixing regardless of the regulator's next move? Those findings often matter more than the request itself.

The decision in front of you now

If a Section 165 notice has arrived, the first decision is governance: who owns this, what is the escalation path, and when does the board hear about it. Make that call today. Everything else follows from it.

Frequently Asked Questions

Should we claim legal privilege over internal analysis prepared in response?

Only where it genuinely applies, and with legal advice. Overclaiming privilege is a common and visible mistake. Keep privileged advice separate from factual production, and be prepared to justify any withholding.

What if we find wrongdoing while preparing the response?

Escalate internally at once, take legal advice, and consider whether notification obligations under Principle 11 or SUP 15 are triggered. Discovering an issue during a Section 165 exercise and failing to disclose it compounds the original problem substantially.

How much context should we provide alongside raw documents?

Enough to prevent misreading, no more. A short, factual index and covering note is appropriate. Lengthy narrative framing reads as advocacy and undermines credibility.

Who should sign the response?

Usually the relevant SMF or an authorised senior officer, depending on the notice. The signatory must be able to attest personally to completeness and accuracy, so they need to understand the methodology, not just the content.

Does board involvement help or hurt?

It helps when calibrated. The board should be informed, understand the scope, and receive the final response summary. They should not be drafting it. Clear management ownership with board oversight is what good looks like.