How to Prepare an FCA Dear CEO Letter Response That Holds Up

A Dear CEO letter is not a request for reassurance. It is a supervisory statement of concern, usually informed by thematic work across your peer group, and the FCA expects the response to demonstrate that the CEO has personally understood the issues, tested the firm against them honestly, and committed to action that is proportionate and verifiable. Firms that treat it as a drafting exercise for the compliance team almost always disappoint.

Start by reading the letter the way the FCA wrote it

Dear CEO letters are drafted with care. Every paragraph signals something: a harm the FCA has observed, a practice it wants stopped, an expectation it wants embedded, or a metric it will test later. Before any drafting begins, the executive sponsor should walk through the letter line by line with the SMF holders whose responsibilities it touches, and agree what the FCA is actually asking. Misreading the scope is the single most common early failure. Firms respond to the topic headline rather than the specific concerns, and the gap becomes obvious when supervisors read the reply.

Run a genuine self-assessment, not a controls inventory

The FCA wants to know whether the harms it has described are present in your firm, to what extent, and what you are doing about them. That requires looking at outcomes, not just policies. Pull the relevant MI, complaints data, file reviews, sales patterns, customer journeys, or whatever the letter points to, and test the evidence against the concerns raised. Where the data is thin, say so, and set out how you will fix the gap. A response that claims full alignment with every expectation, with no issues identified, is rarely believed.

Govern the work properly

Treat the response as a board-level matter. The CEO should chair at least one working session, the relevant SMF holders should sign off their sections, and the board or an appropriate committee should see the draft before it goes out. Record the challenge. Supervisors increasingly ask to see the governance trail behind a response, and a thin paper record undermines the credibility of the substance. Where the letter touches Consumer Duty, operational resilience, financial crime, or another area with a named SMF, the accountability mapping must be explicit.

Write for a supervisor who has read fifty other replies

Supervisors read Dear CEO responses in batches. They notice patterns. The responses that stand out are concise, specific, and honest about what the firm found. Avoid marketing language, avoid repeating the FCA's own words back at it, and avoid vague commitments. If you have found a problem, say what it is, what the root cause looks like, what you are doing, by when, and how you will know it is fixed. If you have not found a problem in an area the FCA flagged, explain how you tested for it and what evidence supports your conclusion.

Build a remediation plan that will survive scrutiny

Every commitment in the response becomes a measuring stick. If you commit to a review by Q2, expect the FCA to ask about it in Q3. Make sure the plan is deliverable, resourced, and tracked through existing governance, not parked in a separate workstream that quietly loses momentum. Assign each action to a named owner, define what completion looks like, and set interim checkpoints the board will see.

What good looks like

A good response is short enough to be read in one sitting, specific enough that a supervisor could test any claim in it, and honest enough that the issues you have found are visible alongside the actions you are taking. It reads as though the CEO wrote the covering letter and the board stood behind it. It does not promise more than the firm can deliver, and it does not hide behind process.

The next decision

Before drafting begins, decide who owns the response end to end, what evidence base you will use for the self-assessment, and how the board will test the draft before it is sent. Those three decisions shape everything that follows.

Frequently Asked Questions

How long should a Dear CEO response be?

Long enough to answer the specific concerns with evidence, short enough that a supervisor can read it in one sitting. Most strong responses sit between ten and twenty pages, with annexes for data and plans.

Should external counsel or consultants draft the response?

They can support the self-assessment and quality-check the draft, but the response must be the firm's own voice and the CEO's own commitment. Supervisors can tell when a reply has been outsourced.

What if we find a serious issue during the self-assessment?

Raise it through the usual channels, including Principle 11 notification if relevant, rather than waiting for the response deadline. Finding and reporting an issue early is viewed very differently from burying it in a letter.

How much detail on remediation is enough?

Enough that a supervisor could, six months later, test whether you did what you said. Named owners, dates, success measures, and governance route are the minimum.

What happens after we send the response?

Expect follow-up questions, possible inclusion in thematic feedback, and in some cases a supervisory meeting. Treat your commitments as live obligations and report progress through the board.