How to Structure a Section 165 Response That Limits Scope Creep

A Section 165 notice is not a conversation starter. It is a statutory demand with legal consequences for non-compliance and reputational consequences for over-disclosure. The firms that get this wrong treat it as an opportunity to demonstrate transparency. The firms that get it right treat it as a precise legal exercise: answer what was asked, in the form asked, and nothing more.

Key Executive Takeaways

• Section 165 responses should be constructed as legal instruments, not supervisory dialogue: every additional volunteered fact expands the FCA's next request.
• The single biggest driver of scope creep is inconsistent framing across attachments, cover letters, and previously submitted materials, not the substance of the answers themselves.
• A named response owner, a documented interpretation log, and a disclosure boundary agreed with the General Counsel before drafting begins are the three controls that separate disciplined responses from expansive ones.

Start with a forensic reading of the notice

Before any drafting, sit with the notice and identify three things: the precise statutory basis cited, the exact scope of information requested, and the specified format and deadline. Section 165 is broad, but the notice itself is not. If the FCA has asked for "policies in force during 2023", you do not provide 2022 drafts, board minutes referencing those policies, or the current version. Each of those becomes a new thread.

Where the request is ambiguous, do not resolve the ambiguity by disclosing more. Resolve it by writing to the case officer with a proposed interpretation and asking for confirmation. This creates a documentary record that constrains later challenge.

Establish the disclosure boundary before you draft

Convene General Counsel, the SMF16/17, and the response owner. Agree, in writing, what sits inside and outside the response perimeter. This should cover: relevant time period, relevant legal entities, relevant business lines, and the treatment of legally privileged material, work product prepared for litigation, and material covered by other regulatory confidentiality regimes.

Most scope creep originates here. A junior analyst pulls a folder that contains adjacent material, a reviewer waves it through as "helpful context", and the FCA now has visibility into a topic that was never in the notice. Once seen, it cannot be unseen.

Draft to the question, not around it

The response should mirror the structure of the notice. Number your answers to match. Do not restructure, consolidate, or thematically reorganise. If a question has three limbs, answer three limbs.

Avoid narrative framing in the cover letter. A short letter confirming receipt, the response owner, the statutory basis of the response, and any confidentiality assertions is sufficient. Executive summaries invite the FCA to read your characterisation as fact and probe the gap between summary and evidence.

Manage attachments as carefully as answers

Every document attached is discoverable in future supervisory activity. Before attaching, ask: does this document contain material outside the notice scope? If yes, either redact with a clear legal basis stated, or produce a bespoke extract with a covering note explaining the extraction methodology. Do not attach entire policy suites when a single clause was requested.

Maintain an interpretation log recording every judgement call made during drafting: what was included, what was excluded, and why. This log is not disclosed but protects the firm if the FCA later alleges incomplete response.

Anticipate the follow-up before you send

Read the draft response as a case officer would. What is the most obvious next question? If the answer is a question the firm does not want asked, revise the response. This is not about concealment. It is about not gratuitously seeding new inquiries through phrasing choices, adjectival flourishes, or volunteered context.

Common triggers: references to "ongoing remediation", "legacy issues", "under review", or named third parties not otherwise in scope. Each of these becomes a Section 165 request in six months.

What good looks like

A disciplined Section 165 response is short, structurally identical to the notice, evidenced by targeted attachments, and silent on everything else. It is signed off by GC and the accountable SMF before dispatch. It closes the request rather than opening a dialogue.

Your next action: pull your last three Section 165 responses and audit them against the disclosure boundary test. If any contain volunteered material outside the notice scope, that is the pattern to fix before the next notice arrives.

Frequently Asked Questions

Can we claim legal privilege over parts of the response?

Yes, but assert it precisely. Blanket privilege claims are challenged. Identify the specific document, the type of privilege (legal advice or litigation), and the basis. Log every privilege decision. Expect the FCA to test weak claims.

What if we identify an issue while preparing the response?

Separate the two questions. First, does the notice require you to disclose it? If yes, disclose. If no, the discovery may still trigger a Principle 11 notification obligation, but that is a separate submission with its own framing, not an addendum to the Section 165 response.

Should we ask for an extension?

Only if you genuinely need one and can specify why. Extension requests are noted. A pattern of extensions signals capacity or governance weakness. If you ask, ask early, ask once, and propose a specific new date.

How do we handle a Section 165 that overlaps with an ongoing skilled person review?

Flag the overlap explicitly in the cover letter and propose coordination. Duplicative disclosure across workstreams is where inconsistencies emerge and inconsistencies drive escalation.