Structuring a Dear CEO Letter Response That Lands Credibly

A Dear CEO letter is not correspondence. It is a supervisory signal, often informed by thematic data the FCA has already triangulated across your peers. The quality of your response tells the regulator whether your firm understands the issue, whether the board owns it, and whether remediation is real. Weak responses almost always invite follow-up: a Section 165 request, a thematic visit, or a skilled person review. Strong responses do the opposite. They close the issue by demonstrating genuine grip.

Start by reading the letter properly

Most firms respond to what they think the letter says, not what it actually says. Read it three times. Separate the explicit asks (confirm actions, submit attestations, provide data) from the implicit ones (demonstrate culture, show board oversight, evidence proportionality). Map every paragraph to a required output. If the letter references a portfolio strategy letter or prior thematic work, go back to those documents. The FCA expects you to join the dots.

Then ask: what is the supervisor actually worried about? A letter on consumer vulnerability is rarely only about vulnerability. It is usually about whether your Consumer Duty outcomes monitoring is real. Respond to the surface question and the underlying one.

Decide who owns the response

The accountable SMF should be named early and visibly. For most Dear CEO letters this is the CEO, but specific topics will pull in the Chief Risk Officer, Compliance SMF, or Chair of a board committee. Ownership should not sit with the general counsel or compliance team drafting the reply. The FCA wants to see executive grip, and the response should read as if the SMF has personally engaged with the content.

Bring the board or relevant committee into the process before drafting is finalised. A response that cites board discussion on a date that post-dates the letter by two weeks tells its own story.

Structure the response for a supervisor's eye

A credible response typically runs in this order:

1. Short opening paragraph acknowledging the letter, the issues raised, and the firm's commitment to address them.
2. Summary of governance: who has reviewed, when, what challenge was applied, what the board concluded.
3. Point-by-point response to each issue raised, using the regulator's own framing and language.
4. Gap analysis: where the firm already meets the expectation, where it partially meets it, where it does not.
5. Remediation plan with named owners, milestones, and board reporting cadence.
6. Attestations or confirmations requested.
7. Clear contact point for supervisory follow-up.

Resist the urge to lead with everything you already do well. Supervisors read defensiveness as a red flag. Lead with acknowledgement and specificity.

Calibrate candour carefully

The hardest judgement is how much to concede. Overclaiming maturity you cannot evidence is the single most common error, and it is the one most likely to generate escalation when the FCA tests the claim. Underclaiming creates unnecessary supervisory concern. The right posture is accurate self-assessment: this is where we are, this is the evidence, this is what we are doing about the gaps, this is when it will be complete.

If a weakness exists, name it before the regulator does. Firms that surface their own issues tend to be trusted to fix them. Firms that are caught minimising rarely are.

Close the loop properly

Commit only to what you will deliver, on timelines you will hit. Missed commitments to the FCA are remembered. Where remediation runs beyond six months, build in interim milestones and offer proactive progress updates. This signals ownership and removes the need for the supervisor to chase.

Before sending, have someone outside the drafting team read the response cold. Ask them: does this sound like a firm that understands the issue and is in control? If the answer is uncertain, rework it.

Your next decision

If you have a Dear CEO letter open now, the immediate question is whether your board has seen it, challenged the proposed response, and recorded that challenge. If not, that is the first step before any drafting resumes.

Frequently Asked Questions

Should every Dear CEO letter receive a written response?

Not always. Some letters are informational and explicitly do not require a reply. Read the final paragraphs carefully. Where no response is required, the firm should still document board consideration and any actions taken, because the FCA may ask later.

How long should the response be?

As long as the issues demand and no longer. Most credible responses sit between eight and twenty pages, with supporting appendices. Brevity signals confidence; padding signals the opposite.

Who should sign the response?

The accountable SMF, usually the CEO. Co-signature by the Chair can be appropriate where the letter touches governance or culture directly.

What if we disagree with the FCA's characterisation?

Say so, respectfully and with evidence. Supervisors expect firms to push back where facts warrant it. What they do not accept is disagreement framed as compliance.

How do we handle commitments we may not hit?

Do not make them. If a timeline is genuinely uncertain, say so, explain the dependencies, and commit to a decision point by a specific date. Honesty about delivery risk is far better received than a missed deadline later.