What Regulators Look For in a Submission: A Practical Guide
This guide explains what regulators actually assess when reviewing a formal submission, from authorisation applications to Section 166 responses and thematic returns. After reading it, you will know how to structure a submission that reflects genuine control, sound judgement and credible governance.
Regulators reading your submission are asking a small number of hard questions: do you understand your business and its risks, are your controls real, is your governance functioning, and can we trust what you say. Everything else is texture. If you want a submission that lands well, whether it is a Part 4A application, a variation of permission, a skilled person response, a REP return commentary or a formal information request, you need to answer those questions directly, with evidence, and without spin.
Key Executive Takeaways
- Regulators judge submissions on substance, coherence and credibility, not polish; the reviewer is testing whether your written position matches how the firm actually operates.
- The most common failure is a submission that reads well in isolation but contradicts prior filings, MI, board minutes or what staff would say if interviewed.
- Strong submissions show the firm has already identified its weaknesses, explained them honestly, and set out proportionate, resourced remediation with owners and dates.
What Regulators Are Actually Assessing
Behind every submission review sits a supervisor forming a judgement on four things.
Understanding. Do you genuinely understand your business model, customer base, risk profile and the rules that apply. Vague or generic descriptions signal a firm that has not done the work. Specificity, including numbers, segments, volumes and concentrations, signals the opposite.
Control. Are the controls you describe real, tested and evidenced. Regulators look for the gap between policy and practice. A control framework that exists only on paper is worse than admitting a weakness, because it raises questions about honesty as well as capability.
Governance. Who decided what, when, and on the basis of what information. Board and committee minutes, MI packs, and challenge recorded in the room are the artefacts that show governance is functioning. Submissions that describe governance without showing it in action rarely convince.
Credibility. Does your submission line up with everything else the regulator knows about you: prior returns, past correspondence, complaints data, whistleblowing intelligence, peer benchmarks and market events. Inconsistency is the single fastest way to lose the reviewer's trust.
What Good Looks Like
A strong submission has a clear narrative spine. It states the position, sets out the evidence, acknowledges limitations, and explains what is being done about them. It uses the regulator's own language and framework, including reference to relevant rules, Principles, and published expectations, without performative citation.
It includes the underlying documents, not summaries of summaries. Where MI is cited, the MI is attached. Where a policy is referenced, the version, date and approval trail are clear. Where a control is described, the testing evidence is included or offered.
It is proportionate. A ten thousand word answer to a narrow question suggests the firm is either hiding something or does not know what matters.
What Most Firms Get Wrong
The most frequent failure is overclaiming. Firms describe target state controls as if they exist today, or describe pilot activity as embedded practice. Supervisors read hundreds of submissions and spot this quickly. Once trust is dented, every subsequent statement is read more sceptically.
The second failure is inconsistency across the submission itself. Executive summary says one thing, the annex data says another. This usually reflects multiple authors and no single owner integrating the document.
The third is avoiding the hard question. If the regulator has asked about a specific incident, complaint pattern or control failure, the answer must address it head on. Deflection reads as defensiveness and invites follow up.
How to Structure the Work
Assign a single accountable owner, usually at ExCo level, with authority to compel input and make final calls on wording. Draft the answer to the regulator's actual question before writing anything else. Test the draft against three sources: your own MI, your own board minutes, and what a randomly selected relevant staff member would say if asked. Where those diverge from the draft, fix the draft or fix the underlying issue.
Before submission, have someone outside the drafting team, ideally with supervisory experience, read it cold and mark every claim that is not evidenced or that overstates the position.
The Decision Point
Before you submit, ask one question: if a supervisor walked into the firm tomorrow and tested every claim in this document, would each one hold. If the answer is no anywhere, revise the submission or accelerate the remediation. Do not submit a document you cannot stand behind under scrutiny.
Frequently Asked Questions
How much detail should we include in an annex versus the main body?
The main body should give a supervisor everything they need to form a view. Annexes exist to evidence claims, not to hide them. If a reviewer has to hunt through annexes to find the actual answer, the structure is wrong.
Should we disclose issues the regulator has not asked about?
If the issue is material to the question being asked, or to the regulator's ability to supervise you effectively, yes. Selective disclosure that later comes to light causes far more damage than proactive honesty.
How do we handle areas where remediation is still in progress?
Be specific: what the issue is, what caused it, what is being done, who owns it, when it completes, and how progress is being tracked. A credible remediation plan is a strong signal. A vague one is a weak signal.
Who should sign off the final submission?
The accountable senior manager under SMCR whose responsibility covers the subject matter, with visible board or committee oversight where the matter is material. Sign off should be substantive, not procedural.
What role should external advisers play?
Advisers can sharpen structure, test arguments and bring pattern recognition from other cases. They should not write the firm's position. Regulators can tell when a submission does not sound like the firm.
Frequently asked questions
How much detail should we include in an annex versus the main body?
The main body should give a supervisor everything they need to form a view. Annexes exist to evidence claims, not to hide them. If a reviewer has to hunt through annexes to find the actual answer, the structure is wrong.
Should we disclose issues the regulator has not asked about?
If the issue is material to the question being asked, or to the regulator's ability to supervise you effectively, yes. Selective disclosure that later comes to light causes far more damage than proactive honesty.
How do we handle areas where remediation is still in progress?
Be specific: what the issue is, what caused it, what is being done, who owns it, when it completes, and how progress is being tracked. A credible remediation plan is a strong signal. A vague one is a weak signal.
Who should sign off the final submission?
The accountable senior manager under SMCR whose responsibility covers the subject matter, with visible board or committee oversight where the matter is material. Sign off should be substantive, not procedural.
What role should external advisers play?
Advisers can sharpen structure, test arguments and bring pattern recognition from other cases. They should not write the firm's position. Regulators can tell when a submission does not sound like the firm.
Related guides
How to Structure a Section 166 Skilled Person Review Response
This guide sets out how senior leaders in regulated firms should structure their response to a Section 166 skilled person review, from the moment the requirement notice arrives to the remediation phase. It covers governance, evidence, stakeholder handling, and the judgement calls that determine whether the firm emerges credibly or damaged.
How to Prepare a Regulatory Filing With Stakeholder Risk Assessment
A practical guide for senior leaders on integrating stakeholder risk assessment into a regulatory filing so it reads as evidence of genuine control, not compliance theatre. After reading, you will know how to sequence the work, what to include, and where filings typically fall short under supervisory review.
How to Structure a Recovery Plan Playbook That Passes PRA Credibility Tests
This guide sets out how to build a Recovery Plan playbook that meets the PRA's credibility, usability and timeliness expectations without creating documents that could damage confidence if they surface externally. After reading, you will know how to sequence indicators, options and governance triggers so the plan works as a live management tool rather than a compliance artefact.
How to Structure an Operational Resilience Self-Assessment That Withstands Regulator Challenge
This guide sets out how to build an operational resilience self-assessment that holds up to FCA and PRA impact tolerance scrutiny. After reading, senior leaders will know how to sequence evidence, frame judgements, and pre-empt the challenges supervisors are most likely to raise.
How to Structure a Pillar 2 Liquidity Narrative That Anticipates PRA ILAAP Challenge
This guide sets out how to build an ILAAP liquidity narrative that pre-empts the specific challenges PRA supervisors raise on Pillar 2 risks. After reading, senior leaders will know how to sequence the document, where to concentrate evidence, and how to defend judgement calls under supervisory pressure.
Where a specific question needs an outside answer, quickly
Polar Insight's Expert Network connects leadership teams with practitioners who can speak to a precise regulatory, commercial, or stakeholder question before a decision is finalised.
Explore Expert Network