A Dear CEO letter is not correspondence. It is the FCA telling an entire portfolio of firms what it expects, in writing, on the record, and with the clear implication that any firm later found short will be asked what it did when the letter arrived.
What these letters are and how they are used
The FCA supervises most firms on a portfolio basis. Until 2026 it set out each portfolio's priorities in portfolio letters, often addressed to the CEO. Between February and March 2026 it replaced these with nine annual Regulatory Priorities reports, one for each sector. Dear CEO letters remain in use for specific issues, such as the letter sent to firms handling motor finance complaints. They set out the harms the FCA has identified, the action it expects and, sometimes, a deadline. Recent letters and priorities reports have addressed themes including safeguarding of relevant funds, financial crime controls in payments and cryptoasset firms, Consumer Duty implementation and outcomes evidence, affordability and forbearance in consumer credit, and wind-down planning.
Three features matter.
They are addressed to the CEO deliberately. The expectation is board-level consideration, not compliance-team filing.
They are evidence of notice. Once issued, a firm cannot credibly say it was unaware of the expectation.
They usually specify an action. Many letters ask firms to discuss the content at board level by a stated date, and some require a written response or an attestation.
The response the FCA expects
The FCA is testing whether the firm can translate a general expectation into specific action within its own business model. A defensible response has four components.
A gap assessment against each expectation
Take each expectation in the letter as a separate line. For each, record the current position, the evidence supporting that position, the gap if any, and the required action. Assertions without evidence references are the most common weakness.
| Element | Weak response | Defensible response |
|---|---|---|
| Current position | "Controls are in place" | Named policy, version, date, control owner |
| Evidence | Not referenced | Monitoring output, sample testing, MI extract |
| Gap | "No material gaps identified" | Specific gaps with severity rating |
| Action | "Under review" | Owner, deliverable, date, closure evidence |
A prioritised action plan
Each action needs an accountable owner, usually a senior manager, a target date and a definition of what closure evidence will look like. Actions without a defined closure test do not close.
Board consideration on the record
The minutes should show that the board received the letter and the gap assessment, applied challenge, agreed the plan and set a review point. Minutes recording only that the letter was "noted" are actively unhelpful.
Follow-through and re-testing
The plan should be tracked to completion through the compliance monitoring programme, with a re-test after implementation to confirm the control is operating and not merely documented.
Sector-specific themes to expect
Payments and [e-money](/licences/uk-electronic-money-institution). Safeguarding records and reconciliation under CASS 15, in force since 7 May 2026, wind-down planning, agent and distributor oversight, and financial crime controls. See our PS25/12 safeguarding compliance checklist.
Cryptoasset firms. Financial crime systems, financial promotions compliance and authorisation under the new regime, which starts on 25 October 2027, with applications accepted from 30 September 2026 to 28 February 2027. Our guidance on the UK cryptoasset regime sets out what applicants need.
[Consumer credit](/licences/fca-consumer-credit). Affordability assessments, treatment of customers in financial difficulty, and fees and charges. See affordability and responsible lending.
All portfolios. Consumer Duty outcomes evidence and the annual board report, and the quality of management information supporting both.
Where firms go wrong
Delegating it downwards. A letter addressed to the CEO answered solely by a compliance manager tells supervision what the firm's governance looks like.
Answering the theme, not the firm. Generic descriptions of good practice do not demonstrate that this firm has assessed its own exposure.
Over-claiming. Stating that a control is fully effective when monitoring has not tested it creates a second issue if the control later fails.
Failing to retain the work. The gap assessment, the plan and the closure evidence should be retained and easy to produce. When the theme returns, whether through a follow-up letter, a multi-firm review or an information request, that pack is the first thing requested.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
We support firms responding to Dear CEO and portfolio letters, including structured gap assessments, board papers and challenge material, remediation planning and tracking, closure evidence packs, and drafting of formal responses and attestations.
Contact our regulatory team at [email protected] for a written proposal.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently asked questions
It is supervisory correspondence sent to the chief executives of a defined portfolio of firms setting out the harms the FCA has identified, its supervisory priorities and what it expects firms to do in response.
Not always. Some letters request a written response or attestation and others do not. In every case the firm is expected to consider the letter at board level and to be able to evidence what it did in response.
A gap assessment against each expectation with supporting evidence, a prioritised action plan with named owners and dates, board minutes evidencing challenge, and a plan for re-testing controls after implementation.
A named senior manager, usually the CEO or the holder of the relevant prescribed responsibility, with the compliance function coordinating delivery and the board retaining oversight.
The letter is evidence that the firm was on notice of the expectation. Where a related failing later emerges, the absence of any documented response is treated as a governance failing in its own right and increases the likelihood of further supervisory intervention.
Yes. Between 24 February and 25 March 2026 the FCA published nine annual Regulatory Priorities reports, one for each sector, to replace portfolio letters. Dear CEO letters are still used for specific issues.
In the same way as a Dear CEO letter: map each priority relevant to the firm to a control, an owner and evidence, take the assessment to the board, and track the gaps to closure.
Definitive guides on this topic
The permanent reference pages this article relates to.