When must a firm notify the FCA?

Firms should not wait until an issue has been fully investigated before asking whether the FCA must be told. Under SUP 15, several duties arise as soon as the firm becomes aware—or has information reasonably suggesting—that a relevant event has occurred, may have occurred or may occur. Notification may therefore be required before the firm reaches firm conclusions about cause, liability or customer harm.

Notification is not merely a reporting formality. Principle 11 requires firms to deal with regulators openly and cooperatively and to disclose appropriately anything relating to the firm of which the FCA would reasonably expect notice (PRIN 2.1.1R). SUP 15 translates that broad obligation into more specific triggers.

When does the duty arise?

The widest trigger is SUP 15.3.1R. A firm must notify the FCA immediately where information reasonably suggests that it is failing to satisfy a threshold condition; that a matter could significantly damage its reputation; that its ability to provide adequate services could be affected with serious customer detriment; or that serious financial consequences could arise for the UK financial system or other firms.

This is forward-looking. The event need not be certain. SUP 15.3.3G says firms should consider both the probability of it happening and the severity of the possible outcome. A low-probability event may still warrant notification if its consequences would be severe.

Principle 11 reaches further. SUP 15.3.8G identifies matters of which the FCA would expect notice, including a proposed restructuring, business expansion or material outsourcing change that could significantly affect the firm’s risk profile or resources. Significant systems or control failures, material changes in capital adequacy or solvency, and significant trading or non-trading losses are also covered. SUP 15.3.9G expects firms to discuss relevant matters with the FCA at an early stage, before making internal or external commitments.

Since June 2026, SUP 15.3.8G also expressly identifies circumstances potentially affecting at least 40% of customers of a service or product, creating significant redress exposure, producing comparatively high complaint numbers or causing substantial financial loss to two or more consumers. The related guidance treats redress of £10 million or 50% of the relevant service’s annual revenue as significant, and loss exceeding £10,000 for an individual consumer as substantial (SUP 15.3.8AG–15.3.8CG).

Separate rules capture particular events. Under SUP 15.3.11R, firms must notify significant breaches of FCA rules, including the Principles and COCON, as well as specified breaches of statutory and regulatory requirements. Notification is required immediately once the firm has information reasonably suggesting that a breach has happened, may have happened or may occur.

Significance is assessed by reference to potential losses to customers or the firm, the frequency of the breach, its implications for systems and controls, and any delay in discovering or correcting it (SUP 15.3.12G). An isolated administrative error may fall below the threshold; repeated errors revealing a control weakness may not.

Other immediate triggers include significant civil proceedings, investigations or sanctions by another regulatory or professional body, and prosecutions involving fraud or dishonesty (SUP 15.3.15R). Significant suspected fraud, accounting irregularities and serious employee misconduct concerning honesty or integrity fall within SUP 15.3.17R. Monetary loss, reputational risk and evidence of control weaknesses determine significance under SUP 15.3.18G. Insolvency events, including winding-up petitions, creditor arrangements and applications for an administrator, are covered by SUP 15.3.21R.

How should the firm notify?

“Immediately” means that the firm cannot postpone notification until its investigation is complete. Where a matter is urgent or significant, SUP 15.7.2G says the firm should contact its usual FCA supervisory contact by telephone or another prompt method before submitting the written notification. A voicemail is unlikely to suffice.

Unless the particular rule provides otherwise, the formal notification must be in writing and English, use the prescribed form—or the form in SUP 15 Annex 4 where none is specified—and include the firm’s reference number (SUP 15.7.1R). It should be addressed to the firm’s usual supervisory contact and delivered through one of the permitted methods, including online submission or email with electronic confirmation of receipt (SUP 15.7.4R–15.7.5AR).

For a breach notification, the content should identify the relevant rule or requirement, explain the surrounding circumstances and describe the remedial and preventative steps taken or proposed (SUP 15.3.14G). Information must be accurate, properly founded and complete (SUP 15.6.1R). If facts remain unavailable, the firm should say that the information is limited rather than delay or present assumptions as conclusions (SUP 15.6.3G).

Notifications should be updated. If information supplied was or may have been inaccurate, incomplete or misleading, or has changed materially, the FCA must be told immediately; corrected information may follow as soon as possible if it is not yet available (SUP 15.6.4R–15.6.5R).

What happens if the firm gets it wrong?

Failure to follow the form and method requirements can make the notification invalid, leaving the underlying notification rule breached (SUP 15.7.15G). Late or absent reporting may also constitute a breach of Principle 11 and expose the firm to regulatory investigation and disciplinary action.

The consequences become more serious where information is concealed or distorted. SUP 15.6.7G records that knowingly or recklessly giving the FCA materially false or misleading information can be a criminal offence under section 398 of the Financial Services and Markets Act 2000.

The practical approach follows directly from the rules: identify the trigger, escalate it promptly, notify on the information available and update the FCA as the facts develop. Waiting for certainty can itself create the breach.