A regulatory visit is not simply a meeting. It is an examination of how your firm is governed, how risks are managed, how controls operate and whether senior management really understands the business.
Regulatory visits remain one of the most important tools available to financial supervisors. Whether conducted by the UK's Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), overseas central banks or other supervisory authorities, they provide an opportunity to look beyond policies, regulatory returns and management information to understand how a firm actually operates.
In the United States, such visits are commonly called examinations. This is a useful way to think about them: the firm is being tested.
A visit might involve a few targeted interviews, several days of intensive onsite scrutiny, or a more extensive thematic or supervisory review involving document requests, walkthroughs, transaction sampling and follow-up meetings. Increasingly, supervisory engagement can also take place remotely or through hybrid arrangements.
The potential consequences should not be underestimated.
A well-managed visit, supported by credible evidence of effective governance and controls, can strengthen supervisory confidence. It may influence the regulator's assessment of the firm and its future supervisory engagement, although there is no guarantee of a lighter supervisory programme.
A poorly managed visit, particularly one exposing substantive weaknesses, can lead to remediation requirements, more intensive supervision, additional investigations, restrictions on business activities, or enforcement action.
In the UK, serious concerns may result in a Section 166 Skilled Person review, with potentially significant financial and operational costs. Prudential weaknesses may also have capital or liquidity implications.
The objective is not to impress the regulator with a polished presentation. It is to demonstrate that the firm understands its risks, manages them effectively and is prepared to address weaknesses transparently.
Drawing on our experience of supervision, risk management and regulatory engagement, here are five principles for managing regulatory visits successfully.
1. Planning and preparation are half the battle
Benjamin Franklin's familiar observation remains relevant: “By failing to prepare, you are preparing to fail.”
Treat a regulatory visit as a significant project, with clear ownership, governance, deliverables, deadlines and quality assurance. Preparation should begin as soon as the regulator's notification or information request is received.
Start by understanding what the regulator wants to achieve.
What prompted the visit? Is it part of routine supervision, a thematic review, a follow-up to an earlier finding, or a response to an incident or emerging concern?
The visit notification may provide a formal scope, but it is worth engaging with the supervisory team to clarify its objectives, expectations and information requirements.
Establish:
- The scope, objectives and principal areas of supervisory interest.
- Which legal entities, activities, products and services are covered.
- The regulatory requirements and supervisory expectations likely to be examined.
- Who will participate from the supervisory team and their areas of expertise.
- Which staff the regulator wishes to interview.
- What documents, records and evidence are required, and when.
Understanding the experience and specialisms of the supervisory team is valuable. A team including operational resilience, cyber or financial-crime specialists may explore issues quite differently from a predominantly prudential or conduct-focused team.
This is not about treating supervisors as adversaries. It is about anticipating the depth and direction of legitimate supervisory challenge.
Conduct a realistic internal readiness review.
Before the visit, ask whether the firm's documented framework reflects what happens in practice.
Are risk assessments current? Are known control weaknesses accurately reported? Do committee minutes demonstrate genuine challenge? Have overdue remediation actions been escalated? Can the firm evidence that management information leads to decisions?
Identify material gaps early, determine what can reasonably be corrected before the visit, and prepare to explain outstanding issues and remediation plans.
Avoid last-minute cosmetic exercises that make the documentation look better without improving the underlying controls.
2. Don't ignore the logistics — or the people
A regulatory visit is both a technical examination and a significant organisational exercise.
Even a relatively short visit can involve dozens of participants, substantial document requests and multiple meetings running simultaneously.
Ensure that the right people are available and adequately prepared.
For each interview, establish who will attend, what responsibilities they hold, what evidence they should understand and how their role relates to the subject under review.
Preparation must go beyond senior management.
Historically, supervisory visits often concentrated on the most senior executives. Modern supervisory approaches also test whether accountability, understanding and effective controls extend into the organisation.
Supervisors may wish to interview business owners, operational managers, control specialists and staff responsible for executing critical processes.
This is particularly important when assessing operational resilience, third-party dependencies, financial-crime controls and technology risks.
The UK's Senior Managers and Certification Regime (SM&CR) is undergoing significant reform. The FCA and PRA introduced initial simplifications in April 2026, followed by further proposals in October 2026 to reduce administrative burdens while retaining individual accountability.
These reforms should not be interpreted as reducing the need for senior managers to understand and oversee their areas of responsibility.
Indeed, testing whether senior management's understanding is consistent with operational reality remains a powerful supervisory technique. Read our related analysis of SM&CR reform.
Brief interviewees properly — without scripting their answers.
Mock interviews can be particularly valuable, helping staff become comfortable with challenging questions and practise explaining complex arrangements clearly.
Interviewees should understand the visit's objectives, the relevant regulatory expectations, their own responsibilities and the firm's actual risk and control position.
But there is a fundamental distinction between preparing someone to answer confidently and coaching them to deliver an artificial or misleading narrative.
The best preparation helps people explain what they genuinely know, identify supporting evidence and recognise when they need to seek clarification.
For international banking groups, coordination with overseas head offices and other regulated entities is also important. Regulators increasingly exchange information, and unexplained inconsistencies between group and local accounts can undermine confidence.
Practical arrangements matter too: suitable meeting rooms, secure document-sharing arrangements, reliable technology, interview schedules and appropriate arrangements for handling sensitive information.
3. Expect the unexpected — and remain agile
One of the greatest mistakes a firm can make is assuming that the regulatory visit will follow the published agenda.
Experienced supervisors will follow the evidence.
An unexpected answer, inconsistent management information, an unusual transaction or an unexplained control weakness can open an entirely new line of enquiry.
The regulator may ask to speak to additional staff, request new documents, extend interviews or revisit subjects that appeared to have been closed.
This is not necessarily a sign that the visit is going badly. It is often simply how effective supervision works.
However, it requires the firm to respond quickly and professionally.
The most important preparation is to ensure that people understand the business, not merely their presentation slides.
Consider a supervisory review of operational resilience.
Senior management may explain that the firm has identified its important business services, mapped critical dependencies and tested severe but plausible scenarios.
A supervisor may then ask an operational manager:
What would actually happen if your most important technology provider failed tomorrow?
The answer may reveal far more about the firm's resilience than the formal presentation.
Similarly, a review of third-party risk management might move from outsourcing policies to questions about who owns a critical relationship, how performance is monitored, what happens when service levels deteriorate and whether the firm has ever exercised its contractual audit rights.
AI creates additional possibilities for supervisory challenge.
A firm may have a comprehensive AI governance policy, but supervisors could ask whether management knows which material AI applications are operating, where third-party AI is used, how model outputs are validated and what happens when an automated process fails.
These are questions about governance and control effectiveness, not simply technological sophistication.
4. Be open and transparent — and correct errors quickly
Trust is fundamental to the relationship between a regulated firm and its supervisors.
Experienced regulators are accustomed to interviewing senior executives and challenging explanations. They will often compare responses across different interviews and reconcile them against documentation, data and other supervisory information.
Inconsistencies are not automatically evidence of wrongdoing, but they may suggest that responsibilities, controls or management understanding are not as clear as the firm believes.
The worst response to a difficult question is to bluff.
If an interviewee does not know the answer, they should say so and offer to obtain the correct information.
If the firm has identified a control weakness, it should explain the issue accurately, its significance, the actions taken and what remains outstanding.
A credible explanation of an identified weakness, supported by a realistic remediation plan, is often far more persuasive than an implausible assertion that everything is under control.
Interviewees should distinguish clearly between established facts, assumptions, management judgements and actions that remain incomplete.
They should also avoid speculation, overconfidence and commitments that the firm has not authorised or cannot realistically deliver.
Correct the record promptly.
Sometimes an interviewee provides information that subsequently proves incomplete or inaccurate.
When this happens, the firm should assess the significance of the error, verify the correct position and arrange an appropriate clarification through its regulatory engagement team.
Where information is materially misleading, the firm's regulatory obligations and any applicable notification requirements must be considered without delay.
Openness does not mean speculating or volunteering inaccurate information. It means being candid, precise, cooperative and appropriately responsive.
5. Learn lessons — and turn supervisory feedback into improvement
The end of the onsite visit should not be the end of the project.
Regulatory visits can generate valuable insights into governance, accountability, risk management and control effectiveness.
Some of these insights arise from formal supervisory findings. Others emerge during preparation, interviews or internal debriefs.
Firms should capture both.
Conduct a structured post-visit review that considers:
- What worked well in preparation and coordination?
- Where were interviewees unable to explain processes or provide supporting evidence?
- Which questions exposed weaknesses in governance, ownership or controls?
- Were material issues already known to management, and if so, why had they not been resolved?
- What improvements are needed before the next supervisory engagement?
The most important distinction is between improving the management of regulatory visits and improving the underlying business.
Better interview preparation may be useful, but it will not resolve ineffective risk management, poor governance or inadequate operational controls.
Regulatory findings must translate into accountable action.
Where the regulator identifies weaknesses, remediation should have clear owners, milestones, appropriate senior management oversight and evidence of completion and effectiveness.
Independent validation may be necessary for significant findings.
Avoid treating closure of an action in a tracking system as proof that the underlying risk has been addressed.
What will supervisors be examining in 2027 and beyond?
Although supervisory priorities vary by regulator, sector and individual firm, several areas are particularly relevant to forthcoming supervisory engagement.
Operational resilience: Can the firm demonstrate that important business services can remain within impact tolerances under severe but plausible disruption? Are vulnerabilities understood, tested and remediated?
Third-party risk management: Does the firm understand its critical external and intra-group dependencies? Can it demonstrate proportionate due diligence, effective ongoing oversight, resilience assurance and credible exit arrangements?
AI governance and risk: Does management understand where AI is deployed, including by third parties? Are accountability, data governance, model risks, human oversight and operational dependencies appropriately controlled?
Governance and individual accountability: Can senior managers demonstrate effective oversight and challenge? Do responsibilities operate effectively below senior management level, notwithstanding ongoing SM&CR reform?
Incident management and regulatory reporting: Are incidents identified, escalated and assessed promptly? Are firms prepared for the new UK operational incident reporting requirements taking effect on 18 March 2027, where applicable?
Consumer outcomes and conduct: Can the firm demonstrate that its systems, processes and controls support appropriate customer outcomes, including the identification and prevention of foreseeable harm?
These subjects are interconnected. A technology failure may expose weaknesses in third-party oversight, incident management, customer protection and senior management accountability simultaneously.
That is why supervisory preparation must be integrated rather than conducted in isolated compliance workstreams.
A final thought: the best preparation starts long before the visit
There is an old saying that practice makes perfect.
Practice certainly helps. But a regulatory visit should not become an exercise in rehearsing the right answers.
The strongest firms are those where senior management understands the risks, control owners can explain how their processes operate, and the evidence supports what people say.
The ultimate objective is not to pass the regulatory examination. It is to run a business that can withstand one.
Put the principles into practice — Regulatory Visits Training
Preparing for Successful Regulatory Visits — Building Societies Association (BSA)
Following our January 2026 programme, JADEtc Academy will once again deliver this specialist training in partnership with the Building Societies Association in Q1 2027.
Led by Dr Jimi Hinchliffe and Andrew Sheen, the course draws on extensive regulatory and industry experience to help participants understand what supervisors expect, prepare effectively for visits, handle challenging regulatory interviews and respond confidently to supervisory scrutiny.
The programme combines practical guidance with realistic case-study exercises and covers current supervisory priorities, including operational resilience, third-party risk management and governance.
2027 course dates and booking link coming soon.
View the January 2026 BSA course programme
How JADEtc Academy can help
JADEtc Academy brings together experienced former regulators and senior risk management practitioners to help firms prepare for supervisory engagement.
Our support includes regulatory visit readiness reviews, practical workshops, mock supervisory interviews, senior manager coaching and advice on operational risk, operational resilience, third-party risk management and governance.
We can simulate challenging supervisory interviews, identify potential weaknesses in the firm's explanations and supporting evidence, and provide practical feedback to help improve readiness.
We also offer dedicated training on Managing a Regulatory Inspection, including preparation, interview techniques, supervisory expectations and post-visit remediation.
Contact JADEtc Academy at GetInfo@JADETCACADEMY.com.
JADEtc Academy — Helping firms implement robust and effective frameworks for Operational Risk, Operational Resilience, Risk Governance and Third-Party Risk Management.