SUP 15: What Firms Must Notify the FCA and When

SUP 15 is the FCA’s notification framework — the chapter of the Supervision Manual that sets out what regulated firms must tell the FCA, on what basis and by when. Getting SUP 15 notifications right is a core compliance obligation. Getting them wrong — or failing to make them at all — is among the most consistent sources of regulatory difficulty that the FCA identifies in its supervisory work.

The SUP sourcebook is the FCA’s supervisory framework — the rules and guidance governing how regulated firms interact with the FCA on an ongoing basis. SUP 15 deals specifically with notifications: the events, changes and circumstances that firms must report to the FCA as they occur. Understanding SUP 15 fully is an essential compliance competency for any SMF16 (compliance oversight function) holder, but it is also relevant to every senior manager who has accountability for areas of the firm’s activities that generate notification obligations.

The Structure of SUP 15

SUP 15 is organised into sections covering: general notification obligations; notifications required in specific circumstances; material changes that must be notified; and the procedures for making notifications. The general notification obligation in SUP 15.3 sits alongside and reinforces the Principle 11 disclosure obligation: firms must notify the FCA promptly if they become aware of anything that could materially affect the FCA’s view of the firm’s fitness and propriety, or that could have a significant adverse impact on the firm’s customers or the financial system. This general obligation is supplemented by the specific notification requirements in SUP 15.4, 15.5 and 15.8, which identify particular events that require notification regardless of whether they also trigger the general standard.

Category One: Significant Events

SUP 15.3.1R requires firms to notify the FCA immediately if they become aware of a series of specific categories of event. These are the most serious notification obligations — events so significant that the FCA needs to know about them without delay, without waiting for regular reporting cycles.

Insolvency proceedings. If any corporate entity within the firm’s group enters administration, receivership, liquidation or any equivalent insolvency proceeding in any jurisdiction, the firm must notify immediately. The FCA needs this information because insolvency events in connected entities can affect the regulated firm’s financial position, its ability to meet its regulatory capital requirements, and its operational continuity. Early notification allows the FCA to assess the impact and, where necessary, to exercise its supervisory powers before harm reaches customers.

Regulatory action by other authorities. Where a firm or a connected entity is subject to significant regulatory action by an overseas regulator — including a formal investigation, a suspension, a fine or a restriction — notification to the FCA is required. The FCA’s interest is in whether the overseas action is indicative of conduct or governance issues that are also present in the UK-regulated entity, and whether the action affects the firm’s fitness and propriety. Firms that receive overseas regulatory correspondence should assess its notification implications immediately rather than treating it as a purely local matter.

Material litigation. Civil proceedings or arbitration that could have a material impact on the firm — either financially or in terms of its ability to carry on regulated activities — must be notified. The financial materiality threshold is relative to the firm’s size and regulatory capital: a claim that would represent a significant proportion of the firm’s capital resources triggers the notification requirement even if it is small in absolute terms. Firms that receive letters before action or claim forms should therefore consider their SUP 15.3.1R implications as part of their initial response process.

Loss of key personnel. Where the loss of a key individual could affect the firm’s ability to carry on its regulated activities or its compliance with threshold conditions, notification is required. The most obvious category is the unexpected loss of an SMF holder, particularly where the firm has no immediate replacement — the FCA must be informed so that it can assess whether the firm continues to meet its governance and management requirements. But the obligation can also extend to non-SMF personnel whose loss creates a material operational or compliance risk.

Category Two: Material Changes

SUP 15.3.8G and the associated rules require firms to notify the FCA of significant changes to their business, activities or circumstances that are not covered by the specific SUP 15.3.1R obligations but that the FCA would reasonably want to know about.

Changes to business activities. Material changes to the nature, scope or scale of the firm’s regulated activities must be notified. This overlaps with the Variation of Permission obligation for changes that take the firm outside its current permission, but it is broader: changes that remain within the current permission but that significantly alter the risk profile of the firm’s activities may still require notification even if no formal VoP application is needed. A firm that significantly expands its consumer credit lending by moving into a higher-risk product segment, or that shifts its investment management focus to a materially riskier asset class, should consider its SUP 15 notification obligations even if the existing permission technically covers the new activities.

Changes to ownership or control. Changes in the ownership or control of the firm — including the acquisition of a qualifying holding, a change in the identity of the firm’s controller, or a change in group structure that affects the firm — trigger specific notification requirements under SUP 11. SUP 15 reinforces these obligations by requiring notification where any change in the firm’s circumstances is such that the FCA would reasonably expect notice. Firms planning mergers, acquisitions, management buyouts or significant investor changes should map their notification obligations across both SUP 11 and SUP 15 as part of the transaction planning process.

Financial position deterioration. Where the firm’s financial position deteriorates materially — including where it falls below or is at risk of falling below its regulatory capital requirements — prompt notification is required. The FCA does not want to discover a firm’s financial difficulties through the firm’s prudential reporting alone: where the firm’s management becomes aware of a material emerging financial problem, the notification obligation crystallises at that point, not when the problem has progressed to the point of formal threshold breach. Firms should build explicit financial monitoring triggers into their capital adequacy governance — alerting the compliance function and the SMF holder when capital levels reach defined early-warning levels — so that the SUP 15 obligation is recognised and discharged in good time.

Significant systems or operational failures. Major operational incidents — IT outages, data breaches, third-party failures — that have caused or could cause material harm to customers or operational disruption to the firm’s regulated activities must be notified. The FCA’s operational resilience framework, introduced in 2021, requires firms to identify their important business services and to set impact tolerances for their maximum acceptable downtime. Where an incident breaches or threatens to breach an impact tolerance, this is a clear indicator that a SUP 15 notification is required. Firms that have implemented the operational resilience framework should build their SUP 15 notification assessment into their incident response process rather than treating it as a separate consideration.

Category Three: SMF-Specific Notifications

SUP 15 contains specific notification requirements related to Senior Manager Functions. These include: notification where an SMF holder ceases to perform their function; notification of any matter that may affect the fitness and propriety of an approved person; and notification of the appointment of a new individual to perform a required SMF function where that individual has not yet been approved by the FCA.

The cessation notification is one of the most time-sensitive in the SMF context. Where an SMF holder leaves their role unexpectedly — whether through resignation, illness, dismissal or any other reason — the firm must notify the FCA promptly. If the function is a required function (one that the firm must have a holder for under the applicable rules), the firm must also have arrangements in place for how the function will be covered in the interim. The FCA’s expectations around interim coverage are set out in the SMCR rules, but the SUP 15 notification obligation runs from the moment the SMF holder ceases — which may be before any interim arrangement has been confirmed.

The fitness and propriety notification is broader and more judgmental. Where the firm becomes aware of any matter that may affect an approved person’s fitness and propriety — including a criminal caution or conviction, an adverse finding in civil proceedings, a disciplinary matter, a significant financial difficulty, or a concern raised by another regulator — it must assess whether the matter is significant enough to require notification. The test is again what the FCA would reasonably expect to be told: a minor historical matter with no current relevance may not require notification; a serious recent matter with direct bearing on the individual’s conduct in their SMF role almost certainly does.

Timing: When Must Notifications Be Made?

SUP 15 specifies different timing requirements for different categories of notification. The general principle is that notifications should be made as soon as practicable after the relevant event or awareness arises. For the most serious events — imminent insolvency, significant operational failures causing material customer harm — “as soon as practicable” means within hours, not days. For other notifications, the standard is typically one business day to ten business days depending on the specific obligation.

The compliance function must therefore have clear internal processes for identifying when a SUP 15 notification obligation has crystallised and for ensuring the notification is made within the applicable time limit. This means the compliance function needs access to information about events that trigger notification obligations across the firm’s business — which requires the compliance function to be embedded in the firm’s operational and incident management processes rather than receiving information through downstream reporting channels. A compliance function that learns about a major IT outage from a press enquiry rather than from the operations team has a process failure that will likely result in a late notification to the FCA.

How to Make Notifications: The Connect System

Most SUP 15 notifications are made through the FCA’s Connect system. Firms should designate one or more named users with Connect access who are responsible for making notifications. The notification form should include: a clear description of the event or change being notified; the date on which the event occurred or the firm became aware of it; an assessment of the significance and impact of the event; and the steps the firm has taken or is taking in response. The FCA does not require a perfectly formatted notification at the initial stage of an urgent event — a brief but accurate notification promptly made is preferable to a comprehensive account provided too late.

For certain specific notifications — changes to control, passporting applications, appointed representative notifications — SUP requires the use of specific forms rather than general Connect notifications. The compliance function should maintain a current register of the specific forms applicable to each notification category, and should test its Connect access and notification processes periodically rather than discovering connectivity or access issues at the point when an urgent notification needs to be made.

Consequences of Failure to Notify

The FCA consistently identifies failures to notify on time — or at all — as one of the most frequently encountered compliance deficiencies in its supervisory work. The consequences range from formal regulatory censure and financial penalties, through increased supervisory intensity, to use of the notification failure as evidence of broader governance and compliance culture failures that justify a more comprehensive regulatory response.

Late notification is often more seriously received by the FCA than the underlying event itself. A firm that experiences a significant operational failure, manages it competently and notifies the FCA promptly is in a very different regulatory position from one that experiences the same failure and notifies three months later after the FCA has already become aware of the incident through other channels. The FCA has stated publicly that it places particular weight on timeliness and transparency in its supervisory relationships, and notification failures are treated as evidence of a deficit in both.

Building an Effective SUP 15 Notification Framework

Effective SUP 15 compliance requires a notification framework that is embedded in the firm’s operational processes rather than administered as a standalone compliance function responsibility. The framework should include: a notification trigger register identifying the events and circumstances that generate SUP 15 obligations and the applicable timing requirement for each; clear ownership for the notification assessment, typically at SMF16 level with escalation to the CEO for significant events; designated Connect access for one or more compliance team members; an internal escalation process that ensures relevant developments are flagged to the compliance function promptly; and a notification log documenting all notifications made, the basis for each, and the timeline from event to notification.

The notification trigger register should be reviewed at least annually against any changes to SUP 15 and against the firm’s own business development — new activities, new products or new risk exposures may create notification obligations that did not previously apply. The register should also be reviewed following each notification to assess whether the event could have been identified and escalated faster, and whether the internal processes supported the timely discharge of the obligation.

Key References

• FCA Handbook SUP 15 — Notifications to the FCA
• FCA Connect — Notification portal
• FCA PRIN 2.1 — Principle 11