The Signal in the Letter: A Four-Tier Triage Model for Regulator Correspondence

Regulators rarely move from silence to formal enforcement without warning. The warning is often a routine letter: a request for information, a clarification of a return, a thematic review questionnaire, a reminder about a deadline or a request to explain a customer outcome. Individually, such correspondence can look administrative. Collectively, it can show where supervisory attention is moving.

The problem is organisational rather than analytical. Routine correspondence is often handled below board level, in a shared inbox or by a single specialist. It is answered, filed and forgotten. The board sees the enforcement notice, the skilled person review or the final report, but not the pattern of questions that preceded it. By then, the opportunity to correct a control, adjust a process or prepare a credible response has narrowed.

Why routine correspondence is a leading indicator

A regulator's information request is a signal of interest. A repeated request on the same theme is a signal of concern. A clarification that follows an earlier answer may indicate that the first response was incomplete or that the regulator is testing the consistency of the firm's position. None of these events is necessarily an enforcement action, but each is useful management information.

UK regulators use a range of supervisory tools before formal action. The FCA and PRA use supervisory letters, information requirements and skilled person reviews. The ICO may make enquiries about data protection practices. HMRC and Companies House may raise questions about filings, AML supervision or registered particulars. Other regulators follow similar patterns in their sectors. The common feature is that the first contact is often handled as a transaction rather than as intelligence.

A four-tier triage model

The purpose of triage is to separate administrative noise from supervisory signal without over-escalating every letter. A four-tier model gives handlers a consistent way to categorise correspondence, assign an owner and decide who needs to see it.

Tier 1: routine administrative contact

This covers acknowledgements, portal confirmations, standard reminders and requests that have no substantive supervisory content. The item should still be logged, with a reference, date, regulator and subject. It does not need board attention unless it forms part of a repeated pattern. The handler should close it within the agreed service level and record the response.

Tier 2: supervisory information request or thematic query

This includes requests for data, explanations of a return, thematic review questionnaires and clarifications about a process or customer outcome. The item should be assigned to a named owner in the relevant business or control function, reviewed by compliance and, where appropriate, legal. It should be reported in the monthly compliance pack and aggregated by theme. The board does not need to see every item, but it should see the trend.

Tier 3: escalated concern, repeated theme or possible breach

This tier applies where the regulator repeats a question, challenges an earlier response, refers to a possible breach, raises customer harm or asks for a remediation plan. The head of compliance should be notified promptly. The item should go to the risk committee or a delegated sub-committee, with a root-cause analysis, a remediation owner and a timetable. Legal advice should be considered, and the response should be consistent with any related incident or complaint data.

Tier 4: formal statutory or enforcement-adjacent contact

This covers formal information requirements, warning letters, restrictions, skilled person reviews, enforcement interviews and any contact that may lead to a statutory notice or public action. The general counsel, chief executive and board should be informed immediately under the firm's regulatory liaison protocol. External counsel should be engaged where necessary, and a single senior owner should coordinate all responses. The board should minute its decisions and the rationale for the response strategy.

Logging and categorising without creating a bureaucracy

A central register is the minimum. It should capture the date received, regulator, channel, reference, subject, business area, control or risk theme, tier, owner, deadline, response, commitments and closure date. The taxonomy should align with the firm's risk framework and, where relevant, with SM&CR responsibilities. Free-text descriptions are useful for context but poor for trend analysis, so a controlled list of themes is essential.

The register should link to incidents, complaints, breach logs and audit findings. A letter about payment delays may be related to an operational incident. A question about customer due diligence may connect to a quality assurance sample. Linking these sources turns a correspondence log into a wider supervisory intelligence picture.

Turning themes into board intelligence

A quarterly report should be short enough for the board to read and specific enough to support challenge. It should show volume by regulator, theme and tier; repeated contacts; response timeliness; open commitments; overdue actions; and any movement in the severity of questions. A heat map can help, but the narrative matters more. The board needs to know which themes are rising, which controls are under scrutiny and what management has done about it.

Board minutes should record the discussion, not just the receipt of the report. Where a theme is escalating, the board should ask whether the firm's risk appetite, control design or customer outcomes are consistent with the regulator's expectations. That is the difference between a correspondence log and an early-warning system.

Operating the model in practice

A single front door for regulator contact reduces the risk of letters sitting in personal inboxes. Inbox handlers need training to recognise supervisory content and to escalate rather than answer outside their competence. Quality assurance should sample tier 1 and tier 2 items to confirm that categorisation is consistent. The model should be reviewed after any enforcement action, skilled person review or significant change in regulatory focus.

Over-escalation is a real risk. If every reminder reaches the board, the system loses credibility. Under-escalation is worse. The tier definitions should be documented, applied consistently and tested. The aim is not to predict enforcement with certainty. It is to ensure that the organisation notices when the regulator's questions start to repeat, sharpen or move closer to the controls that matter. That is the quiet escalation that boards should see before it becomes a formal one.