Notifying the FCA: Principle 11 and Breach Reporting Explained

What Principle 11 actually requires

Principle 11, headed Relations with regulators, is stated in PRIN 2.1.1R as follows: a firm must deal with its regulators in an open and cooperative way, and must disclose to the appropriate regulator appropriately anything relating to the firm of which that regulator would reasonably expect notice. It is one of eleven high-level Principles that the FCA describes as a general statement of the fundamental obligations of firms under the regulatory system.

Two features make Principle 11 unusually broad. First, it applies to world-wide activities. PRIN 1.1.6G confirms that Principle 11 applies to activities carried on outside the United Kingdom, and that where cooperation with an overseas regulator is in question the FCA will have regard to the duties the firm owes to that regulator. Second, it is not exhausted by the specific rules elsewhere in the Handbook. PRIN 1.1.9G makes clear that the FCA's other rules and guidance should not be viewed as exhausting the implications of the Principles themselves.

That is why a firm can comply with every line of SUP 15 and still breach Principle 11. If a significant development falls outside the listed categories but is something the FCA would reasonably expect to hear about, the duty to disclose still bites. Principle 11 also applies to both the FCA and the PRA for dual-regulated firms: the PRIN 2.1.1R note records that the PRA applies Principles 1 to 4, 8 and 11 only, so the open-and-cooperative duty is one of the few Principles the PRA enforces directly.

How SUP 15 turns the Principle into rules

SUP 15 is the chapter titled Notifications to the FCA. Its purpose section explains the link to the high-level duty: Principle 11 requires a firm to disclose to the FCA appropriately anything relating to the firm of which the FCA would reasonably expect notice, and SUP 15 sets out guidance on the type of event a firm should consider notifying in accordance with that Principle. In other words, SUP 15 is a worked set of examples layered on top of Principle 11, not a substitute for it.

The core of the chapter is SUP 15.3, the general notification requirements. It groups reportable events into recognisable buckets: matters having a serious regulatory impact, breaches of rules and other requirements, civil, criminal or disciplinary proceedings against the firm, fraud, errors and other irregularities, and insolvency, bankruptcy and winding up. Each bucket has its own rule reference, and each is triggered on broadly the same basis, which is that the firm becomes aware of, or has information reasonably suggesting, the relevant event.

Because the Principle sits above the rules, the sensible test in a grey area is not only whether a SUP 15.3 category is engaged, but whether the FCA would reasonably expect to be told. If the answer to the second question is yes, notify, even where no specific category is a clean fit.

The events that require a notification

The clearest starting point is SUP 15.3.1R, which deals with matters having a serious regulatory impact. It requires a firm to notify the FCA immediately it becomes aware, or has information which reasonably suggests, that any of four things has occurred, may have occurred or may occur in the foreseeable future: the firm failing to satisfy one or more of the threshold conditions; any matter which could have a significant adverse impact on the firm's reputation; any matter which could affect the firm's ability to continue to provide adequate services to its customers and which could result in serious detriment to a customer of the firm; or any matter which could result in serious financial consequences to the UK financial system or to other firms.

Alongside that sit the more specific categories. SUP 15.3.11R requires notification of a significant breach of a rule, which includes a Principle, a Statement of Principle or a COCON rule, as well as significant breaches of other requirements imposed under the relevant legislation. SUP 15.3.15R covers civil, criminal or disciplinary proceedings against the firm. SUP 15.3.17R covers fraud, errors and other irregularities, including where a person may have committed a fraud against the firm or its customers and where there are material irregularities in the firm's accounting records. SUP 15.3.21R covers insolvency, bankruptcy and winding up.

Separately, changes in senior personnel and in control are notified through their own routes. Changes affecting individuals holding senior management functions, and changes in a firm's controllers, are dealt with under the dedicated regimes in the Handbook rather than as free-standing SUP 15.3 items, but the underlying open-and-cooperative expectation of Principle 11 still frames them. The table below summarises the main SUP 15.3 triggers and the timing that applies.

Timing: what immediately means in practice

The recurring word across SUP 15.3 is immediately. Both SUP 15.3.1R and SUP 15.3.11R require a firm to notify the FCA immediately it becomes aware, or has information which reasonably suggests, that a relevant event has occurred, may have occurred or may occur in the foreseeable future. The trigger is knowledge or reasonable suspicion, not certainty, and it reaches forward to matters that may occur, so a firm cannot wait until an issue has crystallised before picking up the phone or filing a form.

That forward-looking test is important for breach reporting. If an investigation is still under way, the firm does not get to sit on the matter until the facts are settled. Where information reasonably suggests a significant breach may have occurred, the clock has started. The FCA guidance on notifications reinforces that it expects to be told about matters with a serious regulatory impact and about anything relating to the firm of which it would reasonably expect notice, and it expects firms to raise relevant matters at an early stage.

For genuinely developing situations the practical answer is to make an initial notification promptly and then keep the regulator updated as facts emerge, rather than delaying the first contact. A prompt but incomplete first notification, followed by updates, is consistent with the open and cooperative standard; a delayed but polished one is not.

How to make a Principle 11 or SUP 15 notification

Form and method are governed by SUP 15.7. Under SUP 15.7.1R, a notification required from a firm under any notification rule must be given in writing and in English, and it must give the firm's Firm Reference Number, unless the relevant rule states otherwise or the notification is provided solely in compliance with Principle 11. Written notifications must be delivered to the FCA by one of the methods set out in the chapter, which include online submission.

In practice, FCA-only firms submit most notifications through Connect, the FCA's online system, using the relevant notification form. The FCA's own guidance on notifying the FCA or PRA points firms to Connect for the firm notification form and explains that dual-regulated firms should also engage their PRA supervisory contact where the matter concerns both regulators. Choosing the right channel matters: an email to a supervisor may be appropriate for an urgent, developing issue, but it does not replace the formal written notification where the rules require one.

The steps below set out a workmanlike sequence for getting a notification right, from identifying the trigger through to keeping a record. The order matters less than the discipline: confirm the trigger, decide the channel, notify promptly, and document what you told the FCA and when.

The consequences of failing to notify

Breaching a Principle makes a firm liable to disciplinary sanctions. PRIN 1.1.7G states plainly that breaching a Principle makes a firm liable to disciplinary sanctions, and that in deciding whether a Principle has been breached the FCA looks to the standard of conduct required by the Principle in question. For Principle 11 the standard is openness and cooperation, so a failure to disclose something the FCA would reasonably expect notice of, or a decision to delay, can itself be a breach even where the underlying issue is minor.

This is what makes Principle 11 distinctive in enforcement terms. A firm that keeps a problem to itself often faces criticism not only for the original failing but for the non-disclosure, and the second charge can be the more serious of the two. Because Principle 11 also reaches matters outside the specific SUP 15 categories, tidy compliance with the letter of SUP 15 is no defence if a material development was withheld.

The safer posture is a low threshold for notification and a bias towards early, candid engagement. Where there is genuine doubt about whether a matter is reportable, the open-and-cooperative standard points towards telling the regulator and letting it decide, rather than making a unilateral judgment that it did not need to know. A robust breach-reporting process, with clear ownership and a fast escalation path, is the practical expression of Principle 11.

Conclusion

Principle 11 and SUP 15 are best understood as a single obligation seen from two angles. The Principle sets the standard, which is to deal with the regulator openly and to disclose anything it would reasonably expect notice of. SUP 15 gives that standard a concrete shape through the general notification requirements in SUP 15.3, covering serious regulatory impact, significant breaches, proceedings, fraud and insolvency, and through the form and method rules in SUP 15.7. The timing test is immediate, triggered by awareness or reasonable suspicion, and reaching forward to matters that may yet occur.

For compliance teams the message is straightforward. Build a breach-reporting process that identifies triggers quickly, escalates to a named owner, notifies promptly through the right channel, and keeps a clean record. Treat Principle 11 as the backstop that catches anything the specific rules miss, and resolve genuine doubt in favour of disclosure. Firms that need to embed this discipline into a documented control framework can explore how Nasara Connect supports regulatory control and monitoring, or book a demonstration to see it applied to notification workflows.

Frequently asked questions