Supervision is not one thing. At the light end it is a thematic questionnaire sent to a population of firms. In the middle it is a desk based review where the regulator requests documents and asks follow up questions in writing. At the heavy end it is an on site visit, with a team, a scope letter, interviews with named individuals and access to systems. Some visits are routine and cycle based. Some are triggered by a complaint, a data return that looked wrong, a whistleblower, or an event in the market that made the supervisor look at everyone doing a particular thing.
Knowing which kind you have received changes the response. A thematic review of, say, client categorisation across thirty firms is not an investigation into your firm. A visit that follows a specific complaint about withdrawals is narrower and sharper. The scope letter usually says, and reading it precisely is the first task.
The advance request list, and what it is really testing
Most visits begin with an information request: organisation chart, responsibilities map, compliance manual, current policies with version history, board and committee minutes for a period, risk register, complaints log, financial returns, client money reconciliations, marketing approvals, training records, and a client or transaction file sample.
The list looks administrative. It is diagnostic. A supervisor reading it learns three things before anyone arrives. Whether the documents exist. Whether they are current, and a policy last reviewed four years ago says something about the governance around it. And whether they are consistent with each other, because a responsibilities map that names a person who left, a manual describing a process the firm no longer follows, or minutes that never discuss the top risk on the risk register are all visible from a desk. The contents that reviewers expect are set out in what a compliance manual contains, and the gap firms most often show is between the manual and the actual workflow.
Deadlines matter more than people expect. A late or partial response is itself a data point about the firm's control of its own information. If a request cannot be met in time, saying so early with a proposed date is normal and is received far better than silence followed by an incomplete pack.
Interviews test whether people know their own controls
On site, supervisors talk to named individuals: senior managers, the compliance officer, the money laundering reporting officer, often a dealer or a support agent. The purpose is not to trap anyone. It is to test whether the control described in the document is the control operating in the building. A supervisor who reads a policy saying every marketing piece is approved before publication will ask a marketing employee how they get something approved, and the answer either matches or it does not.
Three habits make interviews go badly. Guessing rather than saying you will confirm and come back. Answering for a function that is not yours. And describing the intended process rather than the real one, which fails immediately when a sample is pulled. The strongest answer a manager can give is a specific one about their own area, with the caveat where the caveat is genuine. Firms that have run a mock interview beforehand, using the actual scope, are noticeably calmer, and this is the same preparation described in the first year audit.
General information only. Supervisory processes, notice periods, powers and appeal rights differ by regulator. Firms facing an inspection or enforcement contact should take advice from local counsel experienced with that regulator.
File testing is where firms actually lose points
Samples are pulled and traced end to end. A client file is checked for identity evidence, source of funds where required, appropriateness or suitability assessment where the regime requires one, risk rating, and ongoing monitoring. A trade sample is checked against best execution obligations and the firm's own published policy. A complaints sample is checked for acknowledgement timing, outcome and root cause. A withdrawal sample is checked against the firm's stated timescales and any holds applied.
Two failures recur. The first is a documented decision with no documented reason: an account approved despite a high risk score, a hold released, an exception granted, with no note saying who decided and why. The second is timing that cannot be evidenced, because the system stores current state and not history. If the file shows a risk rating of medium today, and no record of what it was at onboarding or when it changed, the firm cannot demonstrate the monitoring it says it performs. That is a systems question rather than a policy question, and the reason immutable audit trails are worth more during a visit than any binder.
Findings, and the part after the visit
Visits usually end with feedback, then a written report classifying findings by seriousness. Most outcomes are not enforcement. They are required actions with deadlines, sometimes an independent review commissioned at the firm's expense, occasionally a restriction on business while something is fixed. The response the firm sends back matters. A remediation plan with owners, dates and a way to evidence completion is treated as a functioning firm managing an issue. A response that disputes the finding without evidence, or accepts everything and then delivers nothing, moves the relationship in the wrong direction, and unresolved findings are the usual first step toward the process described in how enforcement action unfolds.
The best preparation is not a two week sprint. It is running the firm so that a request for any six month old client file, with its decisions and their reasons attached, can be answered in an afternoon. Firms whose client records, approvals and history sit in one system rather than across a CRM, a spreadsheet and a chat thread find that this is mostly an exercise in exporting what they already have.
"A supervisor is not trying to catch you out. They are testing whether the firm you described in your application is the firm that exists, and that is a very easy test to fail by accident."
— Alex Onta, Executive Director, SINGUARD
Key Takeaways
- Read the scope letter precisely, a thematic review and a complaint driven visit call for different responses.
- The advance document request tests existence, currency and internal consistency before anyone arrives on site.
- Interviews check whether the control in the document is the control in the building, so answer for your own area and confirm rather than guess.
- Most findings come from decisions recorded without reasons and from systems that store current state instead of history.
Frequently Asked Questions
How much notice does a firm get before a supervisory visit?
It depends on the regulator and the type of visit. Routine and thematic work is normally announced in advance with an information request and a scope letter, while some regimes allow unannounced visits, particularly where there are concerns about records being altered. The notice period and the powers involved are set by each regulator's own rules.
Should a firm have lawyers present during interviews?
Many firms take advice before and during a visit, and whether counsel attends interviews is a judgement call that depends on the regulator, the type of visit and the seriousness of the issue. What matters more in routine supervision is that the people interviewed genuinely know their own controls.
What happens if the firm cannot produce a requested document?
Say so promptly and explain the position rather than sending a partial pack late. Missing records are a finding, but attempting to construct something after the fact is a much more serious matter and is usually obvious from metadata and inconsistencies.
About the Author
Alex Onta is an Executive Director at SINGUARD. He built eTrader, the terminal, the mobile apps, eTrader Broker, Copytrading, Business and Community, along with the worldwide clustered-server infrastructure it all runs on, with his brother Roman Onta helping on the design, and he leads that division today. Together with Roman he builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals, and the two of them carry worldwide compliance, payment processing and international business structuring side by side. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.