The Envelope Is Not the Emergency: A Measured Response to Regulator Contact

Regulatory correspondence has a particular quality. It arrives in an ordinary envelope, often on an ordinary morning, and asks for information that suddenly feels far from ordinary. The instinct is to reply quickly, to reassure everyone and to close the matter before it grows. That instinct is understandable. It is also, in the first forty-eight hours, usually the wrong one.

An enquiry from the Solicitors Regulation Authority, the Information Commissioner's Office or HM Revenue & Customs is not a crisis in itself. It is a request for information, or an invitation to explain. What turns a manageable enquiry into a difficult matter is rarely the original letter. It is the deleted email, the informal corridor call, the speculative draft, the client who learns of the regulator's interest from someone else. The first two days are therefore best treated as a period of order, not urgency.

Hour One: Receive, Record, Restrict

The letter should be logged before it is discussed. Record the date and time of receipt, the regulator, the addressee, the subject matter and any deadline. Preserve the envelope and any covering material. Scan the correspondence into a controlled location and restrict access to a small group. In a practice with Leeds and London offices, that means confirming early which office holds the relevant files and who has authority to speak for the firm.

One person should own the matter internally. That may be the relationship partner, the compliance officer for legal practice, the data protection officer or general counsel. The important point is that there is a named individual, a named deputy and a single route for correspondence. Regulators notice inconsistency. So do clients.

Hour Two to Six: Convene a Small Response Group

A response group should be small enough to make decisions and broad enough to see the risk. Typically it includes the responsible partner, the compliance lead, in-house or external counsel, and a note-taker. Communications and professional indemnity insurers should be considered early, not after the first draft has been circulated. If the enquiry touches a client matter, the client relationship partner must be involved, but the group should resist the temptation to become a committee.

The first meeting need not answer the regulator. It should establish what has been asked, what is known, what is not known and what must be preserved. It should also decide who will speak to the client and who will speak to the regulator. Those roles should not be left to chance.

Preservation Before Explanation

Before anyone explains anything, the firm should preserve what it has. Routine deletion should be suspended for relevant custodians and date ranges. Emails, messages, matter files, attendance notes, call recordings, access logs and financial records may all matter. For an SRA enquiry, client ledgers and matter files are likely to be central. For the ICO, data protection records, retention schedules and breach logs may be relevant. For HMRC, financial records and correspondence may need particular care.

Preservation should be proportionate. It is not necessary to image every device in the firm. It is necessary to identify the people, dates and subjects likely to be relevant, issue a written legal hold notice and confirm that recipients understand it. Metadata should not be altered. Documents should not be recreated from memory. A chronology can be prepared, but it should be clearly labelled as a working document and kept separate from the original record.

The Client Conversation

If the enquiry concerns a client matter, the client should ordinarily be told promptly, unless the regulator has prohibited notification or legal advice suggests otherwise. The conversation should be calm and factual. The regulator has asked for information. The firm is coordinating a response. No conclusion has been reached. The client should be told what they need to do, what they should not do and when they will hear more.

The firm should also consider whether a conflict has arisen. A client facing their own regulatory interest may need separate advice. A client who is asked to preserve documents should be asked clearly and in writing, not advised to delete anything. Any call should be documented. The client is not an inconvenience in the process; they are the reason the process deserves care.

What Not to Say

The first forty-eight hours are as much about restraint as action. Do not make admissions, even informal ones. Do not guess at facts. Do not offer assurances that nothing will come of it. Do not contact the regulator by telephone unless invited. Do not volunteer information beyond the request. Do not create speculative notes or draft explanations before the facts are checked. Do not discuss the matter in wider circulation than necessary. Do not allow the enquiry to become a topic of casual conversation in either office.

Above all, do not allow enthusiasm for a quick reply to outrun legal advice. A prompt acknowledgement is often sensible. A substantive response is different. It should be drafted after the facts have been gathered, the documents preserved and the legal position considered. If the deadline is unrealistic, ask for an extension in writing and explain why. Regulators generally prefer a considered response to a hurried one.

The First Draft Is Not the Response

The response should answer the questions asked. It need not answer every question the firm can imagine. Ambiguity in the request should be clarified in writing. Privilege should be considered carefully and not overclaimed. The draft should be reviewed by someone who has not written it. The client should see any part that concerns their matter. The insurer and, where appropriate, the board should be updated. A chronology of events and correspondence should be maintained from the first day.

Testing the Protocol Before It Is Needed

A protocol that has never been tested is only a hope. Firms should run a short tabletop exercise at least annually. Who would open the letter? Who would call the client? Who would instruct IT to preserve records? Who would notify the insurer? What would happen if the named person were on leave or in the other office? The answers should be written down, with deputies and contact details.

A simple checklist helps: a controlled matter file; a named owner and deputy; a legal hold notice; a client communication note; an insurer notification decision; a chronology; a response timetable; and a review after the matter closes. None of this is dramatic. That is the point.

Regulatory correspondence tests a practice's habits more than its rhetoric. The firm that receives the envelope calmly, preserves what matters, speaks to the client clearly and resists the urge to explain too soon is already giving the regulator a coherent account of how it works. Preparation is not a departure from client care. In this context, it is one of its clearest forms.