What to do if…
you are contacted by a regulator about your work and you are not sure what to say
Short answer
Pause and don’t answer substantive questions yet. Verify the contact, move everything to writing, and get advice (your employer’s compliance/legal team and/or your union or a solicitor) before you speak.
Do not do these things
- Don’t “just explain it quickly” on the phone to make it go away.
- Don’t guess, speculate, or fill silences with extra detail.
- Don’t click links, open attachments, or use call-back numbers from an unexpected message until you’ve verified them independently.
- Don’t delete, edit, backdate, or “tidy up” records (including messages) after you realise regulators are involved.
- Don’t sign a statement, timeline, or “summary of what happened” on the spot.
- Don’t share details widely at work (or online) “to check your memory”.
- Don’t hand over personal devices, passwords, or private accounts without advice (especially if mixed work/personal use).
- Don’t ignore written notices or deadlines, even if you feel overwhelmed.
What to do now
- Preserve the contact and verify it safely. Save the email/letter/voicemail. If it’s an email, keep headers/metadata if you can. Then independently find the regulator’s official switchboard/contact details (e.g., on GOV.UK or the regulator’s official site) and confirm the person’s name, role, and reference number.
- Move everything to writing. If they called, ask them to email you the request. If they emailed, reply asking for the request to be set out clearly in writing (what they want, by when, and under what power).
- Use a holding line that keeps you cooperative but safe. For example: “I want to cooperate, but I’m not confident answering accurately without checking records. Please set out what you need in writing and I’ll respond after I’ve checked.”
- Tell the right people internally (if you’re employed). Inform your manager and your employer’s compliance/legal function immediately and forward the exact message you received (don’t summarise from memory). If you have a union, consider contacting your rep for support.
- Check for conflicts before relying on “company lawyers”. Employer-appointed lawyers often represent the organisation first. If you think you personally could be blamed, disciplined, or prosecuted, consider getting independent legal advice before any interview or signed statement.
- Preserve records and stop “auto-cleanups”. Don’t delete emails, messages, drafts, notes, photos, logs, or files. If any system auto-deletes (e.g., chat retention), tell your employer’s IT/compliance so preservation can be put in place. Keep a simple list of where relevant records might be (systems, folders, devices).
- Clarify what kind of step this is. Ask (preferably in writing):
- what issue they’re looking at (topic and time period);
- whether they want documents, answers in writing, an inspection, or an interview;
- what deadline applies, and whether you can request an extension if needed.
- If an “interview under caution” is mentioned, slow it down. Treat this as formal. Don’t attend immediately or alone. Ask what framework applies (many “under caution” interviews follow PACE-style safeguards), whether it will be recorded, and request time to arrange legal representation.
- If you receive a formal notice with a deadline, diarise it and respond through the right channel. Don’t miss deadlines. If the scope is unclear or too broad, ask for clarification and/or an extension promptly in writing.
- Start a communications log now. Note dates/times, who contacted you, what was asked, what you provided, what you still owe, and all deadlines. Keep copies of anything you send.
What can wait
- You do not need to decide “the full story” right now.
- You do not need to resign, confess, or accuse anyone today.
- You do not need to have a long phone call “to clear things up”.
- You do not need to contact witnesses, complainants, or clients to “fix” anything right now.
Important reassurance
Feeling panicked is normal: regulatory contact can sound intimidating even when you’ve done nothing wrong. Verifying identity, moving to writing, and taking advice before speaking is a standard, reasonable way to avoid mistakes.
Scope note
These are first steps only, to prevent irreversible mistakes and buy time. What happens next depends on the regulator, your role, and whether this is information gathering, inspection, or potential enforcement.
Important note
This is general information, not legal advice. If you receive a formal notice, are invited to an interview under caution, or think you may have personal exposure, consider seeking independent legal advice promptly.
Additional Resources
- https://www.gov.uk/government/publications/pace-code-c-2023/pace-code-c-2023-accessible
- https://assets.publishing.service.gov.uk/media/686e23d181dd8f70f5de3cbf/Interviewing_suspects.pdf
- https://www.legislation.gov.uk/ukpga/2018/12/section/142
- https://www.legislation.gov.uk/ukpga/2000/8/section/165
- https://handbook.fca.org.uk/handbook/EG/3/2.html
- https://www.ofcom.org.uk/about-ofcom/what-we-do/information-registry
- https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch23420