When the Regulator Writes: A Boardroom's First Three Hours After an Unexpected Enquiry
Photo: business professional reading urgent regulator email at desk, via thechronicle.com.ph
At 08:42 on a Tuesday, the general counsel's inbox receives an email from a regulator. It is polite, specific and marked urgent. It asks for documents, explains that a formal information request may follow, and requests a call later that day. The chief executive is travelling. The finance director is in a board committee. The company secretary is the most senior person in the building.
What happens next will shape the board's credibility for months. The first three hours are not for answering the substance of the request. They are for containment, preservation and control.
Hour one: acknowledge, triage and contain
The first action is to acknowledge receipt without conceding anything. A short holding response, approved by legal counsel, should confirm that the email has been received and that the company is taking it seriously. It should not promise documents, admit facts or offer a timeline that has not been agreed internally.
The company secretary or general counsel should then open a single incident log. The log records the time of receipt, the regulator, the nature of the request, the deadline stated, the individuals informed and every action taken. This log will become the board's evidence of a reasonable response.
Triage means answering three questions. Is this a routine information request, a data protection notice, a competition enquiry or something else? Does it require immediate preservation of documents or data? Is there a statutory deadline or a court-imposed timetable? The answers determine the escalation route. A data protection notice from the Information Commissioner's Office may require immediate engagement with the data protection officer. A competition enquiry from the Competition and Markets Authority may require separate legal advice and a document hold.
Containment means telling the right people quietly. The chair, the chief executive, the finance director, the general counsel and the company secretary should be informed. The circle should not be widened until the facts are clearer. Leaks, speculation and informal messages to staff can undermine the response.
Hour two: preserve evidence and protect privilege
The second hour is about evidence. The company must suspend routine deletion or alteration of relevant documents and data. An IT hold should be issued to the appropriate custodians, with clear instructions not to delete emails, messages, drafts or files. The hold should be documented and confirmed by the recipients.
Legal privilege is a critical asset. Where the request is likely to lead to legal proceedings or regulatory action, the board should take advice from external counsel. Communications with counsel, and documents created for the dominant purpose of legal advice, may attract privilege. But privilege is not automatic. It depends on how documents are created, who sends them and why. Directors should avoid copying advisers into operational emails that are not genuinely legal in purpose, and they should label documents carefully.
The company secretary should also identify any personal devices or messaging applications that may contain relevant information. In 2026, regulators are alert to the use of unofficial channels. A preservation notice that covers only the corporate email system may be inadequate.
Hour three: agree the internal line and the external posture
By the third hour, the board should have a short internal communication plan. Staff who need to know should be told what to do and what not to do. The default instruction is simple: do not delete, do not discuss outside the response team, and direct all enquiries to the company secretary. Anyone who may have relevant information should be asked to preserve it and to make themselves available for a briefing.
The external posture should also be agreed. That means deciding who will speak to the regulator, whether external counsel will lead, and what the company will say if asked for comment by media or investors. The answer should be factual and consistent: the company has received a request and is co-operating. It should not speculate on outcome or timing.
The board should then set a review point. Three hours is enough to contain the immediate risk, not enough to resolve the matter. A further meeting later the same day or the following morning should confirm the document hold, the legal team, the communication lines and the timetable for response.
Common early mistakes
The most common mistake is to answer too quickly. A well-meaning executive may want to be helpful, but an incomplete or inaccurate response can create a worse impression than a short, considered holding reply. Another mistake is to widen the circle too far, creating speculation and informal contact with the regulator. A third is to overlook personal devices and messaging apps. A fourth is to treat privilege as a blanket protection without taking advice on how to create and maintain it. A fifth is to fail to document decisions. The incident log is not bureaucracy; it is the board's record of a reasonable and proportionate response.
Adapting the checklist to your escalation procedure
Every board should have an escalation procedure that names a first responder, a deputy and an out-of-hours contact. The procedure should be tested annually, ideally with a short tabletop exercise. The checklist above is not a substitute for legal advice, but it provides a structure that directors can adapt to their own organisation.
The first three hours after a regulator's email are not about heroics. They are about discipline. A board that acknowledges, triages, preserves and communicates in a measured way will be in a stronger position when the substantive work begins.
