Supervisory questionnaire response: what the decision maker looks at
A supervisory questionnaire is not a form to fill in and forget. The person reading it looks for internal consistency, evidence behind every claim, and a clear owner for each control. A weak answer on one line can put the whole file back in the queue for clarification, and that resets a clock most obliged entities did not know was running.
What changes once the questionnaire lands
Receipt of the questionnaire starts an internal review cycle inside the authority. From that point, the file is no longer a routine check; it becomes a case with a named handler on the other side. Every document sent after this point becomes part of that case file, including a draft emailed informally if the recipient chooses to treat it as a formal submission.
The practical effect is procedural, not substantive. The burden shifts from "we have a policy" to "we can show the policy working." A written AML policy without dated logs, escalation records and a named compliance officer reads, to a reviewer, as unused paperwork rather than a functioning control.
This is also the point where internal ownership matters. If nobody inside the business is clearly responsible for the answer, the questionnaire tends to circulate between departments and lose consistency between drafts — which is itself something a reviewer notices.
Who decides, and on what timeline
The decision does not sit with a single named person available by phone. It sits with a case officer who prepares a recommendation, and a supervisory panel or head of department who signs off on it. The table below sets out the sequence most files follow. It does not state fixed day counts, because the authority runs its own internal calendar and does not publish one an outside party can rely on for planning.
| Stage | What happens | Who acts |
|---|---|---|
| Intake | The questionnaire is logged and assigned a case officer | Authority's case management team |
| First pass | Answers are checked for completeness against an internal checklist | Case officer |
| Clarification round | Gaps or contradictions are sent back as follow-up questions | Case officer, entity's compliance officer |
| Escalation, if needed | Unresolved issues move to a supervisory panel | Panel or head of supervision |
| Decision | Outcome is recorded and communicated in writing | Panel or head of supervision |
Most files close at the first-pass or clarification stage. Escalation is reserved for cases where the entity's answers conflict with information the authority already holds from another source, such as a prior report or a separate supervisory contact.
What to prepare and in what order
- Assign one person as the single point of contact before drafting any answer.
- Pull the current risk assessment and check every questionnaire answer against it line by line.
- Collect evidence for each control claimed: logs, training records, escalation reports, board minutes.
- If part of the business runs on a licensed third-party platform, check what the licence itself documents about data handling and audit rights — a term sheet can promise more than When a term sheet promises more than the licence actually grants, and the answer must reflect the licence, not the pitch that preceded it.
- Draft answers in plain language and avoid restating policy text the reviewer has already read once in an earlier submission.
- Have the compliance officer sign the final version before submission, not a founder or director unfamiliar with day-to-day controls.
The point of no return
Once the authority issues a formal decision rather than a clarification request, the file changes category. A refusal or a negative finding opens an appeal window, and that window is the one deadline in this process an entity cannot extend by asking. If a refusal follows the questionnaire, treat the moment of receipt as day one — An appeal deadline follows a refusal authorisation the deadline that matters is the one your team can still meet only if it starts counting immediately.
Before that stage, almost everything is recoverable. A missing document can be sent, an unclear answer can be reworded, and a clarification round can absorb most early mistakes. After a formal negative decision, the options narrow sharply, to appeal, resubmission after remedy, or acceptance of the outcome as it stands.
If your situation differs
If the questioned activity involves a product still being changed, note that a reviewer expects the current state of that product, not a snapshot from before the change. The logic is close to what applies When the product is redesigned mid-dispute: describe what exists today and flag the change openly, rather than letting the reviewer discover it independently later.
If part of the compliance evidence depends on source code or infrastructure held by a vendor, check whether that access is itself time-limited. A dispute over release conditions can run on its own separate clock, similar to what happens When source code escrow is demanded, and that clock does not pause because a supervisory questionnaire is also open at the same time.
If the questionnaire arrives shortly after a risk assessment refresh, reuse that work rather than starting from a blank page. The two documents should tell the same story, and any mismatch between them is the first thing a careful reviewer will flag.
What this page does not cover
This page describes the procedural pattern of a supervisory questionnaire cycle. It does not list which specific controls a given business model must have in place, does not estimate the likelihood of a particular outcome, and does not replace a line-by-line review of the entity's own file before submission. Statutory references are deliberately absent here, since they belong on a page tied to a specific jurisdiction and regime, and mixing the two would make either page harder to rely on.
Related reading
Before drafting answers, it helps to revisit how the underlying risk picture was built — see Risk assessment refresh step by step for the document list that most questionnaire answers draw on directly.
Verified
Reviewed 14 February 2025. This page sets out a procedural sequence rather than a statutory one, and no external sources are cited here by design; the underlying regime is addressed on separate, jurisdiction-specific pages.
Frequently asked questions
How long does a supervisory questionnaire response take in practice?
Timing depends on the authority's own caseload and on how many clarification rounds the first draft triggers. A file with complete, evidence-backed answers from the start tends to move through intake and first pass faster than one that needs several follow-up rounds to close gaps.
Which documents are needed to start?
At minimum: the current risk assessment, the AML policy in force, training and escalation logs, and a clear list of who holds which compliance role inside the business. Anything claimed in the answers should have a document sitting behind it before the file goes out.
What happens if the entity does not respond within the requested window?
Silence is read as non-cooperation, not as a neutral pause in the process. It can move the file directly toward escalation and shorten the practical time left to fix gaps before a formal decision is issued.