How to Communicate With Regulators During a Compliance Incident

Communicating with regulators during a compliance incident requires a combination of transparency, timing, and internal alignment. Organizations that communicate proactively, honestly, and in a structured manner build more trust with regulators than organizations that respond reactively or defensively. This article answers the most concrete questions that arise during a compliance incident: from the first contact with a regulator to restoring the relationship afterwards.

What do regulators expect from an organization during a compliance incident?

During a compliance incident, regulators expect above all transparency, timeliness, and a demonstrable willingness to manage the situation. They want to see that the organization acknowledges the seriousness of the incident, is actively mapping the facts, and is taking concrete steps to prevent recurrence. What they do not want is an organization that withholds information, minimizes the severity, or communicates without clear direction.

Regulators assess not only the content of what an organization reports, but also how it communicates. Consistent, well-coordinated communication signals that the organization is taking responsibility. Conversely, chaotic or contradictory communication raises suspicion, even if the facts themselves are not that serious.

Concretely, most regulators expect the following:

A timely initial notification, even if the facts are not yet fully known
A clearly designated point of contact on behalf of the organization
Regular updates as the situation evolves
Honesty about what the organization knows and what is still being investigated
Visible measures to limit the impact and prevent recurrence
Documentation of decisions and communication moments

When should you proactively inform a regulator?

Proactively informing a regulator is appropriate as soon as there are indications that an incident meets the statutory reporting threshold, even if the full extent is not yet clear. Waiting until all the facts are known is in most cases a mistake: it can be interpreted as deliberate delay, and many regulations set explicit deadlines for initial notifications.

In the Belgian and European context, strict reporting deadlines apply across various sectors. Under the GDPR, a data breach posing a risk to data subjects must be reported to the Data Protection Authority within 72 hours. Financial institutions supervised by the FSMA or the National Bank of Belgium have comparable obligations. Organizations in the energy, pharmaceutical, or food sector are subject to sector-specific rules that sometimes prescribe even shorter response times.

Even outside legal obligations, the rule of thumb applies: if an incident could cause reputational damage, public attention, or further escalation, it is better to inform the regulator yourself than to wait until they learn about it through another channel. Proactive communication gives the organization more control over the message and the timing.

How do you draft an initial notification to a regulator?

An initial notification to a regulator must be factual, concise, and honest. It does not need to contain all the answers, but it must demonstrate that the organization is taking the situation seriously and is actively investigating. A good initial notification is not an excuse or spin, but a clear account of what is known at the time of writing.

Structure an initial notification as follows:

What happened? Provide a factual description of the incident, without speculation about causes or consequences that have not yet been established.
When and how was it discovered? State the time of discovery and by whom or what the incident came to light.
What is the (potential) impact? Outline the possible consequences for those involved, systems, customers, or third parties, even if these are not yet fully known.
What measures have already been taken? Describe the initial actions the organization has taken to stabilize the situation or limit further damage.
What is the follow-up process? Indicate what investigation is underway, who is responsible for it, and when the next update will follow.
Who is the point of contact? State the name, position, and contact details of the person coordinating communication with the regulator on behalf of the organization.

Always have the initial notification reviewed by Legal before it is sent. The communicative tone and the legal implications must be aligned.

Who handles communication with the regulator on behalf of the organization?

Communication with a regulator during a compliance incident is best handled by one designated point of contact, preferably someone with sufficient seniority and mandate. This is typically the Chief Compliance Officer, the General Counsel, or a duly mandated director. Multiple individuals each making separate contact leads to contradictory signals and undermines the regulator’s trust.

The choice of point of contact depends on the nature of the incident and the sector. In the case of a data breach, the DPO will play a central role; in a financial compliance incident, Legal or the CFO is more often the designated party. What matters is that the person involved knows the facts, has the mandate to speak on behalf of the organization, and is able to communicate calmly and consistently under pressure.

In this type of case, communication is not a task that rests solely with Legal or Compliance. The communications director or Corporate Affairs lead plays an essential role in preparing messages, aligning with other stakeholders, and ensuring consistency between what is said internally and externally. That collaboration between Legal, Compliance, and Communications is not a luxury, but a necessity.

What are the biggest communication mistakes during a compliance incident?

The most damaging communication mistakes during a compliance incident are not always the most obvious ones. Organizations often underestimate how quickly inconsistent or ill-considered communication erodes a regulator’s trust, sometimes more than the incident itself.

The most common mistakes are:

Reporting too late: Waiting until everything is known, while statutory deadlines have already passed or the regulator learns about the incident through another channel.
Minimizing or downplaying: Trivializing the seriousness of the incident in the hope of tempering the regulator’s response. This breeds distrust and worsens the situation.
Contradictory messages: Disseminating different information internally and externally, or between different spokespersons. Regulators compare what they hear with what they read or learn elsewhere.
Failing to designate a clear point of contact: Multiple individuals each communicating separately without mutual alignment.
Speculating about causes: Providing explanations for the incident before the internal investigation is complete, which then need to be corrected later.
Communicating defensively or legalistically: A tone that gives the impression the organization is defending itself rather than addressing the situation.

How do you keep internal and external communication consistent during a compliance crisis?

Consistency during a compliance crisis is achieved by working from a single central fact base and a single coordinated communication mandate. This means that all parties involved, from the crisis team and Legal to HR, Operations, and the spokesperson, start from the same established facts and the same key messages. Anyone who deviates from that basis, even with the best intentions, creates room for confusion and speculation.

In practice, this requires clear internal governance. Assemble a crisis team with representatives from the relevant disciplines and define who shares what information, with whom, and at what moment. Employees must know what they can say if they are approached by customers, media, or other external parties. Trade unions and works councils have the right to timely information in certain situations and must be included in the communication process.

Keep track of what has been said, to whom, and through which channel at each communication round. That documentation is not only useful for internal follow-up, but also for accountability to the regulator. An integrated crisis communication strategy that treats internal and external communication as a single whole is the most effective way to avoid contradictory signals.

How do you restore the relationship with a regulator after a compliance incident?

Restoring the relationship with a regulator after a compliance incident does not begin after the acute phase, but already during the crisis. Organizations that communicate consistently and transparently, act swiftly, and implement demonstrable improvements lay the foundation for recovery during the incident itself. Afterwards, the task is to continue that approach with concrete actions and a long-term perspective.

Concrete steps in the recovery phase include:

Conducting a post-incident review and actively sharing the findings with the regulator
Communicating about the structural measures the organization is taking to prevent recurrence
Maintaining proactive contact, including outside formal reporting moments
Providing evidence that the promised measures are being effectively implemented
Correcting any inaccurate information that circulated during the crisis

Rebuilding trust is a process, not a one-time action. Regulators look at the consistency between what an organization says and what it does. An organization that demonstrably learns from an incident and strengthens its governance will, over time, build a stronger reputation with the regulator than an organization that views the incident merely as a problem to be managed.

How Whyte helps with communication during a compliance incident

Whyte supports larger organizations throughout the full crisis cycle, including compliance-related incidents where communication with regulators, employees, media, and other stakeholders must be closely aligned. Our approach combines senior strategic advice with hands-on execution and always starts from an integrated view of the stakeholder environment.

Concretely, we can provide support with:

Drafting initial notifications and communication directed at regulators
Developing key messages and Q&As for internal and external communication
Alignment between Legal, Compliance, HR, Operations, and Communications
Spokesperson coaching and media training for involved executives
Stakeholder mapping and prioritization of communication actions
Support with reputation recovery and trust-building after the acute phase

Is your organization dealing with a compliance incident, or would you like to be better prepared for such situations? Contact Whyte for an initial conversation.

Frequently Asked Questions

What if a regulator makes contact before we have reported ourselves?

If a regulator makes contact first, it is important to respond calmly and professionally without immediately going into substantive detail. Confirm that you are aware of the situation, indicate that you are actively investigating, and make a concrete appointment for a full follow-up. Avoid the temptation to improvise on the spot: if necessary, request a brief delay to gather the right point of contact and the established facts, and ensure that Legal and Compliance are immediately informed.

How do you prepare executives for a meeting or hearing with a regulator?

Executives going into a meeting with a regulator must be thoroughly briefed in advance on the established facts, the key messages, and the boundaries of what they can say. Practice the conversation through a simulated question-and-answer session, so they can also answer difficult or unexpected questions calmly. Key ground rules are: only speak about what you know for certain, openly acknowledge what is still being investigated, and avoid speculation or interpretations that may need to be corrected later.

Are we allowed to seek legal advice without undermining transparency towards the regulator?

Yes, seeking legal advice is not only permitted but strongly recommended, and it is separate from the obligation to be transparent. Regulators understand that organizations engage legal assistance; what they do not tolerate is legal advice being used as an excuse to withhold information or delay notifications. The key is to have Legal and Compliance work together on communication that is both legally sound and open and factual, so that both objectives reinforce rather than undermine each other.

What do you do if the facts change during the investigation or if earlier information turns out to be incorrect?

If new insights contradict earlier notifications, it is essential to proactively inform the regulator as quickly as possible and explicitly name the correction. Never try to minimize the change or quietly incorporate it into an update: acknowledge that the initial information was incomplete or incorrect, explain how that could happen, and indicate what steps are being taken to map the facts more accurately going forward. Regulators value honesty about uncertainties; what truly damages trust is the impression that an organization has deliberately provided incorrect information.

How do you deal with multiple regulators simultaneously in an incident that affects multiple sectors or countries?

In an incident involving multiple competent regulators, coordination between the internal teams involved is crucial: ensure a single central fact base and align the timing and content of notifications internally before making contact. Designate a specific point of contact per regulator, but ensure that all those involved start from the same key messages. In cross-border situations, it is advisable to engage external legal and communications specialists with knowledge of local regulations and regulatory culture, so that notifications in each country are submitted in the right tone and within the correct timeframes.

How do you know whether your crisis communication plan is also effective for compliance incidents, and not just for classic crises?

A generic crisis communication plan is rarely fully tailored to the specific dynamics of compliance incidents, in which regulators, legal obligations, and internal governance play a central role. Explicitly test your plan against elements such as reporting deadlines per sector, the role of Legal and Compliance in the crisis communication structure, and the alignment between internal and external messages. A realistic exercise or tabletop simulation with a compliance scenario is the most effective way to identify gaps and strengthen the plan before a real incident occurs.

When is it worthwhile to bring in external communication support for a compliance incident?

External communication support is worthwhile as soon as an incident exceeds internal capacity, affects multiple stakeholder groups simultaneously, or carries a real reputational risk. In practice, this is more often the case than organizations initially estimate: the combination of time pressure, legal complexity, and the need for consistent communication towards regulators, employees, and media requires specialized expertise. The earlier external support is brought in, the greater the impact: in the first hours of an incident, the frameworks are established that guide the rest of the communication.

This content was generated with the help of AI and it may contain mistakes