Section 166 Support: Find Senior Compliance Leaders Who Have Been Through One Before

Section 166 of the Financial Services and Markets Act 2000 gives the FCA and the PRA the power to require an authorised firm to commission an independent review by a “skilled person” — a specialist with relevant expertise — and to pay for it. The output is a formal skilled person report that the regulator uses to form its view on specific matters of concern. For the firm, receiving a Section 166 notice is a serious regulatory event: it typically signals that the regulator has concerns that go beyond what ordinary supervisory engagement can resolve, and the firm is about to be subjected to an independent, forensic examination of its arrangements in the areas specified in the notice. The cost is borne by the firm, the timeline is driven by the regulator, and the output has direct consequences for the firm’s future supervisory treatment.

Section 166 is a supervisory tool, not an enforcement tool. But it often sits at the boundary between the two. Firms that respond well to a Section 166 — engaging substantively with the skilled person, implementing remediation effectively, demonstrating a credible response to the findings — typically avoid enforcement action even where the findings are significant. Firms that respond poorly — defensive engagement, weak remediation, failure to evidence change — typically find the matter escalates into enforcement. The response to a Section 166 is one of the most consequential pieces of regulatory interaction a firm will have, and the senior resource the firm puts into managing it determines whether the outcome is recoverable or escalating.

Section 166 has been used particularly extensively in recent years across Consumer Duty, financial crime, operational resilience, client assets, and a wide range of conduct matters. The FCA in particular has signalled that it will continue to use the power as a core supervisory tool. Every senior compliance, risk and finance leader at an FCA-regulated firm should understand how Section 166 works, what to expect if one arrives, and what the firm needs to do to respond well.

This guide sets out the Section 166 regime in substantive detail — the statutory framework, how and why the FCA uses the power, what the “lots” on the skilled persons panel cover, the mechanics of running a Section 166 review, what the skilled person report typically contains, common firm-side failings, the cost and timeline realities, and how FD Capital places the senior compliance and risk specialists who run the firm’s response to a Section 166. It is written for chief compliance officers, chief risk officers, senior legal counsel, and boards at UK FCA-regulated firms.

The Statutory Basis — Where Section 166 Comes From

Section 166 is a statutory power, not a rulebook provision. Understanding the framework matters because it defines what the regulator can and cannot do with the power.

FSMA Section 166

Section 166 of the Financial Services and Markets Act 2000, as amended, provides that the FCA or PRA may, by written notice, require an authorised person (or certain other persons connected to authorised persons) to provide the regulator with a report by a skilled person. The key provisions:

The regulator defines the scope of the review in the notice
The skilled person must be appointed by the firm (typically from a regulator-approved panel), or in some cases by the regulator directly
The firm bears the cost of the review
The skilled person reports directly to the regulator, though the firm is typically shown the report
The firm must provide the skilled person with all relevant information and access

Section 166A

Section 166A, added by later amendments, extends the regulator’s powers to require firms to collect and keep information in a specific way for the purposes of a future or ongoing skilled person review. This is used less frequently than Section 166 itself but becomes relevant where the regulator anticipates needing a future review and wants to ensure relevant data is preserved.

The FCA Handbook SUP 5

SUP 5 in the FCA Handbook contains the FCA’s operational framework for Section 166 and Section 166A reviews. It covers:

When the FCA will consider using the power
The process for appointing a skilled person
The skilled persons panel and the “lots” system
The relationship between the skilled person, the firm and the FCA
The form and content of the skilled person report
The firm’s obligations in supporting the review

PRA approach

The PRA has parallel Section 166 powers under FSMA and operates its own equivalent framework. The PRA tends to use Section 166 for prudential, risk management and governance matters at the firms it regulates; the FCA uses it across a broader range of conduct, governance and operational matters. Dual-regulated firms can in principle receive Section 166 notices from either or both regulators.

When and Why Section 166 Is Used

Understanding when the FCA typically uses Section 166 helps firms assess their exposure to receiving a notice and helps those who receive one understand the regulator’s likely mindset.

The supervisory escalation context

Section 166 typically sits at a specific point in the supervisory escalation ladder. Ordinary supervisory engagement (meetings, information requests, feedback letters) addresses routine matters. Section 166 is deployed where:

The regulator’s concerns are significant enough to require independent verification
The firm’s own representations have not resolved the concerns
The regulator wants a forensic, evidence-based assessment that goes beyond management attestation
The matters are too complex or specialist for the regulator to assess fully with its own resources
The regulator wants to establish a formal evidential basis for potential further action

Common subject matters

Recent years have seen Section 166 used extensively across:

Consumer Duty: Specific firms have been required to commission skilled person reviews of their Consumer Duty implementation, particularly fair value assessments and consumer outcomes monitoring. See our Consumer Duty guide.
Financial crime and AML: A consistently active area. Reviews of AML framework effectiveness, transaction monitoring, customer due diligence, and SAR function quality. See our MLRO guide, CDD guide and SARs guide.
Governance and SMCR: Reviews of senior manager accountability, management information, and the effectiveness of Statements of Responsibilities. See our SMCR guide.
Operational resilience: Reviews of important business services identification, impact tolerance calibration, and testing quality. See our Operational Resilience guide.
Client assets and client money: CASS reviews are among the longest-running uses of Section 166, particularly after CASS failings or where firms have experienced CASS-related incidents.
Sanctions: Reviews of sanctions screening effectiveness and the firm’s response to sanctions events.
Prudential matters: Reviews of regulatory reporting accuracy, capital calculations, or liquidity management — particularly at the PRA.
Specific incidents: Where a firm has experienced a specific incident (major outage, conduct failing, customer harm event), a Section 166 review may examine the root causes and the firm’s response.

Section 166 volumes and trends

The FCA publishes aggregate Section 166 data in its annual reports. Volumes have been significant in recent years — typically running into multiple hundreds of reviews per year across all sectors. The distribution shifts over time as regulatory priorities change; Consumer Duty has been a particularly active driver of s166 activity since the regime came into force.

The Skilled Persons Panel and the Lot System

The FCA maintains a skilled persons panel of firms it has approved to conduct Section 166 reviews. The panel is organised by subject-matter “lots.” Understanding the lot system is important for firms because it shapes which firms can be appointed for which types of review.

The current lot structure

The FCA skilled persons panel is organised around specific subject-matter lots. The exact lot structure has evolved over time; at the time of writing the FCA operates around nine specialist lots covering areas including:

Lot covering client assets (CASS) and controls
Lot covering conduct of business and Consumer Duty
Lot covering financial crime
Lot covering governance, controls and risk frameworks
Lot covering prudential matters and liquidity
Lot covering technology, operational resilience and cyber
Lot covering investigations and disciplinary matters
Lot covering remuneration
Lot covering specific specialist matters as they arise

Firms on the panel are typically large accounting firms (Big 4 and mid-tier), specialist compliance and risk consultancies, specialist law firms (for specific lots), and specialist boutiques with subject-matter expertise. Each lot has multiple firms approved, so the FCA has a choice of available skilled persons when deploying Section 166.

How the skilled person is selected

The process for appointing the skilled person varies:

Firm selection from panel: The most common approach. The firm proposes one or more skilled persons from the relevant lot; the FCA approves (or rejects) the proposal. The firm has some say in the selection but must justify the choice and demonstrate independence.
FCA direct appointment: In some cases the FCA specifies the skilled person directly, particularly where independence concerns are heightened or where the matter is particularly sensitive.
Contingency panel: For urgent matters the FCA may appoint a skilled person from a contingency arrangement rather than running the standard selection process.

Conflicts and independence

The skilled person must be genuinely independent of the firm and of the matters being reviewed. The firm cannot appoint its regular external auditor or its existing legal advisers (on related matters) as the skilled person, and conflict checks are part of the appointment process. This is an important point: firms sometimes attempt to propose a skilled person with whom they have existing commercial relationships, which typically fails the independence test and delays the appointment.

The Section 166 Notice — What to Expect

When the FCA decides to use Section 166, the firm receives a formal written notice. The content and language of the notice are important signals about the regulator’s mindset.

Contents of a Section 166 notice

A typical Section 166 notice includes:

The statutory basis (FSMA Section 166, and whether Section 166A is also engaged)
A statement of the FCA’s concerns that give rise to the need for the review
The specific scope of the review — what matters the skilled person will examine
The required outputs (the skilled person report, sometimes interim reports or specific findings)
Timelines for appointment of the skilled person and completion of the review
Arrangements for the firm’s engagement with the skilled person
The regulator’s expectations regarding the firm’s cooperation
Cost arrangements (which are borne by the firm but subject to FCA oversight for reasonableness)

Pre-notice engagement

In some cases the FCA will engage with the firm before formally issuing a Section 166 notice — signalling that a notice is being considered, allowing the firm to make representations, and in some cases reaching agreement on the scope of the review in advance. In other cases, particularly where the matter is urgent or the regulator wants to ensure objectivity, the notice arrives without such prior engagement.

The firm’s initial response

The firm’s response to receipt of the notice is the first marker of how well the Section 166 will go. Critical initial steps:

Immediate escalation to the board and Senior Managers (particularly the Chief Executive, Chief Compliance Officer, Chief Risk Officer and Chief Financial Officer) — receipt of a Section 166 notice is typically a matter requiring Principle 11 disclosure and immediate internal visibility.
Legal review of the notice — understanding exactly what is required and identifying any points requiring clarification with the FCA.
Engagement with the FCA to clarify scope, timelines and expectations where these are not clear from the notice.
Immediate planning for skilled person selection, including the internal team that will lead the firm’s response.
Communication to stakeholders as appropriate — internal, external, shareholders, counterparties depending on the matter.

Running a Section 166 Review — the Process

Once the skilled person is appointed, the review commences. The specific process varies by subject matter but typically follows a standard pattern.

Phase 1 — scoping and planning

The skilled person produces a detailed scope document setting out:

The precise matters within and outside the review
The methodology — interviews, document review, data analysis, testing, sample selection
The timeline
The team structure at both skilled person and firm
The deliverables
Interaction with the FCA during the review

The scope document is shared with the FCA for approval. Once approved, the review proceeds within that scope — changes mid-review require formal scope variations.

Phase 2 — fieldwork

The fieldwork phase is where the substantive review happens. Typical activities:

Document review — policies, procedures, governance papers, management information, committee minutes, internal audit reports, customer files (as relevant)
Data analysis — extracting and analysing data from the firm’s systems relevant to the review
Interviews — structured interviews with senior management, Senior Managers, staff in the area being reviewed, and in some cases customers or third parties
Testing — sample-based testing of specific controls, processes or decisions
Observation — in some reviews, direct observation of the firm’s processes in action
Ongoing dialogue with the FCA about emerging findings

Phase 3 — draft report and firm response

The skilled person produces a draft report setting out their findings. Typically:

The firm is given the opportunity to respond to factual matters in the draft, which may lead to corrections where the firm can evidence alternative facts
The firm is not typically able to challenge the skilled person’s judgments and conclusions at this stage — only factual accuracy
The firm may submit a formal management response setting out how it proposes to address the findings
The FCA reviews the draft in parallel with the firm’s response

Phase 4 — final report and delivery

The skilled person delivers the final report to the FCA. The firm typically receives a copy in parallel. The FCA then forms its view on the findings and communicates to the firm how it will respond — typically through a combination of:

Formal feedback requiring specific remediation actions
Further supervisory engagement focused on the areas identified
In more serious cases, referral to enforcement
In less serious cases, closure of the matter subject to implementation of the remediation

The Skilled Person Report — What It Typically Contains

The skilled person report is the formal output of the review. Its contents are important both for the firm’s current situation and for any future reference.

Typical report structure

A comprehensive skilled person report typically covers:

Executive summary — the key findings and conclusions
Context and scope — what the review covered and why
Methodology — how the skilled person conducted the review, with transparent disclosure of sample sizes, data sources and interview scope
Detailed findings by subject area
Root cause analysis — not merely what was found, but why
Comparison to good practice or regulatory expectations
Recommendations for remediation
Assessment of the firm’s existing remediation plans where applicable
Conclusions and overall assessment
Appendices with detailed evidence, testing results, interview notes

The tone of the report

Skilled person reports are typically direct in their findings. They are written for the regulator and are expected to be candid. Firms that hope for a softened or nuanced presentation of findings are usually disappointed — the skilled person’s professional independence requires substantive rather than diplomatic findings.

Confidentiality and use

The report is a regulatory document. Its circulation outside the firm and the regulator is tightly controlled. Firms must handle the report carefully — internal circulation should be restricted to those who need it, and external sharing (with auditors, shareholders or similar) typically requires FCA awareness. The confidentiality framework does not prevent the firm using the report internally for remediation purposes, but it does prevent the firm treating the report as ordinary management material.

Cost and Timeline Realities

Section 166 reviews are expensive and time-consuming. Understanding the realities helps firms plan appropriately.

Costs

Section 166 costs are borne by the firm. The specific cost depends on the scope, complexity and duration of the review but typical indicative ranges for recent reviews:

Small-scope review: £500,000 to £1.5 million for a focused review at a smaller firm
Mid-scope review: £1.5 million to £5 million for a substantive review at a mid-market firm or a narrower review at a larger firm
Major scope review: £5 million to £20 million or more for major reviews at large firms, particularly where CASS, complex AML, or wide-ranging governance matters are involved

These ranges are indicative and specific reviews can run higher. The costs cover the skilled person’s professional fees, which are typically calculated on time and expenses with appropriate team structures. The FCA has oversight of reasonableness but does not typically intervene on cost unless the fees appear disproportionate to the scope.

Timelines

Timelines from notice to final report typically run:

Scoping and skilled person appointment: 4-8 weeks
Fieldwork: 3-9 months depending on scope
Draft report, firm response and finalisation: 4-12 weeks
Total notice-to-final-report: 6-18 months typical, occasionally longer

During the review, the firm is operating under significant resource pressure — the review team at the skilled person will be interacting extensively with the firm’s staff, requiring data provision, interview availability and document production. The impact on ordinary business operations can be substantial, particularly in the fieldwork phase.

Cost to the firm beyond the skilled person fees

Firms should anticipate substantial indirect costs:

Internal resource diverted to supporting the review — staff time for interviews, document production, data extraction
External legal advice throughout the review
Specialist advisory support on the firm’s response
Remediation costs following the review, which are often substantially larger than the review itself
Reputational impact, including in supervisory relationships, in commercial relationships and in public disclosure where applicable

Common Firm-Side Failings

The firms that navigate Section 166 poorly typically fail in recognisable ways.

Defensive engagement

Treating the review as adversarial rather than collaborative. Challenging the skilled person’s findings aggressively. Withholding information or presenting it selectively. Creating a culture of minimising rather than understanding the issues identified. The result is typically worse findings than the firm would otherwise have received, and a more negative FCA response to the report.

Insufficient senior leadership engagement

Delegating the response to the review too far down the organisation. Board and executive-level engagement that is sporadic rather than sustained. Senior Managers not directly involved in supporting the review in their areas of responsibility. This typically produces findings that the Senior Managers were unaware of the issues — which under SMCR creates additional personal accountability exposure.

Weak remediation planning

Remediation plans produced in response to findings that are vague, under-resourced or lacking credible timelines. Plans that look more like public relations exercises than genuine commitments. The FCA assesses remediation plans with considerable scepticism and weak plans signal weak management commitment.

Failure to use the review as a genuine learning opportunity

Focusing only on the minimum steps needed to close the matter, rather than using the review to genuinely improve the firm’s arrangements. This approach typically leads to recurrence of the underlying issues and further regulatory intervention.

Poor internal communication

Lack of clarity within the firm about what the Section 166 is covering, who is leading the response, what the findings are, and what the implications are. Information not flowing appropriately between the review team and the wider business. This creates operational confusion and can lead to inconsistent messaging to the skilled person.

Inadequate document preparation

Being unable to produce documents the skilled person requests within reasonable timeframes, or producing them in disorganised ways that suggest poor record-keeping. This typically becomes a finding in its own right — inadequate governance and oversight evidenced by inadequate record-keeping.

The Senior Resource Firms Need During and After a Section 166

Running the firm’s response to a Section 166 is specialist work. The firms that handle it well typically deploy specific senior resources with specific experience.

Section 166 response lead

A senior individual with overall responsibility for the firm’s response to the review. Typically reports to the Chief Executive or to the Board. Often a senior compliance or risk professional, sometimes a specialist external adviser brought in specifically. Coordinates across the firm, manages the interface with the skilled person, prepares management responses, and oversees remediation planning.

Chief Compliance Officer

The Chief Compliance Officer typically has a central role in any Section 166 involving compliance matters. The CCO’s ability to support the review, coordinate internal response, and drive subsequent remediation is frequently tested by a Section 166.

Chief Risk Officer

The Chief Risk Officer plays a central role in reviews involving risk management, operational resilience or prudential matters. The CRO’s engagement shapes the review’s assessment of the firm’s risk framework.

Head of Remediation

For substantial Section 166 outcomes with major remediation requirements, firms often appoint a dedicated Head of Remediation — sometimes internal, sometimes an interim senior appointment specifically for the remediation phase. This role owns the remediation programme end-to-end, manages governance and reporting, and ensures that the FCA can see credible progress against the plan.

Specialist subject-matter leads

Depending on the scope of the review, specific specialist leads may be required — a Head of Consumer Duty for a Consumer Duty s166, a Head of Financial Crime for an AML s166, a Head of Operational Resilience for an operational resilience s166. These specialists may be existing employees stepped up into the role for the review, or external appointments brought in to supplement internal capability.

Legal counsel

External legal counsel with specific FSMA and regulatory enforcement experience is typically retained throughout. The legal role is substantial — managing the process around the notice, advising on Principle 11 disclosures, supporting the firm’s response to draft findings, and advising on enforcement risk where applicable.

After the Section 166 — Remediation and Beyond

The Section 166 report is the beginning of the next phase, not the end of the matter. What happens after the report is often more consequential than the review itself.

The remediation programme

Where the review identifies issues requiring remediation, the firm must deliver a credible programme to address them. Typically:

Detailed remediation plan submitted to the FCA, covering each finding
Specific actions with owners, timelines and success criteria
Governance arrangements including board and Senior Manager oversight
Regular progress reporting to the FCA
Evidence of implementation, not just commitment
Post-implementation verification, often by internal audit or an external party

Remediation programmes typically run 12 to 36 months depending on the scale of the findings. Some run substantially longer. Major AML remediation programmes have been known to run for 5 years or more.

Follow-up supervisory engagement

After a Section 166, the firm is typically under heightened supervisory attention for an extended period. The FCA will want to see evidence of remediation completion, and may conduct subsequent reviews (including further Section 166 reviews in serious cases) to verify that issues have been addressed.

Enforcement referral

In serious cases, the Section 166 findings lead to enforcement referral. The FCA’s Enforcement division then conducts its own investigation, which can result in financial penalties, public censure, prohibitions of specific individuals, and restrictions on the firm’s authorisation. Section 166 findings can become evidential basis in enforcement cases, though the specifics of how s166 evidence is used in enforcement is a specialised legal area.

Attestations

After significant Section 166 reviews, Senior Managers may be required to provide formal attestations to the FCA confirming specific matters — that identified issues have been remediated, that specific controls are operating, that certain conditions continue to be met. These attestations carry personal legal significance under SMCR and are taken seriously by Senior Managers who sign them.

How FD Capital Places Section 166 Response and Remediation Specialists

FD Capital operates a specialist FCA-regulated firms recruitment practice. Within that practice, Section 166 response, remediation programmes and the related senior compliance and risk work is a specific and active area. The talent pool is small, demand is concentrated in periods around major supervisory cycles, and the specific combination of skills required is genuinely specialist.

Candidate pool

Our Section 166 and remediation candidate pool includes:

Senior compliance and risk professionals with direct experience of running a firm’s response to Section 166 reviews, including former Chief Compliance Officers and Chief Risk Officers from firms that have been through major reviews
Specialist remediation programme leaders with track records of delivering major programmes to FCA satisfaction
Former skilled persons themselves — senior individuals who have conducted Section 166 reviews on the other side of the table, now available to firms needing to respond to them
Specialist subject-matter experts in the areas most commonly subject to Section 166 reviews — Consumer Duty, financial crime, operational resilience, client assets, governance

Engagement models

Interim and fractional placements — the most common model for Section 166 response work. Senior interim specialists brought in to lead the firm’s response through the review and subsequent remediation, usually for 6-24 month engagements.
Permanent placements for firms recognising that a Section 166 or the risk of one requires a stronger permanent senior compliance or risk function — strengthening the CCO, CRO, Head of Financial Crime or similar roles.
Remediation programme leadership — dedicated senior resource for the post-review remediation phase, often running for 1-3 years.

Timing

When a Section 166 notice arrives, the firm’s need for senior specialist resource is typically immediate. Our engagement model is responsive to this urgency — we can typically introduce shortlists of suitable candidates within 48-72 hours for urgent interim requirements, recognising that delay in getting the right senior resource in place can materially worsen the firm’s position in the review.

Section 166 is Serious — Resource the Response Accordingly

Receipt of a Section 166 notice is not a routine regulatory event. It is a specific signal that the firm’s arrangements are under formal scrutiny, the findings will be seen by the regulator and the board, and the response will shape the firm’s future supervisory relationship in a material way. Firms that treat the review as a compliance exercise to be endured typically end up with worse findings, weaker remediation, and a more difficult path back to routine supervision. Firms that treat it as a genuine opportunity to understand and address issues — supported by the right senior resource on their side of the table — typically come out in a stronger position than where they started.

FD Capital can help you find the right senior compliance or risk leader to run your Section 166 response, lead remediation, or strengthen your permanent senior function in response to or in anticipation of regulatory scrutiny. Our specific Section 166 Review recruitment page covers our work in this area in more detail.

A Note from Our Founder — Adrian Lawrence FCA

The conversations I have about Section 166 recruitment are almost always urgent. A firm has just received a notice, or is expecting one, and the realisation sets in that the existing senior compliance or risk resource is not adequate to the scale of the response required. In every one of these conversations, the question is the same: can we find someone, quickly, who has been through this before and knows what good looks like from both the firm’s side and the regulator’s perspective? The answer is usually yes — but only because we maintain a network of specialists specifically for these situations.

The specialists who succeed in Section 166 response have a specific combination of attributes. They know the regulatory framework intimately. They understand how skilled persons think and operate. They can engage credibly with the FCA. They can work across compliance, risk, legal, commercial and board audiences simultaneously. And they have the professional standing to drive change in the firm during a period of significant internal stress. These are genuinely specialist skills, and the UK pool is small.

At FD Capital we place Section 166 response specialists, Chief Compliance Officers, Chief Risk Officers, remediation programme leaders and the specific subject-matter experts UK firms need when under regulatory scrutiny. If you have received a Section 166 notice, are anticipating one, or are strengthening your senior compliance or risk function in response to broader supervisory concern, I am happy to have a direct conversation. Every mandate I take on is handled personally, and the urgency of these situations is something we are set up for.

Hire a Section 166 Response Specialist, Chief Compliance Officer or Remediation Lead

Section 166 response, remediation programme leadership, Chief Compliance Officer and Chief Risk Officer appointments, and specialist subject-matter experts (Consumer Duty, financial crime, operational resilience, CASS). FD Capital places Section 166 and remediation specialists at UK FCA-regulated firms, typically on urgent interim or fractional bases, with permanent placements for longer-term strengthening.

Urgent line: 020 3287 9501
Email: recruitment@fdcapital.co.uk

Section 166 Response Recruitment ›
Call 020 3287 9501

Section 166 Skilled Person Reviews: The Complete UK Guide