What Is a Section 166 Review? FCA Skilled Person Guide

A Section 166 review is one of the more serious things that can happen to a regulated firm short of enforcement. It is not an investigation, and it is not a punishment — but it is expensive, disruptive, and the way a firm handles it shapes the supervisory relationship for years afterwards.

s166 and s166A: Two Different Powers

Published guidance frequently treats these as one thing. They are not, and the distinction determines who you are contracting with.

Section 166 — the firm appoints

The more common route. The regulator requires the firm to obtain a report, and the firm appoints the skilled person with regulatory approval. In practice a firm is usually asked to propose several candidates with a preferred choice. The contract is between the firm and the skilled person, though the report is written for the regulator.

Section 166A — the regulator appoints

Introduced in 2013. Here the FCA appoints the skilled person directly, contracting with them itself, where it wants closer control of the engagement. The firm still bears the cost.

The Skilled Persons Panel and Lots

The FCA maintains an approved Skilled Persons Panel — a list of firms and individuals competent to carry out this work — divided into “Lots” covering different regulatory specialisms, such as client assets, financial crime, governance and risk management, and conduct of business. The panel is re-tendered periodically.

Where the regulator nominates a skilled person, it selects from the panel. Where the firm nominates, it is generally expected to select from the panel too, since the choice requires regulatory approval and the FCA has made clear it expects panel firms to be used where possible.

The practical implication for a firm: your influence lies in which panel firm is appointed, not whether one is. That choice matters — different firms bring different sector depth, different rates, and different working styles, and you will be living with them for months.

What Triggers a Review

Section 166 is a diagnostic and supervisory tool rather than a sanction. It is used where the regulator wants independent, evidenced assurance on something it cannot resolve through normal supervision.

• Systems and controls weaknesses — particularly where issues have recurred after previous assurances.
• Financial crime and AML — customer due diligence, transaction monitoring, suspicious activity reporting.
• Client assets — CASS compliance, segregation, reconciliation and trust documentation.
• Conduct and customer outcomes — suitability, complaints handling, product governance, Consumer Duty.
• Governance and senior management oversight — whether the board and SMFs are actually exercising the oversight they claim.
• Prudential concerns — capital adequacy, liquidity, financial resilience.
• Operational resilience and technology — including cyber and third-party dependency.
• Rapid growth or business model change outpacing the firm’s control environment.

Recurrence is the common thread. A firm that has previously given assurances and not delivered on them is considerably more likely to receive a Requirement Notice than one encountering a problem for the first time.

How the Process Runs

1. Draft Requirement Notice

The regulator issues a draft notice setting out the background, the concerns and the proposed scope. This is the firm’s main opportunity to engage on scope — to correct factual misunderstandings and to raise proportionality where the proposed scope is wider than the concern warrants. Firms that treat the draft as a formality forgo real influence.

2. Final notice and terms of reference

Once settled, the scope is fixed in the terms of reference. The skilled person works to that document, not to what the firm would prefer to discuss, and not to what the firm thinks the real issue is.

3. Appointment

Under s166 the firm proposes candidates for approval; under s166A the regulator appoints. Either way the skilled person must be independent of the firm, which can exclude an incumbent auditor or long-standing adviser.

4. Fieldwork

Document review, systems access, sample testing and interviews with staff at all levels, including senior managers. This is the disruptive phase and it typically runs for months rather than weeks.

5. Reporting

Interim findings are usually shared, allowing the firm to correct factual errors — which is worth doing carefully, because the final report is written for the regulator and becomes the evidential baseline for whatever follows.

6. Remediation

The firm addresses the findings, usually against an agreed plan and timetable. This is where most of the cost and effort actually sits, and it frequently extends well beyond the review itself.

What Happens Afterwards

The report is not the end of the matter; it is the foundation for what the regulator does next.

• Agreed remediation — the most common outcome, with the firm working to a plan and reporting progress.
• A voluntary requirement (VREQ) — the firm agrees to a restriction or obligation, often including attestations from named senior managers confirming remediation has been completed.
• An imposed requirement under section 55L FSMA — where the regulator does not rely on voluntary agreement.
• Referral to enforcement — where findings are serious. The skilled person’s report provides independent, professional evidence that carries considerable weight.

How Firms Should Respond

Engage on the draft scope

The single highest-leverage action available. Once terms of reference are final, the scope is fixed.

Run your own assessment first

Where time permits, understanding your own weaknesses before the skilled person finds them allows remediation to begin immediately and demonstrates the right posture. Findings the firm had already identified and started addressing read very differently from findings that came as a surprise.

Give it proper resource

A skilled person review generates substantial demand for document production, data extraction, interview preparation and remediation delivery. Firms that absorb this into business-as-usual typically find both the review and normal operations suffer.

Be accurate rather than defensive

Correct factual errors in interim findings rigorously. Do not attempt to argue away well-evidenced conclusions — regulators treat the response to a review as a direct indication of culture and governance, and a defensive posture is noted.

Keep the senior managers genuinely engaged

Delegating a s166 entirely to compliance is a recognisable error. The relevant SMF holders should be visibly involved, because their oversight is frequently part of what is being examined.

The Resourcing Question

This is the part most guidance omits, and it is where firms most often struggle.

A review and its remediation create a sudden, temporary demand for capability the firm does not have spare: people who can produce and quality-assure evidence at pace, run a remediation programme, rebuild a control framework, or strengthen a function the report has criticised. That demand is real, urgent, and finite — which makes it poorly suited to permanent recruitment and well suited to interim appointment.

It also frequently exposes an underlying capability gap. Where a report criticises governance, financial control or regulatory reporting, the answer is rarely more process; it is usually someone more senior owning it. Firms that treat remediation purely as a project, without addressing the capability that allowed the issue to arise, tend to find the same theme reappearing at the next supervisory engagement.

Frequently Asked Questions

What is a Section 166 review?

An independent report on a defined area of a regulated firm’s activities, required by the FCA or PRA under section 166 of the Financial Services and Markets Act 2000 and carried out by an approved “skilled person”. The regulator sets the scope; the firm pays. It is a supervisory and diagnostic tool rather than an enforcement action, though findings can lead to enforcement.

Who pays for a Section 166 review?

The firm, in every case — whether the firm appoints the skilled person under s166 or the regulator appoints directly under s166A. Costs are typically significant, as the work is usually undertaken by major accountancy, consulting or law firms.

What is the difference between s166 and s166A?

Under s166 the firm appoints the skilled person with regulatory approval and contracts with them directly. Under s166A, introduced in 2013, the regulator appoints and contracts with the skilled person itself. The firm pays under both. In practice the difference is largely procedural, but it determines who holds the relationship.

Can a firm choose its own skilled person?

Under s166, a firm normally proposes candidates for regulatory approval, and is generally expected to select from the FCA’s Skilled Persons Panel. The skilled person must be independent of the firm, which may rule out an existing auditor or long-standing adviser.

How long does a Section 166 review take?

It varies with scope, but months rather than weeks is the norm for fieldwork and reporting, and remediation frequently extends considerably longer. Firms should plan on the basis that the total commitment substantially exceeds the review period itself.

Does a Section 166 review mean enforcement action?

Not necessarily. Most reviews result in agreed remediation rather than enforcement. However, the report is independent and evidenced, so where findings are serious it can form the basis of a requirement under section 55L, a voluntary requirement with senior manager attestations, or a referral to enforcement.

Is a Section 166 review made public?

The report itself is not routinely published. However, any resulting requirement may appear on the Financial Services Register, and enforcement outcomes are published. Firms should also consider disclosure obligations to lenders, investors and counterparties.

References & Further Reading

• FSMA 2000, section 166 — Reports by skilled persons
• FCA Handbook — SUP 5: Reports by skilled persons
• ICAEW TECH 01/18 FSF — Guidance for Skilled Person Reviews
• Financial Conduct Authority

This guide is general information on the FCA’s skilled person regime, not legal or regulatory advice. Firms receiving a Requirement Notice should take specialist legal and regulatory advice. Correct at the time of writing — refer to SUP 5 and current FCA publications for the position that applies to you.

Adrian Lawrence FCA

Founder & Managing Director, FD Capital

Adrian Lawrence FCA is the founder of FD Capital and a Fellow of the Institute of Chartered Accountants in England and Wales (ICAEW). He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience as a Chartered Accountant and finance leader working with private, PE-backed and owner-managed businesses across the UK. He founded FD Capital in 2018 and works closely with FCA-regulated firms on senior finance, risk and compliance appointments.

→ View Adrian’s ICAEW profile