FCA Skilled Person Reviews (Section 166): What Firms Should Expect

A Section 166 skilled person review is one of the FCA's most important and frequently used supervisory tools. Under Section 166 of the Financial Services and Markets Act 2000 (FSMA), the FCA can require a regulated firm to commission a report by an independent skilled person on any matter relevant to the firm's compliance with regulatory requirements. The review is conducted at the firm's expense, and the findings are reported directly to the FCA. For firms on the receiving end, a s166 review is a significant event that requires careful management. This article explains the process, common triggers, practical implications and how firms should respond.

What Is a Section 166 Review?

A Section 166 review is a formal direction from the FCA requiring a firm to appoint an independent third party, the skilled person, to investigate and report on specified aspects of the firm's operations, controls or compliance. The skilled person is typically an accounting, consulting, legal or forensic firm with relevant expertise. The skilled person's mandate is defined by the FCA in a scope of work document, and the skilled person reports directly to the FCA. The firm is required to cooperate fully and to provide the skilled person with unrestricted access to documents, systems, data and personnel.

Section 166 reviews are distinct from enforcement investigations (which are conducted under the FCA's own powers) and from voluntary compliance audits (which are commissioned by the firm itself). A s166 is a supervisory, not enforcement, tool, although the findings may inform subsequent enforcement action if serious breaches are identified.

What Triggers a Section 166 Review?

The FCA uses s166 reviews when it needs an independent, expert assessment of a specific area of concern. Common triggers include:

Safeguarding concerns. The FCA's recent Dear CEO letters and supervisory activity have focused heavily on safeguarding arrangements for payment institutions and EMIs. Firms with identified safeguarding weaknesses, reconciliation failures, inadequate segregation, unclear safeguarding models, are prime candidates for s166 review. The CASS 15 safeguarding rules (PS25/12), in force since 7 May 2026, give the FCA a detailed standard against which to test firms.

AML control weaknesses. Where the FCA identifies concerns about a firm's anti-money laundering framework, through periodic reporting, whistleblower reports, law enforcement intelligence or its own supervisory activity, a s166 review may be commissioned to conduct a comprehensive assessment of the firm's AML controls, transaction monitoring effectiveness and suspicious activity reporting quality.

Financial resilience. Firms exhibiting signs of financial stress, declining capital ratios, missed regulatory reporting deadlines, qualified auditor opinions or adverse market intelligence, may be subject to s166 review to assess their ongoing viability and the accuracy of their financial reporting.

Governance failures. Where the FCA has concerns about the effectiveness of a firm's board, senior management or control functions, a s166 review can assess governance structures, decision-making processes and the quality of management information.

Thematic reviews. The FCA sometimes uses s166 reviews as part of thematic supervisory work: reviewing a cohort of firms in a specific sector to assess industry-wide compliance with particular requirements.

The Section 166 Process

Step 1: Notification. The FCA writes to the firm setting out its intention to require a s166 review, the proposed scope and the reasons. The firm has the opportunity to make representations, but in practice, the FCA rarely withdraws a s166 direction.

Step 2: Skilled person appointment. The FCA chooses one of two routes. Either the firm proposes a skilled person, which the FCA must approve before the firm contracts with it, or the FCA contracts directly with a skilled person firm, often from its Skilled Person Panel. The FCA assesses expertise, resources and conflicts of interest, so a firm's existing adviser on the same matter is unlikely to be accepted.

Step 3: Scoping. The FCA, the skilled person and the firm agree the detailed scope of work. The firm may request amendments to the scope, but the FCA has the final say. The scope document defines the matters to be reviewed, the information to be examined and the reporting requirements.

Step 4: Fieldwork. The skilled person conducts the review, which typically involves document review, data analysis, interviews with key personnel, process walkthroughs and testing of controls. The firm must cooperate fully and provide timely access to all requested information. The length of fieldwork depends on the scope.

Step 5: Draft report. The skilled person provides a draft report to the FCA and the firm simultaneously. The firm has the opportunity to comment on factual accuracy, but not on the skilled person's conclusions or recommendations.

Step 6: Final report. The skilled person finalises the report, incorporating any factual corrections. The final report is submitted to the FCA and shared with the firm.

Step 7: FCA response. The FCA reviews the report and determines its supervisory response. This may range from requiring a remediation plan to imposing conditions on the firm's authorisation, requiring a Voluntary Requirement (VREQ), or, in serious cases, referring the matter for enforcement investigation.

Cost and Duration

Section 166 reviews are conducted at the firm's expense. Costs depend on scope, complexity and the skilled person chosen. FCA data shows 83 reviews commissioned in 2023/24, and firms paid £38.3 million for skilled person work in that year. In one FCA freedom of information response, 20 reviews in the pensions and retail investments sector cost firms £6.4 million across 2023/24 and 2024/25. Agreeing a tight scope at the start is the most effective way to control cost and time.

How Firms Should Respond

Cooperate fully and promptly. The firm's level of cooperation is closely observed by the FCA and influences subsequent supervisory decisions. Delays in providing information, obstructive behaviour or attempts to manage the skilled person's access will be viewed very negatively.

Appoint an internal project lead. Designate a senior individual to coordinate the firm's engagement with the skilled person: managing information requests, scheduling interviews and ensuring timely responses.

Engage legal counsel early. The findings of a s166 review may have enforcement implications. Firms should take legal advice from the outset on privilege, self-incrimination risk and the appropriate level of cooperation.

Begin remediation before the final report. Where the review identifies clear deficiencies, firms should not wait for the final report to begin remediation. Demonstrating proactive corrective action significantly improves the FCA's view of the firm.

Comment constructively on the draft report. Use the factual accuracy review period to correct genuine errors, but do not attempt to challenge the skilled person's professional judgement or recommendations, as this will not be well received.

What Firms Should Do Now

1. Assess your vulnerability to s166 review: are there known areas of concern that could attract FCA attention (safeguarding, AML, financial resilience, governance)?
2. If you are aware of compliance gaps, remediate proactively rather than waiting for supervisory intervention.
3. Ensure your document management and record-keeping are robust: a s166 review involves extensive document requests, and an inability to produce records quickly creates a negative impression.
4. Review your board and senior management governance: is decision-making documented? Is management information adequate?
5. Consider a voluntary compliance audit in high-risk areas to identify and address issues before the FCA does.

Regulatory Context and Outlook

The FCA has increased its use of s166 reviews in recent years as part of its more assertive supervisory approach. The payments sector, particularly EMIs and PIs, has been a focus of s166 activity, with safeguarding and AML controls the most common review topics. With the CASS 15 safeguarding regime in force since 7 May 2026, firms holding EMI authorisation or API authorisation should be ready to evidence daily reconciliations, monthly returns and audit findings at short notice.

Regulatory Counsel helps firms prepare for and manage FCA Section 166 reviews, including pre-review readiness assessments, project coordination and remediation planning. Contact us for a written proposal.