A section 166 review is the most serious supervisory tool short of enforcement that most firms will encounter. It is not a criticism to be argued away. It is a process to be managed, and the firms that manage it well are those that understand what is fixed, what is negotiable, and what the FCA is actually testing.
What a section 166 requirement is
Section 166 of the Financial Services and Markets Act 2000 allows the FCA to require a firm to provide a report by a skilled person, or to require the firm to appoint a skilled person to produce that report. The firm pays the cost in both cases.
There are two routes.
Firm-appointed. The FCA issues a requirement notice, the firm selects a skilled person from the relevant panel, and the FCA approves the appointment and the scope.
Regulator-appointed. The FCA appoints the skilled person directly and contracts with them. The firm still pays. This route is used where independence concerns are material.
What triggers a review
Section 166 is used where supervision needs assurance it cannot obtain from the firm's own reporting. Common triggers include the following.
- Persistent failures identified through supervisory correspondence that the firm has not closed.
- A material breach self-reported under Principle 11 where the firm's own root cause analysis is not credible.
- Concerns about financial crime systems and controls, safeguarding of client or relevant funds, or prudential resilience.
- Rapid growth that has outpaced governance, particularly in payments, e-money and cryptoasset firms.
- Thematic or multi-firm work that has identified the firm as an outlier.
| Review lens | What the skilled person tests | Typical evidence requested |
|---|---|---|
| Governance and oversight | Board effectiveness, MI quality, challenge | Board packs, minutes, terms of reference |
| Financial crime | Risk assessment, monitoring, screening, reporting | BWRA, alert samples, SAR records, MLRO reports |
| Safeguarding | Records, reconciliation, resolution of shortfalls | Daily reconciliations, bank statements, audit reports |
| Conduct and Consumer Duty | Outcomes for customers, vulnerability handling | Complaints data, outcome testing, product reviews |
| Prudential | Capital, liquidity, wind-down planning | ICARA or equivalent, forecasts, wind-down plan |
The scoping period is the leverage point
Once the requirement notice is final, the scope is effectively fixed for the duration. Before it is final, the firm can and should engage on three things.
Precision of scope. Broad wording such as "review of governance arrangements" produces an unbounded review. Specific wording tied to identified concerns produces a review that can be completed and closed.
Period under review. A look-back that starts at the date of a known control change is materially different from an open-ended historic review.
Sequencing. Where the firm has already commissioned its own independent review of the same area, that work can sometimes reduce duplication if it is disclosed early and is of adequate quality.
Firms that treat the scoping period as an administrative formality lose the only opportunity to shape the cost and duration of the exercise.
Managing the review
Establish a single channel
All information flows through one named coordinator with authority to task the business. Multiple uncoordinated responses produce inconsistencies, and inconsistencies produce findings.
Treat every submission as a regulatory submission
The skilled person reports to the FCA. Draft documents, informal explanations and interview answers all form part of the evidential record. Accuracy matters more than speed, and where a fact is not known it should be stated as not known.
Fix what you find, during the review
Remediating a control weakness while the review is live is not an admission. It is evidence of a functioning governance response, and it is routinely reflected in the report.
Keep the board informed and on the record
The board should receive structured updates and should minute its decisions. A section 166 report that describes a passive board creates a second problem on top of the first.
Cost, duration and what follows
Cost is driven by scope breadth, data quality and the number of interviews. Firms with clean, reproducible records pay materially less than firms whose data has to be reconstructed. Duration is typically three to nine months from requirement notice to final report.
What follows the report matters more than the report. The FCA will expect a remediation plan with owners, dates and defined evidence of closure, and will expect the board to track it. Where a firm cannot demonstrate closure, the realistic outcomes are a further requirement, a voluntary requirement on permissions, or referral to enforcement.
Our guidance on FCA policy monitoring and remediation and on regulatory health checks covers the pre-emptive work that reduces the likelihood of a section 166 in the first place.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
We support firms through skilled person reviews, including scope negotiation support, evidence preparation and quality control, remediation planning, board reporting and closure evidence, and pre-emptive independent reviews designed to identify and close weaknesses before supervision does.
Contact our regulatory team at info@regulatorycounsel.co.uk.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently Asked Questions
It is a review commissioned under section 166 of FSMA 2000 in which the FCA requires a firm to obtain a report from an independent skilled person on a defined matter. The skilled person reports to the FCA and the firm pays the cost.
Cost depends on scope, look-back period and data quality, and commonly reaches six figures for a substantive review. Firms with complete and reproducible records incur materially lower costs than those requiring data reconstruction.
The firm cannot refuse the requirement, but it can and should engage during the scoping period on the precision of the scope, the period under review and any overlap with work the firm has already commissioned.
Most reviews run three to nine months from requirement notice to final report, with longer timelines where the look-back period is extensive or records must be reconstructed.
Not automatically. Section 166 is a supervisory tool. Enforcement risk increases where the review identifies serious failings that the firm has not remediated, or where the firm’s conduct during the review raises further concerns.
Yes. Remediating identified weaknesses during the review demonstrates a functioning governance response and is normally reflected in the report and in the FCA’s assessment of what follows.