The complete guide to managing an FCA Section 166 review
When the Financial Conduct Authority issues a requirement notice under Section 166 of the Financial Services and Markets Act 2000, a firm faces immediate operational and supervisory scrutiny. Compliance Consultant assists regulated firms in managing this intervention, from initial scope discussions under SUP 5 to final remediation. Surviving a skilled person review requires identifying governance weaknesses before the external team arrives, controlling evidence production, and separating independent fact-finding from your internal advisory support.
Why the FCA commissions a skilled person review under SUP 5
The statutory power granted to the FCA under Section 166 of the Financial Services and Markets Act 2000 (FSMA) allows the regulator to require an authorised firm to commission an independent report by an appointed specialist. The regulator uses this mechanism when it requires independent analysis, technical assessment, or verification of data that it cannot readily obtain through standard supervisory dialogue. While often perceived as a disciplinary step, a Section 166 review is formally classified as a supervisory tool rather than an enforcement action, though findings frequently dictate whether an enforcement referral follows.
Under the FCA Handbook - SUP 5.3 Policy on the use of skilled persons, the regulator commissions reviews to serve four specific regulatory purposes:
- Diagnostic: To identify, assess, and measure risks that the regulator suspects are present within the business.
- Monitoring: To track the development of identified risks or compliance shortcomings over an extended period.
- Preventative: To limit or reduce risks before they crystallise into systemic consumer harm or market disruption.
- Remedial: To respond to risks or misconduct that have already crystallised and require formal redress or procedural reconstruction.
The FCA may also exercise powers under Section 166A of FSMA, which provides for the appointment of a skilled person specifically to collect or update information that a firm has failed to provide. While an ordinary Section 166 mandate focuses on assessing systems, controls, and past business conduct, a Section 166A mandate addresses basic operational reporting failures. In the firms we have reviewed, an unexpected Section 166 notice typically reflects mounting regulatory frustration following supervisory queries, thematic reviews, or delayed regulatory reporting.
In our analysis of regulatory interventions, firms often make the mistake of waiting for the formal notice before assessing their exposure. If your supervisory team has expressed persistent dissatisfaction with your governance arrangements, Senior Managers and Certification Regime (SMCR) mappings, or Consumer Duty monitoring data, a skilled person appointment is usually under active consideration.
The two appointment routes and commercial liability
When an intervention is confirmed, the FCA determines how the expert will be appointed under SUP 5.4 Appointment and reporting process. The regulator operates two distinct mechanisms: firm-nominated appointments and direct FCA appointments. Understanding the distinction dictates how much influence your board retains over project management, terms of reference interpretation, and professional costs.
| Appointment Route | How It Works | Firm Control Level | Key Trade-off |
|---|---|---|---|
| Firm-nominated (SUP 5.4.1G) | Firm shortlists and puts forward a preferred supplier for FCA approval, then contracts directly. | Moderate: firm selects candidate from or outside the Skilled Person Panel subject to FCA sign-off. | Faster commercial agreement, but selection must demonstrate zero conflicts of interest and technical competence. |
| FCA-appointed (SUP 5.4.1AG) | FCA selects the supplier directly through a competitive tender process and manages the engagement contract. | Low: firm receives written notice of the selected supplier and has no commercial say. | Regulator controls delivery timelines and resource commitments, but costs can escalate rapidly. |
Under both appointment routes, statutory liability for the costs rests entirely with the regulated firm. According to official FCA skilled person reviews guidance, the regulator selects providers from its established Skilled Person Panel across twelve specialist categories or appoints independent specialists where bespoke expertise is required.
While the FCA publishes indicative targets for supervisory steps, real-world execution frequently diverges. For example, while the regulator operates a target turnaround of several weeks to agree initial scoping, our experience shows the appointment and scoping phase routinely extends beyond six weeks as candidate firms conduct conflict checks. The commercial consequence for the firm is acute: hourly rates for panel specialists frequently exceed standard market consultancies, and total engagement fees can climb well into six figures for mid-sized entities.
Early engagement during the SUP 5.4 scoping dialogue is critical. Before the FCA finalises the requirement notice, senior management must challenge vague terms of reference, unreasonable sample sizes, or disproportionate timelines. Once the notice is signed, challenging the scope becomes procedurally difficult.
Preparing your governance framework before reviewers arrive
The period between the arrival of the Section 166 notice and the start of on-site fieldwork is where firms retain the greatest ability to control the review narrative. Approaching this preparation defensively is a strategic mistake; attempting to conceal operational defects damages regulatory standing. Instead, firms must identify their own procedural weaknesses before the external reviewers locate them.
Gather management information and primary records
Begin by centralising all governance and operational records relevant to the scope of the notice. This includes board packs, committee minutes, compliance monitoring logs, risk registers, and operational metrics. Assemble the factual record early:
- Board and risk committee packs covering the review period.
- Relevant compliance monitoring programme output and internal audit findings.
- Up-to-date SMCR responsibilities maps, management management responsibilities allocations, and Statements of Responsibilities.
- All correspondence with the FCA regarding the root issues cited in the requirement notice.
Review teams request significant volumes of supporting data within days of appointment. If your records are fragmented, incomplete, or contradictory, the skilled person will highlight poor record-keeping as an immediate systemic risk factor.
Conduct a rapid internal gap analysis
Commission an immediate, objective audit against the standards set out in the terms of reference. If the review focuses on governance, evaluate your board oversight, decision-making rationales, and Consumer Duty compliance records against the relevant rules in SYSC and PRIN.
For many firms, obtaining an independent perspective on their actual governance posture is essential. Undergoing an objective assessment such as our Compliance Governance Reviews - FCA Secrets Revealed allows a business to evaluate its senior management arrangements, committee effectiveness, and management information against supervisory expectations before external inspectors begin interviewing staff. If your initial review identifies serious misconduct or material risk exposure, examine whether an immediate formal notification is required under SUP 15, as addressed in our guide on drafting an FCA Principle 11 notification.
Deploy the Section 166 preparation toolkit
Proactive firms document identified deficiencies alongside concrete corrective action plans before the skilled person sets foot on site. Being able to present a structured self-assessment demonstrates a functional compliance culture. When a firm tells the skilled person, "We reviewed this process last month, identified these three control gaps, and have already initiated this corrective project," the tone of the final report shifts from supervisory alarm to monitored remediation.
Firm duties and statutory obligations during fieldwork
Once fieldwork commences, the firm operates under strict statutory obligations set out in FCA Handbook - SUP 5.5 Duties of firms. The governing principle is complete cooperation: a firm must grant the skilled person reasonable access at all reasonable times to its premises, records, personnel, and systems. Any conduct perceived as delaying, obscuring, or obstructing the review can result in immediate disciplinary measures.
A point of contractual mechanics under SUP 5.5.1R often catches leadership teams off guard:
- The contract between the firm and the skilled person must explicitly require the expert to cooperate fully with the regulator.
- The contract must permit the skilled person to report directly to the FCA if they form a reasonable belief that a material breach of regulatory rules has occurred.
- The contract must require immediate notification to the FCA if the skilled person believes the firm may no longer satisfy the threshold conditions or risks failing to remain a going concern.
These contractual terms mean the skilled person operates as an independent reporter for the regulator, not as your paid advisor. Everything shared with the skilled person can be transmitted straight to your FCA supervisory team. Personnel participating in interviews must be briefed to tell the precise truth, substantiate their statements with documentation, and refrain from off-the-record speculation.
Establish a disciplined document management protocol. Designate a single point of contact (SPOC) through whom every data request, questionnaire, and interview schedule flows. Log every document provided to the review team, maintain mirror files of all evidence packs, and ensure an internal observer attends all interviews to take contemporaneous notes of questions asked and responses given.
What firms get wrong during skilled person reviews
In our advisory work supporting regulated firms through contentious supervisory interventions, we observe management teams repeatedly making two fundamental errors during Section 166 reviews.
Treating the skilled person as an advisor
Because the firm pays the skilled person's invoices, executives often confuse the relationship with standard management consulting. They ask the skilled person for advice on how to fix broken controls or expect informal coaching during fieldwork interviews.
This approach carries severe risk. The skilled person's legal remit is purely evaluative: they are contracted to test evidence, assess systems against FCA rules, and report factual findings to the regulator. If you disclose unquantified operational risks to the skilled person hoping for advice, they will not fix them; they will document them as uncontrolled risks in their interim report to the FCA. Use external, independent advisory specialists for strategic counsel, and maintain a strictly professional, formal relationship with the appointed skilled person.
Underestimating the resource drain on business-as-usual operations
A Section 166 review consumes significant executive time. Review teams request transaction samples, governance documentation, email trails, and multiple rounds of executive interviews. Senior compliance officers and MLROs quickly find their entire week swallowed by managing data requests, leaving routine monitoring and day-to-day regulatory operations unmanaged.
When compliance teams abandon their day-to-day duties to service a Section 166 review, routine monitoring lapses, complaints go unreviewed, and new control failures occur. Engaging outsourced retainers can stabilise operational workloads. Our Compliance Retainer Services for FCA-regulated Firms provide dedicated advisory capacity to absorb business-as-usual oversight while your leadership manages the review. For instance, our Gold retainer (Compliance Partner) tier includes 16 hours of dedicated advisory support per month alongside our Section 166 Preparation Toolkit (standalone retail value £349), helping senior managers maintain control without letting core compliance tasks drop.
Implementing recommendations and supervisory close-out
The delivery of the final Section 166 report marks the conclusion of the independent review, but it begins the most delicate phase of regulatory supervision. The FCA will review the findings, categorise the identified risks, and issue a formal supervisory response letter outlining mandatory remediation steps.
Firms that establish credibility at this stage structure their remediation around the "engage, execute, embed" methodology:
- Engage: Establish precise regulatory requirements before remediation infrastructure is built, confirming that all board members and operational leads understand the exact findings.
- Execute: Drive process, technology, and organisational change in parallel with infrastructure development, allocating designated project managers and accountable SMF leads to each finding.
- Embed: Integrate compliance adjustments into real-world operations through continuous testing and scaling, confirming that the new systems function reliably under live commercial conditions.
Drafting a defensible remediation plan
The FCA expects a formal Remediation Plan or Corrective Action Plan (CAP) within a defined timetable following the final report. This document must avoid vague commitments such as "we will enhance our oversight." Every finding must be linked to a root cause, an accountable Senior Management Function (SMF) holder, a concrete action item, and an auditable evidentiary deliverable.
Include clear milestones and independent validation steps. If a finding highlighted deficiencies in your anti-money laundering transaction monitoring, your remediation plan must specify how parameters were recalculated, how staff were retrained, and when an independent audit will verify the new controls.
Updating the permanent compliance monitoring programme
A remediation plan cannot sit in isolation as a temporary project. To satisfy the FCA that risks will not recur once supervisory pressure abates, firms must update their permanent Compliance Monitoring Programme (CMP).
Feed the skilled person's findings directly into your annual compliance risk assessment and risk registers. If the review identified gaps in product governance or fair value assessments under Consumer Duty, your ongoing compliance monitoring cycles must introduce quarterly testing of those specific workflows. Demonstrating to the regulator that the findings have permanently altered your second-line surveillance is the most reliable way to bring the Section 166 supervisory intervention to an official close.
Preparing your firm for regulatory review
Managing a Section 166 skilled person review demands decisive governance, rigorous evidence management, and senior compliance expertise. To discuss an independent governance review or retained advisory support from our team of senior associate consultants overseen by founder Lee Werrell, call our UK team on 0800 689 0190, reach our international line on 020 8243 8620, or book a discovery call with Compliance Consultant.