The True Cost of Compliance: Why Cheap Consultants Drive Up Section 166 Fees

In 2024 and 2025, more than half of firm-procured Section 166 (s166) reviews ran significantly over budget. Data obtained under the Freedom of Information Act reveals that out of 33 indirect procured reviews, 17 exceeded their financial estimates. Ten of these overruns fell between 10% and 50%, while two spiked more than 50% beyond the original quote. This financial instability rarely stems from the regulator’s demands alone. Instead, it is the direct result of underlying compliance foundations built by budget consultants that disintegrate the moment they face expert scrutiny.

Firms often choose the lowest bidder for their initial compliance framework, only to pay the difference—and then some—when the Financial Conduct Authority (FCA) orders a Skilled Person report. When a reviewer enters a firm and finds disorganized documentation, missing audit trails, or policies that were clearly copied and pasted, the hours required to verify the business’s state of affairs multiply. The firm bears 100% of these costs, which routinely range from £50,000 to over £500,000.

The State of Regulatory Costs in 2026

FCA fees are rising, but the published application and annual fees are a distraction from the real financial burden. In our analysis of mid-sized firms, the true cost of obtaining and maintaining authorisation is frequently three to five times higher than the published figures. This gap is what we call the compliance infrastructure deficit.

Research from MEMA Consultants confirms that for a typical fintech or investment firm, the application fee represents barely 10% of the actual outlay. The remaining 90% is consumed by regulatory capital, professional indemnity insurance, and the creation of a functional compliance environment. Firms that attempt to minimize this 90% by hiring ad-hoc, low-cost advisors usually find themselves spending more on remediation within 24 months than they saved during the initial setup.

Reactive compliance is exponentially more expensive than proactive maintenance. When you pay for compliance in fragments, you are not building a system; you are buying temporary reassurance. This fragmented approach is a primary driver of the high failure rate during gateway assessments, as detailed in our analysis of Consistent vs. Fragmented FCA Applications: The 2026 Authorisation Speed Test.

Why Section 166 Reviews Are Spiralling Out of Control

A Section 166 review allows the FCA to send an independent expert into your business to report on specific weaknesses. The triggers are predictable: financial crime control failures, inadequate governance, or late regulatory returns. Once the review is triggered, the firm loses control over the budget.

The 2025 FOI data suggests that firm-procured reviews—where the firm selects the Skilled Person—are particularly prone to overruns. This happens because budget-conscious firms often pressure consultants to provide the lowest possible quote to win the work. Once the review begins and the consultant discovers the true state of the firm’s internal processes, they issue variation requests.

Unlike direct-procured reviews, where the regulator imposes a strict price cap, firm-procured reviews often lack effective fee protection. If your internal systems are too disorganized for an auditor to navigate efficiently, every hour spent searching for a missing policy or a missing source-of-wealth check adds to the bill. You are essentially paying £300 to £600 per hour for a consultant to do basic administrative archeology.

The Ad-Hoc Advice Trap

Paying a consultant an hourly rate for piecemeal advice creates a false sense of economy. You might feel you are saving money by only calling them when a problem arises, but this model incentivizes reactive firefighting rather than systemic health.

Compliance in 2026 is an interconnected web. An update to the Senior Managers and Certification Regime (SMCR) has direct implications for your Consumer Duty implementation and your AML governance. If you use different ad-hoc advisors—or the same advisor for isolated tasks—you create blind spots.

Consider the hidden cost of a single missed check. If a cashier flags that source-of-funds information is missing from a file only after money has hit the client account, the cost is not just the five minutes it takes to ask the client for a bank statement. It is the compliance officer’s time to review the breach, the MLRO’s time to determine if a SAR is required, and the management time spent explaining the lapse during the next audit. If this happens consistently because your processes were designed by a budget consultant who didn't understand your specific transactional flow, the total cost of ownership (TCO) of that cheap advice becomes astronomical.

The Complexity Premium

The regulatory baseline has shifted. The FCA’s CP24/25 consultation makes it clear that fees are being uprated because assessing applications and monitoring firms requires more complex analysis than in previous years. The regulator has explicitly noted that evolving risks in money laundering and gateway assessments require significantly more time to process.

Off-the-shelf policies no longer satisfy supervisors. If you submit a Regulatory Business Plan that looks like ten other plans the case officer saw that week, it triggers immediate scrutiny. The FCA is looking for evidence that compliance is embedded in your culture, not just your filing cabinet.

Budget consultants survive by selling high-volume, low-customization templates. In 2026, these are liabilities. A template that does not reflect your actual operational reality will fail a Section 166 review within the first two days of testing. At that point, you are not just paying for the review; you are paying to rebuild your entire governance framework under the regulator’s watchful eye.

Predictions for the Next 12-18 Months

We anticipate a widening gap between firms that treat compliance as a fixed operational cost and those that treat it as a variable administrative burden. Firms using the latter approach will face higher frequency of regulatory interventions and significantly higher insurance premiums.

Market data suggests a decisive shift toward structured retainer models. Firms are realizing that the cost of a single s166 review—averaging £150,000 for a mid-sized firm—could pay for a high-level compliance partner for nearly a decade. By moving to fixed-price models, firms can cap their exposure and ensure they have the documentation ready for an audit at any time, which is the most effective way to prevent budget overruns.

Evaluating Total Cost of Ownership (TCO)

When procurement departments compare compliance solutions, they often compare the wrong numbers. They look at the monthly fee of a consultant versus the salary of a hire, ignoring the catastrophic costs of regulatory failure.

Let’s look at the financial reality of the options available to a UK firm in 2026:

Option 1: The Internal Hire
A competent compliance manager carries a base salary of £45,000 to £75,000. Once you add National Insurance, pension contributions, recruitment fees, and the cost of the tools they need to do their job, the true cost is closer to £85,000–£100,000. You also face the risk of a single point of failure; if they leave, your compliance knowledge leaves with them.

Option 2: The Ad-Hoc Consultant
Cheap upfront, but unpredictable. Hourly rates for remediation work often exceed £300. As the FOI data shows, these are the firms most likely to end up in a Section 166 review that runs 50% over budget. The TCO is unknown and potentially business-threatening.

Option 3: The Structured Retainer
Our analysis shows that even a comprehensive Gold retainer from Compliance Consultant costs less than 17% of employing a single compliance manager. For £16,140 per year (on an annual billing cycle), a firm receives 16 hours of advisory support per month, a 4-hour response guarantee, and access to over £3,600 worth of digital templates and toolkits. This model saves over £84,000 annually compared to an internal hire while providing budget certainty.

For firms wanting proactive management, our Silver retainer (£9,540 per year) provides a one-business-day response guarantee and a full suite of templates including the SMCR Responsibilities Mapping Playbook and the Consumer Duty Toolkit. You can find more on this in The Total Cost of FCA Compliance: A 3-Year Financial Analysis for Regulated Firms.

Choosing a compliance partner based on the lowest hourly rate is a false economy. The real cost of compliance is not the fee you pay your consultant; it is the cost of the review you have to pay for when that consultant’s work fails to hold up. Budgeting for quality today is the only way to avoid the six-figure penalties of tomorrow.