A section 166 review is not an external audit commissioned for the firm's own assurance. It is a statutory supervisory process in which the FCA defines the regulatory purpose and expects access to reliable evidence. The firm's task is to respond openly, preserve the integrity of the record and maintain control of its own governance and remediation.
The legal power is in section 166 of the Financial Services and Markets Act 2000. The FCA's operational framework is in SUP 5 of the Handbook. Section 166A is a distinct power for appointing a skilled person to collect or update information. It should not be described as merely a procedural version of section 166.
Why the FCA uses a skilled person
SUP 5.3 says the purposes can be diagnostic, monitoring, preventative or remedial. A report may provide information, analysis, assessment, expert advice, recommendations or assurance. The FCA considers the circumstances of the firm, available alternatives, legal and procedural factors, its objectives, cost and its own resources when deciding whether to use the tool.
That breadth means a review can address a focused control or a connected set of governance and outcome concerns. The terms of reference, statutory notice and FCA communications are the controlling documents. Firms should avoid relying on market anecdotes about what a "typical" review covers or how long one takes.
The FCA publishes information about skilled person reviews and commissioned reports. Current quarterly data can provide context, but it does not predict the scale, cost or duration of an individual case.
Appointment and accountability
The FCA describes two appointment routes. A regulated firm may put forward a preferred skilled person for FCA approval and then contract with that provider. Alternatively, the FCA may contract directly with the skilled person. In either route, the FCA determines what is appropriate and remains the recipient of the regulatory work.
SUP 5.4 sets out matters relevant to appointment, scope and reporting. Capability, capacity, conflicts, independence and access to relevant expertise matter. Commercial governance is legitimate, but it must not compromise the scope or the skilled person's independence.
The firm should appoint a senior accountable sponsor and a day-to-day response lead. Their responsibilities are different:
- the sponsor owns decisions, resources, regulatory communication and board escalation;
- the response lead controls requests, evidence production, dependencies, issues and the audit trail; and
- subject-matter owners explain the control and are accountable for correcting identified weaknesses.
Legal advisers can help manage privilege and accuracy, but a legal workstream is not a substitute for operational ownership.
The first ten working days
Early discipline has a disproportionate effect on the review. The firm should establish a controlled mobilisation process as soon as the requirement is received.
| Workstream | Immediate action | Evidence of control |
|---|---|---|
| Governance | Confirm sponsor, response lead, committee route and decision rights | Approved terms of reference for the internal response and meeting record |
| Scope | Parse every question, period, entity, product and population | Scope map with ambiguities and agreed clarifications |
| Evidence | Preserve relevant records and identify system owners | Legal hold or preservation record, data map and evidence register |
| Requests | Create one intake and release process | Request log, owner, due date, reviewer and delivery receipt |
| People | Identify interviewees and operational dependencies | Availability plan and factual briefing protocol |
| Cost | Set invoice, forecast and change-control governance | Budget owner, forecast and challenge log |
This is also the point to identify business-as-usual risks. A firm cannot allow the response project to weaken the very controls under review. Resource decisions should account for continued customer support, compliance monitoring and incident escalation.
Evidence control without obstructing the review
SUP 5.5 addresses the firm's duties, including cooperation and access. A controlled evidence process should improve completeness and traceability, not create a barrier between the skilled person and the facts.
Each delivery should record the request, source system, extraction method, period, population, owner, reviewer, transformations and date supplied. If data is incomplete or definitions changed during the period, say so explicitly. Silent remediation of a dataset before delivery can damage confidence in the entire evidence set.
Documents need version control. Policies, committee papers and management information should be supplied in the version that applied during the review period, with later versions identified separately. The difference between "designed now" and "operating then" is often central to the assessment.
Interview preparation should be factual. Staff can be told the purpose, process and importance of answering accurately. They should not be coached towards a preferred account. Where an interviewee does not know or needs to check a fact, the accurate response is to say so and follow up through the agreed process.
From emerging findings to durable remediation
The firm does not need to wait for a final report before containing an evident risk. It should, however, distinguish immediate containment from verified root-cause remediation and keep the FCA informed where appropriate.
A defensible finding record connects:
- the evidence and affected requirement or outcome;
- the population and potential customer or market impact;
- the root cause, including governance or incentive drivers;
- containment and any historic review or redress decision;
- the permanent action, accountable owner and due date; and
- the independent test that will demonstrate effectiveness.
Closing an action because a policy was rewritten is rarely sufficient. Effectiveness testing should examine live operation and outcomes after implementation. The board should understand which risks remain open, what evidence supports closure and whether the remediation has introduced new operational or customer risks.
Mistakes that increase regulatory risk
Defensiveness is not the same as disciplined challenge. Firms may correct factual errors, clarify scope and explain contrary evidence. The risk arises when challenge is unsupported, disclosure is partial or the firm treats each request as an isolated negotiation.
Other avoidable failures include parallel teams supplying inconsistent data, re-creating historic evidence, losing the link between findings and affected populations, presenting untested planned controls as complete, and allowing overdue remediation to remain buried in a project plan rather than escalated through governance.
Cost and timetable assumptions also need care. Neither legislation nor SUP 5 creates a standard price or duration for every review. Published figures and peer experience are not a safe basis for promising a board that the process will finish within a particular number of months.
Readiness before a notice arrives
Section 166 readiness is principally good regulatory operations. A firm should be able to identify owners for material controls, reconstruct decisions, extract reliable populations, reconcile management information to source systems and show that remediation is tested rather than self-certified.
A targeted readiness exercise can test one high-risk theme by asking the questions a third party would ask: What is the requirement? Who owns it? What evidence shows design and operation? What are the actual customer outcomes? What known limitations remain? Can the firm reproduce the answer consistently?
MEMA's compliance outsourcing and assurance support can help firms establish that evidence chain or mobilise a controlled response. The scope should be based on the FCA requirement and the firm's facts, not a generic section 166 document pack.
Primary sources checked
- FSMA 2000, section 166: Reports by skilled persons
- FSMA 2000, section 166A: Appointment to collect or update information
- FCA Handbook, SUP 5: Reports by skilled persons
- FCA: Skilled person reviews
This explainer is general information, not legal advice. A firm should act on the specific statutory notice, terms of reference and FCA communications relevant to its review.
Frequently Asked Questions
What is a section 166 review?
Section 166 of the Financial Services and Markets Act 2000 allows the FCA to require a report by a skilled person on matters about which it could require information under its statutory powers. SUP 5 explains the FCA's policy, appointment process and the firm's duties. It is a supervisory tool, although its findings may inform further regulatory action.
Who appoints the skilled person?
The FCA decides which appointment route is appropriate. It may require the regulated firm to put forward a suitable skilled person for FCA approval, or the FCA may contract with and appoint the skilled person directly. The FCA describes both routes on its skilled person reviews page.
Who pays for the review?
The FCA's rules allow it to require the regulated firm to pay the costs as a fee, including where the FCA contracts directly with the skilled person. Firms should establish cost governance, invoice review and change control at the outset without obstructing the work or assuming that cost concerns alter the required scope.
Is section 166A the same as a section 166 report?
No. Section 166 concerns reports by skilled persons. Section 166A is a separate power to appoint a skilled person to collect or update information. The FCA lists them as two types of skilled person review, and firms should identify which statutory power and SUP requirements are engaged.
Need help implementing this?
Our regulatory consultants can help your firm meet FCA requirements with practical, evidence-based implementation support.
Book a Free Consultation