Skilled Person Reviews (Section 166): What Firms Must Know

A skilled person review, often called a section 166 or s166 review, is a report by an independent expert, such as an accountant, lawyer or compliance consultant, that the FCA requires a firm to provide or commissions itself, normally at the firm's cost. It lets the FCA test a risk, check a firm's own remediation or gain specialist analysis without carrying out all the work itself.

What is a section 166 skilled person review?

Under section 166 of the Financial Services and Markets Act 2000, where the FCA has required or could require an authorised person to provide information or documents about a matter, it may instead give written notice requiring the firm to provide a report from a skilled person, or appoint a person itself to report. The notice can specify the form of the report. The appointee must appear to the FCA to have the necessary skills, and if the firm makes the appointment, the FCA must nominate or approve the appointee.

There are two related tools, as the FCA describes on its skilled person reviews page:

• Section 166 reports: a skilled person reports on a matter, such as a control framework, a conduct issue or the effectiveness of remediation.
• Section 166A appointments: a skilled person collects or updates information. SUP 5.3.2AG says this is typically prompted where the FCA considers a firm has breached a requirement to collect and keep specified information up to date.

The FCA must formally agree to the appointment either way, and the person concerned, along with anyone who provides or has provided services to it on the matter, must give the skilled person "all such assistance as the appointed person may reasonably require" (s166(7)).

When does the FCA use a skilled person?

SUP 5.3 sets out the FCA's policy. It says the tool may be used for four purposes: diagnostic (to identify, assess and measure risks), monitoring (to track identified risks), preventative (to limit risks before they crystallise) and remedial (to respond to risks that have). Typical triggers listed in SUP 5.3.2G include a specific information requirement, a need for expert advice, a regulatory return needing assurance, a risk mitigation programme, an event at the firm or routine monitoring.

In deciding whether to use s166, the FCA weighs several factors (SUP 5.3.3G):

• the firm's circumstances, including co-operation, history of similar issues, quality of systems and records, objectivity, conflicts of interest and available expertise;
• alternative tools, such as informal requests or visits, information requests under s165, or investigators under ss167 and 168;
• legal and procedural matters, for example whether another power is a better fit;
• the objectives of its enquiries, noting that s166 suits expert analysis or recommendations while historic or enforcement evidence points to other powers; and
• cost, and its own resources and expertise.

The FCA's published data shows how it uses the power. Its page Use of our skilled person reports in 2025/26, first published on 9 July 2026, reports that it used s166 in 31 cases: five where the FCA appointed the skilled person and 26 where the regulated firm did. Eleven skilled person firms were used. By market, insurance had the most reports (7), followed by wholesale sell-side (6), consumer investments (5) and retail banking (5). By subject area, financial crime was the largest category (12 reports), ahead of controls and risk management frameworks (8) and governance, accountability, strategy and culture (4). The FCA completed 19 reviews in the year at a total cost of £47.6m, an average of £2.5m each. It notes that cost reporting changed in 2025/26 (it now reports completed reviews), so earlier years are not directly comparable.

Who pays and who chooses the skilled person?

Under SUP 5.3.8G, if the firm appoints the skilled person, the firm pays. If the FCA appoints, it requires the firm to pay under FEES 3.2.7R. The FCA's page confirms it can require the regulated firm to pay the costs of the review. It also considers whether the firm benefits, whether the work was the firm's own responsibility, poor records, whether the firm can or will remedy problems, and the probability and seriousness of breaches (SUP 5.3.9G).

The FCA picks the route for each review. It either approves a firm chosen by the regulated firm before the firm contracts with it, or contracts directly, using a panel of suppliers organised by area of expertise. A firm contracting with a skilled person is not required to pick from the panel. It may nominate any suitable supplier, subject to FCA approval.

SUP 5.4.8G sets out what the FCA considers when approving a candidate: the skills needed for the task, the ability to meet the timetable, relevant specialist knowledge, any professional difficulties or conflicts of interest, and sufficient detachment. Where cost-effective, it may accept someone who previously advised the firm, such as its auditor (SUP 5.4.9G). If you need to hire an expert for a review, prepare a short list against those five tests and be ready to explain your choice.

How the process runs, step by step

1. Pre-notice discussion. The FCA normally discusses the need with the firm first, including alternatives, scope, who appoints and who is appointed, and likely cost (SUP 5.4.2G to 5.4.5G).
2. Written notice. The notice sets out the purpose, scope, timetable, required content and format (SUP 5.4.3G).
3. Appointment and approval. The firm proposes a skilled person, or the FCA nominates one, and the FCA agrees in advance. The FCA may ask to see the draft contract before it is signed (SUP 5.5.7G).
4. Contract. Under SUP 5.5.1R and 5.5.5R the contract must require and permit the skilled person to co-operate with the FCA, report certain concerns to it, work to FCA deadlines and waive confidentiality that would limit that reporting. It must be governed by UK law, give the FCA enforcement rights and be irrevocable without FCA consent.
5. Fieldwork. The firm must provide all reasonable assistance to the skilled person (SUP 5.5.9R). That includes access to records, information and explanations, and to its auditor (SUP 5.5.11G). The firm should also take reasonable steps to make sure its appointed representatives and tied agents assist (SUP 5.5.10G), and certain service providers, including material outsourcing providers, must assist (SUP 5.5.13G).
6. Progress updates. For substantial reports, the skilled person should provide periodic updates and the firm should normally be kept informed (SUP 5.5.4G). The FCA may also ask for interim reports, source data, working papers and draft reports (SUP 5.5.2G).
7. Reporting. If the firm appointed the skilled person, the report normally goes to the FCA through the firm, which can comment before submission. If the FCA appointed, the skilled person reports directly to the FCA (SUP 5.4.10G and 5.4.10AG). The FCA may meet the firm and skilled person together, or the skilled person alone, to discuss the final report (SUP 5.4.13G).
8. Follow-up. The FCA decides what to do with the findings. Firms should be ready to produce and track a remediation plan. Our guidance on writing testable remediation actions and demonstrating operating effectiveness is relevant here.

Confidentiality and legal privilege

The skilled person is bound by the confidentiality provisions of Part XXIII FSMA and may pass on confidential information only with lawful authority (SUP 5.6.1G). Two statutory limits are noted in SUP 5.6.2G: banking confidentiality under s175(5), and section 413, under which protected items cannot be required to be produced, disclosed or inspected. Get legal advice early on how privilege will be handled before documents are shared.

How to prepare and what good looks like

• Give senior decision-makers access. The review will test governance and accountability. Plan for the skilled person to interview board members and senior managers and make sure the SMFs involved are briefed.
• Nominate a single owner. Someone senior should run the review internally, manage requests and keep a log of everything provided.
• Organise evidence before you start. Policies, MI, committee papers, testing results and remediation records should be easy to find. Our guide to organising regulatory evidence sets out an approach.
• Agree scope in writing. Pin down the questions, the period, the sample sizes and the deliverables, and confirm what the FCA expects the report to cover.
• Manage cost. The FCA expects an initial estimate and the final cost (SUP 5.5.8G). Track against the estimate and raise changes early.
• Be candid. A review is a supervisory tool; the FCA considers a firm's co-operation and objectivity (SUP 5.3.4G). Disputes about facts are easier to resolve early than at report stage.

For a more detailed readiness checklist, see our explainer on section 166 readiness.

How MEMA can help

MEMA helps firms prepare for and manage s166 reviews, and responds to the findings. See our FCA supervisory response service and the section 166 readiness guide.