A section 166 review — the "skilled person report" — is the FCA or PRA requiring an independent expert to examine part of a regulated firm and report back, at the firm's expense. It sits in the uncomfortable middle of the regulatory toolkit: more serious than a supervisory letter, short of enforcement — and often the fork in the road between the two. Around 31 were commissioned in the last reported year, with financial crime the largest single subject, and for the firms involved the review typically becomes the defining compliance event of their next eighteen months. Here is how the process actually runs, and how firms come through it well.
What a s166 is — and what it signals
Under section 166 FSMA, the regulator can require a report by a skilled person — an accountancy firm, consultancy or law firm with the relevant specialism — on more or less any aspect of a firm's business: its financial crime controls, safeguarding arrangements, governance, prudential position, the fairness of its customer outcomes. It is used diagnostically (the regulator wants independent facts), remedially (verify the fixes the firm promised), and preventatively; a related power (s166A) can even install a skilled person to collect information on an ongoing basis. It is distinct from routine information gathering (s165) and from formal investigations (s167) — a s166 is not an allegation of wrongdoing. But nobody should mistake the signal: the regulator has doubts it wants tested by someone it trusts, and how the firm engages with the review shapes everything downstream. Recent years' subject mix tells you where the doubts concentrate: financial crime first by a distance, then controls and risk management, governance and accountability, conduct, prudential, safeguarding.
The process, step by step
It starts with a requirement notice: purpose, scope, timetable, report format. Scope is the negotiation that matters most — a precisely-drawn scope produces a useful, affordable review; a baggy one produces an archaeology project billed by the hour. The skilled person is then appointed, usually nominated by the firm from the regulator's panel (organised into subject-matter lots) and approved by the regulator; in urgent or sensitive cases the regulator appoints directly and the report goes straight to it. Either way, independence is structural: the skilled person owes its duty to the regulator, must report matters of material significance directly, and cannot be managed into softer findings.
Then the review itself — document requests, interviews, file testing, control walkthroughs — followed by a draft report on which the firm can comment for factual accuracy (not conclusions), and delivery to the regulator with findings and typically a remediation plan. The regulator's response ranges from closure, through monitored remediation, to enforcement referral where the findings are bad enough. Costs are the firm's throughout, commonly six figures and, for large or contested scopes, seven; the fee quote deserves the same scrutiny as the scope.
Handling one well
Having sat on the skilled-person side of these, the difference between firms that emerge stronger and firms that emerge into enforcement is behavioural more than technical:
- Engage on scope immediately — with advisers — while it is still drafting rather than history; clarity about what is in and out protects both the budget and the findings;
- Choose the skilled person deliberately: sector fluency and credibility with the regulator matter more than brand, and the firm nominates for a reason;
- Resource the review like a project — a senior owner, a single evidence channel, realistic internal deadlines. Firms that drip-feed documents late convert a diagnostic into a suspicion;
- Fix things during the review, not after it. Remediation already underway when the report lands reads as a firm that manages itself; the report saying so is worth more than any comment on the draft;
- Never spin. The skilled person triangulates everything, and a firm caught presenting is a firm whose every other assertion now gets tested twice.
Before the letter ever arrives
Most s166s are foreshadowed — a supervisory visit that went badly, data submissions that don't reconcile, a Consumer Duty or safeguarding question answered thinly. The cheap insurance is doing the regulator's review before the regulator does: an independent health check of the area your supervision history says is your weak point, on your own scope and budget, with remediation you control. A firm that can show the regulator a completed independent review and a worked remediation plan frequently avoids the statutory version altogether — and the same work builds the assurance framework the regulator wanted evidence of in the first place.
Acumon works on both sides of this territory — independent reviews of financial crime frameworks and AML controls, CASS and client assets, safeguarding, and outsourced internal audit for regulated firms — alongside remediation support where a review is already running. If your supervisory correspondence has developed a theme, the voluntary review is the version of this story you get to control.