FCA Skilled Person Reviews (Section 166) — What Payment Firms Need to Know

A section 166 skilled person review is one of the FCA's most powerful supervisory tools. It allows the regulator to obtain an independent, expert assessment of a firm's operations, controls or financial position — at the firm's expense. For payment institutions and EMIs, s166 reviews have become increasingly common as the FCA intensifies its supervision of the sector. This guide explains the process, common triggers and how to manage a review effectively.

What Is a Section 166 Review?

Section 166 of the Financial Services and Markets Act 2000 gives the FCA the power to require a regulated firm to provide a report by a 'skilled person' — an independent expert appointed to assess specific aspects of the firm's business. The skilled person is typically a major accounting firm, specialist consultancy or law firm with relevant expertise. The FCA specifies the scope and terms of reference for the review, and the firm is required to cooperate fully with the skilled person and provide access to all relevant information, systems and personnel.

Critically, the firm bears the full cost of the engagement. The FCA does not contribute to the fees. This makes s166 reviews both a supervisory tool and, in practice, a financial penalty — the cost of the review can be substantial and the firm has limited ability to control scope or fees once the process is underway.

Common Triggers for Payment Firms

The FCA does not publish a definitive list of triggers for s166 reviews, but the most common reasons for payment firms include:

• Safeguarding concerns — Where the FCA suspects that a firm's safeguarding arrangements do not adequately protect customer funds, or where a safeguarding audit has identified material weaknesses.
• Financial crime control weaknesses — Including concerns about the adequacy of the firm's AML/CTF framework, transaction monitoring, customer due diligence or suspicious activity reporting.
• Governance failures — Including inadequate board oversight, lack of independent challenge, poor risk management frameworks or failure to maintain adequate systems and controls.
• Financial resilience — Where the FCA has concerns about the firm's own funds position, capital adequacy or ability to meet its financial obligations.
• Late or inaccurate regulatory returns — Persistent failures in regulatory reporting can indicate broader governance or control weaknesses that warrant independent investigation.
• Complaints or whistleblowing — Customer complaints or whistleblower reports that raise concerns about systemic issues within the firm.

The Review Process

The typical s166 process follows several stages. Notification — The FCA writes to the firm setting out its intention to require a s166 review, the proposed scope and terms of reference, and typically a panel of potential skilled persons for the firm to choose from (or the FCA may appoint directly). Appointment — The firm appoints the skilled person and agrees engagement terms. The FCA reviews and approves the terms of reference. Fieldwork — The skilled person conducts the review, which typically involves extensive document review, interviews with key personnel, testing of systems and controls, and analysis of data and management information. Reporting — The skilled person produces a report for the FCA setting out findings, conclusions and recommendations. The firm typically has an opportunity to comment on factual accuracy before the report is finalised. Follow-up — The FCA considers the report and determines what supervisory action is required. This may include voluntary undertakings from the firm, requirements to implement specific remediation steps, or — in serious cases — enforcement action.

Managing a Section 166 Review

How a firm engages with a s166 review can significantly influence the FCA's subsequent approach. Practical recommendations include:

• Engage constructively — Resisting or obstructing the review will only increase the FCA's concerns and may result in additional supervisory action.
• Appoint internal counsel early — Consider instructing external lawyers or specialist compliance advisers to help manage the process, review skilled person requests and protect privilege where appropriate.
• Provide information promptly and completely — Delays in providing information extend the review timeline and increase costs.
• Monitor scope carefully — s166 reviews can expand in scope if the skilled person identifies issues outside the original terms of reference. The firm should monitor scope carefully and raise concerns with the FCA if the review appears to be expanding beyond what was agreed.
• Begin remediation immediately — Do not wait for the final report to begin addressing issues that are already apparent. Demonstrating proactive remediation during the review process sends a positive signal to the FCA.
• Negotiate the cost — While the firm must pay, there is scope to negotiate fee arrangements, challenge unreasonable charges and ensure costs are proportionate to the work undertaken.

After the Review

The s166 report becomes part of the FCA's supervisory record for the firm. Material findings will inform the FCA's risk assessment and may trigger further supervisory action. Firms should treat the report's recommendations as mandatory in practice — even where the FCA does not formally require implementation, failure to act on skilled person recommendations will be viewed negatively in any future supervisory engagement. The firm should develop a detailed remediation plan with clear owners, timelines and milestones, and provide regular progress updates to the FCA.

Regulatory Counsel advises payment institutions and EMIs on managing FCA s166 reviews, supervisory engagement and remediation planning. Contact us for a free initial consultation.