PRA skilled person reviews: how a section 166 review works for a bank

A skilled person review is an independent report the PRA requires under section 166 of FSMA on a matter it wants analysed, monitored or put right, usually written by a professional services firm and paid for by the bank. The PRA’s policy is in SS7/14, and in 2025/26 it commissioned 14 reviews, all of banks and building societies.

All 14 were contracted by the firms themselves. A review does not by itself imply wrongdoing, but the PRA expects to receive every draft at the same time as the firm and is “always regarded as the end user” of the report (approach to banking supervision, paragraph 142), so preparation matters from the first conversation.

Why does the PRA commission a skilled person review?

SS7/14 gives four purposes (paragraph 1.5):

• diagnostic: to identify, assess and measure risks;
• monitoring: to track the development of risks already identified;
• preventative: to limit or reduce identified risks before they crystallise or grow;
• remedial: to respond to risks that have crystallised.

A review can be prompted by a specific PRA requirement for information, the PRA’s analysis or assessment of a situation, expert advice it has received, or a decision to seek assurance on a regulatory return (paragraph 1.6), and it can also form part of a firm’s normal supervisory programme (paragraph 1.7). The PRA’s approach to banking supervision calls skilled person reports “a common feature of how the PRA supervises”, used across all impact categories and stages of the Proactive Intervention Framework, and says a review “does not imply any presumption of wrongdoing or rules breaches” (July 2023, Box 4). Use in enforcement is rare (SS7/14 paragraph 1.7B), though a report obtained for supervision can later be relied on in enforcement action (paragraph 1.7A).

When deciding whether to use the power, the PRA weighs the firm’s attitude, “whether the firm is being co-operative”; its history with similar issues; the quality of its systems and records; whether the PRA has confidence in the firm’s “willingness and ability to deliver an objective report”; conflicts of interest; and whether the firm has the technical expertise (paragraph 2.2). Several of those factors are in the firm’s hands before any notice arrives.

How many reviews does the PRA commission?

Source: PRA Annual Reports 2024/25 and 2025/26; bank and building society figures summed from the PRA’s quarterly skilled person data. Costs are the PRA’s latest estimates and are restated as reviews complete; only six of the 2025/26 reviews had finished when the figure was published. A further seven reviews were commissioned between March and August 2026.

Reviews of controls and risk management frameworks were the largest category in each of the three years. The PRA describes its use of the tool as routine and higher than in the past, especially for its most significant firms (approach document, Box 4), though the published count halved in 2025/26 and the PRA notes that use “varies year on year” (Annual Report 2025/26).

Who appoints the skilled person?

There are three routes (SS7/14 paragraph 3.1). The PRA can appoint and contract with the skilled person itself. Where the firm contracts, the PRA can nominate the skilled person, or direct the firm to the relevant lots of its Skilled Person Panel and ask for a shortlist of nominees for the PRA to approve. Either way, it “remains a firm’s responsibility to assess the individual appropriateness of the skilled person”. In practice the firm usually contracts: the PRA contracted directly in none of the 2025/26 reviews.

The current panel runs from 1 April 2026 to 31 March 2030 in twelve lots. For a bank the two that matter most are Lot C, controls and risk management frameworks, and Lot G, prudential work for deposit takers, which covers “business, capital and liquidity planning (including ICAAPs, ILAAPs and stress tests…)” and recovery and resolution planning (PRA Skilled Person Panel lot descriptions). Lot letters changed with the new panel, so older references to bank prudential work under Lot F describe the 2022 to 2026 panel.

Before nominating, approving or appointing, the PRA checks skills, resources and independence (paragraph 3.4). It looks for conflicts or “insufficient detachment”, for example where the skilled person has already reported on the matter, such as the financial statements, where the matter may be contentious enough to lead to enforcement, or where the skilled person was involved in another capacity, such as building the system under review. A firm’s auditor, or the consultancy that designed its framework, may therefore be the wrong nominee for a review of that work.

What does the notice contain?

The PRA normally discusses its requirements with the firm before finalising the notice (paragraph 4.5). The written notification sets out the purpose of the report, its scope, the timetable and the matters the report is to contain, with any requirements on format (paragraph 4.6). The PRA “attaches importance to there being a timetable for each report” (paragraph 4.7) and normally specifies a time limit for delivery (paragraph 4.10). The pre-notice discussion is the firm’s best chance to make the scope precise and the timetable realistic.

How does the review run?

• The contract. The skilled person must be contractually required to cooperate with the PRA; the contract must be governed by the law of a part of the UK, and the provisions the PRA requires must be enforceable by the PRA and cannot be varied or rescinded without its consent (Use of Skilled Persons Part rules 3.1 to 3.3). The firm gives the PRA an initial cost estimate and the final cost (rule 2.1).
• Communication. The channel is normally direct between the skilled person and the PRA, with the firm usually kept informed, though a skilled person may report a matter of material significance without telling the firm first (SS7/14 paragraph 4.3). Periodic progress updates allow the review to be refocused (paragraph 4.2).
• Assistance. The firm must give the skilled person all the assistance it may reasonably require (FSMA section 166(7)). SS7/14 says this should include access to its records at all reasonable business hours, the information and explanations the skilled person needs, and permission to obtain information directly from the auditor (paragraph 5.1).
• Drafts. The skilled person is expected to send the PRA identical copies of any draft at the same time as the firm, and the firm should have the chance to comment in writing before the final report goes in (paragraph 4.9).
• Reporting. A firm-appointed skilled person normally reports to the PRA through the firm; a PRA-appointed one reports directly (paragraph 4.8).
• The final meeting. The PRA may meet the firm and the skilled person together to discuss the final report, and may also meet the skilled person without the firm (paragraph 4.12).

The firm normally pays, whether it engages the skilled person or the PRA contracts directly (paragraph 2.7); the PRA recovers the cost of directly contracted reviews from the firm, including VAT (Annual Report 2024/25).

How should a bank prepare?

SS7/14 sets the process; it says little about what the board and senior managers should do during a review. In our experience, these steps make the difference:

• Speak to the supervisor before commissioning any external review of a matter the PRA may care about. SS7/14 encourages it, so the firm does not pay twice for the same work (paragraph 1.7C).
• Name one senior manager to own the review and the remediation. The PRA already expects firms to give each key risk in its periodic summary meeting letter to a named senior manager (approach document, paragraph 136); a review deserves the same.
• Use the pre-notice discussion to agree a scope the firm can evidence and a timetable it can meet.
• Run the conflict check on possible nominees before shortlisting, against the tests in paragraph 3.4.
• Build the evidence pack early: policies, board and committee papers, management information and the records behind them, indexed so the skilled person can find what it asks for.
• Treat every draft as already read by the PRA. Comment on facts and evidence, and correct errors in writing.
• Start the remediation plan before the final report. The PRA’s 2014 statement of policy on serious culture failings notes that a skilled person report can propose recommendations for management (SoP2/14 paragraph 17), and that under its separate power to impose requirements the PRA can require a firm to nominate an individual responsible for recommendations the PRA specifies (paragraph 23).

Our skilled person review support puts a senior practitioner on the firm’s side from the notice to the closing of the remediation. Reviews of capital and liquidity planning often reach the ICAAP and ILAAP; reviews of governance often reach the risk appetite framework. Terms are defined in our glossary.

Questions readers ask

Does a skilled person review mean the PRA suspects wrongdoing?

Not in itself. The PRA says the use of a skilled person report “does not imply any presumption of wrongdoing or rules breaches on a firm’s part in and of itself” (approach to banking supervision, July 2023, Box 4). Most reviews support supervision; enforcement use is rare (SS7/14 paragraph 1.7B).

Can our external auditor be the skilled person?

It depends on the subject. The PRA weighs conflicts and detachment, and names matters the skilled person has already reported on, such as the financial statements, as an example of where a conflict can arise (SS7/14 paragraph 3.4).

Who pays for a PRA skilled person review?

The firm, normally, whether it engages the skilled person or the PRA contracts directly (SS7/14 paragraph 2.7). The PRA’s latest estimate for the 14 reviews it commissioned in 2025/26 is £7.0 million in total (Annual Report 2025/26).

How long does a review take?

There is no standard length. The notice sets a timetable, and the PRA normally specifies a time limit for delivering the report (SS7/14 paragraphs 4.6, 4.7 and 4.10). If the report may be late, the skilled person should tell the PRA and the firm as soon as possible (paragraph 4.11).

Sources: PRA SS7/14, Reports by skilled persons (first published 2014, last updated November 2024), paragraphs 1.5 to 1.7C, 2.2, 2.7, 3.1, 3.4, 4.2 to 4.12 and 5.1; PRA Rulebook, Use of Skilled Persons Part, rules 2.1 and 3.1 to 3.3; FSMA 2000, section 166; The PRA’s approach to banking supervision (July 2023), Box 4 and paragraphs 136 and 142; PRA Annual Report 2025/26 and 2024/25, sections on section 166 reports; PRA supervision page, quarterly skilled person data to 31 August 2026 and the Skilled Person Panel; PRA Skilled Person Panel lot descriptions (from 1 April 2026); PRA SoP2/14, paragraphs 17 and 23. Accessed 1 October 2026.