Risk Advisory · Skilled person reviews
RiskTAE supports UK banks and lenders before, during and after a section 166 skilled person review, the report the FCA or PRA can require under the Financial Services and Markets Act 2000. A senior practitioner sits on your side of the table, reading the notice with you and writing a remediation plan the regulator can close.
By Mark Dougherty, CPA (CAN)Updated
Definition
Section 166 lets the FCA and the PRA obtain a report on a matter concerning an authorised firm, another member of its group or a partnership it belongs to. The firm either proposes a skilled person for the regulator’s approval, contracts with it and pays, or the regulator appoints one and recovers its expenses from the firm as a fee.
Our article on how a section 166 review works for a bank covers the routes, who pays and whether your auditor can be the skilled person.
Sources: FSMA 2000, section 166, subsections (1) to (6) and (9), as in force at 7 February 2026; FCA, Skilled person reviews, updated 14 August 2026.
The process
The right-hand column is where, in our experience, firms lose ground.
| Stage | What the rules say | Where firms lose ground |
|---|---|---|
| Notice or appointment | A written notice requiring a report in the form the regulator specifies, or an appointment by the regulator with notice to the firm (section 166(3) to (5)). A PRA-regulated firm gives the PRA an initial cost estimate, then the final cost (Use of Skilled Persons 2.1). | The notice is read for its headline, not the form of report it specifies, and the cost estimate is guessed. |
| Nomination | The nominee must appear to the regulator to have the skills for the matter (section 166(6)). The FCA weighs its detachment from the firm and whether the work would reflect on work it did before (SUP 5.4.8G). | The first nominee is the auditor or the adviser who built what is under review, and the refusal costs weeks. |
| Contract | The skilled person cooperates with the regulator, delivers within the time specified and waives any duty of confidentiality to the firm; the contract is enforceable by the regulator and cannot be varied without its consent (SUP 5.5.1R and 5.5.5R; Use of Skilled Persons 3.1 and 3.3). | Staff treat interviews and working papers as private. Nothing given to the skilled person is confidential from the regulator. |
| Fieldwork | The firm, and anyone who provides or has ever provided services to it on the matter, must give all the assistance the skilled person reasonably requires, enforceable by injunction (section 166(7) and (8); SUP 5.5.9R). | Outsourcers and former advisers first hear of the review when the skilled person asks for them, and requests have no owner or log. |
| Report and remediation | The firm takes reasonable steps to ensure the skilled person delivers to the terms of its appointment (Use of Skilled Persons 4.1); the skilled person also reports matters suggesting a rule breach or a threshold conditions problem (SUP 5.5.1R). | Remediation planning starts after the final report, so the first months go on agreeing owners and dates rather than closing actions. |
Sources: FSMA 2000, section 166; FCA Handbook, SUP 5, 5.4.8G, 5.5.1R, 5.5.5R and 5.5.9R; PRA Rulebook, Use of Skilled Persons Part, rules 2.1, 3.1, 3.3 and 4.1.
Scope and cost
The FCA’s skilled person panel, in place since 1 April 2026, has twelve lots, and the lot tells you the shape of the review. For a bank or building society the ones that matter most are Lot G, prudential reviews of deposit takers and PRA-designated investment firms; Lot C, controls and risk management frameworks; Lot B, governance, accountability and culture; and Lot E, financial crime.
In 2025/26 the FCA commissioned 31 skilled person reports, 26 of them firm-appointed. Financial crime accounted for 12 and controls and risk management frameworks for 8; retail banking was the sector in 5. The 19 reviews completed in the year cost £47.6 million between them, £2.5 million on average. PRA-commissioned reviews are not in those figures.
The firm pays on either route. In our experience the two things that move the bill are the scope in the notice and how quickly the firm can produce evidence: an indexed evidence pack in the first week of fieldwork shortens it; answering each request from scratch pays for the skilled person to ask twice.
Sources: FCA, Skilled Person Panel Lot Descriptions, effective 1 April 2026; FCA, Use of our skilled person reports in 2025/26, updated 9 July 2026; FSMA 2000, section 166(9).
How we help
Advice where you keep the pen, consulting where we hold it. Take the parts you need.
We read the notice with you, map the matter to the rules and the panel lot it will be tested against, and set out what the review is likely to find. For a PRA review we build the cost estimate from the scope.
A shortlist of panel firms in the right lot, tested against the detachment the FCA looks for under SUP 5.4.8G.
One indexed pack of policies, minutes, management information and data, with an owner and a log for every request, so each question is answered once.
A former CRO, head of risk or regulator from our bench sits with your team through fieldwork and interviews, checks draft findings for factual accuracy and keeps the board informed.
Owners, dates and the evidence that will show each action closed. Where the findings call for new policies, a risk appetite framework or a rebuilt ICAAP, we hold the pen and hand over.
A second opinion on whether each action is closed before you tell the regulator it is; interim CRO cover from Risk Talent if the review shows a gap in leadership; board risk training from Risk Education.
Engagement
Every engagement starts with a 30-minute scoping call and a written proposal that sets out the scope, the timetable and the fee. The timetable is the regulator’s: the time specified for the report, and the board dates in between. We read the notice first, then the regulator’s last feedback to the firm, because a review rarely arrives without a history.
The board receives:
Credentials
The work is led by Mark Dougherty, CPA (CAN), our technical lead, and done by senior practitioners who have held the roles: former CROs and heads of risk, former regulators and interim executives, with model and quant specialists where the matter is a capital or liquidity calculation.
Work our senior people have led includes new risk policies, procedures and staff training that satisfied the UK regulators after a section 166 skilled person review. The same team works across Risk Advisory, so a finding on the ICAAP or the risk framework is fixed by people who write those documents.
FAQ
Yes. Section 166(7) requires the firm, and anyone who provides or has ever provided services to it on the matter, to give the skilled person all the assistance it may reasonably require, and section 166(8) lets the regulator enforce that duty by injunction.
Yes, and the remediation plan goes better if it is started before the final report arrives; how we help sets out the plan, the fixes and the independent check on closure.
This service puts a senior practitioner on your side of the table. The skilled person is separate: proposed by you for the regulator’s approval, or appointed by the regulator, and expected to be detached from the firm and from earlier work on the matter. That separation is what lets us give you a candid pre-review assessment and check the draft findings on your behalf.
Insights
A chief risk officer runs a bank’s independent risk management function. In the UK the role is a regulated senior management function, SMF4, defined as “responsibility for overall management of the risk controls of a firm,...
By Benn Pople · 7 min read
Pillar 2A is the firm-specific capital the PRA requires a bank or building society to hold on top of its Pillar 1 minimum, for risks Pillar 1 does not capture or does not capture fully, such...
By Mark Dougherty, CPA (CAN) · 7 min read
From 1 January 2027 an ICAAP has to be written on a Basel 3.1 basis. The PRA set this out in PS15/26: ICAAPs signed off by boards in 2026 should include an impact assessment of Basel...
By Mark Dougherty, CPA (CAN) · 8 min readNext step
Tell us what the notice says and when the report is due, and we will tell you what it would take to be ready.
Tell us what needs doing and by when. A partner will come back to you. Treated in confidence.
Prefer email? advisory@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.