Few letters focus a chief executive's mind like a Section 166 notice. One moment you're running the business; the next, the FCA is telling you an independent skilled person will review your operations and report back — and that you'll be paying for it. It's a supervisory tool, not an enforcement action. But in the moment, that distinction matters less than you'd hope, because how you respond becomes part of the record the FCA reads about your culture and governance.
This matters more in 2026 than it did a few years ago. The FCA has moved decisively towards a supervision-led model: rather than relying on long enforcement investigations, it now uses its supervisory toolkit to secure outcomes earlier — senior manager attestations, Part 4A permission variations, and skilled person reviews among them. In a June 2026 speech, the FCA's joint enforcement director described operating in the "no-man's land between doing nothing and launching a full investigation," using the credible threat of enforcement to drive earlier intervention. Skilled person reviews sit squarely in that space, and they're becoming more common. The FCA has also refreshed the machinery around them: a new Skilled Person Panel framework runs from 1 April 2026 to 31 March 2030, organised into twelve subject "lots" spanning financial crime, governance, controls and prudential risk.
The FCA responds badly to firms that appear to be managing the process rather than engaging with it honestly.
Here's how a review actually unfolds — and where firms go wrong. It typically runs three to nine months from draft requirement notice to final report, though complex financial-crime or multi-jurisdiction work can run well beyond that, with remediation afterwards adding many months more. Costs are rarely trivial. But the most consequential mistakes cluster at two moments. The first is the beginning: firms that treat the draft requirement notice as fixed, hand it straight to their lawyers, and wait, miss the window to engage on scope. The FCA shares proposed terms of reference before the review begins, and a well-reasoned submission can keep it focused and proportionate rather than letting it sprawl into areas that were never the concern. The second is the end: firms that receive the report, agree a remediation plan, and then implement it in a box-ticking way invite exactly the escalation — further reviews, requirements, or enforcement — they were trying to avoid.
The mindset that works is consistent. The FCA responds badly to firms that appear to be managing the process rather than engaging with it honestly. The firms that come through well engage early and constructively on scope; get the right people in the room in the first days (senior management, compliance, legal, and a skilled person they trust); cooperate fully and keep a clear audit trail of decisions; update the regulator proactively; and treat the remediation plan as real change to be delivered, not a document to be filed. Done properly, a skilled person review can leave the business genuinely stronger.
What firms should do in the first weeks
- Get the right people in the room immediately — don't let the notice sit as a legal document alone.
- Engage on scope while you still can. Read the FCA's underlying concern carefully, and make a reasoned case for a focused, proportionate review.
- Choose your skilled person deliberately. They must be independent, but the right firm will meet the FCA's requirements while working with you in a way that's practical and proportionate.
- Document everything — the decisions you take, the governance you apply, and how each recommendation is implemented.
- Plan the remediation as a delivery programme from day one — with owners, timelines and evidence — not as an afterthought once the report lands.
Sources: FCA Skilled Person Panel / Skilled Persons Framework 2026–2030 (effective 1 April 2026); FCA Handbook SUP 5.4 and EG 3.3; Therese Chambers, FCA speech "Beyond the headlines" (17 June 2026); Kennedys, Norton Rose Fulbright, fscom and MEMA Consultants commentary (Feb–May 2026).