Capability - Regulatory Assurance and Skilled Persons Review

The Critical Role of Independent Regulatory Assurance

Independent regulatory assurance is credible third-party validation that your compliance frameworks, controls and governance arrangements are effective. It is a strategic governance tool that helps boards and Senior Managers demonstrate they are meeting regulatory expectations, or understand where there are falling short.

The regulator expects firms to maintain strong independent oversight and challenge. Under SM&CR, Senior Managers are personally accountable for ensuring adequate governance in their areas of responsibility. The three lines of defence model requires independent assurance as the third line, providing objective assessment that the first and second lines are working as intended.

Proactive independent assurance delivers clear value. It identifies gaps and weaknesses in your operating model and helps mitigate the risk of detriment crystallising in your customer base. It provides boards with credible evidence of effective oversight and strengthens supervisory relationships by demonstrating a commitment to compliance. Critically, it reduces the risk of issues escalating to formal regulatory intervention – including Section 166.

Firms that invest in independent assurance consistently manage regulatory relationships better than those that rely solely on internal assessment.

Section 166 Skilled Persons Reports: Understanding the Process

What Is a Section 166 Skilled Persons Report?

Section 166 of the Financial Services and Markets Act 2000 (FSMA) gives the FCA and PRA the power to require regulated firms to appoint a skilled person – an independent third party – to investigate and report on any aspect of the firm’s business. This includes systems and controls, governance structures, compliance frameworks, financial crime controls and conduct issues.

The skilled person provides their report directly to the regulator. The firm receives a copy but has limited ability to influence findings or conclusions. Importantly, the firm pays all costs, but the regulator controls the scope and must approve the skilled person appointment.

Section 166 is distinct from Section 166A, which covers information gathering rather than expert analysis and opinion. A Section 166 requirement notice represents significant regulatory concern and should be treated as a board-level priority from the moment it is received.

Common Triggers for Section 166 Reviews

Regulators use Section 166 when their usual supervisory tools have not provided sufficient assurance. Common triggers include:

– Persistent non-compliance or inadequate remediation of previously identified issues

– Thematic review findings suggesting systemic problems across the firm

– Significant operational failures, data breaches or cyber incidents

– High levels of consumer harm, complaints or Financial Ombudsman upholds

– Whistleblowing allegations requiring independent investigation

– Financial crime concerns following suspicious activity or regulatory intelligence

– Governance failures or inadequate board oversight

– SM&CR accountability concerns about Senior Manager effectiveness

Proactive firms commission independent reviews to identify and address issues before they reach the Section 166 threshold. Square 4 conducts skilled persons-style assessments to help firms stay ahead of regulatory concerns.

The Section 166 Process and Timeline

The Section 166 process follows a structured path from requirement notice to remediation:

– Appointment phase: The firm proposes a skilled person for FCA/PRA approval, or the regulator appoints directly from the Skilled Person Panel. This includes conflicts checks, commercial terms and regulatory sign-off.

– Scoping phase: The skilled person develops terms of reference, methodology and information requirements, subject to regulatory approval.

– Review phase: Information gathering, document review, data analysis, staff interviews, control testing and detailed analysis across all areas in scope.

– Reporting phase: Draft report preparation, firm right to comment on factual accuracy, and final report submission to the regulator.

Our Regulatory Assurance and Section 166 Services

Section 166 Requirement Notice Response
We analyse the requirement notice and underlying regulatory concerns, assess the likely scope and resource implications, develop a response strategy and project governance structure, support skilled person firm selection (where firm nomination is permitted), and manage the entire process through to report response and remediation planning. Our experience on both sides of Section 166 reviews - regulatory and firm - means we understand what the FCA expects at every stage.
Independent Regulatory Reviews
We conduct proactive independent reviews to FCA and PRA standards, providing the same depth and rigour as a skilled persons review but under your control and on your timeline. Review areas include regulatory compliance frameworks, governance and board effectiveness, risk management and three lines of defence, conduct and culture, financial crime controls, Consumer Duty implementation, SM&CR accountability, and operational resilience. Each review delivers a comprehensive report with gap analysis, control effectiveness assessment, prioritised recommendations and a board-ready executive summary.
Regulatory Remediation Programme Support
Following Section 166 findings or supervisory concerns, we design and deliver structured remediation programmes. This includes programme governance and oversight structures, detailed workstream plans with accountability and milestones, subject matter expertise across all remediation areas, board and regulatory progress reporting, and independent assurance of remediation effectiveness. We support firms through to regulatory closure, preparing the evidence packs that demonstrate issues have been genuinely resolved.

Sectors We Cover – Our regulatory assurance expertise spans all retail financial services:

Retail Banking & Challenger Banks – lending controls, conduct risk, prudential requirements, payment services
Wealth Management & Investment Platforms – suitability, product governance, client money, advisory standards
Insurance & Insurance Distribution – claims handling, fair value, distribution controls, underwriting governance
Consumer Credit & Motor Finance – affordability, commission disclosure, arrears and collections, vulnerability
Payment Services & E-Money – safeguarding, AML controls, operational resilience, authorisation requirements
Each sector faces distinct regulatory priorities and common supervisory focus areas. Our team’s cross-sector experience means we benchmark against best practice and deliver reviews that reflect current FCA and PRA expectations for your sector.

Why Square 4

Deep Regulatory Expertise

Our team includes former FCA and PRA staff with direct supervisory experience, alongside senior practitioners from across financial services. We understand regulatory decision-making, supervisory priorities and what “good” looks like from the regulator’s perspective. Square 4 was named Compliance Consultancy Firm of the Year 2024 by the International Compliance Association.

Genuinely Independent

Independent assurance is only valuable if it is genuinely objective. Square 4 Partners provides impartial, evidence-based assessments that give boards, Senior Managers and regulators confidence in the integrity of our findings. Whether supporting a proactive regulatory review, providing independent assurance over remediation programmes or assisting with a Section 166 Skilled Persons Review, our conclusions are driven by the evidence and shaped by deep cross-sector knowledge. This independence enables us to deliver robust challenge, credible assurance and practical recommendations that stand up to regulatory scrutiny and support informed decision-making.

Pragmatic, Not Theoretical

We balance regulatory rigour with business reality. Our reviews identify genuine issues and provide actionable, proportionate recommendations. We work with you to design remediation that meets regulatory expectations while remaining operationally deliverable.

Frequently Asked Questions

What is a Section 166 skilled persons report?

A Section 166 skilled persons report is an independent assessment commissioned under Section 166 of the Financial Services and Markets Act 2000. The FCA or PRA requires a regulated firm to appoint a third-party skilled person to investigate and report on specific aspects of the firm’s business – including systems, controls, governance or conduct. The report goes directly to the regulator, and the firm pays all costs. Receipt of a Section 166 notice indicates serious regulatory concern and should be treated as a board-level priority. Square 4 provides expert support throughout the entire process.

Why would the FCA issue a Section 166 requirement notice?

The FCA issues Section 166 notices when significant concerns about a firm’s compliance, controls or consumer outcomes require independent expert assessment. Common triggers include persistent regulatory breaches, inadequate remediation of known issues, thematic review findings, significant operational failures, high complaint volumes, whistleblowing allegations, financial crime concerns and governance failures. A Section 166 notice means the regulator’s usual supervisory tools have not provided sufficient assurance. Proactive firms commission independent reviews before reaching this threshold.

Should we conduct an independent review proactively, before the FCA requires one?

Yes. Proactive independent reviews help firms identify opportunities to strengthen governance, controls and customer outcomes before concerns escalate into supervisory issues. They demonstrate a commitment to good governance and continuous improvement, provide boards and Senior Managers with credible independent assurance under SM&CR, and help firms address risks in a structured and timely way. By identifying and remediating issues early, firms are better positioned to protect customers, meet regulatory expectations and foster constructive engagement with the FCA and PRA. Square 4 conducts ‘mock’ skilled persons reviews to FCA and PRA standards, testing your approach to engaging with the regulator (in general or around specific issues) and providing recommendations for improvement as well as rigorous, independent assurance.