WhatsApp and Telegram +44 7563 115980
[email protected]
Practical support for firms the Financial Conduct Authority (FCA) has told to commission a skilled person review under section 166 of the Financial Services and Markets Act 2000 (FSMA), from the first letter to the FCA's acceptance of remediation.
Selected engagements from more than 250 licences obtained since 2013, for payment, e-money and cryptoasset firms.
Volkswagen
Payment InstitutionObtained Nexpay’s FCA Authorised Payment Institution licence.
Electronic Money InstitutionObtained Dzing Finance’s FCA Authorised Electronic Money Institution licence.
Obtained Orbital’s FCA Authorised Payment Institution licence.
The short answer
A section 166 review is an independent report on a firm, required by the FCA from a skilled person when it has concerns or needs further analysis, usually paid for by the firm. Payment and e-money firms are covered too. A consultant supporting the firm helps it respond to the proposed scope, prepare evidence, manage the review, and design and deliver the remediation the FCA expects.
Section 166 of FSMA allows the FCA to require a report from a skilled person, a third-party expert, on matters it needs to understand better or about which it has concerns. Section 166A allows the FCA to appoint a skilled person to collect or update information. The FCA Handbook definition confirms that these powers also apply to payment institutions and e-money institutions through the Payment Services Regulations 2017 (PSRs) and the Electronic Money Regulations 2011 (EMRs).
There are two ways to appoint. In the first, the firm proposes a skilled person firm, the FCA approves it, and the firm contracts with it directly. In the second, the FCA contracts directly, often through its Skilled Person Panel, which has 12 lots covering areas such as financial crime, client assets and safeguarding, governance and prudential matters. Either way, the FCA can require the firm to pay. A firm contracting for its own review may use a panel supplier or nominate any suitable supplier, subject to FCA approval, and should follow SUP 5.4 of the FCA Handbook.
The FCA's published data shows 31 skilled person reports commissioned in 2025/26. Financial crime was the largest area, with 12 reports, followed by controls and risk management frameworks with 8 and governance, accountability, strategy and culture with 4. Three related to payments and digital assets firms. The 19 reviews completed in the year cost £47.6 million in total, an average of about £2.5 million each.
Those figures matter for two reasons. First, a s166 review is a serious and expensive step, used when supervisory concerns are significant, and the firm's own response can affect how wide and long the review becomes. Second, the cost of the review is often smaller than the cost of the remediation that follows. Typical triggers include weak anti-money laundering controls, safeguarding failures, poor governance, inaccurate regulatory reporting, consumer harm and doubts about financial resources. SUP 5 Annex 1 gives a non-exhaustive list of situations in which the FCA may use the tool.
Most reviews follow the same sequence, and the firm has work to do at every stage.
The weeks after the FCA's first letter set the tone for the whole review. A firm that understands its own weaknesses, shows a credible plan and provides organised evidence is in a stronger position than one that is learning about its problems from the skilled person.
We help the firm carry out a rapid internal assessment of the areas in scope, so management knows what the skilled person will find before fieldwork starts. We prepare a document index, check that policies, risk assessments, board minutes and management information tell a consistent story, and brief the people who will be interviewed so they can explain their roles and controls accurately. Where the draft scope is wider than the FCA's concerns justify, or misunderstands the business, we help the firm make a reasoned, factual response. Where problems are already clear, starting remediation early shows the FCA that the firm is taking ownership rather than waiting to be told.
Remediation is where most of the time and cost sit, and where firms most often fail. The FCA expects remediation to address the root causes the skilled person identified, not only the individual findings, and to be evidenced, so that the firm can show the new control works in practice rather than only that a policy has been rewritten.
We turn each recommendation into a remediation plan with an owner, deadline, deliverable and evidence of completion, and report progress to the board in a form the FCA can follow. The work often includes rebuilding the firm-wide risk assessment, customer due diligence and transaction monitoring, rewriting safeguarding procedures and reconciliations, redesigning governance and management information, strengthening compliance monitoring, and lookback reviews of past customers or transactions. Before the firm tells the FCA that an action is complete, we test it the way a skilled person would, so closure is not reopened at verification.
The FCA assesses conflicts of interest when a skilled person is appointed. A firm that has advised you on the matters under review, designed your controls or held a compliance role in your business will usually not be independent enough to review them. That is why firms under review typically have two sets of advisers: the skilled person, who reports to the FCA, and an adviser who works for the firm.
BCC works for the firm. Our role is to help you understand your position, respond to the FCA and skilled person accurately, and deliver remediation that stands up to independent testing. We coordinate with the skilled person and the firm's lawyers where they are involved, but we do not act for the FCA, and we keep that distinction clear in every engagement so the review's independence is never in question.
Every engagement follows the same four stages, scaled to the size of your firm and the urgency of the issue.
Assessment: we review the FCA's concerns, the draft scope and the areas likely to be tested, and assess your controls against the rules that apply. Written findings: you receive a clear report on likely findings, evidence gaps and the immediate actions that will strengthen your position. Remediation: we design and deliver the remediation plan, rebuild the controls and documents involved, train staff and test each action before closure. Ongoing support or outsourced roles: we support board reporting through the review and verification stages, and can provide interim or outsourced compliance and MLRO roles where the review has exposed gaps in key positions.
Buckingham Capital Consulting (BCC) was established in 2013 and has obtained more than 250 licences in over 60 countries for payment, e-money and crypto firms. That licensing work means we have seen, from the application stage onwards, the controls, people and documents regulators expect to find when they test a firm after authorisation.
We do not stop at the licence. BCC also arranges banking and runs compliance for regulated firms, so the advice you receive reflects how a regulated business actually operates day to day: how its bank partners review it, how its regulator supervises it and how its own board needs to evidence control. Our aim is set out in one line: we open global markets to payment, e-money and crypto businesses, with the licences to enter, the banking to operate and the compliance to scale. If you are weighing your options, use the contact form to describe your firm and the issue, and we will reply with a proposed scope.
The regulated firm. Under FCA rules, the FCA can require the firm to pay the costs of the review, whether the firm contracts with the skilled person itself or the FCA contracts directly. The FCA reported that the 19 reviews completed in 2025/26 cost £47.6 million, an average of about £2.5 million.
Yes. The FCA Handbook defines a skilled person as one appointed under section 166 or 166A of FSMA, including as applied by the Payment Services Regulations and the Electronic Money Regulations. In 2025/26 the FCA commissioned three reports on payments and digital assets firms.
Sometimes. In one route the firm proposes a skilled person, the FCA approves it, and the firm contracts with it. In the other the FCA appoints directly, often from its Skilled Person Panel. A firm may nominate any suitable supplier, but the FCA must approve it and will check for conflicts of interest.
It depends on the scope. A review focused on one area takes less time than one covering governance, financial crime and safeguarding together, and remediation and verification usually take longer than the review itself. Clear evidence, early remediation and a well-prepared firm shorten both.
Brief the board, appoint a senior owner, assess the areas in scope internally, preserve and organise the relevant documents, and review the draft scope carefully before responding to the FCA. Firms that understand their own weaknesses and begin credible remediation early are in a stronger position throughout.
Usually not on the same matters. The FCA assesses conflicts of interest, and an adviser that designed or operated the controls under review is unlikely to be independent enough. Firms typically keep their own adviser to support remediation and appoint a separate, independent skilled person.
Tell us what you need and where you operate.