FCA Skilled Person Reviews: What Regulated Firms Need to Know

The Financial Conduct Authority (FCA) has the power to appoint independent “skilled persons” to examine how regulated firms conduct their business. A review of this kind can have serious financial and reputational consequences.

Understanding how the process works puts you in a stronger position to manage the review and respond to the FCA with confidence. This article outlines what to expect and how to prepare.

What is a Skilled Person Review?

Under section 166 of the Financial Services and Markets Act 2000 ("FSMA"), the FCA can appoint a third party to review and report on areas of concern in a regulated firm. The skilled person (often but not always a major business advisory or accountancy firm) produces written reports that are provided directly to the FCA. The findings inform FCA supervision and may lead to required improvements, business changes, or in serious cases, enforcement action.

The FCA may appoint the skilled person directly or approve the appointment of a skilled person nominated by the firm. Skilled persons can be lawyers, accountants, actuaries, consultants or sector specialists. A skilled person panel exists, but it is perfectly acceptable to appoint off panel if the FCA agrees that the appointee is appropriate. The firm itself then contracts with the skilled person and pays the costs of their work.

The scope of skilled person appointments vary, but common areas include financial crime, governance and oversight, systems and controls, and conduct and culture within the business. 

What are the key stages of a review?

The FCA will issue a Draft Requirement Notice ("DRN") outlining the topic, scope and its expectations. Failing to engage early or passively accepting the proposed scope can lock you into an unnecessarily broad and expensive review.

The skilled person will then typically treat the review as a compliance audit and follow five key stages.

• Documentation review. The skilled person will review policies and records held by the firm to identify key areas of concern and focus
• Engagement / walkthrough. Interviews and discussions will be held with key members of the firm's senior management and operational staff in order to identify how the firm operates in practice
• Testing. The Skilled Person conducts practical tests of the firm's controls to identify areas of weakness / failure.
• Preliminary report. A draft or short report will be prepared for firm and FCA consideration.
• Final report. A written report covering all areas of concern (either identified at the outset or during the course of the review) will be provided for firm and FCA consideration.

This process may follow several iterations, with multiple reports and testing phases to address different parts of the firm's operation. 

The whole process must be carefully managed to avoid scope creep and inconsistent responses that can result in misunderstandings, unrepresentative findings and missed deadlines. A well-defined work plan, milestones and sharing of requirements and information between the firm and the Skilled Person is essential. Equally, where relying on external legal or accounting advice, care must be taken to preserve legal privilege where available.

Outcomes

A Skilled Person Review Report will be used by the FCA as the basis for enforcement action which may include, amongst other things, financial penalties, prohibition orders or the variation or imposition of requirements.

Even prior to its completion, the FCA may use initial indications and preliminary findings as the basis for a request for the firm to submit itself to a Voluntary Requirement ("VREQ"), or, failing this, use its own initiative powers to make an Own Initiative Requirement (“OIREQ”) restraining certain conduct by the firm. A common requirement is freezing certain business lines, or halting the onboarding of new clients.

Depending upon the nature of the business and the scope of the VREQ/OIREQ, restrictions on the conduct of a firm can have a substantial affect on its business, rapidly affecting cashflow and client retention. The FCA ordinarily publicly announces the existence of a VREQ, but negotiations with the FCA can prevent this where it would have a significant impact on the firm. The reality is that it will often be necessary to put clients and contractors on notice of a VREQ if it affects the firm's relationship with them, and this can lead to contractual disputes affecting cashflow or service provision, and ultimately causing a further financial burden to the firm.

Recent Trends and Data

In 2023/24, the FCA commissioned 83 skilled person reviews - up from 47 in 2022/23 - before falling back to 48 in 2024/25. Hidden in this data is a greater reliance on VREQs as a form of enforcement based on the FCA's professed move towards voluntary outcomes and early engagement.

On one level this is to be welcomed, as it is often more cost effective for the firm concerned. However, there is a real risk that inadequately advised firms may accept VREQs that are not appropriate in circumstances where the FCA's use of its own initiative powers would be subject to a successful challenge.

Costs have increased significantly in recent years from circa £534,000 in 2019/20 to £992,000 in 2021/22, as the scope of such reviews has become broader and more complex. Many reviews now cost firms in the region of £500,000, but larger and broader investigations have been reported to cost over £3,000,000. Contributing to this is the issue of scope creep, missing and incomplete datasets and a failure to build an effective working group and relationship with the skilled person and the FCA.

The majority of reviews are now concentrated in retail banking, retail lending and retail investments, and they tend to cover a broad range of issues including consumer duty, governance, systems & controls client money / client assets and market abuse. The clear focus however is on financial control and risk management reviews.

Whilst review numbers have dropped in the last reporting period, they remain a powerful tool for the FCA to intervene into firms of concern. The reality for firms is that any skilled person review, when not carefully managed, has the potential to expand from a narrow technical review to a wide-ranging examination of the governance, conduct and culture within a firm.

Some practical steps 

1. If the FCA initiates a skilled person review of your firm, preparation and coordination are key. Early engagement and a cooperative response can reduce disruption and support a positive regulatory relationship.
2. Begin by reviewing the FCA’s directions and the terms of reference in detail to understand precisely what is being examined. Nominate a single internal lead to manage communications, coordinate document production, and ensure consistency of responses. Identify and collate all relevant material early, maintaining confidentiality and preserving records. Never alter, delete, or withhold documents.
3. Engage senior management, the legal team and compliance from the outset. Throughout the process, maintain transparency and cooperation with both the FCA and the skilled person, providing accurate and timely information and flagging any issues as soon as they arise.
4. Be mindful of legal privilege. Communications made for the purpose of obtaining or giving legal advice may be protected from disclosure. Keep privileged material separate from operational correspondence and avoid mixing factual summaries with legal analysis. Circulate privileged documents only to those who need to know, and seek guidance from legal counsel before sharing any potentially privileged material with the FCA or third parties.
5. Once the report is received, analyse its findings carefully. Distinguish between immediate remedial actions and longer-term improvements, and agree a clear action plan with senior leadership. Ensure changes are implemented effectively and lessons are learned.

We regularly advise firms engaging with the FCA on regulatory enforcement, and can assist in choosing, appointing and overseeing skilled person instructions, ensuring that costs and the risk of further regulatory enforcement action is minimised.  If your firm is notified of a review, or has any concerns about potential FCA intervention, contact us for support.