S166 FAQs

Section 166 of FSMA (Financial Services and Markets Act 2000, revised 2012) gives the FSA the power to require firms to provide reports by skilled persons as one of its regulatory tools.

These can be used for diagnostic purposes: to identify, assess and measure risks; for monitoring purposes: to track development of identified risks; for preventive purposes: to limit or reduce identified risks; or for remedial actions where the firm has been unable to get its affairs in order.

Whereas pre 2013 a nominated skilled person can be an accountant, lawyer, actuary, or person with relevant business, technical or technological skills. The type of skilled person will depend on the scope of the report (the Lots identified by the FCA) that is listed in the requirement’s notice that you will receive when the S166 is requested.

Firms issued with an S.166 Requirement Notice need to select one of the firms from the FCA’s Skilled Persons Panel. It is crucial that firms respond in a timely manner and that they liaise appropriately with the FCA during the course of the process.

A SPR is normally prompted by a specific requirement for information, analysis, expert advice, or by a decision to seek assurance in relation to a regulatory return.

The SPR may be used for diagnostic or monitoring purposes, to limit or reduce identified risks and for remedial action. In practice, a SPR tends to be commissioned when the regulator has concerns about a business or where a business has alerted the regulator about concerns itself. The report will generally establish the extent of any problems and / or the degree of any customer detriment or remediation required.

The FCA cannot conduct these in-depth and evidence based investigations because they do not have the resources or the infrastructure to do so.

Since the FCA and PRA take over from the FSA there are indications that they have reduced in number, although following the “credible deterrence” initiative mentioned in various speeches their frequency and scope may very easily be increased.  The thematic reviews and “Deep Dives” in firms have however increased.

The only reduction in S166’s is likely to be when all the firms adopt a level of practice with more transparent systems and controls and clearer use of all the information they should seek, to run their businesses in a more compliance way.

The firm contracts with the SPR to provide the investigation and the report in alignment with the requirements provided by the regulator. The firm is effectively paying for the service and should use it as an opportunity to make their processes more effective.

We can help you reduce your exposure and limit your costs as we explain HERE.

In accordance with SUP 5.3.8G

(1) if the FCA uses the section 166 power (Reports by skilled persons) or the section 166A power (Appointment of skilled person to collect and update information), either the firm will appoint, and will have to pay for the services of, the skilled person, or the FCA will appoint, and will require under FEES 3.2.7 R (zp) or FEES 3.2.7 R (zq) that the relevant firm pays for the services of, the skilled person;
(2) if the FCA uses its other information gathering and investigation powers, it will either authorise or appoint its own staff to undertake the information gathering or investigation (or both), or it will pay for the services of external competent persons to do so; in either case the costs will be recovered under the FCA’s general fee scheme.

Fees raised by invoice from the skilled person to the FCA (Interim or final) have to be paid within 30 days. Ref Fees 3.2.7R Zp & Zq.

We can help you reduce your exposure and limit your costs as we explain HERE.

A SPR is an independent review of a regulated firm, you could say a specialist audit and it usually focusing on specific issues where the regulator wishes to delve deeper into a firm’s activities

Firms issued with an S.166 Requirement Notice need to select one of the firms from the FCA’s Skilled Persons Panel. It is crucial that firms respond in a timely manner and that they liaise appropriately with the FCA during the course of the process.

It is unlikely that most firms would be subjected to this but it is possible. The SPR requirements notice itemises the areas that the regulator requires the skilled person to investigate and this may be limited to specific sections or areas, depending on the size of the firm. If there are many different areas of concern then multiple S166’s may be issued together or separately. Another way could be if the firm was totally uncooperative with the skilled person or regulator, and it was felt that there was only limited disclosure of the information then a second or subsequent S166 could be issued with broader scope than the initial. The firm would then be required to pay for both.

In 2013/2014, the FCA commissioned 52 skilled person reviews at a cost of £145.7 million,
In 2014/15 The FCA issued 54 S166 requests for a total cost value of £154 million and the top subjects were Conduct of Business (23), Governance & Risk Management (10), CASS (8) and Financial Crime (6).
In 2015/16 the total was 42 SPRs across the typical areas mentioned above.

Normally, following a regulatory visit of some kind like a Firm Systematic Framework (FSF) or themed visit, you will have a good idea that things are perhaps less than they should be.

Sometimes if you are very pro-active and start taking steps before any requirements notice is issued, the regulator may allow you to continue the work. They will normally provide areas of concern for the consultancy and ask that findings and enhancements are evidenced to them or anything else they consider necessary.

Often you will have received a S165 Request for Additional Information which should start the alarm bells ringing.

Initially you will receive a draft notice and this means in the majority of cases it is likely to go ahead, which for many firms means panic. Often emotions run high and denial rears itself up as a defensive mechanism. None of this is helpful and the right course of action is to call us on 0207 097 1434 and we will help you prepare for the inevitable.

The first thing to do is obviously to read and understand what is causing concern for the regulator. If you are not sure, get us to help you. Circulating it internally for other people’s opinions often serves to generate anxiety and fear as well as enormous (often incorrect) speculation or worry.

The problem with doing anything purely internally is that although you are looking at what you consider are important controls or efficient systems; they may not be doing the job in the best way. Additionally the principal-agent problem is a very real issue in any organisation can be harmful at any level.

With an external investigation or assessment these issues can be identified and appropriate action can be taken to mitigate any risks or issues well before you get a regulatory visit.

The cost to any business is high and these will vary depending on the scope of the report. The total costs over the last two years have been around £150 Million pounds or roughly £3 Million each.

There are hidden costs as well to consider;
® Financially – the actual cost of the skilled person and their team to conduct the investigation and prepare the report.
® Productivity – BAU will suffer as your staff will be disrupted as well as unsettled if the process is not handled sympathetically.
® Significant impacts on senior management time and involvement. This is often multiplied if not handled in the right way.

The good news is that you can take steps to avoid this if you are very pro-active and start taking steps before any requirements notice is issued, the regulator may allow you to continue the work. They will normally provide areas of concern for the consultancy and ask that findings and enhancements are evidenced to them or anything else they consider necessary.

This will depend primarily on the areas of concern but the instructions will be for the skilled person to work out the precise requirements from the systems and controls, governance, regulatory or other reporting, sales, or other areas.

Experienced consultants like us can assist in “reading between the lines” to establish the issues and items that will need addressing. It is vital to extract all of the information out of the document so that you can manage the supply of information.

The entire SPR will be an evidence based investigation and report. The scope, the method used and the findings will be listed in the report along with recommendations of how it is suggested that you remediate any issues. It is unlikely that you will want to dispute the findings as they will be evidence based.

You may dispute the actual conclusions or there may be instances where the remediation suggestion would not be appropriate in your specific business or would need to be altered in some way, and these would be the areas to include in your management response within the report before it is sent to the FCA.

There are, of course, ways to respond in the best possible light to provide the regulator with some comfort that you are treating the issues seriously, and we can help you do that.

There is absolutely no reason why you shouldn’t conduct the RMP internally, however there are very few companies who could spare the resource to operate a project with fairly aggressive timescales or whether they would have the necessary experience in managing the workload, building the right governance around the project, coordinating the work streams, preparing the ‘deliverables’ for final approval and delivery to the FCA, and all the other things we have seen involved with an Risk Mitigation Plan.

Also, it is a good idea to use external advisers like Compliance Consultant who bring with them industry best practices and normally a wealth of experience in the area.

There is no reason or expectation for you to use the same firm that conducted the S166 to complete the RMP as well. Some consultancies use this to then start a “land grabbing” exercise and you can end up paying large amounts of money for other areas that you may not currently need.

Obviously there are key elements to operating an effective project and providing robust and long lasting solutions to the work. A key part of the S166 process is often overlooked by many firms and that is the final element of embedding, but more importantly how you evidence the embedding and how to manage that when you are next tested by the regulator.

Key points are;
® Communicate honestly and openly with the regulator at all times.
® Have a co-operative approach; don’t be defensive
® Understand what and why you are being asked
® Be realistic
® Don’t over-promise, but do make sure you are working with, not against, the Skilled Person
® Have systems and records which provide the required information in the best way
® Ensure you have the knowledge and expertise to assist the Skilled Person to provide the Report in the fastest way possible
® Ensure you know the best ways to respond to the supervisory visits and the required/expected responses to the Risk Mitigation Plan.

Running an effective Risk Mitigation Plan can be like herding cats, especially if you have to consider your day job as well. Other than ensuring the operations or other business areas conclude their work on time and in sequence, there are other considerations to be made. These will include;

® Establish and respect the communication protocols with the regulator
® Before anything is delivered it must be reviewed and approved by the Head of Compliance and the relevant Committee/s
® Be aware of lead times. If an outcome is due at the end of the month, make sure that sufficient time is factored in to allow for the production of evidence and internal sign-off