Daren Allen, a partner at the City law firm of Berwin Leighton Paisner, gave the recent International Compliance Association conference in London some sage advice about how, in his words, to "deal with an enforcement." He also looked at regulatory investigations from the point of view of the skilled person. The lessons to be learnt are more or less universal.

Every compliance officer at every bank dreads the moment when an inexperienced young regulator from the Financial Conduct Authority pays a visit, realises that he is out of his depth, throws up his hands and says "your systems and controls are inadequate, send for KPMG!" Daren Allen himself is often brought in as a 'skilled person' under s166 and s166A Financial Services and Markets Act 2000, which allow the regulator, at the expense of the financial institution in question, to appoint an approved firm or professional human being to compile a report or collect and/or update information. Sometimes the institution itself is allowed to choose someone to do this, as long as the FCA approves of its choice.

The subject-matter of a s166 review

Allen explained to the huddled masses that the subject-matter of s166 reviews varies wildly, perhaps touching on:

• a technical issue such as clients' money, or an actuarial matter;
• the strength of some systems and controls, perhaps in the firm's internal risk management rules or standards of governance;
• a past business review or a remediation exercise;
• a factual investigation because another breach is suspected;
• the collation of information relevant to competition power; and
• the mere collection and updating of data.

The FCA has been commissioning 'skilled person reports' extensively in the last two years to help it review the hedging products that banks use.

Who is subject to s166?

The relevant section, s166(3), states that the relevant regulator may either (a) by notice in writing given to the person concerned, require him/it to provide the regulator with a report on the matter concerned, or (b) itself appoint a person to provide the regulator with a report on the matter. At this point Allen said that a separate 'skilled persons panel' existed.

Section 166 notices need not be limited to authorised firms or partnerships or individuals. They are much wider that most people think and can take in any other member of an authorised person's group or "continuing jurisdiction re: previously authorised persons and former group companies."

What can a s166 review cover?

A 's166 notice' will usually compel the subject to provide 'a report' on 'any matter' about which the relevant regulator could compel the provision of information or documents. Section 165 on requests for information, incidentally, covers "specified information or information of a specified description," or "specified documents or documents of a specified description" which are "reasonably required" in connection with the regulator exercising the functions conferred on it by the FSMA. This is even broader than one might suspect, as 'functions' include the vague statutory functions that the Act bestows on the regulator - the FCA described these in a paper in December as follows: "Our strategic objective is to ensure that the relevant markets work well. To advance our strategic objective we have three operational objectives. These are to secure an appropriate degree of protection for consumers, to protect and enhance the integrity of the UK financial system, and to promote effective competition in the interests of consumers." In the same paper it states, ominously though illiterately, that "we know that the retired with resources segment may be at higher risk of being victims of financial crime than other groups." Whereas the suppression of financial crime was once a distinct objective for the regulator's predecessor, it now seems to come under market integrity, consumer-protection and possibly the other objective as well.

What lies outside the scope of s166 reviews?

There are some so-called 'protected items' according to s413 Financial Services and Markets Act but they are quite narrow in nature. These cover 'legal advice privilege' (Allen said that this covered "really only the advice itself") and litigation privilege - Allen said that this operated whenever the "dominant purpose" was litigation.

Also outside the scope of the section is information not reasonably required in connection with the proper exercise of the regulator's statutory powers. What form might a legal challenge take to the exercise of power under s166? Allen answered: "There is no power to refer the decision to the Upper Tribunal. The only real option is judicial review and it is extremely unlikely that a firm will take that action."

Requirement notices

Each appointment is preceded by an appointment notice. The typical terms of reference for such a notice (which are not actually required by the statute) are as follows.

• Detailed terms of reference.
• 'Transparent' budgeting and fee caps.
• Non-exhaustive steps to be taken.
• Staged reporting.
• Deadlines for the completion of each stage.

In some cases, according to Daren Allen, all this is supported by a formal undertaking by the firm. He added that time-frames such as these were mentioned in the anti-money-laundering fines that the regulator levied a few years ago.

A duty to provide assistance

The staff in the part of the firm that the skilled person in question is inspecting are duty-bound to help him. Any person who provides services to the recipient of a notice in relation to the subject matter of a report is required to give the skilled person "all such assistance as the appointed person may reasonably require." Allen did not say whether these words were from the statue or not. He stated mysteriously that a court can "order specific performance," whatever that may mean, adding that he had not see the FCA having to go to court for it.

Another source of compulsion for co-operation with the skilled person comes from 'principle for business' 11, which dictates that every regulated firm must deal with its regulators in an open and co-operative way and must disclose to them anything relating to the firm of which they would reasonably expect notice.

The skilled person's terms of engagement

If a firm engages a skilled person, the regulator insists on the following things.

• A "carve-out of confidentiality obligations" to allow him to report to it periodically. This strange phrase, according to Allen, means that "he can tell them anything."
• A duty to keep it informed of costs, presumably on the part of the skilled person.
• A duty to notify it about the areas in which the firm is not co-operating, presumably on the part of the skilled person.
• A duty on the part of the skilled person to tell it whenever he/it identifies unconnected breaches of the rules.

The status of a s166 report

According to Allen, a s166 report represents the opinions of the skilled person only and its conclusions are not binding on the firm. In many cases, skilled persons ask the firm to agree to their factual findings, conclusions about failings and other things. No firm has a duty to agree with the findings of a s166 report but, in Allen's words, "the skilled person's report is used as a basis to refer the firm into enforcement."

* In the next instalment, we look at the pitfalls of s166 reviews.