The Dual SMF Holder at Smaller Regulated Firms

The Dual SMF Holder: When One Person Covers Multiple Functions at Smaller Regulated Firms

At larger regulated firms, the Senior Manager Functions are generally held by different individuals. The CEO is one person, the CFO another, the CRO a third, and so on. This separation is both practically necessary — given the scale and complexity of the organisations — and regulatorily desirable, since it distributes accountability and reduces the risk of conflicts between functions. But at smaller regulated firms, this clean separation is frequently not possible. The firm may have three or four senior individuals who between them must cover the full range of SMF designations, and the practical reality is that one person will hold multiple functions simultaneously.

The dual or multiple SMF holder arrangement is recognised in the FCA’s framework, but it comes with specific regulatory requirements and risks that boards and senior managers at smaller firms need to understand. This guide sets out how the arrangement works, what the FCA expects, and how to manage it well.

Which SMF Combinations Are Permitted

The rules on Senior Manager Functions for FCA-authorised firms sit in FCA Handbook SUP 10C, and they allow most combinations of SMF functions to be held by a single individual. There is no general rule in the SMCR that prevents a chief executive from also holding Compliance Oversight (SMF16) or the MLRO function (SMF17), and at many small firms the CEO or a sole director does exactly that. What the FCA looks for instead is whether the combination leaves the oversight functions with genuine independence and adequate capacity. The FCA’s own Senior Managers Regime guidance gives an example of the approach: the CEO can also be the Chair, unless another rule forbids it, and in that case the firm applies for both SMF1 and SMF9. The MLRO (SMF17) can likewise be combined with other functions, but the FCA’s guidance makes clear that the MLRO must have genuine independence and the capacity to fulfil the role properly.

Similarly, the Head of Internal Audit (SMF5) must be independent of the activities they audit. Combining SMF5 with an executive management function — including the CEO, CFO or COO — is therefore not possible in a way that preserves genuine independence. At very small firms where a formal internal audit function is not separately required, SMF5 may not be a mandated designation, which resolves the problem structurally rather than through a combined role.

In practice, the question is rarely “is this combination allowed?” and much more often “can this particular person evidence that they will do both jobs to the required standard?” That is a question about the individual, the firm and the time available, and it is where most applications that run into difficulty come unstuck.

Core, Limited Scope and Enhanced Firms: Why Your Category Matters

Which SMFs a solo-regulated firm needs at all depends on its SMCR category, and that category shapes how many functions there are to share out. The FCA’s page on SM&CR categorisation for solo-regulated firms sets out three tiers:

• Core firms comply with the baseline requirements. Most smaller authorised firms — IFAs, brokers, smaller asset managers, consumer credit firms and payment businesses — sit here. The functions typically in play are SMF1, SMF3, SMF9, SMF16, SMF17 and, for partnerships, SMF27.
• Limited Scope firms are exempt from some baseline requirements and usually have fewer SMFs, built around the Limited Scope Function (SMF29). Sole traders are Limited Scope, and the FCA notes that a sole trader may still need SMF16 depending on its permissions or activities.
• Enhanced firms are the small number of large or complex solo-regulated firms. They carry additional functions such as SMF2, SMF4, SMF5, SMF24 and the committee chairs, and the FCA’s expectation of separation between executive and oversight roles is correspondingly higher.

The consequence for a dual SMF holder is straightforward. At a Core firm with three or four directors, combining functions is normal and expected. At a Limited Scope firm, one person holding everything may be the only workable model. At an Enhanced firm, the FCA will look much harder at any arrangement where an oversight function sits with someone who also runs the business. Firms should confirm their own category before designing a combined structure, because the answer changes which functions there are to combine in the first place.

Common Combination Patterns at Smaller Firms

The most common dual SMF arrangements at smaller FCA-regulated firms involve combinations of: CEO (SMF1) and Executive Director (SMF3), where the same individual holds both the chief executive and an additional executive director designation covering a specific functional area; CFO (SMF2) and other finance or treasury functions; COO (SMF24) and other operational oversight functions; or Chair (SMF9) and committee chair functions (SMF10–13) where the chair doubles as the chair of one or more board committees. Note that SMF2, SMF24 and the committee chair functions apply mainly at Enhanced firms, so at a typical Core firm the practical combinations are narrower.

At very small firms — particularly solo-regulated authorised firms with fewer than ten employees — it is not uncommon for the CEO to hold three or four SMF designations simultaneously, covering executive leadership, compliance oversight (where permitted), specific functional areas, and in some cases MLRO responsibilities. The FCA is aware that this is the practical reality for smaller firms and does not in principle object to multiple SMF holdings, provided that the individual genuinely has the capacity and competence to fulfil each designation properly.

The single most common pattern we see is a combined compliance and financial crime role: one person holding SMF16 and SMF17, often on a fractional basis, alongside a CEO or managing director who holds SMF1 or SMF3. Our comparison of when you need SMF16, SMF17 or a combined role looks at that choice in more detail.

Common SMF Combinations and When the FCA Will Accept Them

The table below summarises the combinations smaller firms ask about most often, the circumstances in which they tend to be accepted, and the points the FCA is likely to probe. It is a practical guide rather than a statement of rules: every application is assessed on the individual and the firm.

What the FCA Assesses in Dual SMF Situations

When reviewing a Form A application for an individual who will hold multiple SMF functions, the FCA assesses whether the candidate has the competence and capacity to fulfil each function properly — not just the most senior of the designated roles. An individual who is credible as a CEO but lacks the technical expertise for a combined CRO designation, or who does not have adequate time to fulfil the MLRO responsibilities properly alongside their executive commitments, will face FCA challenge on those specific aspects of the application.

The FCA’s fitness and propriety assessment for a dual SMF holder is therefore more complex than for a single-function holder, and the Form A submission must address each designated function separately. The regulatory references required cover the candidate’s experience across all designated areas, and the Statement of Responsibilities must reflect the full scope of each function rather than combining them into a single high-level description that obscures the breadth of accountability being assumed. Our board guide to the FCA Form A covers the application itself in more depth.

The most common dual role at smaller firms is compliance oversight combined with the MLRO function. SMF Capital’s guide to holding SMF16 and SMF17 together sets out what the regulator expects of one person doing both.

Fractional Combined SMF16 and SMF17: How It Works

For many smaller firms, the answer to “who holds compliance oversight and the MLRO function?” is neither a full-time hire nor the CEO. It is a fractional compliance professional who holds both SMF16 and SMF17 for the firm on a set number of days a week or month, and who may hold similar roles at a small number of other firms. This is now one of the most common ways small directly authorised firms meet the requirement, and it is the brief we are asked to fill most often. Our fractional compliance officer service covers SMF16, and the fractional MLRO service covers SMF17; in a combined role the same person holds both.

The fractional holder is an approved Senior Manager in exactly the same way as a full-time employee. They are personally accountable under the Senior Manager Conduct Rules, they need a Statement of Responsibilities, and the FCA assesses them against the same fitness and propriety standards. The difference is in how the firm evidences that a part-time arrangement gives enough coverage.

How many days a week?

There is no regulatory minimum. The right commitment depends on the firm’s permissions, the number of clients and transactions, the volume of complaints, the complexity of the products and the financial crime risk profile. In our experience a small advice firm or broker with a settled book may be well served by a combined SMF16/17 holder working a day a week or less, with additional time around reporting deadlines, monitoring cycles and regulatory change. A payment institution, an e-money firm, a crypto business or a firm with higher-risk clients will usually need materially more, because transaction monitoring, alerts and suspicious activity reporting create daily work that cannot wait for a fixed day. The test is not the number on the contract; it is whether the person can show they are on top of the firm’s compliance and financial crime risks between visits.

Good fractional arrangements build in more than days. They set out who covers absences, how quickly the holder will respond to an urgent issue (a potential suspicious activity report, a regulatory query, a serious complaint), what management information they receive, and how they report to the board.

Managing conflicts of interest

Combining SMF16 and SMF17 in one person raises fewer conflicts than combining either with an executive function, because both are oversight roles. The conflicts that do arise in fractional arrangements tend to come from elsewhere:

• Other clients. A fractional holder working for several firms must be able to show those firms do not compete in a way that compromises their judgement, and that their total commitments still leave enough time for each.
• Commercial dependence. If the firm is a large share of the holder’s income, there is a risk they become reluctant to challenge it. Boards should be alert to this and make sure the holder’s escalation route is protected.
• Advisory work. A holder who also sells consultancy services to the firm — writing policies, carrying out file reviews — may end up reviewing their own work. Separating the SMF role from paid project work, or bringing in independent assurance, deals with this.
• Combination with SMF3. Where the fractional holder is also appointed to the board, the Statement of Responsibilities must keep the oversight and executive aspects distinct.

Evidencing time and capacity on Form A

The Form A asks for the functions applied for and for information about the candidate’s other roles and directorships. For a fractional dual holder, firms should go further than the minimum and make the capacity case explicitly. That usually means stating the agreed time commitment for the firm, listing the holder’s other SMF and compliance appointments, explaining how the commitments fit together, and describing the support around the holder — compliance analysts, outsourced monitoring, or a deputy MLRO. The FCA may ask follow-up questions or interview the candidate, and an application that answers those questions in advance is far more likely to move smoothly. A clear engagement letter, a written compliance monitoring plan and a board reporting calendar are useful evidence to have ready.

The competence case matters as much as the time case. The candidate should be able to point to relevant experience in conduct compliance and in financial crime, not just one of the two. Our SMF16 Head of Compliance hiring guide sets out what firms should look for on the compliance side, and our MLRO recruitment page covers the financial crime side.

The Risk of Overloading: Regulatory and Governance Implications

The most significant risk associated with dual SMF arrangements at smaller firms is not the regulatory permission to hold multiple functions — it is the practical reality of whether one person can genuinely exercise all of them to the standard the regulation requires. A CEO who holds the compliance oversight function but has neither the time to engage with compliance matters in depth nor the background to assess the quality of compliance advice is not providing the oversight that SMF16 requires, regardless of the fact that the designation has been formally approved.

This creates two types of risk for the firm. First, it creates a regulatory risk: if a compliance failure occurs in an area where the CEO holds SMF16, the FCA will assess whether the CEO took reasonable steps to prevent the failure in their capacity as the Compliance Oversight holder. A CEO who can demonstrate active engagement with compliance matters — regular meetings with the compliance function, documented review of compliance monitoring reports, personal involvement in significant compliance decisions — is better protected than one whose compliance oversight was nominal. Second, it creates a governance risk: the board’s oversight of the compliance function depends on the CEO’s SMF16 accountability being genuine, and a board that has allowed the compliance oversight designation to become a paper function has created a gap in its governance that the FCA will identify.

When to Separate Functions as the Firm Grows

One of the most important governance decisions at a growing regulated firm is identifying the point at which a combined SMF arrangement should be separated. There is no single threshold that triggers this requirement, but the factors that typically indicate the firm has grown beyond a combined arrangement include: the volume and complexity of compliance and risk matters increasing to the point where dedicated professional oversight is required; the FCA’s supervisory engagement suggesting expectations of more specialist function leadership; the firm seeking to expand its regulatory permissions in ways that will increase the technical demands on the compliance or risk function; and the recruitment of additional senior staff whose management requires more of the CEO’s time than was previously the case.

Proactive separation of combined SMF functions — before regulatory pressure requires it — consistently produces better outcomes than reactive separation. Exec Capital regularly advises growth-stage regulated firms on the timing and sequencing of SMF separation, and we conduct the search for the first standalone compliance, risk or audit function leader at firms that are making this transition, often through our executive search service where the first permanent hire is a senior one.

When to Split SMF16 and SMF17 into Separate Roles

The combined compliance and MLRO role deserves its own test, because it is the combination most firms start with and the one they most often have to revisit. The signs that it is time to split the two functions between different people include:

• Financial crime workload is crowding out conduct work. Rising alert volumes, more suspicious activity reports or sanctions screening issues mean compliance monitoring and Consumer Duty work start slipping.
• The firm adds higher-risk activities. New permissions, new products, overseas clients or payment and crypto activity usually call for a dedicated MLRO with specialist experience.
• The holder’s time is no longer enough. If the fractional holder is regularly working well beyond the agreed days, the arrangement no longer matches what was told to the FCA.
• Supervisory feedback. A supervisory letter, a skilled person review or a thematic finding that questions the resourcing of compliance or financial crime oversight.
• Investor or acquirer due diligence. Investors increasingly expect to see dedicated function holders before they commit capital.
• Succession risk. If one person leaving would remove both functions at once, the firm may decide the concentration risk is too high.

Splitting does not have to mean two full-time hires. A common route is to keep a fractional SMF16 and appoint a separate MLRO, or to bring in a permanent Head of Compliance who holds SMF16 while the MLRO role moves to a specialist. Our guide on how to hire a chief compliance officer covers the next stage, when the firm is ready for a senior permanent compliance leader.

Drafting the Statement of Responsibilities for a Dual SMF Holder

The Statement of Responsibilities for a dual SMF holder requires particular care. The document must accurately reflect all designated functions and must not create ambiguity about the scope of accountability for each. The most common mistake is combining the responsibilities of multiple functions into a single description that loses the specific accountability associated with each — producing an SoR that satisfies the formal requirement but does not provide the clarity about individual accountability that the regime is designed to deliver.

Exec Capital works with compliance and legal advisers at smaller firms to ensure that Statements of Responsibilities for dual SMF holders are accurate, comprehensive, and structured to provide genuine accountability clarity. We also advise on the Management Responsibilities Map requirements that apply alongside the individual SoRs. For more on drafting, see our guide to Statements of Responsibilities for board appointments.

What PS26/6 Changed and What CP26/37 Proposes

The SMCR is in the middle of a two-phase reform, and smaller firms with dual SMF holders should keep track of both stages.

Phase 1: PS26/6 (in force)

The FCA’s policy statement PS26/6, published in April 2026, made a set of changes that took effect on 24 April 2026, with some further changes from 10 July 2026. The ones most relevant to small firms with combined roles are:

• The 12-week rule. Where someone steps in to cover an SMF, the firm has 12 weeks to submit an application, and the individual can continue acting while the application is determined. This matters when a combined SMF16/17 holder leaves unexpectedly and both functions need covering at once.
• Criminal records checks. The validity period for checks used in applications was extended from three to six months.
• Statements of Responsibilities and Responsibilities Maps. Requirements on resubmitting these documents were eased so that firms resubmit when they change rather than on a fixed cycle.
• Narrower functions. Additional guidance reduced where SMF7, SMF18 and SMF22 apply.

None of these changes alters the basic test for a dual holder. The FCA still approves each function and still expects the individual to have the competence and capacity for each one.

Phase 2: CP26/37 (consultation)

On 22 October 2026 the FCA published CP26/37, the SM&CR Review: Phase 2. It closes on 22 January 2027, and the FCA expects to publish final rules in the first half of 2027. The proposals include removing the Certification Regime, removing some SMFs and moving other roles to a notification basis, streamlining the SMF application process, raising the thresholds for the Enhanced regime, removing ongoing submissions of Statements of Responsibilities and Management Responsibilities Maps, and streamlining the Prescribed Responsibilities. Commentary on the paper indicates that the functions proposed for notification or deletion are mainly Enhanced-firm and committee roles, such as SMF5, SMF10–15, SMF18 and SMF22, rather than SMF16 or SMF17.

For a small firm, the practical message is that the paperwork around a dual SMF holder may get lighter from 2027, but the pre-approval of compliance oversight and MLRO holders, and the scrutiny of whether one person can do both, is not on course to disappear. These are proposals, not final rules, and firms should check the final policy statement before changing their arrangements.

Working with Exec Capital

Exec Capital works with smaller FCA-regulated firms on both executive and compliance function appointments — including the transition from combined to separated SMF arrangements as firms grow. We understand the specific constraints and requirements of smaller regulated firm governance and we structure our search engagements accordingly, whether the brief is a fractional combined SMF16/17 holder, an interim cover appointment or a permanent SMF16 Head of Compliance. Call us on 0203 834 9616.

Frequently asked questions

Can one person hold SMF16 and SMF17 at the same time?

Yes. It is the most common combined arrangement at smaller firms. The firm applies for both functions, and the FCA assesses whether the individual has the compliance and financial crime experience, and the time, to perform both.

Is there a limit on how many SMFs one person can hold?

There is no fixed numerical limit. The constraint is practical: each function is approved separately and the FCA will challenge any application where the person cannot show the capacity and competence to perform every function they are taking on.

Can the CEO also be the compliance oversight holder?

At small Core and Limited Scope firms, often yes. It is the combination the FCA scrutinises most closely, because the person running the business is also responsible for overseeing its compliance. Firms that use it should be able to show time spent on compliance and, ideally, independent monitoring support.

Can a fractional compliance officer hold SMF16 and SMF17 for several firms?

Yes, provided their total commitments leave enough time for each firm and there are no conflicts that compromise their independence. Each firm’s application should set out the holder’s other appointments and the time agreed.

How many days a week does a fractional combined SMF16/17 need?

There is no regulatory minimum. It depends on the firm’s permissions, client numbers and financial crime risk. Small, low-risk firms can often work with a day a week or less; payment, e-money and crypto firms usually need more.

What happens if our combined SMF16/17 holder leaves suddenly?

The 12-week rule allows someone to cover the functions temporarily, and following PS26/6 the individual can continue acting while an application submitted within 12 weeks is determined. Firms should notify the FCA, arrange interim cover and start the search for a replacement promptly.

Will CP26/37 remove the need to approve SMF16 and SMF17?

Based on the consultation as published and commentary on it, the functions proposed for removal or notification are mainly Enhanced-firm and committee roles. CP26/37 is still a consultation, so firms should check the final rules when they are published in 2027.