Senior Managers vs Certification Regime

Certification Regime vs Senior Managers Regime: Who Gets Approved, Who Gets Certified

One of the most persistent sources of confusion among boards and HR functions at FCA-regulated firms is the distinction between the two central pillars of the Senior Managers and Certification Regime. The Senior Managers Regime and the Certification Regime exist side by side, apply to different populations of staff, and impose materially different obligations on both the individuals and the firm. Getting the distinction wrong — designating individuals in the wrong tier, applying the wrong assessment process, or treating the regimes as interchangeable — creates compliance risk that the FCA takes seriously and that boards are personally accountable for under SMCR.

This guide sets out the distinction clearly — who sits in each regime, what the approval or certification process involves, and what it means in practice for the boards and HR functions responsible for maintaining compliance.

The Architecture of SMCR

SMCR divides the regulated population of a firm into three tiers. The Senior Managers Regime covers the most senior individuals — those who hold a designated Senior Management Function and are personally approved by the FCA (and PRA where applicable) before taking up their role. The Certification Regime covers a broader population of individuals whose roles have the potential to cause significant harm to the firm or its customers, but who are not required to receive prior regulatory approval. The third tier — Conduct Rules staff — covers the remainder of the firm’s employees who are subject to the FCA’s individual conduct rules but who do not fall within either the senior managers or certification populations.

The key structural difference is this: individuals in the Senior Managers Regime require FCA approval before they can take up their role. Individuals in the Certification Regime are assessed and certified by the firm itself — not by the FCA — and must be certified annually as fit and proper to perform their function. The FCA does not pre-approve certification regime holders. It holds the firm accountable for the quality and rigour of its own certification process.

Who Is in the Senior Managers Regime

The Senior Managers Regime applies to individuals holding a prescribed Senior Management Function. The SMF designations cover the most senior executive and non-executive roles at a regulated firm — typically including the Chief Executive (SMF1), Chief Finance Officer (SMF2), Executive Directors (SMF3), Chief Risk Officer (SMF4), Head of Internal Audit (SMF5), Chair (SMF9), committee chairs (SMF10-13), Senior Independent Director (SMF14), Compliance Oversight (SMF16), MLRO (SMF17), and Chief Operating Officer (SMF24), among others depending on firm type and size.

The specific SMFs that apply to a given firm depend on the firm’s regulatory category. The FCA’s SUP 10A rules set out which functions are required for which firm types. Not every firm will require every SMF — smaller firms will have a more limited list, and some SMFs may be stacked with others where a single individual covers multiple functions. Boards should confirm with their compliance function which SMFs are prescribed for their firm type before finalising their governance structure.

Every SMF holder must be individually approved by the FCA. The approval is role-specific and firm-specific — an individual who held SMF1 at a previous firm does not carry that approval to a new employer. A new Form A must be submitted for every new appointment to an SMF, regardless of whether the individual has held the same designation elsewhere.

Who Is in the Certification Regime

The Certification Regime covers individuals who perform a certification function — roles that have a real and significant potential to cause harm to the firm’s customers, its integrity, or the stability of the financial system, but who do not hold a prescribed SMF designation. The certification functions are defined in SYSC 27 of the FCA Handbook and cover a broad range of roles including: significant management (senior managers below SMF level who manage a business area or function), proprietary traders, functions that require FCA qualification, those subject to qualification requirements, material risk takers, client-dealing functions, and algorithmic traders.

The population of certification regime holders at a regulated firm is typically much larger than the SMF population. At a mid-sized wealth manager or investment manager, the certification regime population might include senior portfolio managers, client relationship directors, compliance officers who do not hold SMF16, and senior operations or technology leads whose roles give them significant access to client assets or market systems. At a retail bank, the certification population might run to hundreds of individuals across the branch network and head office functions.

The Certification Process: What Firms Must Do

Because the FCA does not pre-approve certification regime holders, the firm bears the full responsibility for assessing and certifying each individual’s fitness and propriety before they begin performing a certification function, and annually thereafter. The fitness and propriety assessment must cover three areas: honesty, integrity and reputation; competence and capability; and financial soundness.

For honesty, integrity and reputation, the assessment draws on criminal record checks, regulatory history, and references from previous employers. For competence and capability, the firm must assess whether the individual has the skills, knowledge and experience to perform the certification function to the required standard — which for roles subject to qualification requirements means the individual must hold the relevant qualification. For financial soundness, the firm must assess whether the individual’s financial position raises any fitness and propriety concerns.

The assessment must be documented, the certification must be renewed annually, and the firm must maintain a register of certified persons that is available to the FCA on request. Where the firm identifies that a certified person is no longer fit and proper — whether as a result of conduct issues, competence concerns, or a change in their personal circumstances — it must revoke the certification, exclude the individual from performing certification functions, and report the revocation to the FCA through the regulatory notification system.

Regulatory References: Where the Regimes Connect

One of the most important practical intersections between the two regimes is the regulatory reference requirement. When a firm is hiring an individual into an SMF or certification regime role, it must request a regulatory reference from any previous employer that has employed the candidate in a regulated capacity in the last six years. The providing firm must include details of any certified person status the individual held, any conduct issues that arose during their employment, and any disciplinary action that was taken.

This creates a link between the two regimes that has significant implications for hiring decisions. A candidate who was removed from a certification regime role at a previous employer because of conduct or competence concerns will have that removal documented in their regulatory reference. The receiving firm must consider that information when assessing whether the individual is fit and proper for their proposed new role — whether that role is an SMF or a certification function. The regulatory reference system is therefore the mechanism by which individual conduct records travel between firms across the two regimes.

The Conduct Rules and How They Apply Across Both Regimes

Both SMF holders and certification regime holders are subject to the FCA’s individual conduct rules. The basic conduct rules — to act with integrity, to act with due skill, care and diligence, to be open and cooperative with regulators, not to mislead the FCA, and to observe proper standards of market conduct — apply to all regulated individuals regardless of which tier of SMCR they occupy.

Senior managers are subject to additional conduct standards that reflect the specific accountability obligations of the SMF designation. These include: taking reasonable steps to ensure that the business for which they are responsible is controlled effectively; taking reasonable steps to ensure that the business complies with relevant regulatory requirements; taking reasonable steps to ensure that any delegation of their responsibilities is to an appropriate person and that the individual carries out those responsibilities effectively; and disclosing promptly to the FCA anything of which the FCA would reasonably expect notice.

The Duty of Responsibility — introduced by the Bank of England and Financial Services Act 2016 — applies specifically to senior managers and is the mechanism by which the FCA holds SMF holders personally accountable for regulatory failures in their area of accountability. No equivalent duty applies to certification regime holders, though conduct rule breaches by certified persons can still result in enforcement action against the individual where the breach is sufficiently serious.

Common Mistakes in Regime Classification

The most common mistake firms make is failing to identify the full scope of their certification population. The instinct to focus the SMCR compliance effort on the SMF tier — because it involves regulatory approval and is more visible — can lead to a systematic under-identification of roles that fall within the certification regime. Senior individuals who manage significant client relationships, who have access to client assets, or who make significant trading or investment decisions may clearly fall within a certification function, but their roles may not have been formally reviewed against the certification function definitions.

A second common mistake is treating the annual certification process as an administrative tick-box rather than a genuine fitness and propriety assessment. Producing annual certificates without conducting a substantive assessment of whether each certified person continues to meet the fit and proper standard — particularly where there have been performance concerns, complaints, or personal circumstances changes during the year — exposes the firm to regulatory challenge and potentially to enforcement action if a fitness and propriety concern that should have been identified through the certification process is later identified by the FCA through other means.

A third mistake is failing to manage the regulatory reference obligations properly when a certified person or SMF holder moves firms. Providing a reference that omits relevant information — conduct concerns, disciplinary action, performance issues that raised fit and proper questions — is itself a breach of the FCA’s regulatory reference rules and can result in enforcement action against the providing firm.

Implications for Hiring Decisions

For boards and HR functions at regulated firms, understanding the distinction between the two regimes has direct implications for how recruitment is managed. For SMF appointments, the regulatory approval timeline — typically four to eight weeks, but potentially longer — must be built into the hiring process from the outset. Candidates cannot begin performing their SMF responsibilities until approval is granted, and the firm must notify the FCA in advance of the intended appointment.

For certification regime appointments, the firm must complete its own fit and proper assessment before the individual begins performing their certification function. In practice, this means the certification assessment should be integrated into the onboarding process rather than treated as a post-start administrative step. An individual who begins performing a certification function before the firm has completed its assessment is in breach of the certification requirements regardless of whether the eventual assessment is positive.

Exec Capital works with boards and HR functions at FCA-regulated firms on both SMF and certification regime appointments. We integrate the regulatory assessment requirements into every search process and advise on how to structure offers and start dates to ensure regulatory compliance from day one. Every regulated firm search is led personally by Adrian Lawrence FCA on 0203 834 9616.

The Register of Certified Persons and the Directory

One of the practical outputs of the Certification Regime is the firm’s obligation to maintain a register of its certified persons and to report relevant information to the FCA’s Financial Services Register. The FCA’s public Financial Services Register shows SMF holders alongside firms, but the directory of certified persons is a separate disclosure mechanism — the FCA’s Directory, which displays information about certified individuals publicly. Firms are required to submit information about their certified persons to the Directory and to update it promptly when individuals join, leave or change roles within the firm’s certified population.

The Directory is increasingly used by clients, counterparties and other regulated firms to verify the regulatory status of individuals with whom they are dealing. A certified person who is not listed in the Directory — or who is listed with information that does not reflect their current role or status — creates a compliance gap for the firm and a potential question mark for the client or counterparty checking their status. Boards should ensure that their HR and compliance functions have a clear process for maintaining Directory submissions with the same rigour they apply to SMF approval notifications.

The interaction between the register, the Directory and the regulatory reference system creates a coherent infrastructure for individual accountability across the regulated population. When a certified person moves between firms, their regulatory status, their certification history, and the content of their regulatory reference all travel with them in ways that were not possible before SMCR. For boards making hiring decisions — whether for SMF or certification regime roles — this infrastructure means that more information is available about candidates’ regulatory history than was previously the case, and that due diligence on that history is now a regulatory expectation rather than a best practice.

The Senior Managers and Certification Regime: Practical Summary

The practical distinction between the two regimes comes down to this: Senior Managers are approved by the FCA before they act, certified persons are assessed by the firm before they act, and the remainder of the regulated population is subject to conduct rules that apply from employment. Each tier carries different obligations for the firm and the individual, and each requires a different compliance process. Boards at regulated firms should ensure that their SMCR population mapping is reviewed annually — as the firm grows, as roles change, and as the FCA’s supervisory guidance evolves — and that the certification regime is administered with the same rigour the firm applies to its SMF approval process. The FCA holds firms to account for the quality of their certification process, and a nominal annual certification that does not reflect a genuine fitness and propriety assessment is no defence against a regulatory challenge if a certified person causes harm.