SMCR for Crypto Firm Boards: What Authorisation Means for Directors and Leadership Teams

When the FSMA cryptoasset regime starts on 25 October 2027, UK crypto firms come within the Senior Managers and Certification Regime for the first time. The FCA’s final rules are published, the authorisation gateway opened on 30 September 2026, and firms that want to keep serving UK customers without interruption must apply by 28 February 2027. An entire sector must now build boards and leadership structures the FCA will approve: SMF1 chief executives, SMF3 executive directors, SMF16 and SMF17 control functions, prescribed responsibilities, Statements of Responsibilities and personal accountability throughout. This guide explains what SMCR asks of a crypto firm’s board, how to build the governance an authorisation application needs, and how to sequence the appointments.

Something without precedent in UK financial services is under way: an entire sector is entering the Senior Managers and Certification Regime at once. When banking came within SMCR in 2016, and the rest of the regulated population in 2019, those firms already lived under approved persons regimes and had governance built for supervision. Cryptoasset firms do not. Registration under the Money Laundering Regulations — the regime the sector has known since 2020 — creates no approved persons, no board-level accountability framework and no conduct rules. The FCA assesses the fitness of the individuals who manage the firm and its MLRO at registration, and little else about how the leadership team is organised or held to account.

Authorisation under FSMA changes every part of that at once. From commencement, a crypto firm’s chief executive holds office by individual FCA approval; its executive directors carry personal regulatory accountability; its board composition is assessed as part of the authorisation application; and the duty of responsibility means a senior manager can face personal enforcement where a breach occurs in their area and they failed to take reasonable steps. For founders and boards, SMCR is not a compliance workstream to delegate — it is a redesign of who leads the firm, on what terms, and with what personal exposure. This guide covers the regime from the board’s perspective, and our fintech recruitment team works with crypto and digital asset firms on exactly these appointments.

Where the regime stands now

The timetable that was provisional for most of the past two years is now fixed. On 30 June 2026 the FCA published its final rules for cryptoassets in five policy statements: PS26/9 on admissions and disclosures and the market abuse regime for cryptoassets; PS26/10 on stablecoin issuance; PS26/11 on regulated cryptoasset activities, including custody; PS26/12 on the prudential regime; and PS26/13 on how the wider FCA Handbook applies to regulated cryptoasset activities. PS26/13 is the one boards should read first, because it is where SMCR, the Consumer Duty and the systems and controls sourcebook (SYSC) are applied to the sector.

The practical dates are set out on the FCA’s page explaining how the cryptoasset gateway will operate:

• 30 September 2026: the authorisation gateway opened. Firms apply for authorisation, or existing authorised firms apply to vary their permissions, through Connect.
• 28 February 2027: the application period closes. Firms applying within it benefit from a saving provision: if the FCA has not finally determined the application by commencement, the firm can keep providing its cryptoasset services until it has.
• After 28 February 2027: the FCA has said it will not speed up late applications. A late applicant that is not authorised by commencement falls into a transitional provision that allows it only to perform existing contracts — no new business with new or existing UK customers.
• 25 October 2027: the regime commences and authorisation is required to carry on the new regulated cryptoasset activities. Firms that have not applied must have run off their UK business before then.

On SMCR specifically, PS26/13 applies the regime in full to authorised cryptoasset firms, with minor amendments. Because SMCR itself is under review, the FCA has said it will use a modification-by-consent approach for some elements during the gateway rather than ask firms to build to rules that may shortly change. The policy statement also sets expectations that matter for hiring: the firm’s mind and management should be, and remain, in the UK, and SMF16 and SMF17 holders are expected to work from the firm’s principal UK place of business. It sets enhanced-firm thresholds specific to the sector — £100bn of combined safe custody assets and client cryptoassets for safeguarding firms, and £20bn of backing assets on a three-year rolling average for UK qualifying stablecoin issuers — which means almost every crypto firm will sit in the core regime. Boards should read that as a statement about proportionality, not about lighter scrutiny: the core regime still requires approved senior managers, prescribed responsibilities, certification and conduct rules.

SMCR in outline — read from the boardroom

The Senior Managers and Certification Regime, set out in SYSC 23 of the FCA Handbook and the sourcebooks around it, has three layers, each landing differently at board level.

The Senior Managers Regime

Individuals performing designated Senior Management Functions must be approved by the FCA before taking up the role. For a typical authorised cryptoasset firm in the core regime the working set will be SMF1 (Chief Executive), SMF3 (Executive Director), SMF9 (Chair) where the firm has one, SMF16 (Compliance Oversight) and SMF17 (Money Laundering Reporting Officer), with larger or more complex firms adding others as their structure dictates. Each approved individual has a Statement of Responsibilities — a regulatory document recording exactly what they are personally accountable for — and enhanced firms also maintain a management responsibilities map showing how the pieces fit together with no gaps and no overlaps. The board-level significance: allocating responsibilities is a governance design exercise the board itself must own, because the allocation determines who answers personally when something fails. Our guide to what the Senior Managers Regime means when recruiting at board level covers the approval process for each seat.

The Certification Regime

Below SMF level, staff whose roles could cause significant harm — in crypto firms, senior financial crime staff, key custody and treasury personnel, material risk takers — must be certified as fit and proper by the firm itself, at least annually. The FCA does not approve these individuals; the firm does, and the board owns the machinery that makes those certifications defensible. This is the layer most likely to change: the FCA’s current proposals would remove it altogether, as covered below, so boards should build certification processes that work today without over-investing in machinery that may be retired.

The Conduct Rules

Enforceable standards of personal behaviour applying to almost all staff — acting with integrity, with due skill care and diligence, being open with the regulator — with additional rules for senior managers, including taking reasonable steps to ensure the business of the firm for which they are responsible is controlled effectively and complies with the regulatory system. Breaches are individually enforceable, which changes disciplinary processes, employment contracts and the firm’s notification obligations in ways boards must understand before the first incident, not after.

The duty of responsibility: the clause that changes board behaviour

One provision deserves its own section because it reshapes how directors of crypto firms should think about their roles. Under the duty of responsibility, where a firm breaches a regulatory requirement, the FCA can take action against the senior manager responsible for the area in which the breach occurred if that manager did not take the steps a person in their position could reasonably be expected to take to prevent it. In practice, the outcome turns on the evidence the manager can point to: board and committee minutes recording challenge, documented escalations, resourcing decisions, management information actually reviewed, and actions taken when warnings surfaced.

For crypto executives this is a cultural inversion. The sector’s operating style — fast, informal, decision-making in chat channels, documentation as an afterthought — is precisely the style that leaves a senior manager unable to evidence reasonable steps when the FCA comes asking. The boards that adapt well institute the disciplines early: minuted decisions with recorded dissent, a management information pack the board genuinely interrogates, and escalation paths that leave a trail. The boards that adapt badly discover the gap during their first supervisory incident, when it is too late to backfill the record. Candidates for senior roles at crypto firms increasingly ask about exactly these disciplines before accepting — because the quality of the firm’s governance record is now part of their personal risk assessment.

The duty also changes how a board should think about delegation. Senior managers can delegate tasks but not accountability, and the FCA will look at whether the person delegated to was competent, properly resourced and supervised. In a crypto firm that has grown quickly, it is common for a single engineer or operations lead to hold critical knowledge of wallet architecture, key management or transaction monitoring rules. A senior manager who relies on that person without oversight, documentation or a second line of challenge is exposed. Reasonable steps, in that setting, means knowing what the dependency is, recording it, and putting someone with regulatory standing in a position to check it.

What the FCA reads in a board: the authorisation lens

The authorisation application assesses the firm against threshold conditions that include suitability and effective supervision, and the board is where case officers look first. Four questions run through the assessment.

Does the board collectively understand the business it governs? The FCA expects directors who can speak to the firm’s regulated activities, its risk profile and its financial position — not a decorative board around a founder who holds everything. In crypto this cuts both ways: boards need digital asset fluency and regulated-market judgement, and a board holding only one of the two reads as unbalanced.

Is there genuine independent challenge? Venture-stage crypto boards are typically founders plus investor directors — every seat holding equity, no seat independent. Authorisation-stage firms add independent non-executive directors precisely to answer this question, and the FCA reads the presence, calibre and evident engagement of INEDs as a signal of how seriously the firm takes governance. Our companion guide to independent directors and governance for crypto firms covers the appointment in detail.

Are accountabilities clear and credible? The Statements of Responsibilities and, where required, the responsibilities map are tested against reality: does the person named for a responsibility actually control it, with the resources and authority to discharge it? Founder-heavy structures where one individual notionally holds everything, and diffuse structures where accountability falls between seats, both attract questions from case officers.

Do the individuals survive assessment? Every SMF candidate is assessed for fitness and propriety — honesty, integrity and reputation; competence and capability; financial soundness — with regulatory references covering the previous six years, and interviews where the FCA considers them warranted, which for a first-time sector it frequently will. A single weak SMF candidacy delays the whole application; the FCA’s warnings about mid-application changes to key individuals apply at board level with full force.

Stablecoin issuers face a sharper version of the same test, because their boards also answer for backing asset management, redemption and reserve assurance. Our guide to stablecoin issuer leadership covers the additional board and executive capability those firms need.

Building the authorisation-ready board: a sequencing playbook

The board build that works runs in a deliberate order. Ideally it starts twelve to eighteen months before submission; for firms aiming at the 28 February 2027 deadline, the same steps now have to run in parallel rather than in sequence.

Step one: the honest audit. Map the current board and executive team against the SMF set the firm will need and the four questions above. The output is usually uncomfortable and always useful: which incumbents are approvable in which functions, where the gaps are, and — the hardest conversation — whether the founder stands for SMF1 or the firm hires a chief executive. Our guide to the CEO of a cryptoasset firm treats that decision in full.

Step two: the chair and first independents. Independent appointments come early because they compound: a credible chair strengthens every subsequent hire, from CEO candidates who want to know who they answer to, through to the FCA’s read of the application. Crypto firms typically appoint a chair plus one or two INEDs with regulated financial services depth — payments, banking, market infrastructure — balancing the founder and investor seats.

Step three: the executive spine. The SMF1 question resolved, then the SMF3 executive directors, then the control functions — SMF16 and SMF17 — with each appointment made early enough for the individual to shape the application they will defend. Senior permanent hires at this level commonly take several months from brief to start once notice periods are included; against a 28 February 2027 application deadline, the arithmetic is unforgiving, which is why many firms are filling the control functions on a fractional or interim basis first (see below).

Step four: the machinery. Statements of Responsibilities drafted and stress-tested against reality; prescribed responsibilities allocated; board and committee structures (audit and risk at minimum for firms of scale) constituted and actually meeting; the certification population mapped; conduct rules training delivered; and the governance record — minutes, MI, escalations — accumulating the evidence the duty of responsibility will one day ask for.

The committee structure the FCA expects

Board committees are where governance stops being an org chart and becomes a working system, and applications are read accordingly. Proportionality applies — the FCA does not expect a ten-person firm to run a listed-company committee suite — but by authorisation-stage scale, three structures have become the working norm across regulated-sector boards.

Audit committee. Chaired by an independent director with genuine financial reporting depth — almost always a qualified accountant — owning the external audit relationship, the integrity of financial statements built on still-developing digital asset accounting policies, and the internal control attestations the application asserts. At custody businesses and issuers the committee also owns the assurance over on-chain asset existence and, for issuers, reserve verification: novel work that defines the calibre of chair required.

Risk committee. Owning the risk appetite statement the application presents, the management information that evidences it is monitored, and the escalation record that senior managers’ reasonable-steps defences will one day rest on. In crypto firms the committee’s agenda spans market, liquidity, operational, technology and financial crime risk — with the last typically receiving a standing deep-dive given the sector’s supervisory profile. PS26/13 extends the operational resilience rules to all authorised cryptoasset firms, so important business services, impact tolerances and mapping now sit on the risk committee’s agenda too. Smaller firms legitimately combine audit and risk into one committee at the outset, splitting as scale arrives.

Remuneration and nomination arrangements. Lighter-touch at this scale, but the FCA’s interest in incentive structures — do reward arrangements encourage the conduct the application promises? — means even young firms benefit from documented remuneration governance, and the nomination discipline of a skills matrix and succession view strengthens both the application and the board’s own build-out.

Two practical points. Committees need independent chairs to function as intended — an audit committee chaired by the CFO’s closest board ally defeats its purpose, and case officers notice. And committees need to have actually met before the application is assessed: a committee structure constituted the month before submission, with no minutes behind it, reads as scenery. Constitute early, meet properly, and let the record accumulate.

A twelve-month board build: the working calendar

With the gateway open, few firms still have twelve months before they file. The calendar below is the shape the board workstream takes when there is time to do it properly — for new entrants planning an application after commencement, and for firms that will apply later under the normal authorisation process. Firms filing by 28 February 2027 should run the same phases concurrently and prioritise the chair and control functions.

Months one to three: audit and design. The honest audit of the current board against the SMF set and the FCA’s four questions; the founder/SMF1 decision taken in principle; the target board design agreed — functions, committee structure, independence balance — and the chair search launched. The chair comes first because everything downstream recruits better once that seat is filled.

Months three to six: the cornerstone appointments. Chair appointed; CEO question resolved (founder confirmed and development plan started, or external search concluding); first INED search running against the skills matrix; SMF16 and SMF17 searches at offer stage, because those individuals must shape the application from here.

Months six to nine: the machinery. Statements of Responsibilities drafted and stress-tested; prescribed responsibilities allocated; committees constituted and holding their first cycles; conduct rules training delivered to the board itself; the governance record — minutes, MI packs, escalation logs — accumulating. Second INED lands where the design calls for one.

Months nine to twelve: rehearsal and submission. The board walks the application as a governing body — every director able to speak to the business model, the risk profile and their own accountability; SMF candidates through mock interviews; regulatory references gathered; the application filed with a governance chapter describing a board that demonstrably exists rather than one promised for later.

The calendar’s uncomfortable arithmetic: chair and executive searches each take months once notice periods are counted, so a firm starting now cannot complete a permanent build before the application deadline. The answer is to sequence ruthlessly — chair and control functions first, because those are the appointments the rest of the build compounds from — and to use interim or fractional appointments where a permanent hire cannot land in time.

Fractional and interim SMF16/17 cover for crypto firms

The control functions are where timing pressure bites hardest. Every authorised crypto firm needs an SMF16 compliance oversight holder and an SMF17 MLRO, both approved by the FCA, both expected to shape the application, and — under PS26/13 — both expected to work from the firm’s principal UK place of business. Many early-stage firms do not have the regulatory workload, or the budget, to justify two full-time senior hires on day one. Others need someone credible in post now while a permanent search runs.

That is why fractional appointments have become a standard route. A fractional compliance officer holding SMF16 a set number of days a week, or a fractional MLRO holding SMF17, gives the firm an approvable individual with FCA history at a cost proportionate to its size. At smaller firms the two functions are often combined in one person. The FCA will accept that where it is satisfied the individual has the capacity and competence for both, and it will probe capacity directly, particularly where the person holds roles at other firms. Our guide to SMF16 vs SMF17 sets out when a combined role works and when it does not.

Boards considering a fractional route should check four things before appointing:

• Time commitment. The days agreed must be enough to run monitoring, advise the board, own the financial crime framework and deal with incidents. Case officers ask how the time was arrived at.
• UK presence. The FCA expects SMF16 and SMF17 to work from the principal UK place of business. A fractional holder still needs to be physically present and reachable, not a remote name on a form.
• Other commitments. Count the other firms where the individual holds SMFs, and how those roles would be covered if two firms had incidents in the same week.
• Transition plan. Decide whether the role converts to permanent as the firm scales, and record that plan in the board papers so the FCA can see the control functions will grow with the business.

Where a firm needs a permanent hire, our head of compliance recruitment practice runs the search in parallel with any interim cover, so the application can name an approvable individual from the start.

SMCR is changing as crypto firms join it

Crypto firms are entering a regime that is itself being reformed, and boards should build for where it is going as well as where it is today.

Phase one is already in force. The FCA’s PS26/6, published in April 2026, made a first set of changes, most effective from 24 April 2026. Firms now have up to 12 weeks to submit an SMF application, with the individual able to act in the role while it is determined; criminal record checks stay valid for six months rather than three; Statements of Responsibilities and responsibilities maps are submitted only when they change; recertification can fit into existing processes such as appraisals; and conduct rule breaches only need notifying where they lead to a suspension or a cut to, or recovery of, pay. Regulatory reference responses are now due in four weeks rather than six. Further changes from 10 July 2026 raised the thresholds for enhanced status.

Phase two is out for consultation. CP26/37, published on 22 October 2026 and open until 22 January 2027, goes further. The FCA proposes fewer SMF applications, by removing some functions and moving others to a notification process; a simpler application process; higher thresholds for enhanced status; no more ongoing submission of Statements of Responsibilities and responsibilities maps; streamlined prescribed responsibilities; removal of the Certification Regime and retirement of the Directory; and simpler conduct rule training with higher breach-reporting thresholds. Final rules are expected in a policy statement in the first half of 2027.

For crypto boards, the message is clear. The paperwork will get lighter, but the core of SMCR — approved senior managers, personal accountability and the duty of responsibility — is not going away. CP26/37 is framed as reducing burden while keeping high standards of individual accountability. The appointments this guide describes remain necessary whatever the final rules say; what may change is how much administration surrounds them.

The people market: what the SMCR transition does to hiring

The demand shock is straightforward: every crypto firm seeking authorisation needs an approvable SMF1, approvable executive directors, SMF16 and SMF17 holders and credible independents, broadly at once and against the same deadline. The supply is not: executives holding both digital asset credibility and FCA approval history are scarce, and the sector is competing for them with payments and fintech firms that can offer lower personal risk. Three market effects follow.

First, pay at the approvable end has moved, and personal accountability is now explicitly priced into offers through indemnities and directors’ and officers’ insurance cover. Second, candidates conduct reverse due diligence — on the firm’s supervisory history, its governance record and its SMF16/17 bench — before accepting, because their own approval and enforcement exposure depends on it. Firms should expect to share board minutes, the financial crime framework and any FCA correspondence with shortlisted candidates under confidentiality. Third, regulated-sector executives from payments, e-money and banking are moving into crypto because SMCR makes the sector legible to them: the accountability framework they know, applied to a new asset class. Our digital assets executive recruitment work increasingly pairs these regulated-market leaders with founders who hold the product and technical depth.

For firms that need the leadership and the regulated-sector track record together, our fintech executive search draws on both pools, so a board is not forced to choose between digital asset fluency and FCA experience.

The investor dimension: why the cap table now wants what the regulator wants

A quieter force is pushing the same board build the FCA requires: the sector’s capital providers. As institutional money becomes more important at the top of the crypto market, term sheets increasingly carry governance conditions that read like a summary of this guide — independent directors within a defined period, constituted audit and risk committees, an approvable chief executive, and a compliance bench the investor’s own diligence has assessed. The logic is straightforward: for an investor, authorisation is the asset. A firm that fails the gateway, or limps through it a year behind competitors, has impaired the investment regardless of product quality, so board readiness is priced into the rounds the sector raises.

The practical effect for founders is that the SMCR board build is no longer a regulatory tax to be minimised but a fundraising asset to be evidenced — and the firms that grasped this early are recruiting from a position of strength, presenting candidates with a governed business rather than asking them to bet on a promise. Boards planning a raise alongside authorisation should sequence accordingly: the governance milestones investors ask for are the same ones the application needs, and hitting them once serves both audiences.

Frequently asked questions

When do SMCR obligations actually bite for crypto firms?

With authorisation. The gateway opened on 30 September 2026, SMF candidates are named and assessed within the application, and the regime commences on 25 October 2027. Registered-only firms carry no SMCR obligations before they are authorised, but the individuals must be identified, hired and shaping the application long before submission — and firms wanting the saving provision must apply by 28 February 2027.

Do investor directors need FCA approval?

It depends on function, not title. A director exercising executive functions falls within SMF3, and a chair within SMF9; other non-executive investor directors are generally outside the approval requirement in the core regime — though conduct rules and the FCA’s collective read of board suitability still apply. Structure determines the answer, which is one reason the responsibilities mapping exercise belongs at board level.

Can one person hold multiple SMFs?

Yes, where the FCA accepts they have capacity and competence for each — combined SMF16/17 is common at smaller firms, often on a fractional basis, and small-firm CEOs sometimes hold additional functions. The limits are practical: each combination concentrates accountability, and the FCA probes capacity directly at interview.

What happens to our existing board when we apply?

Every continuing director is considered within the application — executives through SMF approval, the board collectively through the suitability and effective-supervision conditions. Directors who would not survive assessment are better addressed before submission than discovered within it; this is the audit at step one, and it is the part firms most often need an outside view on.

Is SMCR really enforced against individuals?

Yes. The FCA has fined and banned senior managers across the regulated sector for governance and oversight failures, and financial crime weaknesses — the crypto sector’s highest-risk area — feature prominently in individual enforcement. The regime’s purpose is precisely that accountability cannot be diffused into the corporate entity, and the current reforms keep that principle intact.

How do we handle SMCR in an acquisition or investment round mid-application?

Carefully and early. A change of control during an authorisation application triggers its own FCA notification and assessment, new controllers are examined for suitability, and any resulting board changes reopen the SMF assessments — all of which can add months. Firms anticipating a raise or sale alongside the gateway should sequence the two processes deliberately with advisers, and brief incoming investors that the governance conditions in this guide are part of what they are buying. The worst outcome is a surprise board reshuffle landing while the FCA is still asking questions; its warnings about changing key individuals during applications apply to investor-driven changes just as much as resignations.

External resources

• FCA — Cryptoassets: how the gateway will operate
• FCA — PS26/13: Application of the FCA Handbook to regulated cryptoasset activities
• FCA — CP26/37: SM&CR review, phase 2
• FCA Handbook — SYSC 23: Senior Managers and Certification Regime