CEO of a Cryptoasset Firm: SMF1, Personal Accountability and the New Leadership Profile

Under the incoming FSMA regime, the chief executive of a UK cryptoasset firm holds office by individual FCA approval as SMF1 — personally accountable, individually assessed, and interviewed on the business they lead. For a sector of founder-CEOs who have never faced an approved persons regime, this is the most personal change authorisation brings. This guide covers the SMF1 role at a crypto firm, the founder-or-hire decision, the approval process, and how packages for approvable chief executives are now negotiated.

Every regulatory regime has a point of maximum concentration — the place where the whole framework converges on a single individual. In the Senior Managers and Certification Regime, that point is SMF1. The chief executive function is defined as the person with responsibility, under the immediate authority of the governing body, for the conduct of the whole of the business. When UK cryptoasset firms come within SMCR at authorisation — the authorisation gateway opened on 30 September 2026 and the regime starts on 25 October 2027 — the sector’s chief executives will, for the first time, hold their roles by individual FCA approval, carry a Statement of Responsibilities covering the entire firm, and stand personally behind the business when the regulator has questions.

For most of the sector’s current leaders, nothing in their careers has prepared them for this specific scrutiny. Crypto CEOs are predominantly founders: technically brilliant, commercially proven, and entirely unassessed by any regulator beyond, at most, an MLR registration in which the FCA examined their MLRO rather than them. The FSMA gateway reverses the exposure. This guide is written for those founders, for the boards deciding who should lead the firm through authorisation, and for the executives from regulated finance now weighing a move into the sector.

What SMF1 actually means

Three features define the function, and each lands with particular force in a crypto context.

Whole-firm accountability

The SMF1’s Statement of Responsibilities is the broadest in the firm: overall responsibility for the conduct of the business, plus whatever prescribed responsibilities the firm allocates to the chief executive. Under the duty of responsibility, where the firm breaches a regulatory requirement, the FCA can act against the senior manager responsible for the relevant area unless they can show they took reasonable steps — and for the chief executive, the “relevant area” defence narrows, because so much of the firm is their area. The practical consequence is evidential: an SMF1 protects themselves through documented governance — minuted decisions, management information genuinely reviewed, escalations acted on, resources allocated when the control functions asked. The informal operating style of a typical crypto scale-up is, from an SMF1’s perspective, an unhedged personal exposure.

Individual approval

The FCA assesses every SMF1 candidate for fitness and propriety across three limbs: honesty, integrity and reputation; competence and capability for this function at this firm; and financial soundness. The assessment draws on the application, regulatory references covering the previous six years, criminal and financial checks, and — for a first-time sector whose business models the FCA is still calibrating — very frequently an interview. Approval is specific to the function and the firm: an executive approved as SMF1 at a payments firm is not automatically approvable at a cryptoasset exchange, though the history helps considerably.

Conduct obligations

Beyond the general conduct rules, senior managers carry additional obligations — among them taking reasonable steps to ensure the business for which they are responsible is controlled effectively, complies with the regulatory system, and that any delegation is to an appropriate person with effective oversight. For a CEO, these rules convert delegation from a management preference into a regulated discipline: the SMF1 who hands custody operations to a lieutenant remains accountable for having chosen well and supervised properly.

How the SMCR reforms affect the crypto CEO role

The regime crypto firms are entering is itself changing. The FCA’s first phase of SMCR reforms, set out in PS26/6, took most of its changes into effect on 24 April 2026. Three matter directly to a CEO appointment. The 12-week rule now gives a firm 12 weeks to submit an SMF application when it needs temporary cover, rather than 12 weeks to submit and receive approval. Criminal record checks for SMF candidates now stay valid for six months rather than three. And firms are expected to answer regulatory reference requests within four weeks rather than six – useful for an authorisation-track firm whose CEO candidate needs references from several former employers.

Phase two is now out for consultation. In CP26/37, published on 22 October 2026, the FCA proposes moving a group of board and control roles – the committee chairs and senior independent director (SMF10 to SMF15) and the head of internal audit (SMF5) – from pre-approval to a notification route, and removing the Certification Regime. The chief executive function is not on that list: SMF1 stays pre-approved. The consultation closes on 22 January 2027, and the final rules depend on legislation still before Parliament.

The practical point for crypto boards is simple. Whatever is streamlined elsewhere, the person who runs the firm will still be individually assessed by the FCA before taking office, and will still carry the duty of responsibility once approved. The preparation described in this guide does not get lighter. For the full board-level map of functions, prescribed responsibilities and conduct rules, see our guide to SMCR for crypto firm boards.

The founder question: stand for approval, or hire

The defining leadership decision of the sector’s authorisation era, and the one we are asked about most. There is no universal answer, but there is a rigorous way to reach one.

The case for the founder standing

The FCA approves individuals for functions; it does not require a CV from regulated finance. A founder who deeply understands the business, has run it without regulatory incident, and can demonstrate competence for the function — including honest fluency about the regulatory framework the firm is entering — is approvable, and founders are approved across regulated financial services routinely. Continuity has real value: investors back founders, customers know them, and an application led by the person who built the business has an authenticity case officers recognise. The approvability gap, where it exists, is usually specific and addressable: governance experience, regulatory literacy, and the evidential habits described above — all buildable in twelve months with a strong chair, a serious SMF16/17 bench, and deliberate preparation.

The case for hiring

Some gaps are not buildable on the timeline. A founder whose history includes matters that fail the honesty-integrity-reputation limb; whose competence case rests entirely on technology rather than running a controlled business; or who — the common, quieter case — simply does not want the personal exposure, the documentation discipline and the regulator-facing role, is better served by a hired chief executive. The market pattern is now well established: sandbox-generation stablecoin issuers and authorisation-track firms are visibly led by executives from payments, banking and market infrastructure, because those profiles compress approval risk and read instantly to the FCA. The founder typically moves to an executive chair, president or chief product seat — retaining the vision role, shedding the SMF1 exposure — an arrangement that, structured well, strengthens rather than dilutes the application.

Alongside the CEO, the FCA will look hard at who holds the MLRO function at a cryptoasset firm. SMF Capital, part of FD Capital Group, handles MLRO appointments for crypto, payments and e-money businesses.

The middle paths

Two hybrid structures recur in our mandates. The interim authorisation CEO: an experienced regulated-firm chief executive engaged for the application period — the FCA process is a defined project with a defined end — handing to the founder or a permanent hire after the grant, having built the governance record on the way through; see our interim CEO practice. And the reinforced founder: the founder stands for SMF1, flanked deliberately — an independent chair with regulatory standing, experienced SMF3 executive directors, and a first-class compliance bench recruited early through our sister brand’s cryptoasset compliance practice — so the FCA assesses a credible individual within a credible structure rather than a founder alone.

Surviving the assessment: how SMF1 candidates prepare

From our placement debriefs across regulated gateways, SMF1 preparation divides into the file and the interview.

The file. Candour governs everything. The application discloses employment history, directorships, and anything adverse — regulatory, criminal, civil, financial. The FCA’s tolerance for disclosed-and-explained history is far higher than for discovered omission, and its verification is thorough: companies dissolved with debts, historical litigation, and previous regulatory interactions all surface. Crypto founders should audit their own history early — including the corporate archaeology of earlier ventures — so the narrative is theirs to tell. Regulatory references need lead time; founders whose six-year history sits in unregulated firms will have thin reference files, which shifts weight onto the interview.

The interview. The FCA interviews SMF1 candidates on the firm as filed: its business model, its money flows, its highest risks, its financial position, its governance. Three failure modes dominate. Delegating the answers — the CEO who defers regulatory questions to “my compliance team” fails the competence limb in real time; the SMF1 need not be a compliance technician, but must own the framework’s substance. Underweighting accountability — a crisp, unflinching answer to “what happens to you personally if this fails” reassures, because it shows the candidate understands the regime they are entering. And overselling — claimed resources, headcount and controls are cross-checked against the application, and inflation is corrosive. Preparation that works: full command of the application as submitted, mock interviews with someone who has sat these sessions, and scenario rehearsal on the firm’s three ugliest risks. We build this into SMF-carrying placements as standard.

The CEO’s role in the authorisation application

The authorisation application is the firm’s, but the FCA reads it as the chief executive’s account of the business. Every major document in the pack – the regulatory business plan, the financial projections, the governance arrangements, the management responsibilities map and each Statement of Responsibilities – is something the SMF1 will be asked to stand behind, at interview and through the assessment that follows. Our wider guide to the SMF1 role at FCA-regulated firms covers the function in general; what follows is specific to a cryptoasset application.

What the CEO should own personally

• The regulatory business plan. The business model, target customers, revenue lines and how each regulated cryptoasset activity is carried on, in language the CEO would use unprompted.
• The responsibilities map. Who holds which senior manager function and prescribed responsibility, and why each person is right for it – including the CEO’s own Statement of Responsibilities.
• Capital and projections. The firm’s position under the new prudential rules for cryptoasset firms (PS26/12), and the runway to fund both the application and the first years of authorised operation.
• The wind-down plan. How the firm would close in an orderly way, and how client assets would be protected if it did.
• The risk and control story. The firm’s highest risks – custody, financial crime, market abuse, operational resilience – and the named people and controls set against each one.

What can be delegated, and what cannot

Drafting can and should be shared: the compliance lead, external counsel and specialist consultants will write much of the pack. Ownership cannot. The CEO signs off the application and must be able to defend any line of it without turning to an adviser. The FCA offers optional pre-application meetings, and is clear they are not advice and do not guarantee approval; where a firm takes one, the CEO should lead it, because it is the first chance for the case officer to form a view of the person who will run the firm. During assessment, questions on strategy, governance and resourcing are effectively questions for the CEO, and the quality of those answers shapes how the whole application is read.

Stablecoin issuers carry an extra layer: the issuance rules in PS26/10 bring their own expectations on backing assets, redemption and disclosure, which the CEO must understand as well as the trading and custody activities. Our stablecoin issuer leadership guide sets out how those firms are building their boards and executive teams.

Why the window matters to the CEO

The FCA expects to decide applications made between 30 September 2026 and 28 February 2027 before the regime starts on 25 October 2027. A firm that applies after the window gets no faster assessment, and if it is not authorised by the start date it falls into a transitional provision in which it can only service existing contracts and cannot take on new UK customers. Firms already authorised for other activities apply to vary their permission; firms registered under the Money Laundering Regulations do not convert automatically and must apply in full. For a chief executive, that turns the window into a commercial deadline: an SMF1 question still unresolved in early 2027 puts the firm’s UK growth at risk. Firms planning their senior hires around these dates can see how our fintech recruitment practice approaches authorisation-stage appointments.

The new CEO profile: what firms are hiring for

Where the decision is to hire, the specification has converged across our digital asset mandates into a recognisable profile. Regulated-firm leadership — payments, e-money, banking, market infrastructure — sits at the core, ideally including a gateway: executives who have taken a firm through FCA authorisation carry pattern recognition nothing else replaces. Digital asset credibility comes next, and it must be real: candidates face technically fluent founders, boards and customers, and tourist-grade crypto knowledge is exposed quickly. Capital markets standing matters for the funded firms — the CEO fronts institutional investors for whom regulated-calibre leadership is now a condition of the cheque. And the personal disposition matters most of all: the appetite to hold SMF1 exposure at a firm whose sector the regulator watches hardest, priced honestly rather than discovered late.

Compensation reflects the convergence of scarcity and risk. In our current London placement work, packages for chief executives at authorisation-stage cryptoasset firms combine a competitive base with meaningful equity, and scaled exchanges and established issuers pay materially more; interim authorisation-CEO day rates carry a regulated-sector premium; and the negotiation now routinely covers deed-of-indemnity terms, directors’ and officers’ cover limits, and the resourcing commitments — particularly the SMF16/17 bench — the candidate requires as a condition of standing. Candidates conduct reverse due diligence on the firm’s supervisory history and governance record before accepting; the strongest treat the quality of the compliance function as a personal risk decision, which it is.

Building the SMF team around the CEO

A chief executive is approved inside a structure, not in isolation. The FCA forms its view of an SMF1 candidate partly from the people around them, and the strongest candidates now set conditions about that bench before they agree to stand. The FCA expects most cryptoasset firms to fall within the existing SMCR tiers, with only a small number of the largest in the enhanced tier. For a core-tier firm the senior manager map typically covers the CEO (SMF1), any executive directors (SMF3), the chair (SMF9), compliance oversight (SMF16) and the money laundering reporting officer (SMF17).

SMF16 and SMF17: compliance oversight and the MLRO

These two functions sit where the FCA looks hardest at a crypto firm: conduct and financial crime. Most registered firms already have an MLRO under the Money Laundering Regulations, but under FSMA that person needs approval as SMF17, and the FCA will look again at whether they are right for an authorised firm with a wider permission. Some firms combine compliance oversight and the MLRO in one person; whether that works depends on the firm’s size, activities and risk, which our guide to SMF16 vs SMF17 and the combined role sets out.

At smaller and earlier-stage firms, the answer is often fractional. An experienced compliance officer or MLRO is engaged for an agreed number of days a month, approved for the function, with the time commitment set out in the application. The FCA’s question is whether the individual has the time, authority and resources to do the job properly, not whether they are full-time, so the commitment has to be genuine and proportionate to the firm’s risk. Done well, a fractional compliance officer and a fractional MLRO give a pre-revenue or early-revenue firm senior oversight it could not otherwise afford – and give the CEO candidate named, approved, experienced people to point to rather than a hiring plan. As the firm grows, the roles usually move to permanent, and that move should be planned rather than forced. Where an incumbent leaves mid-application, our guide to interim SMF16 and SMF17 cover explains how to keep the functions covered.

SMF24 and the operations bench

The chief operations function (SMF24) is a required function only at enhanced-tier firms, but what it covers – technology, operational resilience, outsourcing and, for crypto firms, custody and wallet operations – is central to every cryptoasset business. Under CP26/37 the FCA proposes to keep SMF24 pre-approved. At a core-tier firm these responsibilities usually sit with the CEO or an executive director; either way, the CEO must be able to say who owns operational resilience, which applies to authorised cryptoasset firms under SYSC 15A. Our SMF24 hiring guide covers the profile.

The chair and non-executive directors

An independent chair with regulatory standing can do more for a founder-CEO’s application than almost any other appointment. The chair (SMF9) leads the board that holds the CEO to account, and the FCA will want to see that the board can challenge the executive rather than simply endorse it. Independent NEDs with audit, risk and financial crime experience give that challenge substance, and at founder-controlled firms they show the regulator that governance does not rest on one person. Our chair of regulated firm recruitment practice handles these appointments, and our crypto NED governance guide covers what independent directors at these firms are expected to do.

The order of appointments

The sequence that tends to work is: settle the SMF1 question first; appoint the SMF17 and SMF16 holders (fractional where that fits) early enough for them to shape the policies rather than inherit them; bring the chair on before submission; fill the NED seats; then add operations depth as scale requires. Firms that run these as one coordinated plan, rather than a string of separate hires, present a far more coherent picture to the FCA – which is how our fintech and digital asset searches are usually structured.

The SMF1’s first hundred days

For an executive taking the chief executive seat at an authorisation-track crypto firm — and for the board inducting them — the opening quarter has a recognisable best-practice shape, whether the individual is a hired CEO or a founder formalising into the role.

Weeks one to four: establish the accountability baseline. A personal review of everything the SMF1 will be answerable for: the draft Statement of Responsibilities against operational reality; the firm’s regulatory history — every FCA interaction, registration correspondence and near-miss — read in full; the financial position and runway against the authorisation project cost; and a first-hand assessment of the control functions, because the SMF16/17 bench is the CEO’s own risk mitigation. Incoming CEOs who skip this archaeology inherit surprises at interview; the FCA will know the firm’s history whether or not its new chief executive does.

Weeks five to eight: install the reasonable-steps machinery. The governance disciplines the duty of responsibility assumes, built deliberately: a board and executive meeting rhythm that minutes decisions and dissent; a management information pack the CEO genuinely interrogates monthly; delegation documented with named owners and reporting lines; escalation routes that leave a trail. This is the period in which an informal scale-up becomes an evidentially defensible firm — and it cannot be retrofitted later.

Weeks nine to fourteen: own the application narrative. The regulatory business plan reviewed line by line until the CEO can defend every claim in it; the perimeter analysis and financial projections understood rather than delegated; the firm’s three ugliest risks rehearsed to interview standard; and the external relationships — auditors, banking partners, key counterparties — met personally, because case officers triangulate. By day one hundred the SMF1 should be the application’s most fluent advocate, which is precisely what the FCA interview tests.

Founder-to-chair transitions that work

Where the decision is to hire a chief executive, the founder’s own landing determines whether the structure succeeds — and the failure mode is well known across regulated and non-regulated businesses alike: the founder who nominally steps up to chair while continuing to run the firm through back channels, leaving an approved SMF1 accountable for decisions they do not control. The FCA tests where authority actually sits, the conduct rules make the pretence dangerous for the hired CEO personally, and strong candidates walk away from structures that smell of it during diligence.

The transitions that work share four features, visible across our mandate history. The division of authority is written down — a chair role specification and the CEO’s Statement of Responsibilities drafted together, so vision, external representation and board leadership sit clearly with the founder-chair while executive authority sits undivided with the SMF1. The reporting lines move on day one, not gradually: the executive team answers to the new CEO from appointment, with the founder’s involvement in operations routed through the board. The public narrative is managed — customers, investors and staff hear a deliberate story about why the structure strengthens the firm, framed around the regulatory era the business is entering. And the chair invests in the relationship: the founder-chair/hired-CEO pairing is the most consequential relationship in the firm, and the successful ones are built through structured time together before and after the appointment, often with the incoming chair of the audit or risk committee as a third stabilising voice. Where the founder cannot genuinely accept the division — an honest question worth pressure-testing before any search begins — the executive chair model with a strong COO, or the founder standing for SMF1 with reinforcement, are better answers than a hired CEO set up to fail.

What boards should ask CEO candidates

For boards and founders running an SMF1-carrying CEO search, the interview questions that separate genuinely approvable candidates from polished ones are specific, and worth setting out. Ask the candidate to walk a regulatory gateway they have personally carried — not whether they have “authorisation experience,” but which application, what went wrong in it, and what the case officer pushed hardest on; pattern recognition only exists in candidates who can answer at that resolution. Ask what they would need to see in the firm’s compliance function before agreeing to stand — strong candidates have a precise answer, because the SMF16/17 bench is their personal risk mitigation, and a candidate indifferent to it has not understood the role. Ask how they would evidence reasonable steps eighteen months from now — the answer reveals whether the governance disciplines in this guide are lived habits or interview vocabulary. Ask where the firm’s perimeter analysis is most fragile — technically fluent candidates will have formed a view during their own diligence, and the quality of that view is the best available proxy for how they will perform in front of the FCA. And ask, directly, what would make them withdraw — because candidates who have thought seriously about SMF1 exposure have conditions, and the ones who claim none are either inexperienced or not being candid. The pattern across all five: the strongest SMF1 candidates interview the firm as hard as the firm interviews them, and boards should treat the rigour of a candidate’s reverse diligence as evidence in itself.

Interview questions for a crypto CEO candidate

Boards running a structured process can use the following question set alongside their own. It is grouped by what each question is meant to test.

Regulatory track record

• Which FCA application or variation of permission have you personally carried, and what did the case officer challenge hardest?
• Tell us about a time a regulator disagreed with you. What did you do, and what changed afterwards?
• What will your own regulatory references say, and who will give them?

Crypto and the business model

• Walk us through how customer assets move through our business and where they are most exposed.
• Which of our activities do you think sits closest to the edge of the regulatory perimeter, and why?
• What would you change in our product set before we file, and what would you defer until after authorisation?

Governance and accountability

• What would your Statement of Responsibilities say, and what would you refuse to have in it?
• Who would you want as SMF16 and SMF17, full-time or fractional, and what authority would you give them?
• How would you show the FCA, two years from now, that you took reasonable steps?
• How should the founder’s role be defined if you join, and what happens if that boundary is crossed?

Good answers are specific, name real situations and accept personal accountability without hedging. Weak answers stay general, push regulatory questions onto the compliance team or treat the FCA as an obstacle to be managed. Where the board wants support running the process, our CEO of regulated firm recruitment service covers assessment as well as search.

Frequently asked questions

When does our CEO actually need SMF1 approval?

The candidate is named and assessed within the firm’s authorisation application — the gateway opened on 30 September 2026 and the application window closes on 28 February 2027 — with approval taking effect at authorisation, ahead of the regime start on 25 October 2027. The individual therefore needs to be identified, committed and shaping the application well before submission; a CEO question left open at filing is an application weakness the FCA will find.

Can a founder with no financial services background really be approved?

Yes — competence is assessed for the function at the specific firm, not against a CV template, and founders are approved across regulated sectors. The honest tests are whether the individual can demonstrate command of the regulatory framework, evidence of running a controlled business, and the governance habits the duty of responsibility assumes. Where those are buildable in the time available, build them; where they are not, the hire-or-hybrid routes exist for a reason.

Does the FCA prefer hired professional CEOs over founders?

The FCA has no stated preference — it assesses the individual before it. What it responds to is coherence: a credible SMF1 within a credible structure. A prepared founder flanked by strong independents and control functions reads better than an imported CEO bolted onto a firm that ignores them.

What does SMF1 accountability mean if the firm fails?

Failure alone is not enforcement — the regime targets misconduct and oversight failure, not commercial outcome. The SMF1’s protection is the reasonable-steps record: evidence of effective control, honest regulatory engagement and proper wind-down conduct. An orderly failure with a clean record ends careers less often than the sector fears; a disorderly one with a thin record is a different matter.

We need a CEO for the application period only — is that credible with the FCA?

Yes, if it is genuine: an interim SMF1 fully accountable for their tenure, with a considered succession plan, is an established structure. What fails is the nameplate version — an approved figurehead behind whom an unapproved founder actually runs the firm. The FCA tests where authority really sits, and the conduct rules on delegation make the pretence personally dangerous for the interim.

How long does SMF1 approval add to our timeline?

Approval is assessed within the authorisation application rather than as a separate sequential step, so a strong candidacy adds little — but a weak one dominates the critical path: requisitions about the CEO, a difficult interview, or a mid-application change of candidate can add months to the whole determination. The planning consequence is front-loading: resolve the SMF1 question, complete the candidate’s own disclosure audit and gather regulatory references before submission, so the individual enters the process as an asset to the application rather than its open risk. Firms that submit with the CEO question genuinely settled consistently move through the gateway faster than those that treat it as resolvable in flight.

Does SMF1 still need FCA pre-approval after the SMCR reforms?

Yes. The phase one changes in PS26/6 streamlined processes such as the 12-week rule and regulatory references but did not change which roles need approval. The phase two proposals in CP26/37 would move several board and control roles to notification, but the chief executive function stays pre-approved.

Can our compliance officer and MLRO be fractional?

Often, yes, at smaller and earlier-stage firms. The FCA looks at whether the SMF16 and SMF17 holders have enough time, authority and resources for the firm’s size and risk. A fractional appointment with a clear, documented time commitment can meet that test; one that is nominal will not.

What happens if we apply after 28 February 2027?

The FCA will not speed up the assessment. If the firm is not authorised by 25 October 2027 it enters a transitional provision in which it can only service existing contracts and cannot take on new UK customers. For a growing firm that is a serious commercial cost, so the CEO and senior manager appointments are best settled before the window closes.

Related guides and services

• Digital Assets Executive Recruitment
• SMCR for Crypto Firm Boards: The Complete Guide
• Stablecoin Issuer Leadership: Boards and Executive Teams
• CEO Recruitment
• Interim CEO
• How to Hire a CEO

External resources

• FCA — Senior Managers and Certification Regime
• FCA — How the cryptoasset authorisation gateway will operate
• FCA — Cryptoassets: our standards
• Financial Services and Markets Act 2023
• FCA Register