SMF1 CEO Appointments at FCA-Regulated Firms

Of all the Senior Management Functions designated under the Senior Managers and Certification Regime, SMF1 — the Chief Executive function — carries the broadest scope and the most direct line of personal accountability to the regulator. The CEO at an FCA-regulated firm is not simply the business’s most senior executive. Under SM&CR, they are an approved individual whose fitness and propriety the regulator has assessed before appointment, whose responsibilities are set out in writing, and who can be held personally accountable for regulatory failures within their area of oversight.

For the boards, nomination committees and investors responsible for appointing a CEO at an FCA-regulated firm, this changes the nature of the search in ways a generalist search firm will not always appreciate. This guide sets out what the SMF1 designation means in practice, how it differs between solo-regulated and dual-regulated firms, what the Duty of Responsibility asks of the individual, what has changed under the FCA’s 2026 reforms, and how boards should approach the search for a regulated CEO — including the senior compliance team the CEO will rely on. If you are already planning an appointment, our CEO of regulated firm recruitment service explains how we run these searches.

What Is the SMF1 Designation?

The Chief Executive function — SMF1 — is one of the senior management functions under the Senior Managers Regime. At any regulated firm within scope that has a chief executive, the person performing that role must be approved for SMF1. Approval must be granted before the individual takes up the role. It cannot be assumed informally, shared between people without the regulator knowing, or left vacant without a plan for cover.

The SMF1 designation makes the CEO personally subject to the FCA’s Code of Conduct (COCON), including both the individual Conduct Rules and the additional Senior Manager Conduct Rules. It attaches a Statement of Responsibilities that defines what the individual is personally accountable for. And it means that, in the event of a regulatory failing, the regulator can take enforcement action against the CEO as an individual — not just against the firm as a body corporate.

The framework applies across the full range of regulated firms — banks, building societies, insurers, asset managers, wealth managers, consumer credit providers, payment and e-money businesses, brokers and investment firms. What changes from firm to firm is which regulator approves the CEO, how many other senior managers sit around them, and how much of the firm’s regulatory burden lands directly on the chief executive’s desk. For a wider view of how the regime shapes boardroom hiring, see our guide to Senior Managers Regime board recruitment. For FX and CFD brokers, see our forex CEO recruitment service.

SMF1 at Solo-Regulated and Dual-Regulated Firms

Most UK financial services firms are solo-regulated: the FCA is both their conduct and prudential regulator. For these firms the FCA designates the Chief Executive function and the FCA alone approves the appointment. Solo-regulated firms fall into three tiers — Limited Scope, Core and Enhanced — and the tier determines which senior management functions the firm must fill. Core and Enhanced firms with a chief executive need an approved SMF1. Limited Scope firms generally operate with a narrower set of functions and may not need an SMF1 at all, though the firm’s own structure decides that rather than its size alone.

Dual-regulated firms — banks, building societies, insurers and the largest investment firms — are supervised by both the Prudential Regulation Authority and the FCA. Here the Chief Executive function is a PRA-designated function. The PRA is the approving regulator and the FCA must consent to the approval, so the candidate is effectively assessed twice: by the PRA on prudential matters such as capital, liquidity and safety and soundness, and by the FCA on conduct and consumer outcomes.

The practical differences for a search are worth setting out plainly:

• Who you are persuading. At a solo-regulated firm, the CEO must satisfy one supervisory team. At a dual-regulated firm, the candidate must hold their own with prudential supervisors who will probe the firm’s balance sheet, capital plan and recovery arrangements.
• Depth of the team around the CEO. Enhanced and dual-regulated firms usually have a fuller set of SMFs — CFO, CRO, Chief Operations, Head of Internal Audit, committee chairs — so the CEO’s role is more about directing and overseeing other accountable individuals. At a Core firm, the CEO may personally hold several prescribed responsibilities and sit much closer to the detail.
• Interview likelihood. Regulatory interviews are more common for dual-regulated and higher-impact firms, and the preparation required is correspondingly heavier.
• Timeline. Two regulators, more information requests and a deeper assessment mean the approval stage at a dual-regulated firm should be planned with more contingency.

The CEO’s Regulatory Responsibilities Under SMF1

The Statement of Responsibilities (SoR) gives the SMF1 designation its practical meaning. It sets out the specific areas for which the CEO is personally accountable — typically the firm’s strategy and business model, the overall management of the regulated business, the oversight of other senior managers, and any prescribed responsibilities allocated to the CEO. At smaller firms that can extend to prescribed responsibilities such as the firm’s performance of its obligations under the senior managers regime itself. The SoR is submitted with the approval application and must be kept accurate as the role changes. Our guide to Statements of Responsibilities for board appointments explains how to draft one that reflects the role as it really works.

The CEO’s SoR sits alongside the firm’s Management Responsibilities Map, which shows how responsibilities are divided across the senior team. Read together, the two documents tell the regulator who owns what. A CEO SoR that is vague, or that overlaps confusingly with the responsibilities of the CFO or COO, is a weakness the regulator will notice — and one that can leave the CEO answerable for areas they never meaningfully controlled.

Effective SMF1 holders therefore keep close oversight of the firm’s risk framework, make sure they receive accurate and timely management information across all regulated activities, record significant decisions and their rationale, and keep a constructive relationship with the supervisory team. These are not administrative tasks. They are the evidence that the CEO was in control of the business, and they become very important if anything goes wrong.

The Duty of Responsibility

The Duty of Responsibility is the mechanism that turns the SoR into personal accountability. When the Senior Managers Regime was first legislated in the Financial Services (Banking Reform) Act 2013, it included a “presumption of responsibility”, which would have required a senior manager to prove they had taken reasonable steps. That reverse burden was removed by the Bank of England and Financial Services Act 2016 and replaced with the statutory Duty of Responsibility, which was then extended to all FSMA-authorised firms as SM&CR rolled out.

Under the duty, the regulator can take action against a senior manager where the firm has contravened a regulatory requirement, the senior manager was responsible for managing the activities in which the breach occurred, and the senior manager did not take the steps a person in their position could reasonably be expected to take to prevent or stop it. The burden of proving that sits with the regulator, not the individual. But in practice, a CEO who cannot show what they knew, when they knew it and what they did about it is in a weak position.

For a board, the duty has three practical consequences for the search:

• Experienced candidates will scrutinise the SoR before accepting. A good SMF1 candidate will want to see the responsibilities map, recent compliance monitoring, internal audit findings and any open regulatory issues before they sign. Boards should be ready to share them under confidentiality.
• Inherited problems matter. A CEO joining a firm with a live remediation programme or an open enforcement matter needs a clear record of what was in place on their first day, and a credible plan for what they will do about it.
• The quality of the team is part of the CEO’s protection. “Reasonable steps” includes appointing capable people to key roles and overseeing them properly. A CEO with a weak compliance function is exposed, which is why the team around the CEO deserves as much attention as the CEO hire itself.

The FCA Approval Process for an SMF1 Appointment

Before a CEO can take up their role, the firm must submit a Form A application through the FCA’s Connect system, supported by the information described on the FCA’s approved persons and senior managers pages. The application covers the individual’s personal details, employment history, any material disclosures — criminal convictions, civil proceedings, previous regulatory action, financial difficulties — the firm’s own assessment of the candidate’s fitness and propriety, and the Statement of Responsibilities. The firm must also obtain regulatory references from the candidate’s previous employers covering the last six years, and complete a criminal records check.

The regulators have a statutory period of three months to determine a complete application, and up to six months where an application is incomplete when submitted. Straightforward appointments at lower-risk firms are often decided well within the statutory period, but boards should not plan on a best-case outcome. At larger or more complex firms — dual-regulated businesses, firms with a recent regulatory history, or firms going through significant change — the regulator may ask for more information, take longer, or hold a regulatory interview with the proposed CEO.

The regulatory interview, where it happens, is a significant undertaking. Supervisors will typically focus on the candidate’s understanding of the firm’s risk profile, their plans for the regulated business, how they will run the senior team, and their approach to the regulatory relationship. Candidates who have not previously dealt with supervisors at this level should prepare carefully. The interview sets the tone for how the regulatory relationship begins under new leadership.

For dual-regulated firms, the PRA leads the approval and the FCA’s consent runs alongside it. The PRA’s assessment focuses on prudential matters — the candidate’s grasp of capital adequacy, liquidity risk, recovery and resolution planning, and the firm’s safety and soundness — and it tends to be more intensive. At challenger banks, insurers and larger investment firms, this stage should be built into the search timeline from the start.

What Changed Under PS26/6

The FCA’s PS26/6 is the first phase of its review of SM&CR, with the PRA publishing parallel rules for dual-regulated firms. Most of the changes took effect on 24 April 2026. None of them removes pre-approval for the CEO, but several change how a CEO appointment and transition is managed in practice:

• The 12-week rule. Firms now have 12 weeks to submit an SMF application where someone steps into a senior manager role to provide cover, and the individual can continue to act while the application is decided. For an unplanned CEO departure, this gives the board more room to put an acting chief executive in place and then apply for approval, rather than racing a cliff edge.
• Statements of Responsibilities and Management Responsibilities Maps. Firms have up to six months to notify the regulator of changes, and where several changes happen in that window only the latest version needs to be submitted. This reduces the administrative load when responsibilities are being reshaped around a new CEO, but it does not lessen the need for the SoR to be accurate in substance.
• Regulatory references. The time a firm has to respond to a request for a regulatory reference has been cut from six weeks to four, which should help keep the approval stage moving once a preferred candidate is identified.
• Criminal records checks. The validity period for a criminal records check has been extended from three to six months, and checks are no longer needed for internal or intra-group moves — useful where a group promotes a subsidiary CEO or moves an executive between regulated entities.

Further changes to the FCA Directory and reporting forms followed later in 2026. For boards, the headline is that the mechanics around a CEO appointment have become less burdensome, but the substance — pre-approval, personal accountability and the Duty of Responsibility — has not changed.

Why SMF1 Stays Pre-Approved Under CP26/37

In October 2026 the FCA published CP26/37, the second phase of the review, alongside a PRA consultation. It goes much further than Phase 1. Among other things it proposes removing the Certification Regime, removing certain SMFs, extending the temporary cover period from 12 to 18 weeks, and moving a number of senior management functions from pre-approval to a notification model, under which the firm completes its own fitness and propriety assessment and notifies the regulator rather than waiting for approval. The consultation closes on 22 January 2027, and much of the package depends on legislative change, so none of it is in force yet.

The roles proposed for notification are largely committee chair and oversight functions. The Chief Executive function is not among them: under the proposals, SMF1 would remain a pre-approved role. That is consistent with the logic of the whole regime — the regulators are prepared to rely more on firms’ own assessments for some oversight roles, but they want to assess the person running the firm themselves.

The practical consequences for CEO hiring are straightforward. Boards should continue to plan for a full approval process, with a complete application, references and possibly an interview. A future shift of other roles to notification may make it quicker to assemble parts of the senior team around a new CEO, but the CEO appointment itself will still be the step that sets the critical path.

How the FCA Supervises the CEO

The supervisory relationship with the CEO of a regulated firm is different in kind from the relationship with the firm as an institution. The SMF1 holder is the regulator’s main individual point of contact on strategy, senior governance and significant regulatory events. Supervisors expect the CEO to be accessible, prepared and candid, and they form a view of individual senior managers alongside their view of the firm.

Supervisory meetings with the CEO typically cover the business model and strategic direction, the quality of risk governance, recent regulatory or compliance events, and the CEO’s plans for any material change. Supervisors may also want to understand the CEO’s relationship with the board and with other senior managers — whether the governance structure genuinely works, or whether formal structures disguise decision-making concentrated in one person.

CEOs who perform poorly in supervisory settings — who appear unfamiliar with their firm’s regulatory position, give incomplete or inconsistent information, or are defensive rather than constructive — create a problem that is hard to repair and usually leads to closer supervision of the whole firm. The quality of the CEO’s supervisory relationship is not a soft consideration for the board. It is a governance risk, and where it goes wrong the regulator’s range of supervisory and enforcement tools comes into view.

The CEO Search Brief at a Regulated Firm — What Is Different

Boards starting a CEO search at an FCA-regulated firm are often surprised by how much the regulatory dimension changes the brief. At an unregulated business, the brief is mainly about commercial leadership, strategy and people management. At a regulated firm those remain central, but they are joined by requirements that have no equivalent elsewhere.

The CEO must be capable of being approved, which means no disqualifying regulatory or personal history. They must be willing to engage directly with supervisors — something some highly capable commercial leaders find uncomfortable. They must be able to carry the accountability the SoR imposes, which means real oversight across the business rather than passing regulatory matters to the compliance or risk functions. And they must understand the main regulatory obligations that apply to the firm’s activities, even if they rely on specialists for technical detail.

The brief therefore needs to be more precise than a standard CEO recruitment brief. We work with boards and nomination committees to set out the regulatory competence the role needs in specific terms — not simply “financial services experience”, but which parts of the regulatory environment the CEO must handle personally and which can be delegated to the SMF team. A precise brief produces a narrower but more useful candidate pool, and it reduces the risk of a late-stage problem when regulatory questions surface during due diligence.

A good SMF1 brief usually covers:

• the firm’s regulatory tier and regulators, and whether a regulatory interview is likely;
• the draft Statement of Responsibilities, including any prescribed responsibilities the CEO will hold;
• the current state of the regulatory relationship and any open issues;
• the senior team the CEO will inherit, and any gaps that need filling alongside the appointment;
• the commercial objectives the board expects the CEO to deliver over the first two to three years.

The Candidate Profile for an SMF1 CEO

The pool of credible CEO candidates for FCA-regulated firms is smaller than it looks. Not everyone with a strong financial services background has operated at the level of accountability SMF1 requires. Not everyone who has held a CEO title at a regulated firm has dealt directly with supervisors — at some firms the CEO is mainly a commercial leader while a COO or deputy manages the regulatory relationship. And not everyone with the right regulatory record has the commercial and leadership ability the firm needs.

We assess CEO candidates for regulated firms on three dimensions at once: the depth and relevance of their commercial track record, the quality of their regulatory history and relationship management, and their ability to work within the governance structure SMF1 imposes. We pay particular attention to how candidates have behaved under regulatory scrutiny — during supervisory visits, investigations, skilled person reviews or significant regulatory events — because that is where an individual’s regulatory character shows rather than being asserted.

For dual-regulated firms, we also assess candidates’ understanding of prudential risk. A CEO at a challenger bank or insurer who cannot engage credibly with the PRA on capital and liquidity will struggle in supervisory meetings regardless of their wider ability. That does not require a specialist prudential background, but it does require enough fluency to hold an informed conversation with supervisors and to rely appropriately on the CFO and the Chief Risk Officer (SMF4) for technical detail without handing over the oversight responsibility itself.

First-Time SMF1 Candidates

Some of the strongest candidates for a regulated CEO role have never held SMF1. They may have been a CFO, COO, managing director of a division, or a CEO at an unregulated business. Appointing a first-time SMF1 is entirely possible, and the regulator approves first-time senior managers routinely, but the case for the individual has to be made more carefully. Our guide to hiring a CEO who has never held an SMF role covers this in depth.

The questions a board should work through are practical:

• Has the candidate held any approved role? A candidate who has held SMF2 (CFO), SMF3 (Executive Director) or SMF24 (Chief Operations) already understands personal accountability, Conduct Rules and supervisory engagement. A candidate who has never been approved for anything is a bigger step.
• Where are the gaps? Be specific. A commercial leader from an unregulated business may need strong support on regulatory relationship management; a former CFO may need more depth on conduct risk and customer outcomes.
• How will the gaps be filled? The regulator will want to see that the firm has thought about this: an experienced chair, a strong compliance function, a capable deputy, and a structured induction and development plan.
• Is the application ready for scrutiny? The Form A for a first-time SMF1 should explain the candidate’s suitability clearly, and the candidate should be well prepared for any interview.

Handled well, a first-time SMF1 appointment widens the candidate pool considerably. Handled badly, it is the appointment most likely to stall at the approval stage.

Interim and Fractional Coverage While the Search Progresses

An SMF1 vacancy is not simply an operational gap. It creates regulatory notification obligations and, depending on the firm’s circumstances, can cause supervisory concern if it is not dealt with quickly. Regulators expect firms to have succession arrangements for their senior managers, and an extended SMF1 vacancy without a clear plan for cover will be noticed. Our guide to SMCR board succession planning covers how to prepare before the vacancy arises.

Where a departure is planned, the transition should be managed so the SMF1 role is never uncovered — either through an overlap period or by approving the successor before the outgoing CEO leaves. Where a departure is unplanned, the firm’s compliance team and advisers should confirm the notification obligations and cover options under SUP 10C of the FCA Handbook. Since April 2026, the 12-week rule gives a little more room: an appropriate individual can step in as acting CEO while an application is prepared and submitted.

Exec Capital can introduce experienced interim CEOs who understand SMF1 obligations and have held the designation before. Interim cover allows the permanent search to run at the pace it needs rather than being compressed by urgency, which tends to produce better appointments.

Building the Team Around the CEO

No CEO carries SMF1 alone. The quality of the senior team around them is a large part of how they show they took reasonable steps, and it is one of the first things a strong candidate will examine. At smaller and growing firms, the two roles that matter most after the CEO are usually compliance oversight (SMF16) and the money laundering reporting officer (SMF17).

Many smaller authorised firms — brokers, IFAs, consumer credit firms, payment and e-money businesses, small asset managers — do not need a full-time head of compliance or MLRO, but they do need someone experienced, credible with the regulator and genuinely engaged. A fractional appointment, typically one or two days a week, gives the firm a named, approved individual with real experience at a cost proportionate to the business. Our fractional compliance officer service places SMF16 holders on this basis, and our fractional MLRO service does the same for SMF17. At many firms one experienced person holds both roles; our guide to SMF16 vs SMF17 and when to combine them sets out when that works.

For the CEO, a strong fractional SMF16 or SMF17 brings several things:

• Independent challenge. An experienced compliance officer or MLRO who has seen how other firms handle similar issues will challenge the CEO in ways an internal junior hire may not.
• Credibility with supervisors. The regulator looks closely at who holds SMF16 and SMF17. A seasoned individual strengthens the firm’s position in supervisory meetings and in any application.
• Evidence of reasonable steps. Appointing capable people to key control roles, and overseeing them properly, is part of how a CEO meets the Duty of Responsibility.
• Continuity through a CEO transition. When the CEO changes, an established compliance officer and MLRO keep the control framework stable while the new chief executive settles in.

Beyond compliance, boards should check whether the CFO, Chief Operations function and chair are in place and approved, and whether any of those roles will change around the CEO appointment. Where a new CEO is coming in alongside a new Chief Operations Function (SMF24) or finance lead, the searches and applications should be coordinated so the regulator sees a coherent senior team rather than a series of disconnected changes.

Timing the CEO Search at a Regulated Firm

The most common mistake in regulated firm CEO searches is starting too late. The search itself takes time at this level, and the approval stage adds a statutory period of up to three months for a complete application on top. Add notice periods — often long for senior executives in financial services — and a regulated CEO appointment commonly takes several months from the decision to search to the individual being approved and in post. At dual-regulated firms, boards should allow more.

Boards that begin the search only when the outgoing CEO has already resigned are working against the clock. That can still be done with a well-run process, but it needs a quick, clear brief, no delays at shortlist stage, references requested early, and a Form A submitted as soon as the preferred candidate accepts. Any significant delay — a board that takes weeks to review a shortlist, a candidate who asks for more time before committing — pushes the timeline out and adds operational and regulatory risk.

We advise on timing from the start of every regulated CEO engagement. Where a compressed timeline is unavoidable, we can help the firm prepare the approval application in parallel with the final stages of the search, and use the 12-week rule and interim cover so the business is never without an accountable chief executive.

Working with Exec Capital on Your CEO Appointment

Exec Capital places CEOs at FCA-regulated firms on both a retained and contingency basis. For complex or senior mandates — dual-regulated businesses, challenger banks, firms with recent regulatory concerns, or roles where regulatory track record is a primary selection criterion — we work on a retained basis. For smaller authorised firms where the candidate pool is broader and the search can move quickly, contingency search is available.

Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate. Our process builds the approval timeline in from the outset, supports Form A preparation once a preferred candidate is identified, helps boards shape a Statement of Responsibilities that reflects the real scope of the role, and can fill the fractional SMF16 and SMF17 roles around the CEO at the same time. If you are approaching a CEO appointment at a regulated firm, our regulated firm CEO search team can talk through the market, the timeline and the right approach for your circumstances.

Frequently asked questions

Does every FCA-regulated firm need an SMF1?

No. A firm needs an approved SMF1 where it has a chief executive and falls within the parts of the regime that require the function — in practice Core and Enhanced solo-regulated firms and dual-regulated firms. Limited Scope firms usually operate with a narrower set of functions.

Who approves the CEO at a bank or insurer?

At dual-regulated firms the Chief Executive function is designated by the PRA. The PRA approves the appointment, and the FCA must give its consent, so both regulators assess the candidate.

Can someone act as CEO before they are approved?

Only within the cover rules. Since 24 April 2026, where someone steps in to provide cover, the firm has 12 weeks to submit an SMF application and the individual can continue while it is decided. A permanent appointment should otherwise be approved before the person starts.

Will SMF1 move to a notification regime?

Not under current proposals. CP26/37 proposes moving several oversight roles to notification, but the Chief Executive function would stay pre-approved. The consultation closes on 22 January 2027 and depends partly on legislation.

Does the Duty of Responsibility mean the CEO is presumed guilty if something goes wrong?

No. The original reverse burden was removed in 2016. The regulator must show the CEO did not take reasonable steps, but a CEO who cannot evidence their oversight is still in a weak position.

Do smaller firms need a full-time compliance officer and MLRO alongside the CEO?

Not always. Many smaller firms appoint an experienced fractional SMF16 and SMF17, often combined in one person, working one or two days a week. What matters is that the individual is capable, engaged and approved.