Senior Managers vs Certification Regime

The Senior Managers Regime and the Certification Regime are the two main parts of the Senior Managers and Certification Regime (SM&CR). They sit side by side, but they cover different people, run on different approval routes and put different obligations on the individual and the firm. Senior managers are approved by the regulator before they act. Certified staff are assessed and certified by the firm itself. Treating the two as interchangeable, or putting someone in the wrong tier, is one of the most common SM&CR errors we see when boards and HR teams bring us a regulated hire.

The picture has also moved a long way in 2026. The FCA and PRA finalised the first phase of their SM&CR review in April, HM Treasury has confirmed it intends to take the Certification Regime out of primary legislation, and in October both regulators published phase 2 consultations that would remove it altogether. This guide sets out how the two regimes work today, what changed in 2026, what firms still have to do while the law catches up, and how all of this affects hiring into regulated roles.

The three tiers of SM&CR

SM&CR splits the people in a regulated firm into three groups:

• Senior managers. Individuals who hold a Senior Management Function (SMF). They must be approved by the FCA, or by the PRA with FCA consent at dual-regulated firms, and each has a Statement of Responsibilities setting out what they are accountable for.
• Certified staff. People who are not senior managers but whose roles could cause significant harm to the firm or its customers. The regulator does not approve them. The firm must assess them as fit and proper before they start and certify them annually.
• Conduct Rules staff. Almost everyone else who works in the firm, apart from purely ancillary roles. They are bound by the Individual Conduct Rules but sit outside both the approval and certification processes.

The basic distinction is simple. Regulators pre-approve senior managers; firms certify the next layer down. Everything else in this guide follows from that.

Who is in the Senior Managers Regime

The Senior Managers Regime covers people performing a prescribed Senior Management Function. These are the top executive and non-executive roles: Chief Executive (SMF1), Chief Finance (SMF2), Executive Director (SMF3), Chief Risk (SMF4), Head of Internal Audit (SMF5), Chair (SMF9), the committee chairs (SMF10 to SMF13), Senior Independent Director (SMF14), Compliance Oversight (SMF16), Money Laundering Reporting (SMF17), Other Overall Responsibility (SMF18), Chief Operations (SMF24) and, for partnerships, Partner (SMF27). Our SMF roles guide explains each function and which firms need it.

Which SMFs a firm needs depends on whether it is a limited scope, core or enhanced firm, and whether it is solo or dual regulated. A small core firm may have only a handful of senior managers, with one person sometimes holding more than one function. An enhanced firm or a bank will have a much longer list and a Management Responsibilities Map showing how accountability is divided.

Three features set senior managers apart:

• Regulatory approval. The firm submits an application (Form A) and the regulator decides whether the candidate is fit and proper for that role at that firm. Approval does not travel with the person: a CEO approved at one firm needs a fresh application at the next.
• Statements of Responsibilities. Each senior manager has a document setting out what they are personally accountable for, including any Prescribed Responsibilities allocated to them. Our guide to Statements of Responsibilities covers how to draft them so they stand up in a supervisory review.
• The duty of responsibility. Under the Financial Services and Markets Act 2000, as amended in 2016, the regulator can take action against a senior manager where the firm breaches a requirement in an area they are responsible for and they did not take the steps a person in their position could reasonably be expected to take to prevent it.

Senior managers are also subject to the Senior Manager Conduct Rules on top of the Individual Conduct Rules, covered below.

Who is in the Certification Regime

The Certification Regime covers staff who perform a certification function. The FCA defines these in SYSC 27. The main categories are significant management functions (senior people who run a significant business area but are not SMFs), roles subject to qualification requirements such as many retail investment advisers, client-dealing roles, proprietary traders, algorithmic trading roles, CASS oversight at smaller firms, material risk takers at banks and some investment firms, and anyone who manages a certified person.

The certified population is usually far larger than the senior manager group. At a wealth manager it might include investment managers, advisers, client relationship directors and compliance staff below the SMF16 holder. At a bank it can run into hundreds or thousands of people across head office and the branch network. Senior compliance and risk staff who do not hold an SMF are often certified, which is why so many of the Head of Compliance, Head of Risk and Deputy MLRO roles we fill through our compliance and risk recruitment practice fall in this tier.

Certified staff are not pre-approved by anyone outside the firm. The firm carries the whole responsibility for deciding that each person is fit and proper, and for keeping that judgement current.

Approval versus certification: how each process works

Approving a senior manager

For an SMF, the firm does its own due diligence first: criminal record check, regulatory references covering the last six years, qualification and employment checks, and its own fitness and propriety assessment. It then submits the application with the candidate’s Statement of Responsibilities. The regulator can interview the candidate and has a statutory period of three months from a complete application to decide. HM Treasury has said it intends to cut that statutory deadline to two months, which both regulators already report against voluntarily.

Phase 1 of the review changed the 12-week rule, which lets someone cover an SMF temporarily when the holder leaves unexpectedly. From 24 April 2026 the firm has 12 weeks to submit an application, not 12 weeks to submit it and get it approved, and the person can carry on in the role while the regulator decides. Criminal record checks for SMF applications also now stay valid for six months rather than three. These are real improvements for firms that lose a senior manager at short notice, but they do not remove the need for a candidate who will pass approval.

Certifying a member of staff

For a certification function, the firm assesses the person before they start performing the role and then at least once a year. The assessment covers the same three headings the FCA uses for senior managers: honesty, integrity and reputation; competence and capability; and financial soundness. Our guide to fitness and propriety sets out what evidence typically sits behind each heading.

The firm must request regulatory references for new certified staff, keep records of each assessment, issue a certificate saying the person is fit and proper for the specific function, and update the FCA Directory. If someone is no longer fit and proper, the firm must not certify them, must stop them performing the function, and must reflect that in any future regulatory reference.

What phase 1 changed for annual certification

The FCA’s PS26/6, published with the PRA’s PS12/26 in April 2026, made certification lighter without removing it. From 24 April 2026 the FCA’s guidance says annual recertification should be done in a proportionate way: an email can replace a paper certificate, and firms can fold recertification into their appraisal cycle rather than running a separate exercise. From 10 July 2026 the FCA removed the need to certify one person for several overlapping certification functions, which it estimated would cut the number of certification roles by around 15%. Directory updates for most changes now have 20 business days rather than seven, although departures must still be notified within seven.

Senior Managers Regime vs Certification Regime at a glance

The table below compares the two regimes as they apply today, after the phase 1 changes and before any phase 2 legislation takes effect.

The Conduct Rules across both regimes

The Individual Conduct Rules apply to senior managers, certified staff and Conduct Rules staff alike. In short, they require people to act with integrity; act with due skill, care and diligence; be open and cooperative with the regulators; pay due regard to customers’ interests and treat them fairly; observe proper standards of market conduct; and, under the Consumer Duty, act to deliver good outcomes for retail customers.

Senior managers carry four additional Senior Manager Conduct Rules. They must take reasonable steps to ensure the business they are responsible for is controlled effectively, complies with the regulatory system, and that any delegation is to an appropriate person who is overseen properly. They must also disclose to the regulators anything they would reasonably expect to be told about.

This is where the practical difference in accountability shows. A certified person who breaches a Conduct Rule can face action for their own conduct. A senior manager can face action for failings in the area they are responsible for, even where they did not commit the breach themselves, if they did not take reasonable steps. That is why candidates for SMF roles look so closely at the Statement of Responsibilities they are being asked to sign, and why boards should agree it before an offer is made.

Regulatory references: where the two regimes connect

When a firm hires someone into an SMF or a certification function, it must ask any previous regulated employer from the last six years for a regulatory reference. The reference must disclose relevant matters, including any finding that the person was not fit and proper and any disciplinary action for a Conduct Rule breach. Phase 1 guidance now says firms should aim to respond to a request within four weeks rather than six, which helps keep start dates on track.

References are how conduct history moves between firms. A candidate removed from a certified role at a previous employer will usually have that in their reference, and the hiring firm has to weigh it whether the new role is an SMF or a certification function. For the hiring timeline, that means references should be requested as soon as a preferred candidate is identified, not after the offer letter has gone out.

The PRA’s phase 2 consultation proposes removing the reference requirement for people who would previously have been in the Certification Regime, while keeping it for senior managers. Firms could still take references as part of good hiring practice; it would just no longer be a rule for that group.

The future of the Certification Regime

HM Treasury’s decision

In its consultation response of 22 April 2026, the government said it intends to remove the Certification Regime from the Financial Services and Markets Act 2000. The FCA and PRA would then use their own rule-making powers to set whatever requirements they consider proportionate for staff below senior manager level. The government also said it would line up the commencement of that change with the regulators’ replacement rules to avoid leaving gaps. The PRA reports that the Financial Services and Markets Bill carrying these changes was introduced into Parliament in May 2026.

Phase 2 consultations: FCA CP26/37 and PRA CP14/26

On 22 October 2026 the FCA published CP26/37 and the PRA published CP14/26. Both close on 22 January 2027. The main proposals are:

• Removing the Certification Regime, including annual certification, certificates and regulatory references for that population.
• Retiring the FCA Directory of certified and assessed persons.
• Fewer pre-approved SMFs. The FCA proposes removing some SMFs and making other roles notified rather than approved. The PRA proposes moving almost half of its SMFs to notification, including Head of Internal Audit, the committee chairs and Senior Independent Director, while keeping pre-approval for roles such as CEO, CFO, CRO, Chair and COO. It estimates SMF applications would fall by more than 40%.
• No routine resubmission of Statements of Responsibilities and Management Responsibilities Maps. Firms would keep them up to date and provide them on request.
• Simpler Conduct Rules administration, with lighter training requirements and higher thresholds for reporting breaches.

For banks and insurers, the PRA proposes replacing certification with an ongoing duty to assess whether relevant staff have the integrity, honesty and other personal qualities their roles need, built into its existing competent employees rule, at recruitment and again if there is reason to reconsider. The FCA’s summary does not yet set out its replacement in the same detail. The FCA expects to publish final rules in the first half of 2027, and the PRA expects implementation in the second half of 2027, both depending on the Bill passing and being commenced.

What this means in practice now

Until the legislation is passed and commenced and the new rules take effect, the Certification Regime still applies in full, as amended by phase 1. Firms must keep assessing certified staff before they start, recertify them each year, request and give regulatory references, and keep the Directory up to date. A consultation proposal is not a rule change, and a firm that stops certifying early would be in breach.

What firms can sensibly do now is take the phase 1 savings: fold recertification into appraisals, remove overlapping certifications, and stop running annual criminal record checks where they are not required. They can also plan for a model in which the firm still has to be satisfied that staff in important roles are fit for them, but without the certification paperwork. The underlying expectation of competent, honest people in roles that can cause harm is not going away.

Cryptoasset firms entering the FCA gateway are in a slightly different position: the FCA has confirmed a modification by consent approach to the Certification Regime for them in PS26/13, so they should check how that applies to their own application.

Common classification mistakes

• Under-identifying the certified population. Firms focus on the SMF tier because it is more visible, then miss senior people who manage significant business areas or deal with clients and should be certified.
• Treating recertification as a box-tick. Phase 1 allows a lighter process, not no process. Issuing certificates without looking at complaints, performance concerns or changes in personal circumstances still leaves the firm exposed.
• Letting people act before they are certified. A certified person who starts the function before the firm has completed its assessment puts the firm in breach, even if the assessment later comes back clean.
• Weak regulatory references. Leaving relevant information out of a reference is itself a breach of the reference rules.
• Running ahead of phase 2. Dropping certification or SoR updates because of a consultation that has not yet become law.

What this means for hiring

For an SMF hire, regulatory approval is the longest step that the firm does not control. The application has to be built into the timeline from the start, along with references, the criminal record check and an agreed Statement of Responsibilities. Our article on how SM&CR is changing the senior appointment timetable looks at how the 2026 reforms affect planning. The revised 12-week rule gives more room when a senior manager leaves suddenly, but the firm still needs a credible permanent candidate in view.

For a certified hire, the firm’s own fit and proper assessment should be part of onboarding, finished before the person starts the function. Even if phase 2 removes certification in 2027, the firm will still need evidence that the person is competent and honest, so a good assessment process is not wasted work.

The roles where these questions come up most are compliance and financial crime. A Head of Compliance may be the SMF16 holder at a small firm and a certified significant manager at a larger one. Our Head of Compliance recruitment work covers both, and our wider FCA-regulated firm recruitment covers SMF appointments from CEO and CFO through to board chairs. If you are planning a hire now, our compliance and risk search team can help you work out which tier the role sits in and what the regulatory steps mean for your start date. Within FD Capital Group, our sister firm SMF Capital focuses on SMF and compliance appointments.

Frequently asked questions

What is the main difference between the Senior Managers Regime and the Certification Regime?

Senior managers must be approved by the FCA or PRA before they take up their role and are subject to the duty of responsibility. Certified staff are assessed and certified by their own firm, before they start and annually, and are not approved by the regulator.

Has the Certification Regime been abolished?

Not yet. HM Treasury intends to remove it from FSMA, and the FCA and PRA consulted on its removal in October 2026, but until the legislation and new rules take effect, firms must keep certifying staff.

Do certified staff need a Statement of Responsibilities?

No. Statements of Responsibilities apply only to senior managers. Certified staff have a certificate from the firm stating the function they are fit and proper to perform.

Is the Head of Compliance a senior manager or a certified person?

It depends on the firm. The person with overall responsibility for compliance oversight holds SMF16 and needs approval. Other senior compliance staff, such as a Head of Compliance reporting to a separate SMF16 holder, will usually be certified if their role is a significant management function.

How has annual certification changed in 2026?

Since April 2026 the FCA allows recertification by email and as part of the appraisal cycle, and since July 2026 firms no longer need to certify one person for several overlapping functions. The annual requirement itself remains in force for now.