Hiring an SMF2-Approved CFO: What the Chief Finance Function Really Demands

When a bank, insurer or larger FCA-regulated firm hires a chief financial officer, it is doing more than appointing its most senior finance leader. It is appointing the holder of SMF2, the Chief Finance function under the Senior Managers and Certification Regime (SM&CR). That is a pre-approved Senior Management Function carrying personal regulatory accountability for the firm’s financial affairs. It changes who the board can realistically appoint, how candidates have to be assessed, and what the firm must show the regulator before the new CFO can take up the role.

This guide explains what SMF2 covers and which firms need it, why an SMF2 brief is narrower than an ordinary CFO brief, how the approval process works after the 2026 SM&CR changes, and how to run a search that ends with a candidate who is both the right finance leader and approvable. Exec Capital runs CFO recruitment for regulated and unregulated businesses, and the regulated mandates are where the distinctions below matter most.

What SMF2 is, and which firms need one

SMF2 is the Chief Finance function. It is held by the person responsible for managing the firm’s financial resources and reporting directly to the board on its financial affairs. In practice that is the CFO or finance director, although the job title does not decide the matter: if the person with that responsibility is called something else, they still need approval for SMF2, and a CFO in name who does not actually hold the responsibility should not be put forward for it.

Not every regulated firm has an SMF2. The function applies to:

• Banks, building societies and PRA-designated investment firms. SMF2 is a PRA-designated function for these dual-regulated firms, so the application goes to the PRA, which needs the FCA’s consent before approving.
• Insurers within the PRA’s remit. Solvency II insurers and similar firms also allocate the Chief Finance function as a PRA-designated SMF.
• Enhanced FCA solo-regulated firms. Under the FCA’s solo-regulated regime, SMF2 sits in the list of functions that apply only to Enhanced firms, alongside the Chief Risk function, Head of Internal Audit and the committee chairs.

Core firms, which make up most FCA solo-regulated firms, generally do not have an SMF2 at all. Their required functions are the Chief Executive, Executive Director, Chair, Partner where relevant, Compliance Oversight and the MLRO. A finance director at a core firm who sits on the board will usually be approved as an Executive Director (SMF3) instead, and one who does not sit on the board will not hold an SMF. This matters because the Enhanced thresholds rose on 10 July 2026 (to £65bn average assets under management, £45m of intermediary regulated revenue and £130m of consumer credit revenue, among other tests), so some firms that used to be Enhanced are now core. Before writing an SMF2 brief, confirm the firm’s current category. The FCA’s Senior Managers Regime pages explain how categorisation drives which functions apply.

Like every Senior Management Function, SMF2 comes with a Statement of Responsibilities, the Senior Manager Conduct Rules and the Duty of Responsibility. The Duty of Responsibility means the CFO can face enforcement action if something goes wrong in an area they are responsible for and they did not take reasonable steps to prevent it. Getting the Statement of Responsibilities right is part of the hire, not an afterthought; our note on Statements of Responsibilities at FCA firms covers how to draft one that matches what the role really does.

Why an SMF2 brief is narrower than a normal CFO brief

A strong commercial CFO is not automatically a credible SMF2. Someone who has led a fundraise, built a finance team through rapid growth or taken a business through a sale may have an excellent record and still lack the experience a regulated board and the regulator will look for. The SMF2 brief adds requirements that a commercial brief leaves out.

Prudential and regulatory reporting experience

At a bank or building society, the CFO owns capital and liquidity planning, the ICAAP and ILAAP, and a heavy calendar of regulatory returns. At an insurer, Solvency II reporting, the solvency capital requirement and the Own Risk and Solvency Assessment sit close to the finance function. At an Enhanced investment or consumer credit firm, the prudential framework is different again, but the principle holds: the regulator expects the SMF2 to understand the firm’s capital and liquidity position and the returns built on it. The best candidate is often someone with a regulated finance record, even if their commercial scope is narrower than an applicant from outside financial services.

Relevance to the firm’s business model

Regulated experience is not interchangeable across sectors. A CFO from an asset manager will know the investment firm prudential regime but may not know a lender’s credit impairment modelling or an insurer’s reserving. Regulators look at whether the candidate’s experience is relevant to this firm, at this size, with this business model. A search brief should spell out which regimes and which risks the new CFO must already understand, and which they can reasonably learn.

Working within the wider SMF structure

The SMF2 works alongside the Chief Executive (SMF1), the Chief Risk function (SMF4), compliance oversight and internal audit. The CFO has to give the board assurance on the financial position without taking over the risk function’s accountabilities or blurring lines in the management responsibilities map. Where the firm is hiring a new chief executive at the same time, the two searches should be planned together; we run CEO searches for regulated firms on the same basis, so the pairing can be tested rather than left to chance.

Fitness, propriety and the evidence behind the application

Before applying, the firm must satisfy itself that the candidate is fit and proper, and it must be able to show its working. The assessment covers honesty, integrity and reputation; competence and capability; and financial soundness. For an SMF2 candidate, competence is usually the area the regulator probes hardest: does this person understand the prudential regime, the firm’s balance sheet risks and the reporting they will sign off? Our guide to fitness and propriety under SM&CR sets out the criteria in more detail.

The supporting evidence typically includes:

• Regulatory references from previous regulated employers covering the past six years. Following the April 2026 changes, firms are expected to answer reference requests within four weeks rather than six.
• A criminal records check. From 24 April 2026 a check can be up to six months old when the application goes in (previously three), and a check is no longer needed for certain internal or intra-group moves.
• A documented competence assessment that ties the candidate’s experience to the specific responsibilities in the Statement of Responsibilities.
• A handover plan showing how the outgoing CFO’s knowledge and open issues will pass to the new one.

A search that leaves fitness and propriety until after the board has chosen its preferred candidate is taking a risk. If a reference raises an issue or the competence case is thin, the firm can find itself with an accepted offer and an application it does not want to submit. Testing these points during shortlisting avoids that.

The approval process and timeline in 2026

The application is made on Form A through the regulators’ online systems, with the Statement of Responsibilities and supporting documents. Our FCA Form A guide for boards covers what goes into it and the common reasons applications stall. For a PRA-designated SMF2 at a bank or insurer, the PRA leads the assessment with FCA consent; for an Enhanced solo-regulated firm, the FCA decides.

On timing, three points matter:

• The statutory deadline is still three months from receipt of a complete application. The Government confirmed in April 2026 that it intends to legislate to cut this to two months, and the regulators already report voluntarily against a two-month timeframe, but the legal limit has not yet changed.
• The FCA has a voluntary target, measured from January 2026, of completing at least half of SMF applications inside 35 days, as announced in its faster authorisation targets. That is a target across all applications, not a promise for any individual case.
• Incomplete applications take longer. The clock runs from a complete application, so missing references, a thin competence case or a vague Statement of Responsibilities will extend the process. Interviews by the regulator are more likely for senior roles at larger firms and for candidates new to an SMF.

A board should plan for approval to take a meaningful part of the candidate’s notice period and should not assume the new CFO can start in the SMF2 role on day one unless approval has already been granted.

When the CFO leaves suddenly: the 12-week rule and interim cover

CFO departures are not always planned. Illness, a resignation with short notice, gardening leave or a performance-related exit can leave the Chief Finance function without an approved holder. The 12-week rule lets another person cover the function without approval while the firm sorts out a permanent arrangement.

The rule changed on 24 April 2026 under FCA PS26/6 and PRA PS12/26. The 12 weeks is now the deadline for submitting a complete SMF application, not for getting it approved. Once the application is in, the person covering can stay in place until the regulator decides. Anyone covering under the rule is subject to the Senior Manager Conduct Rules, and breaches have to be reported promptly rather than left for annual returns.

In practice this gives a firm two routes. It can bring in an experienced interim CFO to cover the function while a permanent search runs, applying for approval for the interim if the cover will last longer than the rule allows. Or, if the right permanent candidate is identifiable quickly, it can move straight to an application. Either way, the 12 weeks pass quickly once references and a criminal records check are needed, which is why our urgent SMF appointment service starts with the documentation as well as the candidate.

What the phase 2 reforms could change

On 22 October 2026 the FCA published CP26/37 and the PRA published CP14/26, the second phase of the SM&CR review. Both close on 22 January 2027, with final rules expected in 2027 and implementation depending on the Financial Services and Markets Bill passing. The proposals include:

• moving several SMFs, such as the Head of Internal Audit and the committee chairs, from pre-approval to notification;
• removing the Certification Regime;
• raising the Enhanced thresholds again, which would move more solo-regulated firms into the core category;
• extending the temporary cover period from 12 weeks to 18 weeks;
• ending routine filing of updated Statements of Responsibilities and management responsibilities maps.

The Chief Finance function is not among the roles the PRA proposes to move to notification, so for banks and insurers SMF2 would remain a pre-approved role. For solo-regulated firms the practical change is more likely to come through the thresholds: a firm that drops from Enhanced to core would no longer need an SMF2 at all, although its finance director may still need approval as an Executive Director if they sit on the board. These are proposals, not rules, and firms should plan on the current regime until final policy is published.

How to run an SMF2 search

The pool of finance leaders who combine a strong CFO record with regulated experience relevant to a particular firm is much smaller than the pool of good CFOs. Most are in post and not looking, and many have long notice periods. A search that works usually has these features:

• A brief that states the regulatory dimension up front. Firm category, regulator, prudential regime, the draft Statement of Responsibilities and any other functions the CFO will hold, such as SMF3 if they will sit on the board.
• Research beyond the obvious names. Deputy CFOs, finance directors of regulated subsidiaries and heads of regulatory reporting at larger firms are often ready for a step up and can make strong SMF2 candidates at a smaller firm.
• Assessment that tests both halves. Interviews should cover commercial finance leadership and the candidate’s grasp of capital, liquidity and regulatory reporting, with early sight of anything that could complicate fitness and propriety.
• A realistic timetable. Notice periods and the approval process together often run longer than boards expect, so interim cover should be part of the plan from the start where the role is already vacant.
• Support through approval. The firm submits the application, but the search firm should help assemble the evidence, chase references and prepare the candidate for a possible regulator interview.

Exec Capital runs regulated CFO mandates as retained searches. Every search is run by our specialist team, with Adrian Lawrence FCA, a chartered accountant and former listed-company Finance Director, overseeing each mandate. Where a firm is building out several governing functions at once, we coordinate the searches so the roles fit together, and our wider CFO search practice means we can compare regulated candidates against strong finance leaders from outside the sector. Our sister firm SMF Capital focuses solely on senior manager function hires and shares its network with us.

Frequently asked questions

Does every regulated firm need an SMF2?

No. SMF2 applies to banks, building societies, PRA-designated investment firms, PRA-regulated insurers and Enhanced FCA solo-regulated firms. Core solo-regulated firms do not have the function; a board-level finance director there is usually approved as SMF3.

Can a CFO from an unregulated business hold SMF2?

Yes, if the firm can show they are fit and proper for the role. The competence case will need more work, and the regulator is more likely to interview a candidate with no prior SMF approval, so the firm should be confident the person understands the prudential regime before applying.

Can a part-time or fractional CFO hold SMF2?

It is possible where the person genuinely has responsibility for the firm’s financial affairs and the time commitment matches the size and complexity of the business. At a large bank or insurer that is unlikely to be part-time. The firm must not name someone as SMF2 while the real responsibility sits with someone else.

How long does SMF2 approval take?

The legal limit is three months from a complete application. The FCA aims to complete at least half of SMF applications in 35 days or fewer, but complex cases, incomplete applications and regulator interviews can take longer.

What happens if our CFO leaves before a successor is approved?

Under the 12-week rule another person can cover the function without approval, but since 24 April 2026 the firm must submit a complete SMF application within that period. The person covering can then stay in place until the regulator decides.

Will the phase 2 reforms remove the need for SMF2 approval?

Not as currently proposed. The PRA’s consultation keeps the Chief Finance function as a pre-approved role. Raised Enhanced thresholds could take some solo-regulated firms out of SMF2 altogether, but the proposals are open until January 2027 and may change.