SMF Roles in UK Regulated Firms:

The Senior Managers and Certification Regime (SMCR) reshaped the executive hiring landscape across UK financial services when it took full effect. Since the Financial Conduct Authority extended what had been a banking regime to all FCA-solo-regulated firms in 2019, every regulated business in the UK has had to think more carefully about who sits in its most senior roles, what they are accountable for, and how they are appointed. For boards, founders and CEOs hiring into these positions, the regime turned what used to be a straightforward executive search into a more layered conversation. The role is not just defined by what the business needs operationally — it is also defined by what the FCA expects in writing, with personal regulatory accountability attached. Smaller FCA-authorised firms often use a fractional Chief Compliance Officer to hold SMF16 a few days a month.

This guide sets out the Senior Manager Functions (SMFs) that matter most for hiring decisions. It explains what each role is, who it applies to, what the FCA expects, and — practically — what changes about how you hire when an SMF designation attaches to the position. It is written for businesses making the hire, not for compliance professionals briefing the regulator. If you are trying to decide what the right role looks like and where to find the right person, this is the orientation guide. We have built our practice around hiring senior leadership into UK regulated firms across asset management, wealth management, insurance, brokerage, fintech and consumer credit. The SMF dimension is now part of how we run every regulated-firm search, drawing on what we see day-to-day in the market alongside the FCA’s published guidance on each role.

It is also the hub for every SMF guide we publish. The master table below lists each function by number, the regulator that designates it, the firms it applies to, whether it needs pre-approval today and what the Phase 2 reforms consulted on in October 2026 propose for it, with a link to our detailed guide wherever one exists.

What the SMCR is and why it matters for hiring

The SMCR exists to attach personal regulatory accountability to the most senior people in regulated firms. Before SMCR, firms could be fined for failures of governance and conduct, but the individuals making the decisions were rarely held personally responsible. The post-2008 reform programme — and specifically the work of the Parliamentary Commission on Banking Standards — concluded that this was a structural weakness, and the SMCR is the regulatory response.

The regime has three layers. Senior Managers hold designated SMF positions, must be FCA-approved before they take up the role, and have written Statements of Responsibility setting out exactly what they are accountable for. Certification Functions apply to other staff whose roles could harm the firm or its customers — they are not pre-approved by the FCA but have to be certified annually as fit and proper by the firm itself. Conduct Rules apply to almost everyone else and set baseline standards of integrity and competence.

For hiring decisions, the part that matters most is the SMF layer. When you are hiring into a role that carries an SMF designation, three things change compared with a non-regulated executive hire.

First, the candidate must be FCA-approved before they start. This is a documented application process — typically four to twelve weeks — and a candidate without prior SMF approval will need to clear it before the firm can deploy them into the role. For senior roles where the firm has already lost its incumbent, that gap can be commercially painful.

Second, the Statement of Responsibility is part of the role. What the person is responsible for needs to be defined in writing, agreed with them, and consistent with the firm’s overall responsibilities map. This is a real document with regulatory weight — not an internal job description that lives on a shared drive.

Third, the “reasonable steps” principle attaches personally. If something goes wrong in their area, the regulator can hold the individual personally accountable for whether they took reasonable steps to prevent it. That has implications for how senior the person needs to be, what they are paid, what insurance arrangements the firm needs to have in place, and how risk-tolerant the candidate pool genuinely is when offered the role.

These three differences compound to mean that hiring into SMF roles is a different exercise from hiring into the equivalent position at a non-regulated firm. The candidate pool is smaller, the reference and due diligence work is more thorough, the time-to-start is longer, and the role definition has to be tighter.

One scoping point before going further: not every firm the FCA supervises is inside the SMCR. Payment institutions and e-money institutions, for example, sit outside it and appoint their senior people under their own authorisation regimes, so the SMF numbers in this guide do not apply to them. Everything below concerns banks, building societies, credit unions, insurers and FCA-authorised firms under FSMA — asset and wealth managers, brokers, advisers, consumer credit firms, mortgage firms, insurance intermediaries and the rest.

Firm classification: Core, Enhanced, Limited Scope

Not every SMF applies to every firm. The set that applies depends on how the firm is classified under SMCR — Core, Enhanced, or Limited Scope. Knowing your classification is the starting point for working out what SMFs you actually need to fill.

Core firms are the default for the majority of FCA-solo-regulated firms. They face a smaller set of SMFs and a more limited responsibilities map than Enhanced firms. Most asset managers, wealth managers, brokers and intermediaries fall into this category.

Enhanced firms are the largest and most complex — typically firms with assets under management of £65 billion or more, certain banking-style activities, or other features that bring them into scope. Enhanced firms face the full set of SMFs and the most demanding governance and reporting requirements under the regime.

Limited Scope firms are those whose regulated activities are sufficiently narrow that only a reduced set of SMFs applies. Sole-trader financial advisers and certain insurance intermediaries are typical examples.

If you are not sure which classification your firm falls under, your compliance lead or external compliance adviser will know. The classification affects both the SMF set in scope and the certification population — which in turn affects every senior hire you make.

The Enhanced thresholds in more detail

The FCA’s categorisation page for solo-regulated firms sets out the current Enhanced tests, revised in 2026. A firm is Enhanced if, on a three-year rolling average, it has assets under management of £65 billion or more, intermediary regulated business revenue of £45 million or more a year, consumer credit lending revenue of £130 million or more a year, or (for a non-bank mortgage lender or administrator) 10,000 or more regulated mortgages outstanding. CASS large firms and certain significant SYSC firms are also Enhanced. A firm close to any of these lines should plan its senior hiring with the Enhanced SMF set in mind, because crossing a threshold brings in functions such as SMF2, SMF4, SMF5 and SMF24 that take time to recruit for and approve.

Limited Scope firms and SMF29

Limited Scope firms do not use SMF1 or SMF9. Instead, the senior person usually holds SMF29, the Limited Scope Function. A sole trader with no employees does not need an SMF at all; once they employ someone who must be approved or certified, they need SMF29. Depending on its permissions, a Limited Scope firm may also need an SMF16 or SMF17 holder. No Prescribed Responsibilities apply to Limited Scope firms.

Dual-regulated firms

Banks, building societies, credit unions, insurers and PRA-designated investment firms are dual-regulated. They are subject to the PRA’s rules as well as the FCA’s, and their SMFs are split between the two regulators: the PRA designates the prudential roles (CEO, CFO, CRO, Chair, committee chairs, actuarial and underwriting roles, among others) and the FCA designates the conduct-facing ones (Executive Director, Compliance Oversight, MLRO and some others). The PRA’s supervisory statement SS28/15, Strengthening individual accountability in banking (updated April 2026), sets out the PRA functions for banks.

Master table: every SMF, its regulator and our guide

The table lists every Senior Manager Function currently in use across the FCA and PRA rules — 31 in all, numbered SMF1 to SMF29 with sub-functions such as SMF20a, SMF23a and SMF23b (there is no SMF28). “Firm types” shows where each function applies: LS = Limited Scope, Core and Enhanced are the FCA solo-regulated categories, and “Dual” means banks, insurers and other PRA-authorised firms. All SMFs currently need pre-approval. The “Phase 2 proposal” column reflects FCA CP26/37 and PRA CP14/26 (October 2026); these are proposals only, closing on 22 January 2027, with final rules expected in the first half of 2027 and implementation in the second half at the earliest.

Sources: the FCA’s SM&CR guide for FCA solo-regulated firms for the Limited Scope, Core and Enhanced lists; the PRA’s CP14/26 for the PRA functions and their proposed treatment; and the FCA’s CP26/37 for the FCA proposals. Phase 2 depends on the Financial Services and Markets Bill 2026 becoming law. Until the new rules take effect, every SMF on this list still needs approval before the person starts.

A few cross-cutting guides sit alongside the function-by-function pages: our SMF salary guide covers pay across the functions, the authorisation journey explains how to build an SMF team for a new firm, and urgent SMF appointments covers what to do when a holder leaves without warning.

Which SMFs does my firm need?

The quickest way to work out your SMF set is to start from your category and then add the functions that depend on your structure — whether you have a chair, board committees, partners, a with-profits fund or overseas parent. The table gives the usual starting point.

Two practical points follow from this. First, a small Core firm can often meet its SMF obligations with three or four people — for example a CEO (SMF1), a second executive director (SMF3), and a compliance specialist holding SMF16 and SMF17 together — with a non-executive chair (SMF9) where the board has one. Second, the step up to Enhanced is significant. It adds up to a dozen functions, a full responsibilities map and the requirement that every business area has a senior manager with overall responsibility for it, so a firm approaching a threshold should start hiring for that structure well before it crosses the line.

If you are building a team from scratch for an authorisation application, the regulator will want to see the SMF holders identified — and usually applied for — as part of the application. Our compliance and risk recruitment practice regularly works with firms at this stage, when the SMF16 and SMF17 appointments are often the last pieces to fall into place.

The Senior Manager Functions: how they group for hiring

There are around 30 SMF designations across the regime (31 at the time of writing, as listed in the master table above), but for hiring purposes the most-hired ones fall into three working groups:

• Executive functions — those running the business: SMF1 CEO, SMF3 Executive Director, SMF24 Chief Operations Function
• Risk and oversight functions — SMF2 Chief Finance Function, SMF4 Chief Risk Officer, SMF5 Head of Internal Audit, SMF16 Compliance Oversight, SMF17 Money Laundering Reporting Officer
• Board and governance functions — SMF9 Chair, SMF10 Chair of Risk Committee, SMF11 Chair of Audit Committee, SMF12 Chair of Remuneration Committee, SMF13 Chair of Nomination Committee, SMF14 Senior Independent Director

There are also several specialist SMFs (SMF6 Head of Key Business Area, SMF7 Group Entity Senior Manager, SMF8 Credit Union SMF, SMF15 Chair of the With-Profits Committee, SMF18 Other Overall Responsibility, SMF19 Head of Third Country Branch, SMF20 Chief Actuary, SMF20a With-Profits Actuary, SMF21 EEA Branch Senior Manager, SMF22 Other Local Responsibility, SMF23 Chief Underwriting Officer, SMF23a Underwriting Risk Oversight (Lloyd’s), SMF23b Conduct Risk Oversight (Lloyd’s), SMF25 Small Insurer Senior Manager, SMF26 Head of Small Run-Off Firm, SMF27 Partner and SMF29 Limited Scope Function) which apply in specific firm types — Lloyd’s market, group structures, insurance, branches, partnerships and Limited Scope firms. Several are covered in the master table and our specialist guides rather than in the sections below.

Below we set out each of the most-hired SMFs in turn, with the practical implications for boards and executive search teams.

SMF1 — Chief Executive (Exec Capital territory)

The CEO of an FCA-regulated firm holds SMF1 and is the most senior individual accountable to the regulator. This role differs from a corporate CEO appointment in three ways that matter for the search.

The Statement of Responsibility for an SMF1 must be comprehensive. Unlike a corporate CEO whose accountability sits within an internal governance framework, the SMF1’s responsibilities are defined in a document the FCA can call up at any time. That document sets out which prescribed responsibilities sit with the CEO personally, which are delegated to other Senior Managers, and which are shared. Boards that have not built the responsibilities map before opening the search find themselves writing the Statement of Responsibility around the candidate they have already chosen — which is a less rigorous process than building the role specification first and matching candidates to it.

The candidate pool for SMF1 roles is materially narrower than for corporate CEO roles, and the diligence is heavier. Prior SMF1 approval is the strongest signal a candidate can carry, but it is not the only one — candidates with SMF3 (Executive Director) or strong SMF24 (Chief Operations) experience can transition into SMF1 with the right firm context. The fit-and-proper assessment that the FCA conducts will examine the candidate’s regulatory history, their conduct in previous roles and their understanding of the firm’s specific business model.

Approval timelines for SMF1 typically run six to twelve weeks for clean applications, longer where the FCA wants additional information or interviews. Boards that have not factored this into their succession planning often end up with a regulatory gap, an interim arrangement, or a compromise on the strongest candidate available.

SMF1 applies at Core, Enhanced and dual-regulated firms; at a Limited Scope firm the equivalent person usually holds SMF29 instead. For the regulated-firm search itself, see our CEO of regulated firm recruitment page.

For the corporate (non-regulated) version of this hire, see our CEO recruitment page.

SMF3 — Executive Director (Exec Capital territory)

SMF3 covers Executive Directors who are Board members of regulated firms but not the CEO. In smaller and mid-sized regulated firms — particularly Core firms — this is the SMF that applies to the second-most-senior executive: often a COO, a CFO who sits on the Board, or a Chief Commercial Officer. The Executive Director role under SMF3 is broader than its corporate equivalent because the Statement of Responsibility must capture the prescribed responsibilities allocated to that individual, not just their commercial brief.

The rule is wider than many boards expect: at Core and Enhanced firms, every director on the governing body who is not a non-executive needs SMF3 approval unless they already hold another SMF that covers the role (an SMF1 CEO who sits on the board does not also need SMF3, for example). A founder who joins the board as an executive director, or a finance director promoted to the board at a Core firm, needs an SMF3 application before taking the seat.

For hiring purposes, SMF3 candidates often come from firms one or two sizes larger, where they have held a similar Board role or where they have been one rung below SMF3-level on a larger Board. This is one of the SMF designations where a strong corporate executive can transition into a regulated firm role with the right preparation — the technical scope of the role is similar to a corporate Executive Director, with the regulatory dimension layered on top. We typically advise candidates entering an SMF3 role for the first time to take a structured FCA induction, which improves both their first-year performance and the firm’s regulatory comfort with the appointment. Our executive director recruitment for FCA-regulated firms page covers the search.

SMF24 — Chief Operations Function (Exec Capital territory)

SMF24 is the operational accountability role within the SMCR. The COO of a regulated firm — or, in firms where there is no formal COO, the most senior individual responsible for operations, technology, change and operational resilience — typically holds SMF24.

It is important to be clear about scope: SMF24 applies only at Enhanced and dual-regulated firms. At a Core firm, a COO who sits on the board holds SMF3; one who does not is not a Senior Manager at all, although they may well be a key hire.

This designation has gained materially in importance since the FCA’s Operational Resilience policy took effect in March 2022. SMF24 holders are personally accountable for the firm’s operational resilience capability — the ability to prevent, recover from and learn about operational disruption — and the regulator now treats this as a first-order supervisory priority. Consumer Duty implementation, third-party operational risk, IT and cyber resilience, and outsourcing governance all sit on the SMF24 desk. The Phase 2 consultations underline the point: both regulators propose to keep SMF24 subject to pre-approval, citing the risks posed by AI and cyber incidents, and to review that position two years after implementation.

The hiring market for SMF24 is, in our experience, the tightest of any executive SMF role. Candidates with prior SMF24 approval are a small population, and the operational resilience expectations have raised the bar for what good looks like. We frequently see boards under-spec the role, briefing a traditional COO search when what they need is a candidate who can hold operational resilience accountability under FCA scrutiny. The two are not the same person.

For the corporate (non-regulated) version of this hire, see our COO recruitment page.

SMF4 — Chief Risk Officer (Exec Capital territory)

SMF4 is held by the senior individual responsible for the risk function. It applies only at Enhanced firms and dual-regulated firms such as banks and insurers. At a Core firm, a Chief Risk Officer is not an SMF4 — if they sit on the board they hold SMF3, and otherwise they are not a Senior Manager. Where SMF4 applies, the CRO usually reports to the CEO with a direct line to the Chair of the Risk Committee, and in larger firms may sit on the Board.

The Statement of Responsibility for SMF4 must cover the firm’s risk management framework, the relationship with the Board’s Risk Committee (where one exists), and the firm’s risk appetite framework. The role is substantively different in firms where the CRO is the second line of defence (most common in regulated firms) versus firms where the CRO holds elements of the first line — the FCA has views on which model fits which firm type, and a candidate’s experience in the appropriate model is a material consideration.

The CRO talent market across UK regulated firms has been tight for several years. The post-2008 build-out of risk functions across the banking and asset management sectors created a generation of senior CROs, and the natural attrition into NED careers, advisory roles and overseas markets has thinned the pool. We advise clients to start an SMF4 search earlier than they think they need to, to avoid the situation where a strong commercial candidate is rejected on regulatory grounds and the timeline collapses.

Our CRO recruitment page covers the full role context, including the corporate (non-regulated) version of the hire.

SMF5 — Head of Internal Audit (Accountancy Capital territory)

SMF5 is the Head of Internal Audit. Internal audit is an accounting-qualified discipline — typically requiring ICAEW, ACCA or equivalent qualification combined with internal-audit-specific training under the IIA framework — and the SMF5 role is structurally different from external audit firm partner roles or general assurance work.

SMF5 applies at Enhanced and dual-regulated firms. Under the Phase 2 proposals it would move from pre-approval to notification at both the FCA and the PRA, on the basis that the role does not carry the same day-to-day executive control as other SMFs. The firm would still need to complete its fitness and propriety assessment, criminal record check and regulatory references before notifying.

This SMF role is owned within our group by our specialist colleagues at Accountancy Capital, whose practice covers audit and accounting-qualified hiring. If you are hiring into SMF5, we will introduce you directly to Accountancy Capital — there is no intermediary handover and the relationship continues into the appointment. Exec Capital also covers the role through our Head of Internal Audit recruitment service.

SMF2, SMF16, SMF17 — Finance and compliance functions (FD Capital and partner territory)

Three SMF roles are owned within our group by our specialist colleagues at FD Capital, whose practice is focused exclusively on finance leadership and compliance:

• SMF2 — Chief Finance Function. The CFO or Finance Director with SMF responsibility. SMF2 applies only at Enhanced and dual-regulated firms; at a Core firm, a CFO who sits on the board holds SMF3. FD Capital’s practice is built around CFO and FD recruitment, including SMF2 appointments. See FD Capital’s FCA-Regulated Firms hub.
• SMF16 — Compliance Oversight. The Head of Compliance with personal accountability for the compliance function. See FD Capital’s Compliance Recruitment page.
• SMF17 — Money Laundering Reporting Officer (MLRO). The senior individual accountable for the firm’s anti-money-laundering programme. See FD Capital’s MLRO Recruitment page.

If your search involves any of these three SMFs, we will introduce you directly to FD Capital and the relationship continues from there.

SMF16 and SMF17 are also the most common SMF searches across the group, and Exec Capital runs them directly too — permanent, interim and fractional. They are the two functions almost every Core firm has to fill, and both are proposed to stay subject to pre-approval under Phase 2. For a small firm the question is rarely whether it needs them, but whether it needs them full-time. The next section covers the fractional route.

Fractional SMF16 and SMF17: how the model works

Many Core and Limited Scope firms — small IFAs, discretionary managers, brokers, consumer credit firms, fund managers and newly authorised fintechs — need an approved SMF16 and SMF17 but do not have a full-time job for either. The fractional model answers that: an experienced compliance professional holds SMF16, SMF17 or both for the firm on a part-time basis, typically for a set number of days a week or month, and is approved by the FCA for that firm in the same way a full-time hire would be.

What the FCA looks at

Approval is personal and firm-specific. The firm submits its own application, and the FCA assesses the candidate’s fitness and propriety and whether they can do the job at that firm. For a fractional holder, the practical questions are time and conflicts: how many other roles the person holds, whether the days committed are realistic for the firm’s size and risk profile, and how they will be reachable when something urgent happens. The Senior Manager Conduct Rules and the duty of responsibility apply in full — a fractional SMF16 is just as accountable for taking reasonable steps as a full-time one — so experienced fractional candidates are careful about how many firms they take on.

Making a fractional appointment work

• Write the time commitment down. The engagement letter should set out days, response times and how cover works during holidays, and should match what is said in the approval application.
• Give real access. The fractional SMF16 needs management information, board papers and the authority to escalate. A compliance officer who only sees what is sent to them cannot take reasonable steps.
• Keep the Statement of Responsibilities tight. Be clear about what is in scope — compliance monitoring, financial promotions, Consumer Duty reporting, complaints oversight — and what sits with executive management.
• Plan for exit. If the fractional holder leaves, the firm needs a replacement approved; under the current rules another person can provide temporary cover for up to 12 weeks while the application is prepared and submitted.

Fractional SMF16 and SMF17 appointments are the single largest category of mandate across our group. Exec Capital’s fractional compliance officer and fractional MLRO services cover the two roles, and our compliance and risk recruitment team handles the combined SMF16/17 brief that many small firms need. For the decision itself, our guide on permanent, interim or fractional compliance hires sets out the trade-offs, and when a firm needs a fractional MLRO covers the AML side. Where a firm is under supervisory pressure, see our guide to interim SMF16 and SMF17 cover during an FCA VREQ.

Combining SMFs at smaller firms

The regime does not prevent one person from holding more than one SMF, and at smaller firms it is common. Each function needs its own approval (the application can cover several at once), and the Statement of Responsibilities must show all of them. What the regulator looks at is whether the combination makes sense: whether the person has the time and the expertise for each role, and whether holding them together creates a conflict.

The combinations we see most often are:

• SMF16 and SMF17 together. The most common pairing at Core firms. The skills overlap, and a single compliance and financial crime lead is proportionate for many small firms. It becomes harder to justify as AML risk grows — a firm with high-risk customers or large transaction volumes may need a dedicated MLRO.
• SMF3 with SMF16 or SMF17. A compliance director who sits on the board. Workable, provided they are not also running a revenue-generating business line that compromises the independence of the compliance function.
• SMF29 with SMF16 and SMF17. At Limited Scope firms, the principal often holds all the relevant functions.
• SMF1 with SMF16. Possible at very small firms but often questioned, because the person overseeing compliance is also the person whose business decisions compliance should challenge. Most firms bring in a fractional SMF16 instead.

Combining Chair (SMF9) and Chief Executive (SMF1) runs against standard governance practice and is something a regulator will want to understand. More detail on all of this is in our guides to the dual SMF holder at smaller regulated firms and whether one person can hold more than one SMF.

SMF9, SMF11, SMF14 — Board and committee chair roles (NED Capital territory)

The board and governance SMFs are owned within our group by our specialist colleagues at NED Capital, whose entire practice is built around board and non-executive appointments. The roles in this category are:

• SMF9 — Chair. The Chair of the Board of a regulated firm. The role is materially different from a corporate Chairman — the Chair leads the board’s oversight of the firm and, at larger firms, the Statement of Responsibility includes prescribed responsibilities for the board’s own governance and performance. SMF9 applies at Core, Enhanced and dual-regulated firms that have a chair.
• SMF10 — Chair of the Risk Committee. Where an Enhanced or dual-regulated firm’s Board has a Risk Committee, the Chair of that committee holds SMF10. The function does not apply at Core firms, even where they have a risk committee.
• SMF11 — Chair of the Audit Committee. The Chair of the Audit Committee — typically a Fellow of one of the accounting institutes with significant audit committee experience.
• SMF12 — Chair of the Remuneration Committee. Applies at Enhanced and dual-regulated firms with a remuneration committee; the Chair holds SMF12.
• SMF13 — Chair of the Nomination Committee. An FCA function at Enhanced and dual-regulated firms with a nomination committee.
• SMF14 — Senior Independent Director. The SID provides a sounding-board function for other NEDs and a route for shareholders to raise concerns outside the Chair–CEO relationship. The role is distinct from the Chair.

If your search involves any of these board roles, NED Capital is your specialist destination — we work closely with their team on cross-cluster mandates and the introduction is direct.

Note that the committee chair functions (SMF10 to SMF14) are among those the FCA and PRA propose to move to notification under Phase 2. If adopted, a firm appointing a new audit or risk committee chair would complete its own fitness and propriety checks and notify the regulator, rather than wait for approval. SMF9 Chair stays on pre-approval under the proposals. Exec Capital’s chair of regulated firm recruitment service covers SMF9 searches.

The SMF approval process: what to plan for

Once you have identified the candidate you want to appoint, the FCA approval process begins. The mechanics of approval are mechanical, but the timeline and the diligence are not.

The firm submits a Form A for the candidate, supported by the Statement of Responsibility, the candidate’s CV, regulatory references covering the previous six years, and the firm’s responsibilities map showing how the candidate’s role fits within the overall governance structure. The regulators have a statutory deadline of three months to decide a complete application, with most clean applications resolved within four to twelve weeks. If the regulator asks for more information, the clock effectively waits for the answer. Complex applications — particularly those involving candidates with regulatory history that requires explanation, or firm structures where the responsibilities map is being revised — can take longer.

The fit-and-proper assessment is the substantive test the candidate has to pass. The FCA assesses the candidate against three criteria: honesty, integrity and reputation; competence and capability; and financial soundness. The references that the firm collects from the candidate’s previous regulated employers will form part of this assessment, as will the candidate’s own disclosure of any regulatory matters.

One specific point that catches firms out: the regulatory references that previous employers provide are not optional and not negotiable. If a candidate has been the subject of a conduct investigation, an internal disciplinary process or a non-trivial regulatory matter at a previous firm, this will be disclosed in the reference and the FCA will see it. Candidates with such matters in their background are not automatically blocked — but the firm hiring them needs to be ready to explain why the role is appropriate and what mitigations are in place. We have placed candidates with prior matters successfully where the firm and the candidate worked together to present the situation transparently to the FCA.

Step by step

1. Confirm the function. Check which SMF the role requires, using the tables above, and whether the person will hold more than one.
2. Draft the Statement of Responsibilities. Agree it with the candidate and check it against the responsibilities map and the Prescribed Responsibilities.
3. Complete the firm’s own checks. Criminal record check, regulatory references for the last six years, qualifications and a documented fitness and propriety assessment.
4. Submit Form A through Connect. Answer every question fully; omissions are a common cause of delay.
5. Prepare for questions or interview. For senior and higher-risk roles, the regulator may interview the candidate. Our guide to the FCA Form A approval process covers this in detail.
6. Start only on approval. The candidate cannot perform the function until approval is granted, unless the temporary cover rule applies.

Realistic timelines

For planning, assume eight to fourteen weeks from offer to start for a clean application, and longer where the candidate has a notice period to serve — which, for senior compliance and executive roles, is often three to six months. Firms that build the approval period into the search plan from the outset avoid most of the pain. Our guide to how long FCA SMF approval takes breaks the timeline down stage by stage. The Financial Services and Markets Bill 2026 would also cut the statutory deadline for determining SMF applications from three months to two, although that change depends on the Bill passing.

The 12-week rule and temporary cover

When an SMF holder leaves unexpectedly, another person can cover the role temporarily without approval. Under the Phase 1 changes that took effect on 24 April 2026, the firm has 12 weeks to submit an application for a permanent replacement, and the cover can continue while that application is being determined. The Phase 2 consultations propose extending the 12 weeks to 18 weeks; the FCA would also replace the requirement that the absence was “reasonably unforeseen” with a “reasonable use” test for FCA functions, while the PRA proposes to keep its existing test for PRA functions. Until those proposals are finalised, plan on 12 weeks.

The Senior Manager Conduct Rules

SMF holders are subject to four Senior Manager Conduct Rules in addition to the general Conduct Rules that apply to almost everyone. These are:

• SC1 — You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively.
• SC2 — You must take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system.
• SC3 — You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively.
• SC4 — You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice.

The phrase “reasonable steps” is the operative one. The FCA can and does take action against individual Senior Managers where they conclude the individual did not take reasonable steps in their area of responsibility. That action can include public censure, fines and prohibition from regulated employment — outcomes that carry career-ending implications for the candidate.

For boards hiring into SMF roles, this means that the standard executive-search question of “is this person commercially capable?” needs to be paired with the SMF-specific question of “is this person someone who will take reasonable steps consistently, document their decisions, and operate within the regulatory framework rather than around it?” These are different questions and they require different reference patterns.

The Phase 2 proposals leave the Conduct Rules unchanged. They apply in the same way to notified SMFs as to approved ones, so moving a function to notification does not reduce the personal accountability of the person holding it.

Statements of Responsibility and the responsibilities map

The Statement of Responsibility (SoR) is the foundational document of the SMCR. It sets out, for an individual Senior Manager, what they are accountable for. Every SMF holder must have one. The firm’s Management Responsibilities Map aggregates the individual SoRs into a single document showing how the firm’s prescribed responsibilities, business areas and governance structures are allocated across the senior management team.

For hiring, three things about the SoR matter at the search stage:

The SoR defines what the role actually is. A candidate evaluating an SMF appointment will read the SoR carefully — and if the SoR has been left vague or has overlap with other Senior Managers’ areas, the candidate will pick up on it. We frequently advise clients to draft the SoR before the search opens, even in skeleton form, so the role definition is sharper from day one.

The SoR has to be consistent with the responsibilities map. If the firm’s existing map allocates a prescribed responsibility to one individual, the new candidate’s SoR cannot inadvertently take it on without the existing holder’s agreement. This is a common source of post-offer friction in firms where the responsibilities map has not been refreshed before the search.

The SoR is a regulatory document, not a job description. It will be referenced if anything goes wrong in the candidate’s area of responsibility. Candidates who have held SMF roles before know to push back on language that is loose or that allocates accountability without authority. Candidates who have not held SMF roles before sometimes accept SoRs that they later regret. A search firm with SMF experience will help both sides land on a balanced document.

Phase 2 would lighten the paperwork without changing the principle. Under the proposals, firms would no longer have to resubmit SoRs or responsibilities maps each time responsibilities change (they would keep them up to date internally and produce them on request), and firms with only one Senior Manager would not need an SoR or map at all. An SoR would still be required with every SMF application or notification. Our guide to Statements of Responsibilities and board appointments covers drafting in more depth.

Prescribed Responsibilities: who holds what

Prescribed Responsibilities (PRs) are specific responsibilities the regulators require a firm to allocate to a named Senior Manager. They sit on top of the SMF itself: the SMF says what role the person performs; the PRs say which firm-wide obligations they personally own. At Core and Enhanced firms, every PR that applies must be given to an SMF holder, and the allocation appears in the SoR. Limited Scope firms have no PRs.

According to the FCA’s guide for solo-regulated firms, the Core PRs are:

• (a) the firm’s performance of its obligations under the Senior Managers Regime (the Phase 2 proposals clarify this covers vetting candidates for all SMF roles, including notified ones);
• (b) the firm’s obligations under the Certification Regime;
• (b-1) the firm’s obligations on Conduct Rules notifications and training;
• (d) the firm’s policies and procedures for countering the risk of financial crime;
• (z) compliance with the client assets rules (CASS), where applicable;
• (za) for authorised fund managers, the assessment of value, independent director representation and acting in investors’ best interests.

Enhanced firms add further PRs, including responsibility for the Management Responsibilities Map (c), the independence and performance of the internal audit (j), compliance (k) and risk (l) functions, internal stress testing (s) and developing the firm’s business model (t). Dual-regulated firms have a longer combined list across the PRA and FCA rules, set out in the PRA’s SS28/15 for banks.

In practice, the allocation at a small Core firm is usually straightforward: the CEO (SMF1) takes most of the PRs, and the financial crime PR (d) often sits with the MLRO or the compliance lead. If the Certification Regime is abolished as proposed in Phase 2, PR (b) would fall away. For hiring, PRs matter because a candidate taking on a PR is taking on personal accountability for something wider than their job title — the financial crime PR, for example, is a firm-wide responsibility, not just an MLRO’s reporting duty — and experienced candidates will ask to see which PRs come with the role before they accept.

The Certification Regime and the broader hiring impact

SMCR is not just about the most senior 10–20 individuals in the firm. The Certification Regime applies to a much larger population — typically anyone whose role could cause significant harm to the firm or its customers. Material Risk Takers, customer-facing managers, certain technology roles, and significant management functions below SMF level all fall under certification.

For each certified individual, the firm must annually assess them as fit and proper and issue a certificate confirming this. The hiring impact is twofold. First, when you make a senior hire below SMF level, you need to assess whether the role is in scope for certification — if it is, the candidate’s regulatory references and fit-and-proper history come into play in a way they would not in a non-regulated firm. Second, the certification population is one of the talent pools your future SMF candidates will come from, and the way the firm handles certification affects whether senior-level candidates view the firm as a good place to take an SMF role.

This is the part of the regime most likely to change. Both regulators propose in Phase 2 to abolish the Certification Regime altogether, relying instead on existing competence requirements, the Conduct Rules and the Consumer Duty; the FCA would also retire the FCA Directory. Regulatory references would remain mandatory for SMF candidates and non-SMF board directors, but would no longer be required for previously certified roles. Until the change takes effect, annual certification continues in full.

Phase 2 reforms: which SMFs may move to notification

The October 2026 consultations are the biggest proposed change to the regime since it was introduced. Firms hiring now should plan under the current rules, but it helps to know where things are heading. In summary, as proposed:

• Stay subject to pre-approval: SMF1, SMF2, SMF3, SMF4, SMF7 (in its narrowed form), SMF9, SMF16, SMF17, SMF19, SMF21, SMF23, SMF23a, SMF23b, SMF24, SMF25, SMF26, SMF27 and SMF29.
• Move to notification: SMF5 Head of Internal Audit, SMF6 Head of Key Business Area, the new SMF7a (PRA), SMF8 Credit Union SMF, SMF10 to SMF15 (the committee chairs, the SID and the Chair of the With-Profits Committee), SMF20 Chief Actuary and SMF20a With-Profits Actuary.
• Proposed for removal (FCA): SMF18 Other Overall Responsibility and SMF22 Other Local Responsibility, with their responsibilities reallocated to other SMFs. The FCA also asks whether they should become notified roles instead.

Under notification, the firm completes the same vetting — fitness and propriety, criminal record check, regulatory references and an SoR — and then notifies the regulator, up to three months before the start date. The regulators keep a power to require pre-approval in exceptional cases. Existing approvals carry over. The FCA’s analysis is that Core and Limited Scope firms are not affected by the SMF changes, because the functions moving to notification are ones they do not use.

For most of the firms we work with — Core firms needing a CEO, executive directors, a chair, and a Head of Compliance and MLRO — the practical effect is therefore small: SMF16 and SMF17 remain pre-approved, so the approval timeline still needs to be built into any compliance hire. The bigger changes are the removal of certification, the lighter SoR regime for single-SMF firms and the longer temporary cover window.

What changes for senior search in a regulated firm

To bring this together: when you are running a senior search in a UK regulated firm, the SMF dimension changes the search in five practical ways.

1. The brief includes the regulatory dimension from day one. The role specification needs to address the SMF designation, the Statement of Responsibility outline, and the regulatory expectations — not as appendices but as part of the substantive role definition.

2. The candidate pool is narrower and the diligence is heavier. Prior SMF approval, regulatory references and fit-and-proper history are first-order screening criteria. Candidates without these but with strong corporate backgrounds may still be appointable but require longer preparation and a more deliberate FCA narrative.

3. The timeline includes FCA approval. Eight to fourteen weeks from offer to start is a reasonable planning assumption for clean applications. Boards that have not factored this in often end up with regulatory gaps or interim arrangements.

4. The reference work is structured. Regulatory references covering six years of employment are mandatory. They will surface anything material that has happened in the candidate’s previous roles, and the firm needs to be prepared to handle disclosures appropriately.

5. The Statement of Responsibility is part of the offer. Senior candidates evaluating an SMF role will scrutinise the SoR. Vague or overlapping SoRs are a deal-breaker for experienced candidates — a sign that the firm has not done its governance work properly.

How Exec Capital approaches SMF appointments

Exec Capital has built its regulated-firm practice around hiring senior leadership into UK FCA-regulated firms across asset management, wealth management, insurance, brokerage, fintech and consumer credit. Our SMF mandates focus on the executive functions that fall within our practice — SMF1 (CEO), SMF3 (Executive Director), SMF4 (CRO), SMF24 (Chief Operations Function) — together with SMF16 and SMF17 compliance and MLRO appointments, and the senior C-suite, director-level and specialist roles that operate either within regulated firms or in firms moving into regulated activity.

Where the SMF role belongs to a sister firm in our group — finance and compliance functions (FD Capital), board roles (NED Capital), or audit-qualified roles (Accountancy Capital) — we make the introduction directly. The relationship continues into the appointment. Clients value this for two reasons: the specialism is sharper than a generalist firm would offer, and the cross-cluster relationship is established by the time the search begins.

Across all engagement models — permanent, interim and fractional — we treat the regulatory dimension as part of the brief, not as a constraint that surfaces later. For firms beginning their first SMF search, or firms that have run several but want to refresh how they approach the work, we are happy to walk through your responsibilities map and current role definitions before any search opens. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate.

Further Reading and Authoritative Sources

For the FCA’s authoritative guidance, see the Senior Managers and Certification Regime overview and the FCA’s guidance on categorisation for solo-regulated firms (linked above). The FCA’s Operational Resilience policy is essential reading for anyone working with SMF24. The PRA’s SS28/15 (linked above) covers the dual-regulated firm context, and the FCA’s CP26/37 and the PRA’s CP14/26 set out the Phase 2 proposals.

For the broader policy context, the Parliamentary Commission on Banking Standards report, Changing Banking for Good, sets out the rationale for the regime. The Institute of Directors publishes useful governance frameworks that complement the SMCR’s regulatory requirements. The ICAEW publishes guidance on the financial reporting and audit dimensions of regulated firm governance that is particularly relevant to SMF11 (Chair of Audit Committee) and SMF5 (Head of Internal Audit) appointments.

Frequently asked questions

What does SMF stand for?

SMF stands for Senior Management Function (often called a Senior Manager Function). It is a role designated by the FCA or PRA under the Senior Managers and Certification Regime. The person performing it must currently be approved before they start and is personally accountable for their area of responsibility.

How many SMFs are there?

There are 31 SMF designations in use across the FCA and PRA rules, numbered from SMF1 to SMF29 with sub-functions SMF20a, SMF23a and SMF23b. Most firms only use a handful: a typical Core firm needs five or six, while a large bank or insurer may need twenty or more.

Which SMFs does a small FCA-regulated firm need?

A typical Core firm needs SMF1 Chief Executive, SMF3 for each other executive director, SMF9 Chair if it has one, SMF16 Compliance Oversight and SMF17 MLRO, plus SMF27 if it is a partnership or LLP. A Limited Scope firm usually needs SMF29, with SMF16 or SMF17 only where its permissions require them. Payment and e-money institutions sit outside the SMCR.

Is SMF16 the same as a Head of Compliance?

Usually, but not always. SMF16 Compliance Oversight is the regulatory function; the job title might be Head of Compliance, Compliance Director or Chief Compliance Officer. What matters is that the person has responsibility for the compliance function and is approved as SMF16.

Can SMF16 and SMF17 be held by the same person?

Yes. Combining SMF16 and SMF17 is the most common pairing at Core firms and is generally proportionate for smaller firms with moderate financial crime risk. Larger firms, or those with higher AML risk, typically separate the two roles.

Can an SMF be held on a fractional or part-time basis?

Yes. There is no rule that an SMF must be full-time. Fractional SMF16 and SMF17 appointments are common at small firms. The FCA assesses whether the person has enough time and capacity for the role at that firm, so the time commitment should be documented and realistic.

How long does FCA approval for an SMF take?

The regulators must decide a complete application within three months. Most clean applications are decided sooner, but for planning purposes allow eight to fourteen weeks from offer to start, plus any notice period. Missing information, regulatory history or an interview will lengthen it.

What is SMF29?

SMF29 is the Limited Scope Function. It is used by Limited Scope firms in place of SMF1 and SMF9: the firm’s senior people — typically its directors or principal — hold SMF29. A sole trader without employees does not need it.

Are any SMFs being removed or changed?

Not yet. Under the October 2026 proposals (FCA CP26/37 and PRA CP14/26), SMF5, SMF6, SMF8, SMF10 to SMF15, SMF20 and SMF20a would move to notification, SMF7 would be narrowed or split, and the FCA would remove SMF18 and SMF22. SMF1, SMF2, SMF3, SMF4, SMF9, SMF16, SMF17 and SMF24 would stay pre-approved. The consultations close on 22 January 2027 and implementation is expected in the second half of 2027 at the earliest.

What happens if an SMF holder leaves suddenly?

Another suitable person can cover the role temporarily without approval. The firm then has 12 weeks to submit an application for a permanent replacement, and the cover can continue while the application is decided. Phase 2 proposes extending this to 18 weeks. An interim or fractional appointment is often the quickest way to fill the gap with an approvable candidate.