SMF16 vs SMF17: When You Need One, Both, or a Combined Role

Two of the most frequently confused Senior Management Functions are SMF16 and SMF17. Both sit in the compliance and financial-crime space, both are required at most authorised firms, and at smaller firms they are often held by the same person. But they are distinct functions with distinct accountabilities, and getting the structure right — one role, both, or a single individual holding both — matters for how a firm is governed and how it recruits. This article sets out the difference, when each is required, how the 2026 reforms to the Senior Managers and Certification Regime (SM&CR) affect them, and how to approach hiring for them.

Exec Capital runs SMF16 compliance oversight and MLRO (SMF17) searches for authorised firms — both as standalone appointments and as combined roles — as retained, research-led mandates run by our specialist team, with Adrian Lawrence FCA overseeing each one.

What SMF16 Is

SMF16 is the compliance oversight function. It is the Senior Management Function held by the director or senior manager allocated responsibility for the firm’s compliance function — overseeing that function, advising the governing body on the firm’s regulatory obligations, and reporting to the board on how the firm is meeting them. At most authorised firms that are required to have a compliance function it is a required function, and the holder is commonly the head of compliance or compliance director.

The SMF16 is accountable for the firm having an effective compliance function and for the board being properly informed about the firm’s regulatory position. Like every Senior Management Function, the holder must be approved by the regulator before taking up the role, is assessed as fit and proper, holds a Statement of Responsibilities, and is bound by the Senior Manager Conduct Rules and the Duty of Responsibility. That last point is what separates the function from a job title: if the firm breaches a regulatory requirement in an area the SMF16 is responsible for, the regulator can look at whether the individual took reasonable steps to prevent it.

In practice, the SMF16 owns the compliance monitoring plan, the firm’s regulatory change process, the advice given to the business on new products and activities, and the compliance reporting that reaches the board. At a small firm that may be one person doing most of the work themselves. At a larger firm it is a leader of a team, and the job is as much about structure, resourcing and escalation as technical knowledge.

What SMF17 Is

SMF17 is the money laundering reporting officer (MLRO) function. The FCA’s SYSC 6.3.9R requires a firm within its scope (other than a sole trader with no employees) to appoint an individual as MLRO, with responsibility for oversight of the firm’s compliance with the FCA’s rules on systems and controls against money laundering, and to give that person enough authority, independence, resources and information to do the job. Where the firm is within the SM&CR, that individual holds SMF17.

The MLRO is the point of responsibility for the firm’s financial-crime framework — suspicious activity reporting, the firm’s AML risk assessment, customer due diligence standards, and the operation of its controls. The function is distinct from compliance oversight because financial crime is a specific, high-stakes area of regulatory risk with its own legal framework.

That framework sits partly outside the FCA Handbook. Regulation 21 of the Money Laundering Regulations 2017 requires a relevant person to appoint a nominated officer to receive internal suspicion reports and, where appropriate to the size and nature of the business, a board member or senior manager as the officer responsible for compliance with the Regulations. In many firms the MLRO is also the nominated officer, so the same individual carries both the SM&CR accountability and the statutory reporting role. Like SMF16, SMF17 is a function the holder must be approved for, is assessed as fit and proper for, and is accountable for under a Statement of Responsibilities.

SMF16 and SMF17 Side by Side

The simplest way to separate the two is by the question each one answers for the board:

• Scope. SMF16 covers the firm’s compliance with the regulatory system as a whole — conduct, Consumer Duty, client assets where relevant, financial promotions, reporting. SMF17 covers money laundering and the firm’s anti-money-laundering systems and controls.
• Source of the requirement. SMF16 flows from the FCA’s requirement for a compliance function and its allocation to a senior individual. SMF17 flows from SYSC 6.3.9R, reinforced by the nominated officer and responsible officer requirements of the Money Laundering Regulations.
• External reporting. The SMF16 reports to the board and is the regulator’s usual point of contact on compliance matters. The MLRO, acting as nominated officer, decides whether internal suspicions are reported to the National Crime Agency.
• Typical background. SMF16 candidates usually come from compliance advisory and monitoring roles. SMF17 candidates usually come from financial-crime, AML operations or investigations roles, often with sector-specific experience in payments, banking or wealth.

Where the two overlap is in reporting lines and board engagement. Both functions need direct access to the board, both need independence from the revenue-generating business, and both feed into the firm’s overall risk picture. That overlap is why combining them is common at smaller firms, and why separating them becomes sensible as firms grow.

One Role, Both, or Combined?

When a firm needs both as separate roles

At larger or more complex firms, the compliance oversight and MLRO functions are usually held by different individuals. The volume and specialism of financial-crime work justifies a dedicated MLRO, and separating the functions avoids concentrating too much regulatory accountability in one person. Where a firm has a material financial-crime risk profile — payments, e-money, cryptoassets, money remittance, high-volume retail — a dedicated, experienced MLRO is often essential rather than optional.

Other signals that it is time to split the roles: the volume of internal suspicion reports is rising; the firm is entering new jurisdictions or customer types; the regulator has raised financial-crime concerns in supervisory correspondence; or the combined holder is spending most of their time on one side of the job and the other is drifting.

When one individual can hold both

At smaller authorised firms it is common, and entirely legitimate, for one individual to hold both SMF16 and SMF17. The firm must be satisfied that the individual has the capacity and the expertise to discharge both functions, and that combining them does not create a conflict or stretch the person beyond what they can properly oversee. For many small firms — a boutique asset manager, a small broker, a directly authorised adviser — a single experienced compliance professional holding both functions is the right and proportionate structure. Exec Capital runs combined SMF16/SMF17 searches for exactly this, and our guide to combining senior manager roles covers the wider question of one person holding several functions.

When applying for approval, the firm needs to show it has thought about the combination: how much time each function needs, what support sits underneath the holder, and how the two sets of responsibilities are set out in the Statement of Responsibilities. A combined holder with no support, covering a firm whose activities have outgrown them, is a common source of supervisory concern.

When a fractional or interim holder makes sense

Smaller firms frequently do not need a full-time compliance oversight function or MLRO, but they do need a named, approved individual who genuinely discharges the role. A fractional compliance officer or fractional MLRO can hold the function provided the arrangement gives them real responsibility and the regulator is satisfied they can discharge it. That means enough days, proper access to management information and staff, and a seat at the board when compliance matters are discussed.

Where a function falls vacant unexpectedly, interim cover keeps the firm compliant while a permanent appointment is made. Following the FCA’s PS26/6, in force from 24 April 2026, the 12-week rule now gives firms 12 weeks to submit an approval application for the person covering an unexpected vacancy, rather than 12 weeks to obtain approval, and that person can stay in post until the FCA decides. Our guide to interim SMF16 and SMF17 cover looks at how this works when a firm is also under heightened supervision.

What the Firm Is Really Hiring

For either function, the firm is hiring regulatory accountability as much as technical skill. A strong compliance analyst is not the same as someone who can hold SMF16 and own the compliance function’s accountability to the board and the regulator. An experienced AML specialist is not automatically approvable as an MLRO. The distinction is between doing compliance or financial-crime work and being the person the regulator holds responsible for it.

• For SMF16: the standing to own the firm’s compliance with the regulatory system and to advise and report to the board on it;
• For SMF17: command of the firm’s financial-crime risk and the AML framework, and the authority to act as the point of responsibility for it;
• For either: the regulatory credibility to be assessed as fit and proper for the function;
• An understanding of the firm’s permissions, business model and risk profile proportionate to the role;
• The judgement and temperament to discharge the Duty of Responsibility rather than treat the title as nominal.

Both functions work closely with the firm’s governing functions — the chief executive (SMF1) and the chief finance function (SMF2) — and at many firms the compliance oversight function reports to the board through a specified channel. A compliance or financial-crime leader who understands how their accountability fits with the rest of the governance structure is worth more than one who treats the function in isolation.

Personal qualities matter as much as the CV. Both roles require someone prepared to tell the chief executive something unwelcome, to slow a product launch, or to file a report the business would rather not see. Interviews should test for that directly: ask candidates for examples of escalations they made, what happened next, and what they would do differently. Candidates who can only describe process, and not a moment where they held a line, are a risk in either seat.

How to Run the Search

Compliance and MLRO searches reward a structured, research-led approach into a defined specialist pool. The strongest candidates are usually in post, and the pool of individuals who combine genuine regulatory expertise with the standing to hold a Senior Management Function is narrower than the pool of compliance professionals in general. The brief should be explicit from the outset about the firm’s permissions, its risk profile, and whether the appointment is a standalone SMF16, a standalone SMF17, a combined role, or a fractional arrangement.

Exec Capital runs these as retained searches through its compliance and risk recruitment practice. Briefing establishes the firm’s regulatory status and the exact scope of the function or functions to be held; research maps candidates with the right specialism and the standing to hold the role; approach and assessment test both regulatory expertise and fitness and propriety; and the shortlist carries assessment commentary. We support the firm through interviews, offer, the Statement of Responsibilities and the regulatory approval process.

Timing needs planning. The approval application is the firm’s, not the candidate’s, and the regulator’s assessment runs alongside the candidate’s notice period. Building that into the timetable from the start, and agreeing early who will cover the function in the meantime, avoids a gap in either seat.

Where SM&CR Reform Leaves SMF16 and SMF17

The Senior Managers and Certification Regime is being reformed in two phases. Phase 1, set out in PS26/6, took effect from 24 April 2026 and made practical changes, including the revised 12-week rule and the option to batch Statement of Responsibilities submissions to the FCA. It did not change what SMF16 and SMF17 are.

Phase 2 is still at proposal stage. In CP26/37, published on 22 October 2026 alongside a parallel PRA consultation, the FCA proposes to remove the Certification Regime and to move certain Senior Management Functions from pre-approval to notification. On the proposals as published, compliance oversight and the MLRO are not among the functions moving to notification: they would remain approved functions. The consultation closes on 22 January 2027, and final rules depend on the Financial Services and Markets Bill now before Parliament. Until final rules are published, firms should plan SMF16 and SMF17 appointments on the basis that regulatory approval is still required.

If the Certification Regime goes, firms would still be responsible for ensuring that the staff below senior manager level are competent and suitable. For compliance and financial-crime teams, that puts more weight on the SMF16 and SMF17 holders to make sure their own teams are properly assessed and supervised.

Frequently Asked Questions

Can the same person hold SMF16 and SMF17?

Yes. At many smaller authorised firms a single individual holds both the compliance oversight and MLRO functions, provided the firm is satisfied they have the capacity and expertise to discharge both and that doing so does not create a conflict. At larger or higher-risk firms the functions are usually separated.

Does a small firm really need a dedicated MLRO?

Every firm within scope of the Money Laundering Regulations needs a nominated officer, and FCA-authorised firms within SYSC 6.3 need an MLRO. For a small firm that may be the same person who holds the compliance oversight function, and it may be a fractional or part-time arrangement — but it must be a genuine appointment of an approved, fit-and-proper individual, not a title held in name only.

Can SMF16 or SMF17 be held on a fractional basis?

Yes, where the arrangement gives the holder real responsibility for the function and the regulator is satisfied they can discharge it. Fractional and interim compliance oversight and MLRO arrangements are common at smaller firms and for covering a vacancy while a permanent appointment is made.

Is the MLRO the same as the nominated officer?

Not by definition, but often in practice. The nominated officer is a statutory role under the Money Laundering Regulations and the Proceeds of Crime Act for receiving and reporting suspicions. The MLRO is the FCA-required role overseeing AML systems and controls. Many firms give both to the same person.

Will SMF16 and SMF17 still need FCA approval after the 2026 reforms?

On the current proposals, yes. CP26/37 moves some functions to notification but, as published, keeps compliance oversight and the MLRO as approved functions. These are proposals, and firms should check the final rules when they are published.

Sources and Further Reading

• FCA — Senior Managers and Certification Regime
• FCA Handbook — SYSC 6.3 Financial crime
• FCA PS26/6 — Senior Managers and Certification Regime review
• FCA CP26/37 — Senior Managers and Certification Regime (Phase 2 consultation)
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 21