Statements of Responsibilities at FCA Firms

Statements of Responsibilities: Best Practice for FCA-Regulated Boards

The Statement of Responsibilities is both a regulatory document and a governance instrument. It is the document that gives the Senior Managers Regime its practical meaning at the individual level — translating the general accountability framework into a specific, named description of what each Senior Manager Function holder is personally responsible for within their firm. Poorly drafted Statements of Responsibilities create ambiguity, overlap and gaps in the firm’s accountability map. Well-drafted ones provide genuine clarity about who is accountable for what — and that clarity protects both the firm and the individual in the event of regulatory scrutiny. For employers, see our Chief Compliance Officer recruitment service.

Despite their importance, Statements of Responsibilities at many regulated firms are treated as administrative requirements rather than governance tools. They are drafted to satisfy the Form A submission process, updated only when a structural change forces a revision, and rarely reviewed for accuracy against the individual’s actual current responsibilities. This guide sets out what best practice looks like and how boards and senior managers should approach the drafting and maintenance of Statements of Responsibilities.

The Legal and Regulatory Framework

The requirement for Statements of Responsibilities is set out in SUP 10C of the FCA Handbook for FCA-solo regulated firms and in PRA rules for firms that are dual-regulated. Each individual approved to a Senior Management Function must have a Statement of Responsibilities that sets out the aspects of the firm’s affairs for which they are responsible. The SoR must be submitted to the FCA as part of the Form A application and revised whenever there is a significant change in the individual’s responsibilities. The section on the SMCR reforms below explains how the rules on sending that revised version to the regulator changed in April 2026.

The FCA also requires each Enhanced scope firm — and dual-regulated firms, under PRA rules — to maintain a Management Responsibilities Map — a document that shows how responsibilities across all senior management functions are allocated across the firm and how they connect to the firm’s governance and committee structure. Core and Limited Scope firms do not have to produce one. Where a map exists, the SoR for each individual SMF holder must be consistent with it, and the two documents should be reviewed together whenever either is updated.

Under the Duty of Responsibility, the regulator can take action against an SMF holder where a breach occurs in their area of responsibility and they did not take the steps that a person in their position could reasonably be expected to take to prevent it. The burden of proving that failure sits with the regulator rather than the individual, but the question it asks is the same: what were they responsible for, and what did they do about it? The Statement of Responsibilities defines what that area of responsibility is. An SoR that is too narrow may mean the individual is not accountable for matters that were genuinely within their purview; an SoR that is too broad may create accountability for matters that were beyond the individual’s actual authority or knowledge. Neither extreme serves the firm or the individual well.

The SMCR reforms: what has changed and what is proposed

The Senior Managers and Certification Regime is part-way through a two-stage review. The first stage is already in force; the second is out for consultation. Both touch Statements of Responsibilities directly, so any firm drafting or maintaining SoRs needs to be clear which changes are live rules and which are still proposals.

Phase 1: in force (FCA PS26/6 and the PRA’s parallel policy statement)

The FCA’s policy statement PS26/6 made targeted changes, most of which took effect on 24 April 2026, with further process changes from 10 July 2026. The points that matter for SoRs and SMF appointments are:

• Revised SoRs. A firm must still prepare a revised SoR immediately after a significant change in an SMF holder’s responsibilities and keep its own copy up to date at all times. What changed is when the regulator has to receive it: the revised statement should be sent within a reasonable time, and the guidance allows a firm to submit all of its unsent revised statements once in every six-month period. If several changes happen in the period, only the latest version needs to go in, and a change that is reversed within the period does not need to be submitted. Firms can still submit sooner, and other duties (such as Principle 11) may require faster notification of a significant development.
• Management Responsibilities Maps follow the same approach: updated maps can be submitted on the same periodic basis.
• Form J is unchanged. The FCA chose not to redesign the form in Phase 1, leaving wider SoR and map changes to Phase 2.
• The 12-week rule. Where someone steps in to cover an SMF role, the firm now has 12 weeks to submit an application, rather than 12 weeks to submit it and obtain approval. The individual can continue in the role until the regulator determines the application.
• Criminal record checks for SMF applications are now valid for six months rather than three, and are not needed for internal or intragroup moves.
• Temporary absence. The examples of a significant change now include an SMF holder’s temporary absence of more than 12 weeks, so a long absence will usually mean reallocating responsibilities and revising SoRs.
• Prescribed Responsibilities guidance was clarified: a Prescribed Responsibility should normally go to the most senior person responsible for that area, and if its holder becomes absent it should be reallocated, but only to another SMF holder.
• Enhanced scope thresholds were raised from 10 July 2026, so some firms that were Enhanced have moved to Core, with a reduced set of Prescribed Responsibilities and no map requirement.

Phase 2: proposals only (FCA CP26/37 and PRA CP14/26)

On 22 October 2026 the FCA published CP26/37 and the PRA published its own consultation CP14/26. Both close on 22 January 2027. The FCA has said it intends to publish final rules in the first half of 2027 and implement them about six months later, which depends on the Financial Services and Markets Bill passing. The main proposals affecting SoRs are:

• No more routine resubmission. Firms would no longer submit an updated SoR whenever responsibilities change, and Form J would go. An SoR would still be submitted with every SMF application or notification, kept up to date internally, and superseded versions kept for six years (ten for some dual-regulated firms).
• Single-SMF firms. Where one individual performs all of a firm’s SMF roles, no SoR or map would be needed. As soon as a second person takes an SMF role, every SMF holder would need an SoR.
• Maps on request. Management Responsibilities Maps would be kept internally and produced on request rather than filed routinely.
• Fewer Prescribed Responsibilities. The FCA would keep only PR (a) the Senior Managers Regime, PR (d) financial crime and PR (z) client assets, plus PR (j-3) oversight of outsourced internal audit for Enhanced firms. The underlying obligations behind the deleted PRs would remain.
• Notified rather than approved roles. At the FCA, SMF5 and SMF10 to SMF15 would move to notification, and SMF18 and SMF22 would be deleted. The PRA proposes a similar move for a list of its functions. Firms would still need to assess fitness and propriety and prepare an SoR before notifying.
• The Certification Regime would be removed, although the Conduct Rules would continue to apply.

For now, plan on the Phase 1 rules. Even if Phase 2 goes through as proposed, the SoR survives for every multi-SMF firm: it still accompanies each application or notification, it still has to be kept current, and it is still the document a supervisor or enforcement team will open first. The reforms reduce the filing burden. They do not reduce the need to draft the document well.

What a Statement of Responsibilities Must Cover

There is a prescribed FCA form for Statements of Responsibilities, but no prescribed wording, and the FCA expects them to contain sufficient detail to make clear what the individual is specifically accountable for. A statement that simply lists the individual’s job title and a generic description of their functional area — “the Chief Risk Officer is responsible for risk management at the firm” — does not meet the standard. The FCA expects SoRs to be sufficiently granular to enable it to identify, in the event of a problem, which individual was accountable for a specific area and whether they discharged that accountability appropriately.

Effective Statements of Responsibilities typically cover: the individual’s primary functional responsibilities by area; their oversight responsibilities for specific teams, committees or processes; their accountability for specific regulatory obligations (for example, the CEO’s responsibility for the firm’s relationship with the FCA, or the CRO’s responsibility for the firm’s risk appetite framework); and the boundaries of their accountability — what is within their scope and what is delegated to, or held by, another SMF function holder.

Where responsibilities are shared between two SMF holders — for example, where the CEO and COO share accountability for operational resilience — the SoR should make clear how that shared accountability works in practice. The FCA will be sceptical of SoRs that attribute identical responsibilities to two individuals without explaining how decisions are made and how accountability is allocated in practice.

Two practical constraints shape the drafting. First, the form allows up to 300 words for each responsibility, so each entry has to be concise. Second, the statement has to be self-contained: cross-referring to a compliance charter or terms of reference to get around the word limit is not acceptable. One SoR can cover more than one SMF where the same person holds them, provided it describes all of that person’s responsibilities clearly.

FCA Statement of Responsibilities template

The template below is a drafting worksheet. The final statement has to be submitted on the regulator’s own form (the FCA has separate versions for solo-regulated and dual-regulated firms), but the content you need is the same, and working it out in this structure first makes the form straightforward to complete. The right-hand column shows example wording for a common appointment: a fractional Head of Compliance who also acts as MLRO (combined SMF16 and SMF17) at a small Core firm. Replace everything in square brackets.

Three habits make the template work in practice. Draft sections 4 to 6 together, because a responsibility only makes sense once its boundaries are written down. Read every entry aloud as if you were an enforcement lawyer asking “so what did you do about it?”; if the entry gives no clue, it is too vague. And draft the SoRs for all SMF holders in one sitting, so the gaps and overlaps between them show up before the regulator spots them.

SoR vs Management Responsibilities Map vs job description

These three documents are often confused, and at smaller firms they are sometimes merged into one. They do different jobs, and a firm that treats them as interchangeable usually ends up with an SoR that reads like a job advert or a job description that commits the individual to regulatory accountability nobody intended.

The practical rule is that the SoR should be narrower and sharper than the job description. A job description for a Head of Compliance will include tasks such as training delivery, policy drafting and attending industry forums. The SoR should only contain the matters for which the individual is answerable to the regulator. Conversely, everything in the SoR should be traceable to the job description and to the map, or the three documents have drifted apart.

For the recruitment process, the order matters. The job description is written first to run the search; the draft SoR follows once the firm has decided how responsibilities will be split between the new appointee and existing SMF holders; and the map is updated last to reflect the intended structure after the appointment. Firms that leave the SoR until after the offer usually find the role they recruited for is not quite the role they are asking the FCA to approve.

Prescribed Responsibilities for core, enhanced and limited scope firms

Prescribed Responsibilities are specific responsibilities that the rules require the firm to give to an SMF holder. Every PR that applies to the firm must be allocated to someone, and each must appear in that person’s SoR. Which PRs apply depends on the firm’s SMCR category. For solo-regulated firms the position under the current rules is:

Dual-regulated firms have a longer list, combining FCA and PRA Prescribed Responsibilities, and should read the PRA rules alongside SYSC 24. The detail of which SMFs apply to which firm types is covered in our guide to SMF roles.

Allocating PRs well

• Give each PR to the most senior person responsible for the area. This is now spelled out in FCA guidance. Allocating the financial crime PR to a junior MLRO when the CEO actually controls the budget and systems creates exactly the accountability-without-authority problem described below.
• Only SMF holders can hold PRs. If the holder is absent, the PR must move to another SMF holder, not to a deputy without approval.
• Avoid sharing where possible. PRs can be shared only in limited circumstances, and sharing makes each holder accountable for the whole. If you do share, explain the split in both SoRs.
• Keep the small-firm pattern simple. At many Core firms the CEO (SMF1) or an Executive Director (SMF3) holds (a), (b) and (b-1), the MLRO or Head of Compliance holds (d), and whoever runs client money and assets holds (z).
• Watch Phase 2. If CP26/37 is finalised as proposed, most PRs will be deleted and SoRs will need to be redrafted to remove them, although the underlying obligations will remain with someone.

Common Drafting Mistakes

The most common mistakes in drafting Statements of Responsibilities are: excessive vagueness (using high-level functional descriptions without specifying what the individual is actually responsible for doing); excessive comprehensiveness (listing every conceivable activity under the SMF holder’s broad remit without distinguishing between primary accountability and oversight); failure to reflect actual current responsibilities (using an SoR drafted at appointment that no longer reflects the individual’s role after subsequent structural changes); and failure to align with the Management Responsibilities Map (creating inconsistencies between the firm-level map and the individual-level statements).

A subtler drafting mistake is the use of language that implies accountability where genuine authority does not exist. An SoR that states the Chief Risk Officer “is responsible for ensuring the firm’s risk appetite is not exceeded” without also reflecting the CRO’s authority to escalate concerns and challenge business decisions is creating an accountability gap — the individual is nominally accountable for an outcome they may lack the authority to control. The FCA pays attention to whether the accountability documented in the SoR is matched by genuine authority in the firm’s governance structure.

This is why independence matters so much for control-function roles. Our guide to the SMF4 Chief Risk Officer function explains how reporting lines and access to the board determine whether a CRO can actually discharge what their SoR says. The same test applies to Heads of Compliance and MLROs.

Worked examples: well and badly drafted responsibility wording

The fastest way to improve an SoR is to compare weak entries with stronger rewrites. The examples below are typical of the drafts firms produce under time pressure before a Form A goes in. They are illustrations, not regulator-approved wording, and each needs adapting to the firm’s real structure.

The pattern across all of these is the same: a good entry names an outcome, the actions the individual takes towards it, the authority they hold and the reporting that shows it is working. If one of those four is missing, the entry will either over-promise or say nothing useful. Our SMF16 Head of Compliance hiring guide shows how the same thinking applies to the brief for the role itself.

Updating Statements of Responsibilities

The obligation to update an SoR when there is a significant change in an individual’s responsibilities is clear in the rules, but “significant change” is not always easy to identify in practice. Structural reorganisations that transfer team reporting lines, changes in committee membership, acquisitions that bring new regulated activities within the SMF holder’s scope, and departures of other SMF holders that result in responsibilities being absorbed — all of these can constitute significant changes that require SoR updates.

Best practice is to review all Statements of Responsibilities whenever the firm’s governance structure changes — including when a new SMF appointment is made, since the new individual’s SoR necessarily has implications for the existing SMFs around them. Reviewing SoRs only when a new Form A is triggered means that the firm’s accountability documentation drifts progressively out of date between appointments, which creates risk at the firm level and for individual SMF holders.

Statements of Responsibilities were introduced for banks by the Financial Services (Banking Reform) Act 2013, and the Bank of England and Financial Services Act 2016 extended the regime — including the requirement for a revised statement whenever there is a significant change — to all authorised firms, but the practical implementation of this requirement varies widely. Firms with a mature SMCR compliance function typically have a formal SoR review process embedded in their governance calendar. Firms that treat SoRs as one-off documents rarely maintain the level of accuracy that the regulation requires.

When to update and resubmit: Form J and timing

The April 2026 changes separated two things that firms used to treat as one: updating the SoR and telling the regulator. The first is still immediate. The second now has more flexibility. The table below sets out the usual events and what each requires under the current rules.

Two cautions apply. The six-month window is guidance about submission, not permission to let the internal document lag, and a supervisor asking for the current SoR should get one that is accurate on the day. And the batching option does not override other notification duties: a significant development, such as the departure of the only compliance officer at a firm with an urgent remediation in progress, may still need to be raised with the FCA promptly under Principle 11.

New appointments are where timing pressure is greatest. The SoR has to be ready for the Form A, and an unclear or inconsistent SoR is one of the avoidable reasons applications attract questions. Our board guide to FCA Form A covers the application itself, and how long FCA SMF approval takes sets out a realistic timetable to plan around.

Statements of Responsibilities at Smaller Regulated Firms

At smaller regulated firms — including many solo-regulated FCA firms — the SMF population is small and individual holders may cover broad areas of responsibility. This creates a particular challenge for SoR drafting: the individual may genuinely be accountable for a very wide range of matters, but documenting all of them in a single SoR can produce a document that is too broad to be meaningful. The alternative — being selective about what is included — risks creating gaps that leave matters unaccounted for in the firm’s accountability map.

The answer at smaller firms is typically to be specific about the most important regulatory obligations within each SMF holder’s remit — the areas where regulatory risk is highest and where personal accountability is most material — and to use the Management Responsibilities Map, or at a Core firm an internal allocation document, to provide the broader context for each individual’s SoR. This approach produces documents that are meaningful rather than comprehensive and that can be used practically in governance discussions rather than simply filed as regulatory submissions.

Small firms also tend to combine functions, so the boundary problem appears inside one person’s SoR rather than between two. Our guide to the dual SMF holder at smaller regulated firms looks at when combining roles works and when it leaves too much resting on one individual.

Fractional and combined SMF holders: SoRs for part-time SMF16 and SMF17 roles

The most common SMF appointment at smaller FCA-regulated firms is not a full-time executive. It is a Head of Compliance (SMF16), an MLRO (SMF17), or one person holding both, engaged for a set number of days a month. Brokers, payment and e-money firms, wealth managers, consumer credit firms and newly authorised businesses often have neither the workload nor the budget for a full-time compliance executive, but still need an approved individual who carries genuine personal accountability. A fractional compliance officer is often the right answer, and the SoR is where the arrangement either holds together or falls apart.

The accountability is not part-time

There is no reduced form of the Duty of Responsibility for someone who works two days a week. A fractional SMF16 is accountable for everything in their SoR on every day of the year. That has three consequences for drafting. The SoR has to describe what the individual oversees, including any outsourced compliance support or junior staff who do the day-to-day work. It has to make the first-line responsibility of the business explicit, so the part-time compliance officer is not read as owning compliance itself. And it has to be realistic: if the firm’s compliance workload could not be overseen in the time available, the FCA will question the appointment at Form A stage, where time commitment forms part of the fitness and propriety assessment.

Combining SMF16 and SMF17

One SoR can cover both functions, and at a small firm that is usually the cleanest approach. Separate the entries: compliance oversight responsibilities first, then MLRO responsibilities, then the financial crime PR if allocated. Say how the individual manages the occasional tension between the two, for example where a monitoring finding also raises a suspicion that must be handled confidentially. Our guide to SMF16 vs SMF17 and when to combine them sets out when one person can credibly hold both.

Holding SMFs at more than one firm

Many fractional compliance professionals hold SMF roles at two or more unconnected firms. Each firm needs its own Form A, its own SoR and its own assessment of whether the individual has enough time and no conflicting interests. The SoRs should be drafted independently; copying wording from one firm to another is a common shortcut that produces statements bearing no relation to the second firm’s governance.

Cover and continuity

Part-time holders take holidays and have other commitments, so the SoR and the firm’s internal allocation should say who covers what in a short absence and what happens if the absence lasts beyond 12 weeks. The revised 12-week rule makes it easier to put a successor in place quickly if a fractional holder leaves, because the firm only needs to submit the application within that window.

If your firm is weighing up a part-time appointment, our compliance and risk recruitment team handles fractional, interim and permanent SMF16 and SMF17 searches, and our Head of Compliance recruitment page explains how those searches run. The draft SoR is part of the brief from the first conversation.

SoRs and the Candidate Conversation

From a search and appointment perspective, the Statement of Responsibilities is a tool that should be shared with prospective candidates before they accept a role at a regulated firm. A candidate who understands what the SoR will say about their personal accountability before they sign the employment contract is making an informed decision about the regulatory risk they are accepting. A candidate who only reviews the SoR at the point of Form A submission — when the offer has already been accepted and the notice period served — has had no opportunity to negotiate its scope or to raise concerns about aspects of the accountability that they believe are inappropriate.

Exec Capital advises its clients to prepare a draft SoR early in the appointment process and to share it with the preferred candidate as part of the due diligence phase. This produces better outcomes for both the firm and the individual — the firm gets a clearer indication of whether the candidate fully understands and accepts the regulatory accountability the role carries, and the candidate can make an informed decision with full transparency about what they are committing to.

Experienced SMF candidates increasingly ask for the draft SoR, the map and recent board minutes before accepting, and a firm that cannot produce them signals that its governance may not be ready for the appointment. Our article on what boards should consider about SoRs before appointing an SMF covers the board’s side of that conversation.

Working with Exec Capital

Exec Capital’s experience of working through SMF appointment processes means we have a practical understanding of how Statements of Responsibilities should be drafted for different firm types and seniority levels. We advise our clients on SoR drafting as part of the appointment process and work with the firm’s compliance and legal advisers to ensure the final document is accurate, proportionate and aligned with the Management Responsibilities Map. To discuss a regulated firm appointment, call 0203 834 9616.

Much of our regulated firm compliance hiring is for control-function roles: Heads of Compliance, MLROs and combined SMF16/SMF17 holders, on fractional, interim and permanent terms, alongside CEO, CFO, CRO and Chair searches. Whatever the role, the starting point is the same: agree what the person will be accountable for, then find someone who can carry it.

Frequently asked questions

Is there an official FCA Statement of Responsibilities template?

Yes. The SoR is submitted on the FCA’s prescribed form, with separate versions for solo-regulated and dual-regulated firms. The form fixes the structure but not the wording, which is why firms use a drafting template like the one above before completing it.

How long can a Statement of Responsibilities be?

Each responsibility can be described in up to 300 words. The statement must be self-contained, so you cannot refer the reader to other documents to make up for a short entry.

Do we have to resubmit the SoR every time responsibilities change?

You must revise it internally straight away after a significant change. Since 24 April 2026, FCA guidance allows unsent revised SoRs to be submitted together once in each six-month period, with only the latest version needed. Phase 2 proposes ending routine resubmission entirely, but that is not yet in force.

What is Form J?

Form J is the notification of a significant change in a Senior Manager’s responsibilities, submitted with the revised SoR. It was left unchanged in Phase 1. CP26/37 proposes removing it.

Does a Core firm need a Management Responsibilities Map?

No. Under FCA rules only Enhanced scope firms need one, and dual-regulated firms need one under PRA rules. Core firms still benefit from a simple internal record of who holds what, because it makes the SoRs easier to keep consistent.

Can one SoR cover both SMF16 and SMF17?

Yes. One statement can cover more than one SMF held by the same person, provided all of their responsibilities are described clearly. This is common for fractional appointments at smaller firms, including fractional MLRO roles combined with compliance oversight.

Can a Prescribed Responsibility be shared?

Only in limited circumstances. If a PR is shared, each holder is accountable for all of it, so both SoRs should explain how it is divided in practice.

Will Phase 2 abolish Statements of Responsibilities?

No. The proposals keep the SoR for every SMF application or notification and require it to be kept up to date internally. The main exception proposed is a firm where one individual performs all SMF roles.

Does a fractional SMF holder carry less accountability?

No. The Duty of Responsibility applies in full regardless of the days worked, which is why the SoR for a part-time holder has to be precise about what they oversee and who does the day-to-day work.