The Authorisation Journey: Building an SMF Team From Scratch

A firm applying for FCA authorisation is not only building a business — it is assembling a senior management team the regulator will assess before it grants permission. The Senior Management Functions a firm needs, and the people approved to hold them, are central to the authorisation decision. Getting the team right, and in the right order, is one of the things that most often decides whether an application moves smoothly or stalls. This article sets out which senior managers an authorisation-stage firm needs, how to sequence the hires, and how to keep the people side of the application from becoming the bottleneck.

It is written for founders and management teams taking a firm through authorisation for the first time, and it reflects the position in November 2026: the FCA’s faster authorisation targets, the first phase of Senior Managers and Certification Regime (SMCR) reform that took effect in April 2026, and the second-phase proposals the FCA published for consultation in October 2026. Where specialist search is the right route, Exec Capital runs FCA and regulated-firm recruitment across the Senior Management Functions, and its urgent SMF appointment service is built for the time pressure authorisation timetables create.

Why the People Side Decides the Application

Authorisation is, in large part, an assessment of whether the firm has the people and the governance to operate safely within its permissions. The regulator looks at who will hold the Senior Management Functions, whether they are fit and proper, and whether the firm’s governance gives those individuals the standing and independence to discharge their roles. A strong business plan with a weak or incomplete senior team is a common reason an application struggles.

The legal test sits in the Threshold Conditions, the minimum standards a firm must meet to be authorised and to stay authorised. Several of them are really questions about people. Suitability asks whether the firm is fit and proper, which includes the competence and integrity of those running it. Effective supervision asks whether the regulator can supervise the firm properly, which depends on clear lines of accountability. Appropriate non-financial resources asks whether the firm has enough skilled people to do what it says it will do. A thin or poorly chosen senior team undermines all three at once.

In practice the FCA reads the business plan and the senior team together. If the plan describes a complex product set, multiple distribution channels or client money handling, the case officer will expect to see people with direct experience of running those things. A chief executive with no regulated background, or a compliance oversight holder who has only ever worked in a much smaller or very different firm, invites questions. Those questions take time to answer, and every round of questions extends the assessment.

The candidates themselves are assessed too. Each person proposed for a Senior Management Function needs approval, which means the FCA will look at their competence and capability, honesty and integrity, and financial soundness. Our guide to how long FCA SMF approval takes covers that individual assessment in more detail. The point here is that the firm’s application and each individual’s application rise or fall together.

Which Senior Managers an Authorisation-Stage Firm Needs

The governing functions

Most firms will need the core governing functions: a chief executive (SMF1) responsible for the day-to-day running of the firm, and, where the firm has a board, executive directors (SMF3) and a chair. The chief finance function (SMF2) is needed where the firm has one, and at many firms the governing team is small — a handful of individuals holding the applicable functions between them.

The executive director function is often underestimated at authorisation stage. Founders sometimes assume that only the chief executive needs approval, when at core and enhanced firms every executive member of the board will normally need to be approved as SMF3. That includes a commercial or operations director who sits on the board, and it includes founders who intend to stay on the board after authorisation. Each one needs a Form A, a criminal records check and a credible account of why they are fit to hold the role.

The required oversight functions

Almost every authorised firm needs compliance oversight. The SMF16 compliance oversight and, where the firm is within scope of the money laundering regulations, the MLRO (SMF17) functions are among the first a new firm must plan for — and at smaller firms they are frequently held by one person. Larger or higher-risk firms will also need a chief risk function (SMF4) and internal audit.

These are the roles case officers probe hardest, because the firm’s compliance monitoring, financial crime controls and complaints handling all run through them. An SMF16 candidate should be able to explain the compliance monitoring programme the firm will run in its first year, and an MLRO candidate should be able to walk through the firm’s business-wide risk assessment. If they cannot, the application is unlikely to move forward cleanly.

Firm-tier and sector-specific functions

Which functions apply depends on the firm’s tier and sector. An enhanced firm carries more required functions than a core or limited-scope one; an insurer needs the PRA insurance functions; a payments or e-money firm has its own people requirements. The firm needs to map its applicable functions early, because that map drives the whole hiring plan.

Dual-regulated firms — banks, insurers and some investment firms — face two regulators, with the PRA leading on prudential matters and the FCA on conduct. That adds functions, adds a second assessment and changes who the candidates need to persuade. Payments and e-money institutions are a different case again: they apply under the payment services and e-money regulations rather than as SMCR firms, and the individuals responsible for management are assessed under that framework. Mapping the regime correctly at the start saves a great deal of wasted search effort.

Sequencing the Hires

The order matters. A firm that leaves its senior appointments to the end of the authorisation process risks discovering gaps it cannot fill in time, or presenting a team the regulator is not satisfied with at the point of decision. The better approach is to identify the functions early, prioritise the hires that are hardest to fill or most central to the regulator’s assessment, and build the team in parallel with the rest of the application.

• Map the Senior Management Functions that apply to the firm, given its tier, permissions and sector, before starting to hire;
• Prioritise the governing functions and the hardest-to-fill specialist roles, which have the longest lead times;
• Line up compliance oversight and, where needed, the MLRO function early — these are central to the regulator’s assessment;
• Confirm each candidate is approvable and fit and proper before relying on them in the application;
• Keep the Statements of Responsibilities and the responsibilities map coherent as the team comes together.

The documentation side matters as much as the hiring. Each senior manager needs a Statement of Responsibilities, and the firm needs a coherent responsibilities map showing how accountability is allocated. Drafting these early, even in outline, is one of the best tests of whether the team is complete: if a prescribed responsibility has nowhere sensible to sit, or one person is carrying far more than they could realistically discharge, the gap shows up on paper before it shows up in a case officer’s questions.

Using pre-application support

The FCA runs a free pre-application support service for firms considering an application. Requests are subject to acceptance, and an accepted firm meets a case officer who sets out the regulator’s expectations and points it to relevant material; where possible, the same officer then assesses the application. It is not a formal assessment, but a pre-application meeting is a good moment to test the shape of the senior team — which functions the firm thinks apply, who will hold them, and how the oversight roles will work in a small organisation. Going into that meeting with named or near-named candidates is far more useful than going in with a list of vacancies.

Submitting the SMF applications alongside the firm’s application

A new firm normally submits a Form A for each proposed senior manager together with its application for authorisation, so the FCA can assess the people and the firm side by side. That is why the hiring plan needs to run ahead of the application rather than behind it. Each Form A needs a criminal records check, references and a full employment history, and a candidate who is still negotiating terms or serving notice elsewhere can delay the whole submission. Firms that secure their candidates in principle early, with offers conditional on approval, are in a much stronger position.

How Long the Process Takes Now

The statutory periods have not yet changed. Under the Financial Services and Markets Act 2000 the FCA must decide an application for authorisation within six months of receiving a complete application, or within twelve months of receiving an incomplete one. The statutory period for deciding an SMF approval is three months.

What has changed is the target the FCA works to. In July 2025 it announced faster targets for authorisations, measured from January 2026: four months for complete applications and ten months for incomplete ones, with shorter voluntary targets for some variations of permission. For individual approvals, the FCA set a target to decide at least half of SMF applications in 35 days, and the Government has proposed cutting the statutory deadline for SMF approvals from three months to two. The Government confirmed in its May 2026 consultation response that it intends to legislate for the shorter statutory deadlines when parliamentary time allows; until then, the four- and ten-month figures are targets rather than law.

Two practical points follow. First, the faster targets apply to complete applications. An application that arrives with gaps in the senior team, or with candidates whose Form A raises questions, is treated as incomplete, and the clock that matters is the longer one. Second, a faster decision cuts both ways. The FCA has said the new targets give firms more time to address feedback, but a regulator working to a tighter timetable has less room to wait while a firm finds a replacement candidate. Having an approvable team ready at submission is the most reliable way to benefit from the shorter targets.

Keeping the People Side From Stalling the Application

Two things most often slow the people side of an authorisation. The first is leaving senior hires too late, so the firm is still searching for a key function holder when the rest of the application is ready. The second is relying on candidates who turn out not to be approvable, forcing a restart. Both are avoidable with an early, structured approach to the senior team — treating it as a core workstream of the authorisation rather than an afterthought.

A third problem is quieter: a team that is approvable individually but does not hang together. A chief executive and an FCA-regulated executive director whose responsibilities overlap, or a compliance oversight holder who also runs a revenue-generating desk, will draw questions about conflicts and independence. The case officer is assessing the team as a governance structure, not as a list of CVs.

Exec Capital runs these searches as retained mandates, coordinated across the functions a firm needs. Briefing establishes the firm’s target permissions, tier and the functions it must fill; research maps approvable, fit-and-proper candidates for each; and we sequence the searches so the hardest-to-fill and most central roles are prioritised. Where the timetable is tight, we run the searches to it. The aim is a complete, approvable senior team ready when the application needs it — not a gap that holds everything up. For a function that must be covered immediately, interim or fractional cover can bridge the gap while the permanent search runs.

After Authorisation: Keeping the Team in Place

The authorisation decision is the start, not the end, of the firm’s obligations on its senior team. Once authorised, the firm must keep its Senior Management Functions filled by approved, fit-and-proper individuals, maintain the Statements of Responsibilities and the responsibilities map as the team changes, and reassess fitness and propriety on an ongoing basis. A departure from a key function creates an immediate obligation to fill it, and the firm cannot simply leave a required function vacant.

The first phase of SMCR reform, set out in the FCA’s policy statement PS26/6 and in force for most purposes from 24 April 2026, made some of this easier to manage. Under the revised 12-week rule, a firm covering an unexpected SMF vacancy now has 12 weeks to submit an application for the replacement, rather than 12 weeks to obtain approval, and the person covering can continue while the application is determined. A criminal records check on an SMF candidate now stays valid for six months rather than three, and firms have up to six months to notify changes to Statements of Responsibilities and responsibilities maps. None of this removes the obligation to fill the role; it gives a newly authorised firm more workable time to do it properly.

That is why the team a firm builds for authorisation should be built to last, not just to pass the application. A function holder recruited only to get through the gateway, with no real commitment to the firm, is a liability the moment they leave. Where a vacancy does open in a required function after authorisation, an urgent appointment and fractional compliance cover keep the firm compliant while a permanent replacement is found — but the better position is a stable, committed team that does not need replacing under pressure in the first place.

What the Phase 2 SMCR Proposals Could Mean for New Firms

On 22 October 2026 the FCA published CP26/37, its consultation on the second phase of SMCR reform, alongside a parallel PRA consultation for dual-regulated firms. These are proposals, not final rules. The consultation closes on 22 January 2027 and the FCA expects to publish final rules in the first half of 2027. The proposals are linked to legislative changes that move many prescriptive SMCR requirements out of statute and into regulators’ rules.

The main proposals include:

• reducing the number of SMF applications by removing some functions and making other roles notified rather than pre-approved;
• streamlining the SMF application process;
• raising the enhanced-regime thresholds, so fewer firms are in scope;
• removing the ongoing submission of Statements of Responsibilities and responsibilities maps;
• removing the Certification Regime and retiring the Directory of certified and assessed persons.

For a firm applying now, the sensible course is to build the team against the rules as they stand. Applications submitted in late 2026 and early 2027 will be assessed under the current regime, and even if fewer roles end up needing pre-approval, the regulator will still expect the people running the firm to be competent and the oversight functions to be properly resourced. What may change is the paperwork and the number of Form A submissions, not the underlying need for a credible senior team.

Frequently Asked Questions

When should we start hiring our senior managers?

Early — in parallel with the rest of the application, not after it. The senior team is central to the regulator’s assessment, and the specialist functions have long lead times. Mapping the functions and starting the hardest searches early is the single most effective way to keep the people side off the critical path.

Do we need every function filled before we apply?

The firm needs to be able to present a credible, approvable senior team for the functions that apply to it. Exactly what must be in place at each stage depends on the firm and the application; the practical point is that the regulator will assess the senior team, so it cannot be an afterthought. Planning the team against the application timetable is essential.

Can one person hold several of the functions at authorisation?

Yes, within the usual limits of capacity and conflict. At a small authorisation-stage firm a few individuals often hold the applicable functions between them. The firm must be able to show each holder can genuinely discharge what they hold, and that the independent oversight functions are not compromised.

How long will the FCA take to decide our application?

The statutory maximum is six months for a complete application and twelve months for an incomplete one. Since January 2026 the FCA has worked to faster targets of four and ten months. A complete, well-evidenced senior team is one of the main factors in whether the application is treated as complete.

Should we wait for the Phase 2 SMCR changes before applying?

Generally not. CP26/37 is a consultation, with final rules expected in 2027. Applications are assessed under the rules in force at the time, and the need for competent, approvable people at the top of the firm will not go away.