What Boards and Senior Executives at FCA-Regulated Firms Must Understand in 2026

When an FCA-regulated firm appoints a new CEO, Chair, Chief Risk Officer or Chief Compliance Officer, the regulatory consequences are immediate and personal. Under the Senior Managers and Certification Regime (SMCR), the individuals appointed to Senior Manager Functions hold personal accountability for the areas within their responsibility — accountability that the FCA can and does enforce directly against individuals, not just against the firm. A board that approaches a senior appointment at a regulated firm as a routine vacancy is making a decision with regulatory consequences that will follow the individual and the firm for as long as that person is in post.

2026 has also been a year of real change. The first phase of the SMCR reforms took effect on 24 April 2026, the FCA is now reporting against faster targets for senior manager approvals, and on 22 October 2026 the FCA and the PRA published a second, more far-reaching set of proposals that would remove the Certification Regime altogether. At the same time, the Consumer Duty is being refined rather than relaxed, and operational resilience has moved from a transition project to a standing board responsibility.

This article covers the principal FCA obligations that board members, executive leaders and appointing committees at UK regulated firms need to understand in 2026, updated to reflect the position as at November 2026. It is written from the perspective of a search firm that recruits into these roles every week, so it focuses on where the rules change what a board should do when it hires.

SMCR: The Personal Accountability Framework

The Senior Managers and Certification Regime is the foundation of personal accountability at FCA-regulated firms. It currently operates in three connected layers: the Senior Managers Regime, which creates individually accountable SMF holders with prescribed responsibilities; the Certification Regime, which requires firms to assess and certify, at least annually, individuals in roles that could cause significant harm; and the Conduct Rules, which apply to almost everyone who works at a regulated firm.

For boards appointing to the most senior roles, the Senior Managers Regime is the main concern. A CEO, Chair, CFO, Chief Risk Officer, Chief Compliance Officer or MLRO at an FCA-regulated firm will normally need regulatory approval for their specific Senior Manager Function before they can perform it. The application requires a Form A, a Statement of Responsibilities describing the individual’s accountability, criminal record checks and regulatory references from former regulated employers covering the preceding six years.

Boards that have not run this process before tend to underestimate it. The regulators have a statutory period of three months to decide a complete application, but well-prepared applications are usually decided faster. The FCA’s own figures, quoted in PS26/6, show 99.7% of applications decided within the current three-month deadline and 94.7% within two months in the quarter it reported on. Applications with gaps, inconsistent answers or adverse history are where delay builds up, and the time spent answering regulator questions is time the business is without a settled senior manager.

SMCR in 2026: What Has Changed and What Is Coming

The government, the FCA and the PRA are reforming the SMCR in two phases. Boards need to understand both, because the first is already in force and the second will change the shape of senior hiring from 2027 onwards.

Phase 1: in force from 24 April 2026

The FCA’s PS26/6 and the PRA’s PS12/26 made a set of practical changes that took effect on 24 April 2026:

• The 12-week rule is now a submission deadline. Where an SMF holder is absent or leaves unexpectedly, a firm can appoint someone to cover the role temporarily without approval. The 12 weeks is now the deadline for submitting a complete application, not for having it approved. The individual can continue to act while the regulator decides, and the Senior Manager Conduct Rules apply to them during that period.
• Criminal record checks last longer. A check is now valid for six months rather than three, and is no longer needed for internal or intra-group moves. The regulators’ forms were updated from 10 July 2026 to reflect this.
• Regulatory references should arrive sooner. FCA guidance now expects firms to respond to a reference request within four weeks rather than six. This is guidance rather than a hard rule, but it tightens the timetable a hiring board can reasonably plan around.
• Enhanced regime thresholds have risen. From 10 July 2026, several of the thresholds that make a firm “enhanced” rose by around 30% — for example, assets under management from £50bn to £65bn — with a mechanism to index them to inflation every five years. Firms that sat just above the old thresholds should check whether they now fall back to core status, with lighter obligations.

Alongside the rule changes, the FCA has committed to faster decisions. In July 2025 it set new targets for authorisations, including deciding at least half of senior manager applications in 35 days or less, measured from January 2026. The government has also said it intends to cut the statutory deadline for deciding senior manager applications from three months to two, which requires primary legislation. Our article on how SMCR is changing the senior appointment timetable works through what this means for planning a hire.

Phase 2: consultation open until 22 January 2027

On 22 October 2026 the FCA published CP26/37 and the PRA published CP14/26. Both close on 22 January 2027. They follow the government’s decision to remove the Certification Regime from the Financial Services and Markets Act 2000 through the Financial Services and Markets Bill. The main proposals are:

• Removing the Certification Regime. Firms would no longer issue annual certificates. Instead they would have an ongoing duty to make sure relevant staff are competent and suitable, and the Conduct Rules would continue to apply.
• Fewer approvals. Some SMFs would be removed and others would move from pre-approval to notification. The PRA proposes notification for almost half of its SMFs, including Chief Actuaries and the Chairs of Risk and Audit Committees. The firm would still have to assess fitness and propriety before the appointment takes effect.
• Longer temporary cover at PRA-regulated firms. The PRA proposes extending the 12-week rule to 18 weeks, while expecting firms to submit applications as soon as possible and use the longer period only with clear justification.
• Less ongoing paperwork. The FCA proposes ending ongoing submissions of Statements of Responsibilities and Management Responsibilities Maps, retiring its Directory of certified persons and raising the threshold for reporting conduct rule breaches.

None of this is final. The FCA expects to publish its policy statement in the first half of 2027, and the PRA expects implementation in the second half of 2027, depending on the Bill. What boards should take from it is that accountability is not being reduced at the top. Fewer forms does not mean less personal responsibility for the senior managers who remain approved, and firms will carry more of the fitness and propriety judgement themselves.

The Chair: Governance Leadership Under SMF9

The Chair of the board holds the SMF9 function — Chair of the Governing Body — and carries accountability that is distinct from that of the executive SMF holders. The Chair is responsible for the effectiveness of the board as a governance body, for the integrity of its oversight, and for managing conflicts between the interests of shareholders, the executive team and the firm’s regulatory obligations.

The FCA’s expectations of the SMF9 holder go beyond a formal role. The Chair must show independence of mind and a willingness to challenge executive management. A Chair who does not receive adequate management information, who does not ask probing questions about compliance performance, or who lets the executive set the board’s agenda without meaningful challenge has not discharged their accountability — however well the board minutes are written. The FCA looks through governance documentation to judge whether the Chair is genuinely providing oversight.

The SMCR reforms do not change this. If anything, as the regulators step back from some pre-approvals and annual certification, the Chair’s role in making sure the firm’s own fitness assessments are rigorous becomes more important. Appointing a Chair is one of the most consequential decisions a regulated firm’s shareholders make, and our Chair of regulated firm recruitment practice is built around finding candidates who will stand up to that scrutiny.

Governance Structure: What SYSC 4 Requires

The governance requirements in SYSC 4 set the FCA’s baseline for how regulated firms structure their management and control. The four-eyes principle — that the business is effectively directed by at least two people — applies widely. The management body must collectively have adequate knowledge, skills and experience to understand the firm’s activities and principal risks. Individual members must commit enough time to their roles, act with independence of mind, and avoid conflicts of interest that could compromise their judgement.

For a board assessing its own structure, SYSC 4 is the framework the FCA will use. A board that lacks expertise in the firm’s principal regulatory risks, or whose members hold so many other directorships that they cannot commit enough time, is not meeting the standard however experienced its individual members are. Collective competence matters as much as the individual fit and proper assessment for each SMF holder.

In practice, this is where many board refreshes start. A skills matrix that shows no one with deep compliance, risk or financial crime experience is a gap the FCA can point to, and filling it with an independent director who has run those functions is often the most direct fix. Our financial services non-executive recruitment work is frequently driven by exactly this kind of gap analysis.

Statements of Responsibilities: Getting the Documentation Right

Every SMF holder must have a Statement of Responsibilities setting out what they are accountable for at the firm. The SoR is the document that matters most when something goes wrong: it is the anchor against which the FCA judges whether the individual took reasonable steps, and the basis on which responsibility is allocated between senior managers where several people were involved in a failure.

The quality of the SoR is one of the clearest signs of how seriously a firm takes the SMCR. A generic SoR that describes the function in broad terms gives no protection in an enforcement context. A well-drafted one that describes the decisions the individual takes, the information they receive and the areas they are specifically accountable for gives both the individual and the regulator a clear framework.

The 2026 reforms affect the administration rather than the substance. For PRA-regulated firms, updated SoRs and Management Responsibilities Maps now need to be submitted within six months of a significant change, and only the latest version if several changes happen in that period. The FCA’s phase 2 proposals go further by ending routine ongoing submissions. Boards should not read this as a reason to let the documents drift. A firm that no longer has to send an SoR to the regulator still has to produce an accurate one the moment the regulator asks — and that is usually when something has gone wrong.

The Fit and Proper Assessment: What the FCA Actually Looks For

The FCA’s fit and proper assessment for proposed SMF holders covers three areas: honesty, integrity and reputation; competence and capability for the specific function; and financial soundness. Of these, competence and capability is the one boards most often underweight.

A candidate with a distinguished career in financial services may not be competent for a specific SMF at a specific firm if their experience does not match that firm’s regulatory framework. A proposed SMF16 compliance oversight holder whose whole career has been in retail banking is likely to face questions about their competence at a wholesale investment manager, however strong their track record. The FCA’s test is specific: can this person perform this function at this firm?

Boards should apply the same specificity. Assessing candidates against the requirements of the particular SMF and the firm’s regulatory framework — not just their seniority — is what the FCA expects the firm to have done before it submits a Form A. This becomes more important under the phase 2 proposals, because roles that move to notification will rely entirely on the firm’s own assessment before the person starts. When we run compliance and risk recruitment searches, the regulatory fit of each candidate’s experience is assessed alongside the usual leadership criteria, for exactly this reason.

Regulatory References: The Obligation Boards Must Own

The regulatory references rules in SYSC 22 require firms to request references from former regulated employers of proposed SMF holders covering the previous six years, and to take them into account in the fit and proper assessment. References must disclose specific categories of information, including fitness and propriety findings, disciplinary action and Conduct Rule breaches.

In practice, references are one of the most consistently mismanaged parts of a senior appointment. Requests go out too late — sometimes after the Form A has been submitted — creating a bottleneck. Responses with adverse information are not followed up properly, or are treated as an HR matter rather than a regulatory one. And the obligation to update a reference already given, if new information comes to light, is often not implemented at all.

The 2026 changes help at the margin. The FCA now expects firms to respond to requests within four weeks, and the PRA has added guidance on disclosing misconduct investigations that are not yet complete. Under the phase 2 proposals, the requirement to obtain references for certified staff would fall away with the Certification Regime, but references for SMF holders would remain. The practical lesson for boards is unchanged: start the reference process as soon as a preferred candidate is identified, not after the offer.

Consumer Duty: The Board’s Role

For firms serving retail customers, the Consumer Duty creates a board-level governance obligation that goes beyond earlier rules. The board (or equivalent governing body) must review and approve, at least annually, a report assessing whether the firm is delivering good outcomes for retail customers. That report must be owned by the board, not delegated to compliance as a reporting exercise.

Two developments matter for 2026. First, in February 2025 the FCA said it no longer expects firms to appoint a Consumer Duty board champion. That removes a named role, not the obligation: the whole board remains responsible for the Duty, and in practice this puts more weight on the Chair and the non-executives to provide challenge. Second, the FCA has consulted on CP26/23, Consumer Duty: scope and proportionality. The proposals would take business with non-UK customers out of scope, clarify where the Duty does and does not apply, and explain how firms in a distribution chain can rely on each other and apply the Duty in proportion to their role. The consultation closed in September 2026, and the FCA expects to publish a policy statement and any new rules in the first quarter of 2027.

These are refinements rather than a retreat. A board that receives a report with real outcome data — actual customer results across products and services, price and value, consumer understanding and consumer support, with gaps identified and remedial action directed — is discharging its obligation. A board that notes a compliance-produced attestation without real review is not, and FCA supervision continues to focus on the quality of board oversight rather than the existence of a document.

The Senior Manager Conduct Rules: Personal Obligations

The Senior Manager Conduct Rules apply to all SMF holders on top of the Individual Conduct Rules that apply to almost all staff. The four Senior Manager Conduct Rules require them to take reasonable steps to ensure the business they are responsible for is controlled effectively; to ensure it complies with regulatory requirements; to ensure any delegation is to an appropriate person and is overseen effectively; and to disclose to the regulator anything it would reasonably expect notice of.

What reasonable steps look like has been clarified through FCA enforcement decisions, and the consistent finding is that passive oversight is not enough. A senior manager who receives management information, does not challenge it, does not follow up concerns and keeps no record of their oversight has not taken reasonable steps, however good the firm’s wider framework. Individuals cannot rely on the firm’s compliance infrastructure as a substitute for their own active role.

Note also that since 24 April 2026, a person covering an SMF under the 12-week rule is subject to the Senior Manager Conduct Rules while they do so. An interim appointed at short notice is therefore personally accountable from the start, and should be chosen with that in mind. Where a firm faces a sudden gap in a senior role, our urgent SMF appointment service is designed to put a credible, approvable candidate in place within the regulatory window.

The Three Lines of Defence: Board Oversight of the Control Framework

The three lines of defence model is the framework through which most regulated firms organise risk management and control. For boards and audit committees, understanding how the three lines work in their firm — and whether the second and third lines have the independence and resource to challenge the first — is an essential competence.

The model is widely adopted in name but unevenly implemented. Compliance functions without the independence to challenge business decisions, internal audit resourced by management rather than independently, and risk functions whose findings are routinely overridden without board oversight are all failures the FCA will identify and pursue. A board that does not actively test the adequacy and independence of its second and third lines is not meeting its SYSC 4 obligations. Hiring a Chief Risk Officer or Head of Compliance with the standing to challenge the executive is one of the most direct ways to strengthen the second line, and it is a large part of our compliance and risk recruitment work.

Operational Resilience and the FCA’s 2025–2030 Strategy

The transition period for the operational resilience rules ended on 31 March 2025. Since then, in-scope firms have had to be able to remain within their impact tolerances for each important business service in severe but plausible scenarios. This is no longer a project with an end date: the FCA expects the governing body to approve and regularly review the firm’s self-assessment, important business services and impact tolerances to be reviewed at least annually, and scenario testing to be part of business as usual. For boards, the question is whether anyone at the table can properly challenge the testing results, the technology dependencies behind them and the third parties the firm relies on.

The wider context is the FCA’s five-year strategy for 2025 to 2030, published in March 2025. It has four priorities: being a smarter regulator, supporting growth, helping consumers, and fighting financial crime. Much of the SMCR reform and the faster approval targets follow from the first two. The financial crime priority is a reminder that MLRO and financial crime leadership remain an area of close supervisory attention, even as other requirements are simplified.

Placing Senior Executives at FCA-Regulated Firms

Exec Capital works with boards, nomination committees and chief executives to recruit senior leaders into executive and non-executive roles across UK financial services. Our mandates regularly include CEOs, Chairs, Chief Risk Officers, Chief Compliance Officers, MLROs and non-executive directors at banks, investment managers, wealth managers, payment and e-money institutions, consumer credit firms and insurers. Our FCA-regulated firm recruitment page covers the full range of roles we fill, and our CEO of regulated firm recruitment practice handles SMF1 appointments specifically.

Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate. Because the regulatory position is moving quickly, we brief candidates and clients on the current SMCR rules at the start of each search, build the reference and criminal record check timetable into the process, and assess candidates against the specific function they will be approved for. For firms that need SMF-specific support on compliance and oversight roles, our sister firm SMF Capital specialises in senior manager function appointments across the FCA-regulated market.

Frequently asked questions

What changed in the SMCR on 24 April 2026?

The 12-week rule became a deadline for submitting an SMF application rather than getting it approved, criminal record checks became valid for six months rather than three, and FCA guidance shortened the expected response time for regulatory references to four weeks. Enhanced regime thresholds rose by around 30% from 10 July 2026.

Is the Certification Regime being abolished?

The government intends to remove it from legislation, and the FCA (CP26/37) and PRA (CP14/26) are consulting until 22 January 2027 on the replacement rules. Until those changes take effect, the Certification Regime still applies and firms must keep certifying staff.

How long does SMF approval take now?

The statutory period for a complete application is currently three months, and the government intends to reduce it to two. The FCA aims to decide at least half of senior manager applications in 35 days or less. Incomplete or complex applications take longer.

Does a board still need a Consumer Duty champion?

No. Since February 2025 the FCA has not expected firms to appoint one. The board must still review and approve the annual Consumer Duty report and remains collectively responsible for the Duty.

Will the reforms reduce personal accountability for senior managers?

No. The reforms reduce paperwork and the number of roles needing pre-approval, but the Senior Manager Conduct Rules, Statements of Responsibilities and the duty of responsibility remain. Firms will also carry more of the fitness and propriety judgement themselves.