The Senior Managers and Certification Regime (SM&CR) is the UK framework that makes named individuals accountable for what happens in a regulated firm. It followed the Parliamentary Commission on Banking Standards' recommendations after the 2008 financial crisis and conduct failings such as LIBOR manipulation. The regime applies under the Financial Services and Markets Act 2000 (FSMA) and the rules of the FCA and the Prudential Regulation Authority (PRA).
It was introduced for banks, building societies, credit unions and PRA-designated investment firms in March 2016, extended to insurers in December 2018 and to all FCA solo-regulated firms in December 2019. Benchmark administrators followed in December 2020. Before SM&CR, senior people could point to collective decision-making; now each senior manager has a written statement of what they are responsible for, and the FCA judges them against it.
| Part | Who it covers | What it requires |
|---|---|---|
| Senior Managers Regime | People in senior management functions (SMFs) | FCA approval before starting, a Statement of Responsibilities and the duty of responsibility |
| Certification Regime | Staff whose roles could cause significant harm | The firm assesses and certifies them as fit and proper every year |
| Conduct Rules | Almost all staff | Basic standards of behaviour, with extra rules for senior managers |
SM&CR applies to every firm authorised under FSMA: banks, insurers, investment firms, asset managers, insurance and mortgage intermediaries, consumer credit firms and others, plus certain branches of overseas firms. Solo-regulated firms fall into one of three categories set out on the FCA's categorisation page.
| Category | Typical firms | What applies |
|---|---|---|
| Limited scope | Sole traders, limited permission consumer credit firms and other firms meeting the criteria in SYSC 23 Annex 1 | Fewer senior management functions and prescribed responsibilities |
| Core | Most FCA solo-regulated firms | The baseline requirements |
| Enhanced | The largest and most complex solo-regulated firms | More functions, all prescribed responsibilities, a management responsibilities map and handover procedures |
PS26/6 raised the financial thresholds by about 30% and added a mechanism to update them for inflation every 5 years. A firm is enhanced if it meets any one of the following, measured on a 3-year rolling average where relevant.
| Measure | Before 10 July 2026 | From 10 July 2026 |
|---|---|---|
| Assets under management | £50bn | £65bn |
| Intermediary regulated business revenue | £35m a year | £45m a year |
| Consumer credit lending revenue | £100m a year | £130m a year |
Non-bank mortgage lenders or administrators with 10,000 or more regulated mortgages outstanding, CASS large firms and certain significant SYSC firms are also enhanced. A firm can choose to opt up to a higher category by filing a Form O on Connect.
Payment institutions and e-money institutions authorised only under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 are not FSMA firms and sit outside SM&CR. The FCA assesses their directors and the people responsible for managing payment services and e-money for fitness and propriety at authorisation and when they change. Bringing them into SM&CR would need legislation from HM Treasury. A payment or e-money firm that also holds FSMA permissions, such as for consumer credit, is under SM&CR for the FSMA part of its business.
A senior management function is a role the FCA approves before the person starts. The functions a firm needs depend on its category and structure. The main ones for solo-regulated firms are below.
| Function | Role | Applies to |
|---|---|---|
| SMF1 | Chief Executive | Core and enhanced |
| SMF3 | Executive Director | Core and enhanced |
| SMF9 | Chair | Core and enhanced |
| SMF16 | Compliance Oversight | Core and enhanced; some limited scope firms |
| SMF17 | Money Laundering Reporting Officer | Firms under the Money Laundering Regulations |
| SMF27 | Partner | Partnerships |
| SMF29 | Limited Scope Function | Limited scope firms |
| SMF2, SMF4, SMF5, SMF24 | Chief Finance, Chief Risk, Head of Internal Audit, Chief Operations | Enhanced |
| SMF10 to SMF14 | Chairs of the risk, audit, remuneration and nominations committees; Senior Independent Director | Enhanced |
| SMF7 | Group Entity Senior Manager | Enhanced |
| SMF18 | Other Overall Responsibility | Enhanced |
PS26/6 added Handbook guidance from 24 April 2026 on when SMF7 and SMF18 apply, and removed the wording that required an SMF18 holder to have equal status with an executive director. From 10 July 2026, SMF18 holders at solo-regulated firms may hold any prescribed responsibility.
Prescribed responsibilities are specific duties the rules require a firm to give to a senior manager, such as responsibility for the firm's obligations under SM&CR, for the Certification Regime, for Conduct Rules training and for financial crime. Core firms have a short list; enhanced firms have all of them. PS26/6 added guidance on allocating them, including when a responsibility may be split, with the test being who is most senior and accountable in practice.
Every senior manager has a Statement of Responsibilities: a regulatory document, not a job description, that sets out the areas they are accountable for and any prescribed responsibilities. Enhanced firms also keep a management responsibilities map showing how responsibilities fit together across the firm.
The statement defines the scope of the duty of responsibility. If the firm breaches a requirement in a senior manager's area, the FCA can act against that person if they did not take the steps a person in their position could reasonably be expected to take to prevent it. Reasonable steps typically include understanding the rules for the area, making sure resources and systems are adequate, putting controls and monitoring in place, escalating concerns and acting on issues once identified, with a record of each.
Statements that are vague, copied from job descriptions or left unchanged when responsibilities move weaken both the firm's governance and the individual's position. Since 24 April 2026 firms have up to 6 months to notify the FCA of changes, and if several changes happen within that period a solo-regulated firm submits only the latest version.
At a core investment firm, the SMF16 statement might give the holder responsibility for the compliance function and its monitoring plan, for advising the board on regulatory obligations, and for the prescribed responsibility for Conduct Rules training. It would name the reports the holder receives, the committees they attend and the people who report to them. Reasonable steps would then be evidenced by an approved monitoring plan, completed reviews, findings tracked to closure and regular reports to the board.
A firm applies for approval on Connect before the person takes up the role. The FCA assesses them against the fit and proper test in its FIT sourcebook: honesty, integrity and reputation; competence and capability; and financial soundness.
| Measure | Period |
|---|---|
| Statutory maximum for a complete application (FSMA) | 3 months |
| FCA target | 2 months, with at least half within 35 days |
| FCA median, Q1 2026/27 | 25 days |
From 24 April 2026, a criminal record check for a senior manager candidate is valid for 6 months instead of 3, and no new check is needed when a person moves to another role within the same firm or group.
Where a senior manager leaves unexpectedly, another person can cover the role for up to 12 weeks without approval. Since 24 April 2026 the 12 weeks is the deadline to submit an application rather than to obtain approval, and the person can continue to cover the role until the FCA decides. People covering under the rule are now bound by the senior manager conduct rules, and breaches are notified under SUP 15 rather than in the annual conduct rules return.
The firm's article on hiring MLROs and heads of compliance covers what the FCA looks for in the SMF16 and SMF17 roles.
The FCA's FIT sourcebook sets the same three tests for senior managers and certified staff, and the firm applies them before appointment and keeps them under review.
| Test | What is checked |
|---|---|
| Honesty, integrity and reputation | Criminal records, regulatory findings, disciplinary history, civil judgments, and candour in the application itself |
| Competence and capability | Qualifications, training and direct experience of the business and the risks of the role |
| Financial soundness | Outstanding judgments, insolvency or bankruptcy, and arrangements with creditors |
Disclosure carries as much weight as the history itself. An adverse matter that is disclosed and explained is assessed on its facts; one that the FCA finds for itself raises a question about honesty. For senior manager applications the FCA may interview the candidate, particularly for chief executive, chair and compliance roles, and expects them to explain the firm's business, risks and regulatory obligations in their own words.
SM&CR gives the FCA three tools against individuals. It can fine a person who breaches the Conduct Rules, prohibit them from working in regulated financial services, and withdraw a senior manager's approval. Under the duty of responsibility it does not need to show that the senior manager caused the breach, only that it happened in their area and that they did not take reasonable steps.
What protects a senior manager is evidence. Board and committee minutes that record challenge, management information that shows the risks were monitored, escalation that is documented, and a clear handover when responsibilities move all show reasonable steps. Firms that build this record into day-to-day governance give their senior managers a sound position and give the FCA a clear view of who decided what.
The Certification Regime covers staff who are not senior managers but whose roles could cause significant harm to the firm or its customers. The firm, not the FCA, assesses them as fit and proper before they start and at least once a year afterwards, and issues a certificate. Typical certification functions include significant management, client-dealing roles, material risk takers, CASS oversight and managers of certified staff.
PS26/6 made the regime lighter in two stages. From 24 April 2026, certificates can be issued by email, and annual recertification can run within the appraisal cycle and be proportionate where nothing has changed. From 10 July 2026, overlapping certification functions were removed for about 15% of roles; the FCA removed the duplicated roles from the Directory itself.
Before appointing a senior manager or certified person, a firm requests references from their regulated employers over the past 6 years, covering breaches of the conduct rules, disciplinary action and fitness and propriety. PS26/6 guidance now targets a response within 4 weeks rather than 6, and covers disclosure of suspected misconduct where someone leaves before an investigation ends.
Firms record certified staff and directors on the FCA Directory, a public register. Since 24 April 2026 most Directory updates are due within 20 working days instead of 7; details of leavers keep the 7-day deadline.
The Conduct Rules in the FCA's COCON sourcebook apply to almost all staff of SM&CR firms, except those in purely ancillary roles such as catering or security.
Firms train staff on the rules that apply to them and notify the FCA of breaches that result in formal disciplinary action. PS26/6 clarified that only breaches leading to specified disciplinary action need notifying, and how the rules apply to suspension and reductions in pay.
From 1 September 2026, the FCA's rules on non-financial misconduct, such as bullying, harassment and violence, apply alongside the PS26/6 changes, following its policy statement PS25/23. New COCON guidance covers when such conduct must be notified and how it relates to senior manager conduct rule SC4, and the SC2 guidance was aligned with the SC4 standard rather than requiring reporting without delay.
The Consumer Duty, in force since 31 July 2023, sits inside this framework: senior managers are expected to show how they oversee customer outcomes in their areas, and many statements of responsibilities now refer to the Duty expressly. The firm's practical guide to FCA compliance covers the wider compliance framework.
A firm applying for FSMA authorisation submits its senior manager applications with the authorisation application, and the FCA assesses the people as part of the threshold conditions. The firm's guide to applying for FCA authorisation covers how those applications fit into the wider process.
A buyer of a regulated firm that plans to change the board or senior managers files their applications alongside the change of control notification, so that the approvals arrive together and the firm is never without approved holders of its key functions.
PS26/6 was Phase 1 of the review and changed the FCA's own rules. Phase 2 depends on HM Treasury changing the legislation that sets the regime's structure, and the FCA expects to consult on its Phase 2 proposals once that is in place. The FCA has said that some Phase 1 flexibilities, such as splitting prescribed responsibilities and the wider use of SMF18, may be short-lived if the legislative changes alter the framework. Firms should keep their SM&CR documents current under the rules in force now.
The Senior Managers Regime, which requires FCA approval and a Statement of Responsibilities for senior managers; the Certification Regime, under which firms certify certain staff as fit and proper each year; and the Conduct Rules, which apply to almost all staff.
No, not where they are authorised only under the Payment Services Regulations 2017 and Electronic Money Regulations 2011. Their directors are assessed for fitness and propriety under those regulations.
From 24 April 2026, criminal record checks are valid for 6 months, the 12-week rule became a deadline to apply, and firms have 6 months to notify statement changes. From 10 July 2026, about 15% of certification roles were removed and the enhanced thresholds rose by about 30%.
The statutory maximum is 3 months for a complete application. The FCA targets 2 months, and its median in Q1 2026/27 was 25 days.
Yes. Under the duty of responsibility the FCA can fine or prohibit a senior manager if a breach occurs in their area and they did not take reasonable steps to prevent it.
It lets a person cover a senior manager role for up to 12 weeks after an unexpected departure. Since 24 April 2026 the firm must submit an application within that period, and the person can continue until the FCA decides.
From 10 July 2026, assets under management of £65bn or more, intermediary revenue of £45m or more, consumer credit lending revenue of £130m or more, 10,000 or more regulated mortgages, CASS large status or certain significant SYSC firms.
Buckingham Capital Consulting has obtained FCA authorisations since 2013 and prepares senior manager applications, statements of responsibilities and certification frameworks for FSMA firms, alongside fitness and propriety assessments for payment and e-money directors. The firm reviews existing SM&CR arrangements against the PS26/6 changes and keeps them current as Phase 2 develops.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.