The Certification Regime: How the Annual Fit and Proper Assessment Actually Works

The Certification Regime is the part of SM&CR that firms get wrong most often, because it looks like an HR process and is actually a regulatory one. There is no FCA pre-approval. The firm itself decides that an individual is fit and proper, issues a certificate in its own name, and carries the consequences if the judgement was not defensible.

SM&CR has three pillars (SYSC 23.3.1): the senior managers regime, the certification regime, and the conduct rules in COCON that apply directly to the workforce. The difference between the first two is the critical one. Senior management functions require pre-approval by the FCA under section 60A of the Act and SUP 10C, with statements of responsibilities under SUP 10C.11. Certification involves no pre-approval at all (SYSC 23.3.3) — it runs on sections 63E and 63F and SYSC 27.

What the firm must actually do

Under section 63E(1), reflected at SYSC 27.2.3, a firm must take reasonable care to ensure that no employee performs an FCA certification function without a valid certificate. Under section 63F and SYSC 27.2.4, a firm may issue a certificate only where it is satisfied the person is a fit and proper person for that function.

SYSC 27.2.5 is the provision that makes training records regulatory evidence rather than administration. In reaching that judgement the firm must consider, in particular, whether the person:

• has a qualification
• has undergone, or is undergoing, training
• possesses a level of competence
• has the personal characteristics required by the FCA’s general rules

Note the second limb. “Is undergoing training” is expressly sufficient, which means a part-completed development plan can support certification — but only if the firm can show the plan exists and is being followed.

Twelve months, and not a day longer

SYSC 27.2.10 is unusually hard-edged. A certificate is valid for a period of twelve months beginning with the day it is issued. A firm may choose a shorter period, but a certificate cannot be drafted to last more than twelve months. The FCA would expect annual re-certification on expiry to be proportionate and streamlined, and less detailed than the assessment for a new employee (SYSC 27.2.20).

The surrounding mechanics matter in an inspection. A certificate must state that the firm is satisfied the person is fit and proper and set out the aspects of the firm’s affairs they will be involved in (SYSC 27.2.9). It should be in writing, though no physical document is required (SYSC 27.2.17), should include its dates of validity and be given to the employee (SYSC 27.2.18). One certificate may cover several functions described in broad terms (SYSC 27.2.14). The firm must keep a record of every employee holding a valid certificate (SYSC 27.2.13). Where the firm decides not to issue one, it must give the person written notice of any proposed steps and the reasons (SYSC 27.2.11), and should consider whether a COCON breach needs notifying under SUP 15.3.11R (SYSC 27.2.12).

And on role changes: where a new function carries different requirements for personal characteristics, competence, qualifications or training, the FCA expects fitness to be assessed before the employee starts it (SYSC 27.2.15), though a reassessment may rely on existing assessments that still cover aspects of the new role (SYSC 27.2.15A).

What "fit and proper" means in practice

The criteria are in FIT 1.3, and the current version of that section took effect on 1 September 2026. FIT 1.3.1B states that the most important considerations are the person’s:

1. honesty, integrity and reputation
2. competence and capability
3. financial soundness

FIT 1.3.2A requires the firm to consider the nature, scale and complexity of its business, and whether the person has the knowledge, skills and experience to perform the specific role. FIT 1.3.2B adds that the management body collectively needs adequate knowledge, skills and experience. And FIT 1.3.4B expects assessors to review the role the individual actually performs, using an up-to-date job description — a small requirement that defeats a surprising number of firms, where the job description on file describes a role the person left two years ago.

Where training becomes the answer to a regulatory question

Two provisions in FIT 1.3.10 make this concrete, and they are worth knowing by heart.

Where there has been a breach, the firm considers the steps including training taken since the breach to address its causes (FIT 1.3.10(3)). And where the breach was caused by a lack of competence, the relevant question is whether that lack has been remedied by subsequent training or experience (FIT 1.3.10(4)).

That is as direct as regulation gets on this point. A documented, targeted remediation—with evidence that competence was actually restored—is the mechanism by which a person with a past breach can still be certified. A generic annual CPD log will not answer the question, because the question is specific: was this gap closed?

Time also works in the individual’s favour. A breach that happened a long time ago may carry less weight (FIT 1.3.10(2)), and the passage of time since an offence is a relevant factor for criminal convictions (FIT 1.3.23), including for custodial sentences where the age of the offence and rehabilitation since are considered (FIT 1.3.17(2)).

The surrounding obligations

Certification does not sit alone. Regulatory references under SYSC 22 must be requested from all previous employers over the past six years for senior manager, certification and non-approved NED candidates, with disclosure covering the same period — and no time limit at all for serious misconduct. Conduct Rules breaches resulting in disciplinary action are reported to the FCA annually, and within seven days where the individual is a Senior Manager.

The conduct rules themselves changed scope on 1 September 2026, bringing serious bullying, harassment and violence towards a colleague into COCON at non-bank firms — which feeds directly into fitness assessments. That change, and the training obligation it triggers, is covered in our guide to the non-financial misconduct scope change, with the general framework in our guide to FCA Conduct Rules and a culture of compliance. The regime as a whole is set out in our overview of SM&CR and the Certification Regime.

The distinction worth internalising

Certification is a firm-made regulatory judgement, renewed every twelve months, in which the evidence is largely about competence. That makes the training function part of the regulatory apparatus rather than a service to it. The question an assessor has to answer is not whether the person completed their hours — which is what regimes like the FCA’s 35-hour CPD requirement measure — but whether they have the knowledge, skills and experience for the specific role they actually perform.

That is the same standard now appearing across regulated sectors. Audit firms meet it through the competence and sufficient-time requirements in ISQM 1. Firms delivering retail outcomes meet a parallel one under the Consumer Duty. In each case a completion record is the start of the evidence, not the end of it.

A short self-audit

Does every person in a certification function hold a current certificate, with the record required by SYSC 27.2.13? Is any certificate written to run longer than twelve months? Do the job descriptions used in assessments describe the roles people currently perform? Where someone has had a competence-related breach, can you point to the specific training that remedied it, as FIT 1.3.10(4) asks? And when someone moves into a function with different competence or training requirements, is fitness reassessed before they start?