Regulatory References Under SYSC 22: What Firms Must Disclose, and for How Long

Regulatory references are the part of SM&CR with the sharpest edge, because they are the one obligation a firm cannot negotiate away. If an employee leaves after a conduct issue and the exit is settled, the settlement does not change what the firm must disclose when the next employer asks. The FCA closed that door explicitly.

When a reference must be obtained

SYSC 22.2.1R requires a firm to take reasonable steps to obtain a reference before it permits or appoints someone to a controlled function, before it issues a certificate, or before it appoints a board director. It must ask the candidate’s current employer and any employer in the previous six years. The timing for each role is set out in the table at SYSC 22.2.3R. A sole trader appointing themselves is not required to obtain one from a previous employer (SYSC 22.2.8R to 22.2.10G).

The obligation is on the hiring firm to ask, and separately on the giving firm to answer. Both sides carry duties, which is why a firm can be in breach as a former employer long after someone has left.

What the giving firm must disclose

Two obligations run in parallel. First, SYSC 22.2.2R(2): the firm must disclose all information it is aware of and reasonably considers relevant to whether the person is fit and proper. That is a judgement-based, open-ended duty, not a form-filling exercise.

Second, SYSC 22.2.2R(4): the firm must answer questions A to F of the mandatory template at SYSC 22 Annex 1R. Those answers cover the six years before the request up to the date of the reference. And SYSC 22.5.1R requires that information be verified before it is disclosed — a firm cannot pass on an unproven allegation, nor withhold a verified one.

Generally, information is limited to matters arising in the six years before the request, or between the request and the reference being given (SYSC 22.2.2R(3)(a) and (b)).

Serious misconduct has no time limit at all

The six-year window does not apply to serious misconduct (SYSC 22.2.2R(3)(c)). There is no cut-off. Guidance on what counts as serious, including a table of factors, sits at SYSC 22.5.10G and SYSC 22.5.11G.

In practice this means a firm’s records cannot simply be aged out on a six-year cycle. If something sufficiently serious happened eight or twelve years ago and the firm is aware of it, the duty to disclose survives.

The duty to go back and correct a reference

This is the provision most firms do not operationalise. Under SYSC 22.2.4R, if the giving firm later becomes aware of matters that would have caused it to draft the reference differently, and the differences are significant, it must make reasonable inquiries as to the employee’s current employer and notify that employer in writing. Exceptions are at SYSC 22.2.5R.

The duty generally lasts while the firm still employs the person, and for six years after their employment ends (SYSC 22.2.6R). So a reference given today can require a correction in 2032 — which means someone has to own a process for revisiting references when new facts emerge about former staff. In most firms, nobody does.

You cannot settle your way out of it

SYSC 22.5.13R prohibits a firm from entering into any arrangement that limits its ability to disclose under the chapter. SYSC 22.5.14G confirms this covers agreements made at any point, including settlement agreements. SYSC 22.5.15G says firms should not give undertakings to suppress or omit relevant information in order to secure a negotiated release. And SYSC 22.5.16G is the clincher: the disclosure duty applies regardless of any such agreement.

Read together, a confidentiality or non-disparagement clause purporting to cover regulatory disclosure is unenforceable against the duty. HR and legal teams drafting exit terms need to know this before they sign, not after the next reference request arrives.

Timing and records

The giving firm must provide the reference as soon as reasonably practicable (SYSC 22.2.2R(1)), and the FCA expects one to be issued normally within four weeks of the request (SYSC 22.5.17G). Firms frequently budget longer than that.

On records, SYSC 22.9.1R requires orderly records sufficient to comply with the chapter, limited to questions E and F of the template. There is no express retention period, and SYSC 22.9.2G indicates the retention period is effectively the same as the template’s time limits — which, given the serious misconduct carve-out, is not a clean six years.

Why this belongs in the training and competence conversation

A regulatory reference is, functionally, a competence and conduct record leaving the building. Everything the firm has documented about a person’s conduct breaches, disciplinary outcomes and fitness conclusions becomes disclosable. That raises the standard for how those records are kept in the first place: vague, undated or unverified notes are both a disclosure problem and an evidential one.

It also connects directly to the certification decision at the hiring end. Under SYSC 27.2.5 a firm must consider qualifications, training, competence and personal characteristics before issuing a certificate, and the reference is a primary input to that judgement — the mechanics are in our guide to the Certification Regime and the annual fit and proper assessment.

Two recent changes widen what is likely to appear in references. The Conduct Rules changed scope on 1 September 2026, bringing serious bullying, harassment and violence towards a colleague within COCON at non-bank firms, as set out in our guide to the non-financial misconduct scope change. Behaviour that was previously an internal HR matter can now be a conduct rule breach — and a conduct rule breach resulting in disciplinary action is exactly what the template asks about.

The wider framework for identifying and reporting breaches is covered in our guide to FCA Conduct Rules and a culture of compliance, and the regime as a whole in our overview of SM&CR and the Certification Regime.

There is a cultural dimension too. A disclosure regime this strict only produces accurate references if issues surface internally in the first place, which depends on whether people will raise them — the subject of our guide to speaking up and non-retaliation in financial services.

The verification problem

The requirement at SYSC 22.5.1R that information be verified before disclosure sits awkwardly against the reality of departures. An allegation is made, the employee resigns before any investigation concludes, and the firm is left holding something it believes to be relevant but has not established. It cannot disclose the unverified allegation as fact, and it cannot treat the gap as closing the matter.

The practical answer is that the investigation has to finish. A firm that abandons a disciplinary process because the person has left disables its own ability to answer questions A to F accurately, and inherits a six-year duty to correct the reference if the facts later emerge. Concluding the investigation after departure is not an act of vindictiveness; it is what makes the subsequent disclosure defensible.

Both sides of the same obligation

It is worth separating the two roles a firm occupies, because they are usually owned by different people and reviewed on different cycles.

As the hiring firm, the duty under SYSC 22.2.1R is to take reasonable steps to obtain references before the person starts — which means the timetable in SYSC 22.2.3R has to be built into recruitment, not bolted on at offer stage. Where a previous employer is slow or unresponsive, the obligation is one of reasonable steps rather than guaranteed receipt, but the firm should be able to evidence what it asked for and when. A certification decision taken without the reference, or without a record of having chased it, is difficult to defend.

As the giving firm, the duties survive the employment relationship by six years (SYSC 22.2.6R) and, for serious misconduct, indefinitely. That makes regulatory references a leavers process as much as a joiners one — and in most firms the leavers process is the weaker of the two.

The two duties also meet in the middle: the quality of the reference you receive depends entirely on how well the other firm kept its records, and the quality of the one you give depends on how well you kept yours. Treating conduct documentation as a disclosure asset rather than an HR file is the change in posture the chapter really asks for.

A short self-audit

Do your exit and settlement templates contain any clause that purports to restrict regulatory disclosure? Can you produce, for any former employee of the last six years, the conduct and disciplinary record needed to answer questions A to F? Is there a named owner for the SYSC 22.2.4R duty to correct a reference already given? Are you issuing references within four weeks? And is anything in your records treated as expiring at six years that might meet the serious misconduct test, where no time limit applies?