SM&CR Explained: The Senior Managers and Certification Regime for UK Financial Services

If you work in or advise a UK financial services firm, you have almost certainly come across the Senior Managers and Certification Regime, usually shortened to SM&CR. It is the framework the Financial Conduct Authority and Prudential Regulation Authority use to make individuals, not just firms, personally accountable for their conduct and competence. Understanding it properly matters for anyone working towards CPD requirements in a regulated firm, whether you sit on the board or simply handle client money day to day.

What is the Senior Managers and Certification Regime?

SM&CR was introduced in 2016 for banks, building societies and credit unions, in direct response to the 2008 financial crisis and the widespread view that no individual could be held properly accountable when things went wrong. The regime has since been extended in stages: insurers were brought in from December 2018, and by December 2019 every solo-regulated FCA firm, from small advisory practices to large asset managers, fell within scope. Benchmark administrators joined in December 2020, making SM&CR close to universal across UK financial services.

The three parts of SM&CR

The regime is built from three interlocking components, and it's worth understanding each on its own terms rather than treating SM&CR as a single monolithic rule.

The Senior Managers Regime requires anyone performing a Senior Management Function (an "SMF") to be pre-approved by the FCA or PRA before they start the role. Each senior manager must hold a Statement of Responsibilities setting out exactly what they are accountable for, and firms with more complex structures maintain a Management Responsibilities Map showing how those responsibilities fit together. Senior managers are also subject to a Duty of Responsibility: if something goes wrong in their area, they need to show they took reasonable steps to prevent it.

The Certification Regime covers staff who aren't senior managers but whose role could still cause significant harm to the firm or its customers — think client-facing advisers, algorithmic traders, or those managing material risk. Firms don't need FCA pre-approval for these roles, but they must assess and certify, at least annually, that each person is fit and proper to do the job.

The Conduct Rules set minimum standards of individual behaviour. Tier 1, the Individual Conduct Rules, apply to virtually all staff at a firm (acting with integrity, due skill and care, and being open with regulators). Tier 2, the additional Senior Manager Conduct Rules, apply only to those holding an SMF, and include a specific duty to delegate appropriately and oversee delegated tasks effectively.

Who does SM&CR apply to, and how much depends on firm size

Not every firm faces the same level of obligation. The FCA sorts solo-regulated firms into "Limited Scope", "Core" and "Enhanced" categories, with Enhanced firms — generally the largest and most complex — facing the fullest set of requirements, including a Management Responsibilities Map and additional Senior Management Functions. Smaller advisory and accountancy-linked firms often sit in the Core category, which still carries meaningful obligations but without some of the largest firms' documentation burden.

What's changing under PS26/6

In 2026 the FCA published Policy Statement PS26/6, a targeted review aimed at making SM&CR more proportionate without weakening individual accountability. Most of the changes took effect on 24 April 2026, including a longer validity period for criminal record checks (six months rather than three), a revised 12-week rule under which a firm can keep temporary cover in place beyond 12 weeks if it submits a complete senior manager application within that period, with the cover continuing until the FCA decides, and more time (up to six months) to notify changes to Statements of Responsibilities and Management Responsibilities Maps, with only the latest version needed where there was more than one change. The FCA also issued clearer guidance on when the SMF7 (Group Entity Senior Manager) and SMF18 (Other Overall Responsibility) functions apply, and from 10 July 2026 an SMF18 at a solo-regulated firm can hold any prescribed responsibility. Further changes are staggered through the rest of the year: improvements to regulatory reporting take effect on 10 July 2026, together with the end of the requirement to certify the same person for several overlapping certification functions (about 15% of certification roles), while the FCA removes the duplicate entries from the Financial Services Register's Directory on 30 July 2026, and changes aligning SM&CR with the FCA's wider misconduct framework under PS25/23 come into force on 1 September 2026. Firms already operating under SM&CR should treat 2026 as a year of incremental compliance updates rather than a single big-bang change.

What is in force and what is still proposed

PS26/6 is the first phase of the reforms, and its changes are already in force or have set dates, as described above. A second phase depends on legislation. In April 2026 HM Treasury said it intends to remove the Certification Regime from the Financial Services and Markets Act 2000, let some senior manager roles be appointed by notification rather than pre-approval, and repeal the prescriptive Statement of Responsibilities provisions, leaving the FCA and PRA to set the detail in their rules. These measures need primary legislation. The Financial Services and Markets Bill is progressing through Parliament, and the regulators are expected to consult on Phase 2 rules later. Until then, the existing rules apply.

Why SM&CR matters for compliance CPD

SM&CR sits alongside other accountability-focused obligations that regulated professionals need to keep current on, from the FCA's Consumer Duty through to the responsibilities carried by an MLRO in an accountancy or advisory firm. Because the Certification Regime requires an annual fitness-and-propriety assessment, firms typically build SM&CR awareness training into their yearly compliance CPD cycle rather than treating it as a one-off induction topic. Getting the detail right protects both the individual (whose regulatory record and career depend on it) and the firm (which can face enforcement action for weak SM&CR governance even where no individual is ultimately found at fault).

Frequently asked questions

Does SM&CR apply to accountancy firms? SM&CR itself applies to FCA and PRA-authorised firms, so most accountancy practices fall outside its direct scope unless they hold separate FCA authorisation, for example for investment business or consumer credit activity. However, many accountancy firms encounter SM&CR concepts indirectly when advising financial services clients.

What happens if a senior manager breaches a Conduct Rule? Where the firm takes disciplinary action, it must notify the FCA within seven business days of concluding that action (breaches that do not warrant disciplinary action should not be reported), and the individual can face regulatory sanctions ranging from a public censure to a prohibition from working in regulated financial services.

How often must certified staff be reassessed? At least once every 12 months, though firms can reassess more frequently if a specific concern arises.

Is SM&CR being scrapped? No. PS26/6 simplifies specific processes but leaves the core three-part structure — Senior Managers Regime, Certification Regime and Conduct Rules — fully in place. HM Treasury has announced that it intends to remove the Certification Regime from legislation so that the FCA and PRA can set the requirements in their own rules, and a Financial Services and Markets Bill is before Parliament, but this is not yet law. Until it is enacted and the regulators consult on and make new rules, the Certification Regime and its annual fit and proper assessment continue to apply.

This article is general information for education and CPD purposes only and is not legal, regulatory or financial advice. The SM&CR rules and the government's proposals are changing, so check the current FCA Handbook and publications, or take professional advice, before relying on it.