SMCR Compliance: A Complete Guide to The Requirements And Responsibilities
The Senior Managers and Certification Regime (SMCR) is designed to strengthen individual accountability, conduct and competence across UK financial services. It sets expectations for who is responsible for key business areas, which employees need to be certified as Fit and Proper, and the standards of behaviour expected across the workforce.
For firms, effective SMCR compliance means more than understanding the rules. You need to allocate responsibilities clearly, assess and evidence competence, train employees on the Conduct Rules and maintain the records and processes needed to demonstrate that your framework is working.
The Senior Managers and Certification Regime (SMCR) is an accountability framework for financial services firms. Its purpose is to make individuals more accountable for their conduct and competence, strengthen standards of behaviour and give firms and regulators greater clarity over who is responsible for what.
Related course: Introduction to SMCR
1. Senior Managers Regime
The Senior Managers Regime focuses on the individuals performing Senior Management Functions (SMFs). These individuals generally require regulatory approval before starting their roles and must have clearly documented responsibilities. Every SMF holder must have a Statement of Responsibilities setting out what they are accountable for.
Senior Managers also have a statutory Duty of Responsibility, meaning they must take reasonable steps to prevent regulatory breaches in the areas for which they are responsible.
Read more: SMCR duty of responsibility
Relevant training: SMCR in practice
2. Certification Regime
The Certification Regime covers certain roles that are not Senior Management Functions but can have a significant impact on customers or the firm.
Unlike Senior Managers, Certification Staff are not individually approved by the FCA. Instead, firms are responsible for assessing whether relevant individuals are Fit and Proper and certifying them at least annually.
This places an ongoing responsibility on firms to understand which roles are in scope, assess competence and Fitness and Propriety, and maintain appropriate evidence.
Relevant training: Fit and Proper Assessments3. Conduct Rules
The Conduct Rules establish minimum standards of behaviour for individuals working in financial services. The FCA's Individual Conduct Rules apply broadly across the workforce, while Senior Managers have four additional rules relating to their responsibilities.
The four additional Senior Manager Conduct Rules state that you must:
- Take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively.
- Take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system.
- Take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively.
- Disclose appropriately any information of which the FCA or PRA would reasonably expect notice.
Learn how to meet the Conduct Rules:
Meeting the Conduct Rules in FCA Solo Regulated Firms
SMCR applies to the majority of firms regulated by the FCA and PRA, with requirements varying according to the type and size of firm. The regime was initially introduced for banks and certain investment firms, extended to insurers in 2018 and subsequently to most FCA solo-regulated firms.
The FCA distinguishes between different categories of solo-regulated firms, with requirements applying proportionately depending on the firm's size and activities.
For firms operating across financial services, understanding exactly which SMCR requirements apply is an important first step.
Find answers to key SMCR questions:
What are the key SMCR requirements?
Although requirements vary by firm and role, an effective SMCR framework typically will need to address:
- Identification and approval of Senior Management Functions
- Statements of Responsibilities
- Responsibilities Maps where applicable
- Prescribed Responsibilities
- Fitness and Propriety assessments
- Certification of relevant employees
- Conduct Rules training
- Regulatory references
- Reporting and management of Conduct Rule breaches
- Appropriate records and evidence of compliance
- Ongoing oversight and accountability
The FCA Handbook sets out the detailed requirements and guidance for different elements of the regime.
How can firms evidence SMCR competence?
SMCR places significant responsibility on firms to understand the competence and Fitness and Propriety of relevant individuals.
For Certification Staff, firms need processes to identify relevant roles, assess whether individuals are Fit and Proper and certify them on appointment and at least annually.
Evidence should go beyond simply recording that someone completed a training module. Firms need to be able to demonstrate that appropriate people have received relevant training, understand their responsibilities and can apply the required standards in practice.
Related read: How to evidence SMCR competence
Strengthen your training records:SMCR compliance e-learning courses
SMCR compliance e-learning courses
How should employees be trained on SMCR?
SMCR training needs to reflect employees' roles and responsibilities rather than treating the regime as a one-size-fits-all requirement.
A typical programme may combine:
-
Organisation-wide awareness
Help employees understand why SMCR exists, the three parts of the regime and what it means for them. - Conduct Rules training
Ensure employees understand the standards that pertain to them and how to apply them in practice.
Related read: Managing Non-financial Misconduct -
Role-specific learning
Provide additional training for NEDs, Senior Managers, managers or employees performing relevant Certification Functions. - Scenario-based learning
Use realistic situations to help employees recognise potential breaches and make better decisions.
Related read: SMCR scenario tests - Ongoing reinforcement
Use refresher learning, microlearning and relevant communications to reinforce expectations over time.
Explore SMCR compliance training
SMCR training to meet your compliance programme needs.
Complete library of SMCR e-learning courses
Explore SMCR Compliance E-learning Courses
Our SMCR library includes training for FCA solo-regulated, dual-regulated and insurance firms, with both in-depth courses and shorter learning formats.
Getting started with SMCR awareness
Introduction to the SMCR Course
Conduct Rules training
Meeting the Conduct Rules in FCA Solo Regulated Firms Course
Meeting the Conduct Rules in Dual Regulated Firms Course
Specialist training for Senior Managers
Conduct Rules for Senior Managers at Insurance Firms Course
Conduct Rules for Senior Managers at FCA Solo Firms Course
Conduct Rules for Non-Executive Directors (NEDs) Course
Training on Fitness and Propriety
Fit and Proper Assessments Course
Practical application for managers
SMCR in Practice Course
How can firms manage SMCR compliance?
For larger or more complex firms, managing SMCR can involve maintaining multiple records and processes covering Senior Managers, Certification Staff, Statements of Responsibilities, Fitness and Propriety, training and compliance evidence.
Digitising these processes can reduce manual administration while making it easier to maintain accurate records and provide visibility across the organisation.
Related read: Digitising SMCR compliance
Manage SMCR in one place
SMCR compliance software can bring key records and processes together, helping firms manage Senior Managers and Certified Persons, track certification requirements, maintain supporting evidence and identify upcoming compliance tasks.
Skillcast's Compliance Portal brings SMCR registers, staff information and compliance evidence into one place. It can automatically populate Senior Management Functions based on firm type, draw information from LMS, HR and internal records, trigger certification alerts and securely store supporting documents such as regulatory references and qualification certificates.
See it in action: How Kentro Capital streamlined SMCR compliance
SMCR for different types of firms
Dual-regulated firms
Banks, insurers and other dual-regulated firms may have requirements involving both the FCA and PRA. Training should reflect the firm's regulatory status and the responsibilities of different populations.
Overview of SMCR for Dual Regulated Firms
FCA solo-regulated firms
Solo-regulated firms have requirements that vary according to their SMCR classification and activities.
Meeting the Conduct Rules in FCA Solo Regulated Firms
Insurance firms
Insurance firms have specific requirements and considerations under SMCR, including training for Senior Managers and others performing relevant roles.
Conduct Rules for Senior Managers at Insurance Firms
Explore broader sector support:
SMCR within your wider compliance programme
SMCR rarely sits in isolation. Financial services firms may also need training across areas such as:
- Consumer Duty
- Financial crime
- Market abuse
- Conduct risk
- Complaints handling
- Vulnerable customers
- Data protection
- Cybersecurity
- FCA regulatory requirements
Related read: SMCR training roadmap
Build a stronger SMCR compliance programme
From understanding the rules to training employees and managing evidence, effective SMCR compliance depends on having the right knowledge, processes and tools in place.
Start your free trial
What is SMCR?
There are three key parts to the SMCR: Senior Managers Regime, Certification Regime and Conduct Rules.
Senior Managers Regime
This enforces a detailed and clear allocation of responsibilities between senior managers at each firm, with particular emphasis placed on key documents - 'Statements of Responsibilities' and 'Responsibilities Maps'. These help to record the distribution of responsibility to individual Senior Managers and to demonstrate to the regulators that there are no gaps or excessive overlaps.
Always bear in mind that Senior Managers have a statutory duty of responsibility "to take reasonable steps to prevent regulatory breaches in the areas of the firm for which they are responsible".
Certification Regime
This requires firms to check and confirm that employees performing roles relating to the firm's regulated activities are fit and proper, based on their qualifications, competence and personal characteristics.
Once this has been confirmed, the firm needs to issue them with a certificate that must be renewed every year.
Conduct Rules
This consists of a set of rules provided in the FCA's Code of Conduct Handbook (COCON) that covers all individuals: Senior Managers, Certified Persons and other employees.
What is the scope of the SMCR?
SMCR rollout waves
The SMCR has been rolled out in three waves:- Wave 1: Banks, building societies, credit unions and large investment firms in March 2016 (updated July 2018)
- Wave 2: Extended to insurance firms (those regulated by the FCA and PRA) in December 2018
- Wave 3: The remaining financial services firms (otherwise known as 'solo-regulated firms' since they are regulated only by the FCA, not the FCA and PRA) came under the scope of this regime in December 2019.
SMCR categories
The range of firms in Wave 3 is very diverse. Consequently, the FCA has grouped them into three categories to ensure that the regulation is proportionate to their sizes and activities:
Core: Firms that have to comply with the baseline requirements for solo-regulated firms
Limited Scope: Firms that already had exemptions under the Approved Persons Regime, are exempt from some requirements and require fewer senior management functions
Enhanced: Firms that have extra requirements - these are large, complex firms with potential impact on consumers or markets that warrants more attention from the FCA
What's needed to comply with the SMCR?
- Statement of Responsibilities - Set out the areas for which each Senior Manager is personally accountable
- Responsibilities Map - This knits together the Statement of Responsibilities
- Pre-approval for all Senior Managers - obtain this from the regulators before they carry out their roles
- Duty of Responsibility - Ensure that Senior Managers understand their responsibilities and take reasonable steps to prevent regulatory breaches in their areas of responsibility
- Identify all Certified Persons - These are all material risk takers
- Fit and Proper Assessment - Of all Certified Persons, then re-assess on an annual basis
- Training - Of all those who are subject to the Conduct Rules
SMCR Training
Such training must result in employees gaining awareness and a broad understanding of all of the conduct rules, as well as a deeper understanding of the practical application of the specific rules which are relevant to their work.
To help with SMCR implementation, we have created a 3-step training model.
We provide a comprehensive set of SMCR training courses for all financial firms, including banking, insurance and solo-regulated firms.
Duty of Responsibility
Senior Managers have a statutory duty of responsibility "to take reasonable steps to prevent regulatory breaches in the areas of the firm for which they are responsible".
The FCA can take action against a Senior Manager (SM) where it can show that:
There was misconduct by the SM's firm,
At the time of the misconduct or during any part of it, the SM was responsible for the management of any of the firm's activities in relation to which the misconduct occurred, and the SM did not take such steps as a person in their position could reasonably have been expected to take to avoid the misconduct occurring or continuing.
The burden of proof for all these elements lies on the FCA. The SM does not need to show that they took reasonable steps - rather, it is for the FCA to prove that they did not. The defence against such action is if the senior manager can show that they took "the steps that are reasonable for a person in that position to take to prevent a regulatory breach from occurring".
Fitness and Propriety
The FCA must approve all senior managers, which assess whether they are fit and proper to perform the given function or responsibility.
Three key factors determine whether you are Fit and Proper:
Honesty, integrity and reputation
Competence and capability
Financial soundness
When determining a person's financial soundness, the FCA will not normally require a statement of assets or liabilities of the person. Limited financial means does not in itself affect the suitability of a person to perform an SMF.
When appointing a Senior Manager or Certified Person, firms must obtain a regulatory reference from all their past employers going back six years. This requirement also applies when appointing NEDs who are not Senior Managers.
For this purpose, firms need to retain records of disciplinary and fit and proper findings going back six years and not enter into arrangements that conflict with their disclosure obligations.
What are the SMCR Conduct Rules?
SMCR incorporates new high-level standards of behaviour that apply to almost all employees who carry out financial services activities in a firm. Some Conduct Rules apply to all employees, while others apply only to Senior Managers.
The Conduct Rules are intended to drive up standards of individual behaviour in financial services. By applying them to a broad range of staff, the FCA aims to improve individual accountability and awareness of conduct issues across firms.
Individual Conduct Rules (ICRs)
These apply to all employees, with the exception of ancillary staff, such as facility managers, personal assistants, receptionists, medical staff, IT and HR, who perform a purely non-financial service's role. These ICRs also apply to Non-Executive Directors.
ICR 1: You must act with integrity
ICR 2: You must act with due skill, care and diligence
ICR 3: You must be open and cooperative with the FCA, the PRA and other regulators
ICR 4: You must pay due regard to the interests of customers and treat them fairly
ICR 5: You must observe proper standards of market conduct
Senior Manager Conduct Rules (SMCRs)
These apply only to Senior Managers, including NEDs (SC 4 even applies to out of scope NEDs)
SC 1: You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively
SC 2: You must take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system
SC 3: You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively
SC 4: You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice
What does SMCR Best Practice look like?
Stay up to date with SMCR best practices, industry insights and key trends across regulatory compliance, digital learning, EdTech and RegTech by subscribing to the Skillcast Compliance Bulletin.
3-Step SMCR Training Model
Whether you're new to the SMCR or benchmarking existing processes, our training model will help get your compliance training on track.
FCA Conduct Rules Training Aid
Our desk aid has ten tips on how to ensure your staff fully understand and adhere to conduct rules.
FCA COCON Breaches Desk Aid
Our desk aid reminds all of your staff fully of the ten easiest ways to breach the FCA Code of Conduct.
Operational Resilience Implementation Checklist
Ensure your firm follows the FCA guidelines for a compliant operational resilience programme.
Fit and Proper Training Presentation
Firms need to assess the Fitness and Propriety (F&P) of Senior Managers and Certified Persons when they are appointed and on an ongoing basis. Our F&P training presentation uses scenarios to help explain this further.
SMCR & Non-financial Misconduct
A lack of public confidence and some damaging press stories have renewed the FCA's focus on conduct, including non-financial misconduct. Find out more, including a free training module and a desk aid.
SMCR Solo-Regulated Firms Key Questions Answered
We answer the questions every solo-regulated firm has been asking.
SMCR Insurance Firms Key Questions Answered
We also answer the questions every insurance firm has been asking.
How to Evidence your SMCR Competence
If you cannot articulate what is adequate and competent within your firm, you simply won't be able to evidence SMCR compliance when the FCA comes knocking!
How to Prevent SMCR Training Damaging Staff Motivation
SMCR created a step-change in personal accountability, causing a headache, especially when dealing with those who've never been accountable before. That's why it's important to take steps to address any issues before they spiral out of control.
What are the SMCR Functions?
The Senior Managers Regime (SMR) applies to those who perform a Senior Management Function (SMF). The FCA has classified specific functions as SMFs, so that it knows who a firm's senior decision-makers are, and to make sure that firms clearly allocate specific responsibilities to those key individuals.
In certain circumstances, firms can have more than one individual performing a single SMF. However, the FCA expects that SMFs are only shared where it is justified and appropriate.
The list of SMFs that apply depends on the type of firm.
5.1 Governing Function SMFs
| SMF1 | Chief Executive | Core and Enhanced firms |
| SMF3 | Executive | Core and Enhanced firms |
| SMF7 | Group Entity Senior Manager | Enhanced firms only |
| SMF 9 | Chair (non-executive) | Core and Enhanced firms |
| SMF10 | Chair of the Risk Committee | Enhanced firms only |
| SMF11 | Chair of the Audit Committee | Enhanced firms only |
| SMF12 | Chair of the Remuneration Committee | Enhanced firms only |
| SMF13 | Chair of the Nominations Committee | Enhanced firms only |
| SMF14 | Senior Independent Director | Enhanced firms only |
| SMF27 | Partner | Core and Enhanced firms |
5.2 Required Function SMFs
| SMF16 | Compliance oversight | Core and Enhanced firms (and sole traders, authorised professional firms and oil market participants) |
| SMF17 | Money Laundering Reporting officer | Core and Enhanced firms and (and sole traders and oil market participants) |
| SMF18 | Other Overall Responsibility | Enhanced firms only |
| SMF29 | Limited Scope Function | Limited Scope firms (e.g. limited permission consumer credit firms, authorised professional firms, firms that intermediate insurance without this being principal business) |
The Overall Responsibility requirement means that an Enhanced firm will need to make sure that every activity, business area and management function has a Senior Manager with overall responsibility for it. This is to prevent an unclear allocation of responsibilities.
Overall Responsibility means that a Senior Manager:
- Has ultimate responsibility for managing or supervising a function
- Briefs and reports to the governing body about their area of responsibility
- Puts matters requiring decisions about their area of responsibility to the governing body
5.3 Systems and Control SMFs
| SMF2 | Chief Finance Function | Enhanced firms only |
| SMF4 | Chief Risk Function | Enhanced firms only |
| SMF5 | Head of Internal Audit | Enhanced firms only |
| SMF24 | Chief Operations Function | Enhanced firms only |
What are the required responsibilities under the SMCR Responsibilities
You need to be aware that there are more responsibilities for Senior Managers than just the ones found within each SMF's definition. The regulators have listed certain 'Prescribed Responsibilities' (PRs) that each firm is required to allocate between Senior Managers.
Each PR would generally be allocated to the Senior Manager who performs the SMF most closely linked to the given responsibility. PRs can be shared but not split between Senior Managers. Where responsibility is shared, it is recorded identically in each of the Senior Manager's Statements of Responsibilities.
If there is a breach, all Senior Managers sharing that responsibility may be required to demonstrate that they took reasonable steps to prevent or stop the breach.
The list of PRs that applies depends on the type of firm. Responsibilities (a), (b), (b-1), (d) below cannot be allocated to SMF 18 (Other Overall Responsibility) and responsibilities (j), (k), (l) below should be performed by a non-executive director if possible.
| (a) | Performance by the firm of its obligations under the SMR, including implementation and oversight | All firms |
| (b) | Performance by the firm of its obligations under the Certification Regime | All firms |
| (b-1) | Performance by the firm of its obligations in respect of notifications and training of the Conduct Rules | All firms |
| (d) | Responsibility for the firm's policies and procedures for countering the risk that the firm might be used to further financial crime | All firms |
| (z) | Responsibility for the firm's compliance with CASS (if applicable) | All firms |
| (c) | Compliance with the rules relating to the firm's Responsibilities Map | Enhanced firms only |
| (j) | Safeguarding and overseeing the independence and performance of the internal audit function (in accordance with SYSC 6.2) | Enhanced firms only |
| (k) | Safeguarding and overseeing the independence and performance of the compliance function (in accordance with SYSC 6.1) | Enhanced firms only |
| (l) | Safeguarding and overseeing the independence and performance of the risk function (in accordance with SYSC 7.1.21R and SYSC 7.1.22R) | Enhanced firms only |
| (j -3) | If the firm outsources its internal audit function, taking reasonable steps to ensure that every person involved in the performance of the service is independent from the persons who perform external audit, including supervision and management of the work of outsourced internal auditors, and management of potential conflicts of interest between the provision of external audit and internal audit services | Enhanced firms only |
| (t) | Developing and maintaining the firm's business model | Enhanced firms only |
| (s) | Managing the firm's internal stress tests and ensuring the accuracy and timeliness of information provided to the FCA for the purposes of stress-testing | Enhanced firms only |
| (za) | Responsibility for an AFM's assessments of value, independent director representation and acting in investors' best interests | Authorised Fund Managers |
Who is responsible for assessing competence?
What types of evidence can demonstrate competence?
How often should competence be reviewed?
What is the difference between SMCR and the Senior Managers Regime?
SMCR is the broader framework, while the Senior Managers Regime is one of its three core components, alongside the Certification Regime and Conduct Rules.
Who needs SMCR training?
Training requirements depend on an individual's role and the firm's regulatory status. Conduct Rules apply broadly across the workforce, while Senior Managers and other relevant populations may require more specific learning.
How often does SMCR training need to be completed?
There is no single training frequency that applies identically to every employee and firm. Firms should determine appropriate training based on their responsibilities, risks and regulatory requirements.
Does SMCR apply to solo-regulated firms?
Yes. The majority of FCA solo-regulated firms are within the SMCR framework, although requirements vary depending on the firm's classification and circumstances.
What happens if an employee breaches the SMCR Conduct Rules?
Firms should have processes for identifying, investigating and managing Conduct Rule breaches, including reporting to the FCA where required