The Senior Managers and Certification Regime (SMCR) Explained

The Senior Managers and Certification Regime (SMCR) is the UK's framework for individual accountability in financial services. It replaced the Financial Services Authority's Approved Persons Regime (APR) for banks and designated investment firms from March 2016, and was extended to all FCA-solo-regulated firms in December 2019. SMCR is predicated on a simple idea that the post-crisis reviews found the APR failed to deliver: when things go wrong at a bank, it should be possible to identify the senior individuals responsible, and hold them accountable.

Why the APR Failed: HBOS and RBS

The Parliamentary Commission on Banking Standards (PCBS) — established in the wake of the financial crisis and the LIBOR scandal — concluded in its 2013 report that the APR had failed to deliver meaningful individual accountability. The APR required senior individuals to be approved by the FSA before taking on certain controlled functions, but the approval process was insufficiently rigorous and the regime provided no adequate mechanism for holding individuals accountable after the fact.

The HBOS and Royal Bank of Scotland failures illustrated the deficiency starkly. Boards and senior management teams that presided over catastrophic strategic failures — aggressive expansion, extreme leverage, inadequate risk controls — were largely able to walk away without regulatory consequence. The APR's concept of "significant influence functions" was too broad and too vaguely defined; it was difficult to attribute responsibility for specific decisions and outcomes to specific individuals. The PCBS recommended a wholesale replacement.

The SMCR was designed in response to those recommendations. Its architecture is built around three overlapping populations within a firm: Senior Managers, Certified Persons, and everyone else who is subject to the Conduct Rules.

Senior Management Functions

Senior Management Functions (SMFs) are the specific roles that require pre-approval by the PRA, the FCA, or both. Only individuals in SMF roles are "Senior Managers" under SMCR. The list of SMFs is specified in the regulators' rules, and covers the most senior positions in a firm:

• PRA-designated SMFs include: Chief Executive (SMF1), Chief Finance Officer (SMF2), Chief Risk Officer (SMF4), Head of Internal Audit (SMF5), Group Entity Senior Manager (SMF7), and various others including certain Non-Executive Directors (SMF9 — Chair of the Audit Committee, SMF10 — Chair of the Risk Committee, SMF11 — Chair of the Remuneration Committee).
• FCA-designated SMFs include: Executive Director (SMF3), the Overall Responsibility function (SMF18 — which catches senior managers with responsibility for a business area or function not otherwise covered), and the Money Laundering Reporting Officer (SMF17).

For each SMF, the firm must submit a regulatory reference and the individual must be assessed as fit and proper. Once approved, the individual's status is publicly visible on the FCA's Financial Services Register. A key difference from the APR is that the Senior Manager's responsibilities must be articulated in a Statement of Responsibilities (SoR) — a document setting out clearly what the individual is personally responsible for within the firm.

Prescribed Responsibilities

Alongside the SoR, SMCR requires that certain specific responsibilities — called Prescribed Responsibilities (PRs) — are allocated to named SMFs. PRs were introduced because the PCBS found that certain critical governance responsibilities had, under the APR, fallen between the cracks: everyone assumed someone else was responsible. PRs ensure that no senior management responsibility is unowned.

Examples of PRs in a capital markets firm include:

• Responsibility for the firm's performance of its obligations under the Senior Managers Regime, including implementation and oversight
• Responsibility for the firm's obligations in relation to its ICAAP
• Responsibility for the firm's Recovery Plan and Resolution Pack
• Responsibility for whistleblowing
• Responsibility for the firm's policies and procedures for countering the risk of financial crime
• Responsibility for the firm's performance of its obligations under the certification regime

Each PR must be allocated to a named SMF who accepts personal accountability for it. The totality of an SMF's SoR plus allocated PRs creates a map of that individual's accountability within the firm — and a basis for regulatory accountability should something go wrong in their area.

The Duty of Responsibility and the Presumption of Responsibility

SMCR creates a specific standard of liability for Senior Managers through the Duty of Responsibility. Under this duty, where a firm breaches a regulatory requirement, and the Senior Manager was responsible for the activity in question at the time of the breach, the regulator may take action against that individual if they cannot demonstrate that they took reasonable steps to prevent the breach from occurring.

This reversal of the evidential burden — placing on the Senior Manager the obligation to show they took reasonable steps — was among the most significant changes SMCR made to individual accountability. Under the APR, the regulator bore the burden of demonstrating individual culpability. The Duty of Responsibility places the weight on the Senior Manager to demonstrate active, documented governance.

What constitutes "reasonable steps" is not exhaustively defined, but regulators have indicated it includes: ensuring adequate systems and controls exist, receiving appropriate management information, escalating concerns, and acting decisively when problems are identified. A passive Senior Manager who receives concerning MI and does nothing is unlikely to be able to demonstrate reasonable steps.

The Certification Regime

Below the Senior Manager population sits the Certification Regime. Certified Persons are individuals who perform a Significant Harm Function (SHF) — a function that could cause significant harm to customers, the firm, or market integrity — but who do not hold a formal SMF. The firm, not the regulator, is responsible for assessing and certifying these individuals as fit and proper.

In a capital markets bank, Certified Persons typically include:

• Traders and sales professionals (who hold the "material risk taker" SHF, or the "client-dealing" SHF)
• Analysts whose recommendations influence investment decisions
• Supervisors of certified persons
• Individuals who are proprietary traders

The firm must certify each relevant individual at least annually, confirming they remain fit and proper. Fit and proper encompasses honesty and integrity, competence and capability, and financial soundness. If a firm concludes an individual is no longer fit and proper, their certification must be withdrawn and they cannot continue to perform SHFs. The FCA maintains a public directory of certified persons — not, as with SMFs, an approval register, but a disclosure register showing who firms have certified.

Annual certification creates a formal moment at which the firm must actively consider each Certified Person's conduct record over the preceding year — including any disciplinary matters, compliance breaches, or customer complaints — and make an affirmative judgment about their ongoing fitness. This stands in sharp contrast to the APR, where approval once obtained was effectively permanent until revoked.

Conduct Rules

The Conduct Rules apply to a much broader population than the SMF and certification regimes. With certain limited exceptions (including administrative and ancillary staff), virtually all employees of a firm are subject to the Individual Conduct Rules (ICRs). Senior Managers are additionally subject to the Senior Manager Conduct Rules (SCRs).

Individual Conduct Rules

• Rule 1: You must act with integrity.
• Rule 2: You must act with due skill, care and diligence.
• Rule 3: You must be open and cooperative with the FCA, the PRA and other regulators.
• Rule 4: You must pay due regard to the interests of customers and treat them fairly.
• Rule 5: You must observe proper standards of market conduct.

Senior Manager Conduct Rules

• SC1: You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively.
• SC2: You must take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system.
• SC3: You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively.
• SC4: You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice.

The Conduct Rules provide the FCA and PRA with a direct basis for taking enforcement action against individuals — including those who are neither SMFs nor Certified Persons — for conduct failures. A trader who engages in market manipulation or a junior employee who falsifies records can be held personally accountable under the Conduct Rules without needing to be within the SMF or certification populations.

Regulatory References

SMCR introduced a mandatory regulatory reference regime for Senior Managers and Certified Persons. When a firm recruits an individual into an SMF or Certified Person role, it must request a regulatory reference from the individual's previous employer (going back six years). The previous employer is required to provide information about any conduct rule breaches or disciplinary matters in that period, including matters that might otherwise be covered by a settlement agreement. This was designed to prevent individuals who had been dismissed for serious misconduct at one firm from moving to another firm without that firm knowing their history.

SMCR in Practice: Capital Markets

In a capital markets bank, SMCR creates a layered accountability structure that runs from the Board through to individual trading desks. The Chief Executive, Chief Risk Officer, Chief Finance Officer, and business-line heads each have SoRs and allocated PRs. These documents must be maintained and updated when responsibilities change — including on interim appointments or role changes. The firm must maintain an up-to-date Management Responsibilities Map (MRM) showing how all SMF roles, PRs, and reporting lines fit together.

For the trading businesses, the practical impact is most visible in the certification process. Every trader, salesperson, and structurer who meets the SHF threshold must be certified annually. The Head of Compliance or a designated Certification Officer must maintain records of each certification decision and the evidence base for it. Where an individual's conduct has given rise to concern during the year — disciplinary proceedings, compliance breaches, customer complaints — the certification decision becomes a deliberate judgment, not a rubber-stamp.

SMCR also affects how incidents are managed. When a significant control failure or regulatory breach occurs, one of the early questions is: which SMF held responsibility for this area? The Duty of Responsibility then focuses the investigation on what that individual knew, when they knew it, and what they did. A well-run SMCR framework means the answer to those questions is documented: MI packs, committee minutes, escalation records, and the SMF's own attestations all become part of the evidence base.