SM&CR overhaul: the most significant reforms since the regime began

The PRA proposes to make almost half of current Senior Manager Functions notified rather than pre-approved roles, reducing the volume of SMF pre-approval applications by more than 40%.  The FCA proposes similar changes for dual-regulated and Enhanced solo-regulated firms, including making SMF5 and SMF10–15 notified functions.  Critically, notified SMF holders would be held to exactly the same regulatory standards as pre-approved SMFs, including the Duty of Responsibility, the requirement to take reasonable steps and the Senior Manager Conduct Rules, the shift is administrative, not substantive.

The PRA would retain pre-approval for SMF1 (Chief Executive), SMF2 (Chief Finance), SMF4 (Chief Risk), SMF9 (Chair of Governing Body), SMF19 (Head of Overseas Branch), SMF23 (Chief Underwriting Officer), SMF24 (Chief Operating Officer), SMF25 and SMF26, while making SMF5, SMF6, SMF8, SMF10–12, SMF14, SMF20 and SMF20a notified roles.  The FCA also proposes to remove the FCA-only SMF18 "Other Overall Responsibility" function and SMF22 "Local Responsibility" function entirely, requiring firms that use these to reallocate responsibilities to other SMFs, a change the PRA does not replicate.  SMF18 and SMF22 currently account for 19% of applications at solo-regulated Enhanced firms and 24% at dual-regulated branches, so the reallocation exercise will be substantial for affected firms.

The PRA proposes to split SMF7 into a pre-approved version (SMF7) and a new notified version (SMF7a), with individuals required to be pre-approved only where their group role corresponds to a specified list of functions including Group Chief Executive, Chief Financial Officer, Chief Risk Officer, Chief Operations Officer, Chief Compliance Officer, MLRO and Board Chair.  The FCA proposes a narrower approach at solo-regulated firms and does not introduce a notification-only SMF7a equivalent.  Dual-regulated firms should review their entire SMF7 population and take separate advice on how each individual will be categorised under both sets of rules.

Both regulators propose extending the temporary SMF cover period from 12 to 18 weeks.  However, the FCA proposes replacing the "reasonably unforeseen" test with a "reasonable use" standard for FCA solo-regulated firms and FCA functions at dual-regulated firms.  The PRA proposes retaining the "temporary or reasonably unforeseen absence" standard for PRA functions at dual-regulated firms. This means that the same absence within a dual-regulated firm could trigger different tests depending on whether the relevant role is a PRA or an FCA function. Firms should consider whether to respond to the FCA's alternative proposal to retain the existing test for all dual-regulated firms, which would resolve this inconsistency.

Both regulators propose removing the obligation to submit revised Statements of Responsibilities (SoRs) and Management Responsibilities Maps (MRMs) whenever there is a significant change to a senior manager's responsibilities, a change expected to reduce submissions by approximately 1,700 per year. Firms would still be required to keep SoRs and MRMs complete, accurate and up to date internally, and to provide them to regulators on request.  The FCA proposes a six-year retention period generally, but a 10-year period for certain categories at dual-regulated firms, to align with the PRA.  Firms should not treat the removal of routine submissions as reducing the importance of these documents, they remain a primary accountability tool and must be production-ready at all times.

The FCA proposes to retain only PR A (overall SM&CR obligations), PR D (financial crime) and PR Z (client assets) for Core and Enhanced firms, together with PR J-3 (outsourced internal audit) for Enhanced firms only.  The PRA proposes a longer retained list of PRs, and is removing a narrower subset, meaning some PRs currently shared between the FCA and PRA will become PRA-only for dual-regulated firms. Removing an FCA Prescribed Responsibility does not remove the underlying substantive obligation, firms will still need to allocate and document responsibility for those areas clearly, even without a formal PR designation.  Dual-regulated firms will need to map their current PR allocation carefully against both the retained FCA and retained PRA PRs.

The FCA proposes to increase the consumer credit revenue threshold from £130 million to £200 million, the asset management assets under management threshold from £65 billion to £100 billion, the intermediary revenue threshold from £45 million to £75 million and introduce a new wholesale markets threshold of £750 million in assets calculated on a three-year rolling average.  Firms that fall below the revised thresholds would move to Core-firm requirements, but the FCA retains the power to require Enhanced treatment where a firm's size, complexity or market impact justifies it, including assessment on a group basis.  Firms near the current thresholds should model the proposed new figures now and consider whether any group-level factors could still attract Enhanced treatment.

Both the FCA and PRA propose to remove the Certification Regime completely, including formal requirements to identify certification functions, issue annual certificates, conduct annual fitness and propriety assessments and seek regulatory references for previously certified individuals.  The FCA proposes to rely instead on existing requirements concerning employee competence, suitability, qualifications, employment checks, performance management and the Conduct Rules.  The PRA additionally proposes to extend the 'competent employee' rule so that CRR and Solvency II firms must take reasonable steps to assess whether individuals previously subject to certification demonstrate the integrity, honesty and other personal characteristics necessary to perform their roles.  The key risk is that firms undertake less structured or less documented competence assessments once annual certification is no longer mandatory. Principal firms should design a replacement framework before implementation to ensure this risk does not materialise.

Regulatory references would no longer be mandatory for individuals previously within the Certification Regime, but they would remain required for individuals applying for either a pre-approved or a notified SMF role.  The PRA considers that removing the obligation for regulatory references for certified individuals reduces burden while still allowing firms to form a view on individual fitness drawing on a range of sources.  Firms should update their hiring and referencing processes so that the distinction between certified and SMF roles is clearly reflected in future onboarding workflows.

The FCA proposes retiring the Directory of certified and assessed persons, ending the associated reporting and annual attestation requirements.  The FCA intends for information about firms and SMF holders to remain available through the Financial Services Register and for consumers to be directed towards the FCA Firm Checker.  Firms should consider how they will maintain comprehensive internal records of individuals, roles and competence once the Directory is no longer a reporting framework and associated data quality obligations cease.

The FCA proposes replacing the prescriptive Conduct Rules training obligation with a requirement to notify relevant staff of the rules that apply to them and the consequences of a breach.  Firms could satisfy this obligation through induction, compliance communications or wider conduct frameworks, without the need for dedicated annual training.  The FCA acknowledges that a less structured approach could reduce staff awareness and weaken the deterrent effect of the Conduct Rules if communications are not properly designed.  Principal firms should ensure that any revised approach produces auditable evidence that each relevant member of staff has been informed, particularly given that Conduct Rules enforcement powers remain fully intact.

For most non-SMF staff subject only to the Individual Conduct Rules, both regulators propose raising the reporting threshold to a final written warning or dismissal, with the final outcome reportable after any internal appeal, and the FCA proposes a 14-month overall reporting window.  For non-SMF staff also subject to Senior Manager Conduct Rules, existing categories of disciplinary action would remain and reports would be due within seven business days of the conclusion of any internal disciplinary or appeal process; SMF reporting requirements would be unchanged under both proposals.  The FCA notes broad alignment with the PRA, but the PRA proposes that certain key roles, Material Risk Takers and Key Function Holders at PRA firms, would be subject to reporting for additional categories of disciplinary action not proposed by the FCA.  Dual-regulated firms will need to maintain separate breach-reporting maps for FCA and PRA staff populations to avoid under-reporting.

Both the FCA and PRA acknowledge that significant elements of the Phase 2 proposals depend on Parliament enacting the Financial Services and Markets Bill in substantially its current form, with implementation targeted for H2 2027.  The PRA estimates a H2 2027 implementation date, with transitional arrangements allowing firms to submit notifications for roles moving from approval to notification up to one month before the implementation date.  The estimated annual cost reduction for PRA firms alone is approximately £11.5 million (central estimate), with one-off familiarisation costs of approximately £4.3 million across all PRA firms.  Firms should not wait for final rules to begin gap analysis, the scale of change to processes, governance documents, hiring workflows and staff communications means that planning needs to begin now.