On 22 October 2026, the FCA and the PRA published consultations on the Phase 2 reforms to the Senior Managers and Certification Regime (SMCR) (FCA CP26/37 and PRA CP14/26). They confirmed their Phase 1 changes in April 2026, achieving some “quick wins” that did not require amendments to the framework legislation, such as adding guidance on certain Senior Management Functions (SMFs), reducing how frequently firms must submit Statements of Responsibilities (SoRs) to the regulator(s), and allowing firms 12 weeks to submit an application rather than to obtain approval for cover for temporary absences (see this Latham blog post).
This next wave of reforms seeks to take advantage of the new flexibility being brought to the regime via legislative changes in the Financial Services and Markets Bill 2026, which is currently making its way through Parliament. Planned changes to the legislation include:
The proposed changes to the regulators’ rules are significant and wide-ranging. The SMCR has been tweaked numerous times during its existence and there is a sense that the regulators are trying to future-proof the regime as much as possible to reduce the regulatory change burden for firms. That said, the consultations flag some areas that the regulators plan to keep under review, with potential future changes in mind. We have provided a quick overview of which key changes apply to which type of firm in Annex I. Annex II sets out the proposed notified and pre-approved SMFs, while Annex III provides an overview of the changes to Prescribed Responsibilities (PRs).
Although the regulators are aiming to streamline their rules and simplify the approach for firms, the FCA and PRA do not propose to fully align their rules in certain areas, meaning that dual-regulated firms would still have to contend with applying different standards within the same parts of the regime.
Given the new flexibility to make certain SMFs notification-only, the PRA proposes to remove the requirement to obtain regulatory pre-approval for almost half of its current SMFs, while the FCA proposes to make six of its SMFs notification-only. We have set these out in Annex II. These FCA SMFs are relevant to dual-regulated firms and Enhanced Firms. However, the FCA is not proposing changes to SMF roles in Core and Limited Scope Firms, given that fewer functions apply. Both regulators note that, due to the increasing importance of operational resilience and operational risk, they are not looking to make the Chief Operating Function (SMF24) notification-only at this stage. However, the PRA and FCA intend to review this position two years after the Phase 2 reforms are implemented. These reforms are expected to reduce PRA SMCR pre-approvals by 43% and FCA Enhanced Firm approvals by around 15%.
In addition, the PRA plans to split the Group Entity Senior Manager Function (SMF7) into pre-approved and notified roles, depending on the nature of the role. Thus, an individual exercising significant influence over the regulated firm in a group-level role that corresponds to certain PRA and FCA SMFs that require approval would need pre-approval as an SMF7, whereas others who exercise significant influence over the firm but whose role does not correspond to one of the specified SMFs would only need to be notified as an SMF7a. The PRA considers that, in practice, individuals in branches or subsidiaries of overseas banks are likely to only require notification. The PRA emphasises that this change is not meant to expand the scope of the current SMF7 population.
However, the FCA is proposing a different approach to SMF7, narrowing the scope of SMF7 to broadly capture only the individuals who would meet the test to require approval under the PRA’s revised approach. Therefore, the FCA does not propose to include notified SMF7s under its regime. The relevant SMFs the FCA intends to include in its revised SMF7 definition largely mirror the SMFs it intends to retain as functions requiring approval in Enhanced Firms, namely Chief Executive, Chief Finance, Chief Risk, Chief Operations, Chair, Compliance Oversight, and Money Laundering Reporting Officer. The FCA’s approach would therefore narrow the scope of SMF7 for solo-regulated firms, and it estimates this would reduce the solo‑regulated SMF7 population by about 40%. These differences in approach mirror the supervisory difference that has been visible on the ground in recent years, where the PRA seems much keener than the FCA to use the SMF7 regime to achieve its regulatory objectives.
For notified SMFs, the firm would assess whether the candidate is fit and proper for the role at the time of appointment, instead of applying for regulatory pre-approval. Firms would need to complete all of the same checks as at present; for example, obtaining regulatory references, conducting criminal records checks, and preparing a SoR. The regulators do not set out the full detail of what the notification would look like, but they do indicate their intention to request less information than currently required in the existing Short Form A. They would likely ask for the candidate’s details, confirmation that a fit and proper assessment has been completed, plus a SoR and Management Responsibilities Map (MRM), but would not require any other supporting documents. The regulators plan to only carry out automated checks to confirm the form is complete and the individual is not prohibited.
The notification would need to be submitted by the firm in advance of the individual’s start date, and could be submitted up to three months in advance, to take effect on either the future start date specified by the firm or upon acknowledgement of receipt by the regulator, whichever is later. Firms would also be able to withdraw a notification before it takes effect. Both notified and approved SMFs would appear on the Financial Services Register, and the Register would distinguish between the two types of SMF.
The regulators emphasise that, although individuals performing notified SMFs would no longer require regulatory pre-approval, they would continue to be subject to the same level of accountability as at present, including the Duty of Responsibility and the Senior Manager Conduct Rules. The FCA also warns that it intends to keep its approach under review and may look to consult on reintroducing pre-approval for its notified SMFs if it finds that firms are making unsuitable appointments or failing to undertake appropriate scrutiny. Equally, if it finds that notification is working well, it could decide to extend this to other SMFs.
The approval process for SMFs that continue to require regulatory pre-approval would remain the same. The reforms would also not affect the status of approvals granted before the implementation date. Therefore, if an individual has been approved to perform an SMF that becomes a notified function following implementation, their approval would remain effective and the firm would not be required to submit a notification.
The forthcoming legislative changes will also enable the regulators to require pre-approval for an otherwise notified SMF role, in exceptional cases. Both regulators are proposing guidance on how they would intend to use this power, emphasising that they expect to use it rarely (when they have specific concerns about a firm). They could use this power in relation to a particular role at a firm, or in relation to all notified SMF roles within a certain firm. They provide some examples, including when a firm is at risk of failing, when serious concerns have been identified in relation to a firm’s governance, when there are serious concerns about a firm’s ability or willingness to assess the fitness and propriety of notified SMFs, or when a notified role has particular importance in relation to the firm’s safety and soundness.
The FCA proposes to remove two FCA‑only SMFs: SMF18 (Other Overall Responsibility) and SMF22 (Local Responsibility). The FCA reports that, currently, SMF18 accounts for 19% of applications at Enhanced Firms, while SMF22 accounts for 24% of applications at dual regulated branches, so it considers that removing these roles would reduce the burden of the regime significantly.
Firms would be required to reallocate the PRs and overall and local responsibilities of individuals currently performing SMF18 or SMF22 to other SMFs. The FCA proposes to amend SYSC 26 and COCON so that firms can make greater use of delegation, layered management structures, and governance and reporting frameworks in order to implement these changes.
Having already amended the 12-week rule as part of the Phase 1 changes, the regulators now seek to provide more flexibility by allowing firms 18 weeks to apply for approval or make a notification for an individual providing temporary cover. The regulators consider that this will have a limited impact on risk, since forthcoming legislative changes will reduce the statutory deadline for determining SMF applications from three to two months, and notifications can take effect upon receipt, meaning individuals should not spend longer performing a role without approval than at present. They also propose to remove the requirement to submit a Form D notification when a Senior Manager will be temporarily absent for more than 12 weeks, and when that person returns from absence.
However, the regulators plan to take slightly different approaches. The FCA proposes to remove the requirement that the rule can only be used where the absence of the SMF is “reasonably unforeseen”, and to replace this with a “reasonable use” standard. This would only apply to FCA solo regulated firms and FCA functions in dual regulated firms. The PRA intends to retain the “reasonably unforeseen” requirement for dual regulated firms, and also emphasises that it would expect firms to submit an application as soon as possible. Consequently, if the changes go ahead as proposed, dual-regulated firms would have to apply different temporary cover rules depending on the SMF in question, leading to complexity. The FCA acknowledges this approach may not be ideal for firms, and suggests that it could remove the “reasonably unforeseen” requirement for SMFs in FCA solo regulated firms only, to align the position for dual-regulated firms with that of the PRA.
The proposed legislative changes will allow firms to apply for time limited or conditional approvals in permitted circumstances. This change would be relevant to dual regulated firms, solo regulated firms in dual regulated groups, and Enhanced Firms. The regulators plan to integrate requests for time limited or conditional approvals into SMF application processes, and to specify circumstances where time-limited and/or conditional approvals are more or less likely to be permitted. The regulators anticipate that these options may be useful for managing short-term vacancies for roles requiring approval, and scenarios not covered by the extended 12-week rule, although they expect requests for time-limited or conditional approvals to be rare.
Both regulators intend to remove certain PRs from their regimes. In doing so, the PRA aims to remove duplication and complexity. PRs set to be removed include those relating to the Certification Regime and PR allocation, training and induction of members of a firm’s governing body, and maintenance of the firm’s business model.
Meanwhile, the FCA intends to remove nine of its PRs and retain only key PRs relating to responsibility for the Senior Managers Regime, responsibility for financial crime, responsibility for CASS, and (for Enhanced Firms) responsibility for oversight of outsourced internal audit. The regulators aim to clarify that the Senior Manager with responsibility for the Senior Managers Regime would need to have oversight of the processes for notified-only SMFs as well as approved SMFs. As the PRA would retain a longer list of PRs overall, some PRs that are currently both FCA and PRA PRs for dual regulated firms would become PRA only PRs. We have set out lists of the remaining FCA and PRA PRs in Annex III.
The regulators emphasise that the removal of certain PRs would not take away the underlying requirements. It would only remove the PR mechanism for separately recording responsibility for that area. Consequently, firms would still need to maintain SoRs where required and accurately record SMF responsibilities. That said, the regulators emphasise they would not expect firms to reproduce responsibilities previously covered by deleted PRs as overall, local, or other responsibilities.
To help with transition, the FCA is proposing that Core Firms would not need to update SoRs solely because of the proposed changes to PRs and could make those updates when they next make a separate change to a SoR. However, the FCA would expect Enhanced and dual-regulated firms to make the necessary changes to SoRs and MRMs at commencement. This unhelpfully contrasts with the PRA’s position that it would not require firms to submit updated SoRs solely because they are updated or amended as a result of implementing these reforms. Dual-regulated firms should work on the basis that they will need to submit updated SoRs at commencement, unless a particular SoR only has changes to PRA PRs.
Building on their Phase 1 SMCR changes, the regulators plan to further reduce the frequency with which firms must submit SoRs and MRMs. They propose that firms would no longer need to submit SoRs and MRMs whenever they significantly change, although firms would still have to keep them up to date internally, be able to provide them on request, and maintain records of historic SoRs and MRMs. The regulators also propose to remove the requirement for firms to provide a Form J to notify of significant changes to a Senior Manager’s responsibilities. The FCA proposes a six year retention period for SoRs and MRMs for most firms. The PRA proposes a 10 year retention period for dual regulated firms, which the FCA would also require from the same firms, for consistency.
Both regulators also intend to clarify that an MRM submitted as part of an SMF application should show the firm’s intended governance arrangements following the appointment, not its current governance arrangements (if different).
Now that legislative changes will allow the regulators to determine what certification regime should be in place, the FCA and PRA are proposing to remove all of the certification requirements from their rules, including the requirement to assess fitness and propriety on appointment and annually thereafter, to issue certificates, and to request and provide regulatory references for relevant individuals. The FCA also plans to retire the Directory (which lists Certified Persons) and end associated reporting and attestations. The regulators consider that creating a successor regime would impose disproportionate costs, and that other regulatory requirements (with a few enhancements) can achieve the desired outcomes. However, this approach requires consideration, and the FCA welcomes views on alternative approaches, such as retaining certain Certification Functions, or maintaining some elements of the Certification Regime.
The proposal to remove the Certification Regime entirely would not mean that firms would no longer need to think about whether individuals below Senior Manager level meet proper standards. The regulators emphasise that firms would remain responsible for ensuring individuals in relevant roles are competent, suitable, and adhere to appropriate standards of conduct.
The PRA proposes to build on the existing “competent employee” rule for banks and insurers so that they must consider the personal characteristics (including integrity and honesty) of individuals who would have previously been subject to certification. The PRA expects that this would be considered at the point of recruitment and thereafter, should there be reasonable cause to reconsider whether the requirement is being met. Similarly, the FCA intends to rely on its competent employee rules in SYSC 3.1.6R and SYSC 5.1.1R, under which firms are expected to assess an individual’s honesty and competence upon appointment and whenever there is reason to reassess their suitability.
The regulators intend to reduce the regulatory burden associated with Conduct Rule breach reporting, by focusing on breaches involving more serious misconduct for staff below Senior Manager level. They do not propose to change the content of the Conduct Rules themselves, or the scope of application. They also do not propose any changes for reporting of breaches by individuals subject to the Senior Manager Conduct Rules.
Both the PRA and the FCA intend to raise the reporting threshold for Conduct Rule breaches by staff who are only subject to the Individual Conduct Rules. Currently, Conduct Rule breaches by such individuals must be reported when this results in “disciplinary action” (defined as the issuing of a formal written warning, the suspension or dismissal of the person, and/or the reduction or recovery of any of the person’s remuneration). The regulators intend to change the “formal written warning” element to “final written warning” (following the completion of any appeals process as part of the internal investigation). The FCA also intends to narrow its definition of disciplinary action to the issuance of a final written warning or dismissal. Consequently, dual-regulated firms should note that the PRA and FCA would retain slightly different thresholds for reporting.
As at present, the regulators also differ on the frequency of reporting. The PRA would continue to require firms to submit a Form L within seven business days for any reportable breaches. However, the FCA plans to replace its annual reporting requirement with a requirement for firms to notify within 14 months of imposing disciplinary action. Firms would need to remain mindful of their obligations under Principle 11 (and Fundamental Rule 7, if applicable). There would also be consequential changes to the regulatory reference template to reflect the revised reporting threshold.
In addition, to clarify its expectations and reduce the burden on firms, the FCA is proposing new guidance that firms are not expected to determine whether misconduct amounts to a breach of COCON unless it results in disciplinary action that would be reportable to the regulator.
The FCA intends to replace the requirement to train staff on the Conduct Rules with an obligation to notify staff of the applicable Conduct Rules and consequences of a breach. The FCA indicates that firms could choose the most appropriate way to comply with the revised rule. For example, they could integrate information on Conduct Rules requirements into wider induction or compliance materials, or into broader internal frameworks relating to staff conduct.
After updating certain financial thresholds to account for inflation as part of the Phase 1 reforms, the FCA now plans to significantly increase some of the thresholds for becoming an Enhanced Firm (some by around 50%), as follows:
|
Type of firm |
Current threshold |
Proposed threshold |
|
Consumer credit lenders |
£130 million revenue |
£200 million revenue |
|
Asset managers |
£65 billion AUM |
£100 billion AUM |
|
Intermediaries |
£45 million revenue |
£75 million revenue |
|
Wholesale markets |
Significant SYSC |
£750 million assets |
|
Mortgage lenders |
10,000 mortgages outstanding |
10,000 mortgages outstanding |
|
CASS firm |
CASS large |
CASS large |
It considers that this will help with proportionality by targeting only the largest or most significant firms.
Both regulators intend to remove references to certain forms from their rulebooks, to allow them to update forms more easily without also requiring rulebook changes.
The regulators do not plan to introduce new questions, require additional supporting documents, or expand the scope of information that firms must provide. Both intend to reduce the material that needs to be submitted alongside an SMF application, such as removing the requirements to submit a summary of the handover material at the point of application, submit a separate organisational chart (PRA), and include MiFID annexes (FCA).
The PRA is also planning to remove the requirement to submit a Form M notification for notified NEDs, although firms would still need to ensure that these individuals are fit and proper. The PRA proposes to rename them “Conduct Rule NEDs”, to avoid confusion with the new category of notified SMFs.
More generally, the regulators are also seeking to update and clarify language and terminology throughout their rules and guidance where they consider this helpful.
The regulators request responses to their consultations by 22 January 2027. They plan to publish Policy Statements containing their final rules in the first half of 2027, and propose to implement the changes about six months later in H2 2027. They intend to include some transitional arrangements, for example to enable firms to submit notifications for SMFs that are due to become notified functions up to one month ahead of the implementation date.
Given the proposed removal of the Certification Regime, the SMCR is likely to be renamed. The regulators have not suggested a new title at this stage, although the FCA consultation uses “Senior Managers and Conduct Rules Regime” as a temporary placeholder.
Taken together, the Phase 2 proposals go considerably further than many in the industry may have anticipated, particularly given the proposal to remove the Certification Regime entirely. These changes would represent the most substantial overhaul of the regime since its introduction and should make a significant difference to the time and cost involved in complying with the SMCR, particularly for larger firms with substantial certified populations.
However, the reforms will bring their own complications. Firms appointing notified SMFs would bear full responsibility for the fit and proper assessment without the comfort of regulatory scrutiny, and the regulators have clarified that they may reintroduce pre-approval if firms fall short. The removal of the Certification Regime would not remove the need to assess the suitability of staff below Senior Manager level, and firms will need to decide how far to retain, adapt, or dismantle their existing certification processes to comply with the competent employee rules. Dual-regulated firms in particular would continue to face divergent FCA and PRA approaches in several areas, including SMF7, the application of the 12-week rule, and Conduct Rule breach reporting thresholds and timing.
Although the rules are not yet final, firms should start considering now how they would implement the changes. In particular, firms may wish to:
|
Area of change |
Banks |
Insurers |
Enhanced Firms |
Core Firms |
Limited Scope Firms |
|
Some SMFs to become notification-only |
X |
X |
X |
|
|
|
Removal of some SMFs |
X |
X |
X |
|
|
|
Removal of certain PRs |
X |
X |
X |
X |
|
|
Ability to apply for conditional or time-limited approvals |
X |
X |
X |
Only if in a |
Only if in a |
|
Removal of Certification Regime |
X |
X |
X |
X |
X |
|
Changes to Conduct Rule breach reporting |
X |
X |
X |
X |
X |
This table lists the SMFs that will require notification or pre-approval following the proposed Phase 2 changes. Note that these lists include all PRA and FCA SMFs; not all of these SMFs will be relevant to any particular firm.
|
Proposed notified SMFs |
Proposed pre-approved SMFs |
|
SMF5 Head of Internal Audit |
SMF1 Chief Executive Function |
|
SMF6 Head of Key Business Area |
SMF2 Chief Finance Function |
|
SMF7a Notified Group Entity Senior Manager |
SMF3 Executive Director Function |
|
SMF8 Credit Union Manager |
SMF4 Chief Risk Function |
|
SMF10 Chair of the Risk Committee |
SMF7 Approved Group Entity Senior Manager |
|
SMF11 Chair of the Audit Committee |
SMF9 Chair of the Governing Body |
|
SMF12 Chair of the Remuneration Committee |
SMF16 Compliance Oversight Function |
|
SMF13 Chair of the Nomination Committee |
SMF17 Money Laundering Reporting Officer Function |
|
SMF14 Senior Independent Director (SID) |
SMF19 Head of Overseas Branch |
|
SMF15 Chair of the With‑Profits Committee |
SMF21 EEA Branch Senior Manager Function |
|
SMF20 Chief Actuary |
SMF23 Chief Underwriting Officer |
|
SMF20a With-Profits Actuary |
SMF23a Underwriting Risk Oversight (Lloyd’s) |
|
|
SMF23b Conduct Risk Oversight (Lloyd’s) |
|
|
SMF24 Chief Operating Officer |
|
|
SMF25 Small Insurer Function |
|
|
SMF26 Head of Small Run Off Firm |
|
|
SMF27 Partner Function |
|
SMF29 Limited Scope Function |
FCA — Proposed list of PRs following the Phase 2 changes:
|
Core Firms |
Enhanced Firms |
|
Responsibility for the firm’s performance of its obligations under the Senior Managers Regime |
Responsibility for the firm’s performance of its obligations under the Senior Managers Regime |
|
Responsibility for the firm’s policies and procedures for countering the risk that the firm might be used to further financial crime |
Responsibility for the firm’s policies and procedures for countering the risk that the firm might be used to further financial crime |
|
Responsibility for the firm’s compliance with CASS |
Responsibility for the firm’s compliance with CASS |
|
|
Responsibility for taking reasonable steps to ensure that every person involved in the performance of the firm’s internal audit function is independent from the persons who perform external audit, including: (a) supervision and management of the work of outsourced internal auditors; and (b) management of potential conflicts of interest between the provision of external audit and internal audit services. |
PRA — Proposed list of PRs following the Phase 2 changes:
|
Banks |
Insurers |
|
Responsibility for the firm’s performance of its obligations under the Senior Management Regime (including the vetting of candidates to perform senior management functions) |
Responsibility for the firm’s performance of its obligations under the Senior Management Regime (including the vetting of candidates to perform senior management functions) |
|
Responsibility for the firm’s performance of its obligations under Fitness and Propriety inrespect of Conduct Rules non-executive directors |
Responsibility for ensuring that the firm has complied with its obligations in Insurance -Fitness and Propriety to: (a) ensure that every person who performs a key function but does not also perform a PRA senior management function is a fit and proper person; and (b) provide and obtain regulatory references |
|
Responsibility for overseeing the adoption of the firm’s culture in the day-to-day management of the firm |
Responsibility for leading the development of the firm’s culture by the governing body as a whole |
|
Responsibility for managing the allocation and maintenance of the firm’s capital, funding and liquidity |
Responsibility for overseeing the adoption of the firm’s culture in the day-to-day management of the firm |
|
Responsibility for the firm’s treasury management functions |
Responsibility for the production and integrity of the firm’s financial information and its regulatory reporting |
|
Responsibility for the production and integrity of the firm’s financial information and its regulatory reporting under the regulatory system |
Responsibility for management of the allocation and maintenance of the firm’s: (a) capital; and (b) liquidity |
|
Responsibility for developing and maintaining the firm’s recovery plan, resolution pack and, where relevant, resolution assessment, and for overseeing the internal processes regarding their governance |
Responsibility for performance of the firm’s ORSA |
|
Responsibility for managing the firm’s internal stress-tests and ensuring the accuracy and timeliness of information provided to the PRA and other regulatory bodies for the purposes of stress-testing |
Responsibility for oversight of the independence, autonomy and effectiveness of the firm’s policies and procedures on whistleblowing including the procedures for protection of staff who raise concerns from detrimental treatment |
|
Responsibility for leading the development of the firm’s culture by the governing body as a whole |
Responsibility for overseeing the development and implementation of the firm’s remuneration policies and practices |
|
Responsibility for safeguarding the independence of, and overseeing the performance of, the internal audit function, including the performance of a person approved to perform the Head of Internal Audit function on behalf of the firm, in accordance with Compliance and Internal Audit 3 |
Responsibility for the firm’s performance of its obligations in respect of outsourced operational functions and activities under Conditions Governing Business 7 |
|
Responsibility for safeguarding the independence of, and overseeing the performance of, the compliance function, including the performance of a person approved by the FCA to perform the compliance oversight function on behalf of the firm, in accordance with Compliance and Internal Audit 2 |
|
|
Responsibility for safeguarding the independence of, and overseeing of the performance of, the risk function, including the performance of a person approved to perform the Chief Risk function on behalf of the firm, in accordance with Risk Control 3.4 and 3.5 |
|
|
Responsibility for overseeing the development of, and implementation of the firm’s remuneration policies and practices in accordance with Remuneration |
|
|
Responsibility for the independence, autonomy and effectiveness of the firm’s policies and procedures on whistleblowing, including the procedures for protection of staff who raise concerns from detrimental treatment |
|
|
Responsibility for the firm’s performance of its obligations under Outsourcing |
|