SM&CR Phase 2 (CP26/37): The End of the Certification Regime and What Changes in 2027

On 22 October 2026 the FCA published CP26/37, the second phase of its review of the Senior Managers and Certification Regime (SM&CR), and the PRA published CP14/26 alongside it. Together they propose to remove the Certification Regime, retire the FCA Directory, let firms notify rather than seek approval for some senior roles, and end routine filing of statements of responsibilities. Both consultations close on 22 January 2027. Final rules are expected in the first half of 2027 and would take effect around six months later, in the second half of 2027, subject to Parliament passing the Financial Services and Markets Bill.

What CP26/37 proposes

The SM&CR is the UK's individual accountability regime. Senior managers, the people approved to run key parts of a firm, are personally accountable for their areas, and almost everyone working in a firm must follow the Conduct Rules. Phase 1 of the review came through PS26/6 in April 2026, with most changes in force from 24 April 2026, and worked within the existing law. Phase 2 relies on the Financial Services and Markets Bill, introduced in May 2026, which removes many SM&CR requirements from legislation and leaves the regulators to decide how they apply.

The main proposals in CP26/37 are to:

• remove the Certification Regime and retire the Directory of certified and assessed persons
• make some senior manager functions (SMFs) notified rather than approved, and remove SMF18 and SMF22
• allow 18 weeks instead of 12 for temporary cover of a senior role
• stop routine filing of responsibilities documents and cut the prescribed responsibilities to four
• simplify Conduct Rules training and breach reporting, and raise the Enhanced tier thresholds

The FCA estimates its proposals would cut annual SM&CR compliance costs of £434.5m by £229.0m, around 53%, with £133.0m of that from removing certification, against one-off transition costs of £61.7m. Its draft rules use "Senior Managers and Conduct Rules Regime" as a placeholder name for what remains.

The proposals apply to every firm already in the SM&CR, including third-country branches, and to firms due to join it, such as cryptoasset firms. E-money firms are not currently subject to the SM&CR, as PS26/13 notes.

The end of the Certification Regime and the Directory

The Certification Regime covers staff below senior manager level who perform one of eight certification functions. For each of them a firm must currently assess fitness and propriety (whether the person is honest and competent for the role) on hiring, reassess and certify them every year, obtain regulatory references from previous employers, and report them to the FCA Directory. The FCA says firms track around 139,000 people performing about 261,000 certification functions.

The FCA proposes to remove the regime completely. Firms would rely instead on the competent employee rules in SYSC 3.1.6R and SYSC 5.1.1R, which require firms to employ staff with the skills, knowledge and expertise for their responsibilities. Under the related guidance a firm assesses honesty and competence on appointment and whenever there is reason to reassess, not on a fixed annual cycle. The FCA would extend that guidance to insurers, managing agents and the Society of Lloyd's.

Two linked requirements would also go:

• Regulatory references would no longer be required for people who were previously certified, though they stay for every SMF candidate, approved or notified.
• The Directory would be retired, ending Directory reporting and the annual attestation. The FCA points users to the FCA Register and its Firm Checker instead.

The PRA proposes to stop fitness and propriety assessment on appointment and annually for about 7,700 people in its Certification Regime, with a lighter ongoing requirement for CRR and Solvency II firms (broadly, banks and insurers) to ensure those people stay competent and have appropriate personal characteristics. Our guide to SM&CR fitness and propriety and the Certification Regime explains the rules that apply today.

Senior managers: fewer approvals, faster appointments

For dual-regulated firms (supervised by both the PRA and the FCA) and Enhanced solo-regulated firms (the largest FCA-only firms), the FCA proposes that these roles are notified rather than approved:

• SMF5 Head of Internal Audit
• SMF10 to SMF13, the chairs of the risk, audit, remuneration and nomination committees
• SMF14 Senior Independent Director
• SMF15 Chair of the With-Profits Committee

Notification is not a lower standard. The firm completes the same vetting first, including regulatory references, criminal records checks, right to work and a statement of responsibilities, and the holder of prescribed responsibility A stays responsible for that vetting. The Duty of Responsibility and the Senior Manager Conduct Rules apply in full. Firms would notify through My FCA up to three months ahead, and the appointment takes effect on acknowledgement or on the stated start date. The PRA proposes notification for almost half of current SMFs, including Chief Actuaries.

SMF18 (other overall responsibility) and SMF22 (local responsibility) would be removed and their responsibilities reallocated. SMF7 (group entity senior manager) would be narrowed to people who both exercise significant influence over the firm and perform one of seven specified group functions, which the FCA expects to cut that population by about 40%. SMF24, the Chief Operations function, stays approved. Core and Limited Scope firms keep their current SMF roles.

For all firms, temporary cover for an absent senior manager would run for 18 weeks instead of 12 before an application or notification must be made, and the FCA would replace the "reasonably unforeseen" test with a "reasonable use" standard. The PRA keeps the "reasonably unforeseen" test for its own functions. Separately, the statutory deadline for deciding SMF applications is planned to fall from three months to two.

Responsibilities documents and prescribed responsibilities

A statement of responsibilities (SoR) sets out what each senior manager is accountable for. A management responsibilities map (MRM) shows how responsibilities fit together across the firm, and applies only to dual-regulated and Enhanced firms. Phase 2 proposes:

• No routine filing of revised SoRs, which removes Form J. Firms keep SoRs up to date internally, retain superseded versions for six years (ten for some dual-regulated firms) and provide them on request.
• An SoR is still submitted with each SMF application or notification.
• No SoR at all where one person performs every SMF role, which the FCA says benefits about 18,800 firms.
• MRMs follow the same approach: no routine filing, and none needed in single-SMF firms.
• Nine prescribed responsibilities removed. Core and Enhanced firms keep A (the Senior Managers Regime), D (financial crime) and Z (client assets), and Enhanced firms also keep J-3 (oversight of outsourced internal audit).

Removing a prescribed responsibility does not remove the underlying duty. Core firms would not need to update SoRs solely because of the prescribed responsibility changes. Enhanced and dual-regulated firms would update SoRs and MRMs at commencement, because removing SMF18 and SMF22 moves responsibilities between people. Our article on statements of responsibilities and management responsibilities maps covers the drafting standards, which still apply.

Conduct Rules: same standards, lighter process

The Conduct Rules cover around 900,000 people and the FCA is not changing the rules themselves. It proposes to change how firms support and report them:

• Training: the duty to take all reasonable steps to ensure staff understand the rules would become a duty to notify staff of the rules that apply to them and the consequences of breach.
• Most staff: only disciplinary action ending in a final written warning or dismissal would be reportable, with the final outcome reported within 14 months instead of through the annual return.
• Non-SMF staff under the Senior Manager Conduct Rules, such as non-executive directors: all breaches reported within seven business days.
• SMFs: no change to breach reporting.
• Sole traders would come within the Conduct Rules for the first time.

Before and after: what changes and what stays

What stays:

• the Conduct Rules, and the Duty of Responsibility, under which senior managers must show the reasonable steps they take in their areas
• approval for the most senior executive roles, such as chief executive, compliance oversight and money laundering reporting officer
• the firm's own fitness and propriety assessment of every senior manager, approved or notified
• regulatory references for SMF candidates
• competence and qualification rules, including the annual Statement of Professional Standing for retail investment advisers
• Principle 11 and SUP 15 notifications of significant matters

Key dates

Cryptoasset firms: build today's regime into the application

In PS26/13 the FCA confirmed that the SM&CR will apply in full to authorised cryptoasset firms. Because certification may soon change, it will use a "modification by consent" waiver, which defers assessment of Certification Regime compliance during the gateway until the Phase 2 outcome is settled.

For an application due by 28 February 2027:

• Map the SMF roles the firm needs under today's rules, with a full SoR for each candidate. Phase 2 does not change SMF roles for Core firms, and the FCA does not expect many, if any, firms conducting only cryptoasset activities to be Enhanced when the regime starts.
• Allocate every prescribed responsibility that applies today. A, D and, for custodians, Z survive Phase 2, so give those to the people who will hold them long term.
• Keep mind and management in the UK. The FCA expects SMF16 (compliance oversight) and SMF17 (money laundering reporting officer) holders to work from the firm's UK principal place of business.
• Check the Enhanced thresholds: £100bn in safe custody assets and client cryptoassets combined for safeguarding firms, and £20bn in backing assets, on a three-year rolling average, for UK qualifying stablecoin issuers.
• Base staff competence checks on the competent employee rules, which apply whether or not certification survives.

The FCA is also consulting on cryptoasset perimeter guidance in CP26/36 until 18 November 2026. Our UK cryptoasset authorisation page sets out the full application.

What firms should do now

Nothing changes until the new rules commence. The FCA says it will not take any step to repeal the Certification Regime before reaching a final policy position.

• Keep certifying. Annual certifications that fall due before commencement must still be completed, and Directory data must stay accurate.
• Plan the replacement. List each certification function and decide how hiring checks, reassessment triggers and records will work under SYSC 3.1.6R and SYSC 5.1.1R.
• Review senior roles. Dual-regulated and Enhanced firms should identify SMF18 and SMF22 holders, decide where their responsibilities will sit, test each SMF7 against the narrower definition and draft the SoRs and MRMs needed at commencement.
• Check your tier. A firm near the current Enhanced threshold may become a Core firm.
• Prepare for notification. Firms take the fitness and propriety decision for notified roles, so the vetting process owned by the holder of prescribed responsibility A should be documented and evidenced.
• Plan the Conduct Rules changes. Draft the staff notice and the new breach reporting process, but keep current training and reporting until the rules change.
• Use the transition window. Applications for roles that become notified can be made until commencement, and notifications for later start dates from one month before.

Our SM&CR team maps the changes for each firm and builds the transition plan. Investment firms can also read our guide to SM&CR for investment firms.

Responding to the consultation

CP26/37 asks 27 questions. Responses go through the FCA's online response form by 22 January 2027, and the PRA takes responses to CP14/26 by email by the same date. Dual-regulated firms should respond to both.

Question 18 deserves particular attention. It asks which parts of certification, regulatory references or the Directory to keep if the FCA does not remove everything. The FCA accepts that removal carries some risk and does not intend to consult again if it keeps or amends them, so evidence submitted now carries weight. Question 26 asks whether implementation in the second half of 2027 allows enough time.