SMF16 Compliance Oversight Function: Responsibilities, Approval and CP26/37

SMF16, the Compliance Oversight function, is the Senior Management Function held by the person who runs a firm's compliance function and reports on it to the board. Every firm in the Senior Managers and Certification Regime (SM&CR) that is required by an FCA rule to have that role must have someone approved for it. It is an FCA-approved function, and the FCA's Phase 2 consultation, CP26/37, does not propose to make it notified: SMF16 would still need FCA approval before the person starts.

What SMF16 covers

The definition sits in SUP 10C.6.1R. SMF16 is the function of acting as the person allocated the compliance function under one of a set of listed rules. These include SYSC 6.1.3-CR (the compliance officer of a common platform firm, broadly a MiFID investment firm, restated from article 22(3) of the MiFID Org Regulation in PS25/13 from 23 October 2025), SYSC 6.1.4CR (debt management firms, credit repair firms and Class 1 claims management firms), SYSC 3.2.8R and, for a full-scope UK AIFM, article 61(3)(b) of the AIFMD level 2 regulation. In plain words, the FCA's solo-regulated firms guide describes the holder as "the person responsible for the compliance function in the firm and reporting to the governing body on this".

SMF16 is a "required function". It applies because a Handbook rule requires the firm to have a compliance officer, not because the firm has someone with a compliance title. The FCA's guide is clear that the SM&CR does not make a firm hire into a required function the Handbook does not already require.

Typical job titles are Chief Compliance Officer, Head of Compliance, Compliance Director and, in smaller firms, Compliance Officer. The FCA notes that SMF16 is often held by someone who is not a board member. Example: a 40-person discretionary wealth manager appoints its Head of Compliance as SMF16. She owns the compliance monitoring plan, signs off the annual compliance report to the board and sits on the risk committee, but is not a director.

Which firms need an SMF16

The firm categories come from SUP 10C Annex 1 and SYSC 23 Annex 1. The FCA's Senior Managers Regime page confirms that SMF16 is one of the functions the FCA approves on its own at dual-regulated firms. Our Senior Management Functions guide sets out how every function maps to each tier.

What the SMF16 holder is personally accountable for

Statement of Responsibilities. A Statement of Responsibilities is the document the FCA holds that lists what this person answers for. For SMF16 it should name the compliance function, the compliance monitoring plan, regulatory change, advice to the business and reporting to the board. Vague wording such as "compliance matters" invites challenge. Our guide to Statements of Responsibilities and management responsibilities maps explains the drafting standard.

Prescribed responsibilities. Prescribed responsibilities are fixed duties listed in SYSC 24 that must each be given to a named senior manager. At Core firms the CASS responsibility (z) is often given to SMF16, though it does not have to be. The financial crime responsibility (d) should sit with the most senior person accountable for financial crime policy. In PS18/14 the FCA said that where an executive director owns financial crime policy, responsibility (d) should go to that director and should not be shared with SMF16. At Enhanced firms, responsibility (k), safeguarding the independence and overseeing the performance of the compliance function, is one the FCA expects normally to go to a non-executive director, not to SMF16.

Conduct Rules. As a Senior Manager, the SMF16 holder is bound by the six Individual Conduct Rules and the four Senior Manager Conduct Rules in COCON:

• SC1: take reasonable steps to ensure the business for which you are responsible is controlled effectively
• SC2: take reasonable steps to ensure that business complies with the regulatory system
• SC3: take reasonable steps to ensure any delegation is to an appropriate person and is overseen effectively
• SC4: disclose appropriately any information of which the FCA or PRA would reasonably expect notice

SC2 bites hardest on SMF16. SC4 means the holder must be willing to tell the FCA about significant issues, even when colleagues would prefer to wait.

Duty of Responsibility. Under section 66A of FSMA the FCA can take action against a senior manager if the firm breaches a requirement in an area they were responsible for and they did not take the steps a person in their position could reasonably be expected to take. In everyday terms: if something goes wrong in your area, you must be able to show what you did about it.

Reasonable steps in practice

For a compliance officer, reasonable steps are mostly about evidence that oversight was planned, risk-based, acted on and reported. For a MiFID investment firm, SYSC 6.1.3-AR and 6.1.3-BR require a compliance function that monitors on a permanent basis, runs a risk-based monitoring programme built on a compliance risk assessment, and reports to the management body at least annually. SYSC 6.1.3-CR requires the function to have the authority, resources, expertise and access it needs, and to report directly to the management body when it detects a significant risk of failure.

Our article on how senior managers evidence reasonable steps sets out the wider standard, and our guide to building a compliance monitoring programme covers the plan itself.

The first 90 days in the role

• Read two years of board minutes, compliance and internal audit reports, and FCA correspondence.
• Agree your Statement of Responsibilities line by line before it is filed, and check it matches what you will actually control.
• Re-run the compliance risk assessment and rebuild the monitoring plan around it, rather than inheriting last year's plan unchanged.
• Test the open findings log. Close what is evidenced, re-date what is not, and escalate what is overdue.
• Confirm your reporting line, budget and right of direct access to the board chair in writing.
• Map who holds the prescribed responsibilities and where your role meets the MLRO, risk and finance.
• Set a reporting calendar for monthly management information, quarterly board papers and the annual report.
• Keep a short file note of what you found on day one and what you have done since.

Applying for approval

The firm applies on Form A through the FCA's Connect system. The FCA's application page explains that Form A includes the candidate's details, a role description, ten years of employment history, the Statement of Responsibilities, a competency assessment, a capacity and conflicts assessment, fitness and propriety questions, directorships and confirmation of regulatory reference and criminal record checks. A longer version of the form applies where the candidate has not held a controlled function before, or not for six months or more. A standalone long Form A carries a fee.

• Fitness and propriety. Under section 60A of FSMA the firm must be satisfied the candidate is fit and proper before it applies. The FIT sourcebook covers honesty, integrity and reputation; competence and capability; and financial soundness. Our fitness and propriety guide explains the checks.
• Regulatory references. References cover the previous six years. Since PS26/6, firms must give a requested reference within four weeks.
• Criminal records check. Since 24 April 2026 a check stays valid for six months and is not needed for an internal or intragroup move.
• Competence. Expect a skills gap analysis and a learning and development plan. The FCA says it may apply lower scrutiny to a first-time candidate at a smaller firm where the firm explains how it will support them.
• Interview. The FCA says it is likely to invite SMF16 candidates at large listed firms for interview, and may interview any candidate where it has concerns.
• Timing. The FCA must decide within three months of receiving a complete application. It has committed to a two-month target ahead of a planned change in the law.
• Starting early. Performing SMF16 without approval is a breach by the firm under section 59 of FSMA and can lead to a penalty on the individual under section 63A. The exception is temporary cover: under the PS26/6 rules, someone may cover an unexpected vacancy for up to 12 weeks, and if the firm submits an application in that time the person may continue until the FCA decides.

What CP26/37 would change for SMF16

CP26/37 does not change the SMF16 role itself. The FCA says it is not proposing changes to SMF roles at Core and Limited Scope firms, and SMF16 is not on the list of functions that would become notified at dual-regulated and Enhanced firms. SMF16 would remain FCA-approved. The changes around the role are:

• Prescribed responsibilities. Only A (the Senior Managers Regime), D (financial crime) and Z (CASS) would remain for Core and Enhanced firms, plus J-3 for Enhanced firms. Responsibility (k) for compliance independence would go, though the underlying SYSC duties would stay.
• Statements of Responsibilities. Revised versions would no longer be filed. The firm keeps them current, keeps old versions for six years and provides them on request. A firm where one individual performs every SMF would need none; the FCA's own example is one person holding SMF3, SMF16 and SMF17.
• Temporary cover. The period to submit an application would rise from 12 to 18 weeks, with a "reasonable use" test replacing "reasonably unforeseen" for FCA functions.
• Decision period. The statutory deadline for deciding SMF applications is planned to fall from three months to two.
• Certification and the Directory. These would be removed. Compliance teams would be assessed under the competent employee rules instead, and the Directory would close.
• Conduct Rules. Unchanged, but the training duty would become a duty to notify staff of the rules. SMF16 typically designs that notice.

Consultation closes on 22 January 2027. Final rules are expected in the first half of 2027 and would take effect around six months later, subject to the Financial Services and Markets Bill. Our SM&CR Phase 2 guide covers the full package.

Holding SMF16 with other functions

The FCA's guide confirms that one person can hold several SMFs, with one Form A covering all of them and one Statement of Responsibilities describing every responsibility.

• SMF16 with SMF17. The most common pairing in small and mid-sized firms. It works where one person has the capacity for both and the financial crime workload is proportionate. Our SMF17 Money Laundering Reporting Officer guide covers the second role.
• SMF16 with SMF3. A compliance officer who is also an executive director gains board standing but must keep a clear line between oversight and running the business.
• SMF16 with SMF1 or business roles. For a MiFID investment firm, SYSC 6.1.3-CR(4) says people in the compliance function must not be involved in the services they monitor. SYSC 6.1.5AR allows an exception only where the firm can show the requirement is not proportionate and the function stays effective. Combining compliance with running the business is hard to defend outside the smallest firms.
• Capacity. The FCA's Form A asks for a capacity and conflicts assessment. A compliance officer holding the role at several group firms should show the time each one receives.

How we support SMF16 holders

We work with compliance officers and the firms appointing them, from the first draft of the Statement of Responsibilities to the first annual compliance report. Our work is built around the person's actual responsibilities, not a generic course.

• One-to-one Senior Manager training built on the person's own Statement of Responsibilities
• Drafting and review of the Statement of Responsibilities
• The Form A application and the fitness and propriety file
• FCA interview preparation
• Handover arrangements between outgoing and incoming SMF16 holders

Our SM&CR support team also maps how SMF16 fits with the firm's other senior roles, including the SMF1 Chief Executive and SMF3 Executive Director functions.