SMF2 Chief Finance Function: Who Needs It, Accountability and CP26/37

The Chief Finance function (SMF2) is the Senior Management Function held by the person who manages a firm's financial resources and reports to the board on its financial affairs. Among FCA solo-regulated firms it applies only to Enhanced firms. At banks, building societies, PRA-designated investment firms and insurers it is a PRA function that the firm must fill. SMF2 needs regulatory approval today, and under the FCA's CP26/37 and the PRA's CP14/26 it would stay approved, not notified.

What SMF2 covers

The FCA's SM&CR guide for solo-regulated firms describes SMF2 as the person responsible for managing the financial resources of the firm, including reporting to the governing body (the board) on the firm's financial affairs. The FCA function sits in SUP 10C, the Handbook chapter that lists every senior management function. For banks, the PRA's definition is in Senior Management Functions 3.3: responsibility for management of the financial resources of a firm and reporting directly to the governing body on its financial affairs. Insurers use almost the same words in Insurance: Senior Management Functions 3.2.

The job title does not decide the function. The holder is usually called Chief Financial Officer, Finance Director or Group Finance Director. What matters is that they run the finance function and answer to the board for it. A financial controller who reports to the CFO does not hold SMF2.

Example: a consumer credit lender whose regulated lending revenue averages £130m or more a year over three years is an Enhanced firm. Its Finance Director, who manages capital and liquidity and presents the accounts to the board, must be approved as SMF2 before taking up the role.

This guide is part of our Senior Management Functions guide.

Which firms need an SMF2

A firm's tier is set by the thresholds on the FCA's categorisation page, which rose by about 30% on 10 July 2026. They include £65bn of assets under management, £130m of consumer credit lending revenue and £45m of intermediary revenue, each as a three-year average, plus CASS large firms and some significant SYSC firms. At dual-regulated firms (supervised by both the PRA and the FCA) the PRA approves the SMF2 and the FCA gives its consent.

What the SMF2 holder is personally accountable for

Every SMF2 has a Statement of Responsibilities, the document the regulator holds that lists what this person answers for. For a CFO it normally covers the finance function, financial and regulatory reporting, capital and liquidity, and often treasury and tax. Our article on statements of responsibilities covers the drafting standard.

Prescribed responsibilities, the specific duties the rules say must be given to a named Senior Manager, often sit with SMF2:

• At Enhanced firms, the FCA's guidance in SYSC 24 names SMF2 or SMF4 as the most likely holder of PR (s): internal stress tests and the accuracy of stress-testing information given to the FCA.
• At banks, the PRA's prescribed responsibilities include PR O (capital, funding and liquidity), PR P (treasury management) and PR Q (financial information and regulatory reporting). Insurers have PR O for capital and liquidity and PR Q for financial information and regulatory reporting.
• At small CRR firms, meaning banks with gross assets of £250m or less, the small firm responsibility PR CC, managing the firm's financial resources, is the natural fit.
• PR Z, compliance with the client assets rules (CASS), can be given to the CFO where the firm holds client money or assets.

The Senior Manager Conduct Rules in COCON apply to every SMF2:

• SC1: take reasonable steps to ensure the business you are responsible for is controlled effectively.
• SC2: take reasonable steps to ensure that business complies with the relevant requirements and standards of the regulatory system.
• SC3: take reasonable steps to ensure any delegation is to an appropriate person and that you oversee it effectively.
• SC4: disclose appropriately any information the FCA or PRA would reasonably expect notice of.

The Individual Conduct Rules apply as well: act with integrity, act with due care, skill and diligence, be open and cooperative with the regulators, treat customers fairly, observe proper standards of market conduct and, for retail business, act to deliver good outcomes for retail customers. Since 1 September 2026 the non-financial misconduct rules also apply.

The Duty of Responsibility, in section 66A of FSMA for the FCA and section 66B for the PRA, means that if the firm breaches a requirement in an area the SMF2 is responsible for, the regulator can act against the SMF2 personally unless they took the steps a person in their position could reasonably be expected to take. The regulator has to prove this. In everyday terms: if a regulatory return is wrong or capital falls short, the CFO must be able to show what they did to prevent it.

Reasonable steps in practice

Our guide to Senior Manager reasonable steps explains how to build this record across a whole year.

The first 90 days in the role

• Read your Statement of Responsibilities line by line and agree any changes with the holder of PR A (the firm's SM&CR obligations) before you accept it.
• Obtain a written handover from your predecessor. Enhanced firms must maintain handover procedures.
• Review the last four quarters of regulatory returns and any errors reported to the regulator.
• Meet the external auditor, the chair of the audit committee and the Chief Risk Officer.
• Test capital and liquidity headroom against appetite and check the early warning indicators work.
• Map who in the finance team does what, and how you oversee each delegated task.
• Agree the management information you will take to the board each quarter.

Applying for approval

The firm applies for approval before the person starts, using Form A through Connect, the FCA's online system. At a dual-regulated firm the PRA leads and the FCA consents. Before applying, the firm must satisfy itself that the candidate is fit and proper under FIT: honest, competent and capable, and financially sound. The FCA's preparation guidance expects:

• a criminal records check, which since 24 April 2026 stays valid for six months and is not needed for internal or intragroup moves
• regulatory references from every employer in the last six years
• evidence of competence, such as an accounting qualification and experience of the firm's prudential rules, with a plan for any gaps
• disclosure of directorships in the last ten years and of anything that may affect fitness
• confirmation that the candidate has enough time for the role, and a Statement of Responsibilities

The FCA must decide within three months of receiving a complete application. It has also committed to a two-month standard ahead of a planned change to the law. Either regulator may interview the candidate, and if both do, the interview is joint. Our guide to fitness and propriety covers the assessment itself.

The person must not perform the role before approval, except under the temporary cover rule. Where an SMF2 is absent or leaves unexpectedly, someone can cover for up to 12 weeks. For FCA functions, since PS26/6 the firm must submit (not obtain) the application within those 12 weeks, and the person can then continue until the FCA decides. The PRA's rule for its functions works the same way for reasonably unforeseen absences, provided a valid and complete application is made within the period.

What CP26/37 would change for SMF2

CP26/37 does not make SMF2 a notified role. The FCA keeps it approved, and the PRA lists it as pre-approved in CP14/26. What would change around it:

• Group CFOs: SMF7 at solo-regulated firms would cover only people with significant influence who also perform a listed group function, and the Chief Finance function is on that list. The FCA's own example is that a group CFO without significant influence over the firm would fall outside SMF7.
• Prescribed responsibilities: the FCA would keep only A, D and Z, plus J-3 at Enhanced firms, so PR (s) on stress testing would go. The duty itself remains. The PRA's proposed removals cover certification, allocation, training, management responsibilities maps and the business model, not PR O, P or Q.
• Statements of Responsibilities: no routine resubmission on each change. The firm keeps the statement current, keeps superseded versions for six years and provides it on request. A statement still goes with each application.
• Temporary cover: 18 weeks instead of 12. At Enhanced firms a "reasonable use" test would replace "reasonably unforeseen". At banks and insurers the PRA keeps "reasonably unforeseen" for its functions.
• Conditional and time-limited approvals: possible at dual-regulated firms, solo firms in dual-regulated groups and Enhanced firms.
• Tier thresholds: up about 50% for consumer credit lenders (to £200m), asset managers (to £100bn) and intermediaries (to £75m). A firm that drops to Core no longer has an SMF2 role, so its finance director's approval would need review.

Responses close on 22 January 2027, with final rules expected in the first half of 2027 and changes in force around six months later, subject to the Financial Services and Markets Bill. Our CP26/37 guide covers the full package.

Holding SMF2 with other functions

• SMF2 and SMF24 Chief Operations: common in mid-sized firms. The regulator will test whether one person has the time and expertise for both, so the Statement of Responsibilities must show how operations are overseen.
• SMF2 and SMF4: at banks, the PRA's Risk Control rules require the head of risk to be an independent senior manager. Another senior person may do it only where the firm's size and complexity do not justify a dedicated appointment and there is no conflict of interest. A CFO assessing the risk in their own capital plan is the obvious conflict.
• SMF2 and SMF3 at a dual-regulated firm: where the PRA approves the SMF2 and the firm tells the PRA the person will also act as an executive director, the FCA function is absorbed into the PRA approval under SUP 10C.9, so no separate FCA approval is needed.
• SMF2 and SMF7: a group CFO may hold SMF2 at the main firm and SMF7 for a subsidiary where they have significant influence there.

How we support SMF2 holders

We work with incoming and serving CFOs on the regulatory side of the role, so that what they answer for is clear, current and evidenced. Our SM&CR support covers:

• one-to-one Senior Manager training built on the person's own Statement of Responsibilities
• drafting and review of the Statement of Responsibilities
• the Form A application and the fitness and propriety file
• FCA and PRA interview preparation
• handover arrangements between outgoing and incoming holders