SMF24 Chief Operations Function: Resilience, Accountability and CP26/37

The Chief Operations function (SMF24) is the Senior Management Function held by the most senior person responsible for a firm's internal operations and technology. Among FCA solo-regulated firms it applies only to Enhanced firms, and at banks, building societies, PRA-designated investment firms and insurers it is a PRA function. SMF24 needs regulatory approval today. In CP26/37 the FCA, with the PRA, decided to keep it approved because of operational risk from frontier AI systems and cyber threats, with a review two years after the reforms take effect.

What SMF24 covers

The FCA's SM&CR guide for solo-regulated firms describes SMF24 as the most senior person responsible for managing the internal operations (including human resources), systems and technology of a firm. The function and its guidance sit in SUP 10C.6B. The PRA's definition, in Senior Management Functions 3.8 for banks and Insurance: Senior Management Functions 3.7 for insurers, is responsibility for the internal operations and technology of a firm.

The holder is usually the Chief Operating Officer, but can be a Chief Information Officer, Chief Technology Officer or Chief Administrative Officer. The SUP 10C.6B guidance includes an example of a firm that splits operations by function, giving human resources, business continuity, procurement and outsourcing, and buildings to separate equally senior people, while one Chief Information and Technology Officer holds all of technology. In that example the technology officer performs SMF24 and the others do not.

Example: an insurance intermediary with £45m or more of regulated revenue a year, averaged over three years, is an Enhanced firm. Its COO, who runs the broking platform, the outsourced claims administrator and the operations team, must be approved as SMF24 before taking up the role.

This guide is part of our Senior Management Functions guide.

Which firms need an SMF24

A firm's tier is set by the thresholds on the FCA's categorisation page, which rose by about 30% on 10 July 2026. At dual-regulated firms (supervised by both the PRA and the FCA) the PRA approves the SMF24 and the FCA gives its consent.

What the SMF24 holder is personally accountable for

Every SMF24 has a Statement of Responsibilities, the document the regulator holds that lists what this person answers for. For a COO it usually covers operations, technology, information security, outsourcing and third-party management, business continuity and, at many firms, operational resilience. Three sets of rules give that statement its weight:

• Operational resilience. SYSC 15A, introduced by PS21/3, applies to Enhanced firms, banks, building societies, designated investment firms, Solvency II insurers, payment and e-money institutions and others. Firms must identify their important business services (services whose disruption could cause intolerable harm to customers or markets), set an impact tolerance for each (the maximum disruption they can bear), map the people, processes, technology and third parties behind them, and test against severe but plausible scenarios. Firms had to remain within tolerance by 31 March 2025. The board must approve and regularly review the self-assessment, which is kept for six years.
• Incident and third-party reporting. Under PS26/2, from 18 March 2027 firms report operational incidents through Connect. The initial report is due as soon as practicable and, the FCA expects, within 24 hours of finding that an incident meets a threshold. Payment service providers keep their four-hour deadline. Firms on enhanced reporting give a final report within 30 working days of resolution. Enhanced firms, banks, Solvency II insurers, payment and e-money institutions and others must also notify the FCA when they enter into or significantly change a material third-party arrangement, which the FCA expects before the firm commits, and submit a register of those arrangements every year.
• Outsourcing. SYSC 8 sets the outsourcing rules for FCA firms. At banks and insurers the PRA prescribed responsibility PR X, the firm's obligations on outsourcing, is a natural fit for the SMF24.

Our guides to operational resilience, incident reporting and material third-party reporting cover each regime in detail.

The Senior Manager Conduct Rules in COCON apply to every SMF24:

• SC1: take reasonable steps to ensure the business you are responsible for is controlled effectively.
• SC2: take reasonable steps to ensure that business complies with the relevant requirements and standards of the regulatory system.
• SC3: take reasonable steps to ensure any delegation is to an appropriate person and that you oversee it effectively. For a COO, delegation includes work handed to outsourced providers.
• SC4: disclose appropriately any information the FCA or PRA would reasonably expect notice of, such as a serious outage.

The Individual Conduct Rules apply as well, including the rule to act to deliver good outcomes for retail customers. The Duty of Responsibility, in section 66A of FSMA for the FCA and section 66B for the PRA, means that if the firm breaches a requirement in an area the SMF24 is responsible for, the regulator can act against the SMF24 personally unless they took the steps a person in their position could reasonably be expected to take. If a cyber attack takes an important business service past its impact tolerance, the COO must be able to show the mapping, testing and fixes that came before it.

Reasonable steps in practice

The FCA's own reason for keeping SMF24 approved, frontier AI and cyber risk, tells holders where supervisors will look first. Our guide to Senior Manager reasonable steps explains how to build the full record.

The first 90 days in the role

• Read your Statement of Responsibilities and confirm exactly which of operations, technology, security, outsourcing and resilience it gives you.
• Obtain a written handover from your predecessor. Enhanced firms must maintain handover procedures.
• Review the latest operational resilience self-assessment and the last round of scenario test results.
• Identify every material third-party arrangement and check readiness for the 18 March 2027 notification and register rules.
• Walk through the incident process and confirm who decides whether a reporting threshold is met.
• List the AI tools in use across operations and who approved each one.
• Agree with the CRO how operational risk oversight is split between you.

Applying for approval

The firm applies for approval before the person starts, using Form A through Connect, the FCA's online system. At a dual-regulated firm the PRA leads and the FCA consents. Before applying, the firm must satisfy itself that the candidate is fit and proper under FIT: honest, competent and capable, and financially sound. The FCA's preparation guidance expects:

• a criminal records check, which since 24 April 2026 stays valid for six months and is not needed for internal or intragroup moves
• regulatory references from every employer in the last six years
• evidence of competence in technology, resilience and outsourcing, with a plan for any gaps, which matters when the candidate comes from outside financial services
• disclosure of directorships in the last ten years and of anything that may affect fitness
• confirmation that the candidate has enough time for the role, and a Statement of Responsibilities

The FCA must decide within three months of receiving a complete application. It has also committed to a two-month standard ahead of a planned change to the law. Either regulator may interview the candidate, and if both do, the interview is joint. Our guide to fitness and propriety covers the assessment itself.

The person must not perform the role before approval, except under the temporary cover rule. Where an SMF24 is absent or leaves unexpectedly, someone can cover for up to 12 weeks. For FCA functions, since PS26/6 the firm must submit (not obtain) the application within those 12 weeks, and the person can then continue until the FCA decides. The PRA's rule for its functions works the same way for reasonably unforeseen absences, provided a valid and complete application is made within the period.

What CP26/37 would change for SMF24

CP26/37 proposes notification for SMF5 and SMF10 to SMF15 at dual-regulated and Enhanced firms. SMF24 is deliberately left out. The FCA says that, given current operational risks, particularly those from frontier AI systems and cyber risks, it will keep SMF24 pre-approved because its holders often have responsibility for the activities most exposed to those risks. The PRA takes the same position in CP14/26, citing operational risks from artificial intelligence and cyber incidents. The two regulators will review whether approval is still needed two years after the Phase 2 reforms take effect.

Other changes that touch the role:

• SMF18 would be removed. Where an Enhanced firm now has separate SMF18 holders for parts of operations, such as human resources or procurement, those responsibilities would move to another Senior Manager, and the SMF24 is the natural home.
• Group COOs: SMF7 at solo-regulated firms would cover only people with significant influence who also perform a listed group function, and responsibility for internal operations and technology is on that list. The FCA would also delete its guidance that a group head of human resources may fall within SMF7.
• Statements of Responsibilities: no routine resubmission on each change. The firm keeps the statement current, keeps superseded versions for six years and provides it on request.
• Temporary cover: 18 weeks instead of 12. At Enhanced firms a "reasonable use" test would replace "reasonably unforeseen". At banks and insurers the PRA keeps "reasonably unforeseen" for its functions.
• Tier thresholds: up about 50% for consumer credit lenders, asset managers and intermediaries. A firm that drops to Core no longer has an SMF24 role.

Responses close on 22 January 2027, with final rules expected in the first half of 2027 and changes in force around six months later, subject to the Financial Services and Markets Bill. Our CP26/37 guide covers the full package.

Holding SMF24 with other functions

• SMF24 and SMF2 Chief Finance: common in mid-sized firms. The regulator will test whether one person has the time and expertise for both, especially for technology and cyber.
• SMF24 and SMF3 at a dual-regulated firm: where the PRA approves the SMF24 and the firm tells the PRA the person will also act as an executive director, the FCA function is absorbed into the PRA approval under SUP 10C.9.
• SMF24 and SMF4: avoid. The COO owns operational risk in the first line, and the risk function must be independent of the operations it challenges.
• SMF24 and SMF7: a group COO may hold SMF24 at the main firm and SMF7 for a subsidiary where they have significant influence there.

How we support SMF24 holders

We work with incoming and serving COOs on the regulatory side of the role, linking their Statement of Responsibilities to the resilience, outsourcing and incident rules they will be judged against. Our SM&CR support covers:

• one-to-one Senior Manager training built on the person's own Statement of Responsibilities
• drafting and review of the Statement of Responsibilities
• the Form A application and the fitness and propriety file
• FCA and PRA interview preparation
• handover arrangements between outgoing and incoming holders