1 Obligations under the regulations
In the UK this regime is the Senior Managers and Certification Regime (SM&CR), not “Fitness and Probity”. The statutory core is in FSMA: a firm must take reasonable care that no employee performs an FCA certification function without a valid certificate (s.63E), and may issue a certificate only if it is satisfied the person is fit and proper (s.63F).
When assessing fitness, the firm must have regard in particular to qualifications, training, competence and personal characteristics (s.63F; FIT 1). Certification is required on appointment and at least annually. The firm must maintain a record of every employee who has a valid certificate. Functions requiring a qualification under TC App 1.1.1R are themselves certification functions (SYSC 27.8.10R).
Senior Managers still need FCA (and, if dual-regulated, PRA) approval before they start. Conduct Rules in COCON apply to Senior Managers, Certification Staff and, for most firms, other conduct rules staff. Regulatory references are required under SYSC 22 — provide them as soon as reasonably practicable, and in any event within six years of employment the FCA expects you to be able to look back.
Insurers should also read the FCA’s SM&CR guide for insurers and, where relevant, the PRA’s Insurance — Fitness and Propriety rules and Solvency II governance expectations.
2 What do I need to do
Keep a live map of SMFs and certification functions, then run the same assessment at hire, on role change, and at annual recertification.
1. Identify who is in scope
List Senior Management Functions, then the certification functions that apply (including functions requiring qualifications, significant management, client-dealing, material risk takers, and managers of certification employees). Very small firms may have few or none. Regzact can assist: record roles and regulated functions on each staff compliance profile.
2. Assess fitness and propriety before they start
Qualifications and TC status, training, competence, honesty, integrity, reputation and financial soundness. Take up regulatory references (SYSC 22). For SMFs, the firm must be satisfied they are fit and proper before applying for approval. Regzact can assist: issue questionnaires, capture documents, and record background checks.
3. Issue the certificate and train on Conduct Rules
The certificate must state that the firm is satisfied the person is fit and proper for that function, and set out the aspects of the business they are involved in. Deliver COCON training and keep attendance. Regzact can assist: generate signed certifications, capture declarations, and store evidence of training.
4. Recertify at least annually and keep Directory data current
Reassess qualifications, CPD/training, role changes and any conduct issues. Update the Directory. Recertify immediately on a material change to the function (SYSC 27.2.15G). Regzact can assist: schedule annual review, send reminders, and report who is certified, overdue or missing a qualification.
3 What records do I need to keep
Section 63F requires a record of every employee with a valid certificate. In practice you need the assessment file behind each certificate.
- List of SMFs and certification functions, with named holders
- Fit-and-proper assessments covering qualifications, training, competence and personal characteristics
- Copies of certificates issued, including the business areas covered
- Regulatory references given and received (SYSC 22)
- TC qualification and training records for advice and equivalent activities
- COCON training records and any conduct-rule breach files
- Directory submissions and evidence that they match the internal register
- Annual recertification packs and manager / SMF sign-off
4 Using AI to streamline the process
The fit-and-proper decision cannot be outsourced to a model. AI can still shorten the file:
- Check questionnaires for missing answers before manager review
- Match certificates and memberships to the qualifications required for the function
- Flag people whose certificate is close to expiry or whose role has changed without recertification
- Draft a gap briefing for the certifier
A person who understands the role still has to be satisfied, on the evidence, that the individual is fit and proper.
5 How Regzact can help
The Fitness & Probity solution also runs SM&CR: staff profiles, questionnaires, certifications, qualifications and annual review in one place.
- Compliance profiles covering training, memberships, qualifications, roles and documents
- Questionnaires, electronic signatures and manager approval
- Reminders when certifications, training or declarations are due
- Background checks, evidence files and reporting for the FCA
Registers, partner profiles, sanctions screening and risk analysis sit alongside the SM&CR file. Regzact can assist with each step of this process.
This is a practical how-to for compliance managers. It is not legal advice. Always check the current text of the regulations and your own policies before you act.