1 Obligations under the regulations
Under SM&CR, an authorised firm must know two things: which Senior Management Functions (SMFs) it must fill, and which FCA-prescribed senior management responsibilities it must allocate to those Senior Managers. The functions are in SUP 10C. The responsibilities are in SYSC 24. Neither list applies in full to every firm.
A person may not perform an FCA designated senior management function unless the FCA has approved them (FSMA s.59). The firm must allocate every FCA-prescribed responsibility that applies to it to one or more SMF managers, in a way that makes it clear who has which responsibility (SYSC 24.2.1R and 24.2.5R). Most insurers, and enhanced-scope solo-regulated firms, must also keep a management responsibilities map (SYSC 25) and allocate overall responsibility for every activity, business area and management function (SYSC 26).
Dual-regulated insurers sit in both rulebooks. Several well-known SMFs — Chief Executive, Chair, committee chairs, Senior Independent Director — are PRA functions at a Solvency II insurer and FCA functions at a solo-regulated MGA or broker. This how-to catalogues the FCA functions and FCA-prescribed responsibilities. Check the PRA Rulebook (Insurance – Senior Management Functions and Insurance – Allocation of Responsibilities) for the PRA equivalents.
Limited-scope firms — including many intermediaries whose only insurance permission is distributing non-investment insurance contracts — generally have fewer SMFs and no FCA-prescribed responsibilities under SYSC 24.
2 What do I need to do
Classify the firm first. The SMFs and prescribed responsibilities that apply follow from that classification, not from job titles.
1. Classify the firm
Put the legal entity into one of the SM&CR classes that matter for insurance: Solvency II (or large non-directive) insurer; overseas or EEA insurance branch; small non-directive insurer or run-off firm; insurance special purpose vehicle; or a solo-regulated firm (core, enhanced or limited scope). Most UK MGAs and brokers are solo-regulated. Regzact can assist: hold each company in a multi-company configuration so the map is built for the right legal entity.
2. Identify every Senior Management Function that applies
Use the FCA list below, then the application tables. A tick in the table means the function is available for that class of firm — it still only applies if someone actually performs it (a partner function only applies to a partnership; the Lloyd’s conduct-risk function only applies to the Society). Approve holders before they start. Regzact can assist: allocate each SMF to a senior manager, with appointment and resignation dates.
3. Allocate every prescribed responsibility that applies
SYSC 24.2.6R is the catalogue. SYSC 24 Annex 1 says which of those responsibilities apply to which kind of firm. Give each applicable responsibility to the most senior SMF manager who is actually responsible for that area, and make the split unambiguous if two people share it. Regzact can assist: record the allocation against each Senior Manager and keep it in step with the map.
4. Keep the statements of responsibilities and the map current
Every SMF manager needs a statement of responsibilities. Firms in scope of SYSC 25 need a management responsibilities map of the whole governance structure. Update both on appointment, resignation, parental leave and any re-allocation — not once a year. Regzact can assist: generate a dynamic management responsibilities map from the live allocation.
FCA Senior Management Functions
These are the FCA designated senior management functions you will meet in insurance groups. Descriptions follow SUP 10C.
- SMF1 — Chief Executive
- Responsibility, under the immediate authority of the governing body, for the conduct of the whole of the business. An FCA function at solo-regulated firms. At dual-regulated insurers this is a PRA function.
- SMF3 — Executive Director
- Acting in the capacity of a director (other than a non-executive) of a regulated firm.
- SMF7 — Group Entity Senior Manager
- Exercising significant influence over the firm from a parent or group entity. An FCA function at enhanced-scope firms. Dual-regulated insurers treat the equivalent as a PRA function.
- SMF9 — Chair of the Governing Body
- Directing the affairs of the governing body (the Board Chair). An FCA function at solo-regulated firms. At dual-regulated insurers this is a PRA function.
- SMF10 — Chair of the Risk Committee
- Chairing the committee responsible for risk oversight. An FCA function at enhanced-scope firms; a PRA function at dual-regulated insurers.
- SMF11 — Chair of the Audit Committee
- Chairing the committee responsible for financial audit oversight. An FCA function at enhanced-scope firms; a PRA function at dual-regulated insurers.
- SMF12 — Chair of the Remuneration Committee
- Chairing the committee responsible for executive remuneration. An FCA function at enhanced-scope firms; a PRA function at dual-regulated insurers.
- SMF13 — Chair of the Nomination Committee
- Chairing the committee responsible for board appointments. An FCA function for Solvency II insurers and for enhanced-scope firms, where that committee exists.
- SMF14 — Senior Independent Director
- Acting as the senior independent director, including as a sounding board for the chair. An FCA function at enhanced-scope firms; a PRA function at dual-regulated insurers.
- SMF15 — Chair of the With-Profits Committee
- Chairing the committee that oversees with-profits business policy. An insurance-sector function: it applies where the firm actually has that committee.
- SMF16 — Compliance Oversight
- Carrying out the compliance oversight responsibilities under SYSC 6.1 — the person with overall responsibility for the compliance function.
- SMF17 — Money Laundering Reporting Officer
- Acting as the MLRO under SYSC 6.3. The prescribed financial-crime responsibility (d) can sit with the MLRO, but it does not have to.
- SMF18 — Other Overall Responsibility
- Having overall responsibility for an activity, business area or management function that is not already covered by another SMF. Used so that every area of the firm has a named Senior Manager (SYSC 26).
- SMF19 — Head of Third Country Branch
- Managing the UK business of a branch established in the UK by an overseas firm. An FCA function for overseas core SMCR firms, not for UK-headquartered insurers.
- SMF21 — EEA Branch Senior Manager
- Managing a remaining EEA branch in the specific regimes that still use this function. It does not apply to ordinary UK insurers, MGAs or brokers.
- SMF22 — Other Local Responsibility
- Managing a specific business function inside a UK branch of an overseas firm — the branch equivalent of SMF18.
- SMF23b — Conduct Risk Oversight (Lloyd’s)
- Conduct-risk oversight in the Lloyd’s market. SUP 10C applies this function only to the Society of Lloyd’s.
- SMF27 — Partner
- Carrying out the responsibilities of a partner in a partnership. It only applies if the firm is a partnership (or a comparable unincorporated structure).
- SMF29 — Limited Scope function
- The simplified senior management function used instead of a full SMF suite at limited-scope firms, including many insurance intermediaries.
Which SMFs apply to which insurance firm
SUP 10C Annex 1 Part Four. A “Yes” means the FCA function is in scope for that class of firm; it still only needs a holder if the firm actually performs it.
| Function | Solvency II / large NDI | EEA branch | Overseas branch | Small NDI / run-off | ISPV |
|---|---|---|---|---|---|
| SMF3 Executive Director | Yes | — | Yes | Yes | Yes |
| SMF13 Chair of Nomination Committee | Yes | — | — | — | — |
| SMF15 Chair of With-Profits Committee | Yes | — | Yes | — | — |
| SMF16 Compliance Oversight | Yes | — | Yes | Yes | — |
| SMF17 MLRO | Yes | Yes | Yes | Yes | — |
| SMF18 Other Overall Responsibility | Yes | — | — | — | — |
| SMF21 EEA Branch Senior Manager | — | Yes | — | — | — |
| SMF22 Other Local Responsibility | — | — | Yes | — | — |
| SMF23b Conduct Risk Oversight (Lloyd’s) | Yes* | — | — | — | — |
| SMF27 Partner | Yes | — | — | Yes | — |
*SMF23b applies only to the Society of Lloyd’s. Dual-regulated insurers also fill PRA SMFs (typically SMF1, SMF2, SMF4, SMF9 and, where relevant, SMF5, SMF15, SMF20, SMF23 and SMF24) which do not appear in this FCA table.
Which SMFs apply to MGAs and brokers
SUP 10C Annex 1 Parts Five to Seven. Most UK MGAs and brokers are core, enhanced or limited-scope SMCR firms.
| Function | UK core | Overseas core | Enhanced | Limited scope |
|---|---|---|---|---|
| SMF1 Chief Executive | Yes | — | Yes | — |
| SMF3 Executive Director | Yes | Yes | Yes | — |
| SMF7 Group Entity Senior Manager | — | — | Yes | — |
| SMF9 Chair of the Governing Body | Yes | — | Yes | — |
| SMF10–12 Committee chairs | — | — | Yes | — |
| SMF13 Chair of Nomination Committee | — | — | Yes | — |
| SMF14 Senior Independent Director | — | — | Yes | — |
| SMF16 Compliance Oversight | Yes | Yes | Yes | Some** |
| SMF17 MLRO | Yes | Yes | Yes | Often |
| SMF18 Other Overall Responsibility | — | — | Yes | — |
| SMF19 Head of Third Country Branch | — | Yes | — | — |
| SMF27 Partner | Yes | — | Yes | — |
| SMF29 Limited Scope function | — | — | — | Yes |
**Limited-scope insurance-distribution firms generally use SMF29 (and often SMF17). SMF16 applies to some other limited-scope classes, not to a typical non-investment insurance intermediary. Enhanced firms also have FCA systems-and-controls functions SMF2, SMF4, SMF5 and SMF24.
FCA-prescribed senior management responsibilities
Each responsibility has a reference letter in SYSC 24.2.6R. Allocate every letter that applies to your firm; skip the ones that do not.
- (a) Senior managers regime
- The firm’s performance of its obligations under the senior managers regime — approvals, conditions and time limits, statements of responsibilities (but not the allocation recorded in them), vetting of candidates (FSMA s.60A), and regulatory references for SMF managers.
- (b) Certification regime
- The firm’s performance of its obligations under the certification regime (FSMA ss.63E–63F, SYSC 27), including regulatory references for certification staff and Directory reporting under SUP 16.26.
- (b-1) Conduct Rules training and reporting
- COCON training (FSMA s.64B) and notifying the FCA of disciplinary action (FSMA s.64C).
- (c) Management responsibilities map
- Compliance with the requirements about the management responsibilities map. It does not include allocating the responsibilities recorded on the map. It only applies where SYSC 25 applies.
- (d) Financial crime
- Policies and procedures for countering the risk that the firm might be used to further financial crime, including AML systems and controls. It may be allocated to the MLRO; if it is not, it includes supervising the MLRO.
- (f) Training of the governing body
- Leading the development of, and monitoring the effective implementation of, induction, training and professional development for members of the governing body.
- (g) Training of SMF managers and key function holders
- Monitoring induction, training and professional development for SMF managers and PRA key function holders who are not members of the governing body.
- (j) Internal audit oversight
- Safeguarding the independence of, and overseeing the performance of, the internal audit function — including the Head of Internal Audit SMF where that function applies. Banking and enhanced-scope firms; not an insurance-sector prescribed responsibility.
- (j-2) Outsourced internal audit (insurers)
- Providing for an effective internal audit function, and overseeing it, where a Solvency II or large non-directive insurer outsources internal audit to a third party (PRA internal-audit prescribed responsibility).
- (j-3) Independence of outsourced internal audit
- Taking reasonable steps so that everyone involved in internal audit is independent from external audit, including conflicts where the same firm provides both. Enhanced-scope firms that outsource internal audit.
- (k) Compliance oversight
- Safeguarding the independence of, and overseeing the performance of, the compliance function — including the person performing SMF16. Banking and enhanced-scope firms.
- (l) Risk oversight
- Safeguarding the independence of, and overseeing the performance of, the risk function — including the Chief Risk SMF where that function applies. Banking and enhanced-scope firms.
- (m) Remuneration
- Overseeing the development and implementation of remuneration policies under SYSC 19D. Does not apply where SYSC 19D does not apply (so not a typical insurer, MGA or broker responsibility).
- (n) Whistleblowers’ champion
- Acting as the firm’s whistleblowers’ champion (SYSC 18.4.4R). Applies to Solvency II insurers; not to small non-directive insurers, ISPVs or core solo-regulated firms.
- (s) Stress testing
- Managing the firm’s internal stress tests and the accuracy of information given to the FCA for that purpose (MIFIDPRU 7.5). Enhanced-scope firms in scope of those rules.
- (t) Business model
- Development and maintenance of the firm’s business model by the governing body. Enhanced-scope firms.
- (z) CASS
- The firm’s compliance with the Client Assets Sourcebook, where CASS applies. Includes supervising the CASS operational oversight officer if that person is not the SMF manager who holds (z).
- (za) COLL compliance
- The responsibilities allocated under COLL 6.6.27R, COLL 8.5.22R or COLL 15.7.24R. Only for firms to which those fund rules apply.
- (aa) UK risk management
- Management of the firm’s risk-management processes in the UK. Overseas firms (insurance branches and overseas core firms), not UK-headquartered firms.
- (ee) Escalation of correspondence
- Escalating correspondence from the PRA, FCA and other regulators to the governing body, and where appropriate to the parent. Overseas firms.
- (ff) UK regulatory system
- The firm’s compliance with the UK regulatory system applicable to it. Overseas firms.
Which prescribed responsibilities apply to which insurance firm
SYSC 24 Annex 1 3.3R. Limited-scope firms are outside SYSC 24 entirely.
| Responsibility | Solvency II / large NDI | Overseas branch | Other insurance | ISPV |
|---|---|---|---|---|
| (a) Senior managers regime | Yes | Yes | Yes | Yes |
| (b) Certification regime | Yes | Yes | Yes | Yes |
| (b-1) Conduct Rules | Yes | Yes | Yes | Yes |
| (c) Responsibilities map | Yes | Yes | — | — |
| (d) Financial crime | Yes | Yes | Yes | Yes |
| (f) Training of the governing body | Yes | — | — | — |
| (g) Training of SMFs / key function holders | Yes | — | — | — |
| (j-2) Outsourced internal audit | Yes | — | — | — |
| (n) Whistleblowers’ champion | Yes | — | — | — |
| (z) CASS | Yes | Yes | Yes | — |
| (ee) Escalation of correspondence | — | Yes | — | — |
| (ff) UK regulatory system | — | Yes | — | — |
“Other insurance” is small non-directive insurers and firms in run-off (SYSC 23 Annex 1 5.2R). CASS (z) only applies if CASS itself applies to the firm.
Which prescribed responsibilities apply to MGAs and brokers
SYSC 24 Annex 1 4.2R. Core firms have a short list. Enhanced-scope firms pick up the map, the independent-control responsibilities, the business model and, where MIFIDPRU 7.5 applies, stress testing.
| Responsibility | UK core | Overseas core | Enhanced |
|---|---|---|---|
| (a) Senior managers regime | Yes | Yes | Yes |
| (b) Certification regime | Yes | Yes | Yes |
| (b-1) Conduct Rules | Yes | Yes | Yes |
| (c) Responsibilities map | — | — | Yes |
| (d) Financial crime | Yes | Yes | Yes |
| (j) Internal audit oversight | — | — | Yes |
| (j-3) Independence of outsourced IA | — | — | Yes |
| (k) Compliance oversight | — | — | Yes |
| (l) Risk oversight | — | — | Yes |
| (s) Stress testing | — | — | Yes |
| (t) Business model | — | — | Yes |
| (z) CASS | Yes | Yes | Yes |
| (za) COLL compliance | Yes | Yes | Yes |
| (aa) UK risk management | — | Yes | — |
| (ee) Escalation of correspondence | — | Yes | — |
| (ff) UK regulatory system | — | Yes | — |
(z) and (za) only apply if CASS or the COLL rules apply. Limited-scope firms do not allocate SYSC 24 prescribed responsibilities.
3 What records do I need to keep
If the FCA asks who is responsible for financial crime, or why a prescribed responsibility moved last March, you need the live allocation — not last year’s PDF of the map.
- The SM&CR classification of each legal entity (Solvency II, core, enhanced, limited scope, branch, ISPV)
- A register of SMFs with named holders, FCA/PRA approval references, and appointment and resignation dates
- The allocation of every applicable prescribed responsibility, including any shared split
- Current statements of responsibilities for every SMF manager
- The management responsibilities map (where SYSC 25 applies), matching the live allocation
- Handover material when an SMF manager leaves or a responsibility moves
- Directory submissions that match the internal register
- Evidence of the board or governing-body decision that approved the allocation
4 Using AI to streamline the process
The classification of the firm, and the decision that a person is the right Senior Manager, stay with the firm. AI can still shorten the file:
- Flag any applicable SMF or prescribed responsibility with no named holder
- Compare a statement of responsibilities with the live allocation and list the gaps
- Draft a briefing when someone is appointed or resigns, including knock-on re-allocations
- Spot a map that still shows a person who has a resignation date on the register
Do not let a model decide which functions apply, or who should hold a prescribed responsibility. Use it to find holes; keep the allocation with the board.
5 How Regzact can help
The Fitness & Probity solution tracks the allocation of Senior Management Functions and prescribed responsibilities to named senior managers, including appointment and resignation dates.
- Allocation of SMFs and prescribed responsibilities to each Senior Manager
- Appointment and resignation dates on the same record
- Multi-company configurations so each legal entity has its own map
- A dynamic management responsibilities map generated from the live allocation
Certification, questionnaires and annual fit-and-proper review sit on the same staff file. See also How to keep staff fit and proper under SM&CR.
This is a practical how-to for compliance managers. It is not legal advice. Always check the current text of the regulations and your own policies before you act.