Author: Priscilla Gaudoin, Head of Risk & Compliance, published November 2026
Topics: SM&CR, Regulatory Reform, Individual Accountability, HR, Compliance, Governance
Regions and Regulators: UK - FCA
Time to read: 4 minutes
TL:DR: The SM&CR reforms promise less administration, not less accountability. Proposals to abolish certification and reduce approvals and filings would shift the emphasis to firms’ own controls and evidence. This means HR and Compliance teams should prepare stronger vetting, staff assessment and responsibility records, while also recognising that Phase 2 remains subject to legislation and final rules.
- Proportionate Accountability Regime
- Where do the reforms stand?
- What's changed?
- Can the reforms reduce the burden on firms?
- How does it affect HR and Compliance?
- What are the risks?
- Where could things go wrong?
- What should firms do now?
- How Ruleguard can help
- Contact Ruleguard
Proportionate Accountability Regime
Regulated firms have spent the best part of a decade embedding the Senior Managers and Certification Regime (SM&CR). It arrived for banks in 2016 and was extended to insurers in 2018 and solo-regulated firms in 2019. The objective was simple: be clear about who is responsible for what and hold them to account when things go wrong.
Does the annual certification cycle cause you pain? Do your HR and Compliance teams scramble to gather evidence, complete fitness and propriety assessments and issue certificates on time?
That cycle may soon be a thing of the past, or could it?
On 22 October 2026, the FCA and PRA published their Phase 2 proposals (FCA CP26/37 and PRA CP14/26). They follow the Phase 1 changes made in April 2026 and the Financial Services and Markets Bill (the Bill), which is now before the House of Commons. The Government's stated aim is to cut the regime's regulatory burden by 50%.
So is this the deregulation firms have been waiting for? The answer is more nuanced. The regulators will stop checking a number of things up front, but that does not mean they stop caring about them. The responsibility moves into the firm and the importance of tracking processes, controls and evidence is more critical than evert.
These joint reforms will keep consumers and markets protected while making the regime more proportionate.
Source: Sarah Pritchard, Deputy Chief Executive, FCA
Where does the Reform stand?
The reform is being delivered in stages. Phase 1 used powers the regulators already had and took effect between April and September 2026. Phase 2 goes much further, but it needs the Bill to remove requirements from primary legislation first.
The consultations close on 22 January 2027. The regulators expect final rules in the first half of 2027 and implementation in the second half, provided the Bill passes in broadly its current form. The Bill completed its Lords stages on 15 September 2026, but at the time of writing its Commons second reading had not been scheduled. This means firms are planning against proposals, not final rules.
What's changed?
The headline changes are significant. The Certification Regime would be abolished. Many senior manager roles would move from regulator pre-approval to a simple notification. Routine submissions of Statements of Responsibilities would stop, and the FCA Directory would be retired.
The table below sets out what applies today and what is proposed. It is worth stressing that the Phase 2 column shows proposals, which may change before the final rules are made.
Can the changes reduce the burden upon firms?
On paper, yes. The FCA estimates savings of £229m a year, around 53% of the regime's current cost, with a ten-year net present value of £1.91bn. The PRA's central estimate is £11.5m a year (about 47%), against a one-off familiarisation cost of around £4.3m.
Look a little closer, though, and most of that saving comes from one change: abolishing certification. Annual fit and proper certificates, Directory updates and regulatory references for certified staff take up a large share of HR and Compliance time today, particularly at larger solo-regulated firms.
The change that has attracted the most attention is worth surprisingly little. The FCA values the move from pre-approval to notification at just £0.28m a year. The benefit there is speed rather than cost. Notified appointments no longer wait for the regulator, interim cover can run for 18 weeks rather than 12, and the statutory deadline for deciding applications falls from three months to two.
Firms should also see fewer filings. Ongoing submissions of Statements of Responsibilities and Management Responsibilities Maps would end (around 1,700 fewer a year, according to PRA CP14/26), and FCA firms would no longer need to deliver mandatory Conduct Rules training.
The issue here is that the savings are not automatic. Firms will need to spend time and money up front redesigning processes, policies and systems. The regulators also expect proportionate controls to replace the rules being removed. A firm that simply stops doing things may save money in 2027, only to pay for it later.
How does it affect HR & Compliance?
The work does not disappear. It moves from forms sent to the regulator to controls and evidence held inside the firm.
Take senior manager appointments. For roles that move to notification, the firm becomes the gatekeeper. Fitness and propriety checks, references, criminal record checks and a Statement of Responsibilities all need to be complete before the start date. The proposals place oversight of this vetting under Prescribed Responsibility A, so the person holding it will need to show it was done properly. The regulators have also kept the power to require pre-approval where they have doubts about a firm's assessments.
Then there are the staff who are currently certified. Once certification goes, how does a firm show that its material risk-takers and client-facing advisers are competent and honest? What evidence will a supervisor expect to see? Firms will need to design their own framework to answer these questions, rather than follow a statutory checklist.
The Conduct Rules change too. FCA firms would move from mandatory training to a duty to tell staff which rules apply to them and what happens if they breach them, and the threshold for reporting breaches rises. This means firms need a clear record of who was told what and when, and a consistent way of applying the new thresholds.
Statements of Responsibilities and Management Responsibilities Maps no longer go to the regulator after every significant change, but they still need to be accurate on any given day. In practice, they tend to be tested when it matters most, ie after an incident, during a supervisory visit or in an enforcement case.
Finally, dual-regulated firms face an extra layer of complexity. The FCA and PRA diverge on the test for interim cover, breach-reporting deadlines, the treatment of SMF7 (Group Entity Senior Manager) and which Prescribed Responsibilities remain. One population of staff may well need two maps.
What are the risks?
The biggest risk is that firms confuse less regulatory process with less accountability. The Duty of Responsibility and the Conduct Rules are not changing, and senior managers remain personally accountable for what happens in their areas.
Phase 2 proposals, FCA CP26/37 and PRA CP14/26 · 4 processes
Each of these checks leaves the regulator's process and becomes the firm's own control. The accountability underneath stays exactly where it was.
Where could things go wrong?
First, vetting loses its backstop. For notified roles, a weak fitness and propriety assessment is no longer caught before the appointment. It surfaces later, through a supervisory review or, worse, an incident. The regulators have been clear that doubts about a firm's assessments are grounds to bring back pre-approval.
Second, standards below senior manager level may become uneven. Certification gave every firm the same baseline. Without it, approaches will vary, and firms that cannot explain how they judged someone's competence and integrity will struggle to defend that judgement. With references no longer required for previously certified staff, less information may also pass between firms when people move on.
Third, responsibility records can drift. Once Statements of Responsibilities stop going to the regulator, it is easy for them to fall quietly out of date. This could spell trouble as they underpin the Duty of Responsibility in any enforcement investigation.
Fourth, dual-regulated firms will be working to two rulebooks. Different interim cover tests, breach deadlines and Prescribed Responsibility lists add complexity that eats into the promised savings.
Fifth, there is timing. Phase 2 depends on the FSM Bill that has not yet had its Commons second reading. Firms must plan against proposals while running Phase 1 processes that were only bedded in this year.
Finally, there is the risk of overcorrection. Taking controls out faster than replacements go in creates gaps, and money saved now may be spent later on remediation.
It is also worth noting that one group is heading in the opposite direction. The FSM Bill would bring appointed representatives into SM&CR scope and require principals to hold FCA permission to appoint them. Principals face more accountability, not less, and the detailed rules are still to come.
What should firms do now?
Final rules are not expected until the first half of 2027, but that is no reason to wait. Firms that start now are better placed to capture the savings without opening gaps.
The first step is to respond to the consultations by 22 January 2027. Where the FCA and PRA diverge, or where the cost assumptions do not match your experience, the regulators need to hear it.
Firms should then map their senior manager population against the proposed notified and pre-approved roles and plan any appointments that fall around the changeover. Alongside this, it makes sense to strengthen vetting evidence now, so the Prescribed Responsibility A holder can show how each fitness and propriety decision, reference and criminal record check was made.
The bigger piece of work is designing an approach for staff below senior manager level before certification is switched off. How will competence and integrity be assessed? How will staff be told about the Conduct Rules, and how will breaches be judged against the new thresholds?
Statements of Responsibilities and Management Responsibilities Maps should be treated as live documents with a clear version history, not as filings. Principals of appointed representatives should also be planning for more oversight, not less.
Perhaps the real opportunity here is not simply doing less. It is building a simpler, better-evidenced accountability framework that stands up to scrutiny whenever it is tested.
Continuous assessment is therefore crucial: firms need to know that staff remain competent and suitable as roles, responsibilities and risks change, not just at an annual checkpoint. If certification is abolished as proposed, regular reviews, checks triggered by changes or concerns, and a clear record of decisions will help firms demonstrate that accountability remains embedded in day-to-day practice.
How Ruleguard can help
Ruleguard’s Continuous Assurance Platform supports this shift towards ongoing assessment by connecting regulatory obligations, risks, controls, monitoring activities and evidence in one environment. Automated workflows, real-time dashboards and governed AI agents help teams reduce manual effort and maintain audit-ready records, with human oversight retained.
Ruleguard’s Accountability Solution is designed to help firms keep responsibilities, assessments and records in one place, with a clear audit trail. As the regime moves from regulator filings to firm-held evidence, that audit trail becomes more important than ever.
The Ruleguard platform is designed for organisations operating in the UK, EU and globally, providing a single source of truth across the entire business. Configurable workflows and rules-to-risk mapping support a consistent approach to oversight while allowing firms to tailor processes to their own regulatory requirements.
Learn more about Ruleguard's Accountability Solution.
Book a tailored discovery call
Ready to turn GRC into a board-level advantage?
Book a tailored discovery call with Ruleguard to see how leading firms unify risk and compliance, surface the insights executives care about, and stay audit-ready, without the spreadsheet sprawl.
About the Author
