SM&CR Phase 2: What it means for Core firms
On 22 October 2026 the FCA published CP26/37, the second phase of its SM&CR review. The headline is deregulation: no more Certification Regime, no more Directory, lighter Conduct Rules training and fewer breach reports. The FCA estimates firms will save £229m a year.
Training your team on this? Fundsure’s SMCR training and Conduct Rules training are CPD assessed and rewritten for 2026.
For a Core firm, though, this is not just less paperwork. Picture a typical one: an Executive Director (SMF3), a Compliance Oversight function (SMF16), an MLRO (SMF17) and a team of certified staff. Under these proposals, much of the accountability that currently sits with the certified population would move onto those three senior managers. They would have fewer formal tools to manage it. Below we set out the risks and what firms can do about them before the consultation closes on 22 January 2027.
What changes for a Core firm
SMF3, SMF16 and SMF17 are not among the roles the FCA proposes to move from pre-approval to notification, so they would still need FCA approval. Almost everything below them changes:
| Today | Proposed under CP26/37 |
|---|---|
| Certified staff assessed as fit and proper on appointment and every year | Certification Regime removed. Firms "remain responsible for ensuring the staff are competent and suitable", but there is no prescribed process |
| Regulatory references required for certified staff | Removed for previously certified staff |
| Certified staff listed on the FCA Directory | Directory retired |
| Conduct Rules training required for staff in scope | Training requirements simplified |
| Conduct Rule breaches by non-SMF staff reported to the FCA once disciplinary action is taken | Threshold raised to a final written warning |
| Statements of Responsibilities sent to the FCA and kept up to date | Routine submission ends, and Form J is withdrawn. Firms must still keep SoRs current and produce them on request |
| 12-week rule for temporary SMF cover | Extended to 18 weeks |
The FCA expects final rules in the first half of 2027. Implementation would follow about six months later, subject to the Financial Services and Markets Bill passing.
Risk 1: the obligation stays, but the structure goes
Removing certification does not remove the duty to employ competent, honest people. Firms would still be responsible for making sure staff are competent and suitable. What goes is the framework that made firms prove it: the defined certification functions, the annual sign-off and the audit trail behind it.
In a Core firm, the certified population is usually the staff who deal with customers and the market. That includes advisers, client-dealing staff and their managers. Without a set process, assessments of these people can quietly slip. Annual reviews get skipped. Probation becomes the only real check. Competence gets assumed rather than evidenced.
The FCA itself calls removing certification a significant change that could introduce risks, and it is asking for alternative approaches. If the regulator is not sure what replaces the regime, firms should not assume nothing needs to.
Risk 2: less information on who you are hiring
Today, a firm hiring into a certified role has to get a regulatory reference. Previous employers must disclose relevant matters, including disciplinary outcomes and Conduct Rule breaches. Under the proposals, references for previously certified staff would no longer be required. The public Directory, which shows who holds certified roles, would also be retired.
Together, these changes make it harder to stop people with poor conduct records moving from one firm to the next. Ordinary employment references are often short and factual, and a former employer has little incentive to say more than it must. Smaller Core firms, which do fewer checks and hire from a shallower pool, are most exposed. Losing the Directory also removes a public check that consumers and firms use to confirm who they are dealing with.
Risk 3: more weight on three people
With certification gone, the senior managers become the regime's main way of holding individuals to account, and in a Core firm there may be only three of them. If staff conduct goes wrong, the FCA will ask whether the responsible SMF took reasonable steps. The firm will have no certification records to point to.
In practice:
- SMF3 (Executive Director) answers for how the business is run, including how staff are recruited, supervised and kept competent.
- SMF16 (Compliance Oversight) loses a structured annual check of staff fitness, but still answers for the compliance framework around them.
- SMF17 (MLRO) relies on frontline staff spotting and escalating suspicious activity. Weaker competence checks mean weaker financial crime controls.
As advisers commenting on the earlier stages of the review put it, the changes "will inevitably place more reliance on firms and their SMFs to demonstrate reasonable steps." Fewer rules can mean more personal exposure for the people still in the regime.
The 18-week temporary cover rule adds a related risk. A small firm can now run longer without, say, an approved MLRO, so it needs a credible cover plan for each of its three key roles.
Risk 4: Conduct Rules that people don't know
The Conduct Rules would still apply to almost all staff, and the FCA would bring sole traders into the Code of Conduct. What would change is how firms are told to embed them: Conduct Rules training is to be simplified. The risk is that firms read "simplified" as "optional". Staff can't follow rules they don't understand, and "we weren't required to train them" is a weak answer when a breach comes to light.
Breach reporting would also get narrower. For non-SMF staff, a breach would only need reporting to the FCA once it reached a final written warning, and FCA reports could fall up to 14 months after the event. Fewer cases would reach the regulator, so the firm's own records become the main evidence that problems were spotted and dealt with. Lower-level breaches still need to be logged, and someone still needs to look for patterns in them, even if they never go to the FCA.
Risk 5: less visibility, not less scrutiny
Without routine Statements of Responsibilities, Directory entries or as many breach reports, the FCA will see less of a firm day to day. That does not mean it will look less closely when something goes wrong. When it does look, it will expect SoRs that are up to date, clear records of how staff were judged fit, and evidence that conduct issues were handled. A firm that let its processes lapse after the rules changed will struggle to provide any of that.
Commentators have warned that firms treating the reforms as pure deregulation may face more supervisory attention, not less. The FCA has also said it may bring back pre-approval for firms that make unsuitable appointments. Behind these changes is the regulators' growth and competitiveness objective. Whether a £229m saving is worth less visibility of individual conduct is a fair question for the consultation, and one firms can answer.
What Core firms should do now
Nothing changes until final rules are published and in force, which is unlikely before the second half of 2027. Firms can use that time to decide what to keep.
- 1.Keep a fitness and competence framework. Decide which roles still need a documented assessment on appointment and every year, even if you no longer call it certification.
- 2.Go beyond the minimum on references. Ask previous employers about conduct and disciplinary history, and be ready to answer the same questions about your own leavers.
- 3.Keep training on the Conduct Rules. Make sure every member of staff knows the rules and how they apply to their own job, and keep records that show it.
- 4.Keep an internal breach log. Record every breach, not just those that meet the new reporting threshold, and have SMF16 review it for trends.
- 5.Keep SoRs current. Make sure each one matches what SMF3, SMF16 and SMF17 actually do, and that each SMF can show the reasonable steps they take.
- 6.Plan temporary cover for each SMF under the 18-week rule.
- 7.Respond to CP26/37 by 22 January 2027. The FCA has asked for alternatives to removing certification, and smaller firms' views on what works in practice are worth hearing.
The principle hasn't changed: individuals are still accountable for what they do. What's changing is how much of that accountability the regulator checks for you.
Sources
Related training
Online, CPD-assessed courses for regulated firms, scheduled, chased and certified in the Fundsure Portal.