FCA Approved Person: SM&CR Rules Explained
Published
If you are drafting a board paper, hiring a new senior lead, or preparing a regulatory submission, the phrase FCA approved person can look deceptively simple. In practice, it now sits inside a stricter SM&CR framework, where the key question is not the job title, but whether the role needs regulator approval or firm-level certification before the person starts.
That distinction matters because a board can't treat approval as an HR formality. The firm has to map responsibilities, prove fitness and propriety, and make sure the application matches the governance model on paper and in reality. If those pieces don't line up, the application becomes a control problem, not just a filing.
Table of Contents
- The Evolution of the FCA Approved Person
- Distinguishing Senior Managers from Certified Staff
- Anatomy of a Complete SMF Application
- Mastering the Fitness and Propriety Assessment
- Navigating Extraterritorial Reach and Temporary Cover
- Adapting to the 2026 SM&CR Regulatory Reforms
- Building Your Management Responsibilities Map
The Evolution of the FCA Approved Person
A lot of firms still use approved person as a catch-all label for anyone in a senior seat. That shorthand causes trouble, because under the current regime the decisive issue is not whether someone sounds senior, it's whether the role falls into a Senior Management Function or a certification category.
The old Approved Persons Regime (APR) required regulator approval before an individual could perform specified controlled functions, and it was designed around key roles such as directors, partners and senior managers. It was later judged too limited because it did not fully clarify personal responsibilities or spread accountability through the firm, which led to the Senior Managers and Certification Regime (SM&CR) as set out by the UK government.
What changed in practice
Under SM&CR, the language changed, but the governance expectation became sharper. Senior managers still need regulator approval for designated Senior Management Functions, while many other risk-sensitive roles are certified by the firm itself at least annually. That means the old label survives mostly as legacy terminology, while the live question is whether the individual needs FCA approval under the modern framework.
Practical rule: if the role carries direct accountability for a regulated area, don't rely on the title. Map the actual responsibilities first.
The result is a much more precise process for boards and compliance teams. Instead of asking whether a candidate is broadly suitable in the abstract, the firm has to ask whether the person can discharge the exact responsibilities assigned to them, and whether those responsibilities are documented in a way the regulator can test.
Distinguishing Senior Managers from Certified Staff
Most mistakes happen at the boundary between approved roles and certified roles. A founder who also leads compliance, a contractor with operational control, or a group executive with UK responsibilities may fall into different buckets depending on the firm's structure, permissions and allocation of duties.
Job title won't save you here. Allocated responsibility, governance structure and the firm's regulatory status drive the decision, which is why a responsibility-led triage works better than a title-led one.
SMF Approval vs Internal Certification Triage
| Role Characteristic | Senior Management Function (SMF) | Certification Regime Staff |
|---|---|---|
| Regulator approval required before start | Yes | No |
| Who submits the application | The firm, or someone acting for the firm | Not applicable |
| Core test | Fitness and propriety for a specific senior function | Fitness and propriety assessed by the firm |
| Evidence focus | Statement of Responsibilities, role mapping, governance fit | Internal assessment, competence, conduct and annual certificate |
| Typical risk zone | Directors, senior control functions, senior executives with UK accountability | Supervisory, advisory or operational roles with material risk sensitivity |
| Common failure point | Misreading the actual responsibility allocation | Assuming internal certification is optional or informal |
Borderline cases are where firms need discipline. A start-up may think one person can “cover everything” without separating the approval route from the internal certification route. In reality, that approach often leaves a gap between how the business operates and how the regulatory paperwork describes it.
Direct point: if the board can't explain why a particular person is in SMF approval rather than certification, the file usually isn't ready.
The cleanest triage starts with the actual operating model. Identify who controls what, who signs off what, and who is accountable when something goes wrong. Then test whether that accountability lands inside a designated senior function, or whether it remains within the firm's own certification process.
Anatomy of a Complete SMF Application
A firm preparing for launch may have an experienced executive ready to take charge, yet still submit an incomplete SMF application. The application is a firm-governance control. It must show which Senior Management Function applies, how the responsibility is allocated, and what evidence supports the appointment. The individual must wait until approval is in place before starting the role.
What belongs in the file
A complete submission normally includes Form A, the candidate declaration, a role description, a Statement of Responsibilities, employment history covering the previous 10 years, competency and capacity assessments, conflicts information, fitness-and-propriety answers, directorships, regulatory references and, unless an exemption applies, a criminal-record check as the FCA explains in its application guidance. The firm must submit the application. The candidate cannot apply independently.
The Statement of Responsibilities anchors the file. It connects the individual to defined areas of the firm's affairs and lets the FCA test whether accountability is assigned to the correct Senior Management Function. It should reflect the firm's actual responsibility map, including reporting lines, decision rights and material delegated authority. Vague wording weakens the application because the regulator cannot see who owns the outcome.
Every document must support the same governance account. The role description, employment history, committee memberships, delegated authorities and operating model should align. If one document says the individual owns a control area while another says they only advise it, the discrepancy points to an unresolved governance issue.
The FCA's 2024/25 authorisations operating metrics, identified as FOI 12244, recorded 1,505 applications for approved-person status. 1,466 were determined within three months and 39 took longer, about 97.4% within three months according to the published totals FCA 2024/25 metrics. That timing is not an approval guarantee. It shows why a coherent, internally consistent file matters when appointment and launch plans depend on regulatory clearance.
Mastering the Fitness and Propriety Assessment
The FCA's fitness and propriety test is not a one-off screening event. It starts before appointment and continues afterwards, because the firm has to keep assessing whether the person remains fit and proper for the role as the FCA requires.
The core pillars that matter
The assessment turns on competence and capability, honesty, integrity and reputation, financial soundness, and time commitment. Those are not abstract labels. They need to be evidenced against the actual responsibilities the person will hold.
A practical way to test the candidate is to use scenarios that match the business. For example, ask how they would respond to outsourcing failure, safeguarding issues, a financial-crime escalation, prudential stress or crypto-asset operational resilience problems. Then keep the questions, answers, supporting evidence and any remediation actions in the file.
Don't treat annual certification as a box to tick. If the evidence is undated, the board will struggle to show that the assessment was real.
Triggers for reassessment
Changes in responsibilities, employment history, regulatory findings, criminal matters, financial circumstances or available time can all require a fresh look. The assessment is role-specific, so a change that looks minor on an org chart can still alter the answer.
That's why annual review should be supported by dated evidence, not a blank sign-off sheet. The board or compliance function should also see clear escalation where new information could affect continuing fitness and propriety. A firm that keeps the process alive has a better chance of avoiding awkward surprises when a regulator asks how the decision was made.
Navigating Extraterritorial Reach and Temporary Cover
Physical location does not remove the approval requirement if the individual performs a UK-regulated senior management role. The FCA's solo-regulated firm guidance makes clear that SMCR can apply to people outside the UK when they are carrying out a Senior Manager role for a regulated firm as the FCA states.
Overseas executives still need the right route
Groups often assume an overseas executive can step in without UK approval because the person sits offshore. That assumption fails if the individual is performing the regulated function in scope. The right route depends on the role, the firm's permissions and whether the person sits inside an authorised firm or an appointed representative structure.
The conduct-rules boundary is wider than formal approval as well. The FCA Handbook applies conduct rules to employees performing an SMF even where they are not yet approved, to certification employees, and to the temporary 12-week rule cover scenario as the FCA explains in COCON. That means the firm can't treat “not yet approved” as a free pass.
Temporary cover still needs discipline
Temporary appointment is often where firms get sloppy. They assume emergency cover can be operationally effective while paperwork catches up later, but the approval and conduct-rules position still need to be managed in parallel. The right response is to define the scope, document the cover arrangement, and track when the temporary period ends.
If the person is covering a senior role, the board should ask one question immediately. Is this still a temporary holding arrangement, or has it become a permanent appointment that needs a revised application and updated responsibility mapping? That distinction is where a lot of avoidable governance drift begins.
Adapting to the 2026 SM&CR Regulatory Reforms
The current reform direction is more flexible, but it is not softer in principle. FCA and PRA changes announced in 2026 give firms up to 12 weeks to submit a senior-manager application after an unexpected or temporary change, extend the validity of criminal-record checks, allow more time to update responsibility and Directory information, and remove overlapping certification requirements, with the FCA saying the latter may reduce certification roles by about 15% as set out in the FCA and PRA notice.
Why relief can still create risk
That sounds like administrative relief, and in some ways it is. The trap is assuming a faster or more proportionate process means the person can act first and become accountable later. That is not what the reform path means, and it doesn't remove the need for pre-approval where a designated SMF is involved.
The better operating model is to separate emergency cover from permanent appointment. Temporary continuity can be handled within the available rule set, but the board still has to decide whether the role has changed enough to require a new application or a revised Statement of Responsibilities.
Smaller firms need to be especially careful here. One person can hold several overlapping responsibilities, so a shift in reporting line or mandate can change the evidence set very quickly. If the governance papers lag the reality, the firm can end up with a neat-seeming process and a weak accountability story.
Building Your Management Responsibilities Map
A management responsibilities map is the document that makes the rest of the approval work intelligible. The FCA links it directly to how it assesses senior-manager applications and its ability to grant, refuse, amend or condition approval under SYSC 25.
Build the map so the application can survive scrutiny
Start with every senior role in the organisation and assign a named individual to each responsibility. Then check that the responsibilities map, the application pack and the governance documents all say the same thing. If they don't, the inconsistency becomes the story the regulator remembers.
A practical approval evidence file should include:
- Organisation chart: show reporting lines and where the proposed role sits.
- Responsibility map: make one person visibly accountable for each area.
- Committee mandates: show how decisions are taken and escalated.
- Delegated authorities: define what can be approved directly and what cannot.
- Capacity evidence: prove the person has enough time and resources to do the job.
- Interview pack: prepare answers for governance, control and escalation questions.
The FCA is not just checking the CV. It is checking whether the person fits a live governance structure.
The responsibilities map does more than support the filing. It helps the board explain why the role exists, who owns the risks around it, and what would change if the person were absent or replaced. That is why interview preparation should focus on controls, arrangements and assumptions, not rehearsed slogans.
If your firm is working through an FCA approval, SM&CR classification or responsibilities-map rebuild, Glentorion can help you turn the regulatory standard into a filing that hangs together under scrutiny. Visit Glentorion to discuss authorisation support, governance mapping and interview preparation for senior appointments.
- fca approved person
- smcr compliance
- senior management functions
- fca authorisation
- regulatory governance
