SM&CR and the Growing Fintech: Getting the Senior Managers Regime Right

Why SM&CR Scales With You

SM&CR is the FCA's accountability framework, designed to make individual senior managers personally responsible for the areas they run. For a small authorised firm, the regime is relatively light — a few senior management functions, a small certification population. But it is not static: as the firm grows, adds regulated activities, and takes on more senior people, the regime's demands scale with it. New senior management functions become relevant, the number of statements of responsibility grows, more roles fall into the certification population, and the conduct-rules training obligation extends across a larger workforce.

The risk for a scaling fintech is treating SM&CR as a one-time authorisation exercise rather than a living framework. A firm that mapped its SM&CR arrangements at authorisation and never revisited them finds, two years and fifty hires later, that the map no longer reflects reality — and that gap is exactly what a supervisory review probes.

Senior Management Functions

Senior management functions are the specific roles the FCA designates as requiring pre-approval and carrying individual accountability. The core functions for a growing fintech typically include the Chief Executive (SMF1 or SMF3 depending on structure), the Chief Finance function (SMF2), the Compliance Oversight function (SMF16), and the Money Laundering Reporting Officer (SMF17). As the firm grows, additional functions can become relevant — a Chief Risk function, a Chief Operations function, and others depending on the activities.

The scaling discipline is to review, at least annually, whether the firm's actual senior management structure maps correctly to the designated functions. A firm that has grown a genuine risk function but never had it approved as the relevant SMF, or that has a de facto operations leader outside the SM&CR map, has a gap. The map should reflect who actually runs what.

Statements of Responsibility

Each senior manager has a statement of responsibility — a document setting out precisely what they are responsible for. The point of the statement is that there are no gaps and no unclear overlaps: every area of the firm's regulated activity maps to a named senior manager who is accountable for it. As the firm grows and adds functions, the statements need to be kept current, and the firm-wide map (the "responsibilities map" for larger firms) needs to show that the whole business is covered.

The scaling trap is drift between the statements and reality. A senior manager's statement written at authorisation may no longer reflect what they actually do two years later; a new area of activity may not be clearly allocated to anyone. The discipline is to review statements when responsibilities change — a reorganisation, a new product line, a new senior hire — not only at annual attestation.

The Certification Population

Below the senior managers, the certification regime covers individuals whose roles could cause significant harm to the firm or its customers — the "certification functions". These people do not need FCA pre-approval, but the firm must certify, at least annually, that they are fit and proper for their roles. As the firm grows, the certification population grows, and the firm needs a process to identify who falls into it and to run the annual fit-and-proper assessment.

The scaling discipline is to keep the certification population current. A growing fintech adds roles that fall into certification — senior client-facing staff, people with significant decision-making authority — and the population needs to be reviewed as the organisation changes, not fixed at the authorisation snapshot.

The Conduct Rules

The conduct rules apply across almost the entire workforce of an authorised firm — a set of high-level standards of behaviour, with additional rules for senior managers. As the firm grows, the obligation to train staff on the conduct rules, and to report breaches, extends across the larger workforce. New joiners need conduct-rules training; the firm needs a process to identify and report conduct-rules breaches to the FCA.

The scaling discipline is a repeatable onboarding process that includes conduct-rules training for every relevant new hire, and a breach-reporting process that functions as the headcount grows. A firm that trained its original team but has no process for the fifty people hired since has a compliance gap that grows with every hire.

What the CFO Owns

The CFO is a senior manager under SM&CR — typically SMF2, the Chief Finance function — and therefore carries personal accountability for the finance area under the "reasonable steps" standard. Beyond their own accountability, the CFO often owns or co-owns the practical operation of the regime in a smaller fintech, because it sits at the intersection of governance, risk, and administration.

The specific CFO deliverables: ensuring their own statement of responsibility accurately reflects what they do, taking demonstrable reasonable steps to manage the finance area (documented, so it can be evidenced if ever questioned), and — where finance touches regulated outcomes such as client money or regulatory capital — ensuring those areas are clearly within an accountable senior manager's remit. Where AI or automated systems affect financial reporting or regulated activities, the CFO's reasonable-steps obligation extends to the governance of those systems.

Key Takeaways

• SM&CR demands scale with the firm — new SMFs, more statements of responsibility, a growing certification population, and a wider conduct-rules obligation.
• Review at least annually whether the designated senior management functions map to who actually runs what — a de facto risk or operations leader outside the map is a gap.
• Keep statements of responsibility current so every area of regulated activity maps to a named accountable senior manager with no gaps or unclear overlaps.
• Keep the certification population current as the firm grows, and run the annual fit-and-proper assessment for everyone in it.
• Extend conduct-rules training to every relevant new hire through a repeatable onboarding process, with a functioning breach-reporting route.
• The CFO (SMF2) carries personal accountability under the reasonable-steps standard — keep the statement accurate, document the reasonable steps, and cover AI-touched financial systems.