SMF Capital

Today we're looking at SMF24, the Chief Operations Function — a Senior Management Function that has become increasingly important as operational resilience, technology risk and third-party dependency have moved much closer to the centre of regulatory supervision.

The modern Chief Operating Officer in a regulated business is no longer simply responsible for making sure the organisation runs smoothly.

The role can involve responsibility for the systems, processes, technology and operational infrastructure that allow the firm to deliver its important business services

You can read our detailed guide here:
https://www.smfcapital.co.uk/smf24-explained-what-the-fca-expects-from-a-chief-operations-function/

What Is SMF24?

SMF24 is the Chief Operations Function.

At its core, the role concerns the operational infrastructure of a regulated business — the processes, systems, technology and resources required to keep the organisation functioning effectively.

The exact responsibilities will depend on the firm's structure and the responsibilities allocated to the individual.

But the direction of travel is clear: operational issues can become regulatory issues very quickly.

A major technology failure, cyber incident, third-party outage or disruption to an important business service can potentially affect customers and market integrity.

Consequently, operational leadership can carry significant regulatory importance.

How Operational Resilience Has Changed the Role

Operational resilience has changed the expectations surrounding senior operations leadership.

Regulated firms need to understand which business services are important, consider the impact of disruption, establish appropriate tolerances and test whether the organisation can continue operating during severe but plausible disruption scenarios.

For an SMF24 holder, this means operational resilience cannot simply be treated as a policy document owned by another department.

The COO needs to understand how the framework operates in practice.

What happens if a critical system fails?

What happens if a major technology provider becomes unavailable?

What happens following a serious cyber incident?

Can the business continue delivering its important services?

And can management demonstrate that it has tested its assumptions?

These are operational questions, but they can also become questions for senior management and the regulator.

Third-Party and Outsourcing Risk

Modern financial services firms often rely on extensive networks of third-party providers.

Cloud platforms, technology providers, payment systems, outsourced operations and specialist service providers can all become critical to the firm's ability to operate.

This creates another important dimension to the SMF24 role.

A strong Chief Operating Officer needs to understand not only whether an outsourced service works efficiently, but also what happens if it stops working.

That means considering resilience, dependency, concentration risk, contingency arrangements and exit planning.

The more dependent a firm becomes on external providers, the more important operational oversight becomes.

Technology and Change Management

Technology transformation is another major part of modern operations leadership.

Firms regularly introduce new platforms, migrate systems, automate processes or change their operating models.

Change can create significant operational risk if it is poorly managed.

An experienced SMF24 candidate should therefore be able to demonstrate that they have managed major change programmes while maintaining appropriate controls and business continuity.

The question during recruitment is not simply:

"Have you managed technology projects?"

It is:

"Have you managed operational risk while the business was changing?"

That distinction can be extremely important in a regulated environment.

What Makes a Strong SMF24 Candidate?

A strong SMF24 candidate will generally need a combination of operational leadership, regulatory awareness and practical experience.

Relevant experience might include:

• Leading operations within a regulated financial services business
• Managing operational resilience programmes
• Overseeing critical third-party relationships
• Managing significant technology change
• Responding to operational incidents
• Working with risk, compliance and technology functions
• Reporting operational risks to boards and senior management
• Building effective operational controls and governance

Technical knowledge is important, but leadership is equally important.

The SMF24 holder needs enough authority and credibility to make operational improvements happen across the organisation.

SMF24 and the Board

The Chief Operating Officer does not operate in isolation.

The SMF24 function sits alongside other senior management responsibilities, including functions such as the Chief Executive and Chief Risk Officer.

That makes clarity of responsibility particularly important.

The board needs to understand who owns which risks and how operational issues are escalated.

The SMF24 holder also needs to be able to communicate operational risks in language that the board can understand.

A highly technical explanation of a system failure is not necessarily useful to directors.

The board needs to understand the potential business impact, the regulatory implications, the mitigation and what management is doing about it.

The Personal Accountability of an SMF24 Holder

The Senior Managers and Certification Regime is built around clear individual accountability.

The FCA explains that the SMCR is intended to encourage senior managers to take responsibility for their areas of the business.

That makes the allocation of responsibilities important when appointing an SMF24.

The candidate should understand what they are personally responsible for.

The firm's governance documentation should also accurately reflect the responsibilities allocated to them.

An SMF24 appointment should therefore be treated as considerably more than changing someone's job title to Chief Operating Officer.

It is a regulated senior management appointment with defined accountability.

Does Every COO Need to Be SMF24?

No single designation automatically applies to every Chief Operating Officer.

The relevant Senior Management Functions depend on the firm's regulatory status, permissions, structure and the responsibilities allocated to the individual.

This is why firms should establish the appropriate SMF structure before beginning a senior recruitment process.

A job description and a regulatory responsibility map need to work together.

If the business is unsure which designation applies, specialist advice can help clarify the structure before the search begins.

Recruiting an SMF24 Chief Operating Officer

Recruiting an SMF24 is different from recruiting an ordinary COO.

The candidate needs to satisfy the firm's operational requirements while also being suitable for the regulatory responsibilities attached to the function.

That means assessing more than career history.

A search should examine the candidate's experience of operational resilience, technology, third-party relationships, major change, governance and senior-level decision-making.

The candidate also needs to be able to operate effectively alongside the firm's other SMF holders.

For firms building or strengthening their senior management team, SMF24 should therefore be considered as part of the wider regulatory architecture rather than as an isolated operations appointment.

Understanding SMF24 Alongside Other Designations

SMF24 is one of a wider group of Senior Management Functions covering key executive and control responsibilities.

Understanding where each designation sits is essential when designing a regulated firm's senior leadership structure.

Our SMF Designations: A Complete Guide brings the major functions together in one place, including SMF1, SMF2, SMF4, SMF5, SMF16, SMF17, SMF18, SMF24 and SMF27.

You can read the complete guide here:

https://www.smfcapital.co.uk/smf-designations-a-complete-guide/

Final Thoughts

SMF24 has evolved into a strategically important senior management function.

The Chief Operating Officer is increasingly involved in questions around operational resilience, technology, outsourcing, business continuity and the ability of the firm to continue delivering important services during disruption.

For regulated firms, that means the appointment needs to be approached carefully.

The right candidate needs operational leadership experience, but also the judgement and credibility required to carry a regulated Senior Management Function.

If your firm is recruiting an SMF24 Chief Operating Officer, SMF Capital can help identify senior candidates whose operational experience and regulatory responsibilities align with the requirements of the role.

Visit the SMF24 guide to explore the function in more detail, and use our SMF Designations Complete Guide to understand how SMF24 fits into the wider Senior Managers and Certification Regime.

SMF Capital — specialist recruitment for Senior Management Functions in regulated businesses.

Welcome to the SMF Capital podcast.

Today we are looking at two important Senior Management Functions within the UK's Senior Managers and Certification Regime: SMF16, Compliance Oversight, and SMF17, the Money Laundering Reporting Officer, or MLRO.

These roles sit at the heart of a firm's regulatory framework. They involve responsibility for compliance, financial crime controls and escalation of significant regulatory concerns.

They can also carry substantial personal responsibility for the individual performing the function.

In this episode, we'll look at what SMF16 and SMF17 involve, how they differ, how they interact with the board and compliance function, and why firms need to think carefully about the people appointed to these positions.

For a detailed explanation, see SMF16 and SMF17: Compliance Oversight, the MLRO and Personal Liability:
https://www.smfcapital.co.uk/smf16-smf17-compliance-oversight-mlro/

What Is SMF16?

SMF16 is the Compliance Oversight Function.

The individual performing this function has senior responsibility for overseeing the firm's compliance with its regulatory obligations.

This is not simply about having a compliance department.

The SMF16 holder needs sufficient authority, access to information and organisational standing to provide effective oversight.

That can include challenging senior management, escalating concerns and ensuring that regulatory risks receive appropriate attention.

The precise requirements depend on the firm's regulatory permissions and circumstances, but the underlying principle is clear: compliance needs effective senior oversight.

What Is SMF17?

SMF17 is the Money Laundering Reporting Officer, commonly known as the MLRO.

The MLRO has responsibility for the firm's systems and processes relating to money laundering and terrorist financing risks, subject to the applicable regulatory framework.

This can involve reviewing and escalating suspicious activity, overseeing relevant policies and controls, working with the firm's compliance and financial crime teams, and engaging with the regulator or law enforcement where appropriate.

The MLRO therefore occupies a particularly sensitive position.

They need to be sufficiently independent to challenge the business while also having the authority and resources required to perform the function properly.

SMF16 and SMF17 — One Person or Two?

A key question for firms is whether the same individual can perform both functions.

The answer depends on the firm's regulatory status, structure, size and applicable requirements.

In some businesses, combining the roles may be appropriate.

In others, separating them may provide greater independence and clearer allocation of responsibilities.

What matters is that the firm's governance structure provides effective oversight and that the individuals performing the functions have the necessary authority, competence and resources.

The decision should therefore be based on the firm's actual regulatory and operational requirements rather than simply on organisational convenience.

Why Personal Responsibility Matters

The Senior Managers Regime changed the way accountability operates within regulated firms.

Senior managers are expected to understand the responsibilities allocated to them and to take reasonable steps to ensure that those responsibilities are properly discharged.

That makes the Statement of Responsibilities particularly important.

For an SMF16 or SMF17 holder, the document should clearly identify the responsibilities allocated to them.

This provides clarity for the individual, the firm and the regulator.

It also means that candidates considering an SMF16 or SMF17 position need to understand exactly what they are taking responsibility for.

The job title alone does not tell the whole story.

What Makes a Strong SMF16 Candidate?

A strong Compliance Oversight candidate needs more than technical knowledge of FCA rules.

They need the ability to operate at senior level.

That means being able to challenge management constructively, communicate regulatory issues clearly, prioritise risks and escalate matters when necessary.

They also need sufficient independence.

A compliance officer who is unable or unwilling to challenge commercial decisions when regulatory concerns arise cannot provide effective oversight.

For an SMF16 appointment, firms therefore need to consider judgement, experience, authority and the candidate's ability to operate effectively with the board and senior management.

What Makes a Strong SMF17 Candidate?

The MLRO role requires a different but overlapping skill set.

The candidate needs a strong understanding of financial crime risks and the firm's obligations around anti-money laundering and related controls.

They also need sound judgement.

An MLRO may have to assess complex information, determine whether concerns require escalation and ensure that appropriate action is taken.

Communication is equally important.

The MLRO may need to communicate difficult issues to senior executives and the board, while also working closely with compliance, legal, operations and other parts of the business.

Recruitment for SMF16 and SMF17

Recruiting for an SMF position is different from filling an ordinary compliance vacancy.

The question is not simply whether someone has worked in compliance or financial crime.

The firm needs to establish whether the individual is appropriate for the specific Senior Management Function being allocated to them.

That means considering their regulatory experience, leadership capability, technical knowledge, independence and understanding of the responsibilities they will personally hold.

It also means considering whether the proposed governance structure gives them enough authority to perform the role effectively.

What If a Firm Needs Temporary SMF Cover?

There are circumstances where a firm may need experienced regulatory leadership without immediately making a permanent appointment.

A senior manager may leave unexpectedly, take an extended period of absence, or the firm may need additional regulatory expertise during a period of change.

This is where fractional or interim SMF cover can be useful.

SMF Capital provides access to experienced senior regulatory professionals who can provide temporary or part-time leadership where appropriate.

You can find out more about this approach here:

https://www.smfcapital.co.uk/fractional-interim-smf-cover/

Fractional and interim arrangements can provide a business with experienced senior oversight while it considers its longer-term structure and recruitment requirements.

Why the Distinction Between Compliance and Financial Crime Matters

Although SMF16 and SMF17 can work closely together, compliance oversight and money laundering reporting are not identical responsibilities.

A firm's wider compliance framework covers a broad range of regulatory obligations.

The MLRO's focus is specifically connected with money laundering and financial crime responsibilities.

Understanding that distinction is important when designing the firm's governance structure and allocating Senior Management Functions.

It also helps ensure that Statements of Responsibilities accurately reflect what each senior manager is accountable for.

Final Thoughts

SMF16 and SMF17 are two functions where regulatory expertise, independence and personal accountability come together.

The Compliance Oversight function provides senior oversight of regulatory compliance, while the MLRO has specific responsibility for the firm's money laundering and financial crime framework.

For firms, appointing the right people is about more than finding technically qualified compliance professionals.

The individuals need the authority, experience and judgement to perform their responsibilities effectively — and the firm's governance structure needs to support them.

If you are reviewing your SMF structure, recruiting an SMF16 or SMF17, or considering temporary senior regulatory cover, specialist support can help.

Visit SMF Capital's SMF16 and SMF17 guide to explore the responsibilities in more detail, or learn about fractional and interim SMF cover if your firm needs experienced regulatory leadership on a temporary or part-time basis.

SMF Capital — specialist recruitment and senior management support for regulated businesses.

Today we're looking at SMF9 — the Chair function and what being the chair of a regulated financial services business actually involves under the Senior Managers and Certification Regime, or SMCR.

For many businesses, appointing a chair can initially appear straightforward.

Find an experienced board director, give them the chair's position and let them lead the board.

But within a regulated financial services firm, the role can involve much more.

The chair sits at the centre of the firm's governance structure and needs to ensure that the board is able to perform its oversight role effectively.

What Is SMF9?

SMF9 is the Chair function.

It forms part of the Senior Management Functions framework, although whether SMF9 applies depends on the firm's regulatory status and circumstances.

Where it applies, the chair isn't simply the person who runs board meetings.

The role carries specific responsibilities within the regulated firm's governance arrangements.

That means the appointment needs to be considered carefully alongside the CEO, CFO, risk, compliance and other relevant senior management functions.

The objective is to create a board where responsibilities are clear and effective challenge is possible.

What Does an SMF9 Chair Actually Do?

That can involve:

• Setting the agenda for board meetings
• Ensuring sufficient time is given to important issues
• Encouraging effective challenge
• Making sure directors receive appropriate information
• Supporting effective board decision-making
• Ensuring governance processes operate properly
• Helping the board maintain oversight of senior management

The precise responsibilities will depend on the firm's structure and regulatory requirements.

The Chair Is Not the CEO

One of the most important distinctions is between the chair and the Chief Executive.

The CEO is responsible for managing the business.

The chair leads the board.

Those are different responsibilities.

A strong chair should therefore avoid simply becoming another executive running the company.

Instead, the chair needs to ensure that the board is effectively overseeing management.

That includes challenging the CEO and other senior executives where appropriate.

For a regulated business, maintaining that distinction can be particularly important.

A board shouldn't simply approve everything put in front of it by management.

Directors should be able to ask difficult questions.

Why is the business taking this risk?

What evidence supports this decision?

What happens if the assumptions prove incorrect?

Are the controls adequate?

Does the proposed strategy remain appropriate as circumstances change?

The chair has an important role in ensuring that those questions can be asked and properly considered.

That doesn't mean the chair should dominate the discussion.

The objective is to create a board environment in which directors can contribute constructively and independently.

The Chair and the CEO

The relationship between the chair and CEO is therefore particularly important.

They need to work together effectively, but they also have different roles.

The CEO needs to be able to manage the business.

The chair needs to provide leadership to the board and ensure appropriate oversight.

A good chair should be able to support the CEO while also challenging them when necessary.

That balance can become particularly important during periods of rapid growth, financial pressure, regulatory change or strategic transformation.

SMF9 and FCA Authorisation

For businesses seeking FCA authorisation, governance is an important part of the overall application.

The regulator needs to understand how the proposed business will be governed.

Who will sit on the board?

Who will chair it?

Who will manage the business?

How will the board oversee senior management?

How will directors receive information?

How will challenge and accountability operate?

Where an SMF9 is applicable, the proposed chair therefore needs to be considered as part of the wider governance structure rather than as an appointment made at the last minute.

What Makes an Effective SMF9 Candidate?

A strong SMF9 candidate will normally need substantial board-level experience.

But experience alone isn't enough.

The individual needs to understand the responsibilities of a chair and be capable of operating independently from executive management.

Relevant considerations can include:

• Previous board and chair experience
• Experience in regulated financial services
• Understanding of corporate governance
• Ability to challenge senior management
• Strong communication skills
• Ability to manage difficult board discussions
• Understanding of risk and regulatory responsibilities
• Ability to maintain appropriate independence

The precise requirements will depend on the firm.

A chair for a small fintech may have a different background from a chair of a large established financial institution.

The Chair and the Board

The chair also needs to think about the board as a whole.

Does it contain the appropriate range of experience?

Are directors asking sufficiently challenging questions?

Does the board understand the firm's principal risks?

Are important regulatory matters being given sufficient attention?

Does the board have enough information to make informed decisions?

These are all questions that can fall within the broader responsibilities of effective board leadership.

The Chair and Risk

The relationship between the chair and the firm's risk function is also important.

The board needs to understand the firm's principal risks and how management is addressing them.

The chair should ensure that risk isn't treated as a technical issue that is simply delegated to the Chief Risk Officer.

Instead, the board as a whole needs to understand the significant risks facing the business.

This is particularly important where the firm is growing rapidly or entering new markets.

Statements of Responsibilities

As with other Senior Management Functions, responsibilities need to be clearly defined.

The Statement of Responsibilities should reflect what the SMF9 holder is actually responsible for.

For the chair, this can include responsibilities associated with effective board leadership, governance and oversight.

The document should fit within the firm's wider governance framework rather than existing as a standalone regulatory document.

Does Every Firm Need an SMF9?

Not necessarily.

The Senior Management Functions that apply depend on the firm's regulatory status, activities and circumstances.

Businesses shouldn't simply copy the governance structure of another firm.

A large financial institution may require a substantially different board structure from a smaller regulated fintech.

The appropriate structure should reflect the firm's own circumstances and regulatory requirements.

For an overview of the different Senior Management Functions, see our SMF Designations: A Complete Guide.

Recruiting an SMF9 Chair

Recruiting a chair is therefore different from recruiting a conventional non-executive director.

The individual needs to be capable of leading the board while maintaining appropriate independence from executive management.

The recruitment process should consider:

• Board leadership experience
• Relevant regulatory experience
• Governance knowledge
• Independence
• Ability to challenge constructively
• Understanding of risk
• Experience working with senior executives
• Ability to lead difficult discussions

The right profile will depend on the firm's size, complexity and regulatory environment.

Where to Find Out More

If you're considering an SMF9 appointment, we've produced a dedicated guide:

SMF9: The Chair's Job Under SMCR

The guide looks in more detail at what the FCA's Chair function involves and the responsibilities associated with the role.

For the wider picture, see our SMF Designations: A Complete Guide.

Closing

So, what makes an effective SMF9 chair?

It isn't simply the ability to run a board meeting.

The chair needs to provide effective board leadership, encourage constructive challenge, oversee governance and ensure that the board can properly hold senior management to account.

For a regulated business, the chair can therefore be a central part of the governance framework.

If you're researching SMF9, read SMF9: The Chair's Job Under SMCR.

And for the wider framework, see our complete guide to SMF designations.

You can also visit SMF Capital to find out more about senior management recruitment and support for regulated businesses.

That's all for this episode of the SMF Capital Podcast.

Thanks for listening.

Welcome to the SMF Capital Podcast.

Today we're looking at SMF4 — the Chief Risk function and why the Chief Risk Officer can play such an important role in the governance of a regulated financial services business.

Risk management matters to every business, but in a regulated firm the board needs to understand its principal risks, how those risks are changing and whether the controls designed to manage them are working effectively.

That's where the Chief Risk Officer can become particularly important.

What Is SMF4?

SMF4 is the Chief Risk function.

It forms part of the Senior Management Functions framework, although whether an SMF4 is required depends on the type and regulatory status of the firm.

Where the function applies, the individual isn't simply a conventional risk manager. They have specific senior management responsibilities within a regulated organisation.

That makes the appointment an important part of the firm's governance structure.

The CRO also needs to work effectively alongside other Senior Management Functions, including the CEO, CFO, Compliance Oversight and, where applicable, the MLRO.

The objective isn't simply to create a collection of senior job titles. It is to establish clear responsibility and accountability.

What Does a Chief Risk Officer Actually Do?

The Chief Risk Officer provides senior oversight of the risks facing the business.

Depending on the firm, this can include:

• Financial risk
• Operational risk
• Conduct risk
• Technology and cyber risk
• Liquidity risk
• Credit risk
• Regulatory risk
• Strategic risk
• Third-party and outsourcing risk
• Business continuity and resilience

The exact risk profile depends on the firm's activities.

A payments business may face very different risks from an investment firm or another type of financial services business.

That's why the right SMF4 candidate needs to understand the firm's particular risk environment.

The CRO Needs to Be Heard by the Board

One of the most important aspects of the role is the ability to communicate risk directly and clearly to the board.

A CRO shouldn't simply produce a monthly risk report.

They need sufficient standing to challenge management where appropriate.

Imagine a commercial team wants to launch a new product quickly. The opportunity looks attractive, but the CRO identifies significant operational, technology or regulatory risks.

The purpose of the risk function isn't necessarily to stop the business taking risks. Businesses need to take risks to grow.

The purpose is to ensure those risks are identified, understood and appropriately managed.

That requires a CRO who can provide constructive challenge while understanding the commercial objectives of the business.

Why Independence Matters

A CRO needs enough independence to raise concerns when necessary.

If the person responsible for risk feels unable to challenge the commercial leadership team, the value of the function can be significantly reduced.

The CRO therefore needs to be sufficiently close to the business to understand what is happening, while retaining the ability to challenge decisions.

This becomes particularly important in rapidly growing fintech and financial services businesses, where the risk profile can change quickly as new products, customers, markets and technology are introduced.

SMF4 and FCA Authorisation

For businesses seeking FCA authorisation, the question isn't simply whether the company has a risk policy.

The regulator also needs to understand the governance arrangements surrounding the business.

Who has responsibility for risk?

How are risks identified and monitored?

Who reports to the board?

How are material risks escalated?

Who can challenge senior management?

And how does risk management interact with compliance and finance?

These are governance questions as much as risk questions.

Where SMF4 applies, the appointment should therefore be considered as part of the wider authorisation and governance strategy.

What Makes a Good SMF4 Candidate?

When recruiting a Chief Risk Officer, businesses should consider several areas.

Relevant risk experience: Does the candidate understand the risks associated with the firm's activities?

Regulatory experience: Have they operated within a regulated financial services environment?

Board-level communication: Can they explain complex risks clearly to directors and senior management?

Independence and challenge: Are they comfortable questioning decisions and escalating concerns?

Commercial understanding: Can they balance effective risk management with an understanding of the firm's commercial objectives?

The balance will vary between businesses.

A rapidly growing fintech may require a very different CRO profile from a large established financial institution.

Risk Management and Compliance

Risk management and compliance are closely connected, but they aren't necessarily the same function.

Compliance focuses heavily on meeting applicable laws, regulations and regulatory expectations.

Risk management takes a broader view of the risks facing the organisation and how those risks are identified, assessed, controlled and monitored.

There can be areas of overlap, but a well-designed governance structure should establish clear responsibilities and effective communication between the functions.

The CRO and CFO

The relationship between the CRO and CFO can also be important.

Financial decisions can create risk, while risk decisions can have financial consequences.

Changes to capital allocation, liquidity management, lending strategy or investment strategy can affect both the firm's financial position and its risk profile.

The CFO and CRO therefore need to work together while retaining clarity around their respective responsibilities.

Statements of Responsibilities

The responsibilities of an SMF4 also need to be clearly defined.

A Statement of Responsibilities should reflect what the individual is actually responsible for within the organisation.

That means understanding:

• Who owns particular risks
• Who monitors them
• Who escalates them
• Who reports them to the board
• Who has authority to challenge management

The answers should make sense within the firm's overall governance structure.

Does Every Business Need an SMF4?

Not necessarily.

The applicable Senior Management Functions depend on the firm's regulatory status, activities and circumstances.

Businesses shouldn't simply copy another company's governance structure.

A structure appropriate for a large financial institution may be excessive for a smaller fintech, while a structure designed for a small start-up may become inadequate as the business grows.

The right approach is to understand the applicable requirements and design the governance structure around the actual business.

For an overview of the different Senior Management Functions, see our SMF Designations: A Complete Guide.

Recruiting an SMF4

Recruiting a Chief Risk Officer is about much more than finding somebody with "risk" on their CV.

The recruitment process should consider:

• The firm's regulatory status
• Its business model and principal risks
• The required governance structure
• The candidate's regulatory experience
• Technical risk expertise
• Board experience
• Ability to challenge senior management
• Ability to communicate complex issues clearly

The right balance depends on the individual firm's circumstances.

The CRO and Risk Culture

The CRO can also play an important role in developing the firm's risk culture.

Where to Find Out More

If you're considering an SMF4 appointment, we've produced a dedicated guide:

SMF4: The Chief Risk Officer the Board Needs to Hear From

It looks specifically at the SMF4 role and the considerations involved in appointing a Chief Risk Officer within a regulated financial services business.

For the wider picture, see our SMF Designations: A Complete Guide.

Closing

So, what makes an effective SMF4?

It's not simply someone who can produce a risk register.

The Chief Risk Officer needs to understand the firm's risks, communicate them effectively, provide appropriate challenge and have the credibility to ensure important risk issues reach the board.

For a regulated business, that makes the CRO an important part of the overall governance structure.

If you're researching SMF4, read The Chief Risk Officer the Board Needs to Hear From.

And for the wider framework, see our complete guide to SMF designations.

You can also visit SMF Capital to find out more about senior management recruitment and support for regulated businesses.

That's all for this episode of the SMF Capital Podcast.

Thanks for listening.

Welcome to the SMF Capital Podcast.

Today we're looking at SMF2 — the Chief Finance function and why appointing a CFO to a regulated financial services business can involve considerably more than finding someone with a strong conventional finance background.

For an ordinary commercial company, you might think of the CFO primarily as the person responsible for financial reporting, budgeting, forecasting, cash management and financial strategy.

Those responsibilities remain important in a regulated business.

But when a CFO also holds a regulated Senior Management Function, the role takes on an additional dimension.

The individual needs to understand the financial requirements of the regulated business, the firm's governance arrangements and the responsibilities associated with the SMF2 designation.

So today we're going to look at what SMF2 actually means, what businesses should consider when appointing an SMF2, and why regulatory experience can be just as important as conventional CFO experience.

What Is SMF2?

Let's start with the basics.

SMF2 is the Chief Finance function.

It is one of the Senior Management Functions within the FCA's regulatory framework, with the precise applicability depending on the type of regulated firm and its circumstances.

The important point is that an SMF2 isn't simply another name for a Finance Director or CFO.

The person taking on the function carries specific senior management responsibilities within the regulated firm.

That means the business needs to think carefully about who is going to perform the role and whether that individual has the appropriate experience and competence.

It should also ask:

"Has this person operated in an environment where financial management and regulatory requirements are closely connected?"

That distinction can be extremely important.

The Difference Between a Commercial CFO and a Regulated CFO

Consider two candidates.

The first has spent fifteen years as CFO of rapidly growing technology companies.

They have extensive experience in fundraising, budgeting, M&A, cash flow management and working with investors.

The second has spent ten years as a finance director or CFO within regulated financial services.

They may have less experience of some of the high-growth commercial activities of the first candidate.

But they may have significantly more experience dealing with regulatory reporting, capital requirements, governance and financial controls within a regulated environment.

Neither background automatically makes somebody suitable or unsuitable for SMF2.

The key issue is the requirements of the particular role and the experience of the individual against those requirements.

That's why regulated CFO recruitment needs to be approached differently from a conventional CFO search.

The ideal profile therefore depends heavily on the firm's business model.

There isn't one universal SMF2 candidate profile.

SMF2 and the Wider Senior Management Team

The CFO doesn't operate independently.

In a regulated business, the SMF2 needs to work effectively with the other senior management functions.

That might include the CEO, Compliance Oversight, the Money Laundering Reporting Officer and other relevant senior managers.

The boundaries between those responsibilities need to be understood.

Who makes the commercial decisions?

Who has financial oversight?

Who has compliance responsibility?

Who is responsible for financial crime?

Who reports to the board?

And where do those responsibilities overlap?

A well-designed governance structure should make those relationships clear.

Statements of Responsibilities

This brings us to another important part of the process: Statements of Responsibilities.

The responsibilities of an SMF2 should be clearly defined.

The document shouldn't simply be treated as a regulatory formality.

It should reflect the actual responsibilities the CFO will have within the organisation.

For example, if the CFO is responsible for certain financial controls, reporting or regulatory financial matters, those responsibilities need to be properly understood and documented.

The objective is to create a governance structure in which everybody knows who is responsible for what.

That's particularly important as a regulated business grows.

Can an SMF2 Be Fractional or Interim?

Another question we often encounter is whether an SMF2 has to be a permanent, full-time appointment from day one.

The answer depends on the firm's circumstances and regulatory requirements.

For some businesses, a fractional or interim senior finance professional may be appropriate during a particular stage of development.

A growing fintech, for example, may not initially require a full-time CFO but may still need experienced senior financial leadership.

However, the fact that an appointment is fractional doesn't remove the importance of finding someone with the appropriate experience and capability.

The responsibilities of the role still need to be properly managed.

And the proposed arrangement needs to work within the firm's regulatory framework.

Finding an SMF2

So what should you look for when recruiting an SMF2?

There are several areas worth considering.

First, financial leadership experience.

Has the candidate operated at CFO or equivalent senior level?

Second, regulated financial services experience.

Have they worked within a regulatory environment relevant to the firm's activities?

Third, technical financial capability.

Do they understand the financial and reporting requirements associated with the business?

Fourth, governance experience.

Have they worked effectively with boards and other senior management functions?

And finally, commercial judgement.

Can they operate as a strategic CFO rather than simply as a technical finance specialist?

The balance between these factors will depend on the individual firm's requirements.

SMF2 Is More Than a Job Title

This is perhaps the most important point from today's episode.

SMF2 shouldn't be treated as simply another label for the CFO.

The role sits within the firm's regulated governance structure.

That means the appointment needs to be considered in the context of:

the business model, the regulatory permissions, the firm's financial requirements, the governance structure and the individual's experience.

A strong CFO in an unregulated business isn't automatically the right SMF2 for a regulated business.

And equally, someone with regulatory experience isn't automatically the right choice simply because they've worked in financial services.

The right appointment depends on the actual requirements of the firm.

Where to Find Out More

If you're considering an SMF2 appointment, we've created a dedicated guide:

SMF2: Why a Regulated CFO Needs More Than a Finance Background

The guide looks specifically at SMF2 and the recruitment considerations surrounding a regulated CFO.

SMF2 is also part of the wider framework of Senior Management Functions.

If you're trying to understand which designations may apply to your business, our SMF Designations: A Complete Guide provides a broader overview of the different Senior Management Functions.

Understanding the wider framework can be useful before you start recruiting individual senior managers.

How SMF Capital Can Help

For businesses preparing for FCA authorisation or reviewing their existing senior management structure, the starting point should be the regulatory requirements and the firm's actual needs.

The recruitment process can then be built around those requirements.

That means identifying the responsibilities associated with the role, defining the experience required and searching for individuals whose backgrounds are genuinely relevant.

Rather than simply asking:

"Where can we find a CFO?"

the better question is:

"What type of CFO does this regulated business actually need?"

That distinction can make a significant difference to the recruitment process.

Closing

So, what does it take to be an SMF2?

It's more than having the word CFO on your CV.

The role requires consideration of financial leadership, regulatory experience, technical capability, governance and the particular requirements of the regulated business.

For firms preparing for FCA authorisation, SMF2 should be considered as part of the wider senior management and governance structure rather than as an isolated recruitment exercise.

If you're researching the role, read our dedicated guide on SMF2 and regulated CFO recruitment.

And for the wider picture, see our complete guide to SMF designations.

You can also visit SMF Capital to find out more about senior management recruitment and support for regulated businesses.

That's all for this episode of the SMF Capital Podcast.

Thanks for listening.

Let's take a closer look at one of the most important senior management functions: SMF1, the Chief Executive function.

For many businesses seeking FCA authorisation, the CEO is going to be central to the proposed governance structure.

But becoming the CEO of a regulated business is different from simply becoming the CEO of an ordinary commercial company.

An SMF1 holder has a specific senior management responsibility within the regulated firm, and the individual needs to be approved to perform that function where the regulatory regime requires it.

So what does the regulator want to see?

Again, it's not simply about having an impressive job title.

The individual's previous experience, competence, responsibilities and understanding of the regulated environment all become relevant.

A successful commercial entrepreneur, for example, may have excellent experience building a business, but that doesn't automatically mean they have the regulatory experience required for a particular SMF1 role.

Equally, someone who has spent years in a regulated financial services environment may have extensive regulatory knowledge but a different type of leadership experience.

The important question is whether the individual's overall experience is appropriate for the role they are being proposed for.

We've put together a dedicated guide explaining SMF1: What It Takes to Be Approved as a Regulated CEO.

It's particularly useful for founders and senior executives who are moving from an unregulated business environment into a regulated financial services business.

And SMF1 is only one part of the wider framework.

There are a number of different SMF designations covered by the FCA regime, with the appropriate requirements depending on the type of firm, its activities and its governance structure.

That's why SMF planning shouldn't start with individual job titles.

It should start with the proposed regulated business.

What permissions are being sought?

What activities will the firm undertake?

What governance structure is being proposed?

Which senior management functions apply?

And who has the appropriate experience to take responsibility for each of them?

Once those questions have been answered, the recruitment process becomes much more targeted.

And for a new regulated business, getting that structure right at the beginning can be considerably more straightforward than trying to redesign it shortly before an FCA application is submitted.

There's another important part of the authorisation process that shouldn't be overlooked: the Fit and Proper Test.

Identifying somebody for an SMF position is only part of the process.

The regulator also needs to consider whether the individual is fit and proper to perform the role.

So what does that actually mean?

At a practical level, the assessment considers whether the individual has the appropriate honesty, integrity and reputation, competence and capability, and financial soundness, as applicable to the relevant regulatory requirements.

That means the recruitment process shouldn't simply ask:

"Does this person have the right job title on their CV?"

It should ask:

"Can this individual demonstrate the experience, competence and personal suitability required for the role they're being proposed for?"

This is particularly important when you're building an SMF team for a new regulated business.

A candidate might have extensive experience in financial services, but that doesn't automatically mean they are the right person for every SMF role.

Their previous responsibilities, regulatory experience, technical knowledge and the relevance of their background all need to be considered in the context of the proposed position.

We've produced a detailed guide explaining the Fit and Proper Test and what it means for regulatory approval.

It's worth understanding this before starting the recruitment process, because it changes the question from simply finding a senior executive to finding someone who is appropriate for a specific regulated responsibility.

Recruitment and Regulatory Approval

This is where the connection between recruitment and authorisation becomes particularly important.

If you're recruiting an SMF16, SMF17, chair or another senior regulated individual, you're not simply filling a vacancy.

You're potentially identifying an individual whose appointment forms part of your regulatory application and governance structure.

That means the recruitment process needs to consider the regulatory requirements from the beginning.

At SMF Capital, our SMF Recruitment Services are designed to help firms identify senior financial services professionals for regulated and senior management positions.

The objective is to combine the recruitment requirement with an understanding of the regulatory environment in which the individual will operate.

So rather than starting with a generic job description and then looking for candidates, the process can start with the firm's regulatory requirements, governance structure and the responsibilities attached to the role.

That can help create a much more focused search for the right senior individual.

Welcome to the SMF Capital Podcast.

Today we're looking at an issue that can make a significant difference to the FCA authorisation process: when and how you build your Senior Management Function team.

If you're a fintech, payments business, cryptoasset firm or another business preparing for FCA authorisation, it's tempting to concentrate first on the business plan, technology, commercial proposition and customer proposition — and then deal with the senior management structure towards the end.

But that can create a problem.

Because FCA authorisation isn't simply about whether your business model looks good on paper. The FCA also needs to understand who is actually going to run the regulated business, who is responsible for key functions, and whether those individuals have the appropriate experience and accountability.

That's where SMF Capital's authorisation support comes in.

Why SMF planning needs to start early

One of the biggest mistakes we see is treating SMF recruitment as something that happens immediately before an application is submitted.

In reality, the senior management structure should be considered much earlier.

You need to understand which SMF designations apply to your particular firm, which individuals will take responsibility for key functions, how those responsibilities fit together and whether the proposed structure is proportionate to the firm's activities and regulatory permissions.

For many firms, this will include functions such as SMF16 — Compliance Oversight and SMF17 — Money Laundering Reporting Officer, depending on the firm's regulatory structure and activities.

And for businesses operating in areas such as payments, e-money or cryptoassets, the quality and relevance of that experience can be particularly important.

The question isn't simply:

"Can we find somebody with an SMF16 or SMF17 title?"

The more important question is:

"Does this person have the right experience for our particular business, risk profile and regulatory environment?"

That's a very different recruitment exercise.

The importance of sequencing

Let's take a typical example.

Imagine you're building a fintech business and you've already recruited your commercial leadership team.

You've got the technology team.

You've developed your product.

You've prepared your business plan.

You're getting closer to submitting your FCA application.

Then somebody asks:

"Who is our SMF16?"

And:

"Who is our SMF17?"

If the answer is that you're going to start looking for those people now, you may have left an important part of the process rather late.

Instead, the better approach is to work backwards from the intended authorisation timetable.

What is the target submission date?

Which SMF roles are required?

Which individuals need to be identified?

Which people need to be permanent appointments?

Where could fractional or interim expertise provide appropriate cover?

And how should the responsibilities of those individuals be reflected in the governance documentation?

That sequencing is one of the key areas where specialist SMF recruitment support can add value.

Finding the right SMF16

Let's start with Compliance Oversight.

An SMF16 isn't simply a compliance job with a more senior title.

The individual needs to be appropriate for the firm's business model and regulatory permissions.

For example, the compliance requirements and risks associated with a payments business can be very different from those of another type of regulated firm.

So the recruitment process needs to look at the individual's actual experience.

Have they worked in a comparable regulated environment?

Have they dealt with the types of regulatory permissions you're applying for?

Do they understand the risks inherent in your business model?

And can they operate effectively within the governance structure you're proposing?

These are much more useful questions than simply searching a database for somebody whose CV contains the words "SMF16".

Finding the right SMF17

The same principle applies to the Money Laundering Reporting Officer.

For businesses with significant financial crime exposure, particularly payments, e-money and cryptoasset businesses, experience needs to be relevant to the firm's actual risk environment.

A generic AML background isn't necessarily the same thing as experience managing financial crime risk within a comparable regulated business.

The objective should therefore be to identify an SMF17 candidate whose experience makes sense in the context of the application you're putting in front of the FCA.

Again, it's about fit rather than simply filling a box.

What about the board?

The SMF structure doesn't exist in isolation.

Depending on the firm's size, activities and regulatory requirements, the wider board and governance structure may also need careful consideration.

That can include the chair, independent non-executive directors and other senior appointments.

This is particularly important where the business is moving from an entrepreneurial start-up structure towards a properly governed regulated firm.

The question becomes:

Does the proposed board structure demonstrate that the firm understands the responsibilities that come with being regulated?

And if an experienced board-level appointment is required, that appointment may need to happen well before the authorisation submission rather than being left until after authorisation.

Statements of Responsibilities

Another area that deserves attention is the Statement of Responsibilities.

These shouldn't simply be treated as documents that need to be completed because the application form requires them.

They should reflect the actual governance structure of the business.

Who is responsible for what?

Where do responsibilities begin and end?

How do the different SMF roles interact?

Who has oversight?

And does the overall structure make sense?

A generic template can produce a document that technically looks complete but doesn't necessarily demonstrate that the firm's governance has been properly thought through.

The documentation should reflect the organisation you're actually building.

Do you need full-time SMFs immediately?

Not necessarily.

This is another area where the recruitment model has changed considerably.

For some firms, a fractional or interim SMF16 or SMF17 can make sense during the authorisation process and the early months of trading.

It can provide specialist expertise while the business is still developing its operational scale.

Then, as the firm grows, the role can transition to a permanent full-time appointment when the volume and complexity of the business justify it.

The important point is that the individual should have genuine experience of the authorisation environment.

There is a difference between somebody who has spent years running an established compliance function and somebody who understands what it takes to help build that function as part of an FCA authorisation process.

Working backwards from your submission date

So if you're currently preparing for FCA authorisation, here's a useful exercise.

Take your intended submission date.

Work backwards.

Identify the SMF designations your firm is likely to require.

Determine which individuals need to be appointed or identified.

Assess whether those individuals have genuinely relevant experience.

Consider whether any roles should initially be fractional or interim.

Then make sure the governance structure and Statements of Responsibilities reflect the organisation you're actually proposing.

This turns SMF recruitment from a last-minute exercise into part of the authorisation strategy.

How SMF Capital can help

That's precisely where SMF Capital's SMF Authorisation Support service is designed to help.

We work with firms preparing for authorisation — particularly in fintech, payments and cryptoassets — to identify and build the senior management structure required ahead of submission.

That can include:

• Identifying appropriate SMF16 candidates
• Identifying SMF17 and MLRO candidates
• Reviewing the wider board and chair requirements
• Helping structure Statements of Responsibilities
• Identifying fractional and interim SMF solutions
• Planning the recruitment sequence around the FCA submission timetable

The approach starts with the business model and the intended authorisation timeline.

Then we work backwards.

The objective isn't simply to fill individual vacancies.

It's to build a credible senior management structure that makes sense for the regulated business you're trying to create.

Closing

If you're preparing an FCA authorisation application and you're wondering when you should start building your SMF team, the answer is: earlier than many businesses think.

You can find out more about SMF Capital's SMF Authorisation Support service at:

https://www.smfcapital.co.uk/smf-authorisation-support/

And if you already have a target FCA submission date, SMF Capital can work backwards from that date to help determine the senior management recruitment sequence.

That's all for this episode of the SMF Capital Podcast.

Thanks for listening.

Welcome to today’s episode, where we’re looking at an important subject for anyone dealing with investments, financial planning or regulated financial services: what does FCA regulation actually mean, and why does it matter?

The financial services industry uses a lot of terminology — FCA authorised, FCA regulated, appointed representative, financial adviser, investment advice and financial promotion.

But what do these terms actually mean?

And perhaps more importantly, how can individuals and business owners make sure they are dealing with the right type of financial professional?

Today, we’ll explore those questions and introduce SMF Capital, a specialist financial services business that can help clients navigate this area.

What is the FCA?

Let’s start with the FCA.

The Financial Conduct Authority, commonly known as the FCA, is the UK regulator responsible for regulating financial markets and financial services firms.

Its role includes regulating the conduct of firms and helping ensure that financial markets operate with appropriate standards of integrity and consumer protection.

This is particularly important because financial products and services can involve significant sums of money and, in some circumstances, significant investment risk.

Being able to establish whether a firm or individual is appropriately authorised is therefore an important part of choosing a financial services provider.

What does "FCA regulated" actually mean?

You will often hear businesses describe themselves as "FCA regulated".

However, it is worth being precise about the terminology.

A firm may be authorised and regulated by the FCA, while individuals working within financial services may have different regulatory statuses depending on their role and the activities they undertake.

There are also businesses that operate as appointed representatives of authorised firms.

So rather than relying simply on a phrase appearing on a website, clients should consider checking the firm's regulatory status and understanding what regulated activities it is authorised to undertake.

That distinction matters.

FCA regulation isn't simply a marketing badge. It relates to the activities a firm is permitted to conduct and the regulatory framework within which it operates.

Why does this matter to clients?

For a client, understanding the regulatory position of a financial services business can provide an important starting point when assessing who they are dealing with.

It can also help clients ask better questions.

For example:

• Is the firm authorised by the FCA?
• What activities is it authorised to undertake?
• Who will actually provide the advice?
• Is the service regulated?
• What fees will be charged?
• What risks are involved?
• What happens if something goes wrong?
• What protections or complaints procedures apply?

These are sensible questions whenever you are considering a financial service.

Financial advice versus financial information

Another important distinction is between financial information and regulated financial advice.

There is a huge amount of financial information available online.

You can read about pensions, investments, ISAs, tax planning, markets and financial products within seconds.

But information isn't necessarily personalised advice.

Financial advice considers an individual's or business's circumstances, objectives, risk tolerance and other relevant factors.

That distinction is particularly important when dealing with investments or other regulated financial products.

Why specialist expertise matters

Financial services can become complicated very quickly.

A business owner might be thinking about investments, retirement planning, company finances or longer-term wealth management.

An individual may be considering pensions, investments or how to structure their financial affairs.

In each case, the appropriate solution depends on the circumstances.

That is why working with experienced professionals and understanding exactly what service is being provided is so important.

Introducing SMF Capital

This brings us to SMF Capital, we are a niche recruitment service aimed at recruiting suitable staff for an FCA regulated business.

https://www.smfcapital.co.uk/

That's all for today's episode.

Thanks for listening, and we'll be back soon with another discussion about the UK financial services industry, financial advice and the issues affecting businesses and investors today.