How to designate formal sm&cr roles (smf16 and smf17)

To comply with the Financial Conduct Authority (FCA) requirements, you must formally assign the roles of Compliance Oversight (SMF16) and Money Laundering Reporting Officer (SMF17) to specific individuals within your firm. This process involves more than just a job title; it requires a formal "Statement of Responsibilities" (SoR) that outlines exactly what the individual is accountable for. Under the Senior Managers and Certification Regime (SM&CR), these individuals are personally liable for regulatory failings in their areas, meaning they must take "reasonable steps" to prevent breaches.

Understanding the SMF16 and SMF17 functions

In the eyes of the regulator, these two functions are the pillars of a safe and compliant fintech business:

• SMF16 (Compliance Oversight): This individual is responsible for ensuring the firm complies with all relevant FCA rules and regulations. They oversee the firm’s relationship with the regulator and ensure internal policies are being followed.
• SMF17 (Money Laundering Reporting Officer): Commonly known as the MLRO, this person is the final point of contact for all anti-money laundering (AML) and counter-terrorism financing (CTF) issues. They are responsible for reporting suspicious activity to the National Crime Agency (NCA) and ensuring your AML systems are robust.

Creating the Statement of Responsibilities (SoR)

Every Senior Manager must have an SoR. This is a single, clear document that states what the manager is responsible for. When designating these roles, the SoR should be specific, not vague. It must allow anyone reading it to understand exactly what the manager is accountable for without having to look at other documents.

Best practice: Use the FCA's standard template for SoRs. Avoid using generic job descriptions; instead, list the specific business areas or regulatory requirements the SMF16 or SMF17 holder will manage.

The "Duty of Responsibility"

One of the most important aspects of designating these roles is ensuring the individuals understand the Duty of Responsibility. This is a legal standard under the SM&CR. If a firm breaches a regulatory requirement, the Senior Manager responsible for that area can be held personally accountable by the FCA.

The FCA can take action against a Senior Manager if they failed to take "reasonable steps" to prevent a breach from occurring or continuing.

Steps to formalise the designation

1. Define the scope: Clearly map out which parts of the business fall under the Compliance Oversight and MLRO functions.
2. Draft the Statement of Responsibilities: Work with the candidates to ensure the document accurately reflects their daily authority and tasks.
3. Internal Board Approval: Ensure the board (or the founder team) formally approves these designations and records this in meeting minutes.
4. Induction and Training: Provide the designated managers with specific training on their personal liability under SM&CR. They must understand that "I didn't know" is rarely an acceptable defence to the regulator.

Independence and Authority

For these roles to be effective, the individuals designated must have sufficient authority and independence. The SMF16 and SMF17 holders should have a direct line to the board and the power to challenge business decisions that might put compliance at risk. In very small startups, the founder often takes on these roles, but as the business grows, it is standard practice to delegate these to qualified compliance professionals.