We work with FCA-regulated firms across investment management, payments, consumer credit and wealth every week, placing candidates into exactly these functions. The question we get asked most often — by both firms and candidates — is not “what does the role involve” but “what actually happens if it goes wrong.” This article sets out the honest answer, drawing on real FCA enforcement outcomes rather than theoretical risk.

What the Senior Managers and Certification Regime Actually Changed

Before the Senior Managers and Certification Regime (SM&CR) came into force, regulatory accountability for a firm’s failings sat primarily with the firm itself. Individuals could be swept up in enforcement action, but establishing personal culpability required the regulator to build a case against a specific person’s conduct — often a slow and evidentially difficult process.

SM&CR inverted that dynamic for the most senior roles. Anyone approved to hold a Senior Management Function takes on a statutory Duty of Responsibility. If a regulatory breach occurs within their area of accountability, the burden shifts: the FCA does not need to prove the individual caused the failure. Instead, the individual has to be able to show they took reasonable steps to prevent it, identify it, or stop it continuing. That is a meaningfully different starting position from ordinary employment or even ordinary directorship.

This applies across the full range of Senior Management Functions — not just the compliance-specific ones. SMF1 (Chief Executive), SMF3 (Executive Director), SMF9 (Chairman), SMF16 (Compliance Oversight), SMF17 (Money Laundering Reporting Officer), SMF2 (Chief Finance), and the others each carry their own Statement of Responsibilities, and each holder is personally on the hook for their own area.

The Mechanics of Personal Accountability

A few structural features make SMF liability different from ordinary senior employment:

Personal FCA approval. A firm cannot simply appoint someone to a Senior Management Function. It submits a Form A application, and the individual is vetted and approved by the FCA before they can perform the role. Once approved, their name appears on the FCA’s public register, searchable by clients, counterparties, journalists and future employers alike.

A Statement of Responsibilities. Each SMF holder must have a current, written statement setting out precisely what they are accountable for. This is not internal housekeeping — the FCA can and does request these documents as part of supervisory work, and they form the reference point in any subsequent investigation.

Ongoing certification, not a one-off check. Firms must recertify annually that each SMF holder remains fit and proper. This sits alongside the FCA Conduct Rules, which apply to the individual at all times, not just during a live incident.

Enforcement can outlast the job. The FCA can and does take action against former SMF holders years after they have left a firm, as the cases below show. Moving on does not close the exposure.

What Enforcement Actually Looks Like: Real Cases

The theoretical exposure is significant, but it is worth being precise about how often it actually crystallises, and what it looks like when it does. Individual SMF enforcement cases are genuinely uncommon — but when they happen, the consequences are severe and the reasoning is instructive for anyone stepping into one of these roles.

Steven Smith — MLRO and Compliance Oversight, Sonali Bank (UK). FCA Final Notice, 12 October 2016. The FCA fined Smith £17,900 and prohibited him from ever again performing the MLRO or compliance oversight functions at a regulated firm — a prohibition explicitly extended to cover the equivalent SMF16 and SMF17 functions under the newer regime. What makes this case instructive is what the FCA did, and did not, accept as mitigation. The regulator acknowledged that Smith did not have sufficient senior management support and was overworked. That context reduced the outcome, but did not prevent it: the FCA still found his failings serious in their own right, because he had not taken any of the steps available to an MLRO in that position — escalating concerns to senior management, to the board or relevant committees, to internal audit, through his own annual MLRO report, or directly and confidentially to the FCA itself. Being under-resourced was not, on its own, a defence to failing to escalate. The bank itself was fined £3.25 million separately for the underlying AML systems failings.

David Brian Price — Executive Director and MLRO, CFP Management. FCA Decision Notice, 2023. Price received a financial penalty, a prohibition order, and withdrawal of his approvals. Note this is a decision notice rather than a final notice — procedurally, that means it reflects the FCA’s determination at that stage and can still be referred to the Upper Tribunal, rather than representing a fully concluded matter in the way a final notice does. The FCA’s finding centred on a failure to act with integrity in ensuring a pension transfer model complied with regulatory requirements, with his conduct assessed as reckless rather than merely negligent. Industry commentary at the time noted this was the first individual MLRO enforcement action since the Sonali Bank case nearly a decade earlier, underlining how rare — but how serious — these actions are.

The Trend Line Is Moving in One Direction

Individual cases remain infrequent in absolute terms, but the direction of travel matters more than the historical base rate. In the FCA’s most recent enforcement year, penalties imposed on individuals more than tripled compared to the prior year, and total fines across all enforcement action rose from roughly £38 million to somewhere between £179 million and £186 million. The majority of cases concerned financial crime, deficiencies in anti-money laundering controls, and governance failures — precisely the territory SMF16 and SMF17 holders are personally accountable for.

The FCA has also broadened its toolkit beyond fines: greater use of interventions, authorisation revocations, and other supervisory powers means a firm — and its senior managers — can face serious consequences well before a case reaches formal enforcement and a final notice. Firms under active supervision commonly see voluntary or imposed requirements long before anything becomes public, and named senior managers are the individuals whose conduct and competence come under scrutiny throughout that process.

Why the Fine Is Rarely the Real Penalty

Set against corporate fines running into the tens or hundreds of millions, a £17,900 personal fine can look almost incidental. It is not the number that matters. The prohibition order is the real consequence: a permanent, publicly searchable bar from ever again performing a Senior Management Function at any FCA-regulated firm. For a qualified accountant, compliance professional or executive who has built a career in regulated financial services, that is not a career setback — it is a career ending event in that sector.

This is precisely why candidates who are genuinely qualified to hold SMF16 or SMF17 — people with real, hands-on experience of client money reconciliation, AML frameworks and regulatory reporting — price this risk into what they will accept. A firm advertising one of these functions as a standard management role, without reflecting the personal exposure in the compensation and support structure around it, will struggle to attract someone senior enough to actually carry it well.

Structural Risk Factors Firms Should Address

A handful of structural issues come up repeatedly in FCA findings and in our own conversations with clients building out SMF-holding roles:

Self-review conflicts. Where the same individual prepares financial or compliance information and then signs off on its adequacy in an oversight capacity, that person has a materially harder job demonstrating “reasonable steps” if something goes wrong later. Firms taking on this structure — often unavoidable in smaller regulated businesses — should document how the conflict is managed, for example through an external compliance reviewer or periodic independent audit.

Under-resourcing. In the Sonali Bank case, part of the finding turned on inadequate resourcing and support from senior management. A firm that appoints an SMF16 or SMF17 holder without giving them the budget, headcount or authority to do the job properly is creating exactly the conditions that produced that enforcement outcome.

Handover and transition periods. Where a Senior Management Function is being transferred from one individual to another — common in growing firms bringing regulatory responsibility in-house for the first time — the handover period itself is a point of elevated risk. Responsibilities need to be clearly documented and the incoming holder needs genuine, evidenced readiness before the Form A application goes in, not just proximity to the outgoing holder.

Compensation misaligned with risk. Pricing an SMF-carrying role as though it were a standard operational management position, without reflecting the personal regulatory exposure, tends to either deter genuinely qualified candidates or attract candidates who have not fully understood what they are taking on. Neither outcome serves the firm well.

What This Means in Practice

For firms building out or restructuring their senior management function holders, the practical takeaways are straightforward. Be honest about the scope of accountability in the role from the outset — vague job titles and understated Statements of Responsibilities do not reduce real exposure, they just create confusion later. Resource the function properly, both in terms of budget and organisational authority. Document how any structural conflicts, such as self-review, are managed on an ongoing basis. And compensate the role in line with the personal risk being carried, not simply against a generic finance or compliance manager benchmark.

For individuals considering taking on an SMF16, SMF17 or any other Senior Management Function, the message from the enforcement record is consistent: genuine competence and documented reasonable steps are the best — and largely only — protection available. Enforcement cases turn on whether the individual can show they did what a competent person in that role should have done, with the resources and authority they had. That is worth establishing and evidencing from day one in the role, not after something has already gone wrong.

How FD Capital Helps

We place Senior Management Function holders — SMF16, SMF17, SMF2, SMF18 and related compliance and financial crime roles — into FCA-regulated firms on a permanent, interim and fractional basis. That includes firms taking on regulatory responsibility for the first time, and firms needing experienced cover during a supervisory or enforcement process. Because we work exclusively in this space, we can usually identify candidates with genuine, evidenced hands-on experience of the specific function a firm needs filled, rather than adjacent generalist experience.

If you are building out compliance or financial crime leadership, or need to understand what a role like this should realistically cost given the personal accountability attached, get in touch.

Related Reading

What happened, briefly

The catalyst was the collapse of a specialist property lender that held Annex 1 status. When the FCA opened its enforcement investigation, it made a point of clarifying — in its own public statement — that the firm was registered with and supervised by the regulator solely for compliance with the Money Laundering Regulations, and was not authorised or subject to wider FCA regulation. That distinction, ordinarily a technicality, became the centre of the story: a firm that many counterparties had treated as comprehensively regulated turned out to sit largely outside the FCA’s remit. The details of that case are a matter for the regulator and the courts, and the FCA’s own statement is the place to read them. What matters for the wider sector is what came next.

In the wake of the collapse, the FCA has publicly signalled a marked step-up in attention on Annex 1 firms as a group — seeking information from hundreds of them, and expressing concern that some may be leaning too heavily on parent-company arrangements or on generic compliance procedures that don’t fit their business. The message to the sector is unmistakable: registration is not a formality, and firms are expected to demonstrate that their AML frameworks are genuinely fit for purpose.

The distinction at the heart of it: registered, not authorised

To understand why this matters, you have to understand the distinction the case exposed. Being an Annex 1 firm means being registered with the FCA and supervised for one thing: compliance with the Money Laundering Regulations 2017. It does not mean the FCA has assessed the firm’s financial soundness, its conduct or its management in the way it does for authorised firms. ‘Registered with the FCA’ and ‘regulated by the FCA’ sound the same to most people — but for these firms they mean very different things, a gap we cover in detail in our guide on FCA authorisation versus registration. The recent attention is, in large part, the regulator making sure firms take seriously the one obligation registration does impose.

Why this is a governance and hiring issue

Here is the part that matters for anyone running one of these firms. The regulator’s concern — firms relying on generic procedures, or on frameworks that haven’t kept pace with growth — is fundamentally a resourcing and governance problem. In my experience, when a compliance framework falls short, it’s rarely because the firm set out to cut corners. It’s because the compliance function was built for a smaller, simpler business and never upgraded as the firm grew — the MLRO role held part-time by someone without the capacity the risk now demands, the financial-crime controls designed years ago and never revisited, the framework impressive on paper but not genuinely operating. Scrutiny exposes exactly those gaps. And closing them is, at root, a hiring question: does the firm have people with the seniority, time and expertise to build and run an AML framework that would withstand the regulator’s attention?

That’s why the crackdown is translating directly into demand for compliance and finance talent. Firms that recognise the gap are moving to strengthen their resource — bringing in credible MLROs, heads of compliance, and financial-crime specialists, and in some cases finance leaders who understand the regulatory environment. The firms that fare best in this kind of environment are usually the ones that got ahead of it rather than waiting to be asked.

What Annex 1 firms should do now

My practical advice to any Annex 1 firm reading the current climate is to treat it as a prompt to get ahead of the scrutiny rather than wait for it. That means an honest look at the AML framework: is the money-laundering risk assessment genuinely tailored to the business, or generic? Are the customer due diligence, monitoring and screening processes actually operating as designed, or only on paper? Is the MLRO senior enough, and resourced enough, to do the job credibly? Would the whole framework withstand the kind of information request the regulator is now sending out? Where the answer to any of those is uncomfortable, the fix usually involves people — the right compliance leadership, at the right level, whether permanent, interim or fractional. Bringing in an experienced hand, even on an interim basis, is often the single most reassuring step a firm can take, both for its own board and for a regulator wanting to see that the firm takes its obligations seriously.

None of this requires panic. The Annex 1 regime is a reasonable one, and the vast majority of these firms are legitimate businesses doing useful work. The shift is simply that the compliance obligation registration always carried is now being taken seriously by the regulator — and firms are expected to take it just as seriously in return. For most, that’s a matter of making sure the right people are in place.

Part of a wider direction of travel

It’s worth seeing the Annex 1 attention in its wider context, because it isn’t an isolated move. The broader direction across UK financial regulation has been towards firms having to evidence — not merely assert — that they have the right people, controls and governance in place, and towards holding named individuals accountable for that. Annex 1 firms had largely sat outside that trend; the current scrutiny brings them into it. For firms in the sector, the sensible reading is that this is unlikely to be a passing spike of interest that fades once the headlines do. The expectation that an AML framework be genuinely resourced and genuinely operating is the new baseline, and firms that build to that standard now will be in a far stronger position than those that wait to see whether the attention passes. Getting the right compliance people in place is not a reaction to a single news story; it’s an adjustment to a durable shift in what’s expected of these firms.

How we help

We recruit the senior compliance and finance people that FCA-touching firms depend on, and the current environment has made that resource more valuable to Annex 1 firms than ever. Through our Annex 1 firm compliance recruitment and wider recruitment for FCA-regulated firms, we place MLROs, compliance officers, financial-crime specialists and regulated-firm finance leaders — permanent, interim or fractional — who can build a framework that stands up to scrutiny and demonstrate to the regulator that the firm is in control of its obligations. Every search is led personally by Adrian Lawrence FCA, so you deal directly with someone who understands both the finance and the regulatory sides of these roles. If the changed environment means your firm needs to strengthen its compliance resource, that is exactly what we do.

Related reading and services

In July 2026 the US Office of the Comptroller of the Currency refused Wise’s application for a national trust bank charter. The application had been filed in June 2025. Wise has said the refusal relates to historical issues with that original filing, that its existing US money transmission business is unaffected, and that it intends to submit a fresh application under the current framework. Reporting on the decision has pointed to deficiencies in anti-money laundering and counter-terrorist financing controls, and to a finding that the proposed management team lacked experience in fiduciary activities.

The AML point is the one that generated headlines. The management point is the one that should interest anyone responsible for building a senior team inside a regulated business. A company with roughly 19 million customers, a Nasdaq primary listing and a large compliance function did not clear the bar in part because of who was named on the application.

Regulators Assess People, Not Just Frameworks

There is a persistent assumption among growing firms that a licence application is a documentation exercise. Write the policies, build the control framework, evidence the systems, and approval follows. The reality across supervisory regimes is that the application is also an assessment of named individuals and whether, collectively, they have run a business of this type before.

The UK position is set out explicitly. The FCA’s threshold conditions require an applicant to have appropriate resources — which the regulator reads as human and organisational resources, not only capital — and to be suitable. Suitability is assessed partly through the individuals who will hold senior management functions, each of whom must satisfy the fitness and propriety standards covering competence and capability, honesty and integrity, and financial soundness. A firm can hold an immaculate policy suite and still fail because the person named as compliance officer has never operated inside a supervised firm of comparable complexity.

Our guide to the FCA threshold conditions sets out how each condition is tested in practice. The recurring theme across refused and withdrawn applications is the gap between the framework a firm describes and the people it has appointed to operate it.

The Sequencing Mistake

The most common error is treating senior regulatory hiring as something that follows authorisation rather than something that precedes it. The logic is understandable: the firm does not yet hold permissions, revenue is uncertain, and a full-time compliance officer or regulated CFO is a serious fixed cost to carry through an application period that may run six months or longer.

The problem is that the application cannot be assessed without those individuals. The FCA will not typically determine a firm application until the required senior manager approvals have themselves been determined, and each of those requires a regulatory reference covering the previous five years of employment. Firms that begin the reference process late find the delay compounds. Our guide to the FCA authorisation timeline covers where applications most often stall, and inadequate resourcing of the compliance function is consistently near the top.

There is a second-order cost that firms underestimate. An application submitted with a placeholder team, then amended as candidates are recruited, signals instability to a case officer. Changes to key personnel during an application invite fresh scrutiny rather than resetting the clock cleanly.

What “Relevant Experience” Actually Means

The Wise finding is instructive because it distinguishes between generic financial services experience and experience of the specific activity being applied for. A trust bank charter carries fiduciary, custodial and safekeeping duties. A team that has built a world-class cross-border payments business has not, by that fact, demonstrated it understands fiduciary obligations. The two are not interchangeable, and the regulator did not treat them as such.

UK firms hit the same wall in different forms. A payments business seeking to add investment permissions cannot rely on its existing e-money compliance team to evidence competence for the new activity. A firm applying under MIFIDPRU needs someone who has operated the prudential regime, not someone who has read about it. A firm entering the cryptoasset regime needs financial crime capability calibrated to that risk profile specifically.

When we brief clients on FCA authorisation CFO and compliance mandates, the question we return to is narrow: has this candidate held this function, in this regime, at a firm of comparable scale and risk profile, and can that be evidenced through regulatory references? Title inflation is common in fast-growing fintechs. A “Head of Compliance” at a pre-authorisation start-up and a chief compliance officer at a supervised firm are describing different jobs.

Capacity Is Part of Competence

A related failure mode is concentration. Small regulated firms routinely load several senior management functions onto one person — the finance director who is also the compliance oversight function and the money laundering reporting officer. This is permitted, and for genuinely small firms it can be proportionate. It becomes a problem when the firm grows past the point where one person can discharge all three properly, and nobody revisits the allocation.

The FCA’s fitness and propriety assessment covers capability, and capability includes having the time to do the job. A candidate who is credible in isolation may not be credible carrying four functions across a business that has tripled in size. Where firms have outgrown that structure, separating the MLRO and SMF2 finance roles is usually the first step, followed by a dedicated financial crime function once transaction volumes justify it.

The Board Dimension

The fiduciary experience finding in the Wise decision was directed at the proposed management team, but the same logic reaches the board. Regulators look at whether the governing body contains anyone capable of challenging the executive on regulatory matters with genuine authority.

Founder-led fintechs often have excellent boards for the business they were — investor representatives, commercial operators, product expertise — and weak boards for the regulated business they are becoming. Adding a non-executive director who has sat inside a supervised institution, chaired a risk or audit committee, and dealt with a regulator directly changes how an application reads. It also changes what happens after authorisation, when supervisory engagement becomes continuous rather than episodic.

The Cross-Border Layer

Wise is not alone in looking at the US market, and UK firms expanding across the Atlantic face a structural decision about where regulatory leadership sits. Running US compliance from London is cheaper and preserves consistency with group standards. It also produces exactly the criticism levelled here: a team that does not evidence familiarity with the duties of the licence being sought.

The mirror problem applies to US and EU firms entering the UK, where the location of offices condition requires the firm to be directed and managed from the UK, and where a UK-resident senior management team is not optional. Firms that attempt to satisfy this with a nominal local appointment while decisions are taken elsewhere tend to be found out during the assessment phase.

Bridging the Gap Before You File

The practical objection to hiring early is cost, and it is a fair one. A pre-revenue applicant carrying a full-time regulated CFO and a full-time compliance officer through a nine-month process is burning capital on capacity it cannot yet use.

The route most firms take is a graduated one. An interim or fractional appointment covers the application period, giving the regulator a named individual with genuine regime experience while the firm avoids a permanent commitment before permissions are granted. Where the individual intends to remain, the arrangement converts on authorisation. Where they do not, they have built the framework that a permanent successor inherits, and the transition is a planned handover rather than a scramble.

What does not work is naming someone unqualified to hold the application open, on the assumption that the appointment can be upgraded later. Regulators assess the application in front of them.

The Takeaway

Wise will almost certainly obtain a US charter eventually. It has the resources, the customer base and the commercial motivation, and it has said it is reapplying. The episode is not evidence that the company is failing. It is evidence that scale, capital and a strong compliance budget do not substitute for named individuals with directly relevant experience — and that a regulator will say so plainly.

For any UK firm with an authorisation, a variation of permission or a new SMF appointment ahead of it, the operational conclusion is straightforward. Decide who is holding each function before you draft the application, choose people who have held that function in that regime, give them the capacity to discharge it, and start the regulatory reference process the same week. That sequence costs money earlier than firms would like. It costs considerably less than a refusal.

Key References

• FCA Handbook COND — Threshold Conditions
• FCA Handbook FIT — Fit and Proper Test for Employees and Senior Personnel
• FCA — Authorisation overview and application guidance
• FCA — Our refusal process
• City A.M. — Wise denied US banking licence
• California DFPI — multistate enforcement action, Wise US Inc

Related Guides and Services

TNFD and TCFD are often mentioned together and just as often confused. They are related by design — one was built on the model of the other — but they cover different things and sit at very different stages of their lifecycle. This article explains how the two relate, why TCFD’s work has moved into the ISSB standards, and where nature reporting is heading.

The starting point: what each covers

The Task Force on Climate-related Financial Disclosures (TCFD) addressed climate. It gave the market a framework for disclosing climate-related risks and opportunities, built around four pillars — governance, strategy, risk management, and metrics and targets — and a set of recommended disclosures. It became the dominant global reference for climate reporting over the second half of the last decade.

The Taskforce on Nature-related Financial Disclosures (TNFD) addresses nature — biodiversity, ecosystems and a firm’s dependencies and impacts on the natural world. It deliberately adopted the same four-pillar structure as TCFD, so that a firm familiar with climate disclosure would find the nature framework recognisable. The relationship, in short: TNFD is to nature what TCFD was to climate, and it was built that way on purpose.

Why TCFD is spoken of in the past tense

Here is the point that causes most confusion. The TCFD has been disbanded. In 2023 the Financial Stability Board announced that the TCFD’s work was complete, because the newly-created International Sustainability Standards Board had issued IFRS S1 and IFRS S2, which fully incorporated the TCFD recommendations. The TCFD formally disbanded in October 2023, and the IFRS Foundation took over monitoring companies’ climate-reporting progress.

So TCFD is no longer a live, separately-maintained framework. Its substance lives on — entirely — inside IFRS S2, and a firm applying IFRS S1 and S2 meets the TCFD recommendations. When people refer to TCFD reporting today, they are really referring to a framework whose content has been absorbed into the ISSB standards.

The UK position: moving to UK SRS

For UK firms specifically, there is a further step. UK reporting has been anchored to TCFD through FCA listing rules and company law. The UK is now moving to its own endorsed versions of the ISSB standards — the UK Sustainability Reporting Standards (UK SRS S1 and S2), published in final form in early 2026. The FCA has consulted (in CP26/5) on replacing its TCFD-aligned listing rules with UK SRS alignment, with final rules expected in autumn 2026 and application for accounting periods beginning on or after 1 January 2027.

UK SRS S2 retains the familiar four-pillar climate structure but goes further than TCFD — more prescriptive on Scope 1, 2 and 3 emissions, scenario analysis and connectivity with the financial statements. In the interim, the existing TCFD-aligned rules remain in force, so firms are in a transitional period: reporting under the current regime while preparing for a more demanding successor.

Where nature reporting sits now

Nature reporting — TNFD’s territory — is at an earlier stage. It remains largely voluntary and market-led, and early adopters face real challenges around data availability and the quantification of nature-related risks. But the direction is set: the ISSB announced in late 2025 that it will undertake standard-setting on nature-related disclosures not already captured in IFRS S1 and S2, with options ranging from a dedicated standard to incremental additions. Both the EU’s CSRD and IFRS S1 already require disclosure of material nature-related risks and opportunities.

In other words, nature reporting looks today somewhat as climate reporting did a few years ago — voluntary, evolving, but heading toward a formal standard. The clear message from bodies like TNFD has been for firms to start now wherever they are, rather than wait for the standard to arrive.

What this means in practice

For a firm, the practical position is: climate disclosure is mandatory-and-consolidating — TCFD absorbed into IFRS S2, moving to UK SRS S2 from 2027 — while nature disclosure is voluntary-but-emerging, with TNFD shaping practice and an ISSB standard on the horizon. A firm building its sustainability reporting capability should treat the two as the same journey at different stages, and build a function that can handle climate rigorously now while getting ready for nature.

FD Capital recruits the finance and compliance professionals who own sustainability reporting and its governance, into regulated and listed firms.

Why the frameworks share a structure

The deliberate alignment of TNFD with TCFD’s four pillars was a strategic choice, and understanding why helps explain how they relate. When TNFD was designed, TCFD was already the established, widely-understood model for disclosing an environmental risk. Rather than invent a new structure, TNFD adopted the same governance-strategy-risk-metrics architecture so that firms and investors already fluent in climate disclosure could apply the same mental model to nature. The shared structure is a feature, not a coincidence: it lowers the barrier to nature reporting for anyone who has done climate reporting.

That is why the two are so often discussed together — not because they cover the same ground, but because they are built on the same frame and represent the same idea applied to two different environmental dimensions.

Climate and nature are connected, not separate

A further reason the frameworks belong together is that climate and nature risk are genuinely interlinked. Climate change drives nature loss, and healthy ecosystems buffer climate impacts; a firm’s dependencies often span both. Increasingly, the reporting world reflects this — IFRS S1 already requires disclosure of material sustainability risks including nature-related ones, and the ISSB’s move into nature standard-setting will bring the two closer still within a single reporting architecture. Firms that build climate and nature reporting as one connected capability, rather than two silos, are better positioned for where the standards are heading.

Practical guidance for firms

For a firm working out how to approach this, the sensible sequence follows the maturity of the two areas. Get climate reporting right first, because it is mandatory and consolidating — ensure the firm is meeting its current TCFD-aligned obligations and preparing for UK SRS S2 from 2027. Then build nature-reporting capability in parallel, starting now even though it is voluntary, because the data and governance take time to establish and a formal standard is coming. Treating the two as one journey at different stages, using the shared four-pillar structure, is the most efficient way through.

What each framework means for a finance function

For a finance or reporting function specifically, the practical demands differ between the two. Climate disclosure under IFRS S2 and UK SRS S2 is now a rigorous, quantified reporting exercise — emissions across all three scopes, scenario analysis, and connectivity with the financial statements — that sits squarely in finance territory and demands robust data and controls. Nature disclosure under TNFD is, for now, a more qualitative and exploratory exercise, focused on identifying dependencies and impacts where the data is often immature.

The trajectory, though, is toward nature reporting becoming as quantified and rigorous as climate reporting has become. A finance function building capability now should assume that nature will follow the same path climate has taken — from voluntary and narrative toward mandatory and quantified — and build data foundations that can support both.

The governance dimension

Both frameworks put governance in their first pillar for a reason: credible sustainability reporting depends on genuine board oversight, clear responsibility, and the integration of sustainability risk into the firm’s wider risk management. A firm that treats disclosure as a reporting output produced by a corner of finance, without board engagement or integration into risk management, will struggle to meet the governance expectations of either framework. The strongest firms embed sustainability governance into their existing structures rather than bolting it on, which is also what the incoming UK SRS regime will expect.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.

What FATF is

The Financial Action Task Force is the international standard-setter for anti-money-laundering and counter-terrorist-financing. It is an inter-governmental body, not a regulator of individual firms — it does not supervise or fine a UK payments firm or bank. Instead it sets the international standards, known as the FATF Recommendations, that member countries are expected to implement in their own law, and it assesses how well they do so.

The UK is a founding member and is assessed against the standards like any other member. That assessment matters at national level: a poor evaluation pressures the government and regulators to tighten the domestic regime, which is one route by which FATF’s work eventually reaches individual firms.

How FATF standards reach UK firms

The chain from FATF to a firm’s controls runs through domestic law. The FATF Recommendations shape the UK’s anti-money-laundering framework — principally the Money Laundering Regulations 2017 — which in turn impose the obligations firms actually comply with: the risk-based approach, customer due diligence, enhanced due diligence for higher-risk situations, ongoing monitoring, and suspicious activity reporting. So a firm does not comply with FATF directly; it complies with UK law that implements FATF standards.

Understanding this chain matters because it explains why the domestic rules look as they do, and why changes at FATF level eventually work through into firms’ obligations. A financial crime professional who understands the standards behind the rules is better placed to interpret the rules purposively rather than mechanically.

The grey list and black list

The part of FATF’s work most directly relevant to day-to-day compliance is its identification of higher-risk jurisdictions. FATF publicly identifies countries with strategic deficiencies in their AML/CTF regimes — the widely-used shorthand is the ‘grey list’ for jurisdictions under increased monitoring, and the ‘black list’ for those subject to a call for action. These lists feed directly into firms’ risk-based approach.

When a country is grey-listed, firms are generally expected to factor that into their country risk assessment and may need to apply enhanced due diligence to customers or transactions connected to it. Black-listed jurisdictions attract the strongest response. A firm’s country risk framework and screening should reflect the current FATF listings, and keeping that current is an ongoing compliance task, because the lists change as FATF updates its assessments.

Why this matters for the financial crime function

For a compliance or financial crime function, FATF is the backdrop that explains and drives much of the day-to-day work. The firm-wide risk assessment should reflect FATF’s risk framing; the country risk model should reflect its listings; the enhanced due diligence triggers should capture higher-risk jurisdictions; and the whole approach should be recognisably risk-based in the way FATF’s standards require. A financial crime professional who can connect the firm’s controls back to the standards behind them demonstrates the depth that distinguishes a strong candidate.

Keeping current

Because FATF updates its listings and periodically revises its Recommendations, the function has to stay current rather than treat this as settled knowledge. Listing changes should flow through into the country risk framework promptly, and significant changes to the Recommendations eventually reshape domestic obligations. Building that monitoring into the compliance calendar is part of running a financial crime function properly.

FD Capital recruits MLROs and financial crime professionals who understand the standards behind the rules, into FCA-regulated firms.

The mutual evaluation process

One of FATF’s main tools is the mutual evaluation — a periodic, in-depth assessment of how effectively a country implements the standards. These evaluations carry weight: a poor result puts a country under pressure to strengthen its regime, which flows through into tougher domestic rules and more demanding supervision of firms. For a UK financial crime professional, the national evaluation is worth following, because its findings shape the direction of the regime they work within.

The evaluations also assess effectiveness, not just technical compliance — whether the country’s AML system actually works, not merely whether the laws are on the books. That effectiveness focus has increasingly influenced how the FCA supervises firms: it is not enough to have the policies, they have to work.

How FATF shapes day-to-day controls

Beyond the lists, FATF’s standards underpin the everyday architecture of a firm’s financial crime controls. The risk-based approach that runs through the Money Laundering Regulations is a FATF principle. The expectation of a firm-wide risk assessment reflects FATF’s framing. The customer due diligence and enhanced due diligence obligations trace back to the Recommendations. A financial crime professional who understands this lineage interprets the domestic rules with a surer grasp of what they are for.

Practical steps for the compliance function

• Reflect current FATF listings in the country risk model, and update promptly when they change.
• Ensure enhanced due diligence triggers capture higher-risk jurisdictions FATF has identified.
• Ground the firm-wide risk assessment in FATF’s risk framing, not just a generic template.
• Track significant revisions to the FATF Recommendations, which eventually reshape domestic obligations.
• Follow the UK’s mutual evaluation findings for signals about where the regime is heading.

Common misconceptions

A few misunderstandings about FATF recur, and clearing them up sharpens a compliance professional’s grasp of the framework. FATF is not a law and does not regulate firms directly — it sets standards that countries implement, so a firm never complies with FATF as such. Its lists are not sanctions — grey-listing is not the same as a sanctions designation, though both feed a firm’s risk assessment and screening. And FATF membership is not a mark of low risk in itself — a member country can still be assessed as having deficiencies. Understanding these distinctions helps a financial crime function apply FATF’s output correctly rather than mechanically.

Why this knowledge matters in a candidate

For firms hiring MLROs and financial crime professionals, genuine FATF literacy is a useful signal of depth. A candidate who understands how the international standards flow into UK law, what the lists mean for the risk-based approach, and how the mutual evaluation process shapes the regime, brings a purposive understanding of the rules rather than a checklist familiarity. That depth tends to distinguish the professionals who can build and defend a genuinely risk-based framework from those who can only operate an inherited one — which is precisely the difference that matters most in the MLRO role.

The bigger picture for regulated firms

Stepping back, FATF matters to a regulated firm because it is the source of the logic behind the whole anti-money-laundering regime. The risk-based approach, the emphasis on effectiveness over box-ticking, the focus on higher-risk jurisdictions, the expectation of a firm-wide risk assessment — all trace back to FATF’s standards, filtered through UK law. A firm that understands this sees its financial crime obligations not as an arbitrary rulebook but as a coherent framework with a purpose, which makes for better judgement in the grey areas where the rules do not give a clear answer. That purposive understanding, at the top of the financial crime function, is what turns compliance from a cost into genuine protection against being used to launder money — which is, in the end, what the whole system exists to prevent.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.

Sustainability and ESG have moved from a reputational concern to a regulated compliance obligation, and firms have responded by creating a role that barely existed a few years ago: the ESG Compliance Officer. This article sets out what the role involves, why demand for it has grown, how the UK regulatory landscape is changing, and what firms look for when they hire.

What the role covers

The ESG Compliance Officer owns a firm’s compliance with sustainability-related regulation and the integrity of its sustainability disclosures. In practice that spans several areas: climate and sustainability reporting obligations; the anti-greenwashing rules that govern how a firm describes its products and itself; the sustainability characteristics of investment products where the firm manufactures or distributes them; and the governance and data underpinning all of it. It is a role that sits at the intersection of compliance, finance and sustainability, and it requires fluency across all three.

Why demand has grown

Three forces have driven the role’s emergence. Disclosure obligations have expanded and become more demanding. The FCA’s anti-greenwashing rule has raised the stakes on sustainability claims, making it a genuine compliance risk to overstate a product’s green credentials. And the reporting frameworks themselves are in transition, which creates a period of heightened complexity where firms particularly value someone who owns the change. Together these have turned ESG from something handled at the margins into a role in its own right.

The reporting landscape is shifting: TCFD to UK SRS

Anyone in or hiring for this role needs to understand a significant transition underway. UK sustainability reporting has been anchored to the recommendations of the Task Force on Climate-related Financial Disclosures (TCFD). The TCFD disbanded in October 2023, and its substance was absorbed into the International Sustainability Standards Board’s standards, IFRS S1 and S2.

The UK is now moving to its own endorsed versions — the UK Sustainability Reporting Standards (UK SRS), based on IFRS S1 and S2, published in final form in early 2026. The FCA has consulted (in CP26/5) on replacing its existing TCFD-aligned listing rules with UK SRS alignment, with final rules expected in autumn 2026 and application for accounting periods beginning on or after 1 January 2027. In the meantime, TCFD-aligned rules remain in force. The practical point for firms: the current regime still applies, but a more demanding successor is close, and preparation is a live task now rather than a 2027 one.

Nature reporting is emerging too

Alongside climate, nature-related reporting is developing. The Taskforce on Nature-related Financial Disclosures has shaped market practice, and the ISSB announced in late 2025 that it will pursue standard-setting on nature-related disclosures. Nature reporting is still largely voluntary and nascent, with firms facing real data and quantification challenges — but the direction of travel is clear, and an ESG Compliance Officer needs to be tracking it even where their firm is not yet reporting on it.

What firms look for

Because the role is new, firms are still defining it, but consistent priorities have emerged: genuine understanding of the disclosure frameworks and where they are heading, not just current rules; the compliance judgement to assess sustainability claims against the anti-greenwashing standard; enough data and reporting capability to own disclosure integrity; and the ability to work across the finance, compliance and sustainability functions that all touch this area. A candidate who combines regulatory compliance depth with genuine sustainability-reporting knowledge is still relatively scarce, which is part of why firms find the role hard to fill.

How the role fits the compliance function

At most firms the ESG Compliance Officer sits within the compliance function, reporting toward the Compliance Oversight (SMF16) holder, while working closely with finance on the reporting mechanics and with the business on product-level sustainability characteristics. As disclosure obligations bed in and the UK SRS regime arrives, the role is likely to become a settled part of the compliance structure rather than the emerging specialism it is today.

FD Capital recruits ESG and sustainability compliance professionals into FCA-regulated firms as this area of regulation matures.

Anti-greenwashing: the sharpest current risk

If one area defines the ESG Compliance Officer’s current workload, it is anti-greenwashing. The FCA’s rule requires that sustainability references in a firm’s communications and product descriptions be fair, clear and not misleading — and be capable of being substantiated. That turns every green claim into a potential compliance exposure. The ESG Compliance Officer is the person who has to test claims before they are made: is the evidence there, is the language proportionate to it, and would it withstand challenge?

This is a genuinely difficult judgement, because the commercial incentive to market sustainability credentials pulls against the compliance need to be able to prove them. Holding that line is much of the role.

The data challenge

Sustainability compliance is, at bottom, a data problem. Disclosures require data the firm may not have historically captured — emissions across scopes, the sustainability characteristics of underlying investments, nature-related dependencies. An ESG Compliance Officer spends a significant part of the role working with finance and the business to build the data foundation that disclosures depend on, and assuring its integrity. As the UK SRS regime arrives with its more prescriptive data requirements, this challenge intensifies.

A role still being defined

Candidates and firms alike should recognise that this is an emerging role without a settled template. Titles vary, reporting lines vary, and the balance between compliance, finance and sustainability differs from firm to firm. That fluidity is an opportunity for candidates who can help shape the role, and a reason for firms to think carefully about exactly what they need — a disclosure-and-reporting specialist, a claims-and-conduct specialist, or someone who can span both. Being clear about that at the point of hiring avoids a mismatch later.

Where the role sits between finance and compliance

One of the defining features of the ESG Compliance Officer role is that it straddles functions that do not always speak the same language. Sustainability disclosure is, in large part, a finance-adjacent reporting exercise — emissions data, connectivity with the financial statements, quantified metrics — yet it is governed as a compliance obligation and carries conduct risk through the anti-greenwashing rule. The role therefore needs someone who can work credibly with the finance function on the numbers and with the compliance function on the obligations, translating between the two.

Firms that locate the role purely in compliance sometimes find it lacks the reporting depth; those that locate it purely in finance sometimes find it lacks the conduct-risk instinct. The strongest post-holders bridge both, which is exactly the combination that is scarce in the market.

Preparing for the UK SRS transition

With UK SRS application expected for accounting periods beginning on or after 1 January 2027, the ESG Compliance Officer’s near-term agenda is dominated by preparation. That means reviewing current TCFD-aligned reporting and identifying the gaps to UK SRS — which builds on and expands the existing requirements, with more prescriptive emissions, scenario-analysis and financial-connectivity demands. Firms that begin closing those gaps now, rather than waiting for the rules to bite, will make the transition far more smoothly, and the person driving that preparation is typically the ESG Compliance Officer.

A role worth getting right

For firms, the ESG Compliance Officer is increasingly not optional. Sustainability disclosure obligations are expanding, the anti-greenwashing rule makes claims a live compliance risk, and the UK SRS transition raises the bar from 2027. A firm without someone genuinely owning this area is exposed on both disclosure integrity and conduct. Getting the appointment right — matching the person to whether the firm most needs disclosure-and-reporting depth, claims-and-conduct judgement, or both — is one of the more consequential compliance hires a regulated or listed firm will make in the current environment, precisely because the role is new and the stakes are rising.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.

SMF1 and SMF3 are two of the most senior controlled functions under the Senior Managers and Certification Regime, and the difference between them is frequently misunderstood. Both are held by senior executives; both carry personal accountability. But they are not the same, and getting the distinction right matters for how a firm allocates responsibility. This article explains the two functions and how they relate.

The two functions defined

SMF1 is the Chief Executive function — held by the person with responsibility, under the immediate authority of the governing body, for the conduct of the whole of the firm’s business. There is normally one SMF1: the chief executive. SMF3 is the Executive Director function — held by a director who is an executive of the firm but who is not the chief executive. A firm may have several SMF3 holders, one for each executive director on the board.

The distinction, in essence: SMF1 is the single individual running the whole firm; SMF3 holders are the other executive directors who sit on the board and carry executive responsibility for their areas without being the chief executive.

What each carries

Both functions are senior management functions, so both require FCA pre-approval, a Statement of Responsibilities, and accountability under the Conduct Rules and the Duty of Responsibility. The difference is the breadth of what they own. The SMF1 holder’s Statement of Responsibilities reflects overall responsibility for the conduct of the firm’s business — the widest accountability any executive carries. An SMF3 holder’s statement reflects their specific executive remit as a director, which is significant but narrower than the chief executive’s whole-firm responsibility.

How they sit against the other senior functions

It helps to place them in the wider SMF structure. Above the executive sit the governance functions — the Chair (SMF9) and the various committee chairs — which are non-executive. Alongside SMF1 and SMF3 sit the specific executive functions such as the Chief Finance function (SMF2), the Chief Risk function (SMF4) and the Compliance Oversight function (SMF16). An individual may hold more than one function — a finance director on the board might hold both SMF2 and SMF3, for instance — and the Statement of Responsibilities is where the firm sets out exactly who owns what.

A common point of confusion is the relationship between SMF3 and the specific-responsibility SMFs. Being an executive director (SMF3) is about board membership and executive status; holding SMF2 or SMF4 is about owning a specific function. The two can coincide in one person but describe different things.

Which functions a firm needs

Not every firm requires the same set. The applicability of particular SMFs depends on the firm’s SM&CR category — Limited Scope, Core or Enhanced — and its permissions and structure. SMF1 is required where a firm has a chief executive performing that role. SMF3 applies to executive directors. Smaller or simpler firms carry fewer functions; Enhanced firms carry the fullest set. Getting the firm’s required functions right, and allocating them cleanly, is a core part of SM&CR compliance.

Why the distinction matters in practice

The allocation matters because accountability follows it. If responsibility for an area is genuinely the chief executive’s, it should sit in the SMF1 statement; if it belongs to a specific executive director, it should sit with the relevant SMF3 (or specific-function) holder. Blurring this — leaving responsibilities unallocated, or allocating them to the wrong level — is precisely what the regime is designed to prevent, and it is what a supervisor examines when something goes wrong. Clear Statements of Responsibilities that reflect who genuinely owns what are the foundation of a defensible SM&CR framework.

FD Capital recruits chief executives, executive directors and the full range of SM&CR function holders into FCA-regulated firms, and works with firms on getting senior appointments and their responsibilities right.

Holding multiple functions: how it works in practice

In real firms, especially smaller ones, individuals frequently hold more than one senior management function, and understanding how that works clears up much of the confusion around SMF1 and SMF3. A managing director who is also the most senior executive might hold SMF1. A finance director on the board holds SMF3 as an executive director and SMF2 as the Chief Finance function. The functions describe different dimensions of the person’s role — board status, executive seniority, and specific functional responsibility — and the Statement of Responsibilities ties them together into a clear picture of accountability.

What matters is that every significant responsibility is allocated to someone, and that the allocation reflects reality. The regime is unforgiving of responsibilities that sit in the gaps between functions.

The chief executive’s distinctive accountability

It is worth dwelling on what makes SMF1 different, because it is the function that carries the widest personal accountability in the firm. The chief executive is responsible, under the governing body’s authority, for the conduct of the whole business. That breadth means the SMF1 holder cannot fully delegate away accountability — they retain a top-level responsibility for the firm’s overall conduct even where specific areas are owned by others. This is why the chief executive’s Statement of Responsibilities is scrutinised closely, and why the role carries the heaviest personal exposure under the Duty of Responsibility.

Getting the allocation right

For firms, the practical task is allocating the required functions cleanly and documenting them honestly. That means identifying which SMFs the firm’s category and permissions require, appointing fit-and-proper individuals to each, drafting Statements of Responsibilities that reflect who genuinely owns what, and keeping them current as the firm and its people change. Done well, this is the backbone of a defensible governance framework; done carelessly, it is the first thing that unravels when the regulator examines a problem.

Firm categories and which functions apply

The SM&CR category a firm falls into shapes which senior management functions it must have, and understanding this is essential to allocating them correctly. Limited Scope firms carry the fewest required functions; Core firms carry a standard set; Enhanced firms — the largest and most complex — carry the fullest range including additional functions and prescribed responsibilities. A firm needs to know its category, identify the functions that category requires, and ensure each is held by an approved, fit-and-proper individual.

SMF1 and SMF3 sit within this structure as the core executive functions — the chief executive and the executive directors — alongside the specific-responsibility functions the firm’s activities require. Mapping all of this correctly is foundational SM&CR compliance, and errors in it are a common finding.

What a strong Statement of Responsibilities looks like

Because so much turns on the Statement of Responsibilities, it is worth knowing what a good one does. It sets out clearly what the individual is responsible for, in language specific enough to be meaningful rather than boilerplate. It leaves no significant responsibility unallocated and none double-allocated without clear rationale. It reflects what the person actually does rather than an idealised job description. And it is kept current as roles change. For SMF1 in particular, it captures the whole-firm responsibility the chief executive carries; for each SMF3, it captures that director’s specific executive remit.

Why clean allocation protects the firm and the individual

Clear allocation of SMF1, SMF3 and the specific functions is not bureaucratic housekeeping — it protects both the firm and the individuals. For the firm, it means that when something goes wrong, responsibility is traceable and the governance framework holds up to scrutiny. For individuals, it means their accountability is defined and bounded: a senior manager is responsible for their allocated area, not for everything, provided the allocation is clear and they took reasonable steps within it. Vague or overlapping Statements of Responsibilities expose everyone, because they leave it unclear who was accountable when a failure occurs. Precision in the allocation is in everyone’s interest.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.

The Chief Risk Officer and the Chief Compliance Officer are often confused, sometimes combined, and frequently misunderstood — including by firms hiring for them. Both are second-line functions, both are senior, and at FCA-regulated firms both are typically controlled functions: the CRO usually holds SMF4 and the CCO holds SMF16. This article sets out how the two genuinely differ, where they overlap, and how they should work together.

The core distinction

The cleanest way to state the difference is by what each function is accountable for. The Chief Risk Officer owns the firm’s risk framework — identifying, measuring, monitoring and overseeing the full range of risks the firm faces, from credit and market risk to operational, technology and third-party risk. The Chief Compliance Officer owns the firm’s compliance with the regulatory system — making sure the firm meets its obligations under the rules that apply to it, advising the business, and overseeing the compliance framework.

Put simply: the CRO asks ‘what could harm the firm, and are we managing it?’; the CCO asks ‘are we complying with our regulatory obligations?’ Regulatory risk is one of the risks the CRO oversees, which is where the two most obviously connect — but they are distinct lenses on the firm.

How the SMF roles map

Under SM&CR the mapping is usually clear. SMF4, the Chief Risk function, is held by the senior individual responsible for the risk function — setting and overseeing risk exposures and reporting to the governing body on risk. SMF16, the Compliance Oversight function, is held by the individual responsible for the firm’s compliance with the regulatory system. Each carries its own Statement of Responsibilities, and each holder is personally accountable for their area under the Duty of Responsibility.

Both are second-line functions, distinct from the first line that owns risk day to day and from the third-line internal audit function that assures the board both are working.

Where they overlap

The overlap is real and needs managing. Regulatory and conduct risk sit in both worlds: they are risks to the firm (CRO territory) and they concern compliance with obligations (CCO territory). Operational resilience touches both. Financial crime risk is overseen within the risk framework but has its own accountable owner in the MLRO. The Consumer Duty’s outcomes focus draws compliance into territory that looks a lot like risk management.

Where the two functions are not clear about their respective ownership of these shared areas, things fall between them — which is exactly the gap a supervisor probes. Good firms set the boundary explicitly rather than leaving it to be worked out case by case.

Should the roles ever be combined?

At smaller firms the risk and compliance functions are sometimes held by the same person, or the roles sit close together with shared resource. This can work where the firm’s scale genuinely does not justify two senior functions — but it carries a tension. A combined holder is, in effect, both setting parts of the control framework and overseeing compliance with it, which compresses the independent perspectives the two functions are meant to provide. As a firm grows, separating them is usually one of the governance maturity steps, and the point at which to do so is a judgement the board should make deliberately rather than by drift.

What this means for hiring

The practical consequence for firms is that these are different roles requiring different people, even though the market sometimes treats them as interchangeable. A strong CRO is an enterprise-risk thinker comfortable with quantification, resilience and the full risk taxonomy. A strong CCO is a regulatory expert comfortable advising the business, engaging the regulator and owning the compliance framework. Some individuals can do both, particularly at smaller firms, but the skill sets are genuinely distinct, and hiring for one when you need the other is a common and costly error.

FD Capital recruits both Chief Risk Officers and Chief Compliance Officers into FCA-regulated firms, and advises firms on which the mandate actually requires.

A worked example of the boundary

Consider how the two functions handle the same event. Suppose a firm discovers that a product has been sold to customers for whom it was not appropriate. The compliance function’s concern is whether rules were breached — the conduct obligations, the Consumer Duty, the sales process — and what remediation and possibly notification the breach requires. The risk function’s concern is what this reveals about the firm’s control environment — how the failure happened, what it says about the adequacy of first-line controls, and what the residual risk is across the rest of the book.

Both are engaged; neither view is complete alone. The compliance lens fixes the specific breach; the risk lens asks whether the same weakness exists elsewhere. Firms that understand this run the two functions as complementary rather than competing, and the board gets a fuller picture as a result.

Reporting lines and independence

Both functions need genuine independence from the first line to be effective, and both typically have a reporting line to the board or a board committee — the CRO often to a Risk Committee, the CCO with access to the board on compliance matters. Where either function reports purely into the executive it oversees, its independence is compromised. A firm’s governance maturity often shows in how it protects the independence of these two roles.

What firms get wrong

The most common errors are treating the two as interchangeable in a hiring brief; combining them for too long as the firm grows, past the point where scale justifies separation; and leaving the overlap areas — conduct risk, resilience, financial crime — unallocated between them. Each is avoidable with a clear view of what each function is for, and each is the kind of gap a supervisor notices.

The skills that distinguish each

The two roles reward genuinely different profiles, which is why treating them as interchangeable in hiring goes wrong. A strong Chief Risk Officer is comfortable with the full risk taxonomy, with quantification and modelling, with operational resilience and scenario testing, and with giving a board an unwelcome view of the firm’s exposure. A strong Chief Compliance Officer is a regulatory interpreter — fluent in the rulebook, confident advising the business on how to meet its obligations, practised at engaging the regulator, and able to hold the compliance line commercially.

There is overlap in temperament — both need independence and the willingness to be unpopular — but the technical cores differ. Firms that write a single generic brief for ‘a risk and compliance leader’ often end up with someone strong in one half and stretched in the other.

How the functions evolve as a firm grows

The relationship between the two changes with scale. A small firm may combine them; a growing firm separates them; a large firm builds sizeable functions under each, with specialists beneath. Understanding where a firm sits on that curve is part of hiring well — a firm separating the roles for the first time needs a different kind of leader, someone who can build a function, from a large firm slotting a specialist into an established structure. Getting that stage-match right matters as much as the CRO-versus-CCO distinction itself.

What this means for firms hiring

The practical takeaway for a firm is to be honest about which function it is actually recruiting for, and at what stage of the firm’s development. A firm formalising its risk function for the first time needs a Chief Risk Officer who can build an enterprise-risk framework from a modest base. A firm strengthening its regulatory position needs a Chief Compliance Officer who can own the regulatory relationship and the compliance framework. Conflating the two in a single brief tends to produce a hire who is credible in one dimension and stretched in the other, and the cost of that mismatch at senior level is high. Getting the brief right — which function, at which stage — is where a specialist recruiter earns their place.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.

What the role is, and what makes it different

The Head of Internal Audit maintains oversight of the firm’s control environment and reports findings and recommendations directly to the governing body. The defining feature of the role is independence: internal audit must be independent of the executive management it examines, which is why the function typically reports to the Audit Committee rather than to the executive, and why SMF5 is kept separate from the risk and compliance functions it audits.

That independence is not a nicety — it is the source of the function’s value. An internal audit function that has been captured by the executive, or that pulls its punches, gives the board false assurance, which is worse than none.

Where it sits in the three lines

Understanding the three-lines model is central to the role. The first line owns and manages risk in the business. The second line — risk under SMF4, compliance under SMF16 — sets the framework and provides oversight. The third line, internal audit, independently assures the board that the first two are functioning. SMF5 is deliberately independent of SMF4 and SMF16, and a candidate who cannot articulate why that separation matters will not be credible.

The career path in

Heads of Internal Audit typically arrive from one of a few directions:

• Internal audit progression — rising within the function, the most direct route, often via a professional internal audit or accountancy qualification.
• External audit — moving from a practice background, bringing audit discipline and often a chartered accountancy qualification.
• Risk or controls — crossing from a second-line role, though this requires establishing genuine independence from the areas previously worked in.

A professional qualification is common and valued — whether a chartered internal auditor credential or an accountancy qualification such as the ICAEW. The role is fundamentally about the integrity of assurance, so evidence of technical rigour and independence of mind matters more than management polish.

What firms look for

Beyond technical audit capability, hiring firms and audit committees prioritise: genuine independence and the willingness to report uncomfortable findings; the judgement to focus audit effort on the areas of real risk rather than the easily auditable; the ability to communicate findings to a board in a way that drives action; and enough understanding of the regulatory framework to audit against the right standard. An internal audit function that produces thorough reports nobody acts on has failed, so the ability to land findings and secure remediation is part of the specification.

The independence question in interview

Audit committees probe independence directly, because it is the quality most easily compromised and most damaging when it is. Expect questions about a time you delivered a finding the executive did not want to hear, how you maintained objectivity while working closely with the teams you audit, and how you would handle pressure to soften a conclusion. Candidates who can answer with real examples — and who demonstrate they understand that their loyalty runs to the board and ultimately the firm’s safety rather than to executive comfort — stand apart.

Positioning yourself for the step

The practical moves: build audit breadth across the firm’s significant risk areas rather than depth in one; develop the board-facing communication the role demands, because much of it is influencing at committee level; take the relevant qualification; and, if crossing from a second-line role, be deliberate about establishing independence from your former area. Firm size shapes the route, as with other SMFs — a first Head of Internal Audit role often comes sooner at a smaller firm, with broader personal scope, than at a large firm with a bigger function.

FD Capital recruits Heads of Internal Audit and senior assurance professionals into FCA-regulated firms.

What the function actually does day to day

It helps to be concrete about the work. A Head of Internal Audit builds a risk-based audit plan — deciding, on a view of where the firm’s real risks lie, what to examine and when. They lead audits that test whether controls are designed well and operating effectively, from financial controls to regulatory processes to operational resilience. They report findings to the Audit Committee with clear conclusions and recommendations, track remediation to completion, and give the board an annual opinion on the overall control environment.

The judgement in the role is largely about focus: audit resource is finite, and directing it at the areas of genuine risk rather than the easily-tested is what distinguishes a valuable function from a box-ticking one.

The relationship with the regulator and external audit

Internal audit does not operate in isolation. The function’s work informs the board and, indirectly, the regulator’s view of the firm’s control environment. At many firms internal audit also coordinates with external audit to avoid duplication and ensure coverage. A Head of Internal Audit who understands how their assurance fits into the wider picture — regulatory expectations, external audit, the second-line functions — runs a more effective function than one who treats internal audit as a self-contained exercise.

Career progression from the role

SMF5 is a strong platform. The independence, board exposure and firm-wide view it provides open routes toward audit committee membership and chairmanship (itself a controlled function), toward wider governance and risk roles, and toward non-executive careers where audit-committee readiness is highly valued. For a qualified accountant, the combination of audit depth and board-level standing is a genuine asset in the non-executive market.

What to establish before taking the role

Candidates weighing a Head of Internal Audit appointment should test a few things first. How genuinely independent is the function — does it report to the Audit Committee, and does the committee protect it? Is it resourced to cover the firm’s risk profile, or stretched too thin to be credible? Does the executive respect its findings, or is it treated as an obstacle? And are there open regulatory concerns about the firm’s control environment that the role would inherit?

The answers determine whether the role is a genuine assurance function or a compromised one, and a candidate accepting personal accountability as SMF5 should know which they are taking on.

Why the role has grown in importance

Internal audit has risen up the regulatory agenda as the third line’s role in effective governance has been emphasised. Regulators increasingly expect a firm to be able to demonstrate that its control environment is independently assured, not merely self-assessed by the functions that run it. That has raised both the profile and the expectations of the Head of Internal Audit role, and made genuine independence and rigour more valuable than ever. For capable candidates, it is a role of growing standing rather than a back-office posting.

The value of the role to the board

Ultimately the Head of Internal Audit exists to give the board something it cannot get from management: an independent, honest view of whether the firm’s controls actually work. A board that receives only management’s own assessment of its controls is being asked to trust the people being assessed. Internal audit breaks that circularity. That is why the role’s independence is protected so carefully, and why a capable, genuinely independent Head of Internal Audit is one of the most valuable governance assets a regulated firm has.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.

The Consumer Duty came into force on 31 July 2023 for open products and a year later for closed ones. Enough time has now passed — and enough FCA review activity has followed — to see clearly what separates firms that have embedded the Duty from those still treating it as a documentation exercise. This article sets out what firms have learned, drawing on the FCA’s reviews of the first and second cycles of annual board reports.

It is written for compliance leaders, board members and finance leaders in regulated firms serving retail customers, where the Duty has reshaped what good conduct looks like.

The central lesson: writing the policy was the easy part

The single clearest theme from the FCA’s reviews is that the first implementation phase tested whether firms wrote the policies, and the phase since has tested whether they can prove customers actually receive good outcomes. Many firms did the first well and have struggled with the second. Producing a Consumer Duty framework, mapping the four outcomes and issuing fair-value assessments turned out to be more straightforward than evidencing, across a whole book of customers, that the outcomes are genuinely good.

That shift — from having a framework to proving it works — is where most of the learning has concentrated, and where the gap between strong and weak firms is now widest.

Show, don’t tell

The phrase that recurs through the FCA’s board-report findings is, in effect, show don’t tell. The regulator found firms presenting extensive data without explaining how it demonstrated good or poor outcomes — dashboards full of metrics that never reached a conclusion. The better reports went beyond assertions that the firm was meeting its obligations and set out how the firm had assured itself that it was delivering good outcomes, with the analysis to support it.

For a board report specifically, the FCA looked for evidence of genuine board challenge — not a paper the board received and noted, but one it interrogated. Plans for improvement were expected to carry timescales, named owners and an indication of the data that would show the fix had worked. Firms learned that a report full of confident language but thin on evidence of scrutiny reads, to a supervisor, as a firm that has not really tested itself.

Consumer understanding: absence of complaints proves nothing

The FCA’s review of the consumer-understanding outcome produced one of the most quoted findings: several firms relied on sales data, or the absence of complaints, as evidence that customers understood their products — and the regulator said this provides no reliable assurance whatever the firm’s size. Understanding has to be tested, not assumed from the fact that nobody complained.

The firms doing this well analyse insight from call listening, complaints, chat transcripts, website analytics and drop-off data, and test communications with real customers before and after changes. That is a materially higher bar than issuing clear-looking documents and waiting for problems, and closing the gap to it has been a significant piece of learning for many firms.

Outcomes monitoring across the whole book

A related lesson concerns coverage. The FCA has pushed firms to move past monitoring a sample toward evidencing outcomes across the whole customer base, consistently. That has real operational consequences: manual reviews and spreadsheets do not scale to full coverage, and firms have had to invest in the monitoring capability to see every relevant interaction rather than a slice. Outcomes monitoring that shows complaints, persistency, switching rates and closed-book outcomes — and draws conclusions from them — is what the regulator now expects.

Distribution chains: your responsibility does not stop at your front door

One area the FCA has repeatedly flagged as weak is distribution-chain monitoring. Firms that rely on third parties to reach customers remain responsible for outcomes along that chain, and the regulator found many firms unable to evidence outcomes beyond their own direct customer contact. With distribution-chain accountability confirmed as a live area of FCA focus, firms that manufacture or distribute through others have learned they need visibility they often did not previously have.

What the strongest firms now do differently

Pulling the learning together, the firms best placed under the Duty share a pattern: they monitor every interaction rather than a sample; they map each finding to a specific one of the four outcomes; they collect evidence close to the interaction rather than reconstructing it later; and they connect each issue to a concrete action with an owner and a timescale. In short, they treat the Duty as a continuous outcomes-assurance discipline rather than an annual reporting event.

What this means for the compliance function

The Duty has changed what a conduct compliance function has to be able to do. Rules-based monitoring — checking that procedures were followed — is no longer sufficient; the function has to evidence outcomes, which demands data capability, analytical judgement and the standing to tell the board uncomfortable things. That has raised demand for compliance leaders who can operate in an outcomes-based world, and it is one of the clearest ways the Duty has reshaped the conduct hiring market.

FD Capital recruits the compliance leaders who can build and evidence Consumer Duty outcomes monitoring, into regulated firms serving retail customers.

Fair value: still the hardest outcome

Of the four outcomes, price and value has proved the most demanding to evidence, and the FCA has kept up the pressure through sector-specific work — premium finance, pure protection, unit-linked pensions and long-term savings among them. The lesson firms have drawn is that a fair-value assessment cannot be a one-off document filed at launch; it has to be a live judgement, stress-tested across the product range and revisited as costs, take-up and outcomes change.

Firms that treated fair value as a compliance artefact rather than an ongoing commercial-and-conduct question have found themselves exposed when the regulator asked to see the working. The strongest have built fair-value into their product governance so it is reassessed as a matter of routine.

The supervisory model has changed too

Part of what firms have learned is that the FCA itself is supervising differently. The regulator has moved toward a data-led, risk-based model — using data to spot potential harm and focusing on outlier firms and products rather than reviewing everyone uniformly. That raises the value of a firm being able to show, with its own data, that it is not an outlier. A firm that monitors its outcomes well and can evidence them is far better placed under this model than one that waits to be asked.

What this means for firms preparing their next board report

The accumulated learning points to a consistent set of priorities for each successive board report: move past dashboards to analysis that draws conclusions; document the board’s challenge rather than just its receipt of the report; attach timescales and owners to every planned improvement; evidence outcomes across the whole book, not a sample; deepen the evidence on consumer understanding beyond sales data and complaint volumes; and extend monitoring into distribution chains. Firms that treat each cycle as a genuine self-examination rather than an annual submission are the ones the regulator finds convincing.

The role of the board

A recurring theme in the FCA’s findings is the board’s role, and it is a lesson many firms are still absorbing. The Duty makes the board accountable for outcomes, not just for receiving a report about them. The regulator looked for evidence of genuine challenge — boards interrogating the data, questioning management’s conclusions, and pushing back where the evidence was thin. Firms where the board simply noted the report scored poorly. The learning is that the annual board report is a board responsibility to scrutinise, not a compliance deliverable to receive, and firms that have engaged their boards properly produce visibly stronger reports.

What this has meant for resourcing

Meeting the outcomes-evidence bar has required investment many firms underestimated at the outset. Full-coverage monitoring, communication testing, fair-value stress-testing and distribution-chain oversight all demand data capability and people. Firms that resourced the Duty as a one-off implementation project, and then stood the resource down, have found the ongoing evidence burden difficult. Those that built a permanent outcomes-monitoring capability are better placed — and that shift in resourcing is one reason demand for conduct and data-literate compliance professionals has risen.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.