Is a major overhaul of SMCR coming? FCA chief thinks so

The head of the Financial Conduct Authority (FCA) is getting ready to shake up the Senior Managers and Certification Regime (SMCR). In an interview, FCA chief executive, Nikhil Rathi, made it clear that the FCA supports a shift towards a less burdensome regulatory model, especially for junior staff and that he backs government efforts to make the framework more flexible. 

Rethinking certification 

Banks are currently legally required to assess and certify employees in risk-related roles, which many have complained ends up being large numbers of employees and adds to the compliance burden. Even chancellor Rachel Reeves was quoted as criticising this feature of the SMCR as “overly costly,” and Rathi seems to agree. He is considering supporting a move to allow firms to take a more risk-based approach and remove the need for certification of junior staff. 

“Firms themselves make judgments on who they certify – there are arguments both ways as to whether they’ve captured too many people and whether that’s flexible enough,” Rathi stated on the Following the Rules podcast. He went on to confirm that discussions are underway regarding a potential legislative shift that would give the FCA and the Prudential Regulation Authority (PRA) more discretion in shaping the rules.

The FCA’s proposed changes align with a broader shift in financial regulation. Rathi emphasised the need for a “proportionate” approach that allows some level of risk-taking in order to drive growth. “Lawmakers must accept ‘tolerable failure’ as a price for unlocking growth,” he said, adding that regulators and firms alike should recognize that not every financial initiative will succeed.

This philosophy extends beyond SMCR to other areas, including financial crime controls at rapidly growing challenger banks. Institutions such as Starling and Metro Bank, which have faced scrutiny over anti-money laundering (AML) failures, have been warned that their compliance frameworks must keep pace with their expansion.

Non-financial misconduct rules 

The FCA is also getting ready to release new rules on non-financial misconduct (NFM). The industry has been pushing for more guidance and these will likely provide more clarification on how bullying and harassment behaviours relate to fitness and propriety assessments for regulated roles. According to Rathi, these rules will be coming very soon. “We’re talking weeks,” he said. 

In general, Rathi envisions a shift in the regulator’s relationship with the financial industry. Rather than enforcing rigid rulebooks, the FCA wants to define broad regulatory outcomes and give firms the flexibility to meet them in their own way. “We aren’t going to go after every technical breach of every rule,” he said, noting that firms should focus on achieving regulatory objectives rather than mere box-ticking.

This adaptive approach will also apply to emerging technologies. Rathi pointed to AI as an area where the FCA does not plan to regulate every use case. Instead, it will align its oversight with the government’s broader AI strategy.

A look ahead

Despite criticism, Rathi expressed confidence in the FCA’s stability and effectiveness. “There will always be debate about what we do and whether we are doing it effectively. But I haven’t heard anything to the contrary about the FCA continuing in its current form.”

As he continues to navigate regulatory reforms, Rathi says he remains committed to balancing oversight with innovation. Stay tuned: The coming months will be crucial in determining how the FCA’s planned changes will reshape the regulatory landscape in the UK’s financial sector.

Watch the video of our webinar on FCA compliance. It’s more important than ever.

Check out our courses on FCA compliance:

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.