Now that the Senior Managers and Certification Regime (SMCR) has been extended, how does it affect insurance firms? We have the answers to 17 frequently asked questions.
Almost every employee at an insurance firm regulated by the FCA is now affected by the regime. The SMCR is designed to hold all financial sector employees to certain standards of conduct and to hold senior managers accountable for any misconduct that falls within their area of responsibility.
Below we've answered the questions we've been asked most frequently, but if we've missed any, please let us know and we will happily add more!
We also have a companion article relating to SMCR for solo-regulated firms.
The extension of the SMCR to insurers came into effect on 10th December 2018 for dual-regulated insurers and on 9th December 2019 for solo-regulated firms.
No, the requirements are being applied proportionally. All insurers will be subject to the FCA Certification regime, Fit and Proper test obligations and Conduct Rules requirements.
The full SMCR applies only to Solvency II insurers, and insurers outside the scope of Solvency II with assets of at least £25 million (known as "large non-directive firms").
A more "streamlined" SMCR regime applies to Solvency II firms and large Non-Directive Firms ("NDFs") and a streamlined regime will apply to small NDF's, small runoff vehicles and Insurance Special Purpose Vehicles ("ISPVs").
As the SMCR applies on a legal entity basis, if your firm is part of a group, you will also need to consider how each of the entities is caught by the regime.
The new certification regime, the extension of conduct rules to all staff except for ancillary and the new duty of responsibility.
The conduct rules apply to an individual’s activities in relation to the firm’s regulated and unregulated financial services activities (including any activities carried on in connection with a regulated activity).
The Certification Regime applies to people whose jobs mean they can have a significant impact on customers, the firm or market integrity. The regime also applies to anyone who supervises or manages a Certified Function that isn’t a Senior Manager.
FSMA defines a Certification Function as one that "requires the person performing it to be involved in one or more aspects of the firm’s affairs, so far as relating to a regulated activity, and those aspects involve, or might involve, a risk of significant harm to the firm or any of its customers." (s63E(5) of FSMA).
The FCA and PRA have defined a series of 'certification functions'. The Certification Regime only applies to employees of firms, it doesn’t apply to Non-Executive Directors.
Firms must assess each year whether any person that is to carry out a certification function is fit and proper to perform their role and issue a certificate to them if they are. Some of the staff in the scope of the Certification Regime may previously have been subject to regulator approval. This is not required under the Certification Regime. This reinforces that firms, rather than the regulator, are responsible for ensuring their staff are fit and proper.
The Duty of Responsibility specifies that the FCA and/or PRA can take action against a Senior Manager where they can show that:
The burden of proof for all these elements lies on the regulators. The Senior Manager does not need to show that they took reasonable steps, it is for the regulator(s) to prove that they did not.
Yes, if a Senior Manager performs a role that is subject to the certification regime, and that role is not related to their Senior Management Function, then they also need to be certified. For example, if a Senior Manager meets the definition of the client dealing function (broadly equivalent to the current CF30 role), they must be certified for that function. However, the FCA doesn’t think that there will be many such cases amongst insurers.
The Statement of Responsibilities (SoR) is a single document that every Senior Manager must have which clearly sets out their role and responsibilities. It is the same in substance as a Scope of Responsibilities document, which some insurers were required to submit under the revised APR and PRA’s SIMR. Insurers are required to submit SoRs with an application for approval of a new Senior Manager and must keep these up to date and re-submit them whenever there is a significant change in responsibilities.
The SMCR provides a more granular list of Senior Management Functions (SMFs) than the previous list of controlled functions. If a person is to carry out a role that is designated as an SMF they must be approved as such. Otherwise, there is no general requirement to appoint individuals to hold SMFs.
Yes, it is possible to hold more than one SMF. For example, an SMF3 – Executive Director may also hold the SMF17 – Money Laundering Reporting Officer function. Where this is the case, the individual needs approval from the regulator for each function. The Senior Manager only needs one SoR, but this must clearly describe all their responsibilities.
Yes. Individual conduct rules are basic standards of behaviour that apply to all individuals performing financial services activities in firms. These rules apply to all staff except for ancillary staff, such as cleaners, receptionists, catering staff and security staff.
This requirement only applies to Solvency II firms and large NDFs. Such firms must take all reasonable steps to make sure that a person taking on a Senior Manager role has all the information and materials they could reasonably expect to have to do their job effectively. One way of doing this could be for the predecessor to prepare a suitable handover note. Insurers must create a policy document to explain how they comply with this requirement and maintain adequate records of the steps they have taken.
The Senior Managers Regime allows someone to cover for a Senior Manager without being approved where the absence is temporary or reasonably unforeseen, where the appointment is for less than 12 consecutive weeks.
Firms with complex group structures need to consider the impact of SMCR on senior management within each legal entity, as well as the impact on any individuals within the wider group who exert significant influence over the management and conduct of UK‑regulated activities within the relevant legal entity. For groups with several legal entities, the SMCR could apply in a differing way to each entity.
Yes, firms must make individuals who are subject to the Conduct Rules aware that this is the case, and take all reasonable steps to ensure that they understand how the rules apply to them and their role.
HR processes will require modification to implement the new Regulatory Reference and Criminal Record Check Requirements. The regulatory reference requirements apply when appointing an individual to a Senior Manager or a Certified role and will also apply to all NEDs who aren’t Senior Managers. The criminal record checks apply to Senior Managers and NEDs (where a fitness requirement applies) as part of checking that they are fit and proper.
We have created an SMCR roadmap to help you navigate the compliance landscape, supported by a comprehensive library of SMCR Courses and a fully integrated SMCR 360 Compliance Toolkit.
We also have over 100 free compliance training aids, including assessments, best practice guides, checklists, desk aids, eBooks, games, posters, training presentations and even e-learning modules!
Finally, the SkillcastConnect community provides a unique opportunity to network with other compliance professionals in a vendor-free environment, priority access to our free online learning portal and other exclusive benefits.