One cycle, started on schedule
A recurring annual schedule opens the cycle ahead of your appraisal season. A data set of certified staff and their functions feeds the dropdowns, and the Tasks grid shows which assessments are still outstanding.
SM&CR Annual Fitness & Propriety Certification Checklist Template
Every certificate expires twelve months after it is issued, and the regime around it changed three times in 2026. The annual cycle still has to run while Parliament decides what comes next.
This free checklist runs the annual Senior Managers and Certification Regime cycle at an FCA-regulated firm. It is for HR, compliance and company secretarial teams at banks, insurers, investment managers, advisers, brokers and consumer credit firms. It covers the fitness and propriety assessment and certificate for every certified person, regulatory references for joiners, Directory updates, the annual check on each Senior Manager, Statements of Responsibilities, and Conduct Rules training and breach reporting. Scoping answers add the reference phase and the breach and enhanced-firm tasks only where they apply. Each certificate is approved by a named person before it is issued.
Certification, Senior Managers and Conduct Rules: Three Annual Jobs
The SM&CR has three parts, and each brings its own yearly work. The regulators approve Senior Managers before they start, but the firm must still consider at least once a year whether there are grounds to withdraw that approval. Certified persons are not approved by the regulator at all: the firm assesses them as fit and proper and issues a certificate, valid for twelve months, under section 63F of FSMA and SYSC 27. The Conduct Rules in COCON apply to almost everyone else, and the firm must train staff on them and report breaches.
Our Employee Compliance Certification Tracking Checklist runs a monthly register check across US and UK licences, CE and certificates. This page goes deeper on the UK annual cycle itself: the assessment, the evidence and the sign-off that sit behind each certificate.
Certification Regime
Staff in certification functions
Work: assess fitness and propriety against the FIT criteria at least annually.
Output: a certificate issued for twelve months, or a refusal with written reasons.
Senior Managers Regime
Approved SMF holders
Work: annual fitness and propriety check, and Statements of Responsibilities kept current.
Output: confirmed approvals and updated statements filed after significant changes.
Conduct Rules
Almost all staff
Work: training, a breach log and disciplinary outcomes.
Output: REP008 for solo-regulated firms by 31 October; Senior Manager breaches notified within 7 business days.
What the SM&CR Annual Certification Checklist Covers
Six phases run every cycle. Regulatory references switch on when someone joined or moved role, and breach and enhanced-firm tasks appear only when the Phase 1 answers call for them.
Phase 1
Phase 1: Plan the Cycle
Owned by the SM&CR lead in HR or compliance. The answers recorded here decide which later phases and tasks appear.
- Set the cycle dates — many firms now align certification with the annual appraisal, which FCA guidance confirms is acceptable
- Refresh the certification population — map each role to its certification functions; since 10 July 2026 one certificate can cover overlapping functions
- List certificates expiring before the next cycle — with the expiry date of each
- Record the firm’s SM&CR category — limited scope, core or enhanced; enhanced adds the Responsibilities Map task
- Record whether anyone joined or moved into a certification or SMF role since the last cycle — a Yes opens Phase 3
- Record whether any Conduct Rules breach led to disciplinary action in the year to 31 August — a Yes adds the breach tasks in Phase 6
- Name the assessor and the certificate approver for each population — nobody approves their own certificate
Phase 2
Phase 2: Fitness & Propriety Assessments
Completed by line managers and HR for each certified person, using the FIT criteria.
- Collect each person’s annual self-declaration — criminal, civil, regulatory and financial matters, and outside interests
- Assess competence and capability — performance, qualifications and any Training & Competence requirements for the role
- Assess honesty, integrity and reputation — conduct breaches, disciplinary action, complaints and non-financial misconduct
- Assess financial soundness — including credit checks where firm policy requires them
- Record the recommendation and the evidence — fit and proper, fit with conditions, or not fit
Phase 3 — Joiners & Movers Only
Phase 3: Regulatory References
Shown only when someone joined or moved into a certification or SMF role since the last cycle.
- Request regulatory references covering the past six years — from every regulated employer, before certifying or applying for approval
- Chase outstanding requests — FCA guidance now asks firms to aim to respond within four weeks, down from six
- Review what each reference discloses — Conduct Rules breaches, disciplinary action and fitness concerns
- Record the outcome against the person’s assessment — and attach the references received
- Answer incoming requests about your own leavers — and update any reference you gave if new information would change it
Phase 4
Phase 4: Certificates & the Directory
Each decision is an approval task for the named certificate approver. Not approved opens the refusal steps.
- Approve or refuse each certificate — Approved or Not approved, with the reason recorded
- Issue certificates — naming the functions and the validity dates; email or other digital certificates are acceptable
- For a refusal, give written notice — the steps the firm proposes and the reasons, and stop the person performing the function
- Update the FCA Directory — within 7 business days of a change for any Directory person
- Update the certificate register with the new expiry dates — so the next cycle starts from an accurate list
Phase 5
Phase 5: Senior Managers & Responsibilities
Owned by the company secretary or SM&CR lead, with input from each Senior Manager.
- Consider each Senior Manager’s fitness and propriety — at least annually, whether there are grounds on which the regulator could withdraw approval
- Check each Statement of Responsibilities against what the person actually does — and file updates after a significant change, now within six months
- Enhanced firms: refresh the Management Responsibilities Map — same timing; only the latest version need be submitted
- Confirm every prescribed responsibility is allocated — including after leavers and reorganisations
- Check anyone covering an SMF role under the 12-week rule — the application must be submitted within 12 weeks
Phase 6
Phase 6: Conduct Rules Training & Breaches
The breach tasks appear only when a breach led to disciplinary action in the year.
- Confirm Conduct Rules training reached everyone in scope — including joiners, and covering non-financial misconduct
- Reconcile the breach log for 1 September to 31 August — each breach with its investigation and outcome
- Breaches: confirm Senior Manager breaches were notified within 7 business days — where they led to disciplinary action
- Breaches: feed each finding into the person’s fitness assessment and any reference given — a breach can change both
- Submit REP008 by 31 October — solo-regulated firms, covering the year to 31 August
Phase 7
Phase 7: Review & Sign-Off
Compliance checks a sample; the Senior Manager responsible for the certification regime approves the cycle.
- Reconcile the certificate register with the Directory and the HR system — no one performing a function without a valid certificate
- Compliance sample check — evidence supports each decision and nothing was approved by the person assessed
- Senior Manager sign-off of the cycle — an approval task; Not approved returns it to the SM&CR lead
- Report the results to the board or committee — numbers certified, refused and late, and breach trends
- Schedule the next cycle — and note any rule changes expected before it starts
SM&CR Requirements Map and Reform Timeline
The table reflects FCA rules in force in October 2026. Dual-regulated firms also follow the PRA’s rules, and the detail varies by firm category, so treat it as a starting point, not legal advice.
| Requirement | Source | Timing | Phase |
|---|---|---|---|
| Certify fitness and propriety | FSMA s.63F; SYSC 27; FIT | Before the role starts and at least annually; certificate valid 12 months | 2, 4 |
| Regulatory references | SYSC 22 | Before certifying or applying; covering six years | 3 |
| Directory | SUP 16.26 | Within 7 business days of a change | 4 |
| Senior Manager fitness | FSMA s.63(2A) | At least annually | 5 |
| Statements of Responsibilities and Responsibilities Map | SUP 10C; SYSC 25 for enhanced firms | Kept current; updates filed within six months of a significant change | 5 |
| Conduct Rules training | FSMA s.64B; COCON | On joining and on an ongoing basis | 6 |
| Conduct Rules breach reporting | SUP 15.11; SUP 10C | REP008 by 31 October; Senior Managers within 7 business days | 6 |
The regime is being reformed in two phases. The first is in force; the second needs legislation and is not.
24 April 2026
Phase 1 reforms take effect
Following the FCA’s PS26/6 and the PRA’s policy statement of 22 April, guidance confirms digital certificates and certification through appraisals, SoR and Responsibilities Map updates can follow within six months, the 12-week rule turns on submitting an application, and criminal records checks for SMF applications stay valid for six months.
10 July 2026
Overlapping certification functions
Firms no longer need to certify the same person separately for overlapping certification functions.
1 September 2026
Non-financial misconduct
Under PS25/23, the Conduct Rules in non-bank firms extend to bullying, harassment and violence towards colleagues, with new guidance on conduct and fitness assessments.
15 September 2026
Financial Services and Markets Bill reaches the Commons
The Bill would remove the Certification Regime, the Conduct Rules requirements and the rules on Statements of Responsibilities from FSMA, leaving the regulators to decide what replaces them in their rulebooks. It completed its Lords stages on 15 September and was before the Commons at the time of writing.
Late 2026 onwards
Phase 2 consultation
The FCA expects to consult on replacement rules before the end of 2026, and HM Treasury has said commencement will be aligned with them to avoid a gap. Until then, annual certification still applies.
Why Run SM&CR Certification in CheckFlow?
Approvals that cannot be skipped
Each certificate decision and the final sign-off are approval tasks assigned to named people. The checklist halts until they answer, so no certificate goes out without a recorded decision.
Evidence for supervisors and references
Self-declarations, references and assessments attach to the task they support, and the timestamped activity trail exports. When a supervisor or a future employer asks, the record of who assessed whom, and when, is complete.
CheckFlow is not an HR system, an SM&CR register or a route to FCA Connect, and it does not submit Directory updates or REP008 for you. It runs the workflow around them: who assesses each person, what evidence they used and who approved the certificate. CheckFlow’s HR checklist software covers the joiner and leaver processes that feed the population, and the financial services overview shows other recurring workflows regulated firms run this way.
Senior Managers’ responsibilities also frame the board’s annual Consumer Duty assessment, covered in the Consumer Duty Annual Review Checklist. Complaints are part of each person’s fitness evidence, and the Complaints Handling Checklist records them. See CheckFlow’s compliance checklist software for the wider compliance calendar.
Frequently Asked Questions
How often must certified staff be assessed under the SM&CR?
Before they start a certification function and at least once a year after that. A certificate is valid for twelve months, and nobody may perform a certification function without a valid one. Many firms run everyone through one cycle so certificates expire together, while others certify on each person’s anniversary. Either works if the register shows no gaps.
What are the fit and proper criteria?
The FCA’s FIT sourcebook sets three: honesty, integrity and reputation; competence and capability; and financial soundness. The firm decides what evidence it needs for each, usually a self-declaration, the appraisal, qualifications, conduct and disciplinary records and, for some roles, credit or criminal records checks. Guidance that took effect on 1 September 2026 explains how non-financial misconduct, such as bullying or harassment, bears on the assessment.
Is the Certification Regime being abolished?
It is proposed, not done. The Financial Services and Markets Bill would remove the Certification Regime from FSMA, including the annual recertification requirement, and let the FCA and PRA write a more proportionate replacement into their rulebooks. When this page was last reviewed the Bill had passed the House of Lords and was before the Commons, the FCA had not yet consulted on replacement rules, and HM Treasury had said commencement would wait for them. Keep certifying annually until the rules change.
Can annual certification be done through the appraisal process?
Yes. FCA guidance in force since 24 April 2026 confirms firms can fold recertification into annual appraisals and that certificates can be issued digitally, including by email. The assessment still has to cover the FIT criteria and be evidenced, so build the fitness questions into the appraisal rather than treating a completed appraisal as a certificate.
Who needs a regulatory reference?
Anyone a firm proposes to certify or to put forward for Senior Manager approval. The hiring firm asks every regulated employer from the past six years for a reference in the standard form, disclosing breaches, disciplinary action and fitness concerns. FCA guidance now asks firms giving references to aim to respond within four weeks.
When is REP008 due?
Solo-regulated firms report Conduct Rules breaches that led to disciplinary action for the year from 1 September to 31 August, and submit REP008 by 31 October. Breaches by Senior Managers that lead to disciplinary action are notified separately, within 7 business days. Dual-regulated firms should check the PRA and FCA arrangements that apply to them.
Is CheckFlow free for this template?
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.