6.2 Conduct Standards, SM&CR & Consumer Duty

Origins & Purpose of the Senior Managers & Certification Regime (SM&CR)

For many years, personal accountability in UK financial institutions was governed by the Approved Persons Regime (APR). Following the 2008 banking crash, the Parliamentary Commission on Banking Standards (PCBS) concluded that the APR suffered from fatal weaknesses. Large financial institutions operated with diffuse, matrix-managed governance structures where decisions were made by amorphous committees. When catastrophic failures or systemic misconduct emerged, senior executives frequently claimed ignorance, arguing that the specific operational failure was not within their personal remit—a culture colloquially termed corporate "buck-passing" or "too big to jail."

To re-establish individual accountability and drive profound cultural change, Parliament enacted the Senior Managers and Certification Regime (SM&CR) via the Financial Services (Banking Reform) Act 2013. The regime was extended to the UK insurance sector (insurers and Lloyd's managing agents) in December 2018 and subsequently to insurance intermediaries and brokers in December 2019.

The SM&CR pursues three foundational objectives:

• Encouraging a culture where staff at all levels take personal responsibility for their actions;
• Making it clear to both firms and regulators exactly which senior individuals are responsible for which areas of the business; and
• Ensuring that regulators can hold individuals personally accountable for regulatory contraventions within their sphere of control.

---

The Three Pillars of SM&CR

The SM&CR replaces the historic APR with a cohesive, three-part architecture:

                                [ The Three Pillars of SM&CR ]
                                              │
         ┌────────────────────────────────────┼────────────────────────────────────┐
         ▼                                    ▼                                    ▼
    [ Pillar 1 ]                         [ Pillar 2 ]                         [ Pillar 3 ]
 [ Senior Managers ]                [ Certification Regime ]               [ Conduct Rules ]
      Regime                                  │                                    │
         │                                    │                                    ├─ Tier 1: Individual
         ├─ Senior Management Functions       ├─ Material Risk-Takers              │  Conduct Rules
         │  (SMFs) Pre-Approved by Regulators │  (Defined Significant-Harm Roles)           │  (Applies to covered staff)
         ├─ Statements of Responsibilities    ├─ NOT Pre-Approved by Regulators    │
         │  (SoR)                             ├─ Firm-Assessed Annually as         └─ Tier 2: Senior Manager
         ├─ Prescribed Responsibilities (PRs) │  "Fit and Proper"                     Conduct Rules
         └─ Statutory Duty of Responsibility  └─ Annual Certificate of Fitness        (SC1 to SC4)

Pillar 1: The Senior Managers Regime (SMR)

The Senior Managers Regime applies to the most senior individuals who hold key executive or strategic decision-making authority within a firm. The SMFs required depend on the firm and its activities; the following are examples of designated Senior Management Functions (SMFs), rather than roles every firm must appoint:

• SMF1: Chief Executive Officer (CEO)
• SMF2: Chief Finance Officer (CFO)
• SMF3: Executive Director
• SMF16: Compliance Oversight
• SMF17: Money Laundering Reporting Officer (MLRO)
• SMF20: Chief Actuary (for insurance carriers)

Regulatory Pre-Approval

An individual normally requires regulatory approval before performing an SMF. PRA-designated functions require PRA approval with FCA consent; FCA-designated functions follow the FCA approval route, including at a dual-regulated insurer. The relevant function determines the application route. The candidate must pass the Fit and Proper Test (FIT), assessing honesty, integrity, reputation, operational competence, capability, and financial soundness.

Statement of Responsibilities (SoR)

Every Senior Manager must hold an individual, legally binding Statement of Responsibilities (SoR). This document sets out precisely what the individual is responsible for managing. The SoR must be submitted to regulators upon application and resubmitted whenever a material change in responsibilities occurs, leaving no ambiguity regarding executive boundaries.

Prescribed Responsibilities (PRs)

Firms must allocate the Prescribed Responsibilities (PRs) applicable to their firm type among appropriate Senior Managers. Examples include oversight of the firm's SMR, certification obligations and Conduct Rules training/reporting. Financial-crime and other responsibilities depend on the applicable rules. The Handbook's allocation requirements do not create an identical list for every insurer and broker, and delegation does not remove the allocated manager's accountability.

Statutory Duty of Responsibility

Under Sections 66A and 66B of FSMA, a Senior Manager can be held accountable where the firm breaches a relevant regulatory requirement, the manager was responsible for the affected activities, and the manager failed to take steps reasonably expected of someone in that position to avoid or stop the breach.

The burden of proof is on the regulator. Misconduct is not automatically established merely because a breach occurred in the manager's area, and the manager does not bear a reversed burden to prove innocence. The FCA or PRA must establish the applicable statutory elements.

Reasonable steps depend on the circumstances. Clear responsibilities, appropriate delegation, effective oversight and escalation help a manager prevent or stop contraventions. Records can help demonstrate what happened, but keeping records does not transfer the regulator's burden to the manager.

---

Pillar 2: The Certification Regime

The Certification Regime covers specified Certification Functions which are not Senior Management Functions but could cause significant harm. A firm must identify the functions that apply to it and the people performing them; a job title alone does not determine certification.

Relevant functions can include:

• At insurers: PRA-defined key function holders and, at large firms, material risk takers, subject to the rulebook's scope. An underwriter may qualify because of their actual responsibilities and risk impact.
• At applicable FCA firms: Significant-management functions, CASS oversight and other specified certification functions.
• Managers of certification employees: Where the defined management function applies.

Ordinary general-insurance placing or advice does not by itself trigger the FCA client-dealing certification function, which excludes non-investment insurance activities. A catastrophe modeller likewise needs to meet a defined function rather than being certified automatically because they build models.

Core Exam Distinction: No Regulatory Pre-Approval

Unlike Senior Managers, certification employees are NOT pre-approved by the FCA or PRA. Regulators do not vet them. Instead, the statutory burden is placed squarely on the firm itself.

The firm must evaluate and certify in writing that each certification employee is fit and proper to perform their function:

1. At the time of initial appointment or recruitment; and
2. At least once every 12 months thereafter (Annual Re-Certification).

If an underwriter or broker fails the firm's fit and proper assessment (e.g., due to dishonest market conduct or gross incompetence), the firm must refuse to issue or renew the certificate, legally barring the individual from performing the role.

---

Pillar 3: The Conduct Rules (COCON)

The Conduct Rules are enforceable behavioural standards found in the FCA Code of Conduct sourcebook (COCON). They apply to virtually all employees in financial services firms, excluding only purely ancillary staff (such as catering, reception, security, and facilities personnel).

                    [ FCA Conduct Rules Architecture (COCON) ]
                                        │
         ┌──────────────────────────────┴──────────────────────────────┐
         ▼                                                             ▼
 [ Tier 1: Individual Conduct Rules ]             [ Tier 2: Senior Manager Conduct Rules ]
   (Applies to all covered staff)                   (SMFs; SC4 also covers other directors)
  • Rule 1: Act with integrity                     • SC1: Controlled effectively
  • Rule 2: Due skill, care and diligence          • SC2: Comply with regulatory system
  • Rule 3: Open & cooperative with regulators     • SC3: Appropriate delegation & oversight
  • Rule 4: Pay due regard to customers (TCF)      • SC4: Disclose to FCA/PRA appropriately
  • Rule 5: Proper market conduct standards
  • Rule 6: Good retail customer outcomes

Tier 1: Individual Conduct Rules

• Rule 1: You must act with integrity.
• Rule 2: You must act with due skill, care and diligence.
• Rule 3: You must be open and cooperative with the FCA, the PRA and other regulators.
• Rule 4: You must pay due regard to the interests of customers and treat them fairly.
• Rule 5: You must observe proper standards of market conduct.
• Rule 6: You must act to deliver good outcomes for retail customers. Where Rule 6 applies to conduct, Rule 4 does not apply to that conduct; apply the COCON scope rules.

Tier 2: Senior Manager Conduct Rules

These additional rules apply to Senior Management Function holders under the COCON application rules. SC4 also applies to non-SMF directors; it is not restricted to approved Senior Managers:

• SC1: You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively.
• SC2: You must take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system.
• SC3: You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively.
• SC4: You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice.

---

The FCA Consumer Duty (Principle 12 & PRIN 2A)

In July 2023, the FCA introduced the Consumer Duty, setting a fundamentally higher standard of consumer protection. It introduced Principle 12 into the Principles for Businesses:

"A firm must act to deliver good outcomes for retail customers."

The Duty moves beyond historic compliance rules: firms cannot simply assert that they provided disclosure or avoided mis-selling; they must actively demonstrate and measure that retail consumers experience good outcomes throughout the product lifecycle.

The Three Cross-Cutting Rules

Underpinning the Duty are three cross-cutting rules specifying how firms must act across all retail operations:

1. Act in good faith towards retail customers (eliminating deceptive clauses or exploiting consumer inertia);
2. Avoid causing foreseeable harm to retail customers (identifying potential pitfalls in product design or claims handling);
3. Enable and support retail customers to pursue their financial objectives (providing clear, accessible paths to manage policies and make claims).

The Four Consumer Outcomes

Firms must evidence compliance across four mandatory outcomes:

Scope and Application to the London Market

The Consumer Duty can apply to insurance for consumers and smaller commercial customers, including companies. Corporate legal form does not itself remove retail protection. For general insurance, the current scope excludes commercial specialist risks contracts (such as commercial marine/aviation risks) and other general-insurance contracts for larger commercial customers, as defined in the Handbook. Product, customer and territorial rules determine the result.

• Delegated Authority: An insurer, MGA or coverholder involved in an in-scope retail product must consider its Consumer Duty responsibilities. Delegation or a wholesale position does not itself remove those responsibilities.
• Material Influence: A firm in the distribution chain can be responsible where it determines or materially influences retail customer outcomes, even without a direct customer relationship. Apply the Duty to the activities and outcomes for which that firm is responsible.

---

Whistleblowing & The Public Interest Disclosure Act 1998 (PIDA)

A cornerstone of regulatory governance and corporate integrity in the UK financial services sector is the statutory protection afforded to workers who expose unlawful conduct, malpractice, or financial crime within their organisations. Whistleblowing serves as an essential early-warning mechanism, enabling regulators and senior management to identify and rectify systemic misconduct before catastrophic policyholder harm occurs.

1. Statutory Purpose of PIDA 1998 & Employment Rights Act 1996

The Public Interest Disclosure Act 1998 (PIDA) incorporated comprehensive statutory whistleblower protections directly into the Employment Rights Act 1996 (ERA 1996):

• Statutory Purpose: PIDA is designed to promote a culture of openness, accountability, and ethical governance by protecting workers who make disclosures of information in the public interest.
• Protection Against Dismissal and Detriment: Under the ERA 1996 (as amended by PIDA), an employee who makes a protected disclosure has the statutory right not to be subjected to any detriment (such as demotion, denial of promotion, disciplinary harassment, salary reduction, or exclusion from key projects) by their employer or co-workers. Furthermore, if an employee is dismissed because they made a protected disclosure, the dismissal is classified in employment law as an automatically unfair dismissal, entitling the worker to bring a claim before an Employment Tribunal without any qualifying period of service and with uncapped statutory compensation.
• Broad Definition of Worker: Statutory whistleblowing protection extends beyond standard permanent employees to include contract workers, agency staff, trainees, and seconded personnel operating across the insurance market.

2. Qualifying and Protected Disclosures

For a worker's communication to qualify for statutory employment protection, it must satisfy a two-stage legal test: it must be a qualifying disclosure, and it must be made through an approved reporting channel to become a protected disclosure.

Categories of Qualifying Disclosures

Under Section 43B of the Employment Rights Act 1996, a disclosure is a qualifying disclosure if the worker has a reasonable belief that the disclosure is made in the public interest and tends to show one or more of the following statutory categories. In Great Britain, sexual harassment has been an express category since 6 April 2026:

1. Criminal Offences: A criminal offence has been committed, is being committed or is likely to be committed, such as fraud, bribery or sanctions evasion.
2. Breach of Legal Obligations: A person has failed, is failing or is likely to fail to comply with a legal obligation, including an applicable regulatory requirement.
3. Miscarriages of Justice: A miscarriage of justice has occurred, is occurring or is likely to occur.
4. Health and Safety Dangers: An individual's health or safety has been, is being or is likely to be endangered.
5. Sexual Harassment: Sexual harassment has occurred, is occurring or is likely to occur.
6. Environmental Damage: The environment has been, is being or is likely to be damaged.
7. Deliberate Concealment: Information tending to show any of the preceding matters has been, is being or is likely to be deliberately concealed.

Crucial Distinction: Disclosures concerning purely personal employment grievances (such as an individual's dissatisfaction with a personal pay review, personality clashes, or minor administrative disagreements) do not constitute qualifying disclosures under PIDA because they lack the requisite public interest dimension.

Approved Reporting Channels for Protected Disclosures

To qualify as a legally protected disclosure, the worker must disclose the information through authorized channels recognized by statute:

• Internal Disclosure to Employer: Reporting through the firm's internal whistleblowing procedures to an authorized manager, compliance officer, or nominated director (the standard and primary route);
• Legal Adviser: Disclosing information to a qualified legal adviser in the course of obtaining professional legal advice;
• Prescribed Persons and Regulators: Disclosing directly to designated statutory regulatory authorities, which specifically include the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA). A worker is legally permitted to report directly to the regulators without first raising the matter internally.

3. FCA Whistleblowing Rules (SYSC 18)

Check the rule's application before treating a governance measure as mandatory. The main SYSC 18 arrangements and champion requirements apply to specified banking firms and insurers, including relevant UK Solvency insurers and Lloyd's managing agents. Ordinary insurance intermediaries are not brought into that mandatory scope simply by being FCA-authorised or large; other firms may adopt the rules as proportionate best practice. Statutory protected-disclosure rights remain relevant outside the mandatory regulatory scope.

• Whistleblowers' Champion: An insurer within the relevant scope must appoint a director or senior manager as champion. The FCA expects a non-executive director where the firm has one. The champion oversees the integrity, independence and effectiveness of the arrangements, including measures against victimisation; they need not personally handle every report.
• Internal Reporting Arrangements: In-scope firms must maintain appropriate, effective channels for reportable concerns. These must handle requests for confidentiality and anonymous reports, assess and escalate concerns, keep appropriate records, and provide feedback where feasible and appropriate.
• Protection and Training: Arrangements must include reasonable measures against victimisation and appropriate staff/manager training. They must explain the right to report directly to the FCA or PRA without first using the internal channel. A requested confidentiality arrangement is not a guarantee that every disclosure can be investigated or that identity can never need lawful disclosure.
• NDAs and Settlement Agreements: Under ERA 1996 section 43J, an agreement is void insofar as it prevents a protected disclosure. This does not invalidate every NDA or every other confidentiality obligation. SYSC 18 additionally requires relevant settlement agreements to preserve protected-disclosure rights and prohibits specified warranties about such disclosures.

The distinction is between a worker's statutory protection and the additional systems/champion rules applying to specified firms. A broker can encourage reporting and protect staff without incorrectly claiming that every SYSC 18 provision is a universal broker requirement.