The Authorisation Journey: Building an SMF Team From Scratch

Why Authorisation and Recruitment Are One Project

The FCA doesn’t authorise a business plan in the abstract. It authorises a firm with named Senior Managers whose approvals are applied for alongside the firm’s application. To meet the threshold conditions, the firm must show that it has suitable people, adequate resources and effective supervision. That means “get authorised” and “build the senior team” can’t be done one after the other. They run together, and who is hired when has a direct effect on how smoothly the application goes.

The statutory timescales make this matter. Under section 55V of FSMA, the FCA has six months to decide a complete Part 4A application and twelve months for an incomplete one. Payment and e-money applications have their own deadlines. Applications missing key people or with weak governance tend to be treated as incomplete, which pushes the firm towards the longer deadline.

What Needs to Be in Place Before the Application

A named compliance officer

The FCA expects to see a capable compliance lead named in the application, not a description of a role to be filled later. Applications with a strong SMF16, ideally with experience of a similar business model, move faster than ones where compliance leadership is described in general terms. For small firms this is often a part-time compliance officer.

A named MLRO

For firms with real financial crime risk, such as payments, e-money and cryptoassets, the same applies to the SMF17. A specifically identified MLRO with experience of a comparable risk profile strengthens the application far more than an assurance that AML controls will be built after authorisation. Many smaller firms combine the two roles; see combined compliance officer and MLRO recruitment.

A CEO and board proportionate to the firm

Every firm needs an SMF1 or equivalent and directors who meet the fit and proper test. Smaller firms don’t need the full board of an Enhanced firm on day one, but the FCA expects governance proportionate to the risk. Where an independent chair or non-executive is expected, having them engaged before submission adds credibility. Our guide to which SMFs apply at which firm tier sets out the requirements.

A finance lead who understands regulatory capital

Capital, liquidity and wind-down planning are central to most applications. Even if the SMF2 isn’t required, the firm needs someone who can build credible financial projections and regulatory capital calculations, and who can run regulatory reporting from day one.

Specific Statements of Responsibilities

A templated Statement of Responsibilities is a weak signal at any time, and especially in an application where the FCA is judging whether the firm’s governance has been thought through. See what goes wrong in Form A submissions.

The Order That Works

The Sequencing Mistake We See Most Often

The most common error is building the commercial and technology team first and treating the compliance officer, MLRO and board as a late step before launch. From the FCA’s point of view this is backwards. A firm that shows strong, named compliance and financial crime oversight early, even while other parts of the team are still forming, makes a far more credible application than one with an impressive commercial team and vague governance plans.

The second most common is hiring a compliance lead with plenty of experience running established functions but none of authorisation. Guiding a firm through an application is a distinct skill: writing the regulatory business plan, answering the case officer’s questions and building controls before any customers exist.

Fractional and Interim Cover During Authorisation

Many authorising firms, especially smaller ones, use fractional or interim Senior Managers through the application and early trading, then hire full-time once volumes are proven. This is often sound, and it controls cost before revenue. It works when:

• the fractional person has direct authorisation experience in your sector;
• the time commitment is realistic for the firm’s risk, and stated in the application (see how many days a week);
• the contract covers the regulatory responsibilities properly (see fractional SMF agreements); and
• there is a plan, and a trigger, for moving to a full-time hire.

Outsourcing compliance support to a consultancy is different from appointing a fractional SMF. The SMF must be an individual approved by the FCA, and accountability can’t be outsourced; see what you can and can’t outsource.

Sector Notes

• Payments and e-money: safeguarding and financial crime controls draw close scrutiny. An MLRO with payments experience and someone who understands safeguarding are essential. See the people payment and e-money applications need.
• Cryptoassets: the new UK regime brings a wave of applications, and experienced crypto MLROs are scarce. See hiring a crypto MLRO and crypto SMF recruitment.
• Advice and broking: firms moving from appointed representative to direct authorisation need their own Senior Managers for the first time. See going directly authorised.

Timing the Search

Start compliance, MLRO and any board recruitment earlier than instinct suggests: before the application is drafted, not once it is nearly ready. Allow time for notice periods, which for experienced compliance people are often three months. Fractional candidates can usually start sooner. Given how much a strong, named team strengthens an application, and how much a vague plan weakens it, this is one of the most important sequencing decisions an authorising firm makes. Our authorisation support service is built around it.

If your compliance officer will be taking on SMF16 for the first time, see what the FCA expects from a first-time SMF16 at a newly authorised firm.

Frequently Asked Questions

Do Senior Managers need to be in place before we apply?

They need to be identified, with Form A applications submitted alongside the firm’s application. In practice the compliance officer and MLRO should be engaged before the application is drafted.

How long does FCA authorisation take?

The statutory deadline is six months for a complete Part 4A application and twelve months for an incomplete one. Payment and e-money applications have their own deadlines.

Can we use a fractional compliance officer for authorisation?

Yes, if they have relevant authorisation experience and enough time for the firm’s risk. The arrangement should be described in the application.

Can a consultancy be our compliance officer?

A consultancy can provide support, but the SMF must be an approved individual. Accountability stays with the firm and its Senior Managers.

Who should we hire first?

The compliance officer and MLRO, or one person combining both, because they shape the controls and documents the application relies on.