SMF24 Explained: What the FCA Expects From a Chief Operations Function

What SMF24 Covers

The Chief Operations function carries responsibility for the internal operations and technology of the firm — the systems, processes and infrastructure that keep the business actually running day to day. Historically this sat somewhat in the shadow of the more visible executive functions like SMF1 and SMF2, treated as an important but largely internally-facing role. That’s changed substantially with the introduction of the FCA and PRA’s operational resilience framework, which has made SMF24 one of the executive functions most directly exposed to formal regulatory reporting obligations and supervisory attention.

Which Firms Need an SMF24

For FCA solo-regulated firms, SMF24 applies to Enhanced firms. Dual-regulated banks and insurers also have the function. Core firms do not need an SMF24, although many still have a chief operating officer, who is usually within the Certification Regime or approved as an executive director (SMF3) if they sit on the board. Our guide to which SMFs apply at which firm tier sets out the position.

Operational Resilience Has Changed the Job

Under the operational resilience rules, firms must identify their important business services — the services whose disruption could cause harm to consumers or market integrity — set impact tolerances for how much disruption to each service is acceptable, and demonstrate through testing that they can actually stay within those tolerances during a severe but plausible disruption scenario. The SMF24 holder typically carries direct, personal accountability for this framework, which means the role now involves formal regulatory reporting and testing obligations that didn’t exist in anything like the same form a decade ago.

This is not a paperwork exercise the COO can delegate and simply sign off. The FCA and PRA expect genuine scenario testing — cyber attack, critical third-party outage, major system failure — with real evidence that the firm can identify a breach of impact tolerance and respond to it, not a tabletop exercise that concludes everything would probably be fine. An SMF24 holder without direct, hands-on experience of building and running this kind of resilience testing programme is starting from a significant disadvantage in a firm where operational resilience maturity now genuinely matters to supervisors.

The FCA’s policy is set out on its operational resilience pages. Our guide to where supervisory expectations on operational resilience stand now covers the current position.

Third-Party and Outsourcing Oversight

Modern regulated firms depend heavily on third-party providers — cloud infrastructure, payment processing, core banking platforms, outsourced technology development — and the SMF24 holder typically carries direct accountability for overseeing those relationships from an operational risk perspective. This includes understanding concentration risk where multiple critical functions depend on the same provider, having credible exit and contingency plans for critical third-party relationships, and making sure due diligence on new providers actually assesses operational resilience rather than simply cost and functionality.

Technology and Change Management

Beyond steady-state operations, SMF24 typically carries accountability for the firm’s approach to technology change — system migrations, platform upgrades, and the operational risk that major change programmes introduce. A firm undergoing significant technology transformation while its SMF24 holder lacks direct experience of managing change risk at that scale is taking on a specific, identifiable risk that a properly scoped search should catch before the appointment is made, not after a migration goes wrong.

Typical Responsibilities in an SMF24 Statement of Responsibilities

Getting the boundaries right matters. Where the chief technology officer, chief risk officer and chief operating officer all touch resilience, their Statements of Responsibilities should say clearly who owns what. See writing a Statement of Responsibilities that works.

What a Strong SMF24 Candidate Looks Like

Direct prior experience holding a COO or senior operations leadership role at a comparable regulated firm, ideally one that has actually run an operational resilience programme through to a genuine regulatory reporting cycle rather than only building the initial framework; hands-on experience overseeing critical third-party and outsourcing relationships, including having managed an actual third-party incident or exit; genuine technology fluency sufficient to hold real conversations with the firm’s technology leadership, even where SMF24 doesn’t personally run the technology function; and enough operational and personal credibility to drive genuine change management discipline across a business that may resist it.

Interviewing an SMF24 Candidate

Useful questions test real experience rather than familiarity with the vocabulary:

• Walk us through the last severe but plausible scenario you tested. What failed, and what did you change?
• Tell us about a critical supplier incident you managed. How long were you outside tolerance, and how did you know?
• How did you decide the firm’s important business services and impact tolerances, and who challenged them?
• Describe a third-party exit or migration you led. What would you do differently?
• How do you report operational resilience to the board, and what did the board push back on?

Our guide to interviewing an SMF candidate covers the wider approach.

Where SMF24 Sits Relative to Other Executive Functions

SMF24 sits alongside SMF1, SMF2 and SMF4 as one of the core executive functions at larger regulated firms, and the operational resilience obligation increasingly means it needs to be recruited with the same rigour as those better-established designations rather than treated as a secondary appointment. Boards building out a full executive team at a scaling Enhanced-tier firm should think about SMF24 as a genuinely strategic hire, not simply “the person who keeps the lights on.”

We recruit for the role through our chief operating officer recruitment (SMF24) service. Where SMF24 is one of several new roles as a firm becomes Enhanced, our multi-SMF team build coordinates the searches, and where the incumbent has left suddenly, interim SMF cover can bridge the gap.

Frequently Asked Questions

Does a Core firm need an SMF24?

No. SMF24 applies to Enhanced solo-regulated firms and to dual-regulated firms. A Core firm’s COO is usually certified or approved as SMF3 if on the board.

Is operational resilience always the SMF24’s responsibility?

Usually, but not always. Some firms allocate it to the chief risk officer or a technology Senior Manager. The Statements of Responsibilities must make it clear.

What background makes a strong SMF24?

Senior operations leadership at a regulated firm, hands-on resilience testing and third-party oversight, and enough technology fluency to challenge the technology team.

How long does an SMF24 search take?

Typically three to four months to an accepted offer, then the approval period and notice period.