The SMF24 Chief Operations Function

SMF24 is the Senior Manager Function for the chief operating officer. The holder is accountable for the firm’s internal operations and technology, including operational resilience, outsourcing and business continuity. Under the Senior Managers and Certification Regime, SMF24 applies at Enhanced firms and at dual-regulated firms, where it’s designated by the Prudential Regulation Authority.

At Core firms, the operations role isn’t a Senior Manager Function, and responsibility for operations and technology usually sits with an executive director or the chief executive. Many Core firms still need an experienced chief operating officer, and SMF Capital recruits for both. Our SMF24 guide explains the function in detail. This page is about hiring one.

What the Regulators Expect

• Operational resilience: identifying important business services, setting impact tolerances, mapping dependencies and testing that the firm can stay within tolerance in severe but plausible scenarios. See our analysis of where operational resilience expectations stand.
• Outsourcing and third-party risk: due diligence, contracts, oversight and exit planning for critical suppliers, under rules such as SYSC 8.
• Technology and cyber resilience: secure, resilient systems and a tested response to incidents. Many firms use the National Cyber Security Centre‘s guidance as a baseline.
• Change management: delivering major technology and operational change without disrupting customers.
• Incident management and reporting, including notifications to the regulators.

The role has grown significantly as firms have become more dependent on technology and third parties, and as regulators have made resilience a priority.

Permanent, Interim and Fractional Chief Operating Officer Appointments

Permanent

Most Enhanced and dual-regulated firms need a permanent COO who can own operations, technology and resilience over the long term, lead large teams and manage critical suppliers.

Interim

Interim COOs lead major transformation programmes, technology migrations, integration after acquisitions, or remediation of resilience weaknesses identified by the regulators. Where a Senior Manager leaves unexpectedly, the 12-week rule allows temporary cover, and since the April 2026 reforms the firm must submit an approval application within those 12 weeks if the person covering is to continue.

Fractional

Fractional operations leadership suits smaller firms that need senior oversight of outsourcing, resilience and change without a full-time executive. See fractional and interim SMF cover and our article on when fractional appointments work.

How We Run a Chief Operating Officer Search

1. Brief against the Statement of Responsibilities. We start from what the new Chief Operating Officer will actually be accountable for, including any Prescribed Responsibilities, not just the job title.
2. Direct, confidential search. Most strong candidates already hold roles and aren’t looking. We approach them discreetly, without naming your firm until the right point.
3. Fit and proper pre-assessment. Every candidate is tested against the fit and proper test before reaching your shortlist: prior approvals, regulatory history, directorships and financial soundness.
4. Shortlist and interview. Adrian Lawrence FCA interviews every shortlisted candidate personally. Our guide to interviewing an SMF candidate sets out the questions we use.
5. References and application. We start regulatory references early and support the approval application and Statement of Responsibilities.
6. Through approval to day one. We plan notice periods around the regulator’s timetable and stay involved until your new Senior Manager is in post.

What We Look For in COO Candidates

Resilience Experience

Candidates who have led operational resilience programmes, including mapping, impact tolerances and scenario testing, are in strong demand.

Third-Party and Cloud Oversight

Most regulated firms depend on cloud providers and outsourced services. We look for experience negotiating and overseeing critical supplier relationships, including exit planning.

Incident Leadership

How a candidate has handled a real incident, such as a system outage, cyber attack or supplier failure, tells you more than any framework.

Regulatory Credibility

COOs at dual-regulated firms may be interviewed by the PRA and must explain technical risk in business terms to boards and supervisors.

Change Delivery

Many COO roles involve significant change. Evidence of delivering complex programmes on time, without harming customers, is essential.

COO Recruitment by Sector

• Banks and building societies: core banking systems, payments infrastructure and PRA resilience expectations.
• Investment managers and platforms: fund administration, custody and dealing operations.
• Insurers: policy administration, claims operations and delegated authority.
• Payments and fintech: scalable technology and dependence on card schemes, banking partners and cloud providers.

The COO and the Rest of the Senior Team

The chief operating officer works closely with the chief risk officer, who challenges operational risk, and with compliance, which oversees customer outcomes affected by operational failures. Clear division of responsibilities between these roles matters, particularly for operational resilience, where accountability can easily become blurred. The Statement of Responsibilities should make clear what the COO owns and how it fits alongside the other Senior Managers. At smaller Enhanced firms, where one executive may cover operations, technology and change, the regulators will look closely at whether one person can realistically carry all of it.

A Thin Candidate Pool

Experienced SMF24 holders are relatively scarce, because the function applies only at Enhanced and dual-regulated firms. Many strong candidates are senior operations or technology leaders who haven’t held the function yet. We assess their readiness against the fit and proper test and help firms make a strong case for first-time approval. SMF24 candidates can see current roles on our jobs board.

Timing and Approval

Senior operations leaders often have long notice periods, and the regulators can take up to three months to decide a complete application. For dual-regulated firms, allow time for a PRA interview. Our SMF appointment timeline sets out the stages.

Other Senior Manager Roles We Recruit

SMF Capital recruits across every Senior Manager Function. Alongside this role, we have dedicated pages for Compliance Officer (SMF16), MLRO (SMF17), Chief Risk Officer (SMF4), Chair and Committee Chairs (SMF9–SMF14) and Regulated Chief Executive (SMF1), and designation guides to every other SMF. We also run sector-specific searches for wealth managers, investment managers, consumer credit firms, insurers and MGAs, banks and building societies, payments and fintech firms and crypto-asset firms, and location searches in London, Birmingham and Bristol. Candidates can see every current role on our SMF jobs board.

Frequently Asked Questions

Does a Core firm need an SMF24?

No. SMF24 applies at Enhanced and dual-regulated firms. Core firms may still need a COO, with responsibility for operations sitting with an executive director who holds another function.

Can the COO also be responsible for technology?

Yes, commonly. Some larger firms separate the chief operating officer and chief technology officer roles, but accountability for operations and technology resilience still needs to be clearly allocated to a Senior Manager.

Do you recruit interim COOs for transformation programmes?

Yes. See fractional and interim SMF cover.

How long does a COO search take?

Typically four to six weeks to shortlist, then notice periods and the regulators’ assessment.