The Senior Managers and Certification Regime (SMCR) for insurers

• Insurance regulation
• Insurance
• Insurance brokers and intermediaries
• Financial Services
• Insurance and wealth management
• UK
• Europe

SM&CR's conduct rules will apply to all regulated firms from 10 December 2018. Brokers and other smaller solo-FCA regulated firms will become subject to the SMCR from 9 December 2019. The FCA has published a simple and useful overview of the regime here. The SMCR is made up of the senior managers' regime, the certification regime and the conduct rules. This is called the core regime. Firms subject to the Solvency II Directive, large non-directive firms (NDFs) and insurance special purpose vehicles will transition automatically, while small NDFs and small run-off firms will be required to submit additional information to the Financial Conduct Authority (FCA) before they can transition.

Senior manager's regime

The most senior people in a firm will be approved by the FCA and firms will have to ensure managers are suitable for their role and review this once a year.

Senior managers will be required to have:

• a statement of responsibilities - replacing the existing governance maps. The PRA said that these documents should promote clarity and transparency about the individual responsibilities of each senior manager and a firm or group's management and governance arrangements. The statement of responsibilities should be a single document describing the firm’s management and governance arrangements in order to demonstrate that there are no gaps in accountability. These will have to be submitted with every application for approval of a new senior manager and be kept up to date (and resubmitted in the event of any significant changes in responsibilities). Solvency II firms will have to keep records of their SoRs documents for 10 years. Large and small NDFs are required to keep records for 6 years 
• a duty of responsibility - under SMCR, senior manager functions (SMF) will have a duty of responsibility to take reasonable steps to avoid the firm breaching its regulatory duties in the area for which they are responsible. This duty of responsibility (14-page / 232KB PDF) means that regulators can take action against a senior manager where
• there is a contravention of a relevant requirement by the senior manager’s firm;
• at the time of the contravention or during any part of it, the senior manager was responsible for the management of any of the firm’s activities in relation to which the contravention occurred; and
• the senior manager did not take such steps as a person in their position could reasonably have been expected to take to avoid the contravention occurring or continuing.

Whilst this is an additional burden, if Senior Managers observe the PRA’s conduct standards then this should assist in discharging this duty. The Regulator will look at all the circumstances of the case, including the seriousness of the breach, the person’s position, responsibilities and seniority, and the need to use enforcement powers effectively and proportionately. These criteria are published in the FCA’s Decision Procedure and Penalties Manual (DEPP).

• Prescribed responsibilities - these will vary by firm and are responsibilities that the FCA will require firms to place on their senior managers. The allocation of these responsibilities should help insurers to determine which controlled functions are required. The PRA Rulebook says that certain prescribed functions must be allocated to a controlled function holder.

The certification regime

The SMCR introduces a new certification regime for insurers. They must identify which individuals are performing "certification functions", which the Financial Services and Markets Act says are functions that "require[s] the person performing it to be involved in one or more aspects of the firm's affairs, so far as relating to a regulated activity, and... those aspects involve, or might involve, a risk of significant harm to the firm or any of its customers".

Firms must assess each year whether someone is fit and proper to perform their role and issue a certificate to them if they are. This is in addition to the existing Senior Insurance Manager Requirements, which will be retained under SMCR, to conduct ongoing fitness and propriety assessments of in-scope persons.

Some of the staff in the scope of the Certification Regime may previously have been subject to regulator approval. This will no longer be required under the Certification Regime. This is to reinforce that firms, rather than the regulator, are responsible for ensuring their staff are fit and proper.

Insurers will therefore have to develop procedures that will allow them to effectively determine whether individuals are fit and proper to do their jobs and maintain appropriate records of these assessments.

The Certification Regime will only apply to employees of firms; it will not apply to non-executive directors.

The PRA provides that the certification functions should include all employees that are "key function holders" and "material risk taker"s (MRTs) of large firms, meaning those with £1 billion in premium income for last three years.

The FCA’s certification function is wider and includes:

• Significant Management Function (replacing CF29)
• CASS oversight function (replacing CF10a)
• Functions subject to qualification requirements
• Client dealing function
• MRTs (see above)
• Anyone who supervises or manages a person performing a Certification function.

Given one of the FCA specified significant-harm functions is MRTs, all individuals who fall within the PRA regime will also fall within the wider FCA regime. Both the PRA and FCA have proposed that the certification regime will become effective 12 months from the SMCR effective date, in December 2019. Firms will not be required to obtain regulatory references for existing employees who will be performing the same role after the start of the new regime.

Conduct rules and standards

The PRA and FCA set out conduct standards and conduct rules respectively. These overlap and are set out below:

The regulators can enforce these rules directly against controlled function holders. Insurers will be responsible to the regulators for the compliance of non-controlled function key function holders and persons performing key functions.

Changes under SMCR

The Conduct Rules outlined above will be extended to apply to:

•  senior managers;
• certification staff;
• non-executive directors who are not senior managers; and
• other employees, except ancillary staff, i.e. people who don’t perform a role specific to financial services such as receptionists or catering staff.

Amendments to forms

The PRA has introduced a streamlined set of SMCR forms for both banking firms and insurers. It has amended the existing forms so they no longer distinguish between firm types. The FCA has made similar changes, updating forms to reflect the SMCR and consolidating the forms to remove the distinction between different types of dual-regulated firms in many of the current forms.

Additional controlled functions under SMCR

The PRA is set to retain its list of Senior Insurance Manager Functions (SIMFs). The FCA adds the following SMFs:

Executive roles

SMF3 - Executive Director (replacing CF1)

SMF18 - Other Overall Responsibility

SMF16 - Compliance Oversight (replacing CF10)

Non-executive roles

SMF13 - Chair of Nominations Committee (replacing CF 2A)

SMF15 - Chair of With-Profits Committee (replacing CF 2B)

Conversions

The FCA has a conversion scheme for roles under the existing regime to be converted to SMFs where the equivalent role exists under the SMCR. There is no need for firms to apply for re-approval.

What SMCR means in practice

In relation to SIMFs the transition is more straightforward. The functions themselves will not change from SIMR to SMCR. The position in relation to Significant Influence Functions (SIF) is more involved. Insurers have to inform the FCA, in their applications, of all the individuals they are assigning a new FCA-controlled SMF.

Insurers therefore need to understand both the current SIF functions that individuals will perform and the equivalent mapped function under SMCR.

Insurers need to notify all relevant individuals that they are subject to the Conduct Rules; give all relevant individuals training on Conduct Rules - to include a ‘deeper understanding of the specific rules which are relevant to their work’; and notify the FCA of breaches of Conduct Rules.

From 10 December 2018, firms falling within the scope of the SMCR ought to have policies and processes in place for the following key deliverables:

• drafted Statement of Responsibilities and updated role profiles for all SMF holders
• identified and grandfathered SMF holders
• allocated PRA/FCA-prescribed responsibilities to SMF holders, with documented rationale
• identified certified persons
• assessment of fitness/propriety for SMFs/CPs completed, ideally integrated within performance review process
• adjustments to governance/decision-making frameworks, board/committee terms of reference/composition
• attestations/confirmations as to compliance with requirements
• training delivered to all SMF/certified persons on obligations, including Conduct Rules
• amendments to employment contracts
• amendments to Code of Conduct/whistleblowing/disciplinary policies/procedures
• updated D&O/insurance arrangements
• IT systems infrastructure upgraded to monitor/maintain compliance

How should insurance firms prepare?

The shifting of reporting responsibility onto the regulated firms means insurers need to ensure that they are adequately resourced to implement the key deliverables above. Specifically, measures ought to be put in place for the following:

Training:train staff who are subject to the new rules, as well as identifying and training appropriate staff with responsibility for fitness and propriety testing of others.

Assessment as fit and proper: issue certificates of fitness and propriety to certified staff. Firms should consider whether this will be done through annual appraisals or an alternative process.

Documentation: have key employment documents such as template service agreements and settlement agreements updated as necessary to take account of a firm’s obligations under the new regime.

Policies and procedures: review HR policies to ensure, for example, that they deal with any performance or disciplinary issues in relation to senior managers and certified staff as well as confidentiality provisions for whistleblowing.

A useful six minute video overview about the new regime from the FCA is available here.