PS26/6 lets firms issue certificates by email, fold recertification into appraisal and streamline reviews where nothing has changed. HM Treasury plans to remove the Certification Regime from statute altogether. None of that removes the need to show why each person is fit and proper. Here is what changed, what did not, and a process that holds up.
The problem: a lighter process with an empty middle
Since 24 April 2026, firms subject to SMCR have had welcome flexibility on annual certification. FCA guidance now confirms that a certificate can be issued by email, that recertification can be built into the annual appraisal, and that where a role has not materially changed, the FCA expects recertification to be proportionate and streamlined.
Each change is sensible. Together, they create a risk. In the firms we have reviewed, the new flexibility is sometimes read as permission to reduce certification to a line on an appraisal form: a box ticked by the manager who also scores performance, with no record of what was checked or why.
The certificate got lighter. The judgement it records did not.
Why firms get it wrong
Three misreadings cause most of the trouble.
“Streamlined” is read as “optional”. SYSC 27.2.20G says the FCA expects annual recertification to be less detailed than a first assessment, because major role changes should already have been dealt with when they happened. It does not say the assessment can be skipped. A streamlined review still has to establish that nothing material has changed, and that takes evidence.
Appraisal and certification are treated as the same question. SYSC 27.2.19G allows certification to run inside appraisal, but adds that the firm should apply the certification standards wherever they differ from its appraisal standards. An appraisal asks whether someone performed well. Certification asks whether they are fit and proper: honest, competent and financially sound. A high performer can fail the second test.
The Phase 2 headline is taken as a reason to wait. HM Treasury has confirmed it intends to remove the Certification Regime from the Financial Services and Markets Act 2000 (FSMA). That needs primary legislation, which the government will introduce when parliamentary time allows. Until the change is made and commenced, the current regime applies in full.
What the rules say now
The position as at September 2026, drawn from primary sources.
The statutory duty is unchanged. Under section 63E(1) FSMA, a firm must take reasonable care that no employee performs an FCA certification function without a valid certificate issued by that firm. The FCA summarises the requirements in SYSC 27.2. The certificate must state that the firm is satisfied the person is fit and proper to perform the function.
PS26/6 changed the mechanics. The FCA’s Policy Statement PS26/6 added guidance that a certificate should be in writing but need not be a physical document, and can be an email. It should show its dates of validity and be given to the employee (SYSC 27.2.17G and 27.2.18G). A change of role part-way through the year may call for a targeted reassessment rather than a complete one (SYSC 27.2.15AG).
Overlapping certifications fell away on 10 July 2026. Some individuals no longer need separate certification for overlapping functions. For example, a person certified for the material risk taker function no longer also needs certifying for the significant management function at the same firm. The FCA estimated the change affects around 15% of certification roles, and said it would update the Directory itself.
Directory deadlines moved. Firms now have 20 working days for most Directory updates, up from 7. Details of leavers must still be reported within 7 working days.
Non-financial misconduct is now in scope. From 1 September 2026, a new rule, COCON 1.1.7FR, extends the conduct rules at non-banking firms to bullying, harassment and violence where there is a sufficient link to work. The FCA’s non-financial misconduct guidance, finalised in PS25/23, explains how such conduct forms part of fitness and propriety assessments.
References should move faster. FCA guidance now expects a firm normally to provide a regulatory reference within 4 weeks of a request, down from 6 (SYSC 22.5.17G).
Phase 2 is coming, but it is not here. HM Treasury’s consultation response confirms the government intends to remove the Certification Regime from primary legislation, including the annual re-certification requirement. It says the regulators will be able to use their existing rule-making powers to ensure the suitability of people below senior manager level, and that commencement will be aligned with any replacement rules to avoid regulatory gaps. The FCA has said that, if the Treasury’s changes proceed, it expects to consult on a second phase later in 2026.
The direction is clear: less statutory prescription, and more reliance on the firm’s own documented judgement.
A six-step recertification framework
This is the process we recommend. It works whether certification sits inside appraisal or runs on its own, and it is built to carry across into whatever replaces the current regime.
| Step | The question | Evidence to hold |
|---|---|---|
| 1. Scope | Is this person still performing a certification function? | Certification register reconciled to the FCA Directory, reflecting the 10 July 2026 changes |
| 2. Change | What changed in their role or circumstances this year? | Changes to role, products, client types and reporting lines; any mid-year reassessment |
| 3. Evidence | What do independent sources say? | Self-declaration; T&C status, CPD, file review and QA results; breach log, complaint themes, HR and disciplinary records, including non-financial misconduct |
| 4. Judgement | Who decided, and why? | Two or three sentences of reasoning, signed by a decision-maker with authority to refuse, recorded apart from the performance rating |
| 5. Certificate | Is the certificate complete and in date? | Written certificate (email is acceptable) showing dates of validity, given to the employee; renewal diarised before expiry |
| 6. Afterlife | Would the file support a regulatory reference? | Directory updated within 20 working days (7 for leavers); a record that could answer a reference accurately within 4 weeks |
Where step 2 finds no material change and step 3 turns up nothing new, the review can be short. That is exactly what the FCA’s proportionality guidance anticipates. The time should go where the evidence points.
Two controls make the framework work in practice. First, route file review, complaints, HR conduct and T&C information to the person making the certification decision as a matter of process, rather than relying on a line manager to know about it. Second, give that decision-maker real authority to withhold or condition a certificate, and a clear escalation route when they do.
An illustrative case
The following is a composite scenario. It does not describe any real firm or individual.
James Hartley is Head of Compliance at a financial planning firm. In the spring, one of its advisers moved from mortgage advice to investment advice. Because the adviser stayed within a certification function, nobody treated the move as a trigger. At the annual appraisal, where his client feedback was excellent, the certificate simply rolled forward.
An autumn file review then found that the adviser had given investment advice without the supervision the firm’s own training and competence scheme required while he had not yet been assessed as competent in that area. The advice itself was suitable. The control was not working.
The certification record could not explain how the firm had satisfied itself about the adviser’s competence in a product area he had only just entered. There had been no reassessment, because nobody had recognised that one was needed.
James’s response was proportionate. Following the approach in SYSC 27.2.15AG, he did not reopen the adviser’s honesty or financial soundness, neither of which had changed. He reassessed competence in the new area, reinstated supervision until the adviser was assessed as competent, recorded his reasoning and reissued the certificate. He then added “change of product area” to the firm’s list of reassessment triggers.
The lesson: a proportionate process still needs triggers. Without them, “nothing has changed” is an assumption, not a finding.
What to do next
Before your next certification cycle:
- Reconcile your certification register with the FCA Directory, reflecting the July 2026 changes.
- Map where the step 3 evidence lives and who needs to see it.
- Give any appraisal that doubles as certification a distinct fitness and propriety section.
- Write down your reassessment triggers, including non-financial misconduct findings.
- Brief the Senior Manager responsible for the certification regime on the Phase 2 timetable, and diarise a review for when the FCA consults.
Certification rarely fails on its own. Our governance, risk and SMCR work reviews certification alongside responsibilities maps and conduct rules, and our compliance audits and reviews test whether the evidence behind each decision actually holds up. Staff screening is a financial crime control too, which our AML and financial crime reviews cover. If you would rather start from ready-made documents, the Annual Certification Assessment Template Pack provides assessment forms, a self-declaration, a register and decision records.
Making Compliance Work means making the judgement visible, not the paperwork heavier.
Frequently asked questions
Can an SMCR certificate be issued by email?
Yes. SYSC 27.2.17G says a certificate should be in writing but need not be a physical document, and gives email as an example. It should show its dates of validity and be given to the employee.
Can annual certification be part of our appraisal process?
Yes. SYSC 27.2.19G allows it, provided the firm applies the certification standards wherever they differ from its appraisal standards. In practice, keep a distinct fitness and propriety section and record the reasoning separately from the performance score.
Is the Certification Regime being abolished?
HM Treasury has confirmed it intends to remove the regime from FSMA, including the annual recertification requirement, through primary legislation. The regulators expect to consult on what replaces it, and the government has said commencement will be aligned with the new rules. Until then, the current regime applies.
Does non-financial misconduct affect certification?
Yes. Since 1 September 2026, the conduct rules at non-banking firms extend to bullying, harassment and violence where there is a sufficient link to work, and FCA guidance explains how such conduct forms part of fitness and propriety assessments. Conduct findings should feed your certification decision.
How long does a certificate last?
Up to 12 months. If the person is to keep performing the function, the firm must reassess and renew the certificate before it expires.
Want an independent view of your certification process?
Book a discovery call: https://bit.ly/CCDiscovr
UK 0800 689 0190 | Int’l 020 8243 8620
Compliance Consultant is a trading style of UK Compliance Consultant Limited (Companies House 14805896). We are an independent regulatory compliance consultancy and are not authorised or regulated by the Financial Conduct Authority. This article is general information, not regulatory or legal advice, and should not be relied upon in place of advice specific to your firm’s circumstances.
