Does SM&CR Apply to Payment Institutions and EMIs? Senior Management Accountability Explained

The short answer: the Senior Managers and Certification Regime (SM&CR) does not apply to a payment institution or electronic money institution authorised only under the Payment Services Regulations 2017 (PSRs) or the Electronic Money Regulations 2011 (EMRs). SM&CR applies to firms with a permission under Part 4A of the Financial Services and Markets Act 2000 (FSMA). Pure PIs and EMIs have their own rules on who runs the business, and the FCA expects clear individual accountability all the same. This article sets out what applies, when SM&CR does apply and how to evidence sound governance.

Does SM&CR Apply? A Quick Guide

What Applies Instead: Directors and Managers Under the PSRs and EMRs

Regulation 6 of the PSRs 2017 requires an authorised payment institution to have sound governance arrangements, including a clear organisational structure with well-defined lines of responsibility. Its directors and the persons responsible for managing the business must be of good repute and have appropriate knowledge and experience to provide payment services. The EMRs 2011 apply equivalent tests to EMIs.

In practice this means:

• FCA assessment of individuals. The FCA assesses each director and manager through its payment services individual forms at authorisation, and when new people are appointed.
• Notifying changes. Firms must tell the FCA when directors or managers change, so the FCA can assess the new person.
• Controllers. Anyone with a qualifying holding (a significant ownership stake) is assessed at authorisation, and anyone proposing to acquire or increase control must notify the FCA in advance under the change in control rules.
• FCA guidance. The FCA's Payment Services and Electronic Money Approach Document explains how it applies these tests in practice.
• AML officers. The MLRs 2017 require a nominated officer (MLRO) to receive internal suspicious activity reports and, where appropriate to the firm's size and nature, a board-level officer responsible for compliance with the MLRs.
• Documented responsibilities. There is no statutory responsibilities map, but the FCA expects firms to show who is responsible for safeguarding, financial crime, operational resilience and the Consumer Duty.

When SM&CR Does Apply

Many payment groups hold more than one permission. If a PI or EMI also holds a FSMA permission, for example to lend or to act as a credit broker, the FSMA-authorised firm is within SM&CR. Its senior managers need FCA approval, it must run the Certification Regime for relevant staff, and the Conduct Rules apply. HM Treasury and the FCA reformed SM&CR in April 2026, with most rule changes taking effect on 24 April 2026. Authorised cryptoasset firms come into SM&CR in full when the new regime starts on 25 October 2027.

Common Governance Gaps in PIs and EMIs

1. Unclear ownership. Key areas such as safeguarding or financial crime with no named individual responsible.
2. Late notifications. New directors or managers in post before the FCA has been told.
3. Thin evidence of experience. Individuals whose payments knowledge is not documented in their application or role profile.
4. No regular fitness checks. No periodic check that directors and managers remain of good repute.
5. SM&CR missed in the group. Entities that add a FSMA permission without setting up SM&CR for that entity.

Individual Accountability Without SM&CR

The FCA can refuse a new director or manager who does not meet the good repute and experience tests, and can act against the firm if its management falls below these standards. In SM&CR firms, the FCA can also fine individual senior managers who fail to take reasonable steps to prevent breaches. Clear allocation of responsibility and documented decisions protect both the firm and its leaders.

Practical Implementation Steps

1. Confirm whether any entity in your group holds a FSMA permission and is therefore within SM&CR.
2. For PSRs and EMRs entities, write a short responsibilities document naming who owns safeguarding, financial crime, operational resilience, complaints and the Consumer Duty.
3. Keep the FCA's records of directors and managers current, and notify changes promptly.
4. Check the good repute and experience of each director and manager at least once a year, and record the result.
5. Appoint an MLRO and, where appropriate, a board-level officer responsible for MLR compliance.
6. If you are preparing for cryptoasset authorisation, build SM&CR now: it applies in full from 25 October 2027.

Regulatory Counsel advises payment institutions and EMIs on SMCR implementation, responsibility mapping and senior manager accountability frameworks. Contact us for a written proposal.