The Accountability Gap

Under FSMA 2000 (s.66B), a Senior Manager can be found guilty of misconduct if a contravention occurred in their area of responsibility and they did not take reasonable steps to prevent it. Under POCA s.330–331, the MLRO faces up to five years' imprisonment for failure to disclose. These are not theoretical penalties. The FCA has historically pursued both firms and their MLROs with separate disciplinary actions for the same AML failures.

The asymmetry is stark: you carry criminal and regulatory liability, but often lack the authority, resources, or board backing to actually discharge that responsibility. Accepting an SMF17 role without genuine authority and adequate resources is not merely inadvisable. It may expose you to consequences that cannot be mitigated after the fact.

The MLRO role has been progressively deprioritised in many governance structures. Industry surveys consistently report that once compliance leaders begin pushing back at board level, they risk being characterised as disruptive to commercial objectives. This creates an impossible choice: challenge the business and risk your career, or stay quiet and risk your personal liability.

Without executive buy-in, compliance initiatives stall. Budgets are cut. Headcount requests are deferred. Technology upgrades are deprioritised. The MLRO is left holding the accountability for a framework they were not empowered to build properly.

Outside the top-tier banks, firms are increasingly hiring younger, less experienced practitioners to fill the SMF17 role, primarily because they are cheaper and the role is not treated with the seniority it demands. Fintechs in particular are paying MLROs between £80,000 and £100,000 for a role that carries criminal liability and requires deep expertise. At established banks, the range sits between £160,000 and £250,000. The gap tells you how seriously each type of firm treats the role.

The FCA has warned that SMF16 and SMF17 applicants who do not commit sufficient time to the role tend to be unsuccessful in the approval process. Starling Bank's enforcement action was caused, in part, by the FCA's finding that the senior management team lacked the required AML skills or experience.

Combining SMF16 and SMF17 into a single position is widely regarded as impractical for any firm beyond the smallest scale. The responsibilities and expertise required for each role are substantial, and merging them leads to insufficient coverage and increased risk of non-compliance. Industry consensus is that this practice is not fit for purpose in the vast majority of firms.

The FCA's enforcement action against Starling Bank noted that from its founding in 2016 until 2022, the firm assigned a single senior manager to both the compliance and anti-money laundering functions. The FCA has been explicit that candidates who cannot commit sufficient time tend to be rejected during the approval process.

SAR filing volumes have increased dramatically. The average investigation time has expanded from 1.5 days to over 4 days per case due to manual processes, while resources have remained static. Transaction monitoring systems generate large volumes of alerts, and MLROs must prioritise and investigate efficiently to avoid backlogs that create personal criminal exposure.

Common FCA enforcement triggers in this space include: poorly documented SAR decisions, generic or stale policies, training deficits, nominal MLRO arrangements where the MLRO has no genuine oversight of the SAR process, and failure to escalate. Every unfiled or poorly documented SAR is a potential POCA s.330 exposure.

Most decisions, challenges, and escalations happen verbally or in email threads. When the FCA asks "show me your reasonable steps," the evidence does not exist in a structured, defensible form. This is the single most common failure pattern across SMF16 and SMF17 enforcement actions.

Consider a scenario where an SMF16 leaves and is replaced. If the new SMF's Statement of Responsibilities is not updated for six months and a compliance failure occurs in that period, the firm faces regulatory censure. But if the governance framework flagged the SoR update delay, escalated it, and documented board oversight, the firm can demonstrate that controls were functioning. That is the difference between evidenced accountability and regulatory failure.

The pace of regulatory change bearing down on SMF16 holders is relentless. Consumer Duty multi-firm reviews. The Economic Crime and Corporate Transparency Act. MLR amendments addressing AI-enabled fraud, sanctions breaches, and proliferation financing. Failure to Prevent Fraud obligations effective from September 2025. HM Treasury's proposed Single Professional Services Supervisor model. FCA sector-specific Regulatory Priority Reports introduced in February 2026. And on the horizon: FCA AI governance guidance expected by end of 2026 and the Mills Review recommendations.

Each of these requires identification, impact assessment, action planning, implementation, and evidence of closure. Most SMF16 holders manage this process with spreadsheets, emails, and institutional memory. That approach breaks down when the volume doubles.

AI tools are entering compliance workflows at pace: transaction monitoring, SAR narrative drafting, CDD screening, customer vulnerability assessment. The FCA expects SMF holders to be able to articulate to regulators how any technology solution deployed within their area facilitates risk identification and mitigation. This requires a level of data and technological competence that many experienced compliance professionals did not develop in their earlier careers.

The Treasury Select Committee's January 2026 report recommended that the FCA publish guidance on what level of assurance is expected from senior managers under SM&CR for harm caused through AI. The FCA has signalled that guidance on audit trails and human-in-the-loop protocols is likely in 2026. SMF holders need frameworks now, not when the guidance arrives.

Experienced UK MLROs and financial crime experts are increasingly leaving permanent roles to work as independent contractors and consultants. The motivation is straightforward: they want to reduce their personal liability exposure. The FCA's increasing competency scrutiny means replacement cycles run 6 to 12 months for approval, creating a dangerous gap when an SMF holder departs.

The fit and proper requirements demand sustained professional development. Current expectations include 5 to 7 specialist courses annually covering AML, sanctions, conduct rules, and emerging risks. Finding candidates who meet this bar in a competitive market, at the compensation levels many firms are willing to pay, is a persistent challenge.