Senior management responsibility
Senior management responsibility means that named individuals, not just the firm as a whole, can be held personally accountable when an AML programme fails. In the UK, this runs through the Senior Managers and Certification Regime, which gives every senior manager a statutory duty to take reasonable steps to prevent or stop a breach in their area. It’s a deliberate move away from AML failings being treated as a purely corporate problem.
Key takeaways
- Senior management responsibility means named individuals, not just the firm, can be held accountable for AML failings.
- The UK’s Senior Managers and Certification Regime extended to all FCA solo-regulated firms on 9 December 2019.
- Every Senior Manager has a statutory duty of responsibility, and the FCA carries the burden of proving they failed to take reasonable steps.
- SMF16 (Compliance Oversight) and SMF17 (MLRO) are required functions every core firm must appoint someone to.
- Overall responsibility for a firm’s AML framework is a Prescribed Responsibility, typically allocated to SMF17.
- SM&CR replaced the Approved Persons Regime specifically to stop accountability getting lost in collective decision-making.
On this page
What senior management responsibility actually meansThe Senior Managers and Certification RegimeThe duty of responsibility, and what “reasonable steps” meansSMF16, SMF17, and the AML-specific functionsPrescribed Responsibilities: why AML gets a named ownerStatements of Responsibilities and Responsibilities MapsWhy the regime exists: what came before itWhat this means day to day for an AML programmeFAQsRead more
What senior management responsibility actually means
Senior management responsibility is the principle that a firm’s leaders can be held individually accountable, not just collectively, when the firm’s controls fail. In an AML context, that means a named senior manager, not an anonymous “the firm,” can face regulatory action if the anti-money laundering programme they’re responsible for breaks down.
This matters because it changes incentives. A rule that only ever punishes the corporate entity gives an individual little personal reason to push hard for better controls. A rule that can reach the individual changes that calculation directly.
The Senior Managers and Certification Regime
In the UK, this runs through the Senior Managers and Certification Regime, SM&CR, which the FCA extended to all FCA solo-regulated firms on 9 December 2019, having already applied it to banks and insurers earlier. A Senior Manager under the regime is anyone performing a senior management function, defined as managing an aspect of the firm’s regulated business that could carry serious consequences if it goes wrong.
Before taking up an SMF role, an individual now needs FCA approval, supported by a Statement of Responsibilities setting out exactly what they’re accountable for.
The duty of responsibility, and what “reasonable steps” means
Every Senior Manager carries a statutory duty of responsibility under the Financial Services and Markets Act. If the firm breaches one of the FCA’s rules in that manager’s area, the FCA can hold the individual accountable if they failed to take reasonable steps to prevent or stop it. Critically, the burden of proof sits with the FCA, not the individual: the regulator has to show the senior manager didn’t take reasonable steps, rather than the manager having to prove they did.
What counts as reasonable varies by role and circumstance, but the FCA has published guidance on the factors it weighs, including how clearly responsibilities were documented and how actively the individual engaged with known risks.
SMF16, SMF17, and the AML-specific functions
Two senior management functions matter most directly for AML: SMF16, Compliance Oversight, and SMF17, Money Laundering Reporting Officer. Both are “required functions,” meaning every core firm has to have someone appointed to each one; they’re not optional based on the firm’s structure the way some other SMFs are.
It’s entirely possible, and common in smaller firms, for one person to hold both SMF16 and SMF17, alongside another executive role such as SMF3. What matters to the regulator isn’t how many roles one person holds, but whether the Statement of Responsibilities makes clear who owns what.
Prescribed Responsibilities: why AML gets a named owner
The FCA also requires certain “Prescribed Responsibilities” to sit with a specific named senior manager, rather than being left to a firm’s own allocation. Overall responsibility for the firm’s AML framework is one of these, and it’s typically allocated to whoever holds SMF17.
This is deliberate. Prescribed Responsibilities exist precisely because the FCA wants certain critical areas, AML among them, to always have one accountable name attached, rather than responsibility drifting across a committee or getting lost between roles.
Statements of Responsibilities and Responsibilities Maps
Firms above a certain size also need to maintain a Management Responsibilities Map, a document setting out the governance structure, reporting lines, and how responsibilities are actually divided across senior managers. This exists so that, if something goes wrong, it’s possible to trace exactly whose area it fell within, rather than reconstructing accountability after the fact.
The FCA has been explicit that a Statement of Responsibilities needs to be self-contained and specific. Vague or overlapping descriptions of who’s accountable for what have been flagged as a recurring weakness in its own review of how firms implement the regime.
Why the regime exists: what came before it
SM&CR replaced the FCA’s earlier Approved Persons Regime, which regulators concluded hadn’t done enough to hold individuals accountable after the 2008 financial crisis and a string of conduct failings across UK financial services. The core criticism was that senior individuals could point to collective decision-making and diffuse responsibility, making it hard for the regulator to pin accountability on anyone specific.
The duty of responsibility was designed to close that gap directly, tying accountability to a named person’s documented area of responsibility rather than to the firm’s board as an undifferentiated whole.
What this means day to day for an AML programme
In practice, this changes how AML programmes get built and documented inside a firm. A Statement of Responsibilities that’s vague about who owns AML oversight is a real regulatory weakness, not just a paperwork issue, because it undermines the individual’s ability to demonstrate they took reasonable steps if something goes wrong later.
It also means AML policy, monitoring, and escalation processes need to be documented well enough that a senior manager can point to specific actions they took, training delivered, red flags escalated, resourcing requested, rather than relying on a general sense that the programme was adequately run.
Document AML accountability clearly
Generate a policy draft that records who owns your AML framework and what reasonable steps look like.
Frequently asked questions
What is senior management responsibility in AML?
It’s the principle that named individuals in a firm’s leadership, not just the firm as a corporate entity, can be held personally accountable when the firm’s AML controls fail.
What is the Senior Managers and Certification Regime?
SM&CR is the UK’s framework for individual accountability at FCA and PRA-regulated firms. It requires senior managers to hold formal approval for their role and gives each one a statutory duty of responsibility for their area.
What does “reasonable steps” mean under the duty of responsibility?
It means a senior manager took the actions a reasonable person in their position would take to prevent or stop a breach. The FCA has to prove a senior manager failed to take reasonable steps; the burden isn’t on the individual to prove they did.
What are SMF16 and SMF17?
SMF16 is the Compliance Oversight function and SMF17 is the Money Laundering Reporting Officer function. Both are required functions that every core FCA firm must appoint someone to.
Can one person hold both SMF16 and SMF17?
Yes. It’s common in smaller firms for one individual to hold both roles, sometimes alongside another executive function, as long as their Statement of Responsibilities makes the scope of each role clear.
What is a Prescribed Responsibility?
A Prescribed Responsibility is a specific area, such as overall responsibility for a firm’s AML framework, that the FCA requires to sit with a named senior manager rather than being left to the firm’s own discretion.
Why did the UK introduce individual accountability for senior managers?
The earlier Approved Persons Regime let senior individuals point to collective, diffuse decision-making after failings, making it hard for regulators to hold anyone specifically accountable. SM&CR was designed to close that gap.
Read more: our ultimate guides, whitepapers and templates
Related guides and resources to help you act on what you just read.
Last reviewed July 19, 2026 · 9 min read · Written for compliance and risk professionals · By the WhoWiki editorial team
Key takeaway: Senior management responsibility means that named individuals, not just the firm as a whole, can be held personally accountable when an AML programme fails. In the UK, this runs through the Senior Managers and Certification Regime, which gives every senior manager a statutory duty to take reasonable steps to prevent or stop a breach in their area. It’s a deliberate move away from AML failings being treated as a purely corporate problem.