Boards at FCA-regulated firms spend a good deal of time on their own composition — independence, committee chairs, succession. Rather less is spent on the two executive appointments the board is nonetheless accountable for getting right: Compliance Oversight and the Money Laundering Reporting Officer.

Non-executives do not hold those functions. But the board carries collective responsibility for the firm being run properly, and when a control function fails it is the board that is asked why it did not know.

What the Board Is Actually Accountable For

Under the Senior Managers and Certification Regime, the SMF16 and SMF17 holders carry personal accountability for their areas. That accountability is individual and it does not transfer.

What does sit with the board is everything around it: whether the function is adequately resourced, whether the holder has the standing and access to do the job, whether the information reaching the board is accurate, and whether there is a plan for the day the holder resigns.

None of those are technical compliance questions. They are governance questions, which is precisely why they belong in the boardroom rather than being delegated downwards with the function itself.

The Resourcing Question Boards Rarely Ask Properly

A compliance function is adequately resourced when it can discharge the obligations the firm actually has. Boards tend to assess it by whether anything has gone wrong, which is a lagging indicator and a poor one.

Two questions get closer. First, how many days a month is the function actually receiving, as against the number agreed? A persistent gap between the two is the clearest early signal that the arrangement is under-scoped, and it is visible long before anything fails.

Second, what did the holder not get to this year? Any honest compliance officer has a list — testing sampled more lightly than intended, a policy review deferred, regulatory change skimmed rather than read. A board that never hears that list is not being told the truth about capacity.

The answers frequently point to a structural choice rather than a budget increase. A firm paying for a full-time appointment at the seniority its budget allows often gets less than it would from a few days a month of someone considerably more experienced. FD Capital sets out the permanent, fractional and interim routes at SMF16 recruitment and SMF17 recruitment.

Independence Is a Structural Question, Not a Character One

Boards reassure themselves about independence by reference to the individual — a robust person who will speak up. That is worth having and it is not sufficient.

If the compliance officer reports to the executive whose commercial decisions they are meant to challenge, the function is compromised regardless of character. If their entire income depends on one engagement, the same applies in a different form. Neither is a failing of the person; both are features of the structure the board approved.

The test worth applying is simple. If your SMF16 concluded tomorrow that something significant was wrong, could they put that in front of the board this week, unedited, without anyone’s permission? If the answer is no, the issue is structural and no amount of hiring well will fix it.

This is also an argument for the fractional model that boards sometimes resist. A holder with several clients can afford to give an unwelcome answer in a way that a sole-employer appointee cannot.

Reading the Reporting You Receive

Two documents tell a board most of what it needs to know about its control functions, and both are frequently treated as formalities.

The compliance monitoring report sets out what was tested and what was found. A board should be reading it for coverage as much as for findings — a programme that tests the comfortable areas thoroughly and the uncomfortable ones lightly produces reassuring reports and no assurance.

The MLRO’s annual report is the moment the board is told, on the record, what the firm’s financial crime position actually is. If it has been softened before it arrives, the firm has a governance problem larger than whatever the report describes. If the board receives it and takes no decision, that is also a decision, and it is the board’s.

The question worth asking of both: what changed as a result? Reporting that never produces a change anywhere in the business is being filed rather than used.

The Conflict Boards Should Expect to Manage

There is a tension built into these functions that boards sometimes treat as a personality problem when it is structural.

The compliance officer’s job occasionally requires telling the business something it does not want to hear: that a client cannot be onboarded, that a product needs changing, that something must be reported. The value of the function is concentrated almost entirely in those moments, and each of them is commercially inconvenient by definition.

Where a board hears consistently positive reporting from a control function, the likeliest explanation is not that the firm is exceptional. It is that the function has learned what the board wants to hear, or lacks the standing to say otherwise. A non-executive who has never seen a compliance paper they disagreed with should treat that as information rather than comfort.

The practical control is a private session — the board or audit committee meeting the SMF16 and SMF17 holders without executive management present, as a matter of routine rather than in response to a problem. It is standard practice with external auditors and considerably less common with internal control functions, which is odd given the latter are employed by the people they are meant to challenge.

What a Strong Appointment Looks Like From the Board’s Seat

Boards are rarely involved in selecting the SMF16 or SMF17, and arguably should be more often, given they carry the consequences. Three things are worth knowing about whoever is appointed.

Whether they have held the function at a firm of comparable size and regulatory profile. Compliance experience is less transferable than job titles suggest, and someone from a low-risk intermediary is not automatically equipped for a payments or cryptoasset business.

Whether they have been through a substantive regulatory interaction and can discuss it. The difference between someone who has handled a supervisory visit and someone who has only read about one shows up precisely when it matters.

And whether they asked difficult questions during the process — about reporting lines, board access, and what happens when they escalate something unwelcome. A candidate who asked none of those has either not understood the personal accountability they are accepting, or does not intend to use the authority. Either way the board should want to know.

Succession Is the Gap Boards Discover Late

Senior management functions are pre-approval roles. When the holder resigns, the firm cannot simply appoint a successor — the FCA must approve them, on a timetable the firm does not control.

That makes a resignation a governance event rather than an HR one. The firm has a notification obligation, a limited window of temporary cover, and a gap it may be carrying for months.

The position is sharpest at smaller firms where one person holds both SMF16 and SMF17, which is common and entirely proportionate. The board should understand that in that structure a single resignation removes two control functions on the same day — nobody running the monitoring programme and nobody making suspicious activity decisions. FD Capital covers the combined arrangement, and when it should be split, at fractional dual SMF16 and SMF17 recruitment.

Boards that have thought about this in advance — a named and briefed deputy, or a standing relationship with a specialist recruiter — recover in weeks. Boards that have not can spend months exposed.

Knowing When the Structure Has Outgrown Itself

Arrangements that were proportionate when approved stop being proportionate gradually, and the board is usually the last to notice because nothing announces it.

Three signals are worth building into the board calendar. Transaction volume, because financial crime workload scales with it independently of everything else — a firm can double its volume without changing its product and triple its alert load. A change in regulatory category, which brings additional functions and prescribed responsibilities. And any new product, market or distribution arrangement, each of which changes what the control functions have to cover.

Reviewing the structure on a planned basis is a routine conversation. Reviewing it because a supervisor has raised it is not.

Questions for the Next Board Meeting

None of these require technical knowledge, and the answers tend to be revealing.

How many days did our compliance function actually receive this year, against what we agreed? What did the holder not get to? Who do they report to, and can they reach us directly? What happens if they resign tomorrow — who covers, and how long until a successor could be approved? When did we last review whether the current structure still fits the business? And if one person holds both functions, what is our view on when that should change?

A board that can answer those six is overseeing its control functions. A board that cannot is relying on nothing having gone wrong yet.

Where NED Capital Fits

We recruit non-executive directors, committee chairs and senior independent directors for FCA-regulated boards — see appointing a NED for an FCA-regulated firm, SMCR and independent non-executive appointments and FCA-regulated board governance.

The executive control functions sit with our sister practice. FD Capital recruits Compliance Oversight and MLRO holders on permanent, part-time, fractional and interim bases, including the combined appointment common at smaller firms. Where a board concludes its control functions need strengthening, that is the team to speak to.