Skip to content
ConductLog

FCA Regulatory References: What Small Firms Must Provide Under SMCR

When someone moves from one FCA-regulated firm to another to take on a Senior Manager, Certification or non-approved NED role, their new employer needs more than a standard HR reference. They need a regulatory reference: a structured disclosure covering disciplinary history, conduct rule breaches, fit and proper findings, and any other information relevant to the candidate's suitability for the role.

The regulatory reference rules sit in SYSC 22 of the FCA Handbook. They apply to every FCA-authorised solo-regulated firm — IFAs, mortgage brokers, insurance brokers, wealth managers, and the rest. If you hire anyone into a Senior Manager Function, a Certification Function or a non-approved NED role, you are obliged to request a regulatory reference from their previous regulated-sector employers. If you are the previous employer, you are obliged to give one.

This guide explains who triggers a reference, what you must disclose, how far back you must go, and the template requirements.

What is a regulatory reference, and who asks for it?

The FCA defines regulatory references as "information that firms need to share with each other when an employee or director moves from one firm to another (for candidates of Senior Managers Functions, Non-Executive Directors and Certification Functions)."

The obligation has two sides:

As the hiring firm: Before you appoint someone to a Senior Manager Function (SMF), a Certification Function, or a non-approved NED role, you must request regulatory references from all their regulated-sector employers in the past six years. This is part of your fit and proper assessment — the reference gives you information you would not otherwise have access to.

As the previous employer: When a former employee or director applies for one of these roles at another regulated firm and that firm requests a reference, you are required to provide it. You cannot simply decline. You also cannot enter into arrangements — such as non-disclosure agreements or settlement clauses — that conflict with your disclosure obligations.

When regulatory references are NOT required

The table in the FCA's SMCR guide makes this explicit. Regulatory references are required for new hires from outside the firm. They are not required for internal hires (including intra-group moves) or as part of annual fit and proper reassessments. The obligation is triggered by the recruitment of an external candidate into a qualifying role.

Sole traders are not required to seek regulatory references for themselves, even if they hold a Senior Management Function. Limited Scope firms should note that non-approved board directors (executive and non-executive) at Limited Scope firms are not subject to the fit and proper requirements, including regulatory reference rules.

What a regulatory reference must include

The FCA specifies both the information to be disclosed and the format it must take. The SMCR guide sets out that the regulatory reference rules require firms to:

  • Request references from all previous regulated-sector employers in the past six years for candidates applying for SMF, Certification or non-approved NED roles
  • Share information in a standard template — firms must disclose using a standardised template whose minimum content and structure are prescribed by SYSC 22 Annex 1, rather than a free-form HR reference
  • Disclose disciplinary action for conduct rule breaches going back six years, including the details of any finding that the person was not fit and proper
  • Disclose any other information relevant to the fit and proper assessment of the hiring firm — the FCA gives the example of upheld complaints — covering the previous six years
  • Disclose serious misconduct without any time limit — if the relevant concern relates to serious misconduct, the six-year lookback does not apply; there is no time limit
  • Retain records of disciplinary and fit and proper findings going back six years
  • Not enter into arrangements that conflict with disclosure obligations, such as non-disclosure agreements covering regulatory-reference content

What counts as "serious misconduct"?

The FCA does not define a bright line, but the phrase is intended to cover conduct that would be relevant to an assessment of fitness and propriety indefinitely — fraud, dishonesty, and significant conduct rule breaches that caused serious harm are the categories most commonly cited. Where information relates to serious misconduct, you disclose it even if it occurred more than six years ago. Where it relates to lesser disciplinary matters, the six-year lookback limits your disclosure obligation.

The non-disclosure agreement constraint

This is the most practically significant rule for small firms that have settled employment disputes. If a settlement agreement includes a clause under which the employee agrees not to disparage the firm and the firm agrees not to discuss the circumstances of the departure, that clause cannot be used to justify withholding information that is otherwise disclosable in a regulatory reference. The FCA is clear: firms "must not enter into arrangements that conflict with their disclosure obligations." Existing NDAs entered into before SMCR do not override the obligation.

The standard template

The FCA requires firms to share regulatory-reference information in a standardised template rather than a free-form HR reference. The prescribed minimum content and structure are set out in SYSC 22 Annex 1; the rules fix what the template must contain rather than mandating one specific FCA-issued document, so in practice the FCA and industry bodies publish template wording that meets the Annex 1 requirements. The template typically covers:

Section What to include
Candidate details Name, roles held, dates
Conduct rule breaches Any breaches resulting in disciplinary action, plus outcome
Fit and proper findings Any finding that the individual was not fit and proper
Other relevant information Anything else relevant to F&P assessment (eg upheld complaints)
Serious misconduct Disclosed without time limit
Period covered Minimum six years (no time limit for serious misconduct)

The hiring firm is responsible for obtaining the reference from every regulated-sector employer in the relevant six-year period. If a previous employer does not respond, you should document that you made the request and the absence of a response — this shows due diligence.

Updating references after the fact

Firms must also update regulatory references where new, significant information comes to light after the initial reference was given. If you provided a reference and subsequently conclude, for example, that the individual had breached conduct rules in a way you did not know about at the time, you must send an updated reference to the hiring firm. This is an ongoing obligation, not a one-time disclosure.

PS25/23 and regulatory references from September 2026

From 1 September 2026, PS25/23 extends the COCON conduct rules to cover non-financial misconduct (harassment, bullying, discrimination, sexual misconduct) for all non-bank FCA-authorised firms. This has a direct implication for regulatory references.

Before September 2026, conduct rule breaches requiring disclosure in a regulatory reference were limited to the individual conduct rules and Senior Manager conduct rules as defined in COCON. From September 2026, serious non-financial misconduct that results in disciplinary action for a breach of the extended COCON rules will become disclosable in the same way. A finding that an individual engaged in conduct amounting to harassment or serious bullying — and that this was treated as a conduct rule breach — will need to appear in any future regulatory reference you give for that person.

This matters for how you handle non-financial misconduct investigations between now and September 2026. If you investigate an allegation and conclude it amounted to a conduct rule breach, keep a clear record. The record has two uses: it feeds into your annual fit and proper assessment, and it feeds into any future regulatory reference.

Practical checklist for small firms

Before hiring someone into a Senior Manager, Certification or NED role:

  1. Identify all regulated-sector employers in the past six years
  2. Send a formal request for a regulatory reference from each, using or referencing the SYSC 22 Annex 1 template
  3. Chase any firm that does not respond, and document the chase
  4. Assess the reference(s) as part of your overall fit and proper assessment
  5. Keep all references and your assessment on file — the six-year retention obligation means these must be retrievable

When providing a regulatory reference to another firm:

  1. Confirm the request is for an SMF, Certification or non-approved NED role
  2. Check your records going back six years for any disclosable information
  3. Check separately whether any information relates to serious misconduct — if so, there is no time limit
  4. Review any settlement agreements covering the individual to ensure your disclosure obligations take precedence
  5. Provide the reference using the standard template
  6. Keep a copy of what you disclosed and when

Internal consistency with your fit and proper process

Your regulatory reference obligations and your fit and proper assessment process need to be consistent. Under SMCR, a Senior Manager is accountable for the firm's regulatory reference obligations, as this forms part of Prescribed Responsibilities (a) and (b). At a small firm, this accountability typically sits with whoever holds SMF16 (Compliance Oversight). Documenting your process — who requests references, when, how they are filed, and how the information feeds into F&P decisions — is part of what the FCA expects to see when it reviews your compliance arrangements.

For a closer look at how the annual fit and proper cycle works, see our FCA Certification Regime guide. For the individual conduct rules your staff must follow, see our COCON individual conduct rules guide.

This guide covers FCA regulatory reference obligations under SMCR for solo-regulated firms. It is intended as a practical overview, not legal advice. For complex situations — settlement agreements, overseas employers, or serious misconduct determinations — take specialist compliance or legal advice.

Sources:

Ready to manage conduct rule compliance properly?

ConductLog gives small FCA firms a structured investigation workflow with built-in COCON rule mapping. Join the waitlist for early access.

No spam. Unsubscribe any time. Privacy policy.

Related guides

FCA Certification Regime: Annual Renewal Step-by-Step for Small Firms

How the FCA Certification Regime annual renewal works at a small firm — who needs certifying, the 12-month fitness-and-propriety cycle, what evidence to gather, and a step-by-step renewal process.

FCA Conduct Rule Breach Reporting: REP008, SUP 15 and When Each Applies

How FCA conduct rule breach reporting works at a small firm — REP008 for conduct rules and certified staff, the separate route for Senior Managers, the annual deadline, and what counts as a notifiable breach.

FCA Prescribed Responsibilities: The Core-Firm List and How to Allocate Them

The FCA prescribed responsibilities that apply to Core solo-regulated firms, what each one means, who to allocate them to, and how the small-firm carve-outs work under SYSC 24.