How New FCA Rules Are Changing Compliance and MLRO Hiring

Three rule changes, one pressure point

In the space of three months in 2026, the FCA changed the rules in three areas that rarely get discussed together. In April it reformed the 12-week rule for covering senior manager absences. In May its strengthened safeguarding regime for payments and e-money firms came into force. In July it began regulating Buy Now Pay Later lending for the first time.

Each change has its own audience. Read them side by side, though, and a common thread appears: all three land on the same small group of people, the Heads of Compliance and Money Laundering Reporting Officers who carry personal accountability inside regulated firms. They change how quickly those people must be in place, what they need to know, and how firms can cover the gap when one leaves.

This article looks at each change from the hiring side. It explains what has changed, who is affected and what it means for the next Head of Compliance or MLRO you recruit. For the detail on each area, we have published dedicated pages on SMF16 and SMF17 temporary cover under the 12-week rule, payments and e-money compliance recruitment and consumer credit compliance recruitment.

Change one: the 12-week rule now gives firms time to recruit properly

What changed. Under the Senior Managers and Certification Regime, a firm can put someone into a senior management function to cover an absence that is temporary or reasonably unforeseen, without that person first being approved. Until April 2026, the firm had 12 weeks to apply for and obtain approval for a replacement. Because FCA approval can take up to three months, that window was often unworkable.

The FCA’s SM&CR review policy statement (PS26/6) changed that from 24 April 2026. Firms now have 12 weeks to submit a valid and complete application, and the person covering can continue until the FCA decides it. The same reforms brought the person covering within the Senior Manager Conduct Rules, cut the deadline for providing regulatory references from six weeks to four, and extended the validity of criminal records checks for new senior managers to six months.

What it means for hiring. Three things follow.

• Permanent searches no longer have to be rushed. When an SMF16 or SMF17 resigns, the firm can take the time to find the right permanent candidate rather than the first one who can be approved within 12 weeks. That favours better hiring decisions.
• Interim cover has become more valuable, and more scrutinised. Because the person covering can stay in post until the application is decided, interim cover may now last several months. And because that person is subject to the Senior Manager Conduct Rules, boards want interims who have held the function before and understand the accountability they are taking on.
• Deputies matter more than ever. The FCA has said it expects the rule to be used on a limited basis, with good succession planning covering most situations. A capable deputy Head of Compliance or deputy MLRO is the cheapest insurance a firm can buy.

The rule is not a licence to leave a function vacant. Form C must still be submitted within seven business days of the departing senior manager ceasing to perform the function, prescribed responsibilities must be reallocated, and an MLRO vacancy has an immediate operational consequence because suspicious activity reporting cannot stop. Our page on what to do when your SMF16 or SMF17 resigns sets out a week-by-week timetable, and our earlier article on the SM&CR Phase 1 reforms covers the rest of the package.

Change two: safeguarding has become a compliance discipline

What changed. From 7 May 2026, authorised payment institutions and e-money institutions became subject to the supplementary safeguarding rules in the FCA’s policy statement PS25/12. The rules require daily safeguarding reconciliations on business days, a monthly safeguarding return to the FCA, an annual safeguarding audit by a qualified auditor (with a limited exemption for firms safeguarding small amounts), and a resolution pack recording where customer funds are held and how they are managed.

What it means for hiring. Safeguarding used to be treated largely as a finance and operations process. The new regime has turned it into something boards and the FCA watch closely, and that has changed the people payments firms are looking for.

• A new role has emerged. Many payments firms are now hiring a dedicated Head of Safeguarding, sitting between finance and compliance, to own reconciliations, the monthly return, audit readiness and the resolution pack.
• Compliance leaders need safeguarding literacy. Even where a Head of Safeguarding exists, the Head of Compliance must understand segregation, reconciliation and what the auditor will test, so that they can provide genuine oversight and challenge.
• Remediation demand has risen. Firms whose first audit or monthly returns exposed weaknesses are bringing in interim compliance and safeguarding specialists to fix them.

There is also a point of confusion worth clearing up. Payment institutions and e-money institutions authorised only under the payments regulations sit outside SM&CR, so their Head of Compliance and MLRO are not SMF16 and SMF17 approvals. The FCA still assesses the individuals responsible for managing the business, and the MLRO is still a statutory role under the Money Laundering Regulations 2017. Our payments compliance recruitment page explains how accountability works at a payments firm and what a strong candidate looks like. For the finance side, see our guide to safeguarding client funds and our payments firm CFO recruitment page.

Change three: BNPL lenders need regulated compliance leadership for the first time

What changed. On 15 July 2026 the FCA began regulating Deferred Payment Credit, the product better known as Buy Now Pay Later, under the conduct rules set out in PS26/1. Lenders that were already active and registered for the temporary permissions regime can continue lending while their full authorisation applications are assessed. New entrants need authorisation before they start.

What it means for hiring. A third-party lender that becomes fully authorised is ordinarily a Core SM&CR firm, and needs an SMF16 Compliance Oversight holder and an SMF17 Money Laundering Reporting Officer. For many BNPL businesses, nobody in the firm has ever held an approved role. That creates demand for a particular kind of candidate.

• Consumer credit depth. The FCA expects these firms to meet the consumer credit rules on creditworthiness, arrears and forbearance, and financial promotions, alongside the Consumer Duty. Candidates who know the Consumer Credit sourcebook in practice are in short supply.
• Comfort with scale and data. BNPL is a high-volume, low-value, model-driven business. A credible Head of Compliance needs to interrogate automated decisioning and design monitoring that works at that volume.
• Timing around the application. The authorisation application names the firm’s senior managers, so the hire needs to happen before submission, not after. Firms that apply first and recruit later tend to face more questions from the FCA.

BNPL is only the newest part of a wider consumer credit market where Consumer Duty evidence, vulnerable customer treatment and collections conduct are all driving compliance hires. Our consumer credit compliance recruitment page covers which senior manager functions a lender needs, what to look for in candidates and how to time the hire around an authorisation.

What the three changes have in common

Taken together, these changes point to four trends that we expect to shape compliance hiring through 2027.

1. Niche combinations are scarce. Firms are no longer looking for a generalist compliance professional. They want someone who combines senior manager experience with a specific body of knowledge: consumer credit and data, payments and safeguarding, or financial crime and fraud. Candidates with those combinations are scarce and move quickly.

2. Speed decides interim and fractional hires. When an SMF16 or MLRO leaves, or an audit exposes a problem, the first credible interim shortlist usually wins. In our experience, a good shortlist delivered within 48 to 72 hours makes a material difference to whether the right interim is still available. Permanent searches run to a different clock, where getting the brief and the fit right matters more than raw speed.

3. Interim-to-permanent is becoming the default path. The reformed 12-week rule makes it easier to bring in an experienced interim, stabilise the function and then decide whether to apply for that person’s approval or run a permanent search in parallel. Many of the firms we work with now plan both tracks from the first conversation.

4. Fractional senior compliance is mainstream for smaller firms. For a small lender, an early-stage payments firm or a newly authorised business, a fractional Head of Compliance or MLRO working one to three days a week can provide genuine senior capability at a sustainable cost. The FCA will test whether the time commitment matches the firm’s size and risk, so the arrangement needs to be documented and supported by a deputy. Our article on outsourcing the MLRO function covers where the line usually falls.

Six questions every board should ask now

1. If our Head of Compliance or MLRO resigned tomorrow, who would cover from day one, and have we tested that they are fit and proper?
2. Do we have a deputy MLRO who can keep suspicious activity reporting running without interruption?
3. Does our compliance leader understand the specific rules that matter most to our business, whether that is consumer credit, safeguarding or financial crime?
4. Is our SMF16 and SMF17 time commitment, whether full-time or fractional, still proportionate to our size and risk?
5. If we are applying for authorisation, are the senior managers we will name in the application already identified?
6. Do we know where we would find an experienced interim within a week if we needed one?

If the honest answer to any of these is uncertain, it is worth acting before a resignation or a supervisory request forces the issue. Our compliance recruitment and MLRO recruitment teams can help you plan.

What this means for compliance professionals

For compliance professionals, the same changes create opportunity. Experience of a BNPL or consumer credit authorisation, a safeguarding audit or remediation, or a period of interim SMF cover is now highly marketable. Professionals who have held SMF16 or SMF17 before and are open to interim or fractional work are in particular demand. Our articles on career paths to SMF16 and the SMF17 career path explain how to position yourself, and you can register with us or browse current roles on our jobs board.

Frequently asked questions

Does the reformed 12-week rule mean we can leave the SMF16 role unfilled for longer?

No. The function must still be covered by a suitable person from the start, and the firm must submit a valid and complete application within 12 weeks. What has changed is that the cover can continue while the FCA decides that application.

Do payments firms need an SMF16 and SMF17?

Only if the entity is FSMA-authorised and within SM&CR. A firm authorised only as a payment institution or e-money institution still needs a Head of Compliance and a nominated officer, but the SMF designations do not apply. See our payments compliance recruitment page.

When does a BNPL lender need its SMF16 and SMF17 in place?

The individuals should be identified before the full authorisation application is submitted, because the application names the firm’s senior managers. See our consumer credit compliance recruitment page.

Is fractional compliance leadership acceptable to the FCA?

It can be, provided the time commitment is genuinely sufficient for the firm’s size and risk and the arrangement is documented, with deputy cover in place. As firms grow, the FCA will expect a more substantial commitment.

For a wider view of the compliance hiring market this year, see our article on the disciplines driving compliance recruitment.