SMF18 Explained: The Other Overall Responsibility Function in FCA-Regulated Firms

SMF18 Recruitment: Find a Senior Manager With the Right Specialist Responsibility

SMF18 is the Senior Management Function under the FCA’s Senior Managers and Certification Regime that captures senior managers responsible for areas of the firm not covered by another SMF. It is the most flexible and most situation-dependent SMF in the regime — used for senior individuals running specific business units, oversight functions, or specialist areas within Enhanced-tier firms. The role most commonly applies to CASS oversight, certain operational areas, distinct business divisions, and other senior responsibilities that don’t fit neatly into another SMF designation.

This guide covers what SMF18 actually means in practice — when it applies, how it differs across firm structures, what the personal liability position looks like, and how SMF18 holders are typically positioned within the broader regulatory governance framework. It also covers what FD Capital looks for when placing SMF18-approved candidates, how compensation differs from other SMF roles, and the specific reasons SMF18 mandates are typically more bespoke than other SMF searches.

SMF18 is the SMF that most often catches firms by surprise — boards designing their SM&CR governance frequently underestimate where SMF18 applies, and candidates exploring new opportunities frequently encounter SMF18 designations they hadn’t expected. That’s the gap this guide fills.

What SMF18 Means and When It’s Required

SMF18 is the “Other Overall Responsibility Function” under the FCA’s SMF framework. Per SUP 10C, SMF18 designates a senior manager who has overall responsibility for a part of the firm, an activity, or an area of the firm’s operations that is not covered by another SMF.

SMF18 is required only for Enhanced-tier solo-regulated firms — it does not apply to Core-tier or Limited Scope firms. The reason is that the Enhanced regime requires firms to allocate ALL areas of senior responsibility to a designated SMF, with no significant area left unallocated. SMF18 is the catch-all designation that captures responsibility for areas not assigned to a specific named SMF (SMF1, SMF2, SMF3, SMF4, etc.).

An Enhanced firm typically has multiple SMF18 holders — anywhere from two to twenty depending on firm structure and size. Each SMF18 holder has a specific Statement of Responsibilities setting out exactly which area or activity they are responsible for.

Common SMF18 Allocations

SMF18 designations are bespoke to each firm’s structure. The following are the most common patterns we see:

CASS Oversight

Where the firm holds client money or custody assets under CASS, the prescribed responsibility for CASS oversight (Prescribed Responsibility CC) must be allocated to a specific senior manager. In firms where CASS oversight is allocated separately from SMF2, the holder is typically an SMF18 with CASS responsibility specifically defined in their SoR. CASS-experienced SMF18 candidates are particularly valuable because the role carries concentrated regulatory risk — CASS is one of the most heavily enforced areas of FCA regulation.

Specific Business Units

In Enhanced firms with distinct business divisions, the head of each significant division often holds SMF18. For example, a wealth manager with separate retail and institutional divisions might have an SMF18 for each division, with each having overall responsibility for the conduct, performance and regulatory compliance of their respective business unit.

Head of Internal Audit (where SMF5 not used)

For firms not required to have SMF5 (Head of Internal Audit), the senior internal audit role is typically allocated to SMF18. This is more common in mid-Enhanced firms than in larger Enhanced firms where SMF5 applies directly.

Specialist Functional Heads

Heads of specialist functions that don’t fit other SMFs — typically Head of HR (where the role is sufficiently senior), Head of IT (in firms without SMF24), Head of Legal, or Head of Operations (in firms without SMF24) — frequently hold SMF18 in Enhanced firms.

Outsourcing and Vendor Oversight

In firms with material outsourced operations — particularly intra-group outsourcing in international groups — the senior individual responsible for outsourcing oversight may hold SMF18. This is increasingly common as firms separate outsourcing oversight from the broader operational ownership held by SMF24.

Specific Regulatory Areas

Some firms allocate specific areas — for example, Consumer Duty oversight, financial promotions, or product governance — to a dedicated SMF18 holder rather than absorbing the responsibility into SMF16 or other SMFs. This pattern is more common in larger firms where workload makes specialisation appropriate.

SMF18 Statement of Responsibilities — Why Specificity Matters

The Statement of Responsibilities (SoR) for an SMF18 holder is more important than for any other SMF because the role’s scope is defined by the SoR rather than by a generic SMF description. Where SMF2 has a broadly understood meaning (Chief Finance Function), SMF18 means whatever the SoR specifies.

A well-drafted SMF18 SoR will typically include:

• The specific area, activity, or business unit the SMF18 has overall responsibility for
• The boundaries of the responsibility — what is in scope and what is not
• The interaction with other SMFs — particularly where the SMF18’s area touches on responsibilities held by other named SMFs (e.g., the boundary between an SMF18 head of a business unit and the firm-wide SMF16 compliance responsibility)
• Specific accountabilities — for example, accountability for specific regulatory returns, regulatory relationships, or compliance with specific FCA rules
• The reporting line within the firm and the governance forums the SMF18 attends

The SoR is filed with the FCA at the point of approval and updated whenever responsibilities change. For Enhanced firms, the Management Responsibilities Map (MRM) provides the broader picture of how all SMF responsibilities — including all SMF18 designations — fit together. The MRM is filed with the FCA and updated as the governance structure changes.

When recruiting an SMF18, the SoR is one of the most important documents in the process. Experienced candidates examine the SoR closely to understand exactly what they will be responsible for, where the boundaries lie with other senior managers, and whether the scope is appropriately defined. Vague or overly broad SoRs are a red flag for experienced candidates — they create ambiguity about accountability that can become problematic in regulatory matters.

Personal Liability and the Duty of Responsibility

SMF18 holders carry the same Duty of Responsibility under section 66B of FSMA as any other SMF. The personal liability is bounded by the SoR — the SMF18 is liable for breaches in their defined area where they did not take reasonable steps to prevent the breach.

The personal liability profile varies substantially by what the SMF18 actually covers:

• CASS-allocated SMF18: High personal liability exposure given the FCA’s enforcement focus on CASS. SMF18 holders with CASS responsibility need detailed CASS technical knowledge, strong relationships with the CASS audit firm, and active board engagement on CASS matters. Personal liability includes potential enforcement around CASS reporting, breach handling, and the integrity of client money/custody asset arrangements.
• Business unit SMF18: Liability profile depends on the business unit. A retail-facing unit attracts conduct exposure under Consumer Duty and broader COBS rules. An institutional unit attracts different exposures around best execution and conflicts of interest.
• Outsourcing SMF18: Liability under SYSC 8 (outsourcing) and increasingly DORA — particularly around critical third-party providers and intra-group dependencies.
• Specialist functional SMF18: Liability bounded by the function — Head of HR has limited regulatory liability beyond SMCR fitness assessment processes, while Head of Operations or Head of IT can carry significant operational resilience-related exposure.

The “reasonable steps” defence applies as for any SMF. SMF18 holders need to be able to demonstrate they took the steps appropriate to their defined area of responsibility — documented decision-making, evidence of escalation where appropriate, and active oversight of the activity within their scope.

Day-to-Day Responsibilities of an SMF18

The day-to-day responsibilities vary substantially by what the SMF18 has been allocated. For illustration, here are the typical activities of an SMF18 holding CASS oversight responsibility — one of the most regulated SMF18 designations:

• Maintaining the firm’s CASS framework — policies, procedures, control framework
• Overseeing the CASS reconciliation process — internal and external client money reconciliations, internal and external custody asset reconciliations
• Managing the CASS audit relationship — coordinating the annual CASS audit under FRC standards, addressing audit findings, presenting audit results to the board
• Submitting CASS regulatory returns — particularly the CMAR (Client Money and Asset Return) on the prescribed cycle
• Managing CASS breach handling — internal escalation, FCA notification under CASS 1A, remediation of any breaches
• FCA engagement on CASS matters — supervisory dialogue, response to FCA information requests, leading the firm’s preparation for any CASS-focused FCA visits
• CASS training across the firm — particularly for staff in operations, finance and front-office roles with CASS implications
• Strategic CASS matters — input to product design, new business onboarding, M&A activity where CASS implications arise

For other SMF18 designations the day-to-day looks completely different — a head of business unit’s day looks like a divisional CEO, a head of internal audit’s day looks like an internal audit leader, and so on. The unifying feature is that all SMF18 holders are individually responsible for an area defined by their SoR and accountable for it under SMCR.

SMF18 Compensation Benchmarks (UK 2026)

SMF18 compensation is the most variable of any SMF role because the underlying corporate role varies so widely. The regulated-firm premium of 15-25% applies on top of whatever the underlying role would pay in a non-regulated context:

The CASS-allocated SMF18 commands a particular premium because of the technical specialism required. Candidates with deep CASS expertise — particularly experience leading firms through CASS audit findings or remediation — are genuinely scarce in the market.

Hiring an SMF18 — What FD Capital Looks For

The criteria for SMF18 placements vary substantially by what the role covers, but consistent themes apply:

Specific area expertise

Unlike named SMF roles, SMF18 mandates require specialist expertise in the specific area covered by the SoR. CASS-allocated SMF18 needs CASS expertise; head of operations SMF18 needs operations expertise; head of HR SMF18 needs senior HR expertise — and so on. The candidate pool varies widely depending on the area.

Regulated-firm context experience

Across all SMF18 types, candidates need experience operating within a regulated firm context. The personal liability framework, the FCA approval process, the SoR discipline, and the conduct rules culture are not features of non-regulated roles. Candidates from non-regulated backgrounds can transition into SMF18 roles but typically need a stronger case for FCA approval.

Statement of Responsibilities engagement

Strong candidates engage seriously with the SoR during the recruitment process — discussing scope, boundaries, and how the role interacts with other SMFs. Candidates who treat the SoR as an administrative formality often miss issues that become problematic later.

Senior management presence

SMF18 is a senior management role regardless of which area is covered. The holder sits within the senior management group, attends the relevant governance forums, and participates in decisions affecting their area. Candidates need the seniority and presence to operate at this level.

SMF18 and the Wider SMF Framework

• SMF2 (Chief Finance Function): SMF18 with CASS allocation works closely with SMF2 on financial reporting, regulatory capital and the CASS audit relationship.
• SMF4 (Chief Risk Function): SMF18 holders for specific business units are accountable to the firm-wide risk framework owned by SMF4.
• SMF16 (Compliance Oversight): Business unit SMF18s have a direct relationship with SMF16 — compliance with FCA rules within the business unit is the SMF18’s responsibility, but the framework and oversight sit with SMF16.
• SMF17 (MLRO): Business unit SMF18s are responsible for AML compliance within their area; the firm-wide AML framework rests with SMF17.
• SMF24 (Chief Operations Function): Where SMF24 exists, operational responsibility for the firm rests with SMF24. SMF18 designations covering specific operational areas (outsourcing, IT) sit within or alongside the SMF24 framework.

For the broader regulatory framework, see our complete SMCR guide. For CASS specifically, see our CASS Guide.

Common SMF18 Recruitment Pitfalls

SoR ambiguity. Vague or overly broad Statement of Responsibilities create issues for candidates and for the firm. The SoR should be specific, with clear boundaries.

Misalignment between corporate title and SMF18 scope. Where the corporate title implies broader responsibility than the SMF18 SoR allocates, candidates encounter ambiguity. The two should align.

Underestimating CASS expertise requirements. Firms allocating CASS to an SMF18 sometimes underestimate the depth of CASS-specific expertise the role requires. CASS is technically demanding and FCA-enforced — non-CASS-experienced candidates take material time to come up to speed.

Treating SMF18 as a back-office designation. SMF18 carries the same SMCR personal liability framework as any other SMF. Firms that treat SMF18 holders as below “real” SMF level often find candidates declining the role.

Inconsistency with the Management Responsibilities Map. SMF18 SoRs need to be consistent with the firm’s MRM. Inconsistencies cause issues at FCA approval and create regulatory exposure.

Further Reading and Authoritative Sources

For the FCA’s authoritative guidance on Senior Management Functions, see FCA Handbook SUP 10C. For CASS specifically, the CASS Sourcebook sets out the client money and custody asset framework. For systems and controls including outsourcing, see the SYSC Sourcebook.

Related Guides: SMCR and SMF Functions

Part of FD Capital’s series of practical guides for FCA-regulated firms: SMCR — The Complete UK Guide | SMF2 — The Chief Finance Function | SMF4 — The Chief Risk Officer Function | SMF16 — The Compliance Oversight Function | SMF17 — The MLRO Function | SMF24 — The Chief Operations Function | CASS Guide | Operational Resilience Guide