The FCA Certification Regime: Running Annual Fit and Proper Assessments After CP26/37

On 22 October 2026 the FCA proposed scrapping the Certification Regime altogether. Some firms will read that and quietly let this year's annual fitness and propriety round slide. That would be a mistake, and not only because the regime is still law today.

The consultation, CP26/37, removes the certificate. It does not remove the question the certificate answers: is this person still competent and suitable to do the job you have given them? If your current process can answer that with evidence, you will be fine under the old rules and the new ones. If it cannot, you have a problem under both.

A Certification Regime fit and proper assessment is the check an FCA-regulated firm must make before it issues, and every 12 months reissues, a certificate confirming that an employee in a certification function is fit and proper. It covers honesty, integrity and reputation; competence and capability; and financial soundness, judged against the role the person actually does. Until the CP26/37 reforms take effect, planned for the second half of 2027, the full regime still applies.

Below: what the rules require now, what Phase 1 has already relaxed, and how to run this year's round so the process survives the regime being switched off.

What the Certification Regime asks of you until the rules change

The regime covers staff below Senior Manager level whose roles the FCA has designated as certification functions. The Handbook list in SYSC 27.8 names eight: the CASS oversight function, the proprietary trader function, the significant management function, functions requiring qualifications, managers of certification employees, material risk takers, the client-dealing function and the algorithmic trading function.

The FCA's own consultation sums up what firms must currently do for that population. In paragraph 4.3 of the CP26/37 paper, firms are required to:

• assess fitness and propriety when they hire someone into a certification function;
• reassess and certify fitness and propriety annually after that;
• obtain regulatory references; and
• report up-to-date information to the Directory of certified persons.

The detail sits in SYSC 27.2. A firm may issue a certificate only if it is satisfied the person is fit and proper to perform the function. In reaching that view it must have regard to the person's qualifications, training, competence and personal characteristics. A certificate is valid for a maximum of 12 months from the day it is issued. It should be in writing, include its dates of validity and be given to the employee, and the firm must keep a record of every employee who holds a valid certificate.

So your annual process has to be able to answer these questions for every certified person:

• Which certification function or functions do they actually perform today?
• When does their current certificate expire, and is reassessment booked before then?
• What is the current evidence on honesty, integrity and reputation?
• Do they meet the training and competence requirements for the role, and can you show it?
• Has anything material changed since the last assessment?
• Who made the decision, on what evidence, and where is it recorded?

CP26/37 removes the paperwork, not the duty

Most commentary on the consultation leads with the headline: certification goes, the Directory goes, regulatory references for certified staff go. All true. The FCA's reasoning is more useful to an HR team than the headline, because it tells you exactly what replaces the regime.

In paragraph 4.13 the regulator says firms "will remain responsible for ensuring individuals in relevant roles are competent, suitable and meet appropriate standards of conduct". It then lists the requirements it will lean on instead:

• The competent employee rules. SYSC 3.1.6R and SYSC 5.1.1R already require firms to employ people with the skills, knowledge and expertise their responsibilities need. Under these rules, the paper says, most firms are expected to assess honesty and competence on appointment "and whenever there is reason to reassess their suitability".
• The Conduct Rules. Paragraph 4.18 confirms they will continue to apply to people currently in certification roles.
• Training and Competence. Qualification requirements for retail investment and mortgage advisers in TC stay, as does the annual Statement of Professional Standing for retail investment advisers.
• Consumer Duty. Firms are still expected to make sure staff are adequately trained to deliver good outcomes for retail customers.

The paper also says, in paragraph 4.18, that firms "will continue to assess competence through standard employer practices, including performance management, employment checks and referencing". In other words, the work moves out of a standalone compliance process and into your ordinary people processes. It does not disappear.

Timing matters too. The FCA says it will publish final rules in the first half of 2027 and proposes to implement them about six months later, in the second half of 2027. It also says it will avoid taking any steps to repeal the regime before reaching a final policy position, and the whole package depends on the Financial Services and Markets Bill removing the regime from legislation. The consultation closes on 22 January 2027.

What Phase 1 has already changed

Phase 1, published as PS26/6 in April 2026, has already made this year's round lighter. The amended SYSC 27.2 guidance now says:

• Annual re-certification should be proportionate and streamlined, and the FCA "would expect the assessment to be less detailed" than the initial one (SYSC 27.2.20G).
• Material changes, such as a move into a function with different requirements, should be assessed when they happen rather than waiting for the anniversary (SYSC 27.2.15G).
• When a role changes, the firm "may not have to make a completely new assessment" and can rely on parts of the existing one that still apply (SYSC 27.2.15AG).
• Certification can be embedded in other processes such as appraisal, provided the regime's standards are applied where they differ (SYSC 27.2.19G).
• A certificate can be issued as an email (SYSC 27.2.17G).

From 30 July 2026, the FCA also removed overlapping certification functions from the Directory, so one person doing several related functions no longer needs to be recorded several times.

Running this year's annual assessment in six steps

Here is a process that meets the current rules, uses the Phase 1 flexibility and leaves you with the evidence you will still need after 2027.

1. Confirm who is in scope and what they actually do

Start from the role, not the job title. The FIT sourcebook says a continuing assessment should look at the role the person is actually performing, based on an up-to-date job description (FIT 1.3.4B). People drift into and out of certification functions through restructures, secondments and promotions. Check your list against your HR system, not last year's list.

Do not forget managers of certification employees. It is a certification function in its own right under SYSC 27.8.13R, so a team leader whose people are certified is assessed as a manager, not only as an individual contributor.

2. Refresh the evidence under the three FIT headings

FIT 1.3.1B says the most important considerations are honesty, integrity and reputation; competence and capability; and financial soundness. For an annual reassessment, most of the honesty and financial evidence is a confirmation that nothing has changed: a signed self-declaration, any conduct or disciplinary records from the year, and any checks your policy requires at renewal. The FIT guidance also reminds firms to carry out assessments fairly and in line with privacy and employment law (FIT 1.3.3).

3. Test competence against the role, not the CV

FIT 2.2.1A tells firms to consider whether the person meets any applicable training and competence requirements, whether they have shown by experience and training that they are suitable for the function, and whether they have adequate time to perform it. In practice that means current qualifications, completed mandatory training, CPD where it applies, quality-assurance or file-review outcomes, and the manager's evidence from the year's check-ins and objectives.

This is where most annual rounds are thinnest. A rating of "meets expectations" from an appraisal is not evidence of competence in a regulated function unless the appraisal actually assessed that function.

4. Decide proportionately

Where nothing material has changed, SYSC 27.2.20G lets you run a lighter reassessment. Use that. Spend the time you save on the cases where something has changed: a new function, a conduct issue, a failed file review, a qualification lapse or a significant personal financial event.

5. Use a panel for marginal cases, then issue or refuse in writing

The FCA's fitness and propriety good-practice page points to panels including senior managers for marginal cases, and to relevant Senior Managers actively overseeing the process. If you certify, issue the certificate in writing with its validity dates. If you decide not to, SYSC 27.2.11G requires a written notice to the person setting out the steps you propose to take and your reasons.

6. Record the decision and turn gaps into development plans

Keep the record the rules require, and keep the evidence behind each decision with it. The same FCA page lists development plans arising from F&P assessments, and a process integrated with existing HR and performance management, as good practice. A reassessment that finds a gap and produces a dated development plan is a stronger record than one that finds nothing.

Where annual certification goes wrong

Treating the appraisal as the assessment

Embedding certification in appraisal is allowed, but only if the regime's standards are applied where they differ (SYSC 27.2.19G). An appraisal that rates objectives and values without touching qualifications, conduct or the specific function does not meet that bar on its own.

Waiting for the anniversary

If someone moves into a function with different requirements in March, SYSC 27.2.15G expects the assessment then, not at the December renewal. A process tied only to a calendar date will miss these.

Certifying the job title

Certificates should set out the aspects of the firm's affairs the person will be involved in. A certificate written against a generic title, rather than the functions actually performed, makes it hard to show what you assessed.

Losing the evidence trail

The rules require a record of who holds a valid certificate. They do not stop at that. If a decision is challenged, by the employee, an auditor or the FCA, you need the evidence it rested on. Assessments held in email threads and spreadsheets are the usual failure point.

Regulatory references arriving late

Under SYSC 22.2, firms must take reasonable steps to obtain references from the current employer and anyone who employed the person in the past six years before issuing a certificate. Recruitment timelines for certified roles often ignore this. CP26/37 proposes removing the requirement for previously certified staff, but it stays until the new rules take effect, and it will still apply to Senior Manager candidates.

Getting ready for the second half of 2027

The sensible plan is not to choose between the old regime and the new one. Run this year's round properly, and use it to build the process you will keep.

Activity	Now (current rules)	After CP26/37 takes effect (as proposed)	What to do this year
Fit and proper assessment on hiring	Required for certification functions	Competence and honesty still assessed on appointment under the competent employee rules	Keep it. Standardise the evidence you collect.
Annual reassessment and certificate	Required, maximum 12-month validity	Formal annual certification removed; reassess when there is reason to	Use the Phase 1 proportionate approach; build event-driven triggers.
Regulatory references	Required for certification candidates	Removed for previously certified staff; still required for SMF candidates	Keep obtaining them; plan for employment references and other checks.
Directory reporting	Required	Directory retired	Keep it accurate until the switch-off.
Conduct Rules and TC requirements	Apply	Continue to apply	Tie training records and qualification tracking to each person's role.

A 90-day plan for most mid-sized firms looks like this:

1. Days 1 to 30: reconcile your certified population against the HR system, and map each person to the functions they actually perform. Fix the record before you assess anyone.
2. Days 31 to 60: agree one competence evidence set per function (qualifications, training, QA outcomes, manager evidence) and move it into the place managers already work, rather than a separate annual form.
3. Days 61 to 90: define the events that trigger a reassessment (role change, conduct issue, qualification lapse, failed QA) and make sure each one raises a task for the right person.

Where StaffCircle fits

StaffCircle is performance management software for financial services firms. It is not a regulatory reporting tool and does not submit anything to the FCA. What it does is keep the competence evidence that fit and proper decisions depend on in one place.

Competence mapped to the role

A competency framework lets you define what competent looks like for each function and assess people against it. That gives FIT 2.2 a structure: the assessment is against the role, not a generic appraisal form.

Qualifications and training on the record

The training compliance features track qualifications, mandatory training and expiry dates, so a lapse shows up before the renewal meeting rather than during it. If you also track CPD, our guide to CPD compliance tracking covers the record-keeping side.

Evidence from the whole year

Check-ins, objectives and feedback captured through the year give managers real evidence to bring to the annual assessment, and to any event-driven reassessment. This is the "standard employer practice, including performance management" the FCA says will carry the load after 2027.

Development plans that follow the decision

When an assessment finds a gap, a dated development plan linked to the person's record is the outcome the FCA's good-practice list describes. For more on that, see our guide to performance development plans in financial services.

Final thoughts

The Certification Regime is on its way out, but not this year, and not in a way that lets anyone stop assessing their people. Run this round to the current rules. Use the Phase 1 flexibility to spend less time on the straightforward cases and more on the ones that matter. Build the evidence trail into the processes your managers already use. When the certificate disappears in 2027, the process underneath should not have to change much.

If you are preparing for an inspection more generally, our checklist on preparing for a skills compliance audit is a useful companion. To see how StaffCircle handles competence, training and check-ins in one platform, book a demo.

FAQ

What is the FCA Certification Regime?

It is the part of the Senior Managers and Certification Regime that covers staff below Senior Manager level in roles the FCA designates as certification functions. Firms must assess these people as fit and proper when they are hired, reassess and certify them every year, obtain regulatory references and report them to the FCA Directory.

Is the Certification Regime being abolished?

The FCA proposed removing it completely in consultation paper CP26/37, published on 22 October 2026. The change depends on the Financial Services and Markets Bill and on the outcome of the consultation, which closes on 22 January 2027. The FCA plans final rules in the first half of 2027 and implementation around six months later.

Do I still need to run annual fit and proper assessments in 2026?

Yes. The current rules apply in full until the new ones take effect, and the FCA has said it will not take steps to repeal the regime before reaching a final policy position. Certificates still expire after a maximum of 12 months.

How long is a certificate valid?

A certificate is valid for 12 months from the day it is issued. A firm can draft one to expire sooner, but not later, according to SYSC 27.2.10G.

What does a fit and proper assessment cover?

FIT 1.3.1B says the most important considerations are honesty, integrity and reputation; competence and capability; and financial soundness. The assessment should be made against the role the person actually performs.

What counts as evidence of competence and capability?

FIT 2.2.1A points to training and competence requirements, experience and training that show suitability for the function, and whether the person has adequate time for the role.

Can the annual appraisal double as the fit and proper assessment?

It can, provided the regime's standards are applied where they differ from the appraisal. SYSC 27.2.19G allows firms to embed certification in other processes such as appraisal.

Does the annual reassessment have to be as detailed as the first one?

No. Since April 2026, SYSC 27.2.20G says re-certification should be proportionate and streamlined, and that the FCA would expect the assessment to be less detailed. Material changes should be assessed when they happen.

What happens if someone changes role during the year?

If the new function has different requirements, the FCA expects you to assess fitness before the person starts it rather than waiting for the annual reassessment. You may be able to rely on the parts of the existing assessment that still apply.

What must a firm do if it decides not to issue a certificate?

SYSC 27.2.11G says the firm must give the person a written notice setting out the steps it proposes to take and the reasons for them.

How far back do regulatory references go?

SYSC 22.2 requires firms to take reasonable steps to obtain references from the current employer and anyone who employed the person in the past six years. CP26/37 proposes removing it for previously certified staff, but not before the new rules take effect.

Will certified staff still be subject to the Conduct Rules if certification is removed?

Yes. CP26/37 says the Conduct Rules will continue to apply to individuals currently performing certification roles, and firms will remain responsible for making sure people in relevant roles are competent and suitable.

Which roles are certification functions?

SYSC 27.8 lists eight: CASS oversight, proprietary trader, significant management, functions requiring qualifications, managers of certification employees, material risk takers, client-dealing and algorithmic trading.

---