SM&CR and the certification of staff who oversee AI agents

Under the UK's Senior Managers and Certification Regime, the firm itself certifies that staff in certain significant-harm roles are fit and proper, and most other staff must follow conduct rules. People who oversee AI agents are usually under the conduct rules and sometimes certified. Either way, their competence must be assessable, and evidence of real decisions helps.

What does SM&CR ask of staff who oversee agents?

SM&CR has three parts, each with a different reach.

The Senior Managers Regime covers the most senior people. They are approved by the FCA or PRA, have a statement of responsibilities, and must take reasonable steps to prevent breaches in their areas. One of them will answer for the area where an agent operates; who that should be is discussed in who is the accountable senior manager for an AI agent under SM&CR.

The Certification Regime covers staff who are not senior managers but whose roles could cause significant harm to the firm or its customers. The firm must assess them as fit and proper, considering honesty, integrity, competence and capability, before they start and on a regular cycle after, and issue its own certificate.

The conduct rules apply to most staff in regulated firms. In substance, they require you to act with integrity, act with due skill, care and diligence, be open and cooperative with regulators, pay due regard to customers' interests and treat them fairly, observe proper standards of market conduct, and act to deliver good outcomes for retail customers in line with the Consumer Duty.

For someone overseeing an agent, the conduct rules are the daily standard. Approving an agent's draft without reading it is hard to reconcile with due skill, care and diligence. Approving a draft that treats a customer unfairly runs against the duty to treat customers fairly.

Who does it apply to?

SM&CR applies to FCA-authorised firms, and to dual-regulated firms such as banks and insurers that are also overseen by the PRA. That covers banks, building societies, insurers, wealth managers, payment and consumer credit firms, and many more.

Whether an AI overseer sits in a certification function depends on what they do. Roles that deal with clients in ways the rules define, or that carry material risk, may be certified. Many reviewer roles are not, but they remain under the conduct rules. Ask an employer which applies to the role; a good one will know.

What does "certification" mean here, and what does it not mean?

The word causes confusion. Under SM&CR, "certification" means the firm's own assessment that a person is fit and proper for a defined role. It is not a qualification you earn outside, and no course can give it to you.

What a professional certificate can do is feed that assessment. A firm assessing competence and capability needs evidence. A record of review decisions to a stated standard, signed off by an assessor and checkable at source, is the kind of evidence a firm can file. The question of proving competence is covered at greater length in SM&CR and proving competence to oversee AI agents, and what an outside operator certification is in what is an operator certification.

Be clear in interviews and on your CV: a professional certificate supports the firm's fitness and propriety assessment; it does not replace it.

Which roles and competence does this create?

UK adverts use titles such as operations analyst, customer outcomes reviewer, quality assurance analyst, paraplanner, credit referrals officer and complaints handler. Read the duties for review, approval, exceptions, quality and escalation, and look for mention of the conduct rules or the Certification Regime.

The roles around agents include:

• Reviewers approving agent-held actions, under the conduct rules.
• Certified staff in client-dealing or material-risk roles who also oversee agents.
• Agent owners who answer to the relevant senior manager for one agent.
• Quality and first-line risk analysts who test whether reviewers and agents meet the standard.

Wealth managers show how this works in practice; see how wealth managers can prove staff are trained to oversee AI agents.

How do you show employers you meet the standard?

What might a UK interviewer ask?

1. "Which conduct rule would you be breaching if you approved agent drafts without reading them?" Due skill, care and diligence, and possibly the duty to treat customers fairly.
2. "Is this role a certification function?" Ask it back if they do not say. Showing you know the difference is a good sign.
3. "How would you show us you are competent to oversee this agent?" Point to assessed decisions, training records and a certificate the firm can verify.

A paraplanner we will call Hannah prepared by explaining how she already documented suitability checks for advisers, and how she would apply the same diligence to an agent's draft reports. It mapped directly onto the conduct rules.

What does SM&CR not cover?

It does not regulate AI as such. It does not set the content of agent controls, which come from the firm's own policies, the Consumer Duty and other rules. It does not give outside bodies the power to certify staff. And it does not apply to firms outside FCA authorisation.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Certified Pryme Operator from Pryme Intelligence Academy is a professional certificate, not an SM&CR certificate. It can support a firm's fitness and propriety assessment because it rests on a written exam and a two-week practicum of review decisions signed off by an assessor, and it is checkable at source through VerifyDoc.ai. Some firms make approval rights depend on a current certificate.