A clean SM&CR register does not mean you are covered for Section 250. The two frameworks cover different people, carry different consequences, and one of them carries a fixed 29 June 2026 deadline. Here is how they actually differ.
SM&CR: pre-approval, certification, and the conduct rules
The Senior Managers and Certification Regime has three parts, and the distinction between them matters here. The Senior Managers Regime covers holders of a Senior Management Function (SMF), who need FCA pre-approval before they can act. The Certification Regime covers staff in roles that could cause significant harm; the firm certifies them annually, and the FCA does not pre-approve them. Conduct Rules staff is almost everyone else, with narrow carve-outs for genuinely ancillary roles.
SM&CR is an ongoing framework. No sunset, no deadline. It is the baseline accountability structure the FCA expects authorised firms to maintain.
One point that trips people up: SM&CR accountability runs through the Duty of Responsibility in FSMA s.66B, and that duty is enforced through regulatory sanctions, fines, prohibitions, withdrawal of approval, not criminal prosecution. (Narrow individual criminal offences do exist elsewhere in financial services law, but they are not how SM&CR itself bites.)
Section 250: a corporate attribution rule
Section 250 of the Crime and Policing Act 2026 is not a regulatory framework at all. It is a corporate attribution rule. Under s.250(1), where a senior manager acting within the actual or apparent scope of their authority commits an offence under the law of England and Wales, Scotland or Northern Ireland, the organisation also commits that offence. The scope is any criminal offence under UK law, not a list of offences confined to the Act itself. That uncapped scope is the genuinely new element. The attribution structure echoes s.196 of the Economic Crime and Corporate Transparency Act 2023, and the functional test for who counts as a senior manager traces back to the Corporate Manslaughter and Corporate Homicide Act 2007.
Section 250 applies to all UK bodies corporate and partnerships, not only FCA-authorised firms.
The commencement date is fixed: 29 June 2026, two months after Royal Assent on 29 April 2026. There is no commencement statutory instrument and no regulator discretion involved. Only Parliament could move it. An organisation that has not identified its s.250(3) population and built a record of having done so by that date is exposed to criminal liability, not regulatory enforcement.
Three differences that actually change what you do
SM&CR turns on who you are: your role and your FCA registration. Section 250 turns on what you do. The s.250(3) test asks whether an individual plays a significant role in making decisions about how the whole or a substantial part of the organisation's activities are managed or organised, or in the managing or organising of those activities. Those activities are any activities, not only the regulated financial ones. So a chief operating officer or the head of a major division can sit squarely inside Section 250 scope without holding an SMF. The reverse can happen too, though it is less common.
The consequences differ. SM&CR is an FCA matter, supervised and enforced by the regulator. Section 250 is criminal law, decided in the criminal courts, carrying the consequences of whatever underlying offence is attributed to the organisation.
The cadence differs. SM&CR is continuous. Section 250 needs one specific thing done by a specific date: a gap analysis identifying your s.250(3) population, with documented declarations, before 29 June 2026, and review after that.
Your SM&CR register is where the analysis starts, not where it ends
For an FCA-regulated firm, the SM&CR register is the obvious place to begin a Section 250 gap analysis. It already lists the people the FCA framework covers. Set that list against everyone who meets the s.250(3) functional test, and the people in the second list but not the first are your exposure.
The register and the test do not line up by design. The register tells you who is FCA-approved or firm-certified. The s.250(3) test pulls in the full population of senior decision-makers, including operational, technology, and divisional leaders who may never have needed an SMF or a certified role. A spotless register tells you nothing about that second group.
In practice the work is a sequence: run the gap analysis, send a declaration cycle to everyone the test catches, and keep the signed responses in an evidence pack. CoverProof produces those packs as PDF/A-3B files (ISO 19005-3), which preserve the document reliably and support the authenticity, integrity, and chain of custody a court assesses. The format does not make anything admissible on its own; it gives you evidence built to stand up if it ever has to.
Related articles
Ready to identify your Section 250 exposure?
Import your SM&CR register, run your gap analysis, and download a PDF/A-3B evidence pack. First analysis is free.
Start Free Gap Analysis →Sources
- Crime and Policing Act 2026, s.250www.legislation.gov.uk/ukpga/2026/20/section/250
- FCA — Senior Managers and Certification Regimewww.fca.org.uk/firms/senior-managers-certification-regime
- FSMA 2000, s.66B (Duty of Responsibility)www.legislation.gov.uk/ukpga/2000/8/section/66B
- FCA Registerregister.fca.org.uk/