Senior leaders face greater accountability

Where this pressure most often appears in the customer lifecycle

Onboarding

Ongoing monitoring

Exit & de-risking

The person accountable is rarely the person operating the control

The senior manager accountable for an economic crime control is rarely the person actually operating it. Execution sits across compliance and operations teams, business units, technology and third parties. Allocating responsibility is the easy part. The SMCR test is whether the individual with accountability can demonstrate sufficient oversight of how that responsibility is being discharged.

The focus is becoming more important as the regulatory test moves beyond whether a policy or control exists to whether it works in practice. Firms are also relying more heavily on technology, automation and third parties to deliver economic crime controls, increasing the distance between the person accountable and the activity itself. A firm can have a robust AML framework, sanctions policy or fraud strategy while the control operates differently in practice.

In June 2026, the PRA’s Head of Enforcement and Litigation named section 166 reviews as one route into enforcement investigations. Reviews like this, a supervisory visit, or a whistleblower report, can all trigger the same reconstruction: what went wrong, why it went wrong, and who was accountable. Once a failure is reconstructed, the question is not simply whether the firm had a control: it’s what the individual responsible knew, what they were told, what they challenged and what they did about it.

The same principle is increasingly visible in the regulatory approach to technology. The 2026 Mills Review called for greater focus on having a “human on the hook”, not just a human in the loop. That principle extends beyond AI. Delegating a control to a team, system or third party does not remove the accountability for how it operates.

The pressure, then, is not simply the prospect of personal enforcement. It is the expectation that a senior manager can demonstrate that the controls within their remit were understood, appropriately overseen and effective in practice.

Reasonable steps, on paper, are not the same as reasonable steps you can prove

That reconstruction is where the question changes. It stops being whether the firm had a control, and becomes whether a named individual can show they took reasonable steps. The evidence trail was rarely built specifically for that purpose.

A control can be correctly designed, formally approved and reported as effective while operating differently day to day. The people executing it, and the systems processing it, sit several layers below the individual who has to answer for it. No senior manager can personally verify every layer. What they can be expected to show is that there was a credible way to know what was happening: that weaknesses could surface, that challenge reached the right people, that escalation worked and that identified problems were acted on.

That is where the accountability gap becomes an operational problem.

The control may be delegated. The evidence of oversight cannot.

The same pattern can surface across all key risk domains. The triggering failure may be different; the underlying question is the same: could the individual accountable for the control demonstrate that they had enough visibility to know whether it was working, and acted when it was not?

How we support you

We work on the governance and assurance that let an individual, not just a firm, show their working.

Typical engagements include:

Checking whether economic crime accountability is clearly owned across the three lines of defence, and whether that ownership meets SMCR obligations

Mapping that accountability to the relevant Senior Management Functions, so it’s reflected accurately in their Statements of Responsibilities

Checking whether a control that’s approved and documented on paper is the control operating day to day

Testing whether the resulting evidence would meet the standard a Skilled Person review expects

Strengthening the management information and reporting lines a senior manager relies on for oversight

Building assurance that holds up to an external, adversarial reader, not just an internal sign-off

See our full list of services

Our experience

A UK wealth management firm

Why we were brought on: ahead of an FCA section 166 review, the firm needed an independent assessment across its financial crime controls, including how its senior managers evidenced oversight and control effectiveness, alongside governance, risk assessment and due diligence.

What we did: we assessed the firm’s policies, governance and risk methodology against what the review would test, built an enhanced remediation plan with prioritised actions, then supported delivery of that plan once the review had taken place, including an embedded senior manager providing second-line quality assurance.

Outcome: the remediation plan was delivered and carried into a second phase of implementation support, with senior manager oversight and effectiveness one of the control areas assessed and remediated.

A UK challenger bank

Why we were brought on: the MLRO and SMF-17 holder needed independent assurance that the evidence trail supporting their reasonable-steps position would stand up to regulatory challenge.

What we did: we reviewed the senior manager’s Statement of Responsibilities, oversight MI, escalation paths and challenge records, and rebuilt the evidence base against the standard a Skilled Person would test.

Outcome: the senior manager entered the next supervisory cycle with a documented, defensible position on how the controls in their remit were being overseen and challenged.

A UK wealth manager

Why we were brought on: an incoming MLRO needed to reset personal accountability across the financial crime framework before formally taking on the SMF-17 responsibility.

What we did: we mapped every relevant control to a named accountable owner, tested whether the reporting lines the MLRO would rely on actually surfaced weakness, and closed the gaps before handover.

Outcome: the incoming MLRO took on the role with a working accountability map, live MI and evidence of oversight, not an inherited paper trail.

open FCA investigations into senior managers for possible SMCR breaches, as of November 2024

closed cases since January 2022 had resulted in a financial penalty or public censure

Where enforcement has landed, it has turned on the same test each time: not whether the senior manager personally ran the control, but whether they took reasonable steps to know it was working. In one case, the FCA fined a UK bank’s former chief executive for exactly that. He had not personally failed to operate the bank’s anti-money laundering controls. As the senior manager responsible for them, he had failed to act on warnings about a culture of non-compliance and unusually low levels of suspicious activity reporting.

How confidently could you evidence your actions to a regulator?