Background checks in financial services
If your firm is under the Senior Managers and Certification Regime (SM&CR), FCA rules set the checks for senior managers, who hold a senior management function (SMF), certification staff and, in core and enhanced firms, non-SMF board directors. The firm must be satisfied that each is fit and proper. The FCA's fit and proper test (FIT) names the most important considerations as honesty, integrity and reputation; competence and capability; and financial soundness. Before applying for a senior manager's approval, the firm must obtain the fullest criminal record information the law allows, dated no more than 6 months before the application. For certification staff, FIT says firms should check for convictions where possible. Firms must also take reasonable steps to obtain regulatory references covering the past six years.
For everyone else the ordinary rule applies. FCA rules require fitness and propriety assessments for SMF managers, certification staff and, in core and enhanced firms, non-SMF board directors, and the ICO's draft guidance on pre-employment vetting says you should only vet where the law requires it or the role carries significant and particular risks. Since 1 September 2026, bullying, harassment and violence towards colleagues can breach the conduct rules in non-bank firms, and findings of that kind can reach you through references.
Who the FCA rules cover
FIT applies to SMCR firms, candidates for FCA controlled functions, people a firm proposes to certify, certification employees and certain board directors. Before applying for approval of a controlled function, the firm must be satisfied the person is fit and proper.
Certification staff are not approved by the FCA. The firm certifies that they are fit and proper on appointment and at least once a year, and a certificate cannot last more than 12 months. The eight certification functions are client assets (CASS) oversight, proprietary traders, significant management, functions requiring qualifications, managers of certification employees, material risk takers, client-dealing and algorithmic trading.
The conduct rules apply to almost every employee of an SMCR firm, except those whose only roles are on a listed set such as receptionists, security guards, cleaners and human resources administrators. That alone does not call for a fitness assessment. The FCA says the SM&CR is undergoing reform, so check its pages before relying on detail.
What a fitness and propriety check covers
FIT 2.1.1AG says firms should check for criminal convictions where possible and contact previous employers. In England and Wales a standard DBS check is available for people approved under section 59 of FSMA, which DBS describes as approved person, senior manager or controlled function roles. Certification staff are not approved by the FCA, so check eligibility before asking for more than a basic check. Disclosure Scotland and AccessNI run the equivalent checks in Scotland and Northern Ireland. Where the Rehabilitation Exceptions Orders allow, spent convictions must also be considered (FIT 2.1.3G).
A conviction is not an automatic bar. FIT 1.3.23G asks you to weigh the seriousness and circumstances of the offence, the person's explanation, its relevance to the role, the time since and evidence of rehabilitation. FIT 2.1.3G also lists disqualification as a director, dismissal or being asked to resign, and internal disciplinary findings of harassment, bullying, victimisation or discrimination.
The FCA says you should check the Financial Services Register for anyone carrying out regulated activities for you, including any disciplinary or regulatory action on their record.
Financial soundness and credit reports
FIT 2.3.1G asks about judgment debts that remain outstanding or were not satisfied within a reasonable period, arrangements with creditors, bankruptcy and related proceedings. The FCA will not normally require a statement of assets or liabilities, and limited financial means does not in itself affect suitability (FIT 2.3.2G).
The Individual Insolvency Register covers bankruptcies, Debt Relief Orders and Individual Voluntary Arrangements in England and Wales; Scotland and Northern Ireland have their own registers. The ICO says credit reference checks must not be carried out routinely or without justification. Our view: for most certified roles, start with a candidate declaration covering everything in FIT 2.3.1G, then search the Individual Insolvency Register, which only shows current or recently ended cases, and consider the Register of Judgments, Orders and Fines. A full credit report is needed only where the role justifies it.
Regulatory references under SYSC 22
SYSC 22 applies to all SMCR firms. When considering someone for a controlled function, a certificate (including a renewal) or, in core and enhanced firms, a non-SMF board director role, you must take reasonable steps to obtain references from the current employer and anyone who employed the person in the past six years. For controlled functions the deadline is one month before the end of the FCA's application period; otherwise it is before issue or appointment. If a reference has not arrived in time, keep taking reasonable steps to get it as soon as possible.
The giving firm must disclose everything it reasonably considers relevant, normally from the past six years but at any time for serious misconduct. The FCA expects references within 4 weeks at most. The template asks whether the firm concluded the person was not fit and proper (Question E), took disciplinary action for a conduct breach (Question F) or holds other relevant information (Question G).
References should not be based on unproven allegations or mere suspicions, and fairness normally requires that the employee had a chance to comment on the information. A firm must not enter into any agreement that limits what it can disclose, including a COT3 settled through Acas.
Non-financial misconduct and fitness
Since 1 September 2026, COCON 1.1.7FR extends the conduct rules in non-banking firms to bullying, harassment or violence against colleagues where it relates to the person's role. It does not apply retrospectively. The FCA says FIT allows firms to consider any relevant misconduct, wherever it occurs, and that COCON and FIT operate separately.
For screening, a previous employer's finding of bullying or harassment can reach you through Questions E to G of a regulatory reference, and FIT treats it as relevant to honesty, integrity and reputation. But the FCA says firms do not need to monitor employees' private lives or social media accounts. Our answers on the FCA's non-financial misconduct rules and on fitness and propriety go further.
Role-based check matrix
Use this as a starting point for your own role matrix.
| Role or activity | Check | Basis |
|---|---|---|
| Every new hire | Right to work check | Legal obligation the ICO cites as justifying vetting |
| Candidate for an SMF role | Fit and proper assessment, criminal record (standard DBS in England and Wales), previous employers, financial soundness, FS Register | SUP 10C.10.16R (certificate no more than 6 months old); FIT 2.1.1AG and FIT 2.3.1G |
| SMF, certification or non-SMF board director appointment | Regulatory references covering the past six years | SYSC 22.2.1R and SYSC 22.2.3R |
| Non-SMF board director (core and enhanced firms) | Fit and proper assessment, criminal record check, regulatory references | SYSC 23.4.1AR, SYSC 23.4.2R, SYSC 22.2.3R |
| Certification staff, on appointment and each year | Fit and proper assessment before the certificate is issued | Section 63F FSMA (SYSC 27.2.4G); certificate valid for up to 12 months |
| Other conduct rules staff | No FIT assessment required; further checks only for an identified risk | FCA fitness and propriety page; ICO vetting guidance |
| Listed ancillary roles | Usually right to work only | Outside COCON (COCON 1.1.2R); ICO vetting guidance |
| Roles with authority over money or client assets | Credit reference check, if justified and disclosed | ICO vetting guidance |
What to tell the candidate
- Tell candidates which checks you will run, why, who will see the results, how long you will keep them and, where possible, which third party sources you will use.
- When you ask about spent convictions for an approved person role, tell the person at the time that spent convictions are to be disclosed.
- Give candidates the chance to explain anything that does not match what they told you.
- Never make a candidate obtain their own criminal record through a subject access request.
- If you decide not to issue a certificate, give the person written notice of the steps you propose to take and your reasons.
Sources
- FIT 1 General · FCA Handbook
- FIT 2 Main assessment criteria · FCA Handbook
- SYSC 22 Regulatory references · FCA Handbook
- SYSC 27 Senior managers and certification regime: Certification regime · FCA Handbook
- COCON 1 Application and purpose · FCA Handbook
- The Certification Regime · Financial Conduct Authority
- Fitness and Propriety (F&P) · Financial Conduct Authority
- Senior Managers and Certification Regime · Financial Conduct Authority
- Non-financial misconduct in financial services · Financial Conduct Authority
- Financial Services Register · Financial Conduct Authority
- Eligibility for Standard DBS Checks · GOV.UK (Disclosure and Barring Service)
- Eligibility for Standard DBS checks legislation · GOV.UK (Disclosure and Barring Service)
- Search the bankruptcy and insolvency register · GOV.UK
- Pre-employment vetting of candidates · ICO
- SUP 10C.10 Application for approval · FCA Handbook
- SYSC 23.4 Checks for certain directors · FCA Handbook
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Checks by role
Required or expected
- Candidates for senior management functions: fit and proper assessment, criminal record, previous employers, financial soundness and regulatory references.
- Non-SMF board directors in core and enhanced firms: fit and proper assessment, criminal record check and regulatory references.
- People you propose to certify, and certification staff at each annual renewal: a fit and proper assessment and a regulatory reference, which on renewal can often be the existing one unless the role has changed in a major way.
- Every new hire: a right to work check, which the ICO gives as an example of vetting required by law.
Depends on the role
- Other conduct rules staff: the FCA allows firms to extend similar assessments voluntarily, but each check needs a role-specific risk.
- Roles with authority over money or client assets: a credit reference check, if you can justify it and tell candidates early.
Rarely justified
- Listed ancillary roles such as receptionists, cleaners and HR administrators, which sit outside the conduct rules.
- Blanket credit checks or social media monitoring of all staff.
Questions
Something else? Ask us.
Do we have to DBS check everyone in a regulated firm?
No. For senior manager candidates, and non-SMF board directors of core and enhanced firms, FCA rules require the fullest criminal record information the law allows. For certification staff, FIT says to check for convictions where possible, at the level the role is eligible for. For other staff the ICO's test applies: check only where the role carries a significant and particular risk, at the level it is eligible for.
How far back does a regulatory reference go?
Normally six years. The firm giving the reference must disclose relevant information from the six years before the request, plus anything between the request and the reference. For serious misconduct there is no time limit, although SYSC 22 says the longer ago something happened, the less likely it is still to be serious.
Does the non-financial misconduct rule mean we should screen candidates' social media?
No. The FCA says firms do not need to monitor employees' private lives or social media accounts. Under FIT 1.3.21G, private social media activity is relevant where it shows a material risk of breaching regulatory standards, such as threats of violence, and is otherwise unlikely to be. If a role still justifies a public profile check, follow the ICO's rules on notice and on separating researcher and decision maker.
Do we need a new reference every time we renew a certificate?
Not necessarily. SYSC 22 says a firm should have a reference whenever it renews a certificate, but an existing one will very often still be appropriate. You are unlikely to need a new one from a former employer unless the person's role has changed in a major way.
Related checks
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
- Credit checks on job candidates When a UK employer can justify a credit check on a candidate, how it differs from insolvency and director searches, and what to tell applicants.
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
Sector guides
Also covered in our guides for Technology.
Related answers
- What are the FCA's rules on non-financial misconduct? Since 1 September 2026, the FCA's Code of Conduct (COCON) has applied to serious bullying, harassment and violence by conduct rules staff towards colleagues in firms other than banks, as it already did in banks. New FCA guidance explains when such behaviour breaches the conduct rules and how it bears on fitness and propriety.
- Can misconduct outside work affect whether someone is fit and proper under FCA rules? Yes. FCA guidance says conduct in someone's private life can be relevant to their fitness and propriety, especially dishonesty, a lack of integrity, violence or sexual misconduct. Firms need not monitor staff's private lives or social media. They need only look into private life where there is a good reason, such as an allegation that would call someone's fitness into question if true.
- How do employers carry out right to work checks? Before someone starts work, employers should carry out one of three prescribed checks: a manual check of original documents, a Home Office online check using a share code, or a check through a registered right to work digital verification service provider. Done correctly, it gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.