Fit and proper screening in Fintech: are your hiring records ready for FCA scrutiny?

If your Fintech business is subject to the Senior Managers and Certification Regime (SM&CR), you must be able to demonstrate that relevant employees are suitable for their responsibilities. This means conducting the required checks, investigating concerns and documenting how you reached your decision. Effective fit and proper screening gives you the evidence to support those decisions when the Financial Conduct Authority (FCA) asks questions.

For enterprise Fintech companies, responsibility often sits across HR and Compliance. Recruitment teams coordinate background checks, while Compliance assesses regulatory suitability and ensures the organisation meets its obligations.

Problems arise when those responsibilities are unclear. A candidate may complete standard pre-employment checks without the business obtaining all the evidence needed to support their appointment to a regulated position.

Your screening process should therefore establish clear responsibilities for collecting information, reviewing findings and approving appointments.

What does the FCA expect from your screening process?

Under the SM&CR, firms within scope must assess the fitness and propriety of individuals performing relevant regulated functions.

The FCA's Fit and Proper test considers three main areas:

• Honesty, integrity and reputation.
• Competence and capability.
• Financial soundness.

These criteria inform how firms assess candidates for Senior Management Functions and roles covered by the Certification Regime.

The checks required depend on the individual's position and the regulatory obligations applying to your firm.

A Chief Compliance Officer performing a Senior Management Function may require regulatory references and criminal record checks. An employee performing a Certification Function must also undergo a fitness and propriety assessment, although criminal record checks are not automatically mandatory for every certification role.

The distinction matters. FCA authorisation does not mean every employee within a Fintech business falls under SM&CR.

HR and Compliance should first establish which positions are covered before defining their screening requirements.

Regulatory references must cover the required employment history

Regulatory references are a specific obligation for firms within the scope of the relevant SM&CR rules.

Under SYSC 22, firms must take reasonable steps to obtain appropriate references from a candidate's current employer and employers from the previous six years when appointing individuals to covered positions.

These references can reveal information that standard employment verification may not identify, including relevant disciplinary action or findings concerning an individual's fitness and propriety.

For example, a candidate applying for a senior financial crime position might have worked at several regulated institutions.

Verifying their employment dates would establish whether their stated career history is accurate. Regulatory references provide additional information that may affect their suitability for the proposed role.

A previous employer may disclose relevant misconduct or disciplinary findings, subject to the FCA's rules on accuracy, relevance and disclosure.

Serious misconduct can also be relevant beyond the usual six-year disclosure period.

Your process should record which employers were contacted, whether references were received and how any adverse disclosures were assessed.

Veremark's reference checking service can support employment verification workflows. Where regulatory references are required, your process must also satisfy the specific requirements of SYSC 22.

Criminal records and financial checks require careful assessment

The FCA generally requires criminal record checks for Senior Management Function applicants, subject to applicable exemptions.

However, identifying a conviction does not automatically mean a candidate is unsuitable.

The FCA considers factors including the seriousness of the offence, its relevance to the proposed responsibilities and evidence of rehabilitation.

Suppose a candidate applying for a senior payment operations position has a historical conviction.

The business should examine the circumstances and assess whether the offence has a meaningful connection to the responsibilities they would hold.

An automatic rejection policy could lead to unfair decisions and may be inconsistent with the FCA's case-by-case approach.

Financial soundness also requires judgement.

For some roles, checking relevant financial history may help identify matters that warrant further assessment. However, financial difficulties alone do not establish that an individual lacks integrity.

The ICO's guidance on pre-employment vetting states that employers must justify credit checks based on the responsibilities of the position.

Veremark's guide to financial background checks in the UK explains how employers can assess regulatory history alongside other relevant screening information.

Non-financial misconduct now demands closer attention

The FCA's expectations around employee conduct have developed further.

On 1 September 2026, new rules and guidance concerning non-financial misconduct came into effect, clarifying how firms should consider relevant behaviour when assessing fitness and propriety.

This includes serious misconduct such as bullying, harassment and violence.

The importance of these issues was already evident in the FCA's 2024 survey of wholesale financial services firms.

Among respondents, 92% said they would include non-financial misconduct in regulatory references where appropriate. The number of references reported as containing this information increased from 16 in 2021 to 43 in 2023.

Although the survey covered wholesale financial services rather than Fintech specifically, it demonstrates how conduct information can form part of regulated hiring decisions.

For HR leaders, this places greater importance on how internal investigations and disciplinary findings are documented.

Where misconduct could affect an individual's suitability for a regulated function, Compliance needs access to relevant and properly verified information.

The FCA does not expect firms to investigate trivial allegations or monitor employees' private lives. Assessments must respect employment and privacy law.

An allegation should be evaluated according to the available evidence and its relevance to the role. Your records should demonstrate that decisions were fair and proportionate.

Your screening records should explain the decision

Completing background checks is only part of the employer's responsibility.

You also need to establish how findings were interpreted and whether the evidence supports the appointment.

Consider a candidate for a senior Compliance position whose regulatory history check identifies previous enforcement action.

Your business should establish the nature of that action, whether it relates to the individual and whether it affects their suitability for the proposed responsibilities.

Veremark's financial regulations checks can help identify relevant professional regulatory history.

Where a concern requires further investigation, the outcome should be documented with the reasons for the final decision.

We recommend establishing a screening record that identifies the applicable checks, their completion status, relevant findings and the authorised decision-maker.

For senior appointments, HR should confirm that required checks are complete or that any permitted exceptions have been addressed. Compliance should review findings that could affect regulatory suitability.

The final record should allow an internal auditor or regulator to understand why the business considered the individual fit and proper.

Personal information must also be retained appropriately. You may need to retain evidence of your assessment without keeping every underlying document indefinitely.

Fitness and propriety must be reviewed after appointment

Initial fit and proper screening establishes whether an individual is suitable when appointed. Their continued suitability also requires attention.

Under the Certification Regime, firms must reassess relevant employees at least annually.

This creates an ongoing responsibility to consider information that may affect their fitness and propriety.

For example, an employee may receive a disciplinary finding after appointment or take on responsibilities that require different professional capabilities.

Such developments may justify a fresh assessment.

HR and Compliance should establish how relevant information moves between employee relations processes and regulatory oversight teams.

This includes determining when disciplinary outcomes need to be considered in a fitness and propriety assessment and whether an existing regulatory reference must be updated.

Annual certification does not automatically require repeating every initial background check. The business should determine what evidence is necessary based on the individual's circumstances and applicable regulatory rules.

For enterprise Fintech organisations, this process becomes particularly important when employees transfer between business units or move into regulated responsibilities.

Make accountability clear before the next appointment

The strongest fit and proper screening policies give HR and Compliance clearly defined responsibilities throughout the employee lifecycle.

HR should understand which appointments trigger regulatory screening requirements and ensure that the required information is collected.

Compliance should determine whether the evidence supports the individual's regulatory suitability and whether any findings require further investigation.

Both functions need access to an accurate record of the final decision.

Review your existing screening workflow against the roles covered by SM&CR, the regulatory references you collect and the way adverse findings are handled.

Where responsibilities or evidence requirements remain unclear, address those gaps before your next regulated appointment.

Your ability to demonstrate a reasoned, documented decision will matter when the FCA reviews how your organisation assesses the people entrusted with regulated responsibilities.