A UK bank hiring a senior manager, a certification function holder or a notified non-executive director must request regulatory references covering the candidate’s previous six years from every relevant former employer, and must normally hold them before the PRA will approve a senior manager. PS12/26, in force since 24 April 2026, left the core rules in place and changed three things around them: firms should now consider disclosing misconduct investigations that stopped because the person left, a criminal record check can be up to six months old when the application goes in, and an existing senior manager moving within a group needs no new check. On the same day the FCA cut its expected response time for references from six weeks to four.
What is a regulatory reference?
An employment reference in a mandatory form, containing specific information on a candidate’s conduct and fitness and propriety (SS28/15 paragraph 6.1). Its purpose is to stop the “recycling” of people with poor conduct records between firms (paragraph 6.2). The firm giving it must use the regulatory reference template, which is the one in the FCA’s SYSC 22 Annex 1, and include all the information it sets out (Fitness and Propriety rules 5.1(3) and 7.1; SS28/15 paragraph 6.26).
Who needs references, and from whom?
Firms must request them when assessing candidates for senior management functions, certification functions and notified non-executive director functions (Fitness and Propriety rule 2.7; SS28/15 paragraph 6.4). They cover the previous six years and go to all relevant former employers and, if different, any firm where the candidate held a senior management function, another controlled function, a certification function or a notified non-executive role (paragraph 6.5). Other references should be requested from other employers and organisations too, including any non-executive directorship (paragraph 6.6). The FCA’s SYSC 22 applies to the same banks in parallel, for both PRA and FCA controlled functions, including FCA-approved roles such as compliance oversight (SMF16) and money laundering reporting (SMF17), and for certification functions; one reference can meet both regimes (SYSC 22.1.1R, 22.2.1R, 22.2.3R and 22.4.5R).
What must a reference contain?
Two items are mandatory (SS28/15 paragraph 6.31):
- breaches of the Conduct Rules, or for older conduct the Statements of Principle for approved persons, that culminated in disciplinary action as defined in section 64C of FSMA;
- whether the firm concluded, at any point in the six years before the request, that the candidate was not fit and proper to perform a function.
A suspension imposed while an investigation runs is not included; a suspension imposed as a disciplinary measure is (paragraph 6.32). A cut to pay or a clawback is included only when it was a disciplinary response to a conduct breach, not when it followed poor financial performance (paragraph 6.33).
Beyond the mandatory items, the firm must give all other information it is aware of that is relevant to the candidate’s fitness and propriety, in the template’s “all relevant information” section (paragraph 6.34). That section can carry good news as well as bad, such as exemplary conduct since an old breach (paragraphs 6.36 and 6.37). It is subject to the same six-year limit, except for serious matters, which have no time limit (paragraph 6.38). SS28/15 lists examples a firm may treat as serious: a serious breach of the Conduct Rules, misconduct that led to enforcement action, serious dishonesty, and conduct that would have led the firm to dismiss the person had it known (paragraph 6.39).
How the person left makes no difference to the duty to provide a reference, whether dismissal, redundancy or mutual agreement (paragraph 6.27), and no settlement agreement, including an ACAS COT3, overrides it (paragraphs 6.28 and 6.29).
What changed in April 2026?
| Change | What it means | Source |
|---|---|---|
| Incomplete investigations | Where an internal investigation into misconduct started but disciplinary procedures did not conclude because the person left, firms should consider whether to include it in the reference, subject to their legal duties | PS12/26 paragraphs 2.71 to 2.76; SS28/15 paragraph 6.41 |
| Response times (FCA change) | No PRA change. The FCA cut its expected response time from six weeks to four: it expects a reference normally to be issued within four weeks of the request. The PRA sets no window of its own and says the regimes will align in practice | SYSC 22.5.17G; PS12/26 paragraphs 2.77 and 2.79 |
| Criminal record checks | A check can be carried out up to six months before the application is submitted, up from three (application forms updated on 10 July 2026) | PS12/26 paragraphs 1.24, 2.80 and 2.85 |
| Moves within a group | No new criminal record check for an existing senior manager moving to another senior manager role in the same group, with up to a month between roles, provided the new firm can access the earlier check through adequate group arrangements | PS12/26 paragraph 2.86; Fitness and Propriety rule 2.11 |
The first change needs care. A firm “is not required to disclose information that has not been properly verified” (SS28/15 paragraph 6.43, citing Fitness and Propriety 5.4), and anything adverse should have been properly investigated, with “reasonable grounds for believing that the misconduct has taken place” (paragraph 6.44). The PRA says this does not ask firms to breach employment law (PS12/26 paragraph 2.75). A firm that ends an investigation when someone resigns now has a decision to make, and should record it.
What if the references are not back before the application?
The firm can still apply, but the PRA expects it to explain why, confirm it is satisfied the candidate is fit and proper, list the evidence it relied on, and commit to getting the references and acting on anything adverse, which can mean revoking the offer or terminating the employment (SS28/15 paragraph 6.20). The PRA will then treat the application as incomplete and will not approve the candidate until the firm confirms it has every reference it needs (paragraph 6.23).
One case is common in senior hires. Where the candidate’s current employer is listed, a reference request could reveal an impending resignation and trigger a market announcement (paragraph 6.19). The firm can apply first and collect the reference afterwards, but it must be in before the PRA approves (paragraph 6.21). In other cases the firm has to obtain and consider the references no later than one month before the application is due to be determined (paragraph 6.22). Our article on how long SMF4 approval takes sets this in the wider timeline.
What about candidates who have worked overseas?
Local law sometimes stops overseas employers sharing conduct information (SS28/15 paragraph 6.10). The PRA still requires reasonable steps, which may include approaching every relevant current and former employer, explaining what UK regulation requires, and collecting what they are legally able and willing to give (paragraph 6.11). It will take account of demonstrable legal impediments, evidenced for example by correspondence or a legal opinion (paragraph 6.12). Overseas registers of financial professionals can help, but a firm’s due diligence would be likely to comprise more than a register search (paragraph 6.13).
Can a search firm collect the references?
Yes, as the hiring firm’s agent. SS28/15 says a firm giving a reference should respond where the hiring firm has outsourced the collection of information to an unregulated third party, “such as an executive search firm”, provided the request makes clear the third party acts for the hiring firm (paragraph 6.30). The hiring firm still makes the fitness and propriety decision. Sending the requests the day an offer is accepted is the easiest time to save in a senior appointment, and our chief risk officer and risk and compliance leadership searches build it into the timetable.
Do references have to be updated after they are given?
Yes. A firm must revise a regulatory reference given since 7 March 2017 if it becomes aware of matters that would make it write the reference differently and the differences would be significant to the new employer’s assessment, for six years from the date the person’s employment ended (Fitness and Propriety rule 5.2; SS28/15 paragraphs 6.49 to 6.51). The update goes to the person’s current employer, whom the firm must make reasonable enquiries to identify (paragraphs 6.54 and 6.55). In practice this arises when misconduct comes to light after someone has left (paragraph 6.53).
A working sequence for a senior risk hire
- At offer: map the candidate’s last six years, every employer and every regulated role, including non-executive positions.
- Day one after acceptance: send template requests to firms subject to the regulatory reference rules, and specified requests to anyone outside the regime (SS28/15 paragraphs 6.7 to 6.9).
- For a listed current employer: agree with the candidate when that request goes, and plan to apply first.
- For overseas employers: write early, explain the UK requirement and keep the correspondence as evidence.
- Before applying: record the fitness and propriety assessment and, if references are outstanding, the explanation and evidence paragraph 6.20 asks for.
- After approval: diarise the six-year updating window for anyone who leaves.
Candidates preparing for a move can start on our page for candidates. Terms are defined in our glossary.
Regulatory references for a senior risk hire, step by step
- At offerMap the candidate's last six years, every employer and every regulated role, including non-executive positions.
- Day one after acceptanceSend template requests to firms subject to the regulatory reference rules and specified requests to anyone outside the regime.
- Listed current employerAgree with the candidate when that request goes, and plan to apply first.
- Overseas employersWrite early, explain the UK requirement and keep the correspondence as evidence.
- Before applyingRecord the fitness and propriety assessment and, if references are outstanding, the explanation and evidence paragraph 6.20 asks for.
- After approvalDiarise the six-year updating window for anyone who leaves.
Questions readers ask
How far back does a regulatory reference go?
Six years for the mandatory information and the “all relevant information” section, except that serious matters have no time limit (SS28/15 paragraphs 6.5, 6.31 and 6.38).
Can a settlement agreement stop a firm disclosing misconduct?
No. The duty applies notwithstanding any agreement with the individual, including an ACAS COT3, and firms should not enter into arrangements that conflict with it (SS28/15 paragraphs 6.28 and 6.29).
Does a suspension during an investigation go in the reference?
Not if it was imposed pending the investigation. A suspension imposed as a disciplinary measure does go in (SS28/15 paragraph 6.32).
Can the candidate change what a reference says?
No. Fairness may normally require a firm to give the person a chance to comment on adverse information, though it is ultimately for the firm to decide whether that is appropriate. A right to comment is not a right to edit or veto the reference, and a refusal to comment does not stop the firm including the allegation (SS28/15 paragraphs 6.45 to 6.47).
Sources: PRA SS28/15 (April 2026 version), chapter 6, paragraphs 6.1 to 6.55; PRA PS12/26, Review of the SM&CR: Phase 1 (22 April 2026), paragraphs 1.24, 2.71 to 2.80, 2.85 and 2.86; PRA Rulebook, Fitness and Propriety Part, rules 2.7, 2.11, 5.1 to 5.4 and 7.1; FCA Handbook SYSC 22, including 22.1.1R, 22.2.1R, 22.2.3R, 22.4.5R, 22.5.17G and Annex 1. Accessed 29 September and 1 October 2026.
How we research and check our articles: our editorial policy.