A decade ago, compliance at a small financial firm was often a part of somebody else’s job. The finance director picked it up, or an operations manager with a tidy mind, and for a lot of businesses that was genuinely adequate.
It is not adequate now, and the shift has happened quietly enough that plenty of firms have not noticed it happening to them.
The Job That Kept Expanding
Three things have changed, and they compound.
The first is the volume of rules. Consumer protection obligations, operational resilience requirements, financial crime expectations and reporting duties have all been added to over the past several years, and very little has been taken away. Each addition is manageable in isolation. The cumulative effect is a different job.
The second is evidence. Regulators increasingly expect firms not merely to comply but to demonstrate compliance, with records, on request. That turns a judgement exercise into a documentation exercise as well, and documentation takes time that nobody budgeted for.
The third is personal accountability. Senior people in regulated firms now hold formally designated roles with individual responsibility attached — it does not sit with the company, and it does not evaporate when they leave. That has changed who is willing to take these jobs, and on what terms.
What the Codes Mean
Anyone looking at compliance roles in financial services runs into codes like SMF16 and SMF17, which are not job titles so much as formal designations.
SMF16 is Compliance Oversight — responsibility for the firm’s compliance function, the programme of checks that tests whether the business is doing what it should, and the relationship with the regulator.
SMF17 is the Money Laundering Reporting Officer, responsible for the systems that detect financial crime and for deciding whether suspicious activity is reported to the authorities.
The practical difference between a designated role and an ordinary senior job is that the individual must be approved by the regulator before starting. A firm cannot simply appoint someone and have them begin on Monday, which has significant consequences for how long hiring takes.
Why Small Firms Feel It Most
Obligations do not scale down neatly. A three-person brokerage and a 300-person payments business both need these functions covered. What differs is how much work sits behind them, not whether they exist.
For a large firm, absorbing additional regulatory requirements means adding to an existing team. For a small one, it can mean the difference between a role somebody could do alongside other duties and a role that needs a specialist.
That threshold gets crossed gradually. A business adds a product, enters a market, grows transaction volume — none of which triggers a formal review — and at some point the arrangement that was fine two years ago is no longer defensible. Almost nobody notices the moment it happens.
What the Role Involves Day to Day
For readers outside financial services, the job is less exotic than the codes suggest and more demanding than the title implies.
A substantial part of it is a programme of checks run across the year, testing whether the business is actually doing what its policies say. The findings go to the board, including the uncomfortable ones. Policies get reviewed and updated as the business and the rules change. Staff get trained, and the training gets recorded because an untrained workforce is a finding in itself.
Then there is the part that cannot be scheduled: the question about whether a particular client can be taken on, the product the sales team wants to launch next quarter, the letter from the regulator asking how the firm handles something specific.
Most of the year is routine. The value concentrates in a handful of moments where somebody has to give an answer the business does not want, and be right about it.
The Cost of Getting the Size Wrong
An under-resourced compliance function does not fail dramatically. It fails by omission — checks sampled more lightly than they should have been, a policy review postponed, a rule change nobody had time to read properly. The business looks fine from outside throughout.
The problem surfaces when somebody looks: a regulatory visit, a complaint that escalates, a bank running due diligence, or a buyer in a data room. At that point the firm cannot offer its budget as an explanation, because the obligation sat with the business all along.
What follows is rarely a headline fine. More often it is a remediation programme — months of work, usually with expensive outside help, rebuilding records that should have existed. For most small firms that costs considerably more than the resource would have.
The Squeeze on Experienced People
The predictable consequence of a growing, higher-stakes job is that the people who can do it well have become harder to secure.
Demand has risen across payments, consumer credit, wealth management, insurance and cryptoassets simultaneously. Supply has not, partly because the experience that matters is specific: someone who has run compliance at a low-risk intermediary is not automatically equipped for a business with a different risk profile, even though the job title is identical.
Personal accountability also filters the candidate pool. People who understand what they are accepting are more selective about where they accept it — which is why experienced candidates ask pointed questions about reporting lines, board access and a firm’s standing with its regulator before saying yes.
Who Is Hiring
The demand is not evenly spread, and the pattern tells you something about where regulatory attention has been going.
Payments and e-money businesses account for the largest share. They have grown quickly, they process high transaction volumes, and the supervisory interest in the sector has risen accordingly. Cryptoasset firms are the other obvious cluster, where registration requirements and nervous banking partners have made credible compliance leadership a condition of operating rather than a nice-to-have.
Consumer credit has been busy for a different reason — a sustained focus on how firms treat customers, particularly those in difficulty. Insurance distribution and wealth management generate steadier demand, often driven by firms leaving networks and becoming directly authorised, which means taking on obligations a principal firm used to carry.
What these have in common is that none of the hiring is discretionary. A firm cannot defer filling a designated role the way it might defer a marketing hire, which is part of why the market stays tight even when the wider economy is not.
What This Means for Hiring
Three practical consequences for any business in this position.
Start earlier than feels necessary. Because appointments need regulatory approval, the timetable is not within the firm’s control. A resignation should trigger a search immediately rather than when the person leaves, since approval runs after the offer rather than alongside the notice period.
Size the role against the work. The most common error is deciding the budget first and the shape of the role afterwards. That usually produces a full-time hire at whatever seniority the budget stretches to, which at a small firm is often not enough seniority for the job.
Treat awkward candidate questions as a good sign. Someone asking who they report to and what happens when they raise something unwelcome has understood the role. Someone asking none of that either has not, or does not intend to use the authority.
The Part-Time Option More Firms Are Taking
One genuinely useful feature of the current regime is that these roles do not require an employee. The designated functions can be held by individuals engaged on a consultancy basis, working across several firms, and many are.
This is frequently misread as a cost-saving measure. It is better understood as a way of buying seniority a small business could not otherwise afford — two or three days a month from someone with twenty years of experience, rather than a full-time hire the budget had to compromise on.
There is a second, less obvious advantage. A compliance officer whose entire income depends on one client, reporting to the person whose decisions they are meant to challenge, is in a structurally difficult position however principled they are. Someone with several clients can afford to give an unwelcome answer. For a role whose value lies almost entirely in being willing to do exactly that, the structure matters.
Where It Is Heading
Nothing in the current direction of travel suggests the job gets smaller. Regulatory expectations around financial crime, consumer outcomes and operational resilience have all moved in one direction, and the evidential burden has moved with them.
The firms handling this well are not necessarily the ones spending most. They are the ones that stopped treating compliance as an overhead to be minimised and started treating it as a function to be sized — against what the business actually does, reviewed when the business changes, and resourced at a level the firm could defend if somebody asked.
FD Capital recruits compliance officers for regulated firms on permanent, part-time and interim bases. Its SMF16 recruitment page sets out the options, and its guide to the Compliance Oversight function covers the regulatory background in more detail.
