Pseudonymising SMCR Statements of Responsibility – UK GDPR-compliant anonymisation per Senior Managers & Certification Regime
SMCR statements of responsibility are the individual accountability documents the Senior Managers and Certification Regime — extended to all FCA firms in December 2019 — requires each Senior Manager Function holder to maintain. Certification staff must be recertified annually; the FCA recorded 30 s.166 reviews in 2023; UK GDPR fines reach £17.5 million under DPA 2018. anonym.legal pseudonymises individuals so governance advisers can review SMCR adequacy without processing personal data.
When this applies
This task applies when SM&CR statements of responsibility or management responsibilities maps are reviewed by governance consultants, external legal advisers, or board members assessing the completeness and coherence of the firm's SM&CR framework, and those reviewers do not need to know the identities of the named senior managers.
How anonym.legal handles it
- Upload the SMCR statements of responsibility and management responsibilities map.
- The engine identifies named senior managers and their prescribed-responsibility allocations throughout the documents.
- Each named senior manager is pseudonymised with a consistent pseudonym; prescribed responsibilities, role titles, and reporting-line structures are preserved.
- Gaps in responsibility coverage and any overlapping-responsibility notes remain in clear text for governance adequacy assessment.
- A reversible mapping table is produced with UK/EU data residency.
- Release the pseudonymised documents for governance review; restore originals before any submission to the FCA.
What you provide
- SMCR statements of responsibility for each Senior Manager Function holder
- Management responsibilities map
- Prescribed responsibilities allocation record
Limitations & cautions
- SMCR statements submitted to the FCA for approval or notification must contain the real names of the senior managers; the pseudonymised version is for internal governance review only.
- The tool pseudonymises personal data in SMCR documents but does not assess whether the prescribed responsibilities are adequately allocated across the Senior Manager Function holders. The SMCR extended to all FCA solo-regulated firms on 9 December 2019.
- Conduct rules and fitness-and-propriety assessments referencing named individuals should be processed separately and access restricted appropriately. Certification staff must be certified at least annually, generating personal-data records that require appropriate access controls.
FAQ
Does pseudonymising SMCR documents affect regulatory submissions to the FCA?
No, provided the pseudonymised version is used only for internal governance review. Any SMCR documents submitted to the FCA for approval or notification must contain the real legal names of the senior managers.
Can I pseudonymise a management responsibilities map that includes both executive and non-executive directors?
Yes. All named natural persons — executive directors, non-executive directors, and other Senior Manager Function holders — are pseudonymised with distinct, consistent pseudonyms throughout the map.
Are prescribed responsibility descriptions preserved in the pseudonymised documents?
Yes. Prescribed responsibility descriptions, role-title labels, and reporting-line structures are preserved in clear text. Only the senior managers' names are pseudonymised.
Can a pseudonymised management responsibilities map be shared with a governance consultant?
Yes. This is a primary use case. Pseudonymised maps allow governance consultants to assess responsibility coverage and identify gaps without accessing the personal data of named senior managers.