Outsourced Compliance Officer or Compliance Consultancy? Understanding the Difference

Smaller FCA-regulated firms often say they “outsource compliance”. That phrase covers two quite different arrangements. In one, an experienced individual from outside the firm is approved by the FCA as its compliance officer, holding the SMF16 function. In the other, a consultancy provides services such as monitoring, policy drafting or training, while someone inside the firm holds the regulatory role. Both can work well. Confusing them is where problems start: a firm can believe its compliance is covered when nobody actually holds the accountability the FCA expects to see.

What the FCA Expects

The FCA’s position is straightforward. A firm can outsource tasks, but it can’t outsource its regulatory responsibility. Under the Senior Managers and Certification Regime, most firms need a named individual approved for the compliance oversight function. That person is accountable for compliance oversight and is subject to the Senior Manager Conduct Rules and the duty of responsibility. The firm’s board remains responsible for making sure the compliance function is adequate. The FCA’s rules on outsourcing in SYSC also require firms to keep enough knowledge in-house to oversee what they have outsourced.

Model 1: The Outsourced Compliance Officer

Here, an individual who is not an employee of the firm is approved by the FCA as its SMF16. They might work one or two days a week, or more, under a services agreement. They are a Senior Manager of the firm for regulatory purposes, with the accountability that comes with it.

• Strengths: real senior experience at a fraction of a full-time cost; a named, accountable person the FCA can engage with; independence from day-to-day sales pressure.
• Watch points: the individual must have enough time and access; the firm must check their other commitments; the agreement must cover notice, handover and access to information.
• Suits: smaller firms such as insurance brokers, advice firms and small investment firms that need an experienced compliance officer but not a full-time one.

SMF Capital’s guide to the outsourced compliance officer model goes into more detail, including how the FCA assesses outsourced Senior Managers.

Model 2: The Compliance Consultancy

A consultancy provides compliance services to the firm: file reviews, monitoring programmes, policy writing, training, regulatory updates and help with FCA applications. Someone inside the firm, often a director or an employed compliance manager, holds the SMF16 role and uses the consultancy’s work to discharge it.

• Strengths: access to a team with broad expertise; capacity to scale up for projects; specialist input such as financial promotions or Consumer Duty reviews.
• Watch points: the internal SMF16 must genuinely understand and challenge the consultancy’s work; it is easy to slip into treating reports as box-ticking.
• Suits: firms with a capable internal compliance lead who needs extra hands or specialist expertise.

Side by Side

What It Costs

Costs vary widely with the firm’s size and sector, so treat these as broad patterns rather than prices. An outsourced compliance officer is usually paid a day rate or a monthly retainer reflecting an agreed number of days. Because they hold a Senior Manager role and carry personal accountability, their rate is typically higher than a consultant doing comparable tasks without that accountability. A consultancy will usually charge a retainer for ongoing services such as monitoring and regulatory updates, with project fees for one-off work. When comparing quotes, compare like with like: a cheap consultancy retainer may not include the oversight and board reporting that an outsourced SMF16 would provide, and the internal person holding the function will need time to do that work themselves.

How the FCA Looks at Outsourced Senior Managers

When a firm applies to approve an outsourced individual as SMF16, the FCA assesses them in the same way as an employee: fitness and propriety, competence and capability, and whether they will have enough time for the role. It will often ask how many other firms the individual acts for and how their time will be split. A Statement of Responsibilities should set out what they are accountable for. Firms should expect the FCA to look more closely where an individual holds many appointments, or where the firm is complex relative to the time offered.

Combining the Two

Many firms use both. An outsourced compliance officer holds the SMF16 role and sets the monitoring plan, while a consultancy carries out file reviews or specialist projects under their direction. That can give a small firm senior accountability and extra capacity without a full-time hire. The key is clarity: everyone, including the FCA, should be able to see who holds the function and who does which tasks.

The Most Common Problem

The arrangement we see go wrong most often is where a managing director holds SMF16 on paper while relying entirely on a consultancy, without the time or knowledge to oversee its work. When something goes wrong, the FCA will look to the approved individual, and “the consultants were handling it” is not a defence. SMF Capital’s article on when the managing director is also the compliance officer explores this in more detail.

How to Choose

Ask three questions:

1. Is there someone inside the firm with the experience to hold SMF16 credibly? If not, an outsourced compliance officer is probably the better fit.
2. How much compliance work is there? One or two days a week of oversight suits an outsourced individual; a heavy programme of file reviews might need consultancy capacity as well.
3. Does the work need specialist knowledge the firm lacks? Client money, financial promotions or a new permission may justify specialist consultancy support either way.

What to Check Before Appointing an Outsourced Compliance Officer

• Their relevant sector experience, such as insurance broking, advice or payments.
• How many other firms they act for, and how many days a week they can genuinely give you.
• Their FCA history, references and any past approvals.
• Who covers when they are on holiday or ill.
• The services agreement: scope, access to records and staff, notice period and handover.

SMF Capital’s guides to the part-time compliance officer for small firms and what a fractional SMF agreement should cover set out these checks in detail.

Signs Your Current Arrangement Isn’t Working

• The board receives consultancy reports but nobody inside the firm can explain the findings or what has changed as a result.
• The approved SMF16 can’t describe the firm’s main compliance risks without checking a document.
• Monitoring findings are repeated quarter after quarter without being fixed.
• The outsourced individual is hard to reach, or their days keep slipping because of other clients.
• The FCA, an insurer or an auditor has raised questions about who is responsible for compliance.

Any of these is a reason to review the arrangement. Often the answer is not to change provider but to clarify who holds accountability and to make sure that person has the time, knowledge and support to exercise it.

Switching From One Model to the Other

Firms move between models as they change. A small firm that started with an outsourced SMF16 may later hire an employed compliance officer and keep the outsourced provider on for monitoring support. A firm whose internal compliance lead leaves may appoint an outsourced SMF16 as a bridge. In both cases, plan the handover: the FCA must approve the new Senior Manager before they take up the role, and under the 2026 changes a firm can use temporary cover for an unexpected vacancy while it submits an application within 12 weeks.

A Note for Insurance Brokers

Small general insurance brokers are among the firms most likely to benefit from an outsourced compliance officer. They usually need an experienced SMF16 but rarely a full-time one, and most don’t need an MLRO because they are outside the Money Laundering Regulations. For brokers, the outsourced individual should have direct experience of insurance conduct rules, client money and insurer relationships. See SMF Capital’s guide to the compliance officer role at insurance brokers and MGAs.

Final Thoughts

An outsourced compliance officer and a compliance consultancy solve different problems. The first gives you an accountable Senior Manager; the second gives you capacity and expertise. Be clear which you are buying, make sure someone with the right experience holds the SMF16 role, and document who does what. The FCA’s pages on the Senior Managers and Certification Regime and its SYSC 8 outsourcing rules are the starting points for any firm reviewing its arrangements.