Insurers carry Section 250 exposure across underwriting, claims and operations, and the sector adds two complications most guides skip. SM&CR reaches insurers through a PRA and FCA framework with insurance-specific functions, and the Lloyd's market layers managing agents and syndicates on top. Here is how the s.250(3) test plays out in both.
How does Section 250 apply to dual-regulated insurers?
Section 250 of the Crime and Policing Act 2026 took effect on 29 June 2026, and it reaches insurers exactly as it reaches any other body corporate. Where a senior manager commits an offence within the actual or apparent scope of their authority, the firm commits it too. That covers any criminal offence under the law of England and Wales, Scotland or Northern Ireland, not only offences created by the Act itself.
Most insurers answer to two regulators. The Prudential Regulation Authority (PRA) supervises capital and solvency; the Financial Conduct Authority (FCA) supervises conduct. The attribution rule in s.250(1) and the functional test in s.250(3) cut straight across that split. It does not matter which regulator owns which part of the business.
This is general information, not legal advice. Consult a qualified solicitor or FCA-regulated compliance adviser for your firm's situation.
The hard part for insurers is not the test. It is the regulatory architecture around it. The accountability regime for insurance senior managers, the prudential regime, and the Lloyd's layer of managing agents and syndicates all shape where authority over a substantial part of the business actually sits. Take each in turn.
How do SM&CR for insurers and Solvency UK relate to s.250(3)?
Insurers sit under the Senior Managers and Certification Regime (SM&CR). This is widely misstated, so it is worth pinning down. SM&CR was extended to insurers, replacing the earlier Senior Insurance Managers Regime (SIMR). The SIMR terminology was renamed to SM&CR and Senior Management Functions (SMFs). An insurer today runs an SM&CR baseline with insurance-specific SMFs designated by the PRA and FCA, not a separate SIMR regime in parallel.
SM&CR has three parts. The Senior Managers Regime covers people holding a Senior Management Function, who need FCA approval before they act. The Certification Regime covers staff in roles that could cause significant harm, certified by the firm each year rather than pre-approved by the regulator. Conduct Rules staff covers almost everyone else, with limited carve-outs for ancillary roles.
Solvency UK, the post-Brexit successor to Solvency II, governs capital and governance. It is not the senior-manager accountability regime. SM&CR is. For Section 250 the relationship is the familiar one: SM&CR designations tell you who is already approved, and you apply s.250(3) across the wider population to find who manages a substantial part of the activities without holding an SMF.
One more distinction matters here. The SM&CR Duty of Responsibility in FSMA s.66B is enforced through regulatory sanctions such as fines, prohibitions and withdrawal of approval, not through criminal prosecution. Section 250 is the new criminal exposure, and it does not track the SMF list.
When does underwriting authority meet the functional test?
Underwriting is the core activity of most insurers, so the people who direct it are obvious Section 250 candidates. A chief underwriting officer, or the head of a major class of business, exercises authority over how a substantial part of the firm's risk-taking is organised. That is precisely what s.250(3) describes: an individual who plays a significant role in the managing or organising of a substantial part of the firm's activities. Where these roles are designated SMFs, they are SM&CR-covered and in s.250 scope.
The gap sits below that level. A senior underwriter or class underwriter who, in practice, sets appetite and binds the firm for a substantial line of business may hold real authority without an SMF. The assessment turns on scale: the size of the book the underwriter controls, and whether they decide or merely execute. Record the verdict individual by individual.
When do claims and operations heads qualify?
Claims handling is where an insurer meets its policyholders, and where a substantial part of its activity and conduct risk actually sits. The head of claims, and the heads of major operational functions, can be managing a substantial part of the firm even where no specific SMF attaches to the role. An operations head running policy administration, a head of claims for a large book: each can meet s.250(3) on the operational scale they direct.
The discipline is the same as everywhere else. Title is not the question. The question is whether the person plays a significant role in a substantial part of the firm's activities. For a claims or operations function handling a large share of the business, the answer is often yes.
How does the Lloyd's market complicate the attribution question?
The Lloyd's market adds a layer no other part of the sector has. Syndicates are run by managing agents, which are themselves authorised firms. Capital comes from members. An individual may carry authority across more than one entity. Section 250 applies to each body corporate, so the question has to be asked at the level of each one: the managing agent, and any corporate member or service company in the structure.
Take the person who leads underwriting for a syndicate. They are employed by the managing agent and exercise authority over a substantial part of that managing agent's activities, which makes them a strong candidate to be a senior manager of the managing agent under s.250(3). Where the same individual appears to act for, or is held out by, another entity in the structure, the apparent-authority limb of s.250(1) comes into play. The governance complexity of Lloyd's is exactly why you need an entity-by-entity functional analysis here, not a single firm-wide list.
How do you run the gap analysis at an insurance firm?
Start with the baseline. Pull the SM&CR picture from the FCA register and the firm's records of PRA-approved functions. Then apply the s.250(3) test to the wider population: the underwriters, claims leaders and operations heads who run substantial parts of the business without an SMF. For Lloyd's participants, run it entity by entity across the managing agent and any associated corporate members or service companies.
For each individual, record the verdict, the reasoning (which book, which function, what authority), and a confidence level of High, Medium or Low. From there the workflow is the same one any firm follows: gap analysis, then a declaration cycle to the people you identify, then an evidence pack that captures the whole exercise.
The specific trap for insurers is assuming the SM&CR designations or the Solvency UK governance map answer the s.250 question. They tell you who the regulators approved. The functional test tells you who actually manages a substantial part of the firm, which at an insurer is usually a longer list.
Related articles
Ready to identify your Section 250 exposure?
Import your SM&CR register, run your gap analysis, and download a PDF/A-3B evidence pack. First analysis is free.
Start Free Gap Analysis →Sources
- Crime and Policing Act 2026, s.250www.legislation.gov.uk/ukpga/2026/20/section/250
- FCA — Senior Managers and Certification Regime (insurers)www.fca.org.uk/firms/senior-managers-certification-regime/insurers
- Bank of England (PRA) — Strengthening accountabilitywww.bankofengland.co.uk/prudential-regulation/key-initiatives/strengthening-accountability
- FCA Registerregister.fca.org.uk/