Key Function Holders: What Regulators Check Before Approving a Hire
Last updated: 10 November 2026
Key takeaways
- Many regulators approve the people in key roles, not only the firm, so the hire is part of the licence file.
- The MFSA assesses four criteria: competence, reputation, conflicts of interest and independence of mind, and time commitment.
- The FCA expects firms to show how they satisfied themselves a candidate is fit and proper before applying, including regulatory references going back 6 years.
- VARA requires two Responsible Individuals who are full-time, fit and proper, resident in the UAE or UAE passport holders, and approved during licensing.
- Approval delays become launch delays, so screen candidates against the regulator's criteria before you interview them.
Key function holder approval is the step where a regulator looks at the person you want to hire and decides whether they can hold the role. If you are hiring for compliance, AML, risk or a senior management position in a regulated fintech, crypto or iGaming firm, the regulator will read the candidate's CV, check their history and may interview them. The question for you is not only "is this the best candidate?" but "will this candidate be approved?".
This guide explains what regulators typically assess, how the UK, Malta and Dubai handle it, and how to choose candidates who will pass.
What "key function holder" means
Regulators use different names for the same idea: a role important enough that the person in it is assessed individually.
- UK (FCA). Senior management functions under the Senior Managers and Certification Regime, such as compliance oversight (SMF16) and money laundering reporting (SMF17).
- Malta (MFSA). Persons proposed for roles that require MFSA approval complete a Personal Questionnaire (PQ), and the MFSA assesses their fitness and properness.
- Malta (MGA). Key functions for gaming licensees, such as compliance, AML/CFT, legal affairs and technology, each requiring prior approval and a key function certificate.
- Dubai (VARA). Two Responsible Individuals per VASP, plus other roles such as the Compliance Officer and MLRO, which must be fit and proper.
- EU banks and investment firms. The joint EBA and ESMA guidelines on the suitability of members of the management body and key function holders, which apply from 31 December 2021. The two authorities consulted on a revised version in 2026.
What regulators assess
The MFSA's guidance to the Personal Questionnaire sets out four criteria that most regulators use in some form:
The MGA describes its fitness and propriety assessment in similar terms: primarily integrity, honesty and reputation, and competence and capability.
How key function holder approval works in practice
The firm assesses first. The FCA says firms should be in a position to evidence how they satisfied themselves that a candidate is fit and proper before they apply. The MFSA goes further: a firm must not lodge an application if it has reasonable grounds to believe the applicant is not fit and proper, and it must submit its own assessment. That assessment covers the candidate's competence for the specific role, their good repute, any conflicts of interest and how they will be managed, the weekly time commitment, support arrangements and an organisation chart.
References and background checks. For senior management function applicants, the FCA requires regulatory references going back 6 years and, unless an exemption applies, a criminal records check. Where the candidate has lived or worked in another country, the FCA says firms should obtain foreign records checks too.
The regulator's own review. Regulators read the forms, run their own checks and may interview the candidate. The MGA, for example, interviews applicant MLROs together with the FIAU. For the MLRO role specifically, see How to Hire an MLRO for a Crypto or Fintech Company.
Ongoing, not one-off. Approval is not permanent. The FCA requires firms to assess senior managers' fitness and propriety at least annually. VARA requires VASPs to validate every year that their Responsible Individuals still meet the requirements, and to seek approval before changing them.
Dubai: Responsible Individuals
VARA's Company Rulebook requires each VASP to appoint two individuals of sufficient seniority who are responsible for its compliance with all legal and regulatory obligations. Each Responsible Individual must be a full-time employee of the VASP, a fit and proper person, resident in the UAE or a UAE passport holder, and notified to and approved by VARA during the licensing process.
That last point matters for planning. If one of your two Responsible Individuals is not yet hired, or does not meet the residence condition, the licence application is incomplete. A candidate who would need to relocate should have a realistic timeline for residence before you rely on them in the application.
Why approval delays become launch delays
When a role must be approved before the firm is licensed, or before the person can start, the approval sits on the critical path. Regulators also expect key people to be involved early: the FCA, for example, expects a crypto applicant's MLRO to be heavily involved in preparing the registration application. Common causes of delay:
- A candidate whose experience does not match the business model, which leads to questions or a refusal.
- Gaps or inconsistencies between the CV, the questionnaire and the references.
- Undisclosed or poorly explained past issues, such as a dismissal or an investigation.
- Too many other appointments for the regulator to accept the time commitment.
- Combined roles that the regulator considers conflicting. For when one person can hold two compliance roles, see Compliance Officer vs MLRO: Do You Need Both?.
How to screen candidates before the interview stage
Use the regulator's criteria as your first filter, before you invest time in interviews:
- Match experience to the role and the business. A Head of Compliance for a crypto exchange needs crypto-relevant experience, not only seniority. See Hiring a Head of Compliance for a Crypto Company Applying for a Licence.
- Ask the reputation questions early. Ask candidates directly about investigations, proceedings, dismissals and regulatory findings, and how they would explain them on the form.
- List every other appointment. Directorships, advisory roles and consultancy work, with the time each takes.
- Check location against the rules. Residence and full-time conditions can rule out an otherwise strong candidate.
- Take references that a regulator would take. Ask previous employers what the candidate personally owned and whether they would rehire them.
What we recommend
- List which roles in your structure need regulator approval, and under which regime, before you open the searches.
- Write each job description around the regulator's criteria: competence for your business, reputation, conflicts and time.
- Screen for those criteria before the first interview, not after the offer.
- Prepare your own fitness and propriety assessment for each candidate, as the FCA and MFSA expect.
- Build the approval time into your launch plan and start the search early.
The bottom line
Key function holder approval turns a hire into a regulatory decision: the regulator checks competence, reputation, conflicts and time, and your launch can wait on the answer. Choose candidates whose record will survive that review. Hirexel recruits key function holders for fintech, crypto, blockchain and iGaming firms and pre-screens candidates against fit and proper criteria before the interview stage.
Sources
- FCA, Senior Managers Regime: https://www.fca.org.uk/firms/senior-managers-and-certification-regime/senior-managers-regime
- MFSA, Guidelines to the Personal Questionnaire: https://www.mfsa.mt/wp-content/uploads/2019/02/MFSA_PQ_Guidelines_FINAL.pdf
- Malta Gaming Authority, Key Functions: https://www.mga.org.mt/licensee-hub/key-function/
- VARA, Company Rulebook: https://rulebooks.vara.ae/entiresection/122
- EBA, Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders: https://www.eba.europa.eu/eba-and-esma-publish-final-guidance-fit-and-proper-requirements
- FCA, Cryptoassets: what we expect to see in your application for registration: https://www.fca.org.uk/firms/cryptoassets/application-registration
