In a UK bank the chair of the risk committee holds a senior management function of their own, SMF10, and needs regulatory approval before taking up the role. The PRA requires a risk committee, and so an SMF10, in firms it classes as significant; the chair must not perform any executive function, and the PRA looks at that person first if the committee fails to advise the board on risk appetite. The appointment therefore runs to the regulator’s timetable as well as the board’s.
When does a bank need an SMF10?
When it is significant. Rule 3.1(1) of the PRA Rulebook’s Risk Control Part says a significant firm “must establish a risk committee composed of members of the management body who do not perform any executive function”, and SS28/15 Table B lists the Chair of the Risk Committee function as required for firms “classed as ‘significant’ CRR firms”. The function itself, at rule 4.3 of the Senior Management Functions Part, covers “chairing, and overseeing the performance of any committee responsible for the oversight of the risk management systems, policies and procedures of a firm”.
The committee’s job is set out in the same Part. It advises the board on the firm’s “overall current and future risk appetite” and helps oversee the risk strategy (rule 3.1), checks whether the pricing of assets and liabilities reflects the business model and risk strategy (rule 3.1), examines whether the remuneration system takes risk into account (rule 3.3), and must have adequate access to information on the firm’s risk profile (rule 3.2).
What is the risk committee chair accountable for?
The committee’s work and the independence of the risk function. SS28/15 Table F gives the Chair of the Risk Committee two inherent responsibilities: “Chairing and overseeing the performance of the Risk Committee” and “Ensuring and overseeing the integrity and independence of the firm’s risk function (including the CRO).” SS5/16 paragraph 4.3 says the same of risk and audit committee chairs, who are “deemed responsible for safeguarding the independence, and overseeing the performance” of the executive risk and audit functions, “including the chief risk officer and head of internal audit”.
The prescribed responsibility for safeguarding the independence of the risk function (PR L, Allocation of Responsibilities 4.1(17)) must go to a non-executive oversight function (rule 3.2), and SS28/15 expects each prescribed responsibility to sit with the senior manager it is most closely linked to (paragraph 2.26). Where a bank has a risk committee, that is its chair.
The accountability is real but it is not executive. SS28/15 says non-executives in scope “are neither required nor expected to assume executive responsibilities” (paragraph 2.29). Its worked examples in Table G say that where a risk committee fails to advise the board on risk appetite, the PRA “might primarily consider whether there could be grounds to sanction the Chair of the Risk Committee”, while a capital breach after repeated limit breaches points first at executives, including the chief risk officer.
What should a nomination committee look for?
Someone who can hold the chief risk officer to account on the substance, and who has the time to do it. The Rulebook asks for committee members with “appropriate knowledge, skills and expertise to fully understand and monitor the risk strategy and the risk appetite” (Risk Control 3.1(1)). SS5/16 asks for “sufficient current and relevant knowledge and experience, including sector experience” (paragraph 7.1), and SS28/15 expects chairs to commit “a significantly larger proportion of their time to their functions than other NEDs” (paragraph 2.33).
In practice we test candidates on five things.
- Risk appetite. Can they take the firm’s risk appetite statement apart, metric by metric, and say which limits would actually stop the business doing something?
- Capital and liquidity. Can they read an ICAAP and an ILAAP and find the assumption that matters? From 1 January 2027 that means reading them on a Basel 3.1 basis.
- Stress. Have they been in the room when something went wrong, whether a market stress, a failed product or a section 166 review, and what did they do?
- The relationship with the CRO. Can they support a chief risk officer against executive pressure without becoming a second executive?
- Conflicts and capacity. What else do they chair, and will the diary survive a bad quarter?
The best-qualified candidates have usually run a risk function themselves, as chief risk officer or head of a major risk discipline, or supervised banks. For listed firms, independence is also judged against the UK Corporate Governance Code, under which a director who has served on the board for more than nine years may not be independent (Provision 10).
How does the regulatory approval work?
The firm does most of the work before it applies. It must be satisfied the candidate is fit and proper first (PRA Fitness and Propriety 2.1), looking at personal characteristics, competence, knowledge and experience, qualifications and training (rule 2.6). Then three pieces have to be in place for the application to be complete.
- Regulatory references covering the past six years, with reasonable steps taken no later than one month before the end of the application period (Fitness and Propriety 2.7). The FCA’s four-week window for providing references binds all firms (PS12/26 paragraph 2.79).
- A criminal record check no older than six months when the application goes in, with overseas checks where the candidate lived or worked abroad for a material time in the last six years (FCA SUP 10C.10.16R; Fitness and Propriety 2.9).
- A statement of responsibilities, which must accompany every application (Allocation of Responsibilities 2.1).
The management responsibilities map has to be brought up to date as well, so it shows where the new role sits (Allocation of Responsibilities 7.1).
The regulators then have three months from a properly completed application, with the clock stopping when they ask for more information (FCA SUP 10C.10.26G and 10C.10.28G). In practice the PRA has been much quicker: its median determination time fell to 28 days between December 2025 and February 2026, and 98% of applications in that period were decided within two months (PS12/26 paragraphs 2.19 and 3.7). The government has announced legislation to cut the statutory deadline to two months, which was not law on 1 October 2026.
What if the current chair leaves without warning?
Another non-executive can usually cover without approval while the application for a successor is made, where the departure was unforeseen (Senior Management Functions rules 2.3 and 2.3B). A planned retirement does not qualify, and SS5/16 paragraph 10.2 expects boards to keep succession plans for exactly this case.
How long should the whole appointment take?
| Stage | Typical time | What decides it |
|---|---|---|
| Brief, prescribed responsibilities and draft statement of responsibilities agreed by the board | Two weeks | Whether the chair, the CRO and the company secretary agree what the role owns |
| Search, assessment and shortlist | Six to eight weeks | How narrow the brief is and how many candidates are conflicted |
| Interviews, including with the chair, the CRO and the audit committee chair | Three to four weeks | Diary access for sitting non-executives |
| Fitness and propriety, references and criminal record check | Two to six weeks, often alongside interviews | Overseas references and checks |
| Regulatory determination | About a month on recent PRA figures; three months at most, plus any clock stops | The completeness of the application |
Four to six months from brief to first meeting is a realistic plan. The avoidable delay is a statement of responsibilities left until after the offer, when it should have been drafted with the brief.
Stages in appointing a risk committee chair
- Board agrees the briefTwo weeks. Brief, prescribed responsibilities and draft statement of responsibilities agreed by the board.
- Search, assessment and shortlistSix to eight weeks, depending on how narrow the brief is and how many candidates are conflicted.
- InterviewsThree to four weeks, including the chair, the CRO and the audit committee chair; diary access decides it.
- Fitness and propriety checksTwo to six weeks, often alongside interviews; references and criminal record check, slowed by overseas checks.
- Regulatory determinationAbout a month on recent PRA figures; three months at most, plus any clock stops.
Our risk committee chair and NED search practice runs these appointments, and our chief risk officer search covers the executive the chair will oversee. For the board’s own preparation see our board risk training, and for the framework the committee will own, our work on risk appetite frameworks. Terms are defined in our glossary.
Questions readers ask
Does every bank need a risk committee chair approved as SMF10?
No. The PRA requires a risk committee, and so an SMF10, in firms it classes as significant (Risk Control 3.1; SS28/15 Table B).
Can the risk committee chair be an executive?
No. The committee is made up of members of the management body who do not perform any executive function, and SS28/15 Table E repeats that the chair “must not perform any executive function in the firm”.
How long does PRA approval take?
Up to three months from a properly completed application, plus any clock stops. The PRA’s median was 28 days between December 2025 and February 2026 (PS12/26 paragraph 2.19).
Is the chair personally liable if the committee gets it wrong?
The chair is a senior manager, so the duty of responsibility applies, and the PRA would have to show the chair failed to take the steps someone in that position could reasonably be expected to take (SS28/15 paragraphs 2.62 and 2.68). Its examples point at the chair where the committee fails to advise on risk appetite, and at executives for failures of day-to-day control (Table G).
Sources: PRA Rulebook, Risk Control Part, rules 3.1 to 3.3; PRA Rulebook, Senior Management Functions Part, rules 2.3, 2.3B and 4.3; PRA Rulebook, Allocation of Responsibilities Part, rules 2.1, 3.2, 4.1(17) and 7.1; PRA Rulebook, Fitness and Propriety Part, rules 2.1, 2.6, 2.7 and 2.9; PRA SS28/15 (April 2026 version), paragraphs 2.26, 2.29, 2.33, 2.62 and 2.68 and Tables B, E, F, G and H; PRA SS5/16 (July 2018 version), paragraphs 4.3, 7.1 and 10.2; PRA PS12/26 (22 April 2026), paragraphs 2.19, 2.79 and 3.7; FCA SUP 10C.10; FRC UK Corporate Governance Code 2024, Provision 10. Accessed 29 September 2026.
How we research and check our articles: our editorial policy.