Your CRO has resigned: how the 12-week rule works after PS12/26

When a chief risk officer resigns, a UK bank can put someone into the Chief Risk function (SMF4) without regulatory approval for less than 12 weeks in any consecutive 12-month period, provided the absence was temporary or reasonably unforeseen.

Since 24 April 2026, under the PRA’s PS12/26, that cover no longer stops at 12 weeks: if the firm submits a valid and complete application inside the window, the interim holder can stay until the application is finally determined.

What does the 12-week rule allow?

It lets a firm appoint a stand-in for an absent senior manager without PRA approval, for less than 12 weeks in a consecutive 12-month period. The absence must be temporary or reasonably unforeseen.

The rule sits at rules 2.3 to 2.3B of the PRA’s Senior Management Functions Part, not the Applications and Notifications Part. Rule 2.3A confirms that absence includes the approved person “ceasing to perform their PRA senior management function”, so a resignation counts.

Skipping approval does not skip accountability. PS12/26 applies the Senior Manager Conduct Rules to anyone performing an SMF role, even on an interim basis, and SS28/15 paragraph 5.4 says the employee “is held to the same standards as a permanent Senior Manager”. Boards often brief an interim as a caretaker. The rules draw no such line.

What changed on 24 April 2026 under PS12/26?

The 12 weeks now have to cover finding a candidate and submitting a complete application, not the regulator’s decision as well. PS12/26 was published on 22 April 2026 and took effect on 24 April 2026.

Previously, submission, review and determination all had to fit inside 12 weeks. Rule 2.3B, which applies where the absence is reasonably unforeseen, now says that where the firm makes “a valid and complete application for the approval” before the period expires, the period “is extended until that application is finally determined”: withdrawn, granted, the time for a tribunal reference run out, or tribunal proceedings concluded. The FCA’s companion statement, PS26/6, took effect the same day.

The PRA refused to lengthen the window, saying “12 weeks should be sufficient time to identify an individual to apply for an SMF role, even if only on an interim basis”. The extension is also easy to lose. SS28/15 Table H says it falls away “if the second ‘permanent’ application was made more than 12 weeks after the temporary SMF holder is appointed”. That catches firms that file for the interim, then withdraw in month four when a permanent hire appears.

Which departures do not qualify?

Any departure the firm could reasonably have foreseen. PS12/26 says the rule “is not intended for vacancies that can be anticipated where arrangements for replacement can be started earlier”.

SS28/15 Table H permits use for parental leave on one month’s notice, sickness followed by resignation, someone who gives long notice but stops performing the SMF at once, and a person who leaves unexpectedly for performance reasons or to join a competitor. It rules out a retirement planned a year ahead (“The firm cannot rely on the rule as the departure was reasonably foreseeable.”), the expiry of a fixed-term contract, and five months’ notice of resignation. Paragraph 2.58C adds that the PRA does not expect frequent use and “will monitor firms’ use of the 12-week rule”.

For CROs it usually turns on garden leave. A CRO who resigns on long notice and keeps working is a foreseeable vacancy; the search should start the day the letter arrives. One who stops performing the function immediately sits in the permitted column. Expect the supervisor to ask which you had, and to compare it with your succession plan.

How long does the regulator have once the application is in?

Three months from receipt of a properly completed application, under section 61 FSMA. The clock stops when the regulator asks for further information and restarts when it arrives.

The FCA sets this out at SUP 10C.10.26G and 10C.10.28G. PS12/26 reports that the PRA’s median determination time fell to 28 days between December 2025 and February 2026. The government has announced legislation to cut the deadline to two months, which was not law on 29 September 2026. Clock stops are where the weeks go: a vague statement of responsibilities or an unexplained gap in references invites a question.

What sets the timetable for a new CRO’s application?

The firm’s own work before submission. An application is not valid and complete until four pieces are done.

• Fitness and propriety: under rule 2.1 of the PRA Fitness and Propriety Part, the firm must be satisfied the candidate is fit and proper before it applies.
• Regulatory references: six years, from all relevant former employers, with reasonable steps taken no later than one month before the end of the application period. The FCA’s four-week response window binds all firms.
• Criminal record check: obtained before applying and no older than six months at submission (previously three), with overseas checks where the candidate lived or worked abroad for a material time in the last six years.
• Statement of responsibilities: every SMF application needs one. SS28/15 notes the responsibility for financial information and regulatory reporting is often shared between SMF2 and SMF4, so the CFO’s statement may change too.

Overseas references and checks are usually the slowest items. The statement is usually drafted last, although SS28/15 paragraph 2.73 treats statements and responsibilities maps as “relevant evidence” if something later goes wrong.

What does a realistic timeline look like?

What should the board do in the first week?

Settle the route and start the paperwork that week.

• Minute why the departure was not reasonably foreseeable, against the Table H examples. If it was, the interim needs approval, which SS28/15 paragraph 2.9B says could be time-limited.
• Name the interim and tell them the Conduct Rules apply in full.
• Put the risk committee chair in charge: SS28/15 Table F gives SMF10 the job of overseeing “the integrity and independence of the firm’s risk function (including the CRO)”.
• Secure a handover while the departing CRO is reachable. SYSC 25.9 says it “should include judgement and opinion, not just facts and figures”.
• Decide whose name goes on the application and start references and checks that week. If it is a permanent hire, open the CRO search at once.

RiskTAE’s bench includes former CROs and heads of risk, former regulators, interim executives and model specialists, and we also search for risk committee chairs and NEDs. Terms are defined in our glossary.

Our interim chief risk officer service runs alongside the permanent search, and a smaller firm can make the longer-term appointment a fractional chief risk officer.

Questions readers ask

Can we use the rule if we asked the CRO to leave?

Yes, if the exit was unexpected: Table H lists leaving unexpectedly for performance reasons as permitted. Risk Control rule 3.5 says the head of the risk management function “must not be removed without prior approval of the management body”, so the board decision comes first.

Does earlier interim cover count against the 12 weeks?

On the rule’s wording, yes. The limit is less than 12 weeks “in a consecutive 12-month period”, so earlier cover within those 12 months reduces what is left.

What if the CRO is on long-term sick leave instead?

Temporary absence qualifies. Past 12 weeks, rule 6.1A of the Applications and Notifications Part requires notice to the PRA within seven business days of the end of the 12 weeks, and again on return. The interim would then need approval.

Will the three-month deadline become two months?

The government has said it will legislate for two months in a forthcoming Financial Services Bill. Until that passes, plan on three months plus any clock stops.

Sources: PRA Rulebook, Senior Management Functions Part (as at 29 September 2026); PRA PS12/26 (22 April 2026); PRA SS28/15 (April 2026 version); FCA PS26/6 (22 April 2026); PRA Rulebook, Applications and Notifications Part (as at 29 September 2026); PRA Rulebook, Fitness and Propriety Part (as at 29 September 2026); PRA Rulebook, Allocation of Responsibilities Part (as at 29 September 2026); PRA Rulebook, Risk Control Part (as at 29 September 2026); FCA SUP 10C.10 (release 24 April 2026); FCA SYSC 25.9 (release 1 January 2021). All accessed 29 September 2026.