How long does SMF4 approval take in 2026?

The legal limit is three months from the day the regulator receives a complete application. In practice the PRA is much faster: its median time to decide senior manager applications was 28 days between December 2025 and February 2026, down from 62 days a year earlier, and 98% of SMF applications in that period were decided within two months (PS12/26 paragraphs 2.19 and 3.7). For most chief risk officer appointments the regulator is no longer the slow part. The work the firm has to finish before it applies is.

Who approves a chief risk officer?

The PRA, with the FCA’s consent. The Chief Risk function, SMF4, is one of the senior management functions that need PRA pre-approval (SS28/15 paragraph 2.4 and Table A). The firm has to reach its own view first: it must not apply unless it is satisfied the candidate is fit and proper (Fitness and Propriety rule 2.1), judged on personal characteristics including good repute and integrity, competence, knowledge and experience, qualifications and training (rule 2.6). Every application goes in with a statement of responsibilities setting out what the person will be accountable for (Allocation of Responsibilities rule 2.1).

What is the legal deadline?

Three months from receipt of a properly completed application, under section 61 of FSMA. The FCA’s guidance sets out how the clock works: it stops on the day the regulator asks for more information and starts again when everything requested has arrived (SUP 10C.10.26G and 10C.10.28G), and an application that is incomplete when received takes longer (SUP 10C.10.27G). The PRA said in PS12/26 that it would update its own guidance on clock stops (paragraph 3.5).

The limit may shorten. PS12/26 records the government’s announcement that it would legislate to reduce the statutory period to two months. Until that legislation is in force, three months is the limit.

How long does approval take in practice?

The PRA publishes its performance for senior manager applications as a whole, not for SMF4 alone, and each figure belongs to a specific period.

The FCA set itself a tighter target in July 2025 for the applications it decides, at least half within 35 days; for PRA functions such as SMF4 the PRA’s target is at least half within 45 days. A median is a midpoint, so roughly half of the PRA’s cases took 28 days or more. In our searches, the applications that run long are usually the ones that went in with something missing.

What has to happen before the application goes in?

This is where the time goes. Four pieces of work sit between an accepted offer and a complete application.

• Regulatory references. The firm must take reasonable steps to obtain references covering the past six years from all relevant former employers (Fitness and Propriety rule 2.7; SS28/15 paragraphs 6.4 and 6.5). The PRA sets no response time of its own. The FCA expects references normally to be given within four weeks (SYSC 22.5.17G), and because that applies to all firms, the PRA says the two regimes will align in practice (PS12/26 paragraphs 2.77 and 2.79).
• A criminal record check, with the candidate’s consent, including overseas checks where the candidate has lived or worked outside the UK for a material time in the previous six years (Fitness and Propriety rule 2.9). Since PS12/26 the PRA accepts a check carried out up to six months before submission, up from three (paragraphs 2.80 and 2.85).
• The firm’s own fitness and propriety assessment, documented against rule 2.6.
• The statement of responsibilities, agreed with the candidate.

References are the usual bottleneck. A firm that cannot get them all before applying can still apply, explaining why, confirming it is satisfied the candidate is fit and proper and listing the evidence it relied on. The PRA will then treat the application as incomplete and will not approve the candidate, conditionally or unconditionally, until the firm confirms it has every reference it needs (SS28/15 paragraphs 6.20 to 6.23). Outside market-sensitive cases, the firm has to obtain and consider them no later than one month before the application is due to be determined (paragraph 6.22).

What slows an application down?

• Missing references, for the reason above.
• Requests for further information, which stop the clock until the answers arrive.
• Market-sensitive appointments. Where asking for references would trigger a market-sensitive notification, the firm can apply first, but the references must be in before the PRA approves (SS28/15 paragraph 6.21).
• Overseas careers, which add overseas criminal record checks. Since April 2026 the PRA’s assessment takes account of approvals the candidate has held in other jurisdictions and senior manager experience at other firms (PS12/26 paragraphs 2.16 and 2.21), which helps international candidates once the paperwork is complete.

Can a new CRO start before approval?

They can join the firm, but they cannot perform the Chief Risk function until approved. Where the previous CRO left unexpectedly, the 12-week rule lets someone else cover the function while the application goes in (Senior Management Functions rules 2.3 and 2.3B); a departure the firm could see coming does not qualify. How the 12-week rule works sets out the conditions.

How should a firm plan the timeline?

• Start the references and the criminal record check the day the offer is accepted. A check now stays valid for six months, so starting early costs nothing.
• Draft the statement of responsibilities alongside the offer letter, so the role the candidate accepts is the role the regulator approves.
• Submit when the application is complete. An application missing references is processed but cannot be approved.
• Plan for the median and budget for the limit: about a month on the PRA’s recent figures, and three months of regulator time once the application is complete, plus any time the clock is stopped for information requests.
• If the previous CRO has already gone, arrange interim cover first and run the permanent search alongside it.

For most external hires, the candidate’s notice period now sets the start date, not the regulator. If you are hiring, our chief risk officer search and interim CRO pages set out how we run both, and our white paper on hiring a chief risk officer covers the process from brief to approval. For the role itself, see what a chief risk officer does. Terms are defined in our glossary.

Questions readers ask

Does the FCA have to approve a chief risk officer as well?

SMF4 is pre-approved by the PRA with the FCA’s consent (SS28/15 paragraph 2.4), so both regulators are involved in one decision.

How long is a criminal record check valid for an SMF application?

Up to six months old at the date the firm submits the application. The PRA adopted the six-month period in PS12/26 (paragraphs 2.80 and 2.85), and firms that prefer to keep using a three-month check may do so (paragraph 1.15).

Will the deadline fall to two months?

The government has announced it will legislate to cut the statutory period to two months (PS12/26, footnote to paragraph 2.4). Until that is in force the limit is three months, though the PRA already decided 98% of SMF applications within two months between December 2025 and February 2026.

Does an internal promotion to CRO need approval?

Yes. Approval is for the function, so an employee moving into SMF4 needs it as an external hire would. Where the person already holds an SMF in the same group, the new role begins within a month of the old one and the new firm has access to the information the earlier check produced, no new criminal record check is needed (Fitness and Propriety rules 2.10 and 2.11; PS12/26 paragraph 2.86).

Sources: PRA PS12/26, Review of the SM&CR: Phase 1 (22 April 2026), paragraphs 1.15, 2.4 (footnote), 2.16, 2.19, 2.21, 2.77, 2.79, 2.80, 2.85, 2.86, 3.5, 3.7 and 3.8; PRA SS28/15 (April 2026 version), paragraphs 2.4, 6.4, 6.5 and 6.20 to 6.23, Tables A and H; PRA Rulebook, Fitness and Propriety Part, rules 2.1, 2.6, 2.7 and 2.9 to 2.11; PRA Rulebook, Senior Management Functions Part, rules 2.3 and 2.3B; PRA Rulebook, Allocation of Responsibilities Part, rule 2.1; FCA Handbook SUP 10C.10, 10C.10.26G to 10C.10.28G; FCA Handbook SYSC 22.5, 22.5.17G; FCA, FCA sets faster targets for authorisations (15 July 2025). Accessed 29 September and 1 October 2026.