Insights · Tools
A new chief risk officer cannot act as SMF4 until the PRA, with the FCA’s consent, approves them. The legal limit is three months from a complete application, but the PRA’s median for senior manager cases was 28 days between December 2025 and February 2026 (PS12/26), so for most external hires the notice period now sets the start date.
Enter the offer date, the notice period and how long the references will take. The planner gives the date the new CRO could act as SMF4, on the PRA’s median and at the legal limit, and shows any gap after the current CRO leaves.
Tool
The defaults follow the rules and the PRA’s published figures: four weeks for references, the time the FCA expects a reference to take, and 28 days for the decision. Change them to fit your case.
Method
It starts on the day the offer is accepted. References and the rest of the application run side by side, and the application goes in when both are done. An application missing a reference can be submitted, but the PRA will not approve the candidate until the firm confirms it has every reference it needs (SS28/15, paragraphs 6.20 to 6.23).
It then gives three decision dates: 28 days, the PRA’s median for senior manager cases between December 2025 and February 2026; two months, the target the PRA met for 98% of SMF applications in that period; and three months, the statutory limit under section 61 of FSMA. Any allowance for information requests is added to each, because a request stops the clock until the answers arrive (SUP 10C.10.26G).
The new CRO can act as SMF4 from the later of the decision and the day they are free to join. If the previous CRO left unexpectedly, the planner also checks that the application goes in while interim cover without approval is still available (Senior Management Functions rules 2.3 and 2.3B). Our article on how long SMF4 approval takes covers the detail.
Sources: PRA PS12/26 (22 April 2026), paragraphs 2.19, 2.80, 2.85, 3.7 and 3.8; SS28/15 (April 2026), paragraphs 2.4 and 6.20 to 6.23, Table H; PRA Rulebook, Senior Management Functions Part, rules 2.3 and 2.3B, and Fitness and Propriety Part, rules 2.7 and 2.9 to 2.11; FCA Handbook SUP 10C.10 and SYSC 22.5.17G.
FAQ
The legal limit is three months from receipt of a complete application. Between December 2025 and February 2026 the PRA’s median for senior manager cases was 28 days, and it decided 98% of SMF applications within two months (PS12/26, paragraphs 2.19 and 3.7).
They can join the firm but cannot perform the Chief Risk function until approved. Where the previous CRO’s absence is temporary or reasonably unforeseen, someone can cover for less than 12 weeks in a consecutive 12-month period without approval (Senior Management Functions rule 2.3).
Up to six months at the date the firm submits the application, since PS12/26 (paragraphs 2.80 and 2.85). Firms that prefer to keep using a three-month check may do so.
Insights
A UK bank hiring a senior manager, a certification function holder or a notified non-executive director must request regulatory references covering the candidate’s previous six years from every relevant former employer, and must normally hold them...
By Benn Pople · 8 min readA board's guide to hiring a chief risk officer in the UK: the brief, the search, the assessment, SMF4 approval and the first 100 days in post.
RiskTAEWhen a chief risk officer resigns, a UK bank can put someone into the Chief Risk function (SMF4) without regulatory approval for less than 12 weeks in any consecutive 12-month period, provided the absence was temporary...
By Benn Pople · 7 min readNext step
Tell us when your CRO is leaving and how fast you need cover. In 30 minutes we will set out the search, the interim options and the approval timeline for your case. See our chief risk officer search and interim CRO pages.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.