SMF4 approval timeline planner
Plan when a new chief risk officer can act as SMF4: notice, references, the PRA's decision times and the three-month limit.
RiskTAEInsights · White paper
Hiring a chief risk officer in the UK: a guide for boards
Hiring a chief risk officer in a UK bank or building society means appointing the person who will hold the PRA’s Chief Risk function, SMF4, which they may only perform once the regulator has approved them. The board owns the hire: it sets the brief, assesses the candidates, stands behind the application and plans for the three months the regulator has to decide once the application is complete.
Two sets of dates drive the timetable: the three months the regulator has once the application is complete, and the work before it, because every application needs regulatory references covering six years and a criminal record check no older than six months. This guide covers the brief, the search, the assessment, SMF4 approval and the first 100 days in post.
SMF4The PRA’s Chief Risk function
24 April 2026PS12/26 changes to senior manager approvals take effect
3 monthsStatutory period for the regulator to decide
6 yearsPeriod a regulatory reference covers
The role
What exactly is the board hiring when it hires a CRO?
The board is hiring the holder of SMF4: the person with responsibility for the overall management of the firm’s risk controls, including the setting and managing of its risk exposures, who reports directly to the governing body.
The Risk Control Part adds the conditions that shape the hire. The risk management function must be independent of the operational functions, with enough authority, stature, resources and access to the board. Its head must be an independent senior manager with distinct responsibility for the function, able to go directly to the board where necessary, and cannot be removed without the board’s prior approval. The PRA requires the Chief Risk function at banks and building societies where proportionate; where a firm’s activities do not justify a dedicated appointment, another senior person may fulfil the function if there is no conflict of interest.
The CRO does not hold the role alone. The chair of the risk committee is responsible for safeguarding the independence of the risk function and overseeing its performance, the CRO included, and the prescribed responsibility for the production and integrity of financial information and regulatory reporting is often shared between the chief finance function and the CRO.
In our searches, the question senior candidates ask first is who they report to in practice. A dotted line to the chair of the risk committee that exists only on the organisation chart is spotted at first interview, and the strongest people withdraw.
Sources: PRA Rulebook, Senior Management Functions Part, rule 3.4; Risk Control Part, rules 3.4 and 3.5; PRA SS28/15, April 2026, paragraph 2.41 and Tables B, E and F; PRA SS5/16, paragraph 4.3.
Timing
When should the board start looking for a new CRO?
Start when you learn the CRO is leaving, or earlier if the succession plan has no credible name in it. The PRA expects an effective, up-to-date succession plan for each senior management function, and SS5/16 asks boards to keep succession plans that address the unexpected loss of key people, particularly in roles under the Senior Managers Regime.
A CRO who resigns will often be serving a notice period of several months. The board can use that time to run the search, and a firm that waits until the leaving date to start has spent it.
Sources: PRA SS28/15, April 2026, paragraph 2.58C; PRA SS5/16, paragraph 10.2.
The brief
What should go into the brief for a chief risk officer?
A CRO brief sets out four things in writing: the role, what success looks like at the end of the first year, the terms, and the timetable. For a CRO we add two documents the regulator will also read: the draft statement of responsibilities and the reporting line.
The statement of responsibilities goes to the PRA with the application and lists the prescribed responsibilities the person will hold. Candidates read it more closely than the job description, because it sets what they will answer for personally. Where the CRO will share a responsibility with the finance director, the brief should say so; the PRA allows responsibilities to be shared between senior managers but not split.
Scale changes the brief. A firm with gross total assets of £250 million or less is not expected to have many senior managers beyond the mandatory ones, so its CRO may carry every risk type with a small team. The capital rules change too: the PRA’s Basel 3.1 rules take effect on 1 January 2027, and eligible smaller firms may instead be in the SDDT capital regime from the same date. The brief should say which regime the firm is in, because it decides what the new CRO’s first ICAAP looks like. Our articles on what Basel 3.1 changes and whether to join the SDDT regime cover both.
A practitioner point: briefs written after a difficult period tend to describe the opposite of the last CRO. Write the brief from the business plan for the next three years and the risks in it.
Sources: PRA Rulebook, Allocation of Responsibilities Part, rules 2.1 to 2.4; PRA SS28/15, April 2026, paragraphs 2.7, 2.40 and 2.41; PRA PS1/26, 20 January 2026, paragraph 1.23; PRA PS4/26, 20 January 2026, paragraph 1.15.
The search
How does a retained CRO search run, and who does what?
Most CRO searches are retained and exclusive, with terms and fees agreed in writing before any work starts. A partner owns the search from the brief to the first day. The table shows how the work splits between the board, HR and the search firm.
| Stage | The board and its committees | HR or talent acquisition | The search firm |
|---|---|---|---|
| Brief | Agree the reporting line, the draft statement of responsibilities and what success looks like in the first year | Terms, grade, notice and relocation policy | A 30-minute call, then a written brief with the terms and timetable |
| Market map | Say which firms are out of bounds | Check internal candidates | Map the people who fit, most of whom are not looking, and approach them without naming the firm |
| Technical screen | No role at this stage | No role at this stage | Interview every candidate on the substance of the role before a CV reaches the client |
| Shortlist and interviews | The chair of the risk committee, the chief executive and the chair meet the shortlist | Schedule, feedback and assessment logistics | A written view of each person and feedback in both directions |
| Offer and approval | Satisfy itself the person is fit and proper; approve the application | Offer letter, references, criminal record check | Handle the offer and plan the start around the regulator’s approval |
| First months | Receive the new CRO’s first view of the risk profile | Onboarding | Stay close to client and hire through notice and the first months |
Confidentiality matters more for a CRO than for most roles, because the incumbent is often still in post. We approach candidates without naming the firm until they are interested; where the client asks, candidates sign a non-disclosure agreement before the firm is named, and a candidate’s details are never shared without their agreement.
In practice the market map for a CRO is short. Many credible candidates are sitting SMF holders who will only move for a clear mandate and a board they have met, which is why the chair of the risk committee should meet the shortlist rather than only the final candidate. Our chief risk officer search page sets out how we run these searches.
Sources: PRA SS5/16, paragraph 4.3; PRA Rulebook, Fitness and Propriety Part, rule 2.1; the search stages are RiskTAE’s own process.
Assessment
How should the board assess CRO candidates?
Assess candidates on the same four headings the firm must use before it applies: personal characteristics (including good repute and integrity), competence, knowledge and experience, qualifications, and training. The firm must not apply unless it is satisfied the person is fit and proper to perform the function.
| Heading (Fitness and Propriety 2.6) | What the board should see |
|---|---|
| Personal characteristics, including good repute and integrity | Regulatory references covering the previous six years, a criminal record check, and how the person has handled a disagreement with a chief executive |
| Competence, knowledge and experience | A walk through a capital or liquidity assessment the candidate owned, the numbers they changed and why |
| Qualifications | Relevant professional and academic qualifications, weighed against what the role needs |
| Training | What the person has done to keep current, for example on the Basel 3.1 rules in force from 1 January 2027 |
The PRA says there is no single right background for a senior manager, and since April 2026 its assessment takes account of approvals in other jurisdictions and senior management experience elsewhere. That widens the field to people who have held a CRO role outside the UK.
Every candidate we put forward has been interviewed on the technical substance of the role by people who have held these roles: former chief risk officers and heads of risk, former regulators and interim executives. The weakness we test hardest is scale. A head of one risk type at a large bank has run a deep team on a narrow brief; a CRO at a smaller firm writes the ICAAP, chairs the risk committee papers and answers the supervisor in person. Ask each candidate to walk the panel through a capital assessment they owned and the assumption they would change now.
Sources: PRA Rulebook, Fitness and Propriety Part, rules 2.1, 2.6, 2.7 and 2.9; PRA PS12/26, 22 April 2026, paragraphs 2.16 to 2.21.
Regulatory approval
How long does SMF4 approval take, and what goes in the application?
PS12/26 amendments take effect
Once the regulator has a properly completed application, it has three months to decide, and the clock stops each time it asks for further information. The PRA reports that its median determination time for senior manager cases fell from 62 days (December 2024 to February 2025) to 28 days (December 2025 to February 2026). Those figures describe a past period, and the board should plan on the statutory three months. The government has said it will legislate to cut the deadline to two months; that was not law on 29 September 2026.
| Item | Rule or expectation |
|---|---|
| The firm’s own fitness and propriety assessment | Completed before the firm applies |
| Regulatory references | Cover the previous six years and are sought from all relevant former employers, no later than one month before the end of the application period; the FCA’s four-week reply window binds all firms |
| Criminal record check | Obtained before the application and no older than six months when it is submitted |
| Statement of responsibilities | Accompanies every application for a PRA senior management function |
| The regulator’s decision | Three months from a properly completed application; the clock stops while the regulator waits for further information |
The work before the application usually takes longer than the regulator’s review. If a former employer is slow, the firm may apply without every reference, as long as it explains in the application why it could not obtain them. The FCA has also set a target to complete at least half of senior manager applications within 35 days.
The practitioner detail: request the references and the criminal record check the day the offer is accepted, not the day notice ends. A reference that surfaces an unconcluded internal investigation late in the process, which firms are now asked to consider disclosing, can stop an appointment that looked settled.
Sources: FCA Handbook, SUP 10C.10.16R, 10C.10.26G and 10C.10.28G; PRA PS12/26, 22 April 2026, paragraphs 2.4 (footnote), 2.19, 2.71 to 2.79 and 2.85; PRA Rulebook, Fitness and Propriety Part, rules 2.1, 2.7 and 2.9; Allocation of Responsibilities Part, rule 2.1; PRA SS28/15, April 2026, paragraphs 6.4, 6.5 and 6.22; FCA, FCA sets faster targets for authorisations, 15 July 2025.
Interim cover
What happens if the CRO leaves before a successor is approved?
Where the absence is temporary or reasonably unforeseen, someone can perform the Chief Risk function without approval for less than 12 weeks in a consecutive 12-month period, and since 24 April 2026 that cover continues while a valid and complete application made within the period is decided. A departure the firm could see coming does not qualify.
The interim holder is not a lesser appointment. The Senior Manager Conduct Rules apply to anyone performing an SMF, even without approval, and SS28/15 says they are held to the same standards as a permanent senior manager. An interim CRO can also write the handover that a departed CRO never did.
Our interim chief risk officer page explains how we run interim cover alongside the permanent search, and our article on the 12-week rule sets out the conditions.
Sources: PRA Rulebook, Senior Management Functions Part, rules 2.3, 2.3A and 2.3B; PRA PS12/26, 22 April 2026, paragraphs 2.3 to 2.11; PRA SS28/15, April 2026, paragraph 5.4.
In post
What should the new CRO’s first 100 days look like?
The first 100 days should give the board the new CRO’s own view of the risk profile, built from a proper handover and a read of the firm’s capital, liquidity and risk appetite documents. The 100-day frame is our practice, not a regulatory term; the handover is a rule.
The FCA’s handover rule requires the firm to take all reasonable steps to give a new senior manager the information and material they could reasonably expect to need. The FCA says it should be practical and helpful, not just a record, and should include judgement and opinion as well as facts and figures. Ask the outgoing CRO, or the interim, to write it before the new CRO starts.
The accountability starts on day one. Under the duty of responsibility, a senior manager can be found guilty of misconduct if the firm breaches a requirement in their area and they did not take reasonable steps to prevent it. The PRA must prove the case, will not apply hindsight, and treats statements of responsibilities and the management responsibilities map as relevant evidence. A new CRO who records what they found and what they did about it in the first weeks is building that record.
- Weeks 1 to 4: read the handover, the risk appetite statement, the last ICAAP and ILAAP and the latest risk committee papers; meet the chair of the risk committee alone.
- Weeks 5 to 10: test the risk appetite against the business plan; meet the supervisor; confirm the statement of responsibilities reflects the role as it really is. The PRA expects a revised statement no later than six months after a significant change in responsibilities.
- Weeks 11 to 14: take a written view to the board, including what the next ICAAP must change under Basel 3.1 or the SDDT regime. Our guide to what an ICAAP is sets out the starting point.
Sources: FCA Handbook, SYSC 25.9.4R, 25.9.5R and 25.9.7G; PRA SS28/15, April 2026, paragraphs 2.54, 2.59 to 2.62, 2.68, 2.73 and 2.76; PRA SS5/16, paragraphs 1.2 and 4.1.
Board checklist
What should the board do, step by step?
Ten steps, in the order they usually fall. Where a step rests on a rule or supervisory statement, the reference is given; the others are how we run these searches.
| Step | What the board does | Reference |
|---|---|---|
| 1 | Keep a current succession plan for the CRO, with a named interim option | SS5/16 10.2; SS28/15 2.58C |
| 2 | Agree who owns the hire: the chair, the chair of the risk committee and the chief executive, with HR running the process | SS5/16 4.3 |
| 3 | Settle the reporting line and draft the statement of responsibilities before anyone is approached | Risk Control 3.4 and 3.5; Allocation of Responsibilities 2.1 |
| 4 | Write the brief: the role, first-year success, the terms and the timetable | Our practice |
| 5 | If the CRO has already gone, arrange interim cover and start the application | Senior Management Functions 2.3 to 2.3B |
| 6 | Run the search, with a technical screen before any CV reaches the board | Our practice |
| 7 | Assess the shortlist on the fitness and propriety headings | Fitness and Propriety 2.1 and 2.6 |
| 8 | On acceptance, request regulatory references and start the criminal record check | Fitness and Propriety 2.7 and 2.9 |
| 9 | Submit a complete application and update the management responsibilities map | Allocation of Responsibilities 2.1 and 7.1 |
| 10 | Require a written handover and agree the first 100 days | SYSC 25.9 |
Step 9 is the one boards forget. The management responsibilities map must be a single, up-to-date document describing who is responsible for what, and a new CRO changes it.
Sources: PRA SS5/16; PRA SS28/15, April 2026; PRA Rulebook, Risk Control, Allocation of Responsibilities, Senior Management Functions and Fitness and Propriety Parts; FCA Handbook, SYSC 25.9.
Failure points
What usually goes wrong when a board hires a CRO?
Most failed CRO hires fail on process, not on the candidate. These are the points we see go wrong most often.
- The reporting line is settled after the offer. A candidate who finds out late that the CRO reports only to the finance director reads it as a statement about how the firm sees risk.
- The chair of the risk committee meets only the final candidate. The chair is responsible for safeguarding the risk function’s independence and should be part of the choice.
- References and the criminal record check start when notice ends. The statutory clock only starts with a properly completed application.
- The brief ignores the capital regime. A CRO who has only worked under internal models may be the wrong fit for a firm on standardised approaches from 1 January 2027, and the reverse is also true.
- Nobody writes the handover, and the new CRO spends the first quarter rebuilding what the last one knew.
Sources: PRA SS28/15, April 2026, Table F; FCA Handbook, SUP 10C.10.26G and SYSC 25.9; PRA PS1/26, 20 January 2026.
FAQ
Questions about hiring a chief risk officer
Can a new CRO start work before the PRA approves them?
Not in the Chief Risk function. A person may only perform a senior management function once the regulator has approved them, unless the previous holder’s absence was temporary or reasonably unforeseen, when someone can cover while the application is made. The board should plan the start date around the approval and use interim cover for any gap.
Does a small bank need a chief risk officer?
The PRA requires the Chief Risk function at banks and building societies where proportionate. Where the firm’s activities do not justify a dedicated appointment, another senior person may fulfil the function provided there is no conflict of interest. A growth plan usually settles the question before the next ICAAP.
Who should interview CRO candidates?
At least the chief executive, the chair and the chair of the risk committee, because the risk committee chair is responsible for safeguarding the independence of the risk function. We also recommend a technical interview by someone who has held a CRO role, before the board panel. Our board risk training can help non-executives prepare.
Can we appoint a CRO who has only worked outside the UK?
Yes. Since April 2026 the PRA’s assessment takes account of approvals in other jurisdictions and senior management experience elsewhere, and it says there is no single right background. The firm must still be satisfied the person is fit and proper, and the criminal record check covers time spent abroad where it was material in the previous six years.
Should we use a retained search firm for a CRO?
Most CRO searches are retained and exclusive because the best candidates are not looking and must be approached in confidence. Terms and fees depend on the role and are agreed in writing before any work starts. A partner should own the search from the brief to the first day.
Next step
Tell us about the role
A 30-minute call is enough to agree the brief and whether we are the right firm to run the search.
Brief us on a role
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.