Risk Talent · Executive search
Chief risk officer executive search is RiskTAE’s retained search service for the CRO role in UK banks, building societies, insurers and other regulated financial firms. A partner runs the search from the written brief to the new CRO’s first day, and where the role is the PRA’s Chief Risk function, SMF4, the regulator’s approval is planned in from the first conversation.
You see people who can hold the role in front of your board and your supervisor, each interviewed on the substance before you read a CV, and a start date built around the approval.
By Benn PopleUpdated
The role
In a UK bank or building society the chief risk officer holds the PRA’s Chief Risk function, SMF4: responsibility for the overall management of the firm’s risk controls, including the setting and managing of its risk exposures, reporting directly to the governing body.
Candidates read the statement of responsibilities more closely than the job description and ask who they will report to in practice, so we settle both with you before we approach anyone.
Our guide what does a chief risk officer do in a UK bank covers the role in full.
Sources: PRA Rulebook, Senior Management Functions Part, rule 3.4; Allocation of Responsibilities Part, rule 2.1; PRA SS28/15, April 2026, paragraph 2.41 and Tables B and E.
Candidates
The PRA says there is no single right background for a senior manager, and since April 2026 its assessment takes account of approvals in other jurisdictions and SMF experience elsewhere. Before applying, the firm must satisfy itself that the person is fit and proper on personal characteristics, competence, knowledge and experience, qualifications and training; we build the shortlist on the same headings.
A first CRO for a growing lender usually comes from deputy CROs and heads of credit or prudential risk who have written an ICAAP rather than reviewed one; an established bank looks at sitting CROs and heads of risk at larger firms. The weakness we test hardest is scale: a specialist from a large bank has run one risk type with a big team, while in a firm with gross total assets of £250 million or less, where the PRA expects few senior managers beyond the mandatory ones, the CRO may be the only risk SMF and carry every risk type with a handful of people.
Whoever you appoint now will hold the role through the first year of the PRA’s Basel 3.1 rules, in force from 1 January 2027, so every candidate is asked what they did the last time the capital rules changed.
Sources: PRA Rulebook, Fitness and Propriety Part, rules 2.1 and 2.6; PRA PS12/26, 22 April 2026, paragraphs 2.16 to 2.21; SS28/15, April 2026, paragraph 2.7; PRA PS1/26, 20 January 2026.
Process
How the search runs
From the first call to the first months in the role
The six stages of a RiskTAE chief risk officer search; the table below sets out each one.
Sources: PRA Rulebook, Allocation of Responsibilities Part, rule 2.1; Fitness and Propriety Part, rules 2.7 and 2.9.
| Stage | What happens | What is different for a CRO |
|---|---|---|
| Brief | A 30-minute call, then a written brief: role, first-year success, terms, timetable. | We ask for the draft statement of responsibilities and the reporting line too; both go to the PRA, and both decide who takes the role. |
| Market map | The people who fit, most not looking, approached in confidence without naming you. | We ask early about the six years a regulatory reference will cover, so nothing surfaces after the offer. |
| Technical screen | Each candidate is interviewed on the substance of the role before you see a CV. | The interviewers have held these roles: former chief risk officers and heads of risk, former regulators and interim executives. |
| Shortlist | A short list with our written view of each person, then interviews and feedback both ways. | Our view covers how each record will read to the regulator; the chair of the risk committee meets the shortlist. |
| Offer and approval | We handle the offer and plan around the PRA’s approval. | References go out the day the offer is accepted; the criminal record check must be no older than six months at application. |
| Start | We stay close through notice and the first months. | If the outgoing CRO leaves before the new one is approved, interim cover bridges the gap. |
Sources: PRA Rulebook, Allocation of Responsibilities Part, rule 2.1; Fitness and Propriety Part, rules 2.7 and 2.9; FCA Handbook, SUP 10C.10.16R.
The regulator’s timetable
PS12/26 changes to senior manager approvals took effect
Start the search when you learn the CRO is leaving, not when they leave. Once a complete application is in, the regulator has a statutory three months to decide, and the clock stops each time it asks for more information. The PRA’s median determination time for senior manager cases was 28 days between December 2025 and February 2026, down from 62 days a year earlier.
The work before the application takes longer than the application. Regulatory references must cover the previous six years of employment and be sought from every relevant former employer, with a four-week reply window that now binds all firms, and the criminal record check must be no older than six months when the application is submitted. Add a notice period, and these dates set the timetable.
If the CRO has already gone, our interim chief risk officer page sets out how we run interim cover alongside the permanent search. The PRA’s 12-week rule is a separate question: it can allow temporary cover for the Chief Risk function while an approval is sought, under conditions.
Sources: FCA Handbook, SUP 10C.10.16R, 10C.10.26G and 10C.10.28G; PRA PS12/26, 22 April 2026, paragraphs 2.19, 2.79 and 2.85; PRA Rulebook, Fitness and Propriety Part, rule 2.7.
Failure points
Sources: PRA Rulebook, Risk Control Part, rule 3.4; FCA Handbook, SYSC 25.9; PRA SS28/15, April 2026, paragraph 2.58C.
Working with your team
A CRO search has more owners than most hires. The chief executive wants a colleague; the chair of the risk committee is responsible under the PRA’s rules for safeguarding the independence of the risk function and overseeing its performance, the CRO included. We ask both, and the chair of the board, to agree the brief, and the chair of the risk committee meets the shortlist, which candidates ask for anyway.
With HR, in-house talent acquisition and RPO teams we split the work: they own the process, the employer brand and the offer; we bring the senior risk market map and the technical screen. We can take the hardest role off a hiring plan or support a whole programme; see our page for talent acquisition teams.
The same firm does advisory, training and the RisKIT models, so a search can be paired with interim advisory cover or with training for the new CRO’s team, through Risk Advisory and Risk Education. If the board’s own risk expertise is the gap, we also search for risk committee chairs and risk NEDs.
Sources: PRA SS5/16, paragraph 4.3; PRA SS28/15, April 2026, Table F; PRA Rulebook, Risk Control Part, rule 3.5.
FAQ
For a chief risk officer we work as a headhunter in the plain sense: we map the market, approach people who are not looking and interview them on the substance before you see a CV. We are based in London and run CRO recruitment across the UK and for international clients.
Where the firm needs a CRO’s judgement but not five days of it, a fractional chief risk officer can hold the role part-time. We say at the first call whether a fractional, interim or permanent appointment fits your growth plan.
Often the incumbent is still in post, so we approach candidates without naming you until they are interested, and where you ask, candidates sign a non-disclosure agreement before we name the firm. A candidate’s details are never shared without their agreement.
Insights
A chief risk officer job description for a UK bank has to do two jobs: describe the role to candidates and match the statement of responsibilities that goes to the PRA with the SMF4 application. This template sets out both, with the Risk Control Part requirements and the prescribed responsibilities to consider for a CRO.
By Benn Pople · 7 min readPlan when a new chief risk officer can act as SMF4: notice, references, the PRA's decision times and the three-month limit.
RiskTAEA board's guide to hiring a chief risk officer in the UK: the brief, the search, the assessment, SMF4 approval and the first 100 days in post.
By Benn PopleNext step
In 30 minutes we will agree the brief, say how the market is likely to read it and tell you whether a retained search is the right route.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.
