SMF4 approval timeline planner
Plan when a new chief risk officer can act as SMF4: notice, references, the PRA's decision times and the three-month limit.
RiskTAERisk Talent · Executive search
RiskTAE runs specialist executive search for senior risk roles alongside in-house talent acquisition, HR and RPO teams in banks, building societies, investment firms, asset managers, insurers and payment firms. Your team keeps the process, the employer brand and the offer; we bring a map of the senior risk market and a technical screen run by people who have held the roles.
One partner owns the search from brief to first day, and every candidate is interviewed on the substance of the role before your hiring manager sees a CV.
By Benn PopleUpdated
Who does what
Owns the process and the employer brand: requisition, interview loop, offer, onboarding and the record in your ATS.
Brings the senior risk market and the screen: who runs credit, market, liquidity, operational and model risk in the firms you compete with for people, most of whom are not applying to anything.
The interviewers have held these roles: former chief risk officers and heads of risk, former regulators and interim executives, with model and quant specialists. Before your chief risk officer gives up an hour, a head of credit risk candidate has already been asked how they set limits on a book they inherited, and what they did the first time it breached them.
How it runs
| Stage | Your team | RiskTAE |
|---|---|---|
| Brief | Owns the requisition and the approvals. | A 30-minute call, then a written brief: role, first-year success, terms, timetable. |
| Market map | Tells us who has already applied, been approached or declined. | Maps the people who fit, most not looking, approached in confidence without naming you. |
| Technical screen | Runs the competency interview you would run for any senior hire. | Interviews every candidate on the substance of the role before you see a CV. |
| Shortlist | Loads it into your ATS and books the hiring manager’s diary. | A written view of each person, rather than a stack of CVs. |
| Interviews and offer | Runs the loop and the offer. | Carries feedback both ways and plans around the regulator’s approval for an SMF role. |
| Start | Onboarding. | Stays close to you and the hire through notice and the first months. |
One voice per candidate at each stage keeps the two teams from tripping over each other: until a candidate has agreed to be named to you, the partner running the search is their only point of contact, and nobody is approached about your role twice. Benn Pople, who leads Risk Talent, has recruited only risk leaders since 2003, and the partner who takes the brief runs the search to the first day.
PSL, RPO and terms
Yes. Most searches are retained and exclusive, which lets us approach people who are not on the market; some roles suit a contingent approach. Fees depend on the role and the terms of the search; both are agreed in writing before any work starts, and can sit inside a preferred supplier agreement or an RPO’s supply chain where you have one.
Your ATS holds the record, but a candidate’s details are never shared without their agreement, and nobody hears your name until they have shown interest; where you ask, candidates sign a non-disclosure agreement first. Settle in the terms how someone we approach who is already on your system is treated, and it never becomes an argument about a fee.
The regulator’s timetable
PS12/26 changes to senior manager approvals took effect
Where the role is a senior management function, such as the PRA’s Chief Risk function (SMF4), the person may only perform it once the regulator has approved them; from a complete application the regulator has a statutory three months, and the clock stops each time it asks for more information.
The work before the application is what catches hiring plans out. Regulatory references must cover the previous six years and be sought from all relevant former employers, with a four-week reply window that now binds all firms, and the criminal record check must be no older than six months at submission. Those dates and the notice period, rather than the offer letter, set the start date, so we build them into the timetable at the brief.
If the incumbent has already gone, our interim chief risk officer cover keeps the function filled while the permanent search runs.
Sources: FCA Handbook, SUP 10C.10; PRA Rulebook, Senior Management Functions Part, rule 3.4, and Fitness and Propriety Part, rule 2.7; PRA PS12/26, 22 April 2026.
Failure points
Sources: PRA Rulebook, Fitness and Propriety Part, rules 2.7 and 2.9, and Allocation of Responsibilities Part, rule 2.1.
Scope
Either. Most teams bring us one role that has been open too long: a head of model risk nobody in the applicant pool can do, a chief risk officer for a firm applying for its licence, or a risk committee chair the nomination committee cannot find. We take that role and leave the rest of your plan alone.
Where a firm is building or rebuilding its risk function, we support the programme: the order in which roles are filled, which need the regulator’s approval, and which can be covered on an interim basis while the permanent search runs. The same firm does advisory, training and the RisKIT models, so a search can be paired with interim advisory cover from Risk Advisory or training for the new leader’s team from Risk Education.
FAQ
Yes. The RPO holds the requisition, the process and the reporting to the client; we take the one role its own sourcing has not filled and report to whoever owns the requisition.
A 30-minute call, then the written brief. Send the draft job description, the reporting line, any supplier terms you already hold, and the names of anyone already approached or sitting in your ATS for the role, so nobody hears from the firm twice.
Fees depend on the role and the terms of the search, and we agree both in writing before any work starts. Where you already have supplier terms, send them with the brief.
Insights
Plan when a new chief risk officer can act as SMF4: notice, references, the PRA's decision times and the three-month limit.
RiskTAE
A UK bank hiring a senior manager, a certification function holder or a notified non-executive director must request regulatory references covering the candidate’s previous six years from every relevant former employer, and must normally hold them...
By Benn Pople · 8 min readA board's guide to hiring a chief risk officer in the UK: the brief, the search, the assessment, SMF4 approval and the first 100 days in post.
By Benn PopleNext step
In 30 minutes we will agree the brief, the split of work with your team and how candidates already in your ATS are treated.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.