Risk Talent · Executive search
One title covers three jobs in model risk: running validation alone, owning the framework, or building the models too. RiskTAE runs retained searches for heads of model risk and model validation in UK banks, building societies and investment firms, and maps candidates by model class and size of firm.
A partner runs the search from brief to first day, and every candidate is interviewed against the PRA’s SS1/23 principles before you see a CV.
You meet people who have validated the models your capital ratio rests on.
By Benn PopleUpdated
The role
Model risk, as the UK Capital Requirements Regulation defines it, is the potential loss an institution may incur as a consequence of decisions that could be principally based on the output of internal models. The head of model risk runs the second line for that risk: the inventory, the policy, independent validation, and the reporting that tells the board how far each model can be trusted.
The PRA’s SS1/23 sets out five model risk management principles for banks and has applied since 17 May 2024. It expects an accountable senior management function, the most senior individual responsible for the risks from the firm’s models, to oversee the framework; in the banks we search for that is usually the chief risk officer, SMF4, and the head of model risk reports to them.
The first thing we settle in a brief is the boundary. In one firm the title runs validation alone; in another it owns the framework while validation reports separately; in a third it is expected to build the models too, which sits badly with a risk function the PRA’s rules require to be independent from the operational functions. Candidates ask which job it is on the first call.
Sources: UK CRR, Article 4(1)(12); PRA SS1/23, April 2026 version, paragraphs 1.5 and 1.8 and Principle 2.2; PRA Rulebook, Senior Management Functions Part, rule 3.4, and Risk Control Part, rule 3.4.
Candidates
From three places: heads of validation and senior validators at IRB banks, who have sat through a supervisory model review; developers crossing to the second line, who must show they can challenge former colleagues; and consulting validation practices and former regulators, who know the standard but have not run a function.
The mismatch we see most is scale. A head of model risk at a large IRB bank runs a big inventory and a validation team, and may not have validated a model with their own hands for years; in a smaller bank the same title writes the policy, builds the inventory, validates the material models and presents to the risk committee with one or two analysts. So we ask for the last validation the candidate did rather than signed, and when they last told a model owner a model was unfit for use.
Process
| Stage | What happens |
|---|---|
| Brief | A 30-minute call, then a written brief: the role, first-year success, terms and timetable, plus the model estate: permissions held or sought, where development sits, who the accountable senior manager is, and whether the role is certified. |
| Market map | The people who fit, most not looking, mapped by model class and by the size of firm they ran it in, approached without naming you until they are interested. |
| Technical screen | Each candidate is interviewed on the substance before you see a CV, by former chief risk officers and heads of risk with model and quant specialists: what they validated, built, and wrote rather than inherited. |
| Shortlist | A short list with our written view of each person, then interviews and feedback both ways; we ask that the risk committee chair and the head of model development meet the final two. |
| Offer, checks and start | Regulatory references over six years apply to this role too; our guide to regulatory references after PS12/26 sets out the timetable. The PRA expects a criminal records check for non-SMF holders as well. We plan the start around both and stay close through the first validation cycle. |
Sources: PRA Rulebook, Fitness and Propriety Part, rule 2.7; PRA SS28/15, April 2026, paragraphs 4.19 and 6.5; PRA PS12/26, 22 April 2026, paragraph 2.79.
Basel 3.1
Basel 3.1 applies under PS1/26
The PRA’s Basel 3.1 rules take effect on 1 January 2027 under PS1/26, and much of the change lands on this desk. IRB goes for central governments, central banks and equity, and the advanced approach for institutions, large corporates and financial corporates; input floors arrive for PD, LGD and EAD; and the output floor starts at 60% of standardised risk-weighted assets, reaching 72.5% from 1 January 2030. The internal model approach for market risk follows a year later, on 1 January 2028.
Because the floor compares modelled risk-weighted assets with a standardised recalculation, an IRB firm runs both from 2027, and the head of model risk is asked whether the second has been checked as hard as the first. We ask every candidate what their firm’s impact assessment showed. Our Basel 3.1 page has the rules in full.
Sources: PRA PS1/26, 20 January 2026, paragraphs 1.23, 1.24 and 2.10, and Appendix 1, Article 92; PRA PS9/24, 12 September 2024, paragraphs 1.9 and 3.51.
The regulator’s timetable
Usually not. In most banks the head of model risk is a certification function: someone the firm certifies as fit and proper and reassesses each year, rather than a person the regulator approves. The accountable senior management function sits above them, and SS1/23 expects that person’s statement of responsibilities to say so; we check that it does before the search starts, because a supervisor reads the statement first.
Where the person holds overall responsibility for an area under the FCA’s rules and no other approval, the role is SMF18. The regulator then has three months from a complete application, and the criminal record check must be no older than six months at submission. Our interim chief risk officer page explains how a role is covered while an approval is pending.
Sources: PRA Rulebook, Certification Part, rule 2.1; FCA Handbook, SUP 10C Annex 1, SUP 10C.7.1R and SUP 10C.10; PRA SS1/23, paragraph 1.8; PRA PS12/26, 22 April 2026, paragraphs 2.20 and 2.85.
Failure points
Sources: PRA SS1/23, April 2026 version, introduction; PRA PS1/26, 20 January 2026, paragraph 2.10.
Working with your team
The chief risk officer usually owns this hire; where that role is open too we run the two searches together. The chief financial officer has a stake, since models used for financial reporting sit inside SS1/23, so we ask the CFO to agree the brief. The chair of the risk committee, responsible under the PRA’s rules for safeguarding the independence of the risk function, usually meets the final candidate.
HR, in-house talent acquisition and RPO teams own the process and the offer; we bring the market map and a technical screen a generalist team cannot run. The same firm does advisory, training and the RisKIT models, so a search can be paired with interim cover from Risk Advisory or training for the new head’s team from Risk Education; our other searches are under Risk Talent.
Sources: PRA SS1/23, introduction; PRA SS5/16, July 2018, paragraph 4.3; PRA Rulebook, Allocation of Responsibilities Part, rule 4.1(17).
FAQ
Yes. In some banks the head of validation is the senior model risk person; in others a head of model risk owns the framework and validation reports alongside. The search runs the same way, with more of the screen on the candidate’s own validation work.
Yes. SS1/23 is addressed to firms with internal model permissions, yet a bank without one still relies on models for impairments, stress testing and the ICAAP, and needs a framework builder rather than the head of a large validation team; we map deputies and senior validators as well as sitting heads.
Rarely; head of model risk recruitment at this level is mostly confidential, so we approach people directly. If you are thinking about a move, book a confidential career call, message us on WhatsApp on +44 7537 159269 or email talent@risktae.com. We never put your name forward without your agreement.
Insights
The Basel 3.1 output floor stops a firm’s modelled risk-weighted assets falling below a set share of what the standardised approaches would produce. In the UK it starts at 60% on 1 January 2027 and rises...
By Mark Dougherty, CPA (CAN) · 7 min read
The UK’s version of the Fundamental Review of the Trading Book (FRTB) arrives in two steps. From 1 January 2027 the new trading book boundary and the two new standardised approaches apply with the rest of...
By Mark Dougherty, CPA (CAN) · 7 min read
A chief risk officer runs a bank’s independent risk management function. In the UK the role is a regulated senior management function, SMF4, defined as “responsibility for overall management of the risk controls of a firm,...
By Benn Pople · 7 min readNext step
In 30 minutes we will agree the brief, say how the market is likely to read it and tell you whether a retained search is the right route.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.