Risk Talent · Executive search
Candidates for a head of risk and compliance role ask first who on the board oversees what: in all but the smallest firms, overseeing the risk function and overseeing the compliance function are separate prescribed responsibilities held by non-executives. RiskTAE runs retained searches for combined heads of risk and compliance in smaller UK banks, building societies and investment firms.
One leader runs both disciplines and, in a bank, answers for them to the PRA, the FCA and the board, so a partner runs the search from brief to first day and plans the approval in from the start.
You meet people who can hold both disciplines, tested on the substance of each before you read a CV.
By Benn PopleUpdated
The role
One person holds the whole second line: the risk function, the compliance function and sometimes the money laundering reporting officer’s role too.
In a bank or building society that usually pairs the PRA’s Chief Risk function, SMF4, responsible for the overall management of the firm’s risk controls and reporting directly to the governing body, with the FCA’s compliance oversight function, SMF16, whose holder is responsible for a permanent, effective and independent compliance function. Chief Risk is a PRA function; compliance oversight and money laundering reporting, SMF17, are FCA functions, so one leader answers to both regulators.
The rules allow it: the PRA requires the Chief Risk function where proportionate and lets another senior person fulfil it where a dedicated appointment is not justified and there is no conflict of interest, and a firm with gross total assets of £250 million or less is not expected to have many senior managers beyond the mandatory three.
Candidates check the line to the board first. The head of the risk function cannot be removed without the board’s prior approval, and in all but the smallest firms the board’s oversight of the compliance function and of the risk function are two separate prescribed responsibilities held by non-executives, so we ask which chair holds each before we approach anyone.
Sources: PRA Rulebook, Senior Management Functions Part, rule 3.4, Risk Control Part, rule 3.5, and Allocation of Responsibilities Part, rules 3.2 and 4.1; FCA Handbook, SUP 10C.6 and SYSC 6.1; PRA SS28/15, April 2026, paragraph 2.7 and Tables B and E.
Candidates
The PRA says there is no single right background for a senior manager, and since April 2026 its assessment takes account of approvals and senior management experience elsewhere. Your firm must first be satisfied the person is fit and proper; we add the one test the rules leave to you: can this person carry two disciplines at once.
Candidates come from two pools, each with a blind spot. A head of compliance who has taken on risk is at ease with the FCA, conduct and financial crime, less so with the ICAAP, stress testing and the PRA. A head of risk from a larger bank knows capital and liquidity and has often never owned a compliance monitoring plan. We ask each what they have written and defended themselves, on both sides.
Scale is the other test: where the PRA expects few senior managers, the combined head does the work as well as overseeing it. Whoever you appoint will also hold the role through the first year of the PRA’s Basel 3.1 rules, in force from 1 January 2027.
Sources: PRA Rulebook, Fitness and Propriety Part, rule 2.1; PRA PS12/26, 22 April 2026, paragraphs 2.16 to 2.21; SS28/15, April 2026, paragraph 2.7; PRA PS1/26, 20 January 2026.
Process
A 30-minute call, then a written brief: role, first-year success, terms, timetable. It also names the functions the person will hold and comes with a draft statement of responsibilities, which candidates read before the job description.
The people who fit, most not looking, approached in confidence without naming you until they are interested: compliance leaders who have taken on risk, and risk leaders who have taken on compliance.
Each candidate is interviewed on the substance before you see a CV, by former chief risk officers and heads of risk, former regulators and interim executives. Capital and conduct are tested in the same interview, so one cannot hide the other.
A short list with our written view of each person, then interviews and feedback on both sides.
We handle the offer and plan around the approval. Six-year regulatory references go out the day the offer is accepted; the criminal record check must be no older than six months at application.
We stay close through notice and the first months. The FCA requires a handover to a new senior manager and says the material should carry judgement and opinion, not just facts and figures; if the outgoing head has gone, an interim head of risk can write the risk half.
Sources: PRA Rulebook, Allocation of Responsibilities Part, rule 2.1, and Fitness and Propriety Part, rules 2.7 and 2.9; FCA Handbook, SUP 10C.10.16R and SYSC 25.9.
The regulator’s timetable
PS12/26 changes to senior manager approvals took effect
Start the search when you learn the head is leaving, not when they leave. Once a properly completed application is in, the regulator has a statutory three months to decide, and the clock stops whenever it asks for more information. In July 2025 both regulators set targets: the PRA to complete at least half of senior manager applications within 45 days, the FCA at least half within 35 days.
The work before the application takes longer. Regulatory references over six years apply to this role too; our guide to regulatory references after PS12/26 sets out the timetable. Where two heads become one, the statements of responsibilities and the responsibilities map change too, with a revised statement expected within six months of the change.
If the head has already gone, an interim head of risk can hold the risk function while the search runs. The PRA expects a succession plan for each senior management function.
Sources: FCA Handbook, SUP 10C.10; PRA PS12/26, 22 April 2026, paragraphs 2.79 and 3.8; FCA news story, 15 July 2025; PRA SS28/15, April 2026, paragraphs 2.54 and 2.58C.
Failure points
Sources: PRA Rulebook, Risk Control Part, rule 3.4; FCA Handbook, SYSC 6.1.3R and SYSC 6.3.9R and 6.3.10G; Money Laundering Regulations 2017, regulation 21; PRA SS28/15, April 2026, Table E.
Working with your team
A combined head has more owners than most hires. The chief executive wants a colleague who can say no; under the PRA’s guidance the risk and audit committee chairs safeguard the independence of the executive risk and audit functions, and, above the small-firm threshold, a non-executive holds the prescribed responsibility for the compliance function. We ask all of them to agree the brief, and those non-executives meet the shortlist.
HR, in-house talent acquisition and RPO teams own the process, the employer brand and the offer; we bring the market map and the technical screen. See our page for talent acquisition teams.
The same firm does advisory, training and the RisKIT models, so a search can be paired with interim advisory cover or with training for the new head’s team. If the growth plan will split the role within a few years, run it as a chief risk officer search from the start. If the firm needs senior risk judgement for part of the week, see fractional chief risk officers.
Sources: PRA SS5/16, paragraph 4.3; PRA Rulebook, Allocation of Responsibilities Part, rules 3.2 and 4.1.
FAQ
Often they do in the briefs we take for smaller firms, and the PRA’s guidance lets another senior person fulfil the Chief Risk function where there is no conflict of interest. Whether it works in yours depends on size, plan and the board’s oversight, and we settle that with you first.
Executive search, usually retained and exclusive: we map the market, approach people who are not looking and interview them on the substance before you see a CV. Some roles suit a contingent approach. Terms and fees are agreed in writing before any work starts.
We can place an interim head of risk to hold the risk side while the permanent search runs, and where the role is a senior management function we plan the start around the regulator’s approval. We do not supply interim compliance officers or MLROs, so agree at the brief who covers compliance oversight in the gap.
Insights
The legal limit is three months from the day the regulator receives a complete application. In practice the PRA is much faster: its median time to decide senior manager applications was 28 days between December 2025...
By Benn Pople · 7 min read
A chief risk officer runs a bank’s independent risk management function. In the UK the role is a regulated senior management function, SMF4, defined as “responsibility for overall management of the risk controls of a firm,...
By Benn Pople · 7 min read
A UK bank hiring a senior manager, a certification function holder or a notified non-executive director must request regulatory references covering the candidate’s previous six years from every relevant former employer, and must normally hold them...
By Benn Pople · 8 min readNext step
In 30 minutes we will agree the brief, say how the market is likely to read it and tell you whether a retained search is the right route.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.