SMF10 Chair of Risk Committee Hiring Guide

What Is the SMF10 Senior Management Function?

Senior Management Function 10 — the Chair of the Risk Committee — is the regulatory designation for the non-executive director who leads board-level oversight of risk at a UK regulated firm. The SMF10 holder chairs the risk committee: the board committee responsible for overseeing the firm’s risk appetite, its risk management framework and the risk the executive team takes on in running the business. Unlike most board members, the SMF10 holder carries personal regulatory accountability for that oversight under the Senior Managers and Certification Regime (SMCR).

Which regulator designates the function depends on the firm. At dual-regulated firms — banks, building societies, insurers and PRA-designated investment firms — SMF10 is a Prudential Regulation Authority (PRA) function. At FCA solo-regulated firms it is an FCA function, and it applies only to firms classed as “enhanced” under the SMCR. Core and limited scope solo-regulated firms do not have an SMF10, even if they choose to run a risk committee.

This guide explains the SMF10 role in depth — the regulatory framework that governs it, how the Chair of the Risk Committee operates in practice, what regulatory approval involves today and how that may change, what the candidate profile looks like, and how to run a search. It draws on the work Exec Capital does on regulated firm senior appointments across asset management, wealth management, insurance, banking, fintech and consumer credit, and on our wider board of directors recruitment practice.

The SMF10 hire is one of the most consequential governance appointments a regulated firm makes — not because the role is executive (it is not) but because the Chair of the Risk Committee provides the independent oversight that stops the management team’s appetite for risk running beyond what the board and the regulators consider appropriate. A weak, passive or under-skilled SMF10 is a governance failure with regulatory consequences. A strong one provides genuine challenge, genuine independence and real protection for the firm, its customers and its counterparties.

Two points shape every SMF10 search. First, the regulator will judge the candidate’s fitness and propriety — their honesty, integrity and reputation, their competence and capability, and their financial soundness — and the firm needs to be confident on all three before it submits anything. A candidate who looks right on paper but has undisclosed regulatory history, a thin application narrative or a relationship with the Chief Risk Officer that raises independence questions creates problems that are far harder to resolve after submission than before the search starts. Second, the relationship between the Chair of the Risk Committee and the CRO determines whether risk governance works. A Chair who simply ratifies management recommendations is not providing the oversight the SMCR expects.

The SMCR Framework and SMF10’s Place Within It

The Senior Managers and Certification Regime replaced the Approved Persons Regime. It came into force for banks and PRA-designated investment firms in March 2016, was extended to insurers in December 2018 and to FCA solo-regulated firms in December 2019, with the final elements for solo-regulated firms phased in after that. Its core principle is individual accountability: named individuals carry personal responsibility for defined areas of the firm’s business and governance, and the regulators can act against those individuals directly where they fail to take reasonable steps in their area. The FCA’s SMCR overview sets out the three parts of the regime: the Senior Managers Regime, the Certification Regime and the Conduct Rules.

SMF10 is one of the non-executive senior management functions. It sits alongside SMF9 (Chair of the Board), SMF11 (Chair of the Audit Committee), SMF12 (Chair of the Remuneration Committee), SMF13 (Chair of the Nominations Committee) and SMF14 (Senior Independent Director), with SMF15 (Chair of the With-Profits Committee) relevant to some insurers. Together these functions make the board’s oversight of the executive individually accountable rather than collectively anonymous. The exact list of NED functions differs slightly between the PRA and FCA regimes, which is one reason firms should check the rulebook that applies to them rather than relying on a generic summary.

The prescribed responsibility most closely associated with SMF10 is safeguarding the independence of the risk function, and overseeing its performance, including the performance of the CRO. Where a firm has a Chair of the Risk Committee, the regulators expect that responsibility to sit with them. In practice this means ensuring the firm has adequate risk management policies, that the committee’s oversight of those policies is effective and independent, and that material risk information reaches the board in a form that supports sound decisions. The Statement of Responsibilities for an SMF10 must describe this accurately and should be drafted with legal and compliance input before it is shown to a candidate. Our guide to Statements of Responsibilities and what boards should consider before appointing an SMF covers the drafting points in detail.

SMF10 is not required at every regulated firm. Whether a firm needs a risk committee — and therefore an SMF10 — depends on its size, type and regulatory classification. Larger banks and insurers are generally required to have a separate risk committee; enhanced solo-regulated firms will have an SMF10 where they have a risk committee chair; core firms will not. Some firms combine audit and risk into one committee, and in that case the firm should take advice on which functions the chair holds. Firms should confirm with their legal and compliance advisers whether SMF10 applies before starting the search. For the broader framework and how functions are allocated, SMF Roles: A Complete Guide provides the foundational reference.

Recent SMCR Reforms and the Proposed Move to Notification

The SMCR is in the middle of the most significant reform since it was introduced, and anyone hiring an SMF10 now should understand where things stand. The reforms are coming in two phases.

Phase 1 is in force. The FCA’s policy statement PS26/6 and the PRA’s companion policy statement PS12/26 made targeted changes within the regulators’ existing powers, with most taking effect on 24 April 2026. The changes covered areas including criminal record checks, the 12-week rule for temporary cover, Statements of Responsibilities and Management Responsibilities Maps, regulatory references, prescribed responsibilities and the thresholds for becoming an enhanced firm. For an SMF10 search, the practical effect is that firms should work from the current rules on SoRs, references and temporary cover rather than from older internal templates.

Phase 2 is a proposal. In October 2026 the FCA published CP26/37 and the PRA published CP14/26. Both consultations close on 22 January 2027. Among other changes, both propose moving SMF10 from pre-approval to a notification regime. Under the proposal, the firm would carry out its own fitness and propriety assessment and notify the regulator before the individual starts, rather than waiting for approval. The regulators would keep the power to require pre-approval in exceptional cases, and notified senior managers would remain subject to the Duty of Responsibility and the Senior Manager Conduct Rules in the same way as approved ones.

Three practical points follow. First, until final rules are published and in force, SMF10 still requires regulatory approval, and searches running now should plan on that basis. Second, a notification regime would move the burden of proof onto the firm: the board, not the regulator, would be the main check on whether the candidate is fit and proper, which makes the firm’s own due diligence more important, not less. Third, the accountability does not change. A notified SMF10 who fails to take reasonable steps in their area would face the same exposure as an approved one. Boards should not read the proposal as a reason to lower the bar on candidate quality.

The Chair of the Risk Committee’s Governance Role

Understanding what the Chair of the Risk Committee actually does — in practice, not just in regulatory definition — is essential context for the search brief and for the candidate conversation.

Risk committee leadership and governance. The SMF10 chairs the risk committee, which typically meets at least quarterly and more often where the firm’s risk profile or a live issue demands it. The Chair sets the agenda, manages the committee’s interaction with management (mainly the CRO and CFO), makes sure the terms of reference are followed and reports the committee’s work to the main board. Good chairing needs both subject depth — the ability to judge the quality of the risk information in the pack — and governance discipline: running a meeting that reaches clear, minuted conclusions with named owners and deadlines.

Risk appetite oversight. The risk appetite framework — the firm’s formal statement of the level and types of risk it is willing to take in pursuit of its objectives — is the committee’s most important governance document. The Chair oversees its development and periodic review, makes sure it reflects the board’s actual risk tolerance rather than simply ratifying management’s preferences, and monitors the firm’s actual risk profile against it. Where the firm is operating outside appetite, deliberately or otherwise, the Chair makes sure the board knows and that management acts.

Capital, liquidity and stress testing. At banks, building societies and insurers, the committee will usually review the firm’s internal capital and liquidity assessments and the stress and scenario testing behind them before they go to the board. At solo-regulated investment firms the equivalent is often the internal capital adequacy and risk assessment process. The Chair does not need to build the models, but must be able to tell whether the scenarios are severe enough, whether the assumptions are credible and whether management’s conclusions follow from the work.

CRO relationship and independence support. The CRO’s effectiveness depends heavily on their relationship with the Chair of the Risk Committee. The Chair is the CRO’s main board champion — the person who makes sure the CRO has board access, the information they need and the independence to give honest assessments without pressure to soften them. Where that independence is compromised, by reporting-line conflicts, management pressure or poor resourcing, the Chair is the governance backstop. The Chair should hold regular private sessions with the CRO without management present.

Regulatory liaison. The SMF10 holder may be asked to meet supervisors directly — in periodic supervisory meetings, in response to information requests or, in difficult cases, in an enforcement context. They should understand the regulators’ current priorities and how they apply to the firm’s risk profile. Our explainer on FCA supervisory and enforcement action sets out how that engagement can escalate.

Horizon scanning and emerging risks. The committee oversees known risks, but the Chair also has to make sure the agenda covers emerging risks — climate, geopolitical and supply chain risk, cyber, AI and model risk — that are not yet fully built into the framework but could become material. That forward-looking side of the role needs curiosity and a willingness to bring outside intelligence into the room.

Links to the other committees. Risk does not stay in one committee. The Chair of the Risk Committee needs a working relationship with the Chair of the Audit Committee on internal controls and assurance, with the Chair of the Remuneration Committee on risk adjustment to variable pay, and with the Chair of the Nominations Committee on board skills and succession. Our guides to the Chair of the Remuneration Committee at FCA firms and the SMF13 Chair of the Nominations Committee set out those roles. In many firms the risk chair also sits on the remuneration committee so that risk input to pay decisions is direct rather than second-hand.

The Chair-CRO Dynamic

The relationship between the Chair of the Risk Committee and the CRO is one of the most important governance relationships in a regulated firm, and one of the most delicate. Getting it right is a precondition for effective risk governance. Getting it wrong produces either rubber-stamp oversight, where the Chair defers too much to management, or adversarial dysfunction, where the relationship becomes a bottleneck.

The ideal relationship has three qualities: respect for the CRO’s technical expertise; independence from the management viewpoint the CRO inevitably carries as a member of the executive; and enough trust for candid conversation when the CRO has concerns that need to reach the board. The Chair who has the CRO’s respect gets better information. The Chair who keeps genuine independence provides better oversight. The Chair who has the CRO’s trust hears the things that matter most, early.

In practice this needs deliberate investment. The Chair should have substantive one-to-one time with the CRO between meetings, not only the formal committee interaction, and should be reachable when the CRO needs board-level input on a significant decision. A Chair who only appears at scheduled meetings is not providing the continuous oversight that SMF10 accountability implies.

The Chair also has a formal role in the CRO’s position. Regulators expect the board, usually acting through the risk committee, to be involved in the appointment, objectives, performance assessment and, if it comes to it, removal of the CRO, so that the CRO cannot be dismissed by executives for raising unwelcome points. A candidate for SMF10 should be able to describe how they have handled that in previous roles, including at least one occasion when they backed the CRO against management pressure.

For the CRO’s side of the relationship, see the Chief Risk Officer job description, our analysis of board-level CRO governance and SMF4 approval and the SMF4 CRO Hiring Guide. Where a firm is replacing both the CRO and the risk chair within a short period, sequencing matters: appointing the Chair first usually gives the board a stronger hand in selecting the CRO, and our CRO recruitment practice can run the two searches in step.

FCA Pre-Approval: The SMF10 Application Process

Under the current rules, an SMF10 appointment needs regulatory approval before the candidate can perform the function. At an enhanced solo-regulated firm the FCA approves the application. At a dual-regulated firm, SMF10 is a PRA function: the PRA leads the assessment and approves with the FCA’s consent. In both cases the firm submits a Form A, and the regulator assesses the candidate against the fit and proper criteria. Our practical guide to the Form A approval process walks through the form itself.

The fit and proper assessment. The regulator looks at the candidate’s honesty, integrity and reputation, including any regulatory investigations, enforcement action or adverse supervisory findings at previous firms; their competence and capability for this specific function — risk committee chairing needs real risk knowledge, not just general NED experience; and their financial soundness, where matters such as insolvency or judgment debts are relevant. For dual-regulated firms, the PRA may also interview the candidate, and the interview will test their understanding of the firm’s risks and how they would challenge management.

Application timeline. By statute the regulators have three months from receiving a complete application to make a decision, and longer where an application is incomplete and further information is needed. Straightforward applications can be decided faster; complex ones, where there is history to review, competence questions or wider supervisory concern about the firm, can use the full period. Firms should plan for the statutory window, prepare a complete application first time, and not allow the candidate to perform any SMF10 responsibilities before approval. Our guide to how long SMF approval takes covers the practical factors that speed applications up or slow them down.

The Statement of Responsibilities. The SMF10 SoR must accurately reflect the responsibilities allocated, including the prescribed responsibility for the independence of the risk function, and must be consistent with the Management Responsibilities Map where the firm is required to keep one. The firm’s legal and compliance teams should draft and review it before it reaches the candidate — for accuracy, and so the candidate understands the accountability they are accepting. Experienced SMF holders will read the SoR closely and flag loose or overlapping wording; first-time SMF holders sometimes accept it without enough scrutiny, which causes problems later.

Regulatory references. Firms must obtain regulatory references covering the previous six years from relevant past employers before submitting an SMF application. The format is prescribed, and the references will surface material history that the candidate’s own disclosures might miss. Collecting them takes time, particularly where a candidate has held several NED roles, so the process should start early — ideally once a preferred candidate has been identified, with their agreement, rather than after an offer.

Temporary cover. Where an SMF10 leaves unexpectedly, the 12-week rule allows a replacement to perform the function for a limited period without approval while an application is prepared. The rule was revised in Phase 1, and Phase 2 proposes extending the period. Firms should check the current conditions before relying on it and should treat it as a bridge, not a substitute for a planned succession.

The SMF10 Candidate Profile

The pool of credible Chairs of the Risk Committee is narrower than many firms expect, particularly at the smaller end of the market, where the overlap between regulatory credibility, genuine risk expertise and NED governance experience is limited.

Risk management expertise is the foundation. A Chair without real risk management knowledge — from a career in credit, market, liquidity, insurance or operational risk, or from deep NED experience of risk committees at comparable firms — cannot challenge the information the CRO and the executive present. The regulator’s competence assessment will probe this, and the candidate’s ability to engage with the firm’s specific risk profile is a key quality signal.

Prior SMF experience is a significant advantage. Candidates who have held an SMF before — SMF10 elsewhere, or another NED or executive function — have shown they can work within the regime and manage personal accountability. They tend to need less onboarding, present fewer surprises in the application and bring credibility with supervisors. First-time candidates can still be strong appointments, but the application narrative needs more work to show competence.

Independence from management is non-negotiable. The SMF10 must be independent of the executive team. The UK Corporate Governance Code independence criteria are the usual benchmark even for firms not bound by the Code: no employment with the firm in the previous five years, no material business relationship with it in the previous three, no significant links with other directors, and no other relationship that could reasonably be seen to affect judgement. The assessment should be documented and reviewed before an offer is made.

Sector-specific regulatory literacy. Risk governance at a bank, an asset manager, an insurer and a consumer credit firm differs materially — in the risk categories overseen, in the rules that apply (PRA as well as FCA for banks and insurers) and in the supervisory attention each sector receives. A Chair whose experience is confined to a very different sector may lack the specific literacy needed. Where cross-sector candidates are being considered, the assessment should test their grasp of the firm’s own framework. Our pages on insurance board appointments under SMCR and senior board appointments at challenger banks cover two of the most distinct sector profiles.

Capacity and temperament. The role needs time, and it needs a particular temperament: someone who can be persistent without being combative, who asks the second and third question, and who is comfortable telling a board something it does not want to hear. Candidates holding several other mandates should be asked how they would make time in a crisis, not just in a normal quarter.

Where SMF10 Talent Comes From

SMF10 candidates come from three main backgrounds, each with different strengths and risks.

Career risk professionals who have moved into NED roles. Former CROs, Heads of Risk and Group Risk Directors who have moved from executive to non-executive careers are the most directly qualified candidates. They bring depth, regulatory credibility and often existing relationships with supervisors. Their risk is that they struggle to shift from running a risk function to overseeing one — and end up doing the CRO’s job instead of challenging it.

Senior NEDs with risk committee experience at comparable firms. Established NEDs who have chaired or sat on risk committees at similar firms bring the governance skills the role needs alongside credibility from direct oversight. They are often the most immediately effective, but are in demand and may already hold several mandates, so time commitment needs careful checking.

Former finance, actuarial and treasury leaders. Former CFOs, Chief Actuaries, Group Treasurers and senior finance executives from regulated firms sometimes make strong SMF10s, bringing quantitative and financial risk literacy and commercial judgement. They may need development on non-financial risk and risk management methodology, but can provide strong oversight of capital, liquidity and credit risk.

Beyond these three groups, some firms look to former supervisors or senior advisers from audit and consulting firms. They can work well, but boards should check that the candidate has sat on the receiving end of oversight as well as delivering it, and that any recent regulatory or audit relationship with the firm does not compromise independence. Our financial services non-executive recruitment work draws on all of these pools.

Running the SMF10 Search

An SMF10 search needs regulatory due diligence built into the process — not as a post-offer compliance step but as a pre-offer quality check. The firm should ask candidates directly about their regulatory history, ask for disclosure of any past investigations or enforcement action, and review the public record (the Financial Services Register and, where relevant, published enforcement notices) before shortlisting.

Start with the brief. Before any outreach, the board should agree what the firm needs from its risk chair now: which risk types dominate, how mature the framework is, how strong the CRO is, what supervisors have said recently and how much time the role will take. A firm with an established framework and a strong CRO needs a different Chair from one under supervisory pressure to rebuild its risk function.

Test risk judgement, not recall. Assessment should include a substantive risk governance discussion: the candidate’s approach to risk appetite design, their experience of the Chair-CRO dynamic, and their view of the firm’s most significant current risks. Some boards give shortlisted candidates a redacted risk committee pack and ask what they would challenge. This is not an exam; it tests whether the candidate’s knowledge and approach suit this firm. Our NED interview questions guide has further questions to adapt.

Involve the right people. The SMF10 works within a board structure — under the Chair, alongside the Senior Independent Director and in close contact with the Chair of the Audit Committee. The appointment should have the board Chair’s genuine endorsement, and the CRO should meet finalists, with their views heard though not decisive.

Plan the whole timeline. The search itself, notice periods for candidates stepping down from other roles, reference collection and the regulator’s statutory assessment window all add up. Firms should plan for the full period from the outset and avoid governance gaps by keeping a departing SMF10 in place until a successor can perform the function. Good SMCR succession planning identifies the next risk chair well before the current one’s term ends.

SMF10 Compensation and Time Commitment

NED fees for SMF10 holders reflect the regulatory accountability, the time commitment and the competition for qualified risk chairs. Fee levels vary widely with firm size, complexity, whether the firm is listed and how often the committee meets, so firms should benchmark against comparable firms in their own sector rather than relying on general figures. Our NED fees guide sets out how fee structures are usually built.

Fee structure. The common model is a basic board fee plus an additional fee for chairing the risk committee, with smaller supplements for membership of other committees. A committee chair fee is normally higher than a membership fee, reflecting preparation time and personal accountability. Listed firms disclose NED fees in their annual remuneration reports, which gives a useful public reference point for comparable businesses.

Time commitment. The role involves committee meetings, board meetings, preparation, one-to-ones with the CRO, regulatory engagement and ad-hoc meetings in response to material events. It is more demanding than a standard NED seat, and in a stressed period it can be substantially more demanding. The letter of appointment should state an expected commitment and make clear that more will be needed when circumstances require it.

Additional committee membership. Many SMF10 holders also sit on the audit or remuneration committee, which adds time and fee. The package should be agreed with the full committee portfolio in mind. Firms should also check that the candidate’s other directorships leave enough capacity — both the regulators and the Code expect boards to consider this.

Common Hiring Mistakes

1. Appointing a NED with governance experience but not enough risk depth. A capable generalist NED who lacks real risk knowledge cannot challenge the CRO’s reports or the framework. The regulator may flag this; even if the application passes, the quality of oversight will be poor.

2. Leaving regulatory due diligence until after the offer. Discovering material history after an offer has been made — and after the candidate has been associated with the firm — is far more damaging than surfacing it early. Due diligence should be a pre-offer requirement.

3. Not preparing the Statement of Responsibilities properly. An SoR that is vague, overlaps with other functions or understates the prescribed responsibility creates exposure for the firm and the individual. It should be drafted with legal input, reviewed by compliance and shared with the candidate in final form before the offer.

4. Treating independence as a formality. Independence is central to the role. The assessment should be documented and reviewed before the appointment is offered. An SMF10 later found to lack independence is a governance failure with potential regulatory consequences.

5. Underestimating the timeline. Planning on a quick approval when the statutory window is three months from a complete application creates governance gaps and frustrates candidates. Build the realistic timeline into the plan from day one.

6. Reading the notification proposal as a lower bar. If SMF10 moves to notification, the firm’s own fit and proper assessment becomes the main check. Boards that relax their process in anticipation risk appointing someone a regulator would later question — with the firm owning that judgement.

Onboarding a New SMF10

A good appointment can still start badly. A structured induction gets a new risk chair effective quickly and gives them a defensible record of the reasonable steps they took on arrival.

• Documents first. The risk appetite statement, the risk register, recent committee packs and minutes, capital and liquidity assessments, internal audit reports on risk and any recent supervisory correspondence.
• Meetings early. One-to-ones with the CRO, CFO, CEO, Head of Internal Audit, Head of Compliance and the external auditor, plus the outgoing risk chair where possible.
• An agreed handover note. The outgoing Chair’s view of open issues, management actions in progress and concerns not yet resolved, recorded so the new Chair inherits a clear position.
• A first-year plan. Priorities for the committee’s first twelve months, including any review of the terms of reference, the risk appetite framework or the committee’s information.
• Regulator introduction. Where the firm has a named supervisor, an early introductory meeting sets the tone for the relationship.

Our executive onboarding guide covers the first 90 days for senior hires more generally.

How Exec Capital Approaches SMF10 Appointments

Exec Capital’s regulated-firm practice covers the full range of NED senior management functions — SMF9, SMF10, SMF11, SMF12, SMF13 and SMF14 — alongside executive functions such as SMF4. Our SMF10 process builds regulatory due diligence in from the outset, so candidates presented to the firm have already been checked on regulatory history, independence and sector-specific risk competence before they reach the shortlist. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate.

We work with the firm’s legal and compliance teams on the Statement of Responsibilities and Management Responsibilities Map before candidates are engaged, because the SoR defines the role, and a clear one attracts better candidates and produces fewer surprises in the application. For firms making their first SMF10 appointment, or refreshing the function after a departure, we start with a full brief covering the regulatory, governance and commercial sides of the role before outreach begins. Where the reforms change the process — for example if notification replaces approval — we will set out how that affects the firm’s own assessment and documentation. Find out more about our board of directors recruitment service.

Related NED appointments that often accompany or follow the SMF10 hire include the SMF11 Chair of the Audit Committee, the SMF9 Chair and the SMF14 Senior Independent Director. Firms with a combined committee should read our guide to audit and risk committee chairs, and firms reviewing the whole board alongside the SMF10 appointment can use the Board Construction Guide.

The SMF10 and Climate and Emerging Risk Governance

The risk committee agenda now covers categories that were not part of the standard framework a decade ago. The Chair needs to be able to oversee these as well as traditional financial and operational risk.

Climate and transition risk. Climate-related disclosure requirements, the PRA’s supervisory expectations on climate-related financial risk and the Bank of England’s climate scenario work have put climate firmly on the risk committee agenda at many firms. The SMF10 does not need to be a climate scientist, but should understand how physical risks (damage to assets, supply chain disruption, operational impact) and transition risks (policy change, energy cost volatility, stranded assets) turn into financial risk for the firm, and should make sure the framework captures them credibly. For the executive side of sustainability governance, see our guide on how to hire a Chief Sustainability Officer.

AI and model risk. Growing use of AI and advanced models in financial services — credit decisioning, fraud detection, customer triage, pricing — creates model risk the committee is expected to oversee. The regulators have said they will apply existing frameworks, including the SMCR, to AI use, so accountability for AI risk sits with named senior managers and with board oversight. The Chair should make sure the committee has enough technical input, from the CRO’s team or a specialist NED, to challenge management rather than accept its assurances.

Operational resilience and third-party risk. UK firms are subject to the regulators’ operational resilience requirements, which expect boards to approve important business services and impact tolerances and to oversee testing. Firms with EU operations also face the Digital Operational Resilience Act (DORA), which sets detailed requirements for ICT risk management and third-party oversight. Oversight of the firm’s resilience framework, critical third-party dependencies and testing programme falls within the committee’s remit. A Chair without digital and resilience knowledge should make sure the committee has specialist input.

Conduct and consumer outcomes. For firms serving retail customers, the Consumer Duty has made customer outcomes a board-level risk, and the risk committee often oversees the outcome monitoring that supports the board’s annual assessment. Our guide to Consumer Duty and board composition covers what that means for hiring.

Frequently asked questions

Is SMF10 a PRA or an FCA function?

Both, depending on the firm. At dual-regulated firms SMF10 is a PRA function, approved by the PRA with FCA consent. At FCA solo-regulated firms it is an FCA function and applies only to enhanced firms.

Does every regulated firm need an SMF10?

No. Core and limited scope solo-regulated firms do not have one. Larger banks and insurers will generally need a risk committee and therefore a risk chair. Firms should confirm their position with their advisers.

Will SMF10 still need regulatory approval?

For now, yes. FCA CP26/37 and PRA CP14/26 propose moving SMF10 to a notification regime, but these are consultations closing on 22 January 2027. Until final rules are in force, approval is still required.

How long does SMF10 approval take?

The regulators have three months by statute from a complete application. Incomplete applications take longer. Firms should plan for the full window.

Can one person chair both the audit and risk committees?

Some smaller firms combine the two committees. Larger firms are usually expected to keep them separate. Where one person chairs a combined committee, the firm should take advice on which functions they hold and make sure the SoR covers both.

Further Reading and Authoritative Sources

The primary regulatory sources for SMF10 are the FCA’s SMCR pages and the PRA’s rulebook and supervisory statements. For the current state of reform, read the FCA’s PS26/6 policy statement on Phase 1, then the Phase 2 consultations: FCA CP26/37 and PRA CP14/26, both linked above. Remember that the Phase 2 papers are proposals and may change before final rules are made.

For wider governance standards, the FRC’s UK Corporate Governance Code, linked above, sets the independence and board effectiveness expectations most boards measure themselves against, whether or not they are formally bound by it. Its guidance on board effectiveness is also a useful reference when the board reviews how well its risk committee and its chair are performing.

Further Exec Capital guides on risk and board governance include the Director of Risk and Compliance job description and our overview of what the Senior Managers Regime means when recruiting at board level.