Chief Compliance Officer Job Description

The Chief Compliance Officer is the senior executive responsible for the organisation’s compliance framework — the policies, controls, monitoring and governance that ensure the business operates within its legal, regulatory and ethical obligations. In FCA-regulated firms, the CCO typically holds a Senior Management Function under the Senior Managers and Certification Regime, carrying direct personal accountability to the regulator for the compliance oversight of the firm. This guide covers what the CCO mandate involves across different business types and regulatory environments, how to write a job description that attracts the right candidate, the CCO vs CRO and General Counsel distinctions, what drives CCO compensation, and the qualifications and experience worth testing for.

The CCO is one of the most frequently misrecruited roles in financial services. Boards that hire for technical compliance knowledge alone get a function head who can document a framework but cannot challenge the business when the commercial pressure to take on risk is highest. Boards that hire for seniority and boardroom presence without enough regulatory depth get a CCO who cannot engage credibly with the FCA or withstand scrutiny at a supervisory visit. The CCO who combines genuine regulatory expertise with the commercial judgement to apply it proportionately — and the personal authority to hold the line with a CEO who disagrees — is a specific and scarce profile. Writing the brief correctly is where the search succeeds or fails, and it is the starting point for every mandate our compliance and risk recruitment team takes on.

What is a Chief Compliance Officer?

The Chief Compliance Officer is the most senior executive with specific accountability for the organisation’s compliance with its regulatory, legal and ethical obligations. The CCO designs and maintains the compliance framework — the policies, procedures, monitoring programme and governance structures that enable the business to identify, manage and report compliance risk — and provides independent oversight of the first line of defence: the business units and functions that own compliance in their day-to-day operations.

The CCO sits in the second line of defence in the three-lines model — independent of the revenue-generating and operational functions whose conduct they oversee, but not so removed from the business that they cannot provide practical guidance and proportionate challenge. This independence is the defining characteristic of an effective compliance function. A CCO who is too embedded in the first line loses the objectivity to challenge it. A CCO who is too remote from it loses the commercial understanding to oversee it intelligently.

The CCO mandate varies significantly across sectors and business types. In FCA-regulated financial services firms — banks, insurers, investment managers, wealth managers, consumer credit firms, payments and e-money firms, and others — the compliance function carries formal regulatory accountability under the Senior Managers and Certification Regime, and the CCO’s relationship with the FCA is an active and consequential part of the role. In pharmaceutical, healthcare and life sciences businesses, the compliance function focuses on clinical trial regulation, product safety and interactions with healthcare professionals under MHRA oversight. In technology businesses, compliance increasingly covers data protection, AI governance and sector-specific rules. In each context the skills and experience required of the CCO differ meaningfully, and the job description must reflect the specific regulatory environment rather than a generic compliance framework.

Title also varies with scale. In a large group the CCO may sit above a Head of Compliance in each regulated entity; in a smaller firm, the Head of Compliance is the most senior compliance executive and holds the regulatory function directly. What matters for the job description is not the title but the accountability: who signs off the compliance monitoring plan, who reports to the board on compliance risk, and who the FCA will hold responsible when something goes wrong.

The CCO in FCA-Regulated Firms — SMCR and Senior Management Functions

In firms regulated by the Financial Conduct Authority, the compliance function operates within the Senior Managers and Certification Regime — the framework that assigns individual accountability for the governance of regulated firms to named senior managers. The CCO in an FCA-regulated firm typically holds one or more of the following functions or responsibilities.

SMF16 — Compliance Oversight. The Compliance Oversight function carries personal accountability for the firm’s compliance oversight and for the operation of its compliance monitoring programme. The SMF16 holder must be able to show the regulator that they have the authority, resource and independence to perform effective oversight — and that the firm’s compliance arrangements are proportionate to the nature, scale and complexity of its regulated activities. The underlying requirement for a permanent, effective and independent compliance function sits in SYSC 6.1 of the FCA Handbook, which is worth reading alongside any CCO brief because it sets out what the function must be able to do. Firms recruiting specifically for this function should see our SMF16 Head of Compliance recruitment service.

SMF17 — Money Laundering Reporting function (MLRO). In firms subject to the Money Laundering Regulations 2017, the MLRO carries specific accountability for the firm’s anti-money laundering framework — the systems and controls that detect, prevent and report suspected money laundering and terrorist financing. The MLRO is usually also the nominated officer for submitting Suspicious Activity Reports to the National Crime Agency. In smaller firms, SMF16 and SMF17 are frequently held by the same person. In larger or more complex firms they are typically held separately by people with different specialist expertise. Whether to combine them is one of the first structural decisions in a CCO brief, and we set out the trade-offs in SMF16 vs SMF17: one, both or a combined role.

Consumer Duty. Since July 2023, the FCA’s Consumer Duty has required regulated firms to deliver good outcomes for retail customers across products and services, price and value, consumer understanding and consumer support. The CCO plays a central role in the Duty, both in designing the firm’s framework and in providing independent oversight of whether the firm is genuinely delivering the outcomes it requires. The FCA has been clear that Consumer Duty compliance is not a documentation exercise — it requires evidence of actual outcomes, reported to the board — and a CCO who cannot demonstrate that distinction in practice will struggle under supervisory scrutiny.

Recent and proposed changes to SMCR. The regime is being reformed in two phases. Phase 1 was finalised in the FCA’s PS26/6, with most changes in force from 24 April 2026; these were largely process changes aimed at reducing administrative burden, such as streamlining how Statements of Responsibilities and related documents are submitted, rather than changes to who is accountable for compliance. Phase 2 is still a proposal: CP26/37, published in October 2026, consults on removing certain SMFs, making some others notification-only, raising the Enhanced regime thresholds and removing the Certification Regime. SMF16 is not among the functions proposed for removal or notification-only, so on the proposals as published the Compliance Oversight function stays subject to FCA pre-approval. Final rules are not expected until 2027, so CCO briefs written now should still plan for a full SMF application and allow for the time it takes.

Core CCO Responsibilities

Compliance framework design and governance. The CCO designs and maintains the compliance framework — the policies, procedures, controls and governance structures that enable the firm to identify, manage and report compliance risk across its regulated activities. This includes the firm’s compliance policy suite, its regulatory permissions and SMF records, its conflicts of interest framework, and the governance processes through which compliance matters are escalated to the executive committee and board. A compliance framework that exists as a set of documents but is not embedded in the behaviour of the business is not a compliance framework — it is a liability.

Regulatory monitoring and horizon scanning. The CCO tracks the regulatory agenda — FCA consultations and policy statements, Dear CEO letters, supervisory statements, enforcement outcomes against comparable firms, and wider legislative change — and turns it into timely, practical guidance for the business. The SMCR reforms described above are a live example: a CCO should already be able to tell the board what PS26/6 changed for the firm and what CP26/37 might change next. A CCO who spots a change that affects the business model months before it takes effect gives the firm time to adapt rather than scramble. This requires genuine regulatory expertise and a maintained network across the industry.

Compliance monitoring and testing. The CCO runs the firm’s compliance monitoring programme — the systematic, risk-based review of regulated activities to verify that they are conducted in line with the framework and the FCA’s rules. This includes thematic reviews, file reviews, call and communications monitoring, and testing of key controls. The output of the programme — what is working, what is not, and what remediation is required — is one of the most important inputs to the board’s assessment of the firm’s compliance health and its regulatory risk exposure.

Regulatory relationship management. In FCA-regulated firms, the CCO manages the firm’s primary relationship with the regulator — the principal point of contact for supervisory visits, information requests, notifications and the ongoing supervisory dialogue. The FCA’s confidence that the CCO is candid, competent and in control of the compliance function is one of the most important factors in how the firm is treated when things go wrong. A CCO who has built credibility with the regulator is a material asset. One who has not is a weakness that shows up at the worst possible moment.

Board and audit committee reporting. The CCO reports on compliance matters to the board and, where it exists, the audit and risk committee — giving a regular assessment of compliance risk exposure, the performance of the monitoring programme, significant regulatory developments, and any material issues or breaches. This reporting must be accurate, timely and presented in terms that allow genuine board oversight rather than simply recording the compliance function’s activity. It now includes contributing to the board’s annual Consumer Duty assessment. A CCO who sanitises board reporting to manage internal relationships is not performing the role.

Compliance training and culture. The CCO ensures that all relevant staff understand their compliance obligations and have the training and guidance to meet them. This includes mandatory regulatory training, Conduct Rules training, product and conduct training for front-line staff, and the cultural work that shapes how compliance is treated in the business — as a genuine obligation or as a bureaucratic constraint to be minimised. A CCO who measures training completion rather than the quality of understanding it produces is measuring the wrong thing.

AML and financial crime compliance. In firms subject to the Money Laundering Regulations, the CCO — or a dedicated MLRO working alongside the CCO — is responsible for the anti-money laundering framework: the firm-wide risk assessment, customer due diligence, transaction monitoring, sanctions screening, suspicious activity reporting, and the training and governance that make sure these obligations are met. The regulatory and criminal consequences of AML failures, for the firm and for the individuals accountable, make this one of the highest-stakes parts of the mandate.

Breach management and remediation. When something goes wrong — a rule breach, a customer harm event, a failed control — the CCO owns the process of identifying it, assessing whether it is notifiable, reporting it to the regulator where required, and overseeing remediation and redress. How a candidate has handled a significant breach is often the most revealing part of a CCO interview.

CCO Job Description Template

The template below is written for an FCA-regulated firm. Copy it into your own document and replace the bracketed text with the details of your firm. Delete anything that does not apply — a job description that lists every compliance responsibility in the Handbook tells candidates nothing about the actual job.

Job title: Chief Compliance Officer (CCO) [add: and MLRO, where the roles are combined]

Reports to: Chief Executive Officer [with a direct reporting line to the board, or the chair of the audit and risk committee, on compliance matters to preserve independence]

Senior Management Functions held: [Insert: SMF16 — Compliance Oversight; SMF17 — Money Laundering Reporting; as applicable to the firm’s permissions and SMCR category] [Insert any Prescribed Responsibilities allocated to the role]

Location and working pattern: [Insert: office location, hybrid arrangements, and whether the role is full-time, interim or fractional]

Team: [Insert: number and seniority of direct reports, e.g. compliance monitoring, advisory, financial crime]

Purpose of the role: The Chief Compliance Officer is responsible for the design, maintenance and independent oversight of the firm’s compliance framework. The CCO ensures the firm meets its obligations under FCA rules and all applicable legislation, manages the firm’s relationship with its regulators, and provides the board with independent and accurate reporting on the firm’s compliance risk exposure and the performance of the compliance function. The CCO holds the compliance SMF under the Senior Managers and Certification Regime and carries personal accountability to the FCA for the compliance oversight of the firm.

Key accountabilities:

• Design and maintain the compliance framework — policies, procedures, controls and governance — proportionate to the nature, scale and complexity of the firm’s regulated activities.
• Run a risk-based compliance monitoring programme, providing independent oversight of the first line and accurate reporting to the board on compliance risk exposure.
• Manage the firm’s primary regulatory relationship as the principal point of contact for FCA supervisory engagement, notifications and information requests.
• Monitor regulatory change and give the business timely, practical guidance on changes that affect its activities.
• Oversee the firm’s Consumer Duty framework, ensuring the firm can evidence good outcomes for retail customers across all four outcome areas, and contribute to the annual board report.
• Lead the AML and financial crime framework — or work alongside a dedicated MLRO — ensuring customer due diligence, monitoring and suspicious activity reporting meet the requirements of the Money Laundering Regulations.
• Own breach identification, regulatory notifications and remediation oversight.
• Deliver compliance and Conduct Rules training across the firm.
• Report to the board and audit and risk committee with the independence and candour the role requires.
• [Insert any firm-specific items, e.g. supporting a variation of permission, a new product launch or a remediation programme.]

Person specification — experience:

• Significant experience in a senior compliance leadership role in a comparable FCA-regulated environment, with direct regulatory interaction.
• A track record of designing or substantially developing a compliance framework at comparable scale and complexity.
• Experience holding, or readiness to hold, a Senior Management Function, with a clear understanding of the personal accountability it carries.
• [Insert: specific regulated activity experience — investment management, retail banking, consumer credit, insurance, payments, wealth management — as applicable to the firm’s permissions.]
• Experience presenting compliance matters to a board or audit committee.

Person specification — skills and attributes:

• Regulatory depth — enough expertise in FCA rules, guidance and supervisory expectations to engage credibly with the regulator and make sound judgements without external support on routine matters.
• Independence and personal authority — the ability to challenge the business, the CEO and the board when the evidence requires it, without creating an adversarial dynamic that makes the function ineffective.
• Commercial proportionality — the ability to apply requirements in a way that manages risk without creating needless barriers to the firm’s business.
• Communication — the ability to turn regulatory complexity into clear guidance for a non-specialist audience, and to report compliance risk accurately to the board.
• Integrity — the willingness to raise concerns and hold the line on standards under commercial or executive pressure is the defining quality of the most effective CCO appointments.

Qualifications: [Insert: e.g. ICA or CISI compliance qualification preferred; legal qualification or ACAMS certification desirable where the role covers financial crime.]

Package: [Insert: base salary range, bonus eligibility and structure, pension, benefits, and any deferral or malus and clawback terms.]

Getting the brief right before you advertise

Most CCO searches that stall do so because the brief was not settled before the search began. Four questions are worth answering in writing before the job description goes out.

• Build, fix or maintain? A firm going through authorisation needs someone who has built a function from nothing. A firm with a supervisory issue needs someone who has led remediation under scrutiny. A firm with a settled function needs a steady pair of hands. These are different candidates.
• Which SMFs, and combined or split? Decide whether the role holds SMF16 alone or SMF16 and SMF17, and which Prescribed Responsibilities it will carry. This changes the candidate pool.
• Full-time, interim or fractional? Smaller firms often do not need a full-time CCO, but they do need someone of CCO calibre. A fractional appointment can hold the SMF and run the framework for a set number of days a month. Where a CCO has left suddenly or a regulatory deadline is close, an interim appointment may be the right first step.
• Who does the CCO challenge, and with what backing? Write down the reporting line to the board and how the CCO can escalate. Strong candidates will ask, and a weak answer loses them.

Our CCO recruitment process starts with these questions, and our wider compliance recruitment work covers the team beneath the CCO as well as the role itself.

CCO vs Chief Risk Officer vs General Counsel

The Chief Compliance Officer, Chief Risk Officer and General Counsel carry related but distinct mandates that are frequently confused — particularly in smaller regulated firms where the functions may be combined or where the boundaries between them are not clearly defined.

The CCO is specifically accountable for regulatory compliance — ensuring the firm meets its obligations to the FCA and other regulators. The Chief Risk Officer is accountable for the firm’s broader risk management framework — financial, operational, credit and market risk — within which regulatory compliance risk sits as one element. In firms where both roles exist, the CCO and CRO need a clearly defined boundary and a working relationship that avoids both duplication and gaps. In smaller firms, the two functions are frequently combined under a single Chief Risk and Compliance Officer or Head of Risk and Compliance. Our Chief Risk Officer job description sets out the CRO side of that boundary.

The General Counsel is the firm’s most senior lawyer, accountable for legal risk and the firm’s legal obligations — including contractual, litigation, employment and corporate governance matters. The General Counsel’s remit overlaps with the CCO’s where legal and regulatory obligations intersect — data protection, financial crime and certain conduct obligations — but the two roles carry different expertise and different accountability. In firms where both exist, clarity about who owns which obligations is essential to avoid the gaps that arise when each function assumes the other is covering an area.

A practical test: if a new rule is published, the CCO decides what the firm must do to comply; the CRO assesses how it changes the firm’s risk profile and appetite; the General Counsel advises on the legal interpretation and any contractual consequences. Writing those boundaries into each job description saves a great deal of friction later.

CCO Salary — What Drives the Package

CCO pay in the UK varies too widely for a single figure to be useful in a job description guide, so rather than quote ranges here we point to the factors that move the package and to our SMF salary guide, which we keep updated for compliance and other senior manager roles. The main drivers are:

• Firm size and regulatory complexity. A CCO at a dual-regulated bank or large insurer carries a very different load from one at a boutique adviser or small consumer credit firm, and is paid accordingly.
• The SMFs and Prescribed Responsibilities held. Holding SMF16 and SMF17 together, or taking on additional responsibilities, widens personal accountability and usually lifts the package.
• Situation. Authorisation projects, remediation under supervisory scrutiny and enforcement aftermath all narrow the pool of credible candidates and push pay up.
• Sector and location. Wholesale markets, payments and crypto firms compete hard for experienced compliance leaders; London roles generally pay more than regional equivalents.
• Bonus and remuneration rules. In larger firms, remuneration codes can affect bonus structure, deferral and clawback, which matter to candidates as much as headline base.
• Engagement model. Interim CCOs are usually engaged on a day rate, and fractional CCOs on a monthly retainer for a set number of days, which can make an experienced CCO affordable for a smaller firm.

The personal accountability attached to SMF16 is a real factor in pay: candidates are taking on regulatory risk that cannot be delegated, and the best of them will weigh the firm’s culture, resourcing and board support as carefully as the number on the offer.

CCO Qualifications — What to Look For

There is no single standard qualification route to the CCO role. The International Compliance Association (ICA) and the Chartered Institute for Securities & Investment (CISI) both offer compliance qualifications that are widely held by compliance professionals in UK financial services. Legal qualifications — particularly where the CCO’s mandate has significant legal risk overlap — are common among senior candidates. The CAMS (Certified Anti-Money Laundering Specialist) qualification from ACAMS is a widely recognised credential for MLRO-level AML expertise.

What distinguishes the strongest CCO candidates is not qualification level but the depth and relevance of their regulatory experience — specifically whether they have managed a supervisory visit or enforcement investigation, whether they have held an SMF with direct regulatory accountability, and whether they have built or rebuilt a compliance function rather than simply maintained one that was already working. These experiences test the judgement and authority the role demands in a way that running a steady-state function does not.

Useful interview areas include:

• A time the candidate told a CEO or board something they did not want to hear, and what happened next.
• How they built the last compliance monitoring plan they owned, and what they dropped from it and why.
• The most serious breach they have managed, including whether and how it was notified.
• How they evidence Consumer Duty outcomes to a board, not just processes.
• What PS26/6 changed at their current firm, and what they expect from the Phase 2 proposals.

Because the CCO will need FCA approval for the SMF, fitness and propriety checks, regulatory references and criminal records checks should be planned into the timetable from the start, not left until an offer has been accepted.

Frequently asked questions

Does every FCA-regulated firm need a Chief Compliance Officer?

Not by that title. Most firms must have a compliance function under SYSC 6.1, and many need an approved SMF16 holder, but in a small firm that may be a Head of Compliance, a combined compliance and MLRO role, or a fractional appointment.

Can the CCO also be the MLRO?

Yes. In smaller firms SMF16 and SMF17 are often held by one person. Larger or higher-risk firms usually separate them so each gets specialist attention.

Will the SMCR reforms remove the need for SMF16 approval?

On the proposals published in CP26/37, no: SMF16 is not among the functions proposed for removal or notification-only. The consultation is not final, so check the FCA’s policy statement when it is published.

Who should a CCO report to?

Usually the CEO for line management, with direct access to the board or the chair of the audit and risk committee on compliance matters so independence is protected.

Should we hire a permanent, interim or fractional CCO?

It depends on scale and urgency. Permanent suits a settled, larger function; interim covers a sudden gap or remediation; fractional suits smaller firms that need CCO judgement for a few days a month.