Compliance and Risk recruitment

Compliance and Risk Recruitment

Exec Capital provides senior compliance and risk recruitment for UK firms across financial services, professional services, healthcare, technology, manufacturing and broader regulated industry. Compliance and risk leadership has moved substantively from operational support function into senior strategic accountability over the past decade — driven by SMCR for FCA-regulated firms, GDPR and broader data protection law, the substantial growth of operational risk programmes, and the increasing personal accountability that boards and senior leaders carry under UK regulation. The senior roles — Chief Risk Officer, Compliance Director, Chief Compliance Officer, Head of Risk, MLRO — now sit at C-suite or senior director level at most substantial firms, with substantive accountability that warrants substantive search work.

Our practice covers UK senior compliance and risk appointments across firms with substantial regulatory exposure — FCA-regulated firms (where the Senior Managers and Certification Regime applies and the Compliance Director is often an SMF holder), data-intensive businesses with substantive privacy and information security obligations, and firms in transformation or M&A contexts where compliance and risk leadership is central to substantive commercial outcomes. Every senior mandate is led personally by Adrian Lawrence FCA.

Senior compliance roles we recruit

Chief Compliance Officer (CCO). Senior C-suite compliance leadership at substantial firms. Substantive accountability for the firm’s compliance framework across regulatory, conduct, financial crime and (where relevant) data dimensions. At FCA-regulated firms, often combined with SMF16 (Compliance Oversight) responsibility.

Compliance Director. Senior director-tier compliance leadership at mid-market firms or specialist compliance leadership at larger firms. Often the operational lead under a CCO at the largest firms; often the most senior compliance role at mid-market firms.

Money Laundering Reporting Officer (MLRO). The substantive UK regulatory role under SMF17 for FCA-regulated firms. Personal accountability for the firm’s anti-money-laundering framework and SARs reporting.

Head of Compliance / Head of Regulatory. Senior compliance leadership at specialist scope — often sub-sector specific (asset management compliance, banking compliance, insurance compliance, fintech compliance).

Senior compliance specialists. Heads of Conduct, Heads of Financial Crime, Heads of Regulatory Change, Heads of Compliance Monitoring & Testing — substantive specialist senior roles at firms with deep compliance functions.

Senior risk roles we recruit

Chief Risk Officer (CRO). Senior C-suite risk leadership at substantial firms. Substantive accountability for the firm’s risk framework across credit, market, operational, regulatory and (where relevant) emerging risk dimensions. At FCA-regulated firms, the SMF4 holder.

Risk Director. Senior director-tier risk leadership at mid-market firms or specialist risk leadership at larger firms. Common pattern at mid-market FCA-regulated firms where risk and compliance are combined into a single senior role.

Operational Risk Director. Specialist senior leadership of the operational risk function — particularly central in banking, insurance, asset management and substantial professional services contexts. Substantive responsibility for the operational risk framework, RCSAs, key risk indicators, and operational resilience.

Information Security Risk Officer (CISO / Head of Information Security). Senior leadership of the information security and cyber risk function. Increasingly central as cyber threat exposure has grown and substantial regulatory expectation has crystallised through DORA (for in-scope firms), the FCA’s operational resilience framework, and broader UK cyber security policy.

Senior risk specialists. Heads of Credit Risk, Heads of Market Risk, Heads of Enterprise Risk, Heads of Risk Analytics — substantive specialist senior roles at firms with deep risk functions.

The candidate pool

Senior compliance and risk candidates come from substantively different backgrounds depending on the role and firm context. For senior compliance roles, the substantive pools are: sitting Compliance Directors and CCOs at peer firms; senior compliance leaders stepping up from Heads of Compliance roles; senior partners and directors from compliance consulting practices (particularly common at the CCO end of the market); and senior ex-regulator candidates transitioning to industry compliance leadership.

For senior risk roles, the pools are: sitting CROs and Risk Directors at peer firms; senior risk specialists stepping up from Head of Risk roles; senior partners and directors from risk consulting practices; senior ex-Big-4 risk advisory leaders; and senior ex-regulator candidates particularly common in the CRO pool at FCA-regulated firms.

The substantive shape of the candidate pool depends materially on the firm’s regulatory context. FCA-regulated firms appointing SMF4 (CRO) or SMF16 (Compliance Oversight) holders need candidates with substantive prior SMF experience or substantive credentials that will pass FCA fit-and-proper assessment. Non-regulated firms have substantively wider pools but typically benefit from candidates with prior regulated-firm experience for the substantive perspective they bring on regulatory risk dimensions.

The substantive specification work

Strong senior compliance and risk searches start with substantive specification work covering five dimensions.

Reporting line and board engagement. Direct CEO report or via another senior leader. Direct board access for risk and compliance matters. Frequency and substance of board-level reporting.

Substantive scope. Compliance only, risk only, or combined. Sub-sector specialisation (banking, asset management, insurance, fintech). Geographic scope where applicable.

Regulatory dimension. Whether the role is SMF or not. Whether the firm has substantive recent regulatory matters (enforcement, supervisory, skilled persons reviews). The substantive cooperation history with regulators.

Team and budget. Existing team size and quality. Substantive budget under the role’s control. Realistic team-build trajectory if the firm is investing in the function.

Substantive standing. The dimensions captured in the founder panel above — board engagement, ability to challenge, the firm’s substantive cultural posture toward compliance and risk as substantive senior functions rather than oversight afterthoughts.

Further reading

For substantive treatment of FCA-regulated firm senior appointments and the SMCR framework, see our SMF Roles Guide, our role-specific guide on SMF4 Chief Risk Officer, our SMF5 Head of Internal Audit guide, and our broader FCA-regulated firm executive recruitment hub.

For role-specific senior hiring guides, see our CRO hiring guide, our Chief Compliance Officer hiring guide, our Audit and Risk Committee Chairs guide, and the rest in our Knowledge Centre.

For audit-qualified senior internal audit appointments, see our sister firm Accountancy Capital, the primary specialism in our portfolio for senior audit and accountancy-qualified roles. For UK regulatory frameworks underpinning senior compliance and risk appointments, see the FCA Senior Managers and Certification Regime, the PRA for dual-regulated firms, and the ICO for data protection senior accountability.