CRO Recruitment at Challenger Banks and Dual-Regulated Firms

The Chief Risk Officer role at a challenger bank or dual-regulated financial institution carries a set of demands that do not exist at FCA solo-regulated firms or at non-regulated businesses. Dual regulation by the FCA and PRA means the CRO must maintain constructive supervisory relationships with two regulators at once, each with distinct priorities and supervisory approaches. The PRA’s prudential focus — on capital adequacy, credit quality, liquidity, operational resilience and the firm’s ability to withstand stress scenarios — sits alongside the FCA’s conduct focus on customer outcomes, market integrity and the firm’s treatment of retail clients. The CRO must be credible in both registers.

At challenger banks specifically, the CRO appointment carries additional complexity. Challenger banks are typically at earlier stages of regulatory maturity than their established peers: their risk frameworks are still being built, their supervisory relationships are being established, and their risk culture is being formed under conditions of rapid commercial growth. The CRO at a challenger bank is not simply managing a mature risk framework. They are building one, often under time pressure and in a commercial environment where growth ambitions create real internal pressure to accept risk that the regulatory framework may not permit.

This guide sets out what the PRA and FCA expect of the SMF4 Chief Risk Officer at a deposit-taker, how the profile differs between a bank in mobilisation and one approaching scale, what changes with Basel 3.1 and the strong and simple regime from 1 January 2027, and how boards should run the search. For the wider service, see our CRO recruitment practice, and for the full role scope our Chief Risk Officer job description.

The PRA’s Expectations of the CRO at a Dual-Regulated Firm

The PRA’s supervisory approach to the CRO function at banks and insurers is more intensive than the FCA’s approach at solo-regulated firms. PRA expectations for risk governance require that the individual has direct access to the board and to the PRA, that they have genuine authority to challenge business decisions that exceed the firm’s risk appetite, and that their remuneration is structured to support independence from the business lines they oversee rather than creating financial incentives to align with commercial outcomes.

The PRA pays close attention to CRO appointments, and for CEO, CFO and CRO appointments a regulatory interview is a common part of the assessment, particularly at firms that are new, growing quickly or under heightened supervision. The interview focuses on the candidate’s understanding of the firm’s prudential risk profile — the credit book, the capital position, the funding structure, and the specific regulatory capital requirements that apply to the firm’s activities. A CRO candidate with strong conduct risk credentials but limited experience of prudential risk management will face real scrutiny, and an appointment that proceeds with residual concerns unaddressed can colour the firm’s supervisory relationship for some time.

In practice, the PRA is looking for three things in the person holding SMF4:

• Independence that holds under pressure. A reporting line to the board or the board risk committee, protected access to the chair of the risk committee, and evidence that the candidate has escalated against commercial colleagues when the facts required it.
• Prudential depth. Working command of credit risk, capital adequacy, liquidity and funding, interest rate risk in the banking book and stress testing — not just an oversight-level familiarity.
• Clear accountability. A Statement of Responsibilities that matches what the individual actually does. Our guide to Statements of Responsibilities and board appointments covers what boards should settle before an SMF application goes in.

The FCA’s interest is different but no less real. At a challenger bank with a retail customer base, the FCA will want to see that the CRO’s framework covers conduct risk, financial crime exposure and the Consumer Duty outcomes the firm is accountable for, and that the risk function and the compliance function work together rather than in parallel.

Challenger Bank CRO: The Build vs Manage Distinction

One of the most important questions in a challenger bank CRO search is whether the firm needs a risk builder or a risk manager. These are genuinely different profiles, and the best risk managers are not always the best risk builders — and vice versa.

The risk builder profile is appropriate for challenger banks at early regulatory maturity — firms that need to establish their risk appetite framework, build their credit risk assessment methodology, create their operational risk and control environment, and develop the management information and reporting that will allow the board to oversee the firm’s risk position meaningfully. The risk builder candidate typically has experience of standing up risk functions from scratch, of producing a first Internal Capital Adequacy Assessment Process (ICAAP) at a growing firm, and of managing the PRA relationship during the period when a new bank’s risk infrastructure is being evaluated against the regulatory standard for the first time.

The risk manager profile is appropriate for challenger banks that have built their core risk infrastructure and need sustained quality in risk oversight. The risk manager candidate has deep expertise in running a mature risk function — managing credit concentrations, monitoring risk appetite utilisation on an ongoing basis, supporting the risk committee effectively, and maintaining the PRA’s confidence in the firm’s risk management over multiple supervisory cycles. The two profiles overlap, but the balance between infrastructure building and operational risk management is different. Appointing a manager when the firm needs a builder, or a builder when the firm needs a manager, produces predictable and avoidable governance problems.

A practical way to decide is to look at the next three years of the business plan. If the plan involves a new product line, a move from specialist lending into retail deposits, a first IRB or model-heavy approach, or a capital raise that will bring new investors asking hard questions of the risk function, the firm usually needs at least some of the builder profile. If the plan is steady growth within the existing model, the manager profile is usually the better fit, and the board should prioritise depth in credit risk and stress testing over start-up experience.

The CRO at a New Bank in Mobilisation

New banks that take the PRA’s mobilisation route are authorised with restrictions while they complete their build. The PRA’s guidance on mobilisation describes a period of up to 12 months, a deposit cap of £50,000, and an expectation that the governance framework is fully developed before entry. At a minimum the chair, the CEO and one other executive (usually the CFO) must be in place, and control functions including Risk, Internal Audit and Compliance must be built out during mobilisation. The PRA also says it does not expect material changes to the individuals involved once mobilisation has started.

For the CRO search, that has three consequences. First, the CRO should be identified early — ideally before mobilisation begins — because a late hire compresses the time available to build the framework that the exit assessment will test. Second, the candidate has to be comfortable doing the work personally: writing the risk appetite statement, building the first ICAAP and ILAAP, setting up the risk committee’s information pack and preparing for supervisory meetings, often with a very small team. Third, the board should treat stability as part of the brief. A CRO who leaves part-way through mobilisation is a material change the PRA will want to understand.

Candidates who have been through a bank authorisation before are scarce, and many of them now sit at banks that have scaled. That is one reason boards at new banks often look at fintech recruitment markets more widely, including risk leaders from lending platforms, e-money institutions and payments firms who have prudential experience and are ready to step into a bank’s SMF4 seat.

The ICAAP and ILAAP: CRO Accountability at Challenger Banks

The Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP) are among the most significant regulatory deliverables for any PRA-regulated bank, and the CRO’s role in both is central. The ICAAP requires the bank to show the PRA that it has identified all material risks, assessed its capital needs under a range of stress scenarios, and holds a buffer adequate to absorb those stressed losses. The ILAAP requires a parallel assessment for liquidity and funding risk. Together, the two documents are the main way the PRA evaluates whether the bank is managing its prudential risks adequately.

For a challenger bank CRO, ownership of the ICAAP and ILAAP is one of the most demanding parts of the role. The PRA reviews these documents closely and will challenge stress assumptions, methodology and conclusions where it believes the firm’s self-assessment is too optimistic. A CRO who cannot defend the ICAAP in the Supervisory Review and Evaluation Process (SREP) — who cannot set out the firm’s credit concentration analysis, explain the key assumptions behind its capital projections, or engage credibly with questions about liquidity risk — is creating a supervisory problem the bank’s senior leadership will find hard to manage.

When assessing candidates, ask them to talk through an ICAAP they owned: which risks were hardest to quantify, where the PRA pushed back, what changed as a result, and how they explained the Pillar 2 outcome to the board. The quality of that answer is a better guide than any line on a CV. The CRO also needs a close working relationship with the credit function; our guide to the Chief Credit Officer in commercial banking explains how the two roles divide responsibility for the loan book.

The SMF4 Approval Process at Challenger Banks: PRA and FCA Dimensions

At a dual-regulated bank, the PRA leads on SMF4 approval and the FCA must consent. The two regulators assess the candidate against their respective priorities — the PRA on prudential risk management capability and the FCA on conduct risk oversight. For most CRO candidates at challenger banks, the PRA assessment is the more intensive and the more likely to involve an interview.

Under the current legislation, the regulators have three months from receipt of a complete application to reach a decision, and the clock can be affected by requests for further information. A growing bank should plan for the full period rather than hope for less, and confirm interim risk cover before the search begins rather than reactively when the vacancy arises. Our guide to how long SMF approval takes sets out a realistic planning timeline.

The process has been changing. The first phase of SM&CR reforms took effect on 24 April 2026 through FCA PS26/6 and PRA PS12/26, bringing practical changes such as a longer validity period for criminal record checks, relief from repeat checks when an existing senior manager moves to another SMF role in the same group, and a simpler approach to resubmitting Statements of Responsibilities. In October 2026 the regulators published their phase 2 proposals — the PRA’s CP14/26 and the FCA’s CP26/37. Under those proposals a number of SMFs, including the Chair of the Risk Committee (SMF10), would move from pre-approval to notification, but SMF4 Chief Risk would remain subject to pre-approval. The proposals also refer to a shorter, two-month statutory deadline for determining applications, which depends on legislation. The consultation closes on 22 January 2027 and the PRA expects implementation in the second half of 2027, so boards should plan on today’s rules for any CRO hire now in train.

The regulatory references required for the application add complexity for CRO candidates who have worked at several regulated firms over the previous six years, which is typical for senior risk professionals. Collecting and reviewing multiple references in a way that allows the board to understand their full content before the application is submitted needs dedicated process management, and Exec Capital provides this as part of every regulated firm search. For the broader picture of how the regime shapes board-level hiring, see what the Senior Managers Regime means when recruiting at board level.

What the Challenger Bank CRO Profile Looks Like

The candidate profile for a challenger bank CRO combines elements that are individually not rare but whose combination is genuinely scarce. Banking prudential risk expertise — direct experience of credit risk management, capital framework oversight and ICAAP/ILAAP responsibility — is the technical threshold. Without it, the candidate is unlikely to pass the PRA’s assessment and will not have credibility with either the PRA supervisory team or the bank’s own risk function.

Challenger bank or high-growth experience comes next: having operated where the commercial growth agenda creates persistent pressure on the risk function, where the risk infrastructure is being built or improved under time pressure, and where the CRO must balance the requirement for independence with the reality of being part of a leadership team trying to build a competitive bank. Candidates whose whole risk career has been at large, established banks may find the challenger environment, with its higher volatility and more intense commercial pressure, quite different from what they know.

PRA supervisory relationship experience is the third element — having managed the PRA relationship as the named CRO, including SREP meetings, capital dialogue and the handling of supervisory concerns. This is a significant differentiator because it cannot easily be developed in a second-line advisory role. It requires having been the individual in the room when the PRA is challenging the bank’s risk assessment, and having managed that interaction well.

Beyond these three, boards should test for:

• Lending model fit. A CRO from unsecured consumer credit is not automatically right for a bank lending to property investors or SMEs. Sector knowledge of the loan book matters.
• Treasury and funding literacy. Deposit-funded growth, concentration in fixed-term savings and the use of central bank facilities all sit within the CRO’s view of liquidity risk.
• Operational resilience and technology risk. Most challenger banks run on modern, often outsourced technology stacks, and the CRO must be able to oversee third-party and cyber risk credibly.
• Board communication. The ability to turn a complex risk position into a clear message for non-executives and investors.

Our guide on how to hire a CRO covers interview design and assessment in more detail.

Working with Exec Capital

Exec Capital places Chief Risk Officers at challenger banks and dual-regulated financial institutions on permanent and interim terms, with a specific understanding of the PRA/FCA dual approval process and the prudential capability that distinguishes the CRO role at a bank from the same function at other firm types. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate.

A typical engagement starts with a briefing session with the CEO, the chair of the risk committee and, where relevant, the investors. We use that session to agree whether the role is a build or manage brief, what the PRA will want to see, the reporting lines and Statement of Responsibilities, and how interim cover will work if the seat is vacant. The search then runs against that agreed brief, with candidates assessed on prudential depth, supervisory experience and fit with the bank’s lending model before they reach the board.

Once a preferred candidate is identified, we support the board on the regulatory references, the fitness and propriety assessment and preparation for any PRA interview, and stay involved until approval is granted and the CRO is in post. To discuss a CRO search, call 0203 834 9616 or email recruitment@execcapital.co.uk.

The CRO’s Role in Capital Planning at Growing Banks

Capital planning is one of the most consequential parts of the CRO’s role at a challenger bank, and one where the tension between commercial ambition and regulatory prudence is most directly felt. A growing bank that is expanding its loan book, launching new products or entering new markets is consuming regulatory capital at a rate that requires continuous forward planning to keep adequate buffers above minimum requirements. The CRO is responsible for making sure the board and the PRA have a clear and honest assessment of the capital position under both base case and stress scenarios, and for escalating concerns when the growth plan would consume capital the bank’s current base cannot comfortably absorb.

At challenger banks that are pre-profit or in the early stages of profitability, capital planning is complicated by limited internal capital generation. The CRO must weigh the commercial case for continued growth investment against the prudential requirement to stay adequately capitalised, and must be prepared to present an honest view to both the board and the PRA — including where that view is that the current plan is inconsistent with holding adequate buffers under stress. This is the kind of independent challenge the SMF4 role exists to provide, and it is exactly the kind of challenge commercial pressure creates the strongest incentive to avoid.

The CRO and CFO must work closely here without blurring their roles. The CFO typically owns the financial plan and the capital raise; the CRO owns the independent view of whether the risks in that plan are understood, measured and within appetite. Boards that hire a CRO who defers to the CFO on capital, or one who cannot work with the CFO at all, will see the effect in their next SREP.

Basel 3.1 and the Strong and Simple Regime: What Changes for the CRO

Two prudential changes take effect on 1 January 2027 and both bear directly on the challenger bank CRO’s brief.

The first is Basel 3.1. The PRA’s final rules were published in January 2026 in PS1/26, with the policy taking effect on 1 January 2027 following a one-year delay announced in January 2025. For banks using the standardised approach, the revised risk weights change how capital is calculated across the loan book, and the CRO needs to understand where the new rules raise or lower requirements for the bank’s particular asset mix.

The second is the strong and simple framework for Small Domestic Deposit Takers (SDDTs). The PRA’s strong and simple pages set out the eligibility criteria — including average total assets of £20 billion or less, a predominantly UK credit book, a limited trading book and no IRB models — and confirm that the simplified capital regime, finalised in PS4/26, applies from 1 January 2027. Eligible firms opt in by accepting a modification by consent; liquidity and disclosure simplifications were introduced earlier.

For many challenger banks this creates a strategic choice that the CRO should help the board make: whether to opt into the SDDT regime, and how the growth plan interacts with the eligibility thresholds over time. A bank that expects to grow beyond the scope criteria, or to adopt internal models, needs to plan its exit route from the simpler regime well in advance. Candidates who can speak credibly about these choices, and about how they would prepare the ICAAP and stress testing for the new rules, stand out in the current market.

Managing the PRA Supervisory Relationship as a Challenger Bank CRO

The PRA’s supervisory approach to challenger banks reflects the prudential risks specific to newer banking businesses — concentrated loan books, a limited track record of credit performance through a full cycle, funding models that may be less diversified than established banks, and governance frameworks that are still maturing. The CRO is the main management interface with the PRA on prudential risk, and the quality of that relationship directly affects the bank’s supervisory risk profile and its ability to execute its commercial strategy without regulatory friction.

CROs who build constructive, transparent relationships with the PRA supervisory team — who communicate material risk developments before they appear in regulatory data, who engage substantively with the regulator’s questions about the bank’s risk models, and who show that risk governance is genuinely independent rather than commercially compromised — tend to produce better supervisory outcomes than those whose relationship with the PRA is reactive and information-limited. Building this relationship requires both the personal credibility that comes from a strong technical risk background and the interpersonal skill to manage a relationship that is inherently weighted in the regulator’s favour.

When interviewing, ask candidates to describe a time the PRA raised a concern they did not initially agree with, how they responded, and what the outcome was. Good answers show the candidate engaging on the substance, keeping the board informed and resolving the issue without either capitulating or becoming defensive.

Interim CRO Cover During the Search

A vacant SMF4 seat at a bank is a governance risk in itself. If the CRO resigns, is unable to continue or the firm needs to change the post-holder, the board needs a credible person in the role while the permanent search and approval run their course. The SM&CR’s 12-week rule allows a firm to appoint someone to cover an SMF role for up to 12 weeks in a consecutive 12-month period without pre-approval where the absence is temporary or reasonably unforeseen. Following the phase 1 reforms, breaches by individuals operating under the 12-week rule must be reported, so boards should track the dates carefully.

For many challenger banks, the 12-week window is not long enough to cover a full search plus approval, so the practical answer is an interim CRO who is either already approved for SMF4 elsewhere or can be put forward for approval quickly. An experienced interim can also be valuable during a specific project, such as a first ICAAP, preparing for mobilisation exit, or getting ready for Basel 3.1 or the SDDT regime, before a permanent CRO takes over a function in better shape.

Frequently asked questions

Does a challenger bank CRO need PRA and FCA approval?

Yes. At a dual-regulated bank, SMF4 Chief Risk is approved by the PRA with the FCA’s consent. Under the phase 2 proposals published in October 2026, SMF4 would remain a pre-approved role.

How long does SMF4 approval take?

The current statutory period is three months from a complete application. The phase 2 proposals refer to a shorter two-month deadline, but that depends on legislation and is not yet in force.

Can the CRO also hold the compliance or CFO role?

At a bank this is rarely appropriate. The CRO’s independence from the business, and from the finance function that owns the plan, is central to what the PRA expects of SMF4.

Should a new bank hire its CRO before or during mobilisation?

Ideally before. The PRA expects key senior roles to be identified early and control functions, including Risk, to be built out during mobilisation, and it does not expect material changes to individuals once mobilisation has started.

What changes for the CRO on 1 January 2027?

Basel 3.1 takes effect for UK banks, and the simplified capital regime for eligible Small Domestic Deposit Takers applies to firms that opt in. Both affect capital planning, stress testing and the ICAAP.