CRO Recruitment

Chief Risk Officer Recruitment

The Chief Risk Officer is one of the most consequential appointments any organisation makes. In a well-governed business, the CRO sits at the intersection of strategy, regulation, and operational resilience — providing the independent risk oversight that enables the board, the CEO and the management team to make decisions with a clear understanding of their exposure. In a poorly governed one, the CRO role is a compliance function in disguise, producing risk reports that are read and filed rather than acted upon. The difference between these two outcomes is almost entirely determined by the quality of the individual in the role and the clarity of their mandate.

Exec Capital places Chief Risk Officers with UK businesses across every sector — on a permanent, interim and fractional basis. Our search work covers both commercial organisations where the CRO is building or maturing a risk framework, and regulated firms where the CRO holds the SMF4 Senior Management Function and carries personal regulatory accountability — that is, Enhanced-tier FCA firms and dual-regulated banks, building societies and insurers. At Core-tier FCA firms the risk lead is not an SMF, which changes the brief, the timetable and often the right engagement model. Every CRO search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate.

How It Works: Hiring a CRO with Exec Capital

Every CRO search follows the same six stages. The detail inside each stage changes with the firm — a dual-regulated bank needs the regulatory approval built into the plan from day one, while a PE-backed manufacturer building its first enterprise risk function does not — but the sequence holds. We agree the timetable with you at briefing, once we understand the market for the profile you need and any regulatory steps involved.

What a Chief Risk Officer Does

The CRO’s primary accountability is to own the firm’s risk management framework — to define the risk appetite in partnership with the board and CEO, to design and embed the systems and controls that manage risk within that appetite, and to provide independent challenge when business decisions carry risk that the organisation may be inadequately pricing or managing. In organisations with mature risk functions, the CRO is a genuine strategic partner to the CEO, bringing risk intelligence into business planning rather than simply assessing business decisions after they have been made.

The specific scope of the CRO’s role varies significantly by sector and by the maturity of the organisation’s risk management. At a financial services firm, the CRO oversees credit risk, market risk, liquidity risk, operational risk, and regulatory risk — and at an Enhanced-tier or dual-regulated firm, these responsibilities are attached to a personal regulatory designation that makes the individual accountable to the regulator as well as to the board. At a technology or professional services business, the CRO’s focus may be primarily on operational and cyber risk, business continuity, and the management of third-party and supply chain risk. At a manufacturing or infrastructure business, health, safety and environmental risk may dominate alongside the commercial and financial risk dimensions.

Across all of these contexts, the CRO function shares certain core characteristics: independence from the business lines whose risk they oversee, a direct reporting line to the board or a board committee (typically the Risk Committee), and sufficient authority within the governance structure to provide genuine challenge rather than post-hoc assessment. A CRO who cannot speak truth to a powerful business leader, or whose risk assessments are overridden without adequate escalation to the board, is not performing the function regardless of their technical credentials. Our Chief Risk Officer job description sets out the typical responsibilities in more detail if you are drafting a role profile.

Note that CRO in this context means Chief Risk Officer. Some technology and sales-led businesses use the same initials for a Chief Revenue Officer; that is a commercial role and a different search. If you are unsure which your organisation needs, we will say so at briefing.

When Businesses Hire a CRO

The decision to appoint a Chief Risk Officer typically reflects one of several triggers. Regulatory requirement is the most binary — at Enhanced-tier FCA firms, the chief risk function is a Senior Management Function (SMF4) that must be held by an approved individual, and the FCA expects that individual to be genuinely independent and appropriately qualified. At banks, building societies and insurers subject to PRA oversight, the expectations of the CRO role are more prescriptive still. At Core-tier FCA firms there is no SMF4, but the firm must still run adequate risk management systems and controls, and growing Core firms often appoint a Head of Risk or CRO well before any rule requires it.

Beyond regulation, the most common commercial triggers for a CRO appointment are: a significant loss event or near-miss that has exposed inadequacy in the existing risk framework; a growth phase that has taken the organisation’s risk profile beyond the management capacity of generalist governance; a capital raise, IPO or acquisition that brings new investors or counterparties whose due diligence standards require an evidenced risk management function; and a board composition review that identifies risk expertise as the most significant gap in the board’s collective competence.

Increasingly, CRO appointments are also triggered by the escalating expectations of institutional investors and major clients around enterprise risk management, cyber security governance, and ESG risk. The CRO’s role in maintaining the organisation’s licence to operate with its most demanding stakeholders has grown considerably, and the profile of the individuals who are effective in the role has evolved correspondingly.

A further trigger is a change of regulatory tier. A firm that crosses the thresholds for the Enhanced regime, or that applies for a banking licence, moves from having no SMF4 to needing one, and the CRO search then sits on the critical path of the firm’s regulatory plan. The reverse can also happen: the regulators’ October 2026 proposals would raise the Enhanced threshold, which could take some firms out of the Enhanced regime once final rules are made. Firms in that position should take advice before restructuring an established risk function.

Chief Risk Officer vs Other Senior Risk and Control Roles

Boards sometimes reach for a CRO when the gap is really in compliance, internal audit or a single risk discipline — and sometimes the reverse. The table below sets out how the CRO differs from the roles it is most often confused with. It is a guide to scope, not a rule: in smaller firms, two or more of these jobs are often combined.

If the gap sits below the CRO, our specialist pages cover operational risk director recruitment, credit risk manager recruitment and risk manager recruitment for asset management firms. Where the need is assurance rather than risk ownership, see our Head of Internal Audit recruitment service. Where the risk is primarily information security, our information security risk officer recruitment page covers that profile.

CRO Recruitment at FCA-Regulated Firms: The SMF4 Designation

At Enhanced-tier FCA firms and at dual-regulated banks, building societies and insurers, the Chief Risk Officer holds the SMF4 designation — the Chief Risk function under the Senior Managers and Certification Regime. The FCA’s guide to the SM&CR for solo-regulated firms lists SMF4 among the Enhanced-only functions; the six Core-regime SMFs are SMF1, SMF3, SMF9, SMF16, SMF17 and SMF27. At dual-regulated firms, SMF4 is a PRA-designated function. The SMF4 holder is approved by the regulator before taking up the role and carries individual accountability for the firm’s risk management framework within their Statement of Responsibilities. They are subject to the conduct rules and the Duty of Responsibility — meaning that in the event of a risk management failure within their area of accountability, they must demonstrate they took reasonable steps to prevent it.

This personal accountability dimension changes the CRO appointment in two important ways. First, the candidate must be individually approved via a Form A application before they can begin exercising their SMF4 responsibilities. Under section 61 of the Financial Services and Markets Act 2000, the regulator has three months from receipt of a complete application to decide it, and the clock stops while it waits for information it has requested. In practice the FCA’s published median for senior manager approvals in 2025/26 was about 25 days, and its operating service metrics report that 99.7% of applications were determined within the three-month timeframe — but referencing, criminal record checks and any follow-up questions all add time, and that has to be planned for from the outset. Second, the regulator’s assessment of the candidate’s fitness and propriety goes beyond professional credentials to include regulatory history, conduct record, and the quality of their regulatory references from previous employers.

Exec Capital integrates the SMF4 approval timeline into every regulated CRO search from the initial brief. We advise on Form A preparation, regulatory reference management, and the regulatory interview that the FCA or PRA may require for senior appointments at more complex or higher-risk firms. Our CRO search work at regulated firms is informed by a deep understanding of what the regulators expect of the role — not just the commercial and technical credentials of the candidate. For more detail on the SMF4 hiring process, see our guide on hiring an SMF4 Chief Risk Officer at a regulated firm, and for bank and building society appointments, our page on CRO recruitment for challenger banks and dual-regulated firms.

At Core-tier firms the position is different. There is no SMF4, so a Head of Risk or CRO at a Core firm does not need prior approval for that role (unless they also hold another SMF, such as SMF3 as a board director). Most Core firms’ regulatory hiring need is the Compliance Oversight function (SMF16) and the MLRO (SMF17), both of which stay pre-approved under the current proposals. Payment institutions and e-money institutions sit outside SMCR altogether: they appoint an MLRO under the Money Laundering Regulations, and the FCA assesses the people responsible for managing the business, but not as SMFs.

SMCR Changes Affecting CRO Appointments

The SMCR is in the middle of a two-phase reform, and both phases affect how a CRO hire is planned.

Phase 1: in force since 24 April 2026

The first set of changes (FCA PS26/6 and the PRA’s parallel rules) took effect on 24 April 2026. The change most relevant to CRO hiring is temporary cover. Under SUP 10C.3A, where an SMF holder leaves unexpectedly, a firm can appoint someone to cover the function without prior approval; since April 2026, firms have 12 weeks to submit an application for the replacement, and the cover can continue until the application is determined. That makes an interim CRO a practical bridge at an Enhanced or dual-regulated firm, provided the application is submitted in time.

Phase 2: consultation open until 22 January 2027

In October 2026 the FCA published CP26/37 and the PRA published CP14/26, setting out the most significant changes since the regime began. The regulators’ joint announcement covers the headline points. For CRO hiring, the key proposals are:

• SMF4 stays pre-approved. The functions proposed for notification rather than approval include SMF5 (Head of Internal Audit) and the committee chair roles SMF10–SMF14, but not SMF4. A CRO at an Enhanced or dual-regulated firm would still need approval before starting.
• A higher Enhanced threshold. The FCA proposes raising the threshold for the Enhanced regime, which would reduce the number of firms that need an SMF4 at all.
• Longer temporary cover. Both regulators propose extending the temporary cover period from 12 to 18 weeks.
• No more Certification Regime. The FCA proposes removing the Certification Regime, which would change how risk staff below the CRO are assessed.

These are proposals, not final rules; the FCA expects to publish a policy statement in the first half of 2027. We build the current rules into every search and will tell you at briefing if a proposal is likely to change your plan.

Permanent, Interim and Fractional CRO Appointments

Exec Capital places Chief Risk Officers on a permanent, interim and fractional basis. The right engagement model depends on the specific circumstances of the organisation and the nature of the risk leadership requirement.

Permanent CRO appointments are appropriate where the organisation needs sustained risk leadership over a multi-year cycle — where the CRO will be building or transforming the risk function, embedding a risk culture across the organisation, and carrying the long-term accountability for the firm’s risk framework development. At Enhanced-tier and dual-regulated firms, permanent appointments are the regulatory default for the SMF4 holder.

Interim CRO appointments serve situations where immediate risk leadership is required without the lead time of a permanent search — an unplanned departure, an urgent regulatory requirement, a specific programme of risk remediation, or a bridge while the permanent search progresses. Exec Capital provides access to experienced CROs who can assume interim responsibility quickly, including individuals with SMF4 experience who can cover the function under the temporary arrangements in SUP 10C.3A, or apply for approval in their own right, where the firm’s compliance advisers confirm this is appropriate. Our interim CRO page covers that service in detail.

Fractional CRO appointments are increasingly relevant for growth-stage businesses, scale-ups and smaller regulated firms that need senior risk expertise without the full cost of a permanent appointment. A fractional CRO working one or two days per week can provide the risk framework architecture and board-level risk oversight that a growing firm needs as it matures — particularly valuable in the period before the organisation’s scale and complexity justify a permanent CRO hire. Fractional arrangements fit most naturally at Core-tier firms and unregulated businesses, where the risk lead is not an SMF. At an Enhanced or dual-regulated firm, a part-time SMF4 holder would need to satisfy the regulator that the time commitment is enough for the firm’s risk profile; Exec Capital advises on this as part of the search process.

When to Hire a Permanent, Interim or Fractional CRO

The table below compares the four ways to bring in risk leadership. The right answer depends on the firm’s regulatory tier, how urgent the gap is, and how much risk work there really is.

Other ways to hire a CRO. If you need cover now, start with our interim CRO service. If your firm is a Core-tier FCA firm, the senior regulatory hire you need may be compliance rather than risk: we place fractional Chief Compliance Officers, fractional compliance officers who can hold SMF16, fractional MLROs for SMF17 and interim CCOs where cover is urgent. Many small firms combine a fractional SMF16 and SMF17 holder with risk oversight from the board rather than a standalone CRO.

The CRO Candidate Profile

The Chief Risk Officer candidate pool is more stratified than it appears from a distance. Technical risk expertise — in credit, market, operational, or enterprise risk depending on the sector — is a threshold requirement rather than a differentiating quality. What distinguishes genuinely effective CROs from technically competent ones is the combination of risk expertise with the interpersonal capability to provide credible, constructive challenge to powerful business leaders without compromising either the relationship or the independence of the function.

Exec Capital assesses CRO candidates against four dimensions simultaneously. Technical depth — genuine mastery of the risk disciplines relevant to the firm’s activities, not simply familiarity with risk management frameworks. Governance capability — the ability to operate effectively at board level, to support the Risk Committee and its chair, and to produce board risk reporting that enables effective oversight rather than simply documenting risk exposures. Independence of judgment — a track record of providing challenge that is substantive rather than ceremonial, including examples of situations where the CRO’s assessment materially affected a business decision. And regulatory credibility — particularly for regulated firm appointments, a track record of constructive engagement with FCA and PRA supervisors and a clean regulatory reference history.

For regulated firm appointments, Exec Capital also assesses candidates’ understanding of the SMF4 obligations specifically — their familiarity with the Statement of Responsibilities framework, their experience of the supervisory relationship, and their capacity to manage the personal accountability dimension of the role alongside the functional risk leadership responsibilities. Where the Risk Committee chair is also being appointed, our guide to hiring an SMF10 Chair of the Risk Committee explains how the two appointments interact.

What a CRO Typically Delivers in the First 90 Days

The first three months tell a board whether it has hired well. A strong CRO does not arrive with a ready-made framework; they diagnose first, then act on the few things that matter most. A typical 90-day pattern looks like this.

Days 1–30: diagnose

• Meet every executive committee member, the Risk Committee and Audit Committee chairs, internal audit and, at regulated firms, the supervisory contact.
• Review the risk register, risk appetite statement, recent incidents and losses, and the last internal audit and regulatory findings.
• Assess the risk team’s capability and the quality of management information reaching the board.

Days 31–60: prioritise

• Agree with the CEO and Risk Committee chair the three to five risk priorities for the year.
• Close any obvious control gaps, especially those raised by the regulator or internal audit.
• At SMF4 firms, confirm the Statement of Responsibilities matches what the CRO actually owns.

Days 61–90: embed

• Present a refreshed risk appetite statement or a plan to rebuild it.
• Redesign board risk reporting so it supports decisions, not just records exposures.
• Set out a hiring and development plan for the risk function, and the CRO’s own objectives for the year.

We discuss this 90-day picture with shortlisted candidates at interview, because the way a candidate describes their first three months is one of the clearest signs of how they will work.

Sectors We Recruit CROs For

Exec Capital recruits Chief Risk Officers across a wide range of UK sectors. In financial services, our CRO search work spans banks, insurers, asset managers, wealth management firms, consumer credit providers, payment institutions and fintech businesses. At banks, insurers and Enhanced-tier firms the CRO carries both functional and regulatory accountability; at payment and e-money institutions, which sit outside SMCR, and at Core-tier firms, the CRO carries functional accountability without an SMF4 designation. Our wider financial services executive search practice covers the other senior roles these firms hire.

Outside financial services, we recruit CROs for technology and digital businesses where cyber, data and operational risk are the primary mandate; professional services firms where reputation, conflict and regulatory risk dominate alongside operational resilience; infrastructure and energy businesses where physical, environmental and regulatory risk are central; and PE-backed businesses at growth and transformation stages where the risk framework is being built or significantly upgraded ahead of a capital event or exit.

The CRO candidate market in financial services is more liquid than in other sectors — there are more defined career paths, more standardised expectations of the role, and more active networks of risk professionals who move between firms. Outside financial services, the CRO talent pool is more idiosyncratic, and the search requires a deeper understanding of which backgrounds produce effective risk leaders in each specific context. Exec Capital draws on its cross-sector executive search experience to cover both markets.

Who We Place CROs With

Our CRO clients are usually one of the following types of organisation. We do not publish client names; we are happy to talk through relevant experience in confidence.

• Dual-regulated banks, building societies and insurers appointing or replacing a PRA-approved SMF4.
• Enhanced-tier FCA firms such as larger asset managers, wealth managers and consumer credit firms.
• Firms going through authorisation or a change of tier that need a risk leader in place before the regulator will be satisfied.
• Fintech and payments businesses scaling fast, often outside SMCR but facing investor and partner bank scrutiny of their risk framework.
• Private equity-backed businesses building risk and control frameworks ahead of an exit, often alongside a CFO or COO hire; see our private equity executive search service.
• Listed and pre-IPO companies strengthening enterprise risk management in line with the UK Corporate Governance Code’s expectations on risk management and internal controls.
• Infrastructure, energy and technology businesses where operational, cyber and safety risk sit at board level.

CRO Compensation and Market Context

Chief Risk Officer compensation varies considerably by sector, firm size, and the seniority and complexity of the role. The main drivers are whether the role carries SMF4, the size and complexity of the balance sheet, whether the firm is listed or PE-backed, and how far the CRO is expected to build rather than run a function. At large banks and insurers, total compensation is usually well above base salary through bonus and long-term incentives; at smaller and growth-stage firms, equity or a share of an exit pool can be a larger part of the package. We do not publish salary figures on this page because the range is wide and moves with the market; our SMF salary guide gives current context, and we provide role-specific market data at briefing.

Interim CROs are engaged on a day rate, and fractional CROs on an agreed number of days a week or month. Day rates depend on seniority, sector, regulatory exposure and urgency, with dual-regulated financial services roles typically at the upper end. Where we place an interim or fractional CRO, the day rate includes our fee.

At regulated firms, CRO compensation is subject to the remuneration code requirements applicable to the firm — including deferral, malus and clawback provisions for material risk takers, a group that normally includes SMF holders. The bonus cap was removed from 31 October 2023, and the FCA and PRA’s joint remuneration reforms (FCA PS25/15 and PRA PS21/25) have since given banks and building societies more flexibility on deferral and on how variable pay is structured. Because the CRO must remain independent, regulators also expect their variable pay not to be tied to the performance of the business lines they oversee. Exec Capital advises on market-rate compensation structures for CRO appointments and ensures that offer packages are structured consistently with the applicable regulatory framework from the outset of the appointment process.

Engagement and Fees

We agree the fee structure with you at briefing, once we understand the role, the market and the format. In outline:

• Retained search is our usual approach for permanent CRO appointments at regulated firms and for confidential replacements, where the candidate pool is small and most of the right people are not looking.
• Contingent search can suit interim and fractional appointments and some permanent roles at unregulated or Core-tier firms where the profile is clearer.
• Interim and fractional CROs are engaged on a day-rate basis; the day rate includes our fee, and you receive one invoice for the engagement.

Every engagement includes the brief and role profile, market mapping and approaches, candidate assessment, interview management, referencing, offer negotiation, and support on the regulatory approval process where SMF4 applies. Our guide to retained vs contingent executive search explains the differences in more depth.

How the Search Process Works

Every CRO search at Exec Capital begins with a thorough brief — typically a half-day conversation with the CEO, Chair or Risk Committee Chair to understand the specific risk challenges the organisation faces, the mandate the CRO will hold, the governance structure they will operate within, and the type of individual who will be credible in the role. We are direct in advising when the brief needs to be refined — when the reporting line proposed will undermine the CRO’s independence, when the compensation structure is unlikely to attract the right candidates, or when the expectations of the role are inconsistent with what the organisation’s governance can support.

We offer both retained and contingency search depending on the mandate’s complexity and the seniority of the role. Retained search is our default approach for permanent CRO appointments at regulated firms and for roles where the candidate pool is limited and discreet market engagement is essential. Contingency search is available for interim and fractional appointments and for permanent roles where the commercial model is more appropriate given the firm’s circumstances.

Candidate identification draws on Exec Capital’s active relationships across the UK risk executive market, supplemented by targeted market mapping. We do not rely on database searches for CRO appointments — the most credible candidates are rarely actively looking, and reaching them requires the kind of direct, trusted relationship that a search firm builds over years of working in the sector. Call our team on 0203 834 9616 to discuss your CRO search.

For regulated appointments, the search plan also covers the approval stage: who prepares the Form A, which regulatory references are needed and from whom, whether the candidate has any history the regulator will ask about, and how the start date fits the approval timetable. Our guide on how long FCA SMF approval takes explains the steps in more detail.

Looking for a CRO or senior risk role? If you are a risk executive rather than a hiring firm, please register with us as a candidate and browse our current opportunities. We keep a confidential record of risk leaders interested in permanent, interim and fractional work.

Frequently Asked Questions

What does CRO stand for in recruitment?

On this page, CRO means Chief Risk Officer: the executive accountable for the firm’s risk framework and independent risk oversight. Some businesses use CRO for Chief Revenue Officer, which is a commercial role and a different search.

Does every FCA-regulated firm need an SMF4 Chief Risk Officer?

No. SMF4 applies at Enhanced-tier FCA firms and at dual-regulated banks, building societies and insurers. Core-tier firms do not have an SMF4, and payment and e-money institutions are outside SMCR altogether, though all of them still need adequate risk management.

How long does it take to recruit a Chief Risk Officer?

It depends on the market for the profile, the candidate’s notice period and, for SMF4 roles, regulatory approval. We agree the timetable at briefing. The regulator has three months from a complete application to decide an SMF4 approval; the FCA’s median in 2025/26 was about 25 days.

Can an interim CRO cover SMF4?

Yes, under the temporary arrangements in SUP 10C.3A where the absence was not planned. Since 24 April 2026, the firm has 12 weeks to submit an application and the cover can continue until it is decided. The regulators have proposed extending this to 18 weeks.

Can we hire a fractional Chief Risk Officer?

Yes, and it is common at Core-tier firms, fintechs and PE-backed businesses. At an Enhanced or dual-regulated firm, a part-time SMF4 holder would need to show the regulator that their time commitment fits the firm’s risk profile.

What is the difference between a CRO and a Chief Compliance Officer?

The CRO owns the whole-firm risk framework and risk appetite; the Chief Compliance Officer owns compliance with regulatory rules and usually holds SMF16. Smaller firms often have a compliance lead but no CRO.

Who should a Chief Risk Officer report to?

Usually to the CEO for day-to-day matters, with direct access to the Risk Committee or board and its chair. The reporting line must protect the CRO’s independence from the business lines they oversee.

Will the SMCR reforms remove the need for SMF4 approval?

Not under the current proposals. CP26/37 and CP14/26 would move some functions to notification, but SMF4 is not among them. The proposed higher Enhanced threshold could take some firms out of scope of SMF4 altogether.

How are CRO search fees structured?

We agree the fee structure at briefing. Permanent CRO searches are usually retained; interim and fractional appointments are charged on a day-rate basis that includes our fee.

Do you recruit CROs outside financial services?

Yes. We place CROs and heads of risk in technology, infrastructure, energy, professional services and PE-backed businesses, where the focus is often operational, cyber and enterprise risk rather than prudential risk.