How to Hire a Chief Compliance Officer: A Complete Guide for UK Companies

The Chief Compliance Officer is the senior executive accountable for the firm’s regulatory compliance framework – the policies, processes and people that keep the business operating within the rules set by the FCA, the PRA, sector regulators and other supervisory bodies. The role has grown in importance as individual accountability under the Senior Managers and Certification Regime (SMCR) has formalised what regulators expect of senior compliance leaders, and as consumer-facing regulation such as the Consumer Duty has moved compliance from a back-office function to a seat at the executive table. The Chief Compliance Officer’s job is to make compliance risk visible at executive level, to give independent oversight of the firm’s regulatory position, and to give the board assurance that what the firm does matches what its permissions and obligations require.

This guide is written for chairs, CEOs, audit committee chairs and boards working through a Chief Compliance Officer appointment or succession at a UK firm. It covers when a firm needs senior compliance leadership at executive level, what the role involves – including the SMF16 Compliance Oversight function at FCA-regulated firms and the closely linked SMF17 MLRO role – where candidates come from, the engagement models available (permanent, interim and fractional), how the search and regulatory approval process runs under the current rules, and the mistakes that most often derail these hires. Exec Capital runs these searches through its compliance and risk recruitment practice, as part of FD Capital Group. One important point of clarity: this guide covers the Chief Compliance Officer (regulatory compliance leadership). For the Chief Commercial Officer (sales and revenue leadership), see our guide to hiring a Chief Commercial Officer.

Disambiguation: Chief Compliance Officer vs Chief Commercial Officer

The CCO abbreviation is genuinely ambiguous in UK business, and the two roles it can refer to are completely different. Boards approaching a CCO search benefit from being explicit about which role they need, both internally and with the search firm, from the very first conversation.

Chief Compliance Officer is the senior executive responsible for the firm’s regulatory compliance. The role operates in the regulatory dimension of the business, typically reports to the CEO with a line of access to the audit or risk committee, and at FCA-regulated firms is often the holder of SMF16 (Compliance Oversight), with personal regulatory accountability for that function.

Chief Commercial Officer is the senior executive responsible for revenue performance – typically owning sales, account management, partnerships and channel strategy, sitting on the executive committee and reporting to the CEO.

The two roles draw from completely different candidate pools. Compliance candidates come from regulated firms, audit and consulting practices, legal and risk backgrounds; commercial candidates come from sales, account management and revenue leadership. The pay structures, search processes and assessment criteria all differ. A specification that does not make the role explicit attracts a confused candidate pool and wastes the first weeks of the search.

There is a quieter version of the same problem inside compliance itself. “Chief Compliance Officer” can describe an SMF16 holder at an FCA-authorised firm with personal accountability to the regulator, or a senior compliance leader at an unregulated business whose scope is closer to enterprise risk, ethics and governance. Those are different searches, and the brief should say which one it is.

When does a firm need a Chief Compliance Officer?

Not every firm needs a Chief Compliance Officer. Many UK businesses run effective compliance through a Head of Compliance reporting to a CFO, COO or General Counsel, or through a part-time or outsourced arrangement. The decision to appoint a dedicated Chief Compliance Officer at executive level should be deliberate. Five triggers typically signal that the move is warranted.

SMF16 accountability at an FCA-regulated firm. Most Core and Enhanced firms under SMCR need someone approved to hold SMF16 (Compliance Oversight), and firms subject to the Money Laundering Regulations need an SMF17 MLRO. Where the firm’s conduct and compliance exposure is material, that SMF16 holder usually needs to sit at executive level rather than several layers down. Our SMF16 Head of Compliance recruitment service is built around exactly these appointments.

Sector-specific regulatory complexity. Healthcare businesses working under MHRA frameworks, energy firms supervised by Ofgem, data-intensive firms answerable to the ICO, food businesses under the FSA – wherever the regulatory dimension is material and growing, senior compliance leadership at executive level is usually justified.

Recent regulatory enforcement or compliance failures. Firms that have been through enforcement, a public compliance failure, a customer harm event or a skilled person review typically need to show boards, regulators and investors that compliance leadership has been strengthened.

Strategic transition involving regulatory complexity. Acquisitions into regulated sectors, expansion into new regulatory regimes, new products or business models that bring new permissions, and IPO preparation all raise the bar for compliance leadership.

Investor or capital structure changes. Private equity investment in regulated sectors, a listing, or a lending facility review. Investors routinely scrutinise senior compliance leadership during due diligence, and a gap in the SMF16 or SMF17 seat is a finding nobody wants in a diligence report.

For smaller firms, the answer is often not a full-time Chief Compliance Officer at all but a senior, experienced SMF16 holder on a fractional basis. We cover that option in detail below, because for many authorised firms it is the right first step.

What a Chief Compliance Officer actually does

The substantive work of the role splits into four areas, with the balance varying by sector and firm type. For a fuller breakdown of duties and reporting lines you can adapt for your own brief, see our Chief Compliance Officer job description.

The compliance framework. Setting and maintaining the firm’s compliance framework – policies, procedures, training, monitoring, escalation routes and the governance structure that supports them. This is the foundation, and a new Chief Compliance Officer’s first months are usually spent testing whether the framework on paper matches what actually happens.

Regulatory engagement. The Chief Compliance Officer is usually the firm’s main point of contact with the regulator on compliance matters – supervisory meetings, notifications, regulatory returns, responses to information requests and communication during any enforcement process. For FCA-regulated firms this carries personal accountability under SMCR for the SMF16 holder.

Compliance monitoring and assurance. Systematic checking of whether the firm operates within its regulatory framework – a risk-based monitoring plan, file reviews, sampling, thematic reviews and reporting of findings to the board. Strong Chief Compliance Officers run monitoring that finds things; weaker ones treat it as form-filling.

Executive contribution and culture. The Chief Compliance Officer sits on the executive committee and contributes where regulatory implications need to be weighed – new product approvals, M&A due diligence, geographical expansion, distribution and outsourcing decisions. The best holders also shape compliance culture, working with the CEO and HR on tone from the top and on how conduct is reflected in performance management.

The Statement of Responsibilities

At an FCA-regulated firm, the SMF16 holder’s accountability is written down in a Statement of Responsibilities submitted with the approval application. Getting that document right before the search starts sharpens the brief: it tells candidates exactly what they will be personally accountable for, and it prevents the common problem of a compliance leader inheriting responsibilities that nobody mapped. Our guide to Statements of Responsibilities and SMF appointments covers what boards should settle before they appoint.

Consumer Duty and the board report

Where the firm deals with retail customers, the Chief Compliance Officer typically plays a central role in Consumer Duty monitoring and in preparing the evidence behind the annual board report. Candidates who have built outcome monitoring, management information and board reporting under the Duty – rather than simply mapping policies to it – are noticeably stronger at interview.

SMF16, SMF17 and the current SMCR rules

Because so many Chief Compliance Officer appointments are SMF16 appointments, boards need an accurate picture of how the regime works now. Several practical rules changed in 2026, and further reform is under consultation.

Phase 1 reforms are in force. The FCA’s PS26/6 and the PRA’s matching PS12/26 took effect for most purposes on 24 April 2026. Three changes matter most for compliance hiring:

• The 12-week rule is now a submission deadline. Where a senior manager leaves unexpectedly, the firm can appoint someone to cover, and that person must have an SMF application submitted within 12 weeks rather than approved within 12 weeks. The cover can continue while the regulator decides. This gives firms more room to put interim SMF16 or SMF17 cover in place while a permanent search runs.
• Criminal record checks stay valid for six months rather than three, which removes a common reason for applications being sent back during longer searches.
• Regulatory references must be provided within four weeks of a request, rather than six, which should shorten the referencing stage for candidates moving between regulated firms.

Approval timescales. The FCA must decide on a complete application within three months, and can stop the clock if it asks for more information or interviews the candidate – see the FCA’s page on how it assesses SMF applications. Separately, the FCA has set itself a target of completing at least half of senior manager applications in 35 days or fewer, alongside a proposed statutory deadline of two months. Treat the 35-day figure as a target rather than a promise: complex applications, gaps in the Statement of Responsibilities or a candidate interview all extend the timeline. Our guide on how long FCA SMF approval takes sets out a realistic plan.

Phase 2 is under consultation. In CP26/37, published on 22 October 2026 and open until 22 January 2027, the FCA proposes moving a group of functions – SMF5 (Head of Internal Audit) and the committee chair and SID roles SMF10 to SMF15 – from pre-approval to notification at the firms where they apply. SMF16 Compliance Oversight and SMF17 MLRO are not in that group: they would remain functions that need FCA approval before the individual can hold them, other than under the 12-week cover arrangement. Until final rules are published, boards should plan compliance appointments on the current approval basis.

Dual-regulated firms. Banks, building societies and PRA-regulated insurers work with both regulators; the PRA publishes its own guidance on Senior Managers Regime approvals. SMF16 and SMF17 are FCA-designated functions, but the overall SMF map and the timing of applications need to be coordinated across both.

For a board-level view of how the regime affects senior hiring more widely, see what the Senior Managers Regime means when recruiting at board level.

The candidate pool

The UK Chief Compliance Officer candidate pool varies considerably by sector. Five broad pools recur.

Sitting Chief Compliance Officers and Heads of Compliance at peer firms. The most common source – candidates already leading compliance at a firm of similar size, sector and complexity. They have shown they can do the job and bring direct sector knowledge. For regulated firms, those who already hold SMF16 approval are the strongest credential, because the FCA has already assessed their fitness and propriety in that function.

Compliance Directors at larger firms stepping up. The natural step-up pool: a Compliance Director or deputy at a substantially bigger business who is ready for the executive seat at a smaller firm. They often bring better framework discipline than the hiring firm has today, and the question is whether they can work with fewer resources.

Big Four and consulting transitions. Directors and partners from regulatory consulting practices moving in-house. Common in financial services. They bring breadth across many firms; the test is whether they have owned outcomes rather than advised on them.

Law and regulatory backgrounds. Candidates from legal practice, from the regulators themselves, or from General Counsel roles with substantive compliance scope. They bring strong regulatory understanding; the question is operational depth in running a compliance function day to day.

Cross-discipline candidates. Senior MLROs, risk officers and internal auditors who have moved into broader compliance leadership. Particularly relevant in financial services, where SMF16 sits next to SMF17 (MLRO) and SMF4 (Chief Risk Officer), and where smaller firms frequently combine SMF16 and SMF17 in one person.

The fractional and interim pool deserves separate mention. A substantial group of experienced compliance leaders now work on a portfolio basis, holding SMF16 or SMF17 at more than one firm or moving between interim assignments. Because Exec Capital is part of FD Capital Group, the senior compliance and C-suite networks built across the group’s firms are pooled, which widens the shortlist on both permanent and fractional briefs.

Engagement models

We place senior compliance appointments across all three engagement models, and the right choice depends on the firm’s size, regulatory exposure and how urgently the seat needs filling. Our guide to permanent, interim or fractional compliance hires goes into the trade-offs in more depth.

Permanent. Permanent Chief Compliance Officer appointments remain the norm at larger firms. The role is structurally part of the executive team, and continuity matters for the regulatory relationship.

Interim. Interim appointments are common during transitions, after an unexpected departure, during remediation following enforcement, or to bridge the gap while a permanent successor goes through FCA approval. An interim Chief Compliance Officer can usually be in place far faster than a permanent hire, and the revised 12-week rule makes interim SMF cover easier to manage than it was.

Fractional. A fractional Chief Compliance Officer works well at smaller regulated firms where the size of the business does not justify a full-time SMF16 holder but the regulatory framework requires senior compliance presence. Engagements are typically a set number of days per month, flexing up around regulatory deadlines, product launches or supervisory visits.

Fractional and interim SMF16 and SMF17 cover

For a large share of FCA-authorised firms – IFAs and wealth managers, insurance and mortgage brokers, consumer credit firms, payment and e-money institutions, smaller investment firms and start-ups going through authorisation – the realistic need is not a full-time Chief Compliance Officer. It is a senior, credible individual who can hold SMF16, SMF17 or both, for a defined number of days, with the experience to satisfy the FCA that the function is properly overseen. This is one of the most common briefs we receive, and it is a distinct search from a permanent executive hire.

When fractional SMF16/17 cover makes sense

• The firm is small enough that compliance oversight is not a full-time role, but its permissions require an approved SMF16 holder.
• The firm is subject to the Money Laundering Regulations and needs an SMF17 MLRO with real financial crime experience, which it cannot justify hiring full-time.
• The firm is applying for authorisation and needs approvable SMF16 and SMF17 candidates named in the application.
• An existing SMF holder has left and the firm needs cover quickly while a permanent decision is made.
• The firm is under supervisory pressure – for example a voluntary requirement or a skilled person review – and needs experienced oversight in place immediately.

Combined SMF16 and SMF17

Smaller firms frequently ask one person to hold both functions. That is permitted, and often sensible, provided the individual genuinely has the capability and time for both. The FCA will look at whether the combined role is credible for the firm’s size and risk, so the candidate’s financial crime experience matters as much as their conduct compliance background. We have set out the considerations in SMF16 vs SMF17: one, both or a combined role.

What to check in a fractional candidate

• Time commitment. How many other SMF roles does the candidate hold, and is the number of days offered realistic for your firm’s risk profile? The FCA will ask the same question.
• Sector fit. A fractional SMF16 for a mortgage broker needs different experience from one for an investment manager or a payments firm.
• Approval history. Candidates who already hold, or have recently held, SMF16 or SMF17 approval tend to move through the process with fewer questions.
• Hands-on capacity. Fractional holders need to do real work – monitoring, file reviews, board reporting – not simply lend their name. Check what is included in the days quoted.
• Escalation and availability. Agree how the firm reaches the individual between scheduled days when something goes wrong.

Exec Capital places fractional SMF16 holders through its fractional compliance officer service and fractional SMF17 holders through its fractional MLRO service, alongside permanent appointments through the compliance and risk recruitment practice. Many firms start with a fractional holder and move to a permanent appointment once the business has grown into it.

The search process and timeline

A well-run Chief Compliance Officer search runs through six phases. The structure mirrors other senior C-suite searches, with regulatory steps layered through where the role is an SMF.

1. Brief. Agree the role title (compliance, not commercial), scope, reporting line, whether the role is SMF16, SMF17 or both, and the draft Statement of Responsibilities. Decide early on permanent, interim or fractional.

2. Market mapping. Identify sitting compliance leaders, step-up candidates and portfolio SMF holders who fit the sector and size of firm.

3. Shortlist. Present candidates with a clear view of their approval history, sector experience and availability. For fractional briefs, include existing commitments.

4. Interviews. Test technical depth, judgement and independence. A useful exercise is asking the candidate how they would handle a disagreement with the CEO over a product launch.

5. Selection and referencing. Regulatory references, criminal record checks and fitness and propriety checks. Under the current rules, references should come back within four weeks and criminal record checks remain valid for six months, which makes this stage easier to schedule.

6. Approval and onboarding. Submit the application with the Statement of Responsibilities, prepare the candidate for a possible FCA interview, and plan handover. The FCA’s statutory deadline is three months from a complete application, with a target of deciding at least half of senior manager applications in 35 days or fewer.

For an unregulated Chief Compliance Officer role, the process stops at selection. For an SMF16 role, boards should build the approval period into the start date and, where there is a gap, arrange interim cover under the 12-week rule.

Compensation

UK Chief Compliance Officer pay has the standard components – base salary, annual bonus, long-term incentives and benefits – with levels that vary widely by firm size, sector, ownership and whether the role carries SMF16 accountability. Rather than relying on headline figures, benchmark against the specific candidate pool you are targeting at the start of the search; we provide current market data for each brief.

Two considerations are specific to senior compliance roles. First, performance measures must suit a control function. Bonus structures for a Chief Compliance Officer should not be tied to the commercial outcomes the role exists to challenge. Better structures use the effectiveness of the compliance framework, the quality of regulatory engagement, audit and monitoring findings and stakeholder feedback. Second, the FCA’s remuneration codes shape pay structure for relevant financial services firms, including rules on deferral and variable pay for certain staff.

For fractional and interim roles, compensation is usually a day rate or a fixed monthly retainer for an agreed number of days. Be clear about what the fee covers – board attendance, monitoring work, regulatory correspondence – and what is charged on top.

Common search pitfalls

Six patterns recur in Chief Compliance Officer searches that go off track.

Title confusion. Briefing a CCO search without specifying Chief Compliance or Chief Commercial. The fix is to be explicit from the start.

Briefing a Head of Compliance rather than a Chief Compliance Officer. Specifications that emphasise compliance delivery without the strategic and executive leadership dimension attract candidates whose seniority does not match the firm’s needs.

Bonus structures that compromise independence. Compliance leaders whose pay is linked to commercial outcomes face perverse incentives. Strong audit committees test the bonus structure during the appointment.

Underspecifying the regulator relationship. Good candidates probe how the firm handles regulatory engagement – recent supervisory history, the CEO’s attitude and the executive team’s seriousness about the relationship. Be ready to answer candidly.

Underestimating the approval timeline. SMF16 and SMF17 appointments still require FCA approval. Boards that plan on the 35-day target alone, without allowing for the three-month statutory period or a stopped clock, often face a gap in cover.

Choosing a fractional holder on price alone. The cheapest fractional SMF16 is rarely the one the FCA finds most credible. Time commitment, sector experience and approval history matter more than the day rate.

How Exec Capital and FD Capital approach senior compliance mandates

Exec Capital runs Chief Compliance Officer, SMF16 and SMF17 searches directly, on permanent, interim and fractional terms. As part of FD Capital Group, we draw on the senior finance, compliance and C-suite networks built across the group, which means a compliance appointment can be run alongside a wider leadership search – a CEO, CFO or Chief Risk Officer – within a single engagement and a single point of contact.

Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate. Adrian’s background as a Chartered Accountant and former listed-company Finance Director means the regulatory and governance questions are understood from the client side of the table, not only the recruiter’s.

For boards beginning Chief Compliance Officer succession, or working out whether they need a Chief Compliance Officer, a Head of Compliance or a fractional SMF16 holder, we start with a structured conversation covering the role specification, the SMF position, the candidate pool and a realistic timeline – before any formal mandate begins.

Frequently asked questions

Is a Chief Compliance Officer the same as an SMF16?

Not always. SMF16 (Compliance Oversight) is an FCA-designated function. At regulated firms the Chief Compliance Officer usually holds it, but the title itself has no regulatory status, and at unregulated businesses there is no SMF at all.

Can our SMF16 be part-time or fractional?

Yes. There is no requirement for the SMF16 holder to be full-time. The FCA will assess whether the individual has the experience and enough time to oversee compliance properly for the firm’s size and risk.

Can one person hold SMF16 and SMF17?

Yes, and many smaller firms combine them. The individual needs real competence in both conduct compliance and financial crime, and enough time for both.

How long does FCA approval for an SMF16 take?

The FCA must decide within three months of a complete application and aims to decide at least half of senior manager applications in 35 days or fewer. Requests for more information or a candidate interview pause the clock.

What happens if our SMF16 leaves suddenly?

Under the revised 12-week rule, the firm can appoint cover and must submit an SMF application within 12 weeks; the cover can continue while the FCA decides. Interim or fractional cover is the usual answer.

Will SMF16 move to notification under the Phase 2 reforms?

Not under the current proposals. CP26/37 proposes moving SMF5 and SMF10 to SMF15 to notification, while SMF16 and SMF17 remain approved functions. The consultation closes on 22 January 2027.

Further reading

For our service pages, see Chief Compliance Officer recruitment, MLRO recruitment and urgent SMF appointments. For related guides, see the SMF16 Head of Compliance hiring guide, the SMF17 MLRO hiring guide, interim SMF16 and SMF17 cover during an FCA VREQ and the SMF salary guide.

For the wider collection of guides on senior and regulated appointments, visit our Knowledge Centre.