Operational Risk Director Recruitment

UK Operational Risk Director Recruitment

Specialised Senior Search for Operational Risk Director Appointments at UK FCA-Authorised Banks, UK FCA-Authorised Asset Managers, UK Insurance Firms and UK Selected FCA-Regulated Firms with Material Operational Risk Function Dimensions Across FCA Operational Resilience Framework, PRA Operational Risk Capital Framework, Basel III Operational Risk Framework and FCA Senior Managers and Certification Regime (SMCR) SMF4 Chief Risk Function

A UK Operational Risk Director is the specialist senior operational risk function leader at a UK FCA-regulated firm with senior accountability for the firm’s operational risk framework leadership distinct from broader Director of Risk and Compliance scope (which extends across both risk and compliance functions in combined leadership) and distinct from C-Suite Chief Risk Officer (CRO) scope (which extends across the firm’s enterprise-wide risk leadership at C-Suite tier across operational risk, market risk, credit risk, liquidity risk, conduct risk, and adjacent risk dimensions). UK Operational Risk Director scope focuses specifically on the firm’s operational risk function leadership including operational risk framework leadership across the firm’s operational risk taxonomy, operational risk identification and assessment framework, operational risk measurement and reporting framework, operational risk capital framework intersection where applicable to UK PRA-authorised firms operating Basel III operational risk capital framework dimensions, UK FCA Operational Resilience framework leadership, UK third-party outsourcing risk framework leadership, UK operational risk incident management framework, UK operational risk governance framework, and the wider UK operational risk function leadership dimensions. UK Operational Risk Director appointments operate under the UK Senior Managers and Certification Regime (SMCR) framework with associated senior commercial accountability for SMCR conduct rules and SMCR senior manager regime engagement at SMF4 Chief Risk function tier where applicable to the firm.

This UK Operational Risk Director recruitment service page covers the senior UK Operational Risk Director recruitment context, the principal UK FCA-regulated firm scenarios for senior operational risk function leadership engagement (UK FCA-authorised banks operating with PRA Operational Risk Capital framework dimensions, UK FCA-authorised asset managers operating with material operational risk dimensions, UK insurance firms operating with PRA-authorised operational risk dimensions, UK selected FCA-regulated firms operating with material operational risk function dimensions), the senior commercial distinction between Operational Risk Director scope, broader Director of Risk and Compliance scope, and C-Suite CRO scope, the UK regulatory framework intersection with senior operational risk function leadership (FCA Operational Resilience framework, PRA Operational Risk Capital framework, Basel III/CRR Operational Risk framework, FCA SMCR framework engagement at SMF4 Chief Risk function tier, ISO 31000 risk management framework intersection, ORX Operational Risk eXchange framework intersection), the senior UK Operational Risk Director professional qualification framework (IRM Institute of Risk Management, ICA International Compliance Association, CFA, IRM International Certificate in Operational Risk Management, FRM, PRM, ORX framework engagement), the realistic compensation calibration, and adjacent senior UK risk and compliance recruitment engagement across the broader Exec Capital and FD Capital cross-portfolio architecture. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate.

UK Operational Risk Director appointments operate with senior commercial dynamics that differ materially from broader UK Director of Risk and Compliance appointments and from C-Suite UK CRO appointments. UK Operational Risk Director scope focuses specifically on the operational risk function as a distinct senior operational risk function leadership scope — UK Operational Risk Directors lead the firm’s operational risk framework as a specialist function with senior accountability for operational risk taxonomy, operational risk identification and assessment, operational risk measurement and reporting, operational risk capital framework intersection at UK PRA-authorised firms, FCA Operational Resilience framework leadership, third-party outsourcing risk framework leadership, operational risk incident management framework, and adjacent senior operational risk function dimensions. The senior commercial dimensions of UK Operational Risk Director appointments differ materially across UK FCA-regulated firm sectors — UK FCA-authorised banks operate with materially different operational risk function dimensions than UK FCA-authorised asset managers, given the PRA Operational Risk Capital framework intersection at UK FCA-authorised banks; UK insurance firms operate with operational risk function dimensions specific to UK insurance regulatory framework; UK selected FCA-regulated firms operating with material operational risk function dimensions operate with sector-specific operational risk dimensions reflecting the firm’s commercial business model.

Specifying the Operational Risk Director mandate accurately at the brief stage matters because the senior career trajectories, sector-specific career background, regulatory framework familiarity, SMCR SMF4 holder framework dimensions where applicable, professional qualification credentials, and senior commercial dimensions of UK Operational Risk Director candidates differ materially across UK FCA-regulated firm scenarios. UK FCA-authorised bank Operational Risk Director candidates operate with materially different senior career background dimensions than UK FCA-authorised asset manager Operational Risk Director candidates; UK insurance firm Operational Risk Director candidates operate with senior career background dimensions specific to UK insurance regulatory framework. Senior search engagement that doesn’t articulate the firm sector, the operational risk function scope dimensions, the SMCR framework requirements where applicable, the UK regulatory framework requirements, and the senior commercial dimensions specific to the firm frequently produces poorly-fitting shortlists. At Exec Capital our senior UK Operational Risk Director search engagement begins with structured brief development that articulates the firm scenario, sector context, operational risk function scope dimensions, SMCR framework requirements where applicable, regulatory framework requirements, and the senior commercial dimensions specific to the firm.

Tell us about your Operational Risk Director search →

How an Operational Risk Director search works

Operational risk director recruitment goes wrong most often at the start, when the firm describes the job it had five years ago rather than the one it needs now. The process below is built to stop that. We agree the timetable with you at briefing, because it depends on how specialist the brief is, how many stakeholders interview and whether the role carries a Senior Manager Function.

Where the hire will hold SMF4, build the regulator’s approval into the plan from day one. The FCA and PRA have up to three months to decide a complete application, and the clock stops while they wait for information they have asked for; our guide on how long FCA SMF approval takes sets out the published medians and what slows applications down. Most Operational Risk Director and Head of Operational Risk roles are not SMFs, so the regulatory step is usually the certification assessment and regulatory references rather than an approval.

UK FCA-Regulated Firm Scenarios for Senior Operational Risk Director Recruitment

UK Operational Risk Director appointments operate across the following principal UK FCA-regulated firm scenarios with senior commercial dynamics, sector-specific operational risk framework dimensions, and senior commercial structures specific to each UK FCA-regulated firm context.

UK FCA-authorised banks — PRA Operational Risk Capital framework — UK FCA-authorised banks (UK retail banks, UK commercial banks, UK challenger banks operating at material UK banking regulatory framework scale, UK PRA-authorised banks) operate with material operational risk function dimensions including UK PRA Operational Risk Capital framework intersection at Pillar 2 capital framework engagement, UK FCA Operational Resilience framework leadership at material banking commercial scale, UK third-party banking outsourcing risk framework leadership, UK banking operational risk incident management framework leadership at scale, UK banking operational risk taxonomy framework leadership across UK banking commercial dimensions, and the wider senior operational risk function dimensions specific to UK FCA-authorised banking firms. UK FCA-authorised bank Operational Risk Director scope typically operates at UK SMCR framework SMF4 Chief Risk function tier or as senior member of the SMF4-led risk function team with senior commercial accountability for operational risk function leadership at material UK banking commercial scale.

UK FCA-authorised asset managers — material operational risk function dimensions — UK FCA-authorised asset managers (UK FCA MIFIDPRU-authorised asset managers, UK FCA AIFM-authorised alternative investment fund managers, UK FCA UCITS-authorised UCITS managers) operating with material operational risk function dimensions frequently appoint Operational Risk Directors with UK asset management-specific senior operational risk function dimensions. UK FCA-authorised asset manager Operational Risk Director scope typically extends across UK MIFIDPRU operational risk framework intersection where applicable to UK MIFIDPRU-authorised firms, UK AIFM operational risk framework intersection where applicable to UK AIFM-authorised firms, UK asset management operational risk taxonomy framework leadership, UK asset management third-party operational outsourcing risk framework leadership including UK asset management depositary framework intersection at UCITS firms, UK asset management operational incident management framework leadership, and the wider senior operational risk function dimensions specific to UK FCA-authorised asset management firms.

UK insurance firms — PRA-authorised operational risk dimensions — UK insurance firms (UK PRA-authorised general insurers, UK PRA-authorised life insurers, UK Lloyd’s of London managing agents) operating with material operational risk function dimensions frequently appoint Operational Risk Directors with UK insurance-specific senior operational risk function dimensions. UK insurance firm Operational Risk Director scope typically extends across UK PRA Solvency II operational risk framework intersection at UK PRA-authorised insurers, UK insurance operational risk taxonomy framework leadership, UK insurance operational risk capital framework intersection where applicable, UK insurance third-party outsourcing risk framework leadership, UK insurance operational risk incident management framework leadership, and the wider senior operational risk function dimensions specific to UK insurance firms.

UK selected FCA-regulated firms with material operational risk function dimensions — UK selected FCA-regulated firms operating with material operational risk function dimensions (UK consumer credit firms operating at material commercial scale with FCA Consumer Duty intersection, UK payments firms operating at material commercial scale with FCA payments framework intersection, UK e-money firms operating at material commercial scale, UK selected FCA-regulated firms operating with material operational risk dimensions specific to the firm’s commercial business model) frequently appoint Operational Risk Directors with sector-specific senior operational risk function dimensions reflecting the firm’s commercial business model and FCA regulatory framework intersection. Note that authorised payment institutions and e-money institutions sit outside SMCR: they appoint an MLRO under the Money Laundering Regulations, and the people responsible for their management are assessed by the FCA, but not as Senior Managers. They are, however, in scope of the FCA’s operational resilience rules, so the operational risk role matters just as much there.

Senior Operational Risk Director Scope vs Director of Risk and Compliance Scope vs CRO Scope

The senior commercial distinctions between Operational Risk Director scope, broader Director of Risk and Compliance scope, and C-Suite Chief Risk Officer scope operate principally across function scope dimensions and senior tier dimensions.

Operational Risk Director — specialist operational risk function leader — Operational Risk Director scope focuses specifically on the operational risk function as a distinct specialist senior leadership scope. Operational Risk Director scope is suitable at UK FCA-regulated firms operating at material commercial scale with operational risk function dimensions warranting specialist senior operational risk function leadership distinct from broader risk and compliance function leadership. UK Operational Risk Director appointments typically operate at UK FCA-regulated firms operating at scale where the operational risk function warrants specialist senior leadership.

Director of Risk and Compliance — combined risk and compliance function leader — Director of Risk and Compliance scope extends across both risk and compliance functions in combined senior leadership. Director of Risk and Compliance scope is suitable at UK firms operating at scale where combined risk and compliance senior function leadership is warranted by the firm’s commercial structure. For UK Director of Risk and Compliance Job Description reference covering combined risk and compliance senior leadership scope see Director of Risk and Compliance Job Description.

Chief Risk Officer (CRO) — C-Suite enterprise-wide risk leader — Chief Risk Officer scope extends across the firm’s enterprise-wide risk leadership at C-Suite tier across operational risk, market risk, credit risk, liquidity risk, conduct risk, and adjacent enterprise risk dimensions. CRO scope is suitable at UK FCA-regulated firms operating at material C-Suite tier with enterprise-wide risk leadership warranting C-Suite tier senior leadership. UK CRO appointments typically operate at UK FCA-authorised banks, UK PRA-authorised insurers, UK FCA-authorised asset managers operating at scale, and adjacent UK firms with C-Suite tier enterprise risk leadership designs. For UK CRO recruitment service engagement see CRO Recruitment; for UK CRO Job Description reference see Chief Risk Officer Job Description.

Chief Compliance Officer (CCO) — C-Suite compliance leader — for UK CCO senior search at the senior compliance function leadership at C-Suite tier see CCO Recruitment; for UK CCO Job Description reference see Chief Compliance Officer Job Description.

Operational Risk Director vs CRO vs Head of Operational Resilience vs COO

Four roles share the operational risk territory and they are often confused at the brief stage. Getting the split right changes who you should be interviewing. The table sets out the usual position at a UK regulated firm; the exact allocation of responsibilities should follow your own Responsibilities Map or management responsibilities map.

In smaller firms these roles collapse into one or two people. A Core SMCR investment firm may have a Head of Risk who covers operational risk, resilience and compliance monitoring, with the CEO or another Senior Manager holding overall responsibility. A mid-sized bank will typically have a CRO holding SMF4, an Operational Risk Director reporting to the CRO, and a resilience lead in the COO’s area who works closely with operational risk. Our SMF4 CRO hiring guide covers the CRO side of that split, and the SMF24 Chief Operations guide covers the operations side; for the first-line executive see COO of regulated firm recruitment.

The most common mistake we see is a firm hiring an Operational Risk Director and expecting them to run resilience delivery, information security and outsourcing as well, without the budget or the authority to do it. Second-line oversight and first-line delivery are different jobs. If the gap is really technology and cyber risk, an information security risk officer may be the better hire, with the Operational Risk Director providing challenge over the top.

UK Regulatory Framework Intersection with Senior Operational Risk Function Leadership

UK Operational Risk Director appointments operate within the UK FCA-regulated firm regulatory framework with material framework dimensions specific to senior UK operational risk function leadership.

FCA Operational Resilience framework — rules in force 31 March 2022, transition ended 31 March 2025 — the principal UK FCA operational resilience regulatory framework, introduced on 31 March 2022 by FCA PS21/3, with firms required to be able to remain within their impact tolerances by 31 March 2025. The rules apply to banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges, Enhanced scope SMCR firms and authorised payment and e-money institutions (Core and Limited Scope SMCR firms are not in the list), with associated senior UK Operational Risk Director accountability for FCA Operational Resilience framework application across UK FCA-regulated firm operations. FCA Operational Resilience framework dimensions include important business services framework leadership (identifying and mapping the firm’s important business services), impact tolerance framework leadership (setting impact tolerances for important business services), third-party operational outsourcing risk framework leadership, IT and operational mapping framework leadership, scenario testing framework leadership, lessons learned framework leadership, and the wider FCA Operational Resilience framework dimensions specific to senior UK Operational Risk Director scope.

PRA Operational Risk Capital framework — Pillar 2 capital framework — the UK PRA Operational Risk Capital framework operating at UK PRA-authorised firms with associated senior UK Operational Risk Director accountability at UK PRA-authorised firms for PRA Operational Risk Capital framework application. PRA Operational Risk Capital framework dimensions include UK PRA Pillar 2 capital framework engagement, UK PRA Internal Capital Adequacy Assessment Process (ICAAP) framework engagement at UK PRA-authorised banks, UK PRA Own Risk and Solvency Assessment (ORSA) engagement at UK PRA-authorised insurers under the Solvency UK framework (the UK version of Solvency II), and the wider PRA Operational Risk Capital framework dimensions specific to UK PRA-authorised firm Operational Risk Director scope.

Basel III / CRR Operational Risk framework — the international Basel III regulatory framework as implemented in UK regulation through the Capital Requirements Regulation (CRR) framework with associated senior UK Operational Risk Director accountability at UK FCA-authorised and UK PRA-authorised firms operating within Basel III operational risk capital framework scope. Basel III / CRR Operational Risk framework dimensions include UK PRA implementation of Basel III standardised measurement approach (SMA) for operational risk capital framework, UK PRA Pillar 1 minimum capital requirement framework intersection, UK PRA Pillar 2 supervisory review framework intersection, UK PRA Pillar 3 disclosure framework intersection, and the wider Basel III / CRR Operational Risk framework dimensions specific to UK firm Operational Risk Director scope. The PRA published its final Basel 3.1 rules in PS1/26 on 20 January 2026; they take effect on 1 January 2027, when a single standardised approach for operational risk replaces the existing approaches and supervisory statement SS14/13 on operational risk is withdrawn.

FCA SMCR — Senior Managers and Certification Regime engagement at SMF4 Chief Risk function tier — the UK FCA SMCR framework with associated senior UK Operational Risk Director accountability for SMCR framework engagement where the Operational Risk Director operates at SMF4 Chief Risk function tier or as senior member of the SMF4-led risk function team. FCA SMCR framework dimensions include SMF4 Chief Risk function senior manager regime engagement where applicable, SMCR Statement of Responsibilities framework, SMCR conduct rules framework engagement (Individual Conduct Rules and Senior Manager Conduct Rules), SMCR fit and proper framework engagement, SMCR Certification Regime framework engagement at certification function staff dimensions where applicable, and the wider FCA SMCR framework dimensions specific to senior UK Operational Risk Director SMCR engagement. SMF4 Chief Risk applies only at banks, building societies, insurers and other dual-regulated firms and at FCA Enhanced scope SMCR firms; Core firms have no SMF4, so at a Core firm the operational risk lead is normally a certified role and responsibility for risk oversight sits with an existing Senior Manager.

ISO 31000 — Risk Management framework — the international ISO 31000 risk management framework with associated senior UK Operational Risk Director intersection at UK firms operating ISO 31000 risk management framework. ISO 31000 framework dimensions include risk management principles framework, risk management framework process (mandate and commitment, framework design, implementation, monitoring and review, continual improvement), risk management process (communication and consultation, scope and context, risk assessment, risk treatment, monitoring and review, recording and reporting), and the wider ISO 31000 framework dimensions specific to senior UK Operational Risk Director scope.

ORX — Operational Risk eXchange framework — the principal international operational risk benchmarking and operational risk loss data sharing organisation with associated senior UK Operational Risk Director engagement at UK firms operating with ORX framework engagement. ORX framework dimensions include operational risk loss data benchmarking framework, operational risk taxonomy framework benchmarking, operational risk scenario framework benchmarking, operational risk practice benchmarking, and the wider ORX framework dimensions specific to senior UK Operational Risk Director engagement at ORX-member UK firms.

FCA Consumer Duty framework — at UK FCA-regulated firms operating retail-facing distribution dimensions, the FCA Consumer Duty framework introduced 31 July 2023 with associated senior UK Operational Risk Director intersection accountability where Consumer Duty operational delivery framework intersects with operational risk function dimensions including price and value operational risk framework, consumer understanding operational risk framework, consumer support operational risk framework, products and services operational risk framework, and the wider FCA Consumer Duty framework dimensions specific to senior UK Operational Risk Director intersection scope.

What has changed for operational risk leaders

Four pieces of regulation have reshaped the operational risk job in the last few years, and candidates will expect you to know where your firm stands on each. They are also the best interview material: ask a candidate to explain what each one means for your firm and you will quickly see who has done the work.

Operational resilience is now business as usual

The FCA’s operational resilience rules came into force on 31 March 2022, and the transition ended on 31 March 2025, by which date in-scope firms had to be able to remain within impact tolerances for each important business service. The focus has moved from building the framework to proving it works: scenario testing that is severe but plausible, self-assessments that the board actually challenges, and remediation that is funded and tracked. An Operational Risk Director hired now should be able to show how they have used resilience testing results to change investment decisions, not only that they drafted the self-assessment.

Incident and third-party reporting from 18 March 2027

The FCA published PS26/2 on operational incident and third-party reporting on 18 March 2026, and the new rules come into force on 18 March 2027. The incident reporting rules apply far more widely than the resilience rules: to all firms with a Part 4A permission, payment service providers, recognised investment exchanges, registered trade repositories and registered credit rating agencies. That means Core SMCR firms that were outside the resilience regime now need an incident definition, thresholds and a reporting process. The third-party rules apply to Enhanced scope SMCR firms, banks, building societies, designated investment firms, Solvency II firms, CASS large firms, recognised investment exchanges, authorised payment and e-money institutions and consolidated tape providers. Those firms must notify the FCA of new material third-party arrangements and significant changes to them, keep a register of those arrangements and submit it to the FCA annually.

For many firms the Operational Risk Director will own both processes. If your current incident log is a spreadsheet maintained by operations, or your outsourcing register is held by procurement and has never been reconciled to your important business services, the person you hire will spend their first year on exactly this work.

The critical third parties regime

The regime for critical third parties lets HM Treasury designate suppliers whose failure could threaten financial stability or confidence, and brings them under direct oversight by the Bank of England, the PRA and the FCA. On 10 July 2026 the Treasury made the first four designations (Amazon Web Services EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle Corporation UK), with oversight beginning on 13 July 2026. Designation does not shift responsibility away from the firms that use those suppliers: each firm remains accountable for managing its own outsourcing and third-party risk. Boards will expect their Operational Risk Director to explain what the regime does and does not change for the firm’s cloud concentration risk and exit plans.

Basel 3.1 operational risk capital from 1 January 2027

For banks and building societies on the Basel 3.1 regime, the PRA’s final rules (PS1/26, published 20 January 2026) take effect on 1 January 2027. Operational risk capital moves to a single standardised approach driven by the Business Indicator, a measure built from interest, services and financial income components, and the existing approaches are replaced. In the UK the internal loss multiplier is set at 1, so a firm’s own loss history does not change its Pillar 1 operational risk charge. Loss data still matters: the rules include loss data requirements, and supervisors will use the firm’s loss experience and scenario analysis when they look at Pillar 2 and the ICAAP. Smaller lenders that have opted into the PRA’s simpler regime for small domestic deposit takers follow different rules, so check which regime applies before writing the brief.

What this means for the hire

• Banks and building societies need an Operational Risk Director who has lived through a capital methodology change and can explain the Business Indicator calculation to the board, as well as running the framework.
• Insurers and Lloyd’s managing agents need someone who can connect operational risk scenarios to the ORSA and to the internal model or standard formula, and who can handle the new third-party reporting.
• Asset managers and investment firms need a lead who understands the ICARA, the operational risk K-factors where they apply and the oversight of outsourced fund administration and depositary services.
• Payments and e-money firms sit outside SMCR but inside both the resilience and the new reporting rules, and often need their first dedicated operational risk lead as they scale.
• Core SMCR firms now need incident reporting capability for the first time, which is often the trigger for a fractional or part-time operational risk appointment.

UK Operational Risk Director Compensation and Package Structure

UK Operational Risk Director compensation varies materially with UK FCA-regulated firm scale, sector, and senior accountability scope including SMCR SMF4 framework dimensions where applicable.

UK FCA-authorised bank Operational Risk Director — packages at banks and building societies combine base salary, an annual bonus set under the firm’s remuneration policy and, at larger banks, deferred awards in cash and shares. Where the Operational Risk Director is identified as a material risk taker, deferral, malus and clawback apply to variable pay. The bonus cap was removed on 31 October 2023, and the PRA (PS21/25) and the FCA (PS25/15) have since reformed the remuneration rules further, so the balance between fixed and variable pay is moving and should be checked against the firm’s current policy rather than old market habits. Challenger banks often weight more of the package towards equity or long-term incentives than established banks, which matters when a candidate is weighing a move from a larger institution.

UK FCA-authorised asset manager Operational Risk Director — at MIFIDPRU investment firms the remuneration code in SYSC 19G applies, with its proportionality tiers deciding how much of the variable pay must be deferred or paid in instruments. Because the Operational Risk Director is a control function, pay should be set against the objectives of the risk function and not against the performance of the business areas it oversees. At alternative investment fund managers and hedge funds the variable element can be a larger share of total pay, and carried interest or co-investment rights are sometimes offered to senior control function staff; the tax treatment of carried interest changed from 6 April 2026, so candidates will ask how any carry award is structured.

UK insurance firm Operational Risk Director — insurers and Lloyd’s managing agents apply the Solvency UK remuneration requirements, with deferral for staff whose roles have a material impact on the risk profile. Packages usually combine base salary, a bonus scheme and, at listed groups, a long-term incentive plan. Lloyd’s managing agents compete with company-market insurers and with banks for the same operational risk talent, which pushes packages up where the candidate pool is thin.

We do not publish salary ranges on this page because operational risk pay varies with the size of the balance sheet, the regulatory perimeter and whether the role carries an SMF. During the brief we benchmark the package against current market evidence for comparable firms and roles; our SMF salary guide sets out how senior regulated-firm pay is structured. The questions that move a package most are: does the role hold or deputise for SMF4, is it a material risk taker role, how large is the team, and does the firm need someone who has run an operational risk capital calculation or only a framework?

Permanent, interim or fractional operational risk leadership

Not every firm needs a full-time Operational Risk Director, and some need one urgently while a permanent search runs. The right format depends on the size of the firm, the state of the framework and how quickly the regulator expects to see progress.

Many of the smaller firms that ask us about operational risk actually need a compliance appointment first. If you are a Core SMCR firm or a payments business, the regulator’s first question is usually who holds SMF16 Compliance Oversight and SMF17 Money Laundering Reporting, or who your MLRO is if you are outside SMCR. Both SMF16 and SMF17 are pre-approval roles, and a fractional holder working one or two days a week is often the most practical answer. We place a fractional compliance officer or an interim CCO for exactly this situation, and that person can often own the operational risk framework and incident reporting as well until the firm is large enough for a separate hire.

If an SMF holder leaves suddenly, the temporary cover rule in SUP 10C.3A.6R lets another person cover the function while an application is prepared; since the SMCR changes in force on 24 April 2026 the firm has 12 weeks to submit an application, and the FCA’s CP26/37 proposes extending that to 18 weeks. Our urgent SMF appointment service is set up for that situation.

UK Operational Risk Director Required Experience and Qualifications

UK Operational Risk Director appointments typically require senior operational risk career experience and qualification credentials across the following dimensions.

Senior UK operational risk career background — typically 12-18+ years of senior UK operational risk career experience including prior UK Operational Risk Director or senior Head of Operational Risk experience at peer UK FCA-regulated firms, prior UK senior operational risk leadership career background at UK FCA-authorised banks, UK FCA-authorised asset managers, UK insurance firms, or UK selected UK FCA-regulated firms with material operational risk function dimensions.

Sector-specific UK regulatory framework career background — UK Operational Risk Director appointments typically require sector-specific UK regulatory framework career background. UK FCA-authorised bank Operational Risk Director candidates typically come from UK banking career backgrounds with UK PRA Operational Risk Capital framework career experience; UK FCA-authorised asset manager Operational Risk Director candidates typically come from UK asset management career backgrounds with UK MIFIDPRU/AIFM/UCITS framework career experience; UK insurance firm Operational Risk Director candidates typically come from UK insurance career backgrounds with UK PRA Solvency II framework career experience.

SMCR SMF4 framework career background — UK Operational Risk Director appointments at SMF4 Chief Risk function tier or with SMF4-related career background dimensions typically require demonstrable UK SMCR framework career experience including prior SMCR Senior Manager regime career background where applicable, SMCR conduct rules framework career background, SMCR fit and proper framework career background, and the wider UK SMCR framework career background dimensions.

IRM — Institute of Risk Management qualification framework — the principal UK risk management professional qualification framework with IRM (Institute of Risk Management) qualification credentials operating as standard UK senior risk management professional credentials. IRM qualification framework dimensions include IRM International Certificate in Enterprise Risk Management (Level 3), IRM International Diploma in Enterprise Risk Management (Level 6), and IRM Fellowship operating as the senior IRM credential at senior UK risk management professionals.

ICA — International Compliance Association qualification framework — UK Operational Risk Director appointments at UK FCA-regulated firms with material UK FCA compliance framework intersection frequently include preferences for ICA (International Compliance Association) qualification credentials including ICA International Diploma in Governance, Risk and Compliance, ICA International Diploma in Anti Money Laundering, and adjacent ICA qualification framework credentials.

CFA — Chartered Financial Analyst qualification framework — UK Operational Risk Director appointments at UK FCA-authorised asset managers and UK FCA-authorised banks operating at material commercial scale frequently include preferences for CFA Charterholder credentials operating as standard senior UK investment management and senior UK banking professional credentials.

IRM operational risk credentials and adjacent operational risk professional credentials — UK Operational Risk Director appointments typically include preferences for specialist operational risk credentials such as the IRM International Certificate in Operational Risk Management, launched in 2024 (the IRM has worked in alliance with the Institute of Operational Risk since 2019). Adjacent senior UK operational risk professional credentials include FRM (Financial Risk Manager) credentials administered by GARP (Global Association of Risk Professionals), PRM (Professional Risk Manager) credentials administered by PRMIA (Professional Risk Managers’ International Association), and adjacent senior UK operational risk professional credentials.

What a Head of Operational Risk typically delivers in the first 90 days

A good Head of Operational Risk or Operational Risk Director spends the first three months listening, testing and prioritising before rewriting anything. The plan below is what we would expect a strong hire to present at final interview; asking candidates to sketch their own version is one of the best ways to separate those who have built a function from those who have only run one.

Days 1 to 30: understand the firm and its risks

• Meet the CRO, the COO, the heads of the main business lines, internal audit and the chair of the risk committee, and agree what each expects from operational risk.
• Read the last year of risk committee papers, internal audit reports, the operational resilience self-assessment and any regulatory correspondence or section 166 findings.
• Review the incident log and loss data for completeness: are incidents being captured, classified and closed, and does the data match what the business says happened?
• Check the third-party and outsourcing register against the important business services map.

Days 31 to 60: test the framework

• Walk through the risk and control self-assessment for two or three high-risk processes with the first line, testing whether controls are designed and working as described.
• Assess key risk indicators: are thresholds linked to risk appetite, and do breaches lead to action?
• Map the gap between current incident and third-party processes and the requirements of PS26/2 ahead of 18 March 2027.
• For banks, review the Business Indicator calculation and the data behind it ahead of Basel 3.1 on 1 January 2027.

Days 61 to 90: set the plan

• Present a prioritised plan to the CRO and the risk committee, with owners, dates and the resources needed.
• Agree the operational risk appetite statements and the reporting pack the board will receive.
• Set the scenario analysis programme for the year and link it to resilience testing, ICAAP, ORSA or ICARA as relevant.
• Confirm the team structure and any hires, and start closing the highest-priority control gaps.

Senior UK Operational Risk Director Search — Methodology

UK senior Operational Risk Director search engagement at Exec Capital follows a structured retained methodology calibrated to the specific dynamics of UK Operational Risk Director recruitment.

Structured brief development — every senior UK Operational Risk Director mandate at Exec Capital begins with structured brief development that articulates the firm scenario (UK FCA-authorised bank, UK FCA-authorised asset manager, UK insurance firm, UK selected UK FCA-regulated firm with material operational risk dimensions), the sector context, the operational risk function scope dimensions, the SMCR SMF4 framework requirements where applicable, the UK regulatory framework requirements (FCA Operational Resilience framework, PRA Operational Risk Capital framework where applicable, Basel III / CRR Operational Risk framework where applicable), the qualification requirements (IRM, ICA, CFA, IRM operational risk certificate, FRM, PRM), and the senior commercial dimensions specific to the firm.

UK Operational Risk Director candidate pool research — UK senior Operational Risk Director candidate pool research operates with concentrated research extending across the relevant UK Operational Risk Director candidate pool. UK Operational Risk Director candidate pool extends across senior UK Operational Risk Directors at peer UK FCA-regulated firms in the relevant sector, senior UK Heads of Operational Risk with senior progression dimensions, senior UK risk professionals at UK FCA-authorised banks/asset managers/insurance firms operating at material commercial scale, and adjacent senior UK risk professional candidate pool dimensions.

Engagement and fees

Most Operational Risk Director appointments are run on a retained basis. The candidate pool is small, the best people are rarely looking, and the work of approaching them confidentially and assessing technical depth justifies a committed search. Contingent recruitment can work for a more junior Head of Operational Risk role where the pool is wider and the brief is standard. Our guide to retained and contingent executive search explains the trade-offs.

The fee structure is agreed with you at briefing and set out in our terms before work starts. For interim and fractional appointments we quote a day rate, and that day rate includes our fee, so there is one figure to budget for.

Every engagement includes:

• A written brief and candidate profile agreed with you before research starts.
• Market research and confidential approaches to candidates who are not actively looking.
• Structured interviews and written assessments of each shortlisted candidate, including technical testing of operational risk knowledge.
• Package benchmarking and offer negotiation.
• Referencing, and support with regulatory reference requests and the timetable for any SMF application or certification assessment.
• Contact with the candidate through the notice period and the early months in role.

Who we place operational risk leaders with

We recruit Operational Risk Directors, Heads of Operational Risk and operational resilience leads for UK regulated firms of every size, from start-ups preparing for authorisation to established groups. Typical clients include:

• Banks and building societies, including challenger and specialist lenders preparing for Basel 3.1.
• Insurers, reinsurers and Lloyd’s managing agents, where operational risk links to the ORSA and to outsourcing of claims and policy administration; see our insurance recruitment practice.
• Asset and wealth managers, including fund managers that outsource administration, custody and technology.
• Payments and e-money firms, which are outside SMCR but in scope of the resilience and reporting rules; our guide to senior hiring at payment institutions covers how the FCA assesses their management.
• Consumer credit lenders and brokers, where Consumer Duty outcomes depend on processes working as designed; operational risk and credit risk leadership are often hired together.
• Investment firms, brokers and trading venues, where trading and settlement errors are a large part of operational loss.
• Private equity investors buying into regulated businesses, who want the risk framework fixed before or soon after completion.

Across these sectors our financial services executive search practice covers the wider leadership team, so an operational risk hire can be run alongside a CRO, COO or compliance appointment where the firm is rebuilding its control functions.

Cross-Portfolio Architecture and Adjacent Senior UK Risk Recruitment Engagement

UK senior risk recruitment engagement extends across Exec Capital and the broader Exec Capital cross-portfolio architecture with FD Capital cross-portfolio engagement specific to senior UK FCA-authorised firm SMF holder recruitment.

FD Capital — UK FCA-authorised firm senior CFO and senior SMF holder authority — sister site FD Capital operates as the dedicated UK FCA-authorised firm senior commercial CFO and senior SMF holder authority across senior UK FCA-authorised firm appointments at material commercial seniority. UK senior SMF4 Chief Risk function holder appointments at UK FCA-authorised firms at material seniority frequently operate within FD Capital cross-portfolio senior commercial authority given the SMF holder dimensions specific to UK FCA-authorised firm senior appointments.

UK Director of Risk and Compliance — combined risk and compliance leadership — for UK Director of Risk and Compliance recruitment service engagement covering combined risk and compliance senior leadership scope see Director of Risk and Compliance Job Description.

UK Chief Risk Officer (CRO) — C-Suite enterprise risk leadership — for UK CRO recruitment service engagement covering C-Suite tier enterprise risk leadership see CRO Recruitment; for UK CRO Job Description reference see Chief Risk Officer Job Description.

UK Chief Compliance Officer (CCO) and senior compliance leadership engagement — for UK CCO recruitment service engagement see CCO Recruitment; for UK CCO Job Description reference see Chief Compliance Officer Job Description.

UK Part-Time MLRO and adjacent UK AML leadership engagement — for UK Part-Time MLRO recruitment service engagement at UK FCA-regulated firms operating with structured part-time MLRO engagement requirements see Part-Time MLRO.

Other ways to hire operational risk and control leadership

This page covers Operational Risk Director and Head of Operational Risk recruitment. If the role you need is broader or sits elsewhere, our sibling pages cover it: compliance and risk recruitment for combined control function hires, risk manager recruitment for asset management for investment and portfolio risk roles at fund managers, and head of internal audit recruitment for the third line. Chief Risk Officer appointments are covered on our CRO recruitment page above.

Looking for an operational risk role?

If you are an operational risk professional looking for your next Head of Operational Risk or Operational Risk Director role, register with us and see our current opportunities. Many of our operational risk appointments are confidential and are never advertised.

Frequently asked questions

What does an Operational Risk Director do?

An Operational Risk Director leads the second-line operational risk function. They set the operational risk framework, oversee risk and control self-assessments, run incident and loss data processes, set key risk indicators, lead scenario analysis, oversee operational resilience and third-party risk, and report to the CRO, the risk committee and the board. At banks they also own the operational risk capital inputs.

Is a Head of Operational Risk the same as an Operational Risk Director?

Usually the role is the same and the title depends on the firm’s grading. Larger banks and insurers tend to use Director or Managing Director titles; smaller firms and asset managers more often use Head of Operational Risk. What matters is the scope: framework ownership, team size, reporting line and whether capital is involved.

Is the Operational Risk Director an SMF4 role?

Not normally. SMF4 Chief Risk is held by the CRO, and it only exists at banks, building societies, insurers and other dual-regulated firms and at FCA Enhanced scope SMCR firms. The Operational Risk Director is usually a certified role reporting to the SMF4 holder. Some smaller Enhanced firms combine the two, in which case the hire needs regulatory approval.

Do Core SMCR firms need an Operational Risk Director?

Rarely as a full-time role. Core firms have no SMF4 and are not in the list of firms covered by the operational resilience rules, but they are covered by the new incident reporting rules from 18 March 2027. Many use a part-time or fractional risk lead, often combined with their compliance appointment.

Do payment and e-money firms need operational risk leadership?

Yes. Payment and e-money institutions are outside SMCR, but they are in scope of the operational resilience rules and of both the incident and the third-party reporting rules in PS26/2. As they scale, most need a dedicated operational risk lead alongside their MLRO.

How is an Operational Risk Director different from a Head of Operational Resilience?

The Operational Risk Director provides second-line oversight of all operational risks. A Head of Operational Resilience usually sits in the first line, in operations or technology, and delivers the resilience programme: important business services, impact tolerances, mapping and testing. The Operational Risk Director challenges that work.

What does Basel 3.1 mean for bank operational risk hires?

From 1 January 2027 banks on the Basel 3.1 regime calculate operational risk capital under a single standardised approach based on the Business Indicator, with the internal loss multiplier set at 1 in the UK. Banks want Operational Risk Directors who can manage the change, explain the calculation and keep loss data and scenario analysis at a standard that supports Pillar 2.

Can we hire an interim or fractional operational risk lead?

Yes. Interim operational risk leaders cover vacancies and remediation programmes full-time for a fixed period; fractional leaders work one or two days a week for smaller firms. Both are priced on a day rate that includes our fee.

What qualifications should an Operational Risk Director have?

There is no mandatory qualification. Common credentials include IRM qualifications (including the International Certificate in Operational Risk Management), FRM or PRM, and ICA diplomas where the role overlaps with compliance. Experience of running a framework at a comparable firm usually counts for more than the certificate.

How long does an Operational Risk Director search take?

It depends on the brief, the size of the candidate pool, the interview process and notice periods, which are often three months or longer at this level. We agree the timetable with you at briefing and, where an interim is needed in the meantime, can run both searches together.