SMF4: The Chief Risk Officer Function and Why Independence Defines It

The Chief Risk Officer is the Senior Management Function the regulator relies on to be the independent check inside a firm. SMF4 — the chief risk function — is held by the individual with responsibility for the firm’s risk management framework, and the defining feature of the role is its independence from the business it oversees. For a board appointing a CRO, that independence shapes who can hold the function, how the role is structured, and what the firm must demonstrate to the regulator. This article explains what SMF4 is, which firms must have it, why independence matters so much, how the 2026 changes to the Senior Managers and Certification Regime affect the appointment, and how to run the search.

Exec Capital runs Chief Risk Officer (SMF4) recruitment as retained, research-led searches. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate, and candidates are assessed against both risk leadership capability and the regulatory standing the function demands.

What SMF4 Is

SMF4 is the chief risk function — a Senior Management Function held by the individual with overall responsibility for the firm’s risk management framework and for overseeing the risks the firm runs. The PRA’s rules describe it as having responsibility for the overall management of the firm’s risk controls, including the setting and managing of its risk exposures, and reporting directly to the governing body on the firm’s risk management arrangements. In practice the holder owns the risk appetite framework, the identification and monitoring of material risks, and the independent challenge of the business’s risk-taking. In most firms the holder is the Chief Risk Officer.

Like every Senior Management Function, SMF4 is held by an approved person who must be assessed as fit and proper, holds a Statement of Responsibilities, and is subject to the Conduct Rules and the Duty of Responsibility. Our overview of the Senior Managers and Certification Regime covers those obligations in more detail. What sets the risk function apart is that its value depends on its independence: a CRO who cannot challenge the business, or who has been captured by it, is not discharging the function the regulator expects.

It also helps to be clear about what SMF4 is not. It is not the compliance oversight function (SMF16), which covers the firm’s compliance with regulatory rules, and it is not internal audit (SMF5), which provides third-line assurance over the whole control environment, risk included. In larger firms these are three separate people with three separate reporting lines. In smaller firms the boundaries blur, and that is where most of the difficult design questions arise.

Which Firms Must Have an SMF4

Not every regulated firm needs a designated chief risk function. Whether SMF4 applies depends on who regulates the firm and how it is classified.

• PRA-regulated (dual-regulated) firms. For banks and building societies, the chief risk function is set out in the PRA’s senior management functions rules, and the PRA applies equivalent rules to the insurers it regulates. At dual-regulated firms most SMFs, SMF4 included, are approved by the PRA with the FCA’s consent.
• FCA solo-regulated Enhanced firms. Under the FCA’s regime, the chief risk function is one of the additional SMFs that applies only to Enhanced firms, alongside functions such as the Chief Finance function, Head of Internal Audit and the board committee chairs. The FCA’s guide to the SM&CR for solo-regulated firms lists the Enhanced-only functions.
• Core and Limited Scope firms. These firms do not have an SMF4. Risk management still has to be adequate for the business, but responsibility for it sits with other senior managers — often the chief executive or an executive director — rather than with a designated chief risk function.

Classification is not fixed. A solo-regulated firm that grows through the Enhanced thresholds, or a firm that applies for a banking licence, moves into SMF4 territory and needs to plan the appointment early. Equally, the 2026 reform proposals (covered below) would move some firms out of the Enhanced category. Boards should confirm their current classification with their compliance function before scoping a CRO search, because it determines whether the role needs regulatory approval at all.

Why Independence Defines the Role

The CRO is the second line, not the first

Under the three-lines model that regulated firms are expected to operate, the business owns and manages its risks (the first line), the risk and compliance functions provide independent oversight and challenge (the second line), and internal audit provides independent assurance (the third). The CRO sits in the second line. Their job is not to run the business or to take the risks, but to own the framework within which risk is taken and to challenge it independently. A CRO drawn too far into first-line decision-making loses the independence the function depends on.

This is easy to state and harder to protect in practice. CROs are often among the most commercially aware people in the building, and executive teams naturally pull them into product, pricing and deal decisions. Some involvement is healthy: a risk function that only sees decisions after they are made adds little. The test is whether the CRO is advising on and challenging the decision, or has become one of the people making it.

Access to the board matters

An effective CRO has a direct line to the board, typically through a risk committee, and the standing to escalate concerns over the heads of the executive where necessary. The PRA’s own description of the function refers to reporting directly to the governing body. A CRO buried in the management line, reporting only through the chief executive, cannot give the board an unvarnished view of the firm’s risk profile. The function works closely with the risk committee chair and the other financial services non-executive directors on the board, and the strength of that relationship is one of the better predictors of whether the CRO will be effective.

Independence of judgement and of mind

Independence is structural, but it is also personal. The best CROs combine technical command of the firm’s risks with the temperament to hold a position under pressure and the judgement to know which risks matter. Assessing an SMF4 candidate means testing both: the technical risk expertise, and the independence of mind to challenge a confident executive team when the framework requires it.

Pay and incentives are part of this. A CRO whose variable pay is tied to the same revenue targets as the business lines they oversee faces an obvious conflict. Boards should expect candidates to ask how their remuneration is set and by whom, and should treat that question as a sign of the right instincts rather than a negotiating tactic.

What the Board Is Really Hiring

An SMF4 appointment asks for risk leadership and regulatory standing at once. The first is command of the firm’s risk landscape — the material risks it runs, the framework to manage them, and the judgement to advise the board. The second is the regulatory dimension: an understanding of the chief risk function’s role in the firm’s governance, the credibility to be assessed as fit and proper, and the independence the function depends on.

• A risk leadership record appropriate to the firm’s scale, business model and risk profile;
• Command of the firm’s material risks and of a risk management framework proportionate to the firm;
• The regulatory credibility to be assessed as fit and proper for the chief risk function;
• The structural and personal independence to provide genuine second-line challenge;
• The judgement and temperament to discharge the Duty of Responsibility for the firm’s risk framework.

The SMF4 works closely with the firm’s governing functions — the chief executive (SMF1) and the chief finance function (SMF2) — and, at insurers, with the Chief Actuary (SMF20), given how closely the actuarial and risk functions interlock. A CRO who understands how risk accountability fits with the finance, compliance and (where relevant) actuarial functions is worth more than one who treats risk in isolation. Where the second line is being built as a whole, it often makes sense to look at the brief alongside wider compliance and risk recruitment so the team below the CRO is designed at the same time.

Matching the profile to the firm

The right CRO for a deposit-taking bank looks different from the right CRO for an insurer, an Enhanced asset manager or a consumer credit firm. Banking CROs tend to be measured on credit, liquidity and capital risk; insurance CROs on underwriting, reserving and the own risk and solvency assessment; asset management CROs on investment, liquidity and operational risk across funds. A strong candidate from one sector can move to another, but the board should be honest about how much learning the move involves and whether the firm can carry it in the first year.

Stage matters too. A firm going through authorisation or a first PRA review needs someone who can build a framework from limited foundations and explain it to a supervisor. An established firm with a mature framework may need someone who can sharpen risk appetite, improve reporting to the board and lead a larger team. The CV of the first person is rarely the CV of the second.

The 2026 SM&CR Reforms and SMF4 Appointments

The regulators have changed parts of the approval process this year and are consulting on larger changes. For a board planning a CRO appointment, it helps to separate what is already in force from what is still only proposed.

In force since 24 April 2026

The FCA (PS26/6) and the PRA (PS12/26) published Phase 1 of their SM&CR review in April 2026, with most changes taking effect on 24 April 2026. The changes most relevant to an SMF4 appointment are:

• The 12-week rule is now a submission deadline. Where a senior manager leaves unexpectedly or is temporarily absent, someone can cover the role without approval, but the firm now has 12 weeks to submit a complete application rather than 12 weeks to have it submitted and decided. The Senior Manager Conduct Rules apply to the person providing cover.
• Criminal record checks last longer. The check for an SMF candidate must now be carried out within six months before the application is submitted, up from three months.
• Regulatory references should be faster. Firms should aim to respond to regulatory reference requests within four weeks rather than six.

Separately, the FCA has set itself a target of completing at least half of senior manager applications in 35 days or less. That is a performance target, not a guarantee for any individual case, and a complex or incomplete application will still take longer. Our article on how SMCR is changing the senior appointment timetable looks at what this means for planning start dates.

Proposed in October 2026 (Phase 2)

On 22 October 2026 the FCA published CP26/37 and the PRA published CP14/26, both closing on 22 January 2027. These are proposals, not final rules. Among other things they propose to reduce the number of senior manager roles that need pre-approval by making some functions notification-only, to raise the thresholds for the FCA’s Enhanced regime so fewer firms fall into it, to remove the Certification Regime (our guide to the Senior Managers and Certification Regimes explains the difference), and to stop ongoing submission of Statements of Responsibilities and Management Responsibilities Maps.

For SMF4 specifically, the PRA’s consultation proposes to keep the chief risk function subject to pre-approval, alongside the chief executive and chief finance functions. In other words, the regulators’ current direction is to lighten the process around some roles while keeping the CRO among the appointments they want to approve in advance. Until final rules are published, firms should plan SMF4 appointments on the basis of the current rules, and treat any change to their own Enhanced classification as something to confirm once the outcome is known.

How to Run the Search

A regulated CRO search rewards a structured, research-led and confidential approach. The brief should be explicit about the firm’s regulatory status, its risk profile and how the risk function is positioned in the governance structure, so candidates are assessed against the independence and regulatory dimensions from the outset. The strongest candidates are usually in post and reached directly, and many will be working through lengthy notice periods, so the timetable for approval and notice should be mapped together.

Exec Capital runs CRO searches on a retained basis. Briefing covers the firm’s regulatory status, its risk profile and the positioning of the risk function as well as the risk leadership brief; research maps candidates with both the risk record and the regulatory standing the function demands; approach and assessment test technical risk expertise and independence of judgement; and the shortlist carries assessment commentary that speaks to fitness and propriety. We support the firm through interviews, offer, the Statement of Responsibilities and the regulatory approval process.

A few practical points tend to decide whether an SMF4 appointment goes smoothly:

• Start the approval paperwork early. With criminal record checks now valid for six months, the check can be run as soon as a preferred candidate is identified, without the risk of it lapsing during a long notice period.
• Draft the Statement of Responsibilities before the offer. The candidate should see exactly what they will be accountable for, and a well-drafted statement makes the application easier to review.
• Prepare the candidate for interview by the regulator. For significant firms, the PRA or FCA may interview an SMF4 candidate. Strong candidates welcome preparation on the firm’s risk profile and current supervisory issues.
• Plan cover. If the outgoing CRO leaves before the successor is approved, decide early who will provide cover under the 12-week rule, or whether an interim CRO is needed.

Where the firm is building out its regulated leadership team — appointing a chief risk function alongside a chief executive, a chief finance function or the compliance oversight function (SMF16) — we coordinate the searches so the second-line functions fit together and the risk function’s independence is preserved.

Frequently Asked Questions

Does every regulated firm need an SMF4?

No. The chief risk function applies to PRA-regulated firms such as banks, building societies and insurers, and to FCA solo-regulated firms classed as Enhanced. Core and Limited Scope firms do not have an SMF4; their risk responsibilities sit with other senior managers. The firm’s SM&CR classification confirms which applies.

Can the CRO also run part of the business?

Combining the chief risk function with a first-line business role undermines the independence the function depends on and is generally avoided. The CRO’s value is as an independent second-line check; a holder who also owns first-line risk-taking cannot provide that. Where resource is constrained, the answer is usually a proportionate risk function, not a conflicted one.

Can SMF4 be held on a fractional basis?

At smaller firms a fractional or part-time chief risk function can work, provided the arrangement gives the holder real responsibility and genuine independence, and the regulator is satisfied they can discharge it. What the firm cannot do is appoint a risk function in name only while the real decisions sit unchecked in the business.

What happens if our CRO leaves suddenly?

Under the 12-week rule, someone can cover the function without prior approval while the firm finds a successor. Since 24 April 2026 the firm must submit a complete application for the permanent holder within those 12 weeks. Many firms bring in an interim CRO so the function is covered by an experienced practitioner during that period.

Will the Phase 2 reforms remove the need for SMF4 approval?

Not on the current proposals. The PRA’s October 2026 consultation proposes keeping the chief risk function subject to pre-approval. The consultations close on 22 January 2027 and final rules may differ, so firms should plan on the current rules for now.

Sources and Further Reading

• FCA — The Senior Managers and Certification Regime: guide for FCA solo-regulated firms
• PRA — PS12/26: Review of the SM&CR, Phase 1
• FCA — FCA sets faster targets for authorisations
• FCA — CP26/37: SM&CR Review, Phase 2
• PRA — CP14/26: Review of the SM&CR, Phase 2