SMF10 Chair of the Risk Committee: Responsibilities, Approval and CP26/37

SMF10, the Chair of the Risk Committee function, is the senior management function held by the non-executive director who chairs the board committee overseeing the firm's risk management. It applies only at Enhanced firms and dual-regulated firms, and only where a risk committee exists. Today it is an approved role; under the FCA's CP26/37 and the PRA's CP14/26 it is proposed to become a notified role.

What SMF10 covers

SUP 10C.5A.8R defines the chair of the risk committee function as having responsibility for chairing, and overseeing the performance of, any committee responsible for the oversight of the firm's risk management systems, policies and procedures. The name of the committee does not matter. A "Board Risk Committee", a "Risk and Compliance Committee" or a combined "Audit and Risk Committee" all count if they oversee risk management.

The holder is a non-executive director, usually with a background as a chief risk officer, banker, actuary or senior finance professional. The role sits alongside SMF4, the Chief Risk function: SMF4 runs the risk function day to day, and SMF10 makes sure the board can see and challenge what SMF4 reports. See our SMF4 guide.

If a firm is not required to have a risk committee but sets one up anyway, chairing it is still SMF10 (SUP 10C.5A.2G). If the firm later closes the committee, the chair stops performing the function.

Example: a significant UK bank must have a risk committee of non-executive members under SYSC 7.1.18R. The non-executive director who chairs it holds SMF10, approved by the PRA because at a bank SMF10 is a PRA function.

For the full set of roles see our Senior Management Functions guide.

Which firms need an SMF10

The FCA list is in SUP 10C Annex 1: SMF10 appears only in the Enhanced firm table. At dual-regulated firms, CP26/37 confirms that SMF10 is a PRA function, defined in the PRA Rulebook.

What the SMF10 holder is personally accountable for

Statement of Responsibilities. This is the document, held by the regulator, that lists what this person answers for. For a committee chair it is short: chairing the risk committee and overseeing its performance, plus any prescribed responsibilities. The FCA expects a non-executive's statement to be less extensive than an executive's (SUP 10C.11.34G). Our guide to statements of responsibilities covers drafting.

Prescribed responsibilities. These are specific duties the rules require a firm to give to a named senior manager. SYSC 24 Annex 2 names SMF10 as the most appropriate holder of:

• PR K: safeguarding the independence of, and overseeing the performance of, the compliance function, including the SMF16 holder
• PR L: safeguarding the independence of, and overseeing the performance of, the risk function, including the SMF4 holder

At solo-regulated Enhanced firms these are FCA prescribed responsibilities. At dual-regulated banks the PRA's equivalent PR K and PR L must go to an oversight function such as SMF10 (PRA Allocation of Responsibilities).

Conduct Rules. The SMF10 holder must follow the Individual Conduct Rules, including Rule 6 on the Consumer Duty, and the Senior Manager Conduct Rules SC1 to SC4 in COCON 2: take reasonable steps to keep the business they are responsible for controlled and compliant, oversee any delegation, and tell the regulator what it would reasonably expect to know.

Duty of Responsibility. Under section 66A(5) of FSMA the regulator can act against a senior manager if the firm breaches a requirement in their area and they did not take reasonable steps to prevent it. For SMF10 the area is the committee's oversight of risk management, not the running of the risk function. DEPP 6.2.9-EG says the steps expected of a non-executive may differ from an executive's, and the FCA carries the burden of proof. COCON 1 Annex 1 sets out what the FCA expects of a committee chair: meetings often enough, open challenge of executives, enough time on the committee's remit, the right information, and reporting to the board.

Reasonable steps in practice

Our article on senior manager reasonable steps sets out the general standard. For a risk committee chair the evidence is in the committee's own records.

At CRR firms SYSC 7.1.19R requires the risk committee to have adequate access to information on the firm's risk profile and to decide the nature, amount, format and frequency of risk information it receives. A minuted decision on the risk information pack is direct evidence of that.

The first 90 days in the role

• Read the handover pack, the last year of committee papers and the most recent internal audit reports on risk management. Enhanced firms must have handover procedures under SYSC 25.9.
• Agree your Statement of Responsibilities, including PR K and PR L where they apply.
• Meet SMF4 and SMF16 one to one, then set a standing private session with each.
• Review the terms of reference and the forward agenda against the firm's risk register.
• Agree the risk information pack and paper deadlines.
• Test the risk appetite statement: is every limit measurable, and does the committee see breaches?
• Meet the chairs of the audit and remuneration committees to agree how issues pass between committees.
• Schedule a committee effectiveness review within the first year.

Applying for approval

Today the firm applies on Form A. At an Enhanced firm the FCA approves. At a dual-regulated firm the application goes to the PRA, which needs the FCA's consent (SUP 10C.9.11G). Before applying, the firm must be satisfied the candidate is fit and proper; our guide to fitness and propriety covers the tests.

• Criminal records check: no more than 6 months old when the firm applies. Not needed for a move within the firm or group, or where the firm already checked the candidate as a board director, which often covers a sitting non-executive taking the committee chair (SUP 10C.10.16R).
• Regulatory references: from the current employer and anyone who employed the candidate in the past six years, given within four weeks.
• Competence: evidence of risk expertise, a skills gap analysis and an induction plan.
• Interview: possible where the regulator has questions; for dual-regulated firms either regulator or both may interview.
• Timing: three months from a complete application; the FCA has committed to work to two months.

The candidate cannot start a planned appointment before approval. The temporary cover rule covers an SMF10's temporary or reasonably unforeseen absence, for example by letting another committee member chair, for up to 12 weeks, or until the regulator decides if the firm applies within those 12 weeks. Acting without approval exposes the person to action under section 63A of FSMA.

What CP26/37 would change for SMF10

CP26/37 proposes that at dual-regulated and Enhanced firms SMF5, SMF10, SMF11, SMF12, SMF13, SMF14 and SMF15 become notified rather than approved. SMF10 is on that list. The split between the regulators matters:

• At Enhanced solo-regulated firms SMF10 is an FCA function. The firm would notify the FCA through My FCA.
• At dual-regulated firms SMF10 is a PRA function. The PRA's CP14/26 also lists SMF10 as notified, so the firm would notify the PRA. A notification to the PRA does not need to be copied to the FCA and needs no FCA consent.

Notification is not a lighter standard. The firm must complete the fitness and propriety assessment first, including regulatory references, criminal records checks, right to work checks and a Statement of Responsibilities, and the holder of PR A answers for that vetting. Notifications can be made up to three months ahead and take effect on acknowledgement or on the stated start date. The regulators keep a power to require pre-approval in exceptional cases, such as serious concerns about the firm's governance. The Duty of Responsibility and Conduct Rules apply in full.

Other changes for SMF10:

• The FCA would remove PR K and PR L, keeping only PR A, PR D, PR Z and, for Enhanced firms, PR J-3. The PRA's summary of the prescribed responsibilities it proposes to remove does not mention its PR K or PR L.
• Statements of Responsibilities would not be refiled on change but kept current and provided on request.
• Temporary cover would rise from 12 to 18 weeks. For FCA functions a "reasonable use" test replaces "reasonably unforeseen"; the PRA keeps its test for PRA functions.
• Applications can still be made until commencement, and notifications for later start dates from one month before. The PRA says approvals granted before implementation continue.

Consultation closes on 22 January 2027; final rules are expected in the first half of 2027 and would take effect around six months later, subject to the Financial Services and Markets Bill. Our CP26/37 article covers the full package.

Holding SMF10 with other functions

• SMF11, Chair of the Audit Committee: a CRR firm that is not significant may combine its risk and audit committees (SYSC 7.1.18AAG), and members must then have the knowledge for both. The chair of a combined committee holds SMF10 and SMF11. See our SMF11 guide.
• SMF12, Chair of the Remuneration Committee: serving on both committees helps link risk and pay, but one person chairing both concentrates two oversight roles. See our SMF12 guide.
• SMF14, Senior Independent Director: a common combination for an experienced non-executive.
• Executive roles: SMF10 is an oversight role. Giving it to someone who also manages the risk function would defeat its purpose. At large insurers, PRA rules bar a group executive from chairing the risk committee.

How we support SMF10 holders

We prepare risk committee chairs for approval today and for notification under the new rules, working from the committee's actual papers. See our Senior Manager training and SM&CR support.

• one-to-one Senior Manager training built on the person's own Statement of Responsibilities
• drafting and review of the Statement of Responsibilities
• the Form A application and fitness and propriety file
• FCA interview preparation
• handover arrangements