Who holds the chair, who is moving, and how the hiring works
senior figures mapped
senior roles tracked
firms & regulators
documented role moves
This is a commentary on senior risk leadership in UK financial services — who holds the chief risk officer’s chair across the country’s banks and insurers, how those seats are being filled, and where the talent comes from. It draws on Brown Strategic Search Partners’ market map of 56 chief risk officer and senior risk-leadership seats, spanning the Tier-1 institutions, the mid-market and the London specialty insurance market. What follows is a read of the market as it stands in mid-2026 — and of the direction it is travelling.
Across 56 chief risk officer seats mapped in UK financial services, the market splits cleanly in two. The largest institutions grow their own: until this year, eight of nine filled Tier-1 CRO chairs were held by an internal promotion. The mid-market does the opposite, hiring externally by more than two to one. The instinct that a CRO is a role you promote into — too sensitive, too institution-specific to hand to an outsider — holds only at the very top. And even there, it is starting to give.
The split is stark. Among the Tier-1 firms, until this year only one filled CRO chair in nine was held by an external hire — a large insurer that had recruited from outside. The other eight were promoted from within, the chief risk officer raised through the institution’s own risk function, across both banking and insurance. That the pattern held in both sectors marks it as a tier effect rather than a quirk of one. The mid-market behaves in the opposite direction entirely: external hires outnumber internal promotions by more than two to one, twenty-four to eleven.
The reason is structural. The largest institutions carry deep, layered risk benches from which a successor can be drawn; mid-market firms — specialist lenders, scaled digital banks, building societies and mid-tier insurers — rarely do. When the chair turns over they have no internal candidate of the right seniority, and go to the market.
The CRO chair changes hands far more often than its seniority suggests. Five of the ten Tier-1 firms have changed, or are changing, their chief risk officer inside eighteen months.
The two early-2025 moves were internal promotions at Tier-1 banks. The three 2026 appointments broke the pattern, and none was a homegrown promotion. One bank recruited its new CRO from another Tier-1 bank, succeeding a long-serving chief in post since 2017 — the longest-tenured bank CRO in the set — who is retiring this year. One insurer hired from a global bank, its outgoing CRO leaving for a senior role at the regulator. And one banking group promoted its new CRO into the chair from a subsidiary arm after a roughly six-month interim — but that leader had joined the group only a year earlier from outside, so even this was not the homegrown promotion it appeared. The largest institutions — the firms that have always grown their own risk leaders — went to the market in 2026, breaking a pattern that had held until now.
Why are the deepest-benched firms reaching outside at all? Because the job has changed. A decade ago the chief risk officer’s remit sat largely in credit and market risk; it no longer does. The seat now carries operational resilience, cyber and third-party risk, model and AI governance, climate, financial crime and the personal liability of the Senior Managers Regime. Most internal benches were built for the narrower version of the job, and succession planning has, unsurprisingly, not kept pace with how far the remit has moved. When the chair turns, the successor who covers the full span is often not there — which is why even firms that instinctively promote are now going to the market for breadth.
Half of all the CROs in the map come from outside a pure risk career, and the split runs by sector rather than by size. Bank chief risk officers are, overwhelmingly, risk lifers — seventeen of the bank seats are held by career risk professionals. Insurer CROs are not. They are drawn predominantly from actuarial and audit backgrounds: one large insurer’s CRO is a former Big Four advisory partner and an actuary by training; another is a chartered accountant; a third is a Fellow of the Institute of Actuaries and a former Big Four partner. A quieter channel runs to and from the regulator, and it runs both ways — as one recent insurer-CRO departure to the supervisor shows.
The market implication is concrete: in insurance the credible candidate pool is far larger than the list of sitting CROs, because the strongest candidates often sit in actuarial, audit or advisory seats and have never carried the title. A search scoped to the words “career risk officer” screens out half of that field before it begins.
If the mid-market buys its chief risk officers, the question is from where — and the answer is that there is no farm system. No single firm, sector or pipeline supplies the talent; recent hires have been drawn laterally from right across the market — a digital bank recruiting from a mutual, a direct insurer from a motoring-services group, a clearing bank from a specialist lender, and another digital bank from an international bank. A second channel is the Big Four audit and advisory firms, where many of these leaders trained before moving into industry; a third, rarer one is M&A, where an acquiring insurer gained its CRO through a firm it bought.
For the hiring employer, this is what makes the search demanding: the pool is fragmented, so there is no ready shortlist to inherit. Each hire has to be assembled from a different corner of the market — which is exactly why a mapped view of who sits where, and who might move, is worth more than a reactive scramble when the chair empties.
The mid-market’s external bias is not uniform. Building societies are the lone exception, and only just: the mutual model still grows its own marginally more often than it buys — three seats to two, one large society’s recent internal elevation the example. Every other segment buys. Specialist lenders and mid-tier insurers hire externally by roughly two to one, and the venture-backed digital banks do so almost without exception — of the scaled challengers in the map, not one promoted its current CRO from within. The newer and faster-growing the institution, the more certainly it goes to the market, because it has had no time to build a bench.
A handful of seats sit unfilled, bridged by a caretaker while the search runs — rare enough that each one is worth reading, because it marks a firm that a turnover caught without a successor ready. One Tier-1 banking group’s chair ran under an interim for close to six months before it was filled; one specialist bank’s, vacated when its risk chief left late last year, is still open. When a firm is caught short, filling the seat takes about six months — and a prolonged gap does not go unnoticed by the regulator.
For the mid-market, external search is not a fallback; it is the norm, and the data settles the question. These firms do not hold the bench depth to promote, and when the chair turns they compete for the same external talent. For the largest institutions, 2026 has settled the question: promoting from within is no longer the safe default it was. When the seat demands a breadth the internal bench was never built for, the bench does not hold. The board’s task now is to treat succession as a live question — mapped and worked before the chair turns — not a scramble once it has.
And the credible field is both wider and more scattered than the title suggests — it spans risk, actuarial, audit, consulting and the regulator, and sits in no single place. There is no farm system to recruit from, and the benches that exist — even the deepest — were built for a narrower job than the role has become. Only the building societies still find their successor within, and only just. A simpler risk profile keeps the job, for now, within reach of even a mid-market bench. For the rest of the market, the direction of travel is one-way: as the remit keeps widening and internal pipelines thin, more of these chairs will be filled from outside, and filled more often. The firms that map the field continuously — who sits where, who is ready, who might move — will hold the shortlist when the chair turns. Those that wait for the resignation will be hiring into a market that has already moved.
Two Tier-1 institutions went outside in 2026 despite deep benches, and a third group’s incoming chief had joined only a year before — one of these appointments crossing from banking into insurance. When the firms that normally promote start buying, internal succession has fallen behind the remit.
Most CRO seats fill with no gap, by internal promotion or a lined-up successor; the few firms running an interim are the ones a turnover caught short. When that happens the bridge runs about six months — so an interim flags a specific seat where the bench failed, not a standing market.
Every scaled digital bank in the map hired its CRO from outside; none promoted. They are buying experience built elsewhere because they have had no time to grow it.
Actuarial and Big-Four audit are the dominant feeder routes into insurer CRO seats, and the credible talent pool is far wider than the list of sitting CROs — and largely does not carry the title.
A recent insurer-CRO move into the supervisor shows the regulator drawing on the same senior risk talent as the firms it oversees. For now the flow runs outward more than in — a drain on an already-thin pool worth watching.
Drawn from Brown Strategic Search Partners’ UK FS risk-leadership market map: 56 filled chief risk officer and senior risk-leadership seats across Tier-1, mid-market and London specialty insurance firms, plus a regulator talent layer, with six open or in-transition seats tracked separately. Verified June 2026 across company, regulatory and industry sources. Movement is measured over approximately the last eighteen months. Named individuals and firms are omitted from this public version.
Brown Strategic Search Partners is a boutique senior executive search firm focused on data, AI, governance and senior risk mandates at MD and ED level in UK financial services. The mapping behind this work is a working asset we maintain continuously and use to advise on senior seat design, candidate selection, and architectural decisions. We welcome a conversation on any of these findings or a specific senior question on your bench.
Insight-first: Every mandate begins with a structured view of the market, capability trends and leadership patterns.
Integrated lens: We surface cross-domain leaders who operate across technology, data, regulation and strategy.
Pricing philosophy: A flat-fee structure shaped by in-house executive hiring experience — typically 40–60% below traditional search pricing — designed for clarity, predictability and senior delivery.
Senior appointments across Governance, Data & Transformation with specialist FS firms — banks, payments providers, insurers, fintechs and regulated infrastructure.
Example Hires:
Governance – Director of Compliance & NF Risk · Head of Operational Risk for Tech, Cyber & Data · Chief Risk Officer, Channel Islands · Head of Financial Crime, Corporate Bank
Data & Emerging Technology – Head of AI Strategy · Head of AI Data Engineering · Head of Data Governance · Chief Architect