The key insight:
A chief risk officer is paid to say no to the people who set the bonus pool. That is why the pay is built differently from every other chief officer role, and why the fixed element carries more of the weight.
JOH Partners benchmarks the total annual package for a chief risk officer (CRO) at USD 250,000 to 480,000 in the United States, GBP 150,000 to 290,000 in the United Kingdom, AED 1.1 million to 2.6 million in the UAE and SAR 1.2 million to 2.9 million in Saudi Arabia. Large banks and insurers sit above those bands, and the package is built differently from other chief officer roles, with more weight on fixed pay.
The reason is the job. A chief risk officer is paid to tell the people who set the bonus pool when the business is taking more risk than it should. If the pay depended mainly on the same revenue, the independence would be quietly bought. This guide sets out what the market pays, how the package is built, what moves the number, and what to ask before you accept an offer. Note that the abbreviation CRO is also used for chief revenue officer; this guide is about the risk role, and our guide to chief revenue officer pay covers the other.
The figures come from the executive search mandates JOH Partners runs, not from self-reported surveys, and the UAE bands are built to sit consistently with our guides to CEO and C-suite pay in Dubai and the UAE and director and executive compensation globally.
JOH Partners Intelligence
Get the fortnightly brief on GCC careers, salaries, and market moves.
No spam. Unsubscribe any time.
What a chief risk officer is paid, market by market
Total annual package, meaning base plus bonus plus the cash-equivalent value of benefits, for a chief risk officer with genuine enterprise-wide scope. These are JOH Partners benchmarks for 2026.
| Market | Chief risk officer total annual package | Top tier (large banks, insurers, listed and systemically important firms) |
|---|---|---|
| United States | USD 250,000 to 480,000 | USD 500,000 to 900,000+ |
| United Kingdom | GBP 150,000 to 290,000 | GBP 300,000 to 520,000+ |
| United Arab Emirates | AED 1.1m to 2.6m | AED 2.7m to 3.8m+ |
| Saudi Arabia | SAR 1.2m to 2.9m | SAR 3.0m to 4.6m+ |
As with every senior title, the top of each band is not a ceiling so much as the entry point to the next tier of scope. A chief risk officer moving from a mid-sized insurer to a systemically important bank, or from a single-market role to a group mandate, should expect to move towards the top-tier column, not simply negotiate harder within the standard one.
For context on the wider occupation, the US Bureau of Labor Statistics reports a median annual wage of USD 166,570 for financial managers in May 2025. That is a broad occupational median for a much larger group, not a chief risk officer benchmark, and it is a useful reminder of how far a chief officer role sits above the middle of the field.
Where the chief risk officer sits against the rest of the C-suite
In the UAE, the picture across the finance and control roles is close, and the differences are in shape as much as size.
| UAE role (2026) | Total annual package (AED) |
|---|---|
| Chief financial officer | 1.2m to 2.8m |
| Chief operating officer | 1.3m to 3.0m |
| Chief risk officer | 1.1m to 2.6m |
| General counsel | 950k to 2.0m |
The chief financial officer and chief operating officer bands match our UAE C-suite benchmarks, and the general counsel band matches our general counsel salary guide. Our guide to CFO and finance pay in Dubai sets out how the finance ladder fits underneath. The chief risk officer sits just below the CFO and above the general counsel at the typical level, with the overlap between all three real and not an approximation. If you are comparing a risk offer with a legal or finance title elsewhere, compare the reporting line and the scope, not the label.
What moves a chief risk officer's number
Four factors, and the first two matter more than they do for most chief officers.
Regulatory weight. A chief risk officer at a systemically important bank, a regulated insurer or a listed financial group carries a personal regulatory profile that a risk head at a non-financial corporate does not. The more heavily regulated the firm, the higher the band and the more of the package is shaped by rules.
Reporting line and independence. A chief risk officer with a direct line to the board or its risk committee sits in a different position from one who reports into the chief financial officer. In the UAE, the Central Bank's corporate governance regulation for banks says the risk management function must be independent of the risk-taking functions and have a direct reporting line to the Board or the Board risk committee. A role that has the line and the standing is priced as the senior role it is.
Sector. Banking and insurance pay most, then asset and wealth management, then non-financial corporates, where the role is often enterprise risk under a different title.
| Sector (UAE) | Chief risk officer total annual package (AED) | What moves the number |
|---|---|---|
| Banking and financial services | 1.6m to 3.2m+ | Balance-sheet scale, regulatory weight, a place on the executive committee |
| Insurance | 1.1m to 2.2m | Capital and solvency complexity, reinsurance exposure |
| Asset, wealth and family office | 1.0m to 2.2m | Mandate size, and whether risk reports to the investment committee or the chief executive |
| Energy, industrial and other corporates | 0.9m to 1.9m | Whether the job is enterprise-wide or a head-of-risk role |
Scope of mandate. The number of risk types, entities and jurisdictions under the role. A group chief risk officer who covers credit, market, operational, cyber and conduct risk across several countries is a different job from a risk head covering one.
How the package is built, and why it is different
This is the part most candidates underestimate. Across the C-suite, a typical package is roughly half to two thirds base, with the balance in bonus and long-term incentives. For a chief risk officer in a regulated firm, the mix shifts towards fixed pay, for a reason regulators have written down.
The Central Bank of the UAE's regulation says the pay of control-function staff must be predominantly fixed and determined independently of the performance of the bank. That is the clearest statement of the principle in the Gulf, and it applies to the risk function alongside audit and compliance. A chief risk officer at a UAE bank should therefore expect a higher share of fixed pay and a smaller, more tightly controlled variable element than a chief financial officer or chief commercial officer.
In the UK, the Prudential Regulation Authority's supervisory statement on remuneration (SS2/17, in its version effective from 15 October 2025) governs variable pay at the firms it supervises, including deferral, payment in instruments and retention. For instruments awarded upfront, for example, the PRA expects a retention period of at least one year. The exact percentages and periods depend on the firm and the individual's category, so read the firm's own remuneration policy rather than relying on a headline figure.
| Component | What it looks like for a regulated-firm chief risk officer | Why it matters |
|---|---|---|
| Base salary | Often well above half of total reward | The anchor, and a signal of how independent the role is meant to be |
| Annual bonus | Smaller than for revenue roles; linked to risk-function objectives rather than firm profit | Protects the independence of the role |
| Long-term incentive | Where present, deferred, partly in shares and subject to retention and clawback | Check the vesting, leaver terms and what triggers a clawback |
| Benefits | In the Gulf: housing, schooling, flights and a car or allowance | Lifts real take-home well above base |
| Tax treatment | No personal income tax in the UAE | Gross sits very close to net |
What boards are actually buying
A board is buying a person who will escalate. JOH Partners argues that a chief risk officer's direct line to the board is only as real as the chair's willingness to protect it, and warns that when the officer's pay and tenure stay under the chief executive's influence, escalation is quietly discouraged. For a candidate, that is useful. How a board prices the role, and how it structures the reporting line, tell you how seriously it means the independence.
Reading your own offer
Three disciplines matter more than any other.
First, benchmark on scope and regulatory weight, not on the title. A group chief risk officer for a regulated bank and a head of enterprise risk at a manufacturer can share a title and share nothing else.
Second, read the variable pay terms, not just the headline number. Ask what is deferred, what is paid in shares, what is subject to clawback and what happens on leaving. Our guide to total reward sets out how to turn a full package into a single comparable number, and our guide to equity compensation covers how to value instruments properly.
Third, treat the pay conversation as a signal of readiness and independence. The role asks you to say no under pressure, to people who influence your pay. If you want an outside view of how your profile handles that before you are in the room, you can take the free Leadership Psychometric, a 50-question leadership profile. Composure and Influencing Power are the two dimensions most relevant to a role that must say no under pressure.
To see where your own package sits against market bands, Your market value compares on scope and sector, not just title; create a free account and run it.
Free pay range
Find out what your role pays in your market
See the pay range for your role free. Pro adds where you stand against peers, your package component by component and the moves that increase your pay.
See my market value →Key takeaways
- JOH Partners benchmarks a chief risk officer (CRO) at USD 250,000 to 480,000 in the US, GBP 150,000 to 290,000 in the UK, AED 1.1 million to 2.6 million in the UAE and SAR 1.2 million to 2.9 million in Saudi Arabia, with large banks and insurers running higher.
- The package is built differently: regulators expect control functions to be paid independently of the performance of the business, so fixed pay carries more of the weight and variable pay is tightly controlled.
- Regulatory weight, reporting line and sector move the number more than tenure or title. A direct line to the board is both a governance feature and a pricing signal.
- Read the variable pay terms, including deferral, share-based payment, retention and clawback, not just the headline.
- Benchmark on scope, not on the abbreviation. CRO also means chief revenue officer, and the pay structure is the opposite.
For more on what senior roles pay, see the full Salary & Market Data collection.
Frequently asked questions
- What is the average chief risk officer (CRO) salary?
- There is no single meaningful average, because the role varies with the sector and the regulatory weight of the firm. As a total annual package, JOH Partners benchmarks a chief risk officer at USD 250,000 to 480,000 in the United States, GBP 150,000 to 290,000 in the United Kingdom, AED 1.1 million to 2.6 million in the UAE and SAR 1.2 million to 2.9 million in Saudi Arabia, with large banks and insurers running higher in every market.
- How much does a chief risk officer earn compared with a CFO?
- Typically somewhat less, though the gap narrows in banking and insurance. In the UAE, JOH Partners benchmarks the CFO at AED 1.2 million to 2.8 million and the chief risk officer at AED 1.1 million to 2.6 million. The difference is also in the shape of the package: a chief risk officer's pay is weighted towards fixed pay, because the role has to stay independent of the revenue it checks.
- Why is a chief risk officer's bonus smaller than other chief officers'?
- Because the job is to challenge risk-taking, not to generate revenue. Regulators expect control functions to be paid independently of the performance of the business they oversee. The Central Bank of the UAE's corporate governance regulation for banks says pay for control-function staff must be predominantly fixed and determined independently of the performance of the bank.
- Do chief risk officers get long-term incentives and equity?
- Often, particularly in listed and regulated firms, but with tighter controls than in other roles. Variable pay in regulated financial firms is typically deferred, partly paid in shares or similar instruments and subject to retention periods and clawback. The Prudential Regulation Authority's remuneration supervisory statement, for example, expects a retention period of at least one year for instruments awarded upfront.
- Is CRO the same as chief revenue officer?
- No. The abbreviation CRO is used for both chief risk officer and chief revenue officer, and the roles are paid very differently. A chief revenue officer is paid heavily on commercial performance, a chief risk officer on a fixed-weighted basis. If you are comparing pay, make sure the benchmark is for the right CRO.
- Can a psychometric help a risk leader prepare for a chief risk officer role?
- It can show whether your profile has the independence the role needs. The Leadership Psychometric is a 50-question leadership profile that scores five dimensions: Vision Thinking, Execution Drive, Influencing Power, People Intelligence and Composure. Composure and Influencing Power are the two most relevant to a role that must say no under pressure. It informs your development plan; it does not predict appointment.
JOH Partners Intelligence
Get the fortnightly brief on GCC careers, salaries, and market moves.
No spam. Unsubscribe any time.