Islamic bank licensees must have an effective and independent risk management function commensurate with the bank’s size, complexity and risk profile, under the direction of a chief risk officer (CRO) or equivalent, with sufficient stature, independence and skilled resources.