Licensees must appoint a chief risk officer (CRO) or equivalent with an overall responsibility for the licensee’s risk management function.