Corporate · Compliance leadership
Independence and resourcing are tests a prosecutor will ask. We assess the CCO against those tests, not against a policy library.
A Chief Compliance Officer is the person who owns the compliance programme: design, resourcing, escalation, and whether it works in practice. The US Department of Justice restated those tests in the September 2024 update of its Evaluation of Corporate Compliance Programs. A CCO who cannot reach the board or the audit committee, or who is starved of people, fails those tests before the first examination. We retain for that officer. We do not fill a "Head of Policy" title and call it a CCO.
Since 2017 we have completed 41 compliance and regulatory leadership placements — CCO, MLRO, Head of Sanctions, DPO/CPO — inside 230+ in-house placements. The CCO clock is 21 days to shortlist and 10 weeks median to accepted offer. Retained terms: 28-33 percent of first-year cash, three instalments, 12-month replacement. Parent desk: compliance and regulatory recruitment.
Independence is a reporting-line problem. We lock it in the Mandate Blueprint, the same week as the fee.
The CCO can reach the chair of the audit committee without going through the business. Listed and dual-regulated companies: this is the default we brief. NYSE payments CCO in New York was scoped this way.
Day-to-day, the CCO still has to live with legal, risk and the CEO. We name which, and we name the conflict if the GC is also the CCO.
CCO reporting into a business unit, a CRO who owns the bonus, or a GC who will not share the board calendar. Any of those is a design defect under the ECCP independence test.
A privacy officer with a compliance title, or an MLRO asked to be CCO without the programme. Those seats exist; they are different products on the compliance parent.
We place lawyers and non-lawyers into CCO seats. A JD helps when the CCO will also own investigations, employment overlay or the privilege line with the GC. It does not help when the company needs someone who has already sat a BSA exam, an FDA inspection, or a prudential review and can walk the audit committee through what failed. The scorecard says which.
If the company actually needs a GC who happens to own compliance, that is a general counsel succession or a first general counsel with a compliance-heavy brief — not a CCO search with a law degree bolted on.
Banks, asset managers, private credit. Dual-regulated groups of 15-40 lawyers plus compliance. Prudential, conduct, financial crime. Often paired with an MLRO. London and New York City are the densest markets we run.
Licensed principals, NYDFS, FCA, CBI. The NYSE-listed payments CCO in New York was assessed against the ECCP with an audit-committee line. Shortlist week 3, offer week 10.
FDA, EMA, quality-system consent decrees, promotion. A CCO here is not a GCP auditor and not the GC. Boston and the California corridor.
Sanctions, projects, environmental, listed disclosure. Often a second mandate after a Head of Legal. Riyadh, Houston, London. Sanctions specialists sit on a sibling desk.
Sibling seat: sanctions and AML recruitment. Markets: compliance recruitment in New York City, Houston, Boston, Dallas.
ECCP tests, audit line, JD or not, perimeter, 12-month replacement already in the letter.
Sitting CCOs who have sat this supervisor, not policy authors.
Dossiers that name examinations. CCO clock: day 21.
The loop is small on purpose. Median accepted offer week 10.
12-month replacement term. Off-limits 24 months on legal and compliance.
Timeline: Shortlist week 3; accepted offer week 10.
Client references
We asked for a CCO who had sat across a regulator, not a policy author. The dossiers named examinations. We interviewed three. We hired one.
The September 2024 ECCP asks whether compliance is independent, adequately resourced, and empowered to escalate. Prosecutors test design, resourcing and whether the programme works in practice. A CCO who cannot reach the audit committee, or who sits under a business P&L, fails the independence test before the first interview. Source: DOJ Evaluation of Corporate Compliance Programs, September 2024.
No. We place both JD and non-JD CCOs; the scorecard is examinations sat, not the degree. A payments CCO who has lived a BSA exam and a non-JD from a supervisor's office will beat a GC who has only written a policy. The chair of the audit committee at a Euronext-listed insurer in Brussels asked for examinations, not a policy author. We interviewed three. We hired one.
On listed and dual-regulated companies we set an audit-committee reporting line, with a working line into the GC or CEO. The ECCP independence test is the reason. Dual-hatting the GC as CCO is a design choice we will name as a risk, not a default.
Compliance-leadership searches shortlist in 21 days and close at a 10-week median to accepted offer. A NYSE-listed payments CCO in New York: audit-committee line, assessed against the ECCP, shortlist week 3, accepted offer week 10. Read the New York payments CCO.
We have completed 41 compliance and regulatory leadership placements since 2017, inside 230+ in-house placements. That slice includes CCO, MLRO, Head of Sanctions and DPO/CPO. Parent desk: compliance and regulatory recruitment. Sanctions seats: sanctions and AML recruitment.
Retained CCO searches carry a 12-month replacement term, the same window as GC and CLO searches. Fee 28-33 percent of first-year cash, fixed at engagement, three instalments. Off-limits: 24 months on the client's legal and compliance department.
Financial services, payments, life sciences and energy are the perimeters we run most often, plus listed groups in other regulated trades. Dual-regulated financial services typically carry 15-40 lawyers plus a compliance bench. See compliance talent acquisition and hiring a chief compliance officer.
Independence, resourced
41 compliance-leadership placements. 12-month replacement. Fee and off-limits in the letter before we call anyone.
