Payment companies, e-money businesses, cryptoasset companies, wealth managers, lenders, brokers, accounting practices, estate agents and others are protected by the money laundering rules in the UK, and generally require a person with official responsibility to report suspicions to the authorities.
For growing businesses, the question is rarely if these rules apply. Who should take on the role, how much time is required, and what part of the work can be delegated to someone outside the business.
Who Needs an MLRO?
Businesses within the scope of the Money Laundering Regulations 2017 must have a designated officer: a person who receives internal reports of suspected money laundering and decides whether to report them to the National Crime Agency. In most regulated companies, that person is the MLRO.
For FCA authorized companies, the requirements are more extensive. The FCA’s system and control rules in SYSC 6.3 require companies to assign responsibility to a director or senior manager for the company’s anti-money laundering controls, and in companies under the Senior Manager and Certification Regime, the MLRO has the Senior Manager Function, SMF17. That means the regulator has to approve the person before they start, and they take personal responsibility for their area.
What Roles Actually Involve
MLROs are responsible for much more than filling out occasional reports. These roles typically include:
- have a firm assessment of money laundering and terrorist financing risks;
- set standards for checking who the customer is and where the money comes from;
- oversee transaction monitoring and sanction screening;
- receive internal suspicion reports, decide whether to report to the National Crime Agency and handle consent requests;
- training staff to identify and escalate red flags; and
- reporting to the board, at least once a year, on how the company’s controls are working.
It’s a role that requires judgment as much as technical knowledge. A MLRO must take quick decisions, sometimes with customers or colleagues waiting, and be prepared to say no to business when the risk is too high.
Can Roles Be Combined?
In many smaller companies, the MLRO is also a compliance officer, or a senior executive who takes on the role alongside other duties. Combining roles can work when the business is small and the risk is low. It becomes harder as the firm grows: the volume of customers, alerts and reports increases, and the time required for the MLRO role can quickly outstrip what people with other full-time jobs can provide.
The FCA looks at whether the person has sufficient time and the right experience for the size and risk of the company. A managing director who is also the MLRO of the fast-many payment business, for example, is likely to face questions.
What You Can Outsource, and What You Can’t
Much of the day-to-day work of financial crime can be supported from outside. Companies generally use external providers for customer screening tools, transaction monitoring systems, independent review of controls, staff training and periodic customer review assistance.
What cannot be outsourced is accountability. The company remains responsible for meeting its obligations, and the MLRO remains personally responsible for decisions made in that role. Using an outside provider also means having someone in the business who knows what the provider is doing, checking the quality of the work and acting on what they find. Companies considering options can find practical details about what you can and can’t outsource in compliance.
Full-Time, Interim or Fractional?
There is no right answer as to how long an MLRO is required for a business. The main options are:
- Full-time. Banks, larger payment companies, investment platforms and cryptoasset businesses with significant volumes usually require a dedicated MLRO, often with a team.
- Small companies often choose an experienced and approved MLRO for a few days each month. It gives the business senior expertise at a cost commensurate with its size, if the time commitment is realistic.
- When the MLRO leaves suddenly, or the firm needs to fix the problem after regulatory advice, the interim MLRO can continue its role and lead remediation when a permanent appointment is made.
Whatever route a business takes, the decision should be driven by risk, not just budget. Regulators will ask whether it is reasonable.
Get the right hire
Hiring an MLRO is not like hiring for many senior roles. Candidate pool is small, the best people in demand, and the regulator has said in the appointment. Some principles help:
- Match the experience to the business. Payments, crypto, wealth management and lending each have different financial crime risks, and MLROs from one sector may struggle in another.
- Testing, not just knowledge. Ask the candidate to talk through the actual decisions they made, including the wrong ones.
- Plan for approval. For SMF17 roles, the FCA has up to three months to decide on a full application, and a regulatory reference from a previous employer must be obtained. Start early to avoid gaps.
- Be honest about time. Whether full-time or part-time, the role requires enough time to cover routine and unexpected work.
MLRO Recruitment Specialists can speed up the search, especially where candidates need to be assessed against the regulator’s fit and proper tests before getting shortlisted.
The Bottom Line
For any business in money laundering legislation, the MLRO is one of the most important appointments you will make. Get it right and really have a senior person who protects, advises and reassures the regulator. Get it wrong and the business can find itself at a time when it is trying to grow. Thinking early on who should hold the role, how much time it will take and what support can come from outside is the best way to prevent it.
Adrian Lawrence FCA is the founder of SMF Capital, which recruits Senior Managers, compliance officers and MLROs for FCA and PRA regulated companies, and FD Capital Group. He is a Chartered Accountant, a Fellow of the ICAEW and a former Finance Director of a listed company.