Every firm says its MLRO is independent. Fewer can show it. The test comes when the MLRO wants to exit a profitable customer, refuse a new partner, delay a product launch or ask for more staff, and the business disagrees. Whether the MLRO’s view prevails, or at least gets a fair hearing at board level, depends on structural choices made long before that moment: who the MLRO reports to, what else they are responsible for, and what resources they control.
This article looks at what the rules require, where firms commonly undermine their MLRO without meaning to, and how to structure the role so its independence is real.
What the rules require
The FCA’s systems and controls rules in SYSC 6.3 require most authorised firms to appoint an MLRO responsible for oversight of the firm’s compliance with its anti-money laundering obligations, and to make sure that person has a level of authority and independence within the firm, and access to resources and information, sufficient to do the job. The Financial Crime Guide expands on what the FCA looks for in practice, and the JMLSG guidance sets out how the industry applies it.
The Money Laundering Regulations 2017 add their own requirements, including the nominated officer role and, where appropriate, a board-level officer responsible for compliance with the regulations. At firms within the Senior Managers regime, the MLRO also holds SMF17, signs a Statement of Responsibilities and is subject to the Duty of Responsibility. SMF Capital’s guide to SMF16 and SMF17 explains how those pieces fit together.
None of those sources prescribes a single organisational chart. They set an outcome, and leave firms to show how their structure delivers it.
Reporting lines
The question we hear most often is who the MLRO should report to. There is no single right answer, but some arrangements make independence far easier to demonstrate than others.
| MLRO reports to | Works well when | Watch for |
|---|---|---|
| Chief Executive | Smaller firms where the CEO is engaged and the MLRO also has direct board access | Commercial pressure when the CEO owns revenue targets |
| Chief Risk Officer | Firms with an established second line | The MLRO becoming one voice among many in the risk function |
| Head of Compliance | Larger firms with separate SMF16 and SMF17 holders | The MLRO’s view being filtered before it reaches the board |
| Chief Operating Officer or CFO | Rarely the best choice | Direct conflict with operational targets or cost control |
Whatever the day-to-day line, the MLRO should have a direct, unfiltered route to the board or the relevant board committee, usually the risk or audit committee. That committee’s chair is often the MLRO’s most important ally. SMF Capital’s guide to the risk and audit committee chairs under the SMCR explains their role, and our sister practice NED Capital recruits the independent non-executives who sit in those chairs.
Combining the MLRO role with others
At smaller firms, the MLRO almost always wears more than one hat. Some combinations work well; others create conflicts the regulator will notice.
Compliance officer and MLRO
Combining SMF16 and SMF17 is the norm at small and mid-sized firms, and it usually works. The two roles share skills and a second-line perspective. The risk is capacity rather than conflict: one person can run out of time to do both properly as the firm grows. SMF Capital’s articles on combined compliance officer and MLRO recruitment and when to split a combined SMF16/17 role cover the signs.
Finance director and MLRO
This combination appears at very small firms, and it is harder to defend. A finance director is responsible for costs and often for revenue reporting; an MLRO may need to argue for spending and against revenue. If you are in this position, document how conflicts will be managed and plan to separate the roles. Our sister practice FD Capital places fractional finance directors, which can free an existing director to concentrate on one role.
Operations and MLRO
An operations director who owns onboarding speed and customer service targets is poorly placed to also decide whether onboarding controls are strong enough. Where this combination exists, expect the regulator to ask how it works in practice.
Founder or chief executive as MLRO
At the smallest firms, the founder sometimes holds the MLRO role. It is permitted in principle, but it is very difficult to show independence when the person deciding whether to report a customer is also the person whose income depends on that customer. A fractional MLRO is usually the better answer. SMF Capital’s page on fractional MLRO recruitment explains how that works, and its guide to who can be your MLRO answers the common questions from smaller firms.
SMF Capital’s broader guide on whether one person can hold more than one SMF covers the general principles for combining Senior Manager roles.
Resources
Independence without resources is a title, not a function. An MLRO who cannot get monitoring tuned, alerts cleared or periodic reviews completed is accountable for failures they cannot prevent. Good practice includes:
- A financial crime budget the MLRO has a say in, reviewed at least annually
- Analysts and investigators sized to the firm’s actual volumes. SMF Capital’s guide to sizing the financial crime team is written for payments firms but applies more widely.
- Access to all the data and systems needed to monitor and investigate, without having to ask permission from the business
- A deputy or documented cover arrangement. See do you need a deputy MLRO?
- Time in the diary for training, horizon scanning and the annual MLRO report
The annual MLRO report is the natural place to ask for resources, and the board’s response to it is strong evidence of whether the firm takes the role seriously. FD Capital’s guide to the MLRO annual report sets out what the board should expect to see.
When the MLRO needs to build a team, SMF Capital’s financial crime leadership recruitment service fills the roles around them, and Accountancy Capital recruits the qualified finance and regulatory reporting professionals whose work often feeds financial crime monitoring.
Independence for a fractional MLRO
A fractional MLRO starts with one structural advantage: they are not dependent on a single employer for their livelihood, which can make it easier to say no. But the arrangement brings its own risks to independence, and firms should manage them deliberately.
The first is distance. A fractional MLRO who is in the business one day a week can be presented with decisions already made, or told about a new partner after the contract is signed. The engagement should require that they are consulted on new products, markets and significant customers before decisions are taken, not afterwards.
The second is information. Between scheduled days, the fractional MLRO needs direct access to monitoring outputs, case management and internal reports, not a weekly summary prepared by someone else.
The third is the commercial relationship itself. A fractional MLRO who fears losing the engagement may be slower to challenge than one who does not. A written engagement with a reasonable notice period, and a board that visibly backs the MLRO when they do challenge, helps with all three. FD Capital’s article on outsourcing the MLRO function covers the wider pros and cons of the model.
Remuneration and incentives
An MLRO whose bonus depends on revenue, customer growth or sales targets has an obvious conflict. Their variable pay, if any, should be linked to the effectiveness of the financial crime framework and their personal objectives, not to commercial performance. The same principle applies to any fractional MLRO whose fee might be affected by the firm’s commercial success.
Signs that independence is not real
Boards should watch for warning signs, because the MLRO may not raise them directly.
- The MLRO’s reports to the board are edited or summarised by someone else before they arrive.
- Requests for resources are repeatedly deferred to “next year”.
- Decisions to exit customers are routinely overturned by the business.
- The MLRO is excluded from product and partnership decisions until they are effectively made.
- The MLRO turns over frequently, or leaves without a clear reason.
Each of these will eventually show up in a regulatory review. The FCA’s enforcement record on financial crime regularly cites under-resourced or sidelined MLROs. SMF Capital’s analysis of FCA enforcement trends covers what that means for individual Senior Managers.
Hiring for independence
Independence is partly structural and partly personal. The strongest MLRO candidates can describe specific occasions when they challenged the business, escalated a concern or refused to approve something, and what happened next. When MLRO Capital runs a search, those examples are central to how we assess candidates, alongside the fit and proper test for SMF17 roles. SMF Capital’s guide to interviewing an SMF candidate has questions you can use.
If the issue is structure rather than the person, SMF Capital’s governance and SMF structure review can look at how responsibilities are allocated across your Senior Managers. For executive roles around the MLRO, such as a chief risk officer, see SMF Capital’s CRO recruitment page or our sister practice Exec Capital.
The bottom line
An MLRO’s independence is decided by the board, not by the MLRO. Give them a direct line to the board or its risk committee, avoid combinations that create commercial conflicts, fund the team properly and keep their pay away from revenue. Do that, and when the difficult customer or the risky partnership arrives, the firm will have someone able to say no, and a structure that lets them be heard.
