The First 90 Days for a New MLRO or Compliance Officer
A new compliance officer or MLRO is accountable from the day they start in the function, including for problems they inherit. The first 90 days decide whether they get on top of their area quickly, and whether they can later show that they took reasonable steps from the start.
This plan is written specifically for control function holders: SMF16 compliance officers, SMF17 MLROs, and those holding both at smaller firms. It’s the plan we share with every compliance and MLRO appointment we make.
Before Day One
Ask the firm for these before you start, so you can read them in advance:
- your final Statement of Responsibilities and, at Enhanced firms, the Responsibilities Map
- the last two compliance monitoring reports and the current monitoring plan
- for MLROs, the latest annual MLRO report and the business-wide risk assessment
- the breaches and complaints logs for the past year
- any correspondence with the FCA in the past two years
- the latest internal audit reports covering compliance or financial crime.
The 90-Day Plan
| Period | Compliance officer (SMF16) | MLRO (SMF17) |
|---|---|---|
| Week 1 | Handover; confirm monitoring plan status; review open breaches and complaints themes | Confirm you’re the nominated officer from day one; review open internal SARs and pending consent requests |
| Weeks 2–4 | Meet the board, chief executive, business heads and compliance team; review financial promotions sign-off and regulatory returns calendar | Review CDD and periodic review backlogs, transaction monitoring alerts and sanctions screening; meet the business heads who own onboarding |
| Weeks 4–6 | Write the starting-position note (below); check management information covers your responsibilities | Write the starting-position note; check the business-wide risk assessment reflects the firm’s real business |
| Weeks 6–8 | Agree priorities with the CEO; escalate any serious issues; review Consumer Duty outcome monitoring | Agree priorities; escalate serious backlogs or control gaps; review training and the SAR process |
| Weeks 8–12 | Report to the board or risk committee; update the monitoring plan; meet the supervisor if appropriate | Report to the board; plan the next MLRO report; review technology and resourcing |
The Starting-Position Note
The most important document you’ll write in your first 90 days is a short, dated note recording the state of your area when you took it over. It protects you from being held responsible for issues that pre-date you, and gives the board a clear baseline. A simple log works well:
| Issue | Source | Severity | Owner | Action agreed | Target date |
|---|---|---|---|---|---|
| Overdue monitoring reviews (e.g. 4 of 12) | Monitoring plan | Medium | Compliance | Revised schedule | End of quarter |
| Periodic CDD review backlog | MI / team | High | Financial crime | Additional resource requested | Board decision next month |
| Financial promotions approved without record | Sample check | Medium | Marketing / compliance | New sign-off process | Within 6 weeks |
| Complaint theme in one product | Complaints log | High | Product owner | Root cause review | Within 8 weeks |
Date it, share it with the chief executive and keep a copy. If the handover was thin, record that too.
Specific Priorities for MLROs
- Nominated officer continuity. Make sure staff know you’re now the person to report to, and that internal reporting routes are updated. The Money Laundering Regulations require the firm to have a nominated officer at all times.
- Open SARs and consent requests. Review every open case, including any awaiting a response from the National Crime Agency.
- Backlogs. Find out the true size of any due diligence or alert backlog, not just what the management information reports.
- Sanctions. Check screening lists are current and matches are being handled.
- The risk assessment. Check it reflects the firm’s actual customers, products and channels.
Specific Priorities for Compliance Officers
- The monitoring plan. Is it risk-based, up to date and actually being delivered?
- Consumer Duty. How does the firm monitor customer outcomes, and when is the next board assessment due? See our article on the Consumer Duty and the SMF framework.
- Financial promotions. Who approves them, and is there a record?
- Regulatory returns. Is there a calendar, and who owns each return?
- Breaches. Are breaches recorded and assessed for notification to the FCA?
A new MLRO at a payments firm finds that management information shows 300 overdue periodic reviews, but a direct query of the onboarding system shows nearly 1,200. She records both figures in her starting-position note in week three, escalates to the chief executive the same week, and presents a resourcing request to the board in week six. When the regulator later asks about the backlog, her dated note and the board minutes show exactly when she found it and what she did.
Checking Your Resources
By the end of the second month, you should have a clear view of whether your function has the people, systems and budget it needs. Look at the volume of work against the team’s capacity, the quality of the technology you rely on, and any reliance on outsourced providers. If something is missing, put the case in writing with the risks of not addressing it. A clear, early resourcing request is one of the strongest pieces of evidence of reasonable steps a new control function holder can create, and boards generally respond better to a well-argued request in the first quarter than to the same request a year later.
Working With the Rest of the Senior Team
Control function holders need productive relationships with the chief risk officer or head of risk, internal audit, the finance director and the business heads. Agree early how you’ll share information, who leads on overlapping areas such as Consumer Duty monitoring or operational incidents, and how disagreements will be escalated. Clear working arrangements stop issues falling between functions, which is one of the commonest weaknesses supervisors find.
Building Relationships
Your effectiveness depends on relationships as much as frameworks. In the first 90 days, aim to meet everyone who owns risk in your area, the board members you’ll report to, and the people in the business who will bring you problems. Ask each of them the same question: what worries you? Make it clear you want to hear bad news early.
Reporting to the Board
By around day 90, give the board or the relevant committee a short report: what you found, what you’ve done, your priorities for the next year and any resources you need. It formalises your starting position and sets expectations for the relationship. Many new control function holders find this first report is the moment the board starts to see them as the accountable Senior Manager rather than the new arrival.
Interim Holders
Interim compliance officers and MLROs face a compressed version of the same plan, often with a remediation focus. The starting-position note is just as important for an interim, and so is the handover note at the end of the assignment, so the permanent successor inherits a clear picture. See fractional and interim SMF cover.
New Compliance Officers and MLROs
Guides and services for control function holders starting a new role. Every SMF search is led personally by Adrian Lawrence FCA
Responsibilities
Documents to read first.
→ Statements of Responsibilities
→ The Responsibilities Map
Cover
Interim and fractional holders.
→ Fractional and interim cover
→ When an MLRO resigns
Candidates
Current roles and registration.
→ Compliance and MLRO jobs
→ Register confidentially
Every SMF search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
Am I responsible for problems that existed before I started?
You’re responsible for your area from the day you start, which is why recording what you inherited, and acting on it, matters so much.
Should I meet the FCA early?
For significant firms, often yes, usually alongside the chief executive. Introduce yourself and your priorities.
What if the firm won’t fund what I need?
Record the request, the reasons and the response. Escalate to the board if the risk is significant.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital compliance and MLRO search personally and shares this 90-day plan with every new appointment. View Adrian’s ICAEW profile.
Appointing a New Compliance Officer or MLRO?
We recruit permanent, interim and fractional control function holders, and support them through their first months in post. Get in touch for a confidential conversation.
Adrian Lawrence FCA is the founder of SMF Capital and a Fellow of the Institute of Chartered Accountants in England and Wales and holds an ICAEW practising certificate in his own name. He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience working with boards, investors and business owners across the UK. He founded SMF Capital to help FCA and PRA-regulated firms appoint the Senior Managers the regulators expect, with the fit and proper assessment built into every search, and personally leads every Senior Manager Function search.
