Quick Answers

The Two Roles

The Compliance Officer (SMF16)

The SMF16 Compliance Oversight holder is accountable for overseeing the firm’s compliance with FCA rules. Most Core and Enhanced firms under the Senior Managers regime need someone in this function. The role needs enough authority to challenge the business and direct access to the board or senior management.

The MLRO (SMF17) and Nominated Officer

The Money Laundering Regulations 2017 require firms within scope to have a nominated officer who receives internal suspicious activity reports and decides whether to report to the National Crime Agency. At firms within the Senior Managers regime, the MLRO holds SMF17 and must be approved by the FCA. The FCA’s systems and controls rules in SYSC also expect the MLRO to have enough seniority, resources and independence, and to be based in the UK.

At payment, e-money and crypto-asset firms outside the Senior Managers regime, there’s no SMF17, but the firm still needs a nominated officer and the FCA still assesses the arrangement.

The Questions in Detail

Can a director be the MLRO?

Yes. At many smaller firms, a director holds the MLRO role. The Money Laundering Regulations also require firms, where appropriate to their size, to appoint a board member or senior manager as the officer responsible for compliance with the Regulations, and at smaller firms that’s often the same person. The director needs genuine knowledge of financial crime risk and enough time to deal with internal reports promptly, which can be hard alongside running the business.

Can the compliance officer also be the MLRO?

Yes. Combining SMF16 and SMF17 is very common at smaller firms and usually works well. The individual needs expertise in both areas and enough time for both. As firms grow, the roles are often separated, because financial crime work in particular can expand quickly.

Can the MLRO role be outsourced?

Firms can buy support, such as transaction monitoring reviews, due diligence checks or training, from external providers. But the MLRO role itself must be held by an individual. At SMCR firms, that individual must be approved as SMF17 at the firm, even if they’re external. The firm remains responsible, and the MLRO must oversee any outsourced work. See our page on fractional and interim SMF cover.

Can a fractional or external person hold SMF16 or SMF17?

Yes. Many smaller firms use an experienced fractional compliance officer and MLRO who works a set number of days a month and is approved at the firm. The FCA will want to understand their time commitment, their other roles and how they’ll respond to urgent matters. Our comparison of fractional and full-time compliance officers sets out the costs and risks.

Does the compliance officer need to be full-time?

No. The test is adequacy, not hours. A small firm with limited regulated activity may need a few days a month. A firm with many customers, complex products or supervisory attention will need much more. Be realistic, and review the time commitment as the firm grows.

Can the chief executive also be the compliance officer?

At very small firms it sometimes happens, but it’s the combination most likely to raise questions. Compliance oversight is meant to provide challenge, and it’s hard to challenge yourself. If the chief executive does hold SMF16, the firm should consider independent support, such as external compliance monitoring or an independent non-executive. Most firms find a separate compliance officer, even part-time, gives the regulator more confidence.

Can the MLRO be based overseas?

The FCA expects a firm’s MLRO to be based in the UK. For UK subsidiaries of overseas groups, that usually means a UK-based MLRO, even where group financial crime functions are run from abroad.

What qualifications should they have?

There’s no mandatory qualification, but the regulator will look for relevant knowledge and experience. Qualifications such as ICA diplomas or ACAMS certification for MLROs, and compliance qualifications for SMF16 holders, are useful evidence. Experience in the firm’s sector matters most.

Do we need a deputy MLRO?

It isn’t always required, but it’s good practice, especially where the MLRO is part-time or fractional. Someone needs to receive internal reports when the MLRO is unavailable.

Who can’t be the compliance officer?

Anyone who wouldn’t pass the fit and proper test, or who lacks the time, knowledge or independence the role needs. Someone whose pay depends heavily on sales performance may also face questions about their independence.

Choosing a Structure

Common Mistakes

• Appointing a busy director as MLRO without checking they have time for prompt reporting.
• Assuming outsourcing removes the need for an approved individual.
• No cover when the MLRO is away.
• Not reviewing the arrangement as the firm grows.
• Choosing on cost alone rather than on what the firm’s activities need.

More Questions

Can one person be MLRO for several firms?

Yes, and many fractional MLROs are. Each firm’s arrangement must be adequate, and the individual must be approved at each SMCR firm.

What happens if our MLRO leaves suddenly?

Make sure someone acts as nominated officer immediately. Our 30-day MLRO resignation plan sets out the steps.

Can you find us a fractional compliance officer and MLRO?

Yes. It’s one of the most common appointments we make for smaller firms.