Why Payments Firms Are Different

Several features of payments and e-money businesses push financial crime workloads up:

• Volume. Thousands or millions of transactions generate large numbers of monitoring alerts.
• Speed. Faster payments leave little time to stop suspicious funds, so monitoring and decisions need to be quick.
• Fraud. Authorised push payment fraud, account takeover and mule activity are constant risks, and the mandatory reimbursement regime for APP fraud has made fraud losses a direct cost.
• Onboarding at scale. Digital onboarding of consumers or merchants needs robust automated checks and well-staffed exception handling.
• Merchants and agents. Acquirers and firms using agents or distributors take on third-party risk that needs monitoring.
• Cross-border flows. International payments bring sanctions and higher-risk jurisdiction exposure.
• Supervisory focus. The FCA has repeatedly highlighted weaknesses in payments firms’ financial crime controls, and supervisors pay close attention to them.

Our guide to the people the FCA expects payments and e-money firms to have covers the authorisation stage, and the FCA’s financial crime pages set out its broader expectations.

How the Team Typically Grows

The stages below are a guide drawn from the firms we work with. Every firm’s path depends on its model, customers and growth, so treat the triggers as prompts for review rather than fixed thresholds.

Stage One: Authorisation and Launch

At authorisation, the FCA wants to see a credible MLRO who has helped design the controls described in the application: the business-wide risk assessment, onboarding standards, monitoring scenarios and reporting process. Many firms appoint a fractional MLRO at this stage, sometimes holding SMF16 too. That works if the person has genuine payments experience and the time commitment reflects the planned volumes, not just today’s. Our page on fractional MLRO recruitment covers how to scope it.

The common mistake at launch is assuming automated tools will carry the load. Tools generate alerts and exceptions; people have to resolve them. Plan for the first analyst before go-live, not after the first backlog.

Stage Two: Early Growth

Once the firm has real customers and transaction volumes, the MLRO’s time quickly gets absorbed by case work. The first hires are usually one or two analysts to handle onboarding exceptions, enhanced due diligence and first-level alert review, so the MLRO can focus on decisions, the risk assessment and board reporting. If the MLRO is fractional, this is often the point where the firm needs someone inside the business to handle escalations on the other days.

Fraud usually becomes a distinct workload here too. Rising APP fraud claims and mule activity need someone who understands fraud typologies, reimbursement obligations and data, even if they also cover some AML work.

Stage Three: Scaling

As volumes grow, the function needs management as well as analysts. The typical additions are:

• A deputy MLRO to run day-to-day operations, provide cover for reporting decisions and build succession. Our guide to deputy MLROs explains the role.
• A fraud lead to own fraud prevention, detection and reimbursement processes.
• Team leaders for onboarding and monitoring as analyst numbers grow beyond what one person can supervise.
• A sanctions specialist where cross-border flows or international customers create significant exposure. Our guide to hiring a sanctions lead covers when and why.

At this stage, a combined compliance officer and MLRO usually needs to be split, or at least supported by a strong deputy. Our guide to when to split a combined SMF16 and SMF17 role sets out the signs.

Stage Four: Established

Larger payments and e-money firms typically run a structured financial crime function led by a head of financial crime, who may hold SMF17 or report to an MLRO with broader oversight. Specialist teams cover AML operations, fraud, sanctions and investigations, with a separate quality assurance or testing function checking that controls work in practice. Our guide to head of financial crime or MLRO explains how the senior roles fit together.

Signs the Team Is Under-Resourced

Banking partners deserve particular mention. Payments firms rely on banks for safeguarding accounts and payment access, and banks conduct their own due diligence on the firm’s financial crime controls. A weak function can cost a firm its banking relationships well before the regulator acts.

Building a Resourcing Model

The firms that manage this well link financial crime resourcing to the drivers of the work, rather than setting headcount in an annual budget and hoping. A simple model tracks:

• new customers onboarded per month and the share needing manual review;
• alerts generated per month and the average time to resolve each;
• fraud cases and reimbursement claims;
• periodic reviews due, by customer risk rating;
• internal suspicion reports and SARs; and
• planned growth in each of these.

From that, the firm can estimate analyst capacity needed and the management layer to supervise it, and show the board and the regulator a clear rationale. Review it quarterly, and whenever a new product or market launches.

Recruiting for Payments Financial Crime

Experienced payments financial crime professionals are in high demand, and the best MLROs and deputies in the sector are rarely on the market for long. Sector experience matters: fraud typologies, scheme rules, safeguarding interactions and the pace of payments operations are hard to learn on the job at senior level. Our page on SMF recruitment for payments and fintech covers the market, and our financial crime leadership recruitment practice recruits deputy MLROs, heads of financial crime, fraud and sanctions leads. For the MLRO itself, see our page on MLRO recruitment.

Frequently Asked Questions

Is there a standard ratio of financial crime staff to customers?

No. It depends on the business model, customer risk, automation and alert quality. A resourcing model based on actual workloads is far more reliable than a ratio.

Can a newly authorised payments firm use a fractional MLRO?

Yes, and many do. The time commitment should reflect planned volumes, and the firm needs someone internal to handle escalations on other days.

Should fraud sit with the MLRO?

In most payments firms, fraud and AML sit together in one financial crime function because the data and typologies overlap. What matters is clear ownership.

How quickly can you add capacity?

Interim analysts and specialists can usually start within weeks. Permanent senior hires typically take two to four months, plus FCA approval for SMF17.