The Annual MLRO Report: What the Board Should Expect
Once a year, the MLRO puts their assessment of the firm’s financial crime controls in front of the board. Done well, the annual MLRO report is the single most useful document a board receives on money laundering, terrorist financing and sanctions risk. Done badly, it is a box-ticking exercise that tells directors little and protects nobody. This guide explains what the report is for, what a good one contains, how the board should challenge it, and what a weak report says about the MLRO who wrote it.
Why the Report Exists
The FCA’s rules in SYSC 6.3 require firms to have an MLRO with responsibility for oversight of the firm’s anti-money laundering systems and controls, and to ensure that senior management receives a report from the MLRO, at least annually, on the operation and effectiveness of those systems and controls. The precise wording and application vary by firm type, so firms should read the rule that applies to them, but the expectation is clear: the board must be properly informed, at least once a year, about whether the firm’s financial crime defences actually work.
The report also matters for the MLRO personally. At Core and Enhanced firms, the MLRO usually holds the Money Laundering Reporting function, SMF17, and is accountable under the Senior Manager Conduct Rules. The annual report is one of the clearest records of what the MLRO knew, what they told the board and what they recommended. If something later goes wrong, it is one of the first documents a supervisor or enforcement team will read. Our guide to the MLRO role and SMF17 sets out the wider responsibilities.
What a Good Annual MLRO Report Contains
There is no prescribed template, and a report should reflect the firm’s size and risks. The FCA’s Financial Crime Guide and the JMLSG guidance are useful reference points. In our experience, strong reports cover the following areas.
| Section | What it should tell the board |
|---|---|
| Executive summary | The MLRO’s overall view of the effectiveness of controls, the key risks and the decisions the board needs to take, in a page or two |
| Business-wide risk assessment | How the firm’s money laundering, terrorist financing and sanctions risks have changed, and why, including new products, customers, channels and geographies |
| Customer due diligence and monitoring | Onboarding volumes, high-risk customers, PEPs, enhanced due diligence, periodic reviews and any backlogs |
| Suspicious activity reporting | Internal reports received, external SARs submitted, defence requests, trends and turnaround times |
| Sanctions | Screening coverage, alerts, true matches, any breaches or near misses, and changes to sanctions regimes affecting the firm |
| Systems and data | Performance of screening and transaction monitoring systems, tuning, false-positive rates and known weaknesses |
| Training and culture | Completion rates, quality of training and evidence that staff escalate concerns |
| Assurance | Findings from compliance monitoring, internal audit and any external reviews, with progress on actions |
| Resourcing | Whether the financial crime function has the people, skills and budget it needs, and the MLRO’s own time commitment |
| Regulatory developments | Changes to the Money Laundering Regulations, FCA expectations or enforcement themes relevant to the firm |
| Action plan | Clear recommendations, owners and dates, and progress on last year’s actions |
Good Report, Weak Report
The difference between a useful report and a weak one is rarely length. It is whether the MLRO has formed and expressed a view.
| A good report | A weak report |
|---|---|
| States clearly whether controls are effective, partly effective or not effective, and why | Describes processes without saying whether they work |
| Analyses SAR data and what it reveals about risk | Lists numbers with no commentary |
| Links findings to the business-wide risk assessment | Treats the risk assessment as a separate document that hasn’t changed in years |
| Is candid about resourcing gaps and backlogs | Says resources are “adequate” without evidence |
| Asks the board for specific decisions | Asks the board only to “note” the report |
| Tracks last year’s actions to completion | Repeats last year’s recommendations unchanged |
How the Board Should Challenge the Report
A board that simply notes the MLRO report is not doing its job. Directors, particularly the chair of the audit or risk committee, should test it. Useful questions include:
- What is your overall conclusion, and what would change it?
- Which of our risks has grown most in the last year, and are our controls keeping pace?
- Why did SAR volumes rise or fall, and what does that tell us?
- Where are we relying on systems we haven’t tested or tuned recently?
- Are there any backlogs in due diligence, periodic reviews or alerts, and how old are they?
- Do you have enough time and resource to do this role properly?
- Which of last year’s actions are overdue, and why?
- What would a supervisor or skilled person find if they looked at us tomorrow?
The board should minute the discussion and the decisions it takes. That record protects the directors, the MLRO and the firm, and demonstrates the reasonable steps the Senior Managers regime expects.
Scenario: A growing e-money firm’s MLRO presents an annual report that runs to forty pages of process description and concludes that controls are “broadly adequate”. The new chair of the audit committee asks three questions: how many transaction monitoring alerts are more than thirty days old, when the monitoring rules were last tuned, and whether the MLRO’s two days a week are enough now that customer numbers have trebled. The answers reveal a significant alert backlog and rules unchanged since launch. The board approves funding for two analysts, commissions an independent review of the monitoring system and asks the MLRO to report quarterly until the backlog is cleared.
What a Weak Report Says About Your MLRO
A poor annual report is often the first visible sign that a firm has outgrown its MLRO, or that the MLRO is overstretched. Warning signs include a report that is substantially the same as last year’s, an inability to answer board questions without going away to check, a risk assessment that doesn’t reflect obvious changes to the business, and repeated statements that resources are adequate despite backlogs.
None of these necessarily means the MLRO is the wrong person. They may lack time, support or systems. But the board should ask the question honestly. If the answer is that the firm needs a more experienced or more available MLRO, it is far better to act after a weak report than after a supervisory visit. Options range from adding a deputy or analysts, to appointing a fractional MLRO with deeper sector experience, to a permanent search; see our MLRO recruitment page. If the MLRO is leaving or the board has lost confidence, interim MLRO cover can stabilise the function while a successor is found.
Tips for MLROs Writing the Report
- Start with the conclusion. Directors read the first page. Put your overall view and the decisions you need there.
- Use data, then explain it. Trends over two or three years tell the board more than a single year’s numbers.
- Connect to the risk assessment. Show how changes in the business changed the risk, and how controls responded.
- Be candid about gaps. A report that flags problems and proposes solutions is far stronger evidence of reasonable steps than one that hides them.
- Ask for decisions. If you need resources, systems or policy changes, ask for them explicitly and record the answer.
- Follow up. Report progress on actions during the year, not just annually.
New MLROs should treat their first report as a baseline. Our guide to the first 90 days for a new MLRO or compliance officer explains how to document what you inherit.
The Report and the Wider Senior Manager Team
The MLRO report shouldn’t sit in isolation. At many firms, the compliance officer (SMF16) and the MLRO (SMF17) are the same person, and the annual report sits alongside compliance monitoring reporting. Where the roles are separate, the two should be consistent, particularly on shared themes such as the Consumer Duty, financial promotions and customer onboarding. Our guide to SMF16 and SMF17 explains how the roles fit together, and the Money Laundering Regulations guide covers the legal framework behind the report.
MLRO Recruitment and Guidance
Financial crime leadership boards can rely on. Every MLRO search is led personally by Adrian Lawrence FCA
Financial Crime
The wider function.
→ Financial crime leadership
→ Sanctions screening
When Things Change
Departures and remediation.
→ Your MLRO has resigned
→ Staffing a s166 remediation
Every MLRO search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
How often must the MLRO report to the board?
The FCA’s rules require a report to senior management at least annually. Many firms also receive shorter quarterly updates, which we recommend.
Who should receive the annual MLRO report?
The board, or its audit or risk committee with escalation to the board. The discussion and decisions should be minuted.
Is there a template for the report?
No prescribed template exists. The content should reflect the firm’s size and risks, but most good reports cover the areas set out above.
What if the board disagrees with the MLRO’s conclusions?
The disagreement and the reasons should be recorded. The MLRO must be free to give an independent view, and the board remains responsible for its response.
Can a fractional MLRO write the annual report?
Yes. A fractional MLRO holds the role and its responsibilities in full, including the annual report.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital search personally. View Adrian’s ICAEW profile.
Does Your Firm Need a Stronger MLRO?
If your last MLRO report raised more questions than it answered, talk to us. We recruit permanent, fractional and interim MLROs and will come back to you the same working day.
Adrian Lawrence FCA is the founder of SMF Capital and a Fellow of the Institute of Chartered Accountants in England and Wales and holds an ICAEW practising certificate in his own name. He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience working with boards, investors and business owners across the UK. He founded SMF Capital to help FCA and PRA-regulated firms appoint the Senior Managers the regulators expect, with the fit and proper assessment built into every search, and personally leads every Senior Manager Function search.
