Who Checks the Checker? Independence When One Person Is Compliance Officer and MLRO
Combining the compliance officer and MLRO roles is one of the most common Senior Manager arrangements in smaller regulated firms, and usually a sensible one. But it creates a gap that is easy to overlook. The compliance officer is meant to check that the firm’s controls work, including its anti-money laundering controls. The MLRO designs and runs those controls. When one person holds both roles, the person checking the financial crime framework is the person who built it. This article explains why that matters, where the gap shows up, and the practical ways firms close it.
Two Roles With Different Jobs
Under the Senior Managers regime, the compliance officer holds the compliance oversight function, SMF16, and the MLRO holds the money laundering reporting function, SMF17. The two roles overlap, but they have different jobs:
| Compliance officer (SMF16) | MLRO (SMF17) | |
|---|---|---|
| Main role | Oversee the firm’s compliance with its regulatory obligations | Own the firm’s anti-money laundering systems and controls |
| Key activities | Advice, policy, monitoring, breach reporting, regulatory change | Risk assessment, due diligence standards, transaction monitoring, suspicious activity reporting |
| Relationship to the other | Should monitor whether financial crime controls work, as part of the wider compliance programme | Is one of the areas the compliance function should test |
In a firm where the roles are separate, the compliance officer’s monitoring programme can include independent testing of the MLRO’s controls. When one person holds both, that independent check disappears unless the firm deliberately puts something in its place. Our guide to SMF16 and SMF17 explains both functions in more detail.
Where the Gap Shows Up
Monitoring financial crime controls
A good compliance monitoring programme tests whether customer due diligence is done properly, whether transaction monitoring alerts are handled well and whether sanctions screening works. When the compliance officer is also the MLRO, those tests are carried out by the person responsible for the controls. Findings are harder to make objectively, and easier to soften. Our guide, Compliance Monitoring Explained, sets out why independence is central to a credible programme.
Decisions on suspicious activity
The MLRO decides whether to report suspicions to the National Crime Agency. Those decisions are personal and often finely balanced. In a larger firm, the compliance function or a financial crime committee may review the quality of decision-making over time. With one person holding both roles, nobody routinely reviews whether decisions not to report were reasonable. Our guide to suspicious activity reports and the nominated officer explains the decision framework.
The annual MLRO report
The MLRO’s annual report gives the board a view of how well the financial crime framework is working. When the author is also the person responsible for compliance assurance, the board receives the MLRO’s assessment of their own work, without a separate compliance view alongside it. Our article on the annual MLRO report covers what boards should expect to see.
The business-wide risk assessment
The MLRO usually owns the firm’s assessment of its money laundering risks. If that assessment underestimates a risk, the controls built on it will be too weak, and the monitoring programme, designed by the same person, may not test the right things. Our guide to the business-wide risk assessment covers what a robust assessment looks like.
What the Rules Expect
The Money Laundering Regulations 2017 require relevant firms, where appropriate to their size and nature, to establish an independent audit function to examine and evaluate the adequacy and effectiveness of their anti-money laundering policies, controls and procedures. The FCA’s Financial Crime Guide also expects senior management to understand and challenge the firm’s financial crime risks and controls.
Neither requires a firm to separate the compliance officer and MLRO roles. But both point the same way: someone other than the person running the financial crime framework should be checking that it works.
Practical Ways to Close the Gap
Firms with a combined compliance officer and MLRO use several measures, often in combination:
| Measure | How it helps | Best suited to |
|---|---|---|
| Independent AML review | An external specialist reviews the financial crime framework, typically once a year, and reports to the board | Most smaller firms; often the simplest way to meet the independent audit expectation |
| Outsourced monitoring of financial crime areas | A third party carries out the compliance monitoring tests on due diligence, transaction monitoring and screening | Firms with significant financial crime exposure, such as payments and e-money |
| Internal audit | An internal audit function, or an outsourced one, includes financial crime in its plan | Larger firms, particularly those with a head of internal audit (SMF5) |
| Non-executive challenge | An independent non-executive or audit committee chair reviews the MLRO report and monitoring results and asks hard questions | Firms with independent directors on the board |
| Peer review of decisions | A sample of decisions not to report suspicions is reviewed periodically by an external adviser | Firms with a meaningful volume of internal reports |
| A deputy MLRO | Provides cover and a second view on decisions, and can carry out some testing | Growing firms; see our article on whether you need a deputy MLRO |
Whatever the mix, the key is to document it. The firm should be able to explain to the regulator who provides independent assurance over financial crime, how often, and what they found.
What the Board Should Ask
For boards of firms with a combined compliance officer and MLRO, a few questions go a long way:
- Who independently tests our financial crime controls, and when did they last do it?
- What did they find, and have the actions been completed?
- Has anyone other than the MLRO reviewed a sample of decisions on suspicious activity?
- Does our compliance monitoring plan include financial crime, and who carries out that testing?
- Does the role still fit in one person’s time, given how the business has grown?
Asking these questions, and recording the answers, is part of the board taking reasonable steps. Our guide to the compliance monitoring plan and what the board should see has more on board oversight of monitoring.
Example: A wealth manager with around 40 staff had one experienced person as compliance officer and MLRO. Its compliance monitoring plan covered advice and Consumer Duty thoroughly, but financial crime testing was carried out by the compliance officer on their own controls. After the board asked who independently checked the AML framework, the firm commissioned an annual external review of its financial crime controls and had the reviewer test a sample of decisions not to report. The first review found that periodic reviews of higher-risk clients were overdue, an issue the internal monitoring had not flagged.
When Separating the Roles Is the Answer
Independent review can close the gap for many firms. But there comes a point where the better answer is to separate the roles: a dedicated compliance officer and a dedicated MLRO, each able to challenge the other. That point usually arrives when financial crime risk is high, such as in payments, e-money and cryptoasset firms, when volumes grow sharply, or when the regulator has raised concerns. Our article on when to split a combined SMF16 and SMF17 role sets out the signs.
Until then, a combined role with properly designed independent checks is a credible, proportionate arrangement. The firms that run into difficulty are not those that combine the roles. They are those that combine them and assume no one needs to check.
Hiring for a Combined Role With Independence in Mind
When recruiting a combined compliance officer and MLRO, it is worth asking candidates directly how they would provide independent assurance over their own financial crime work. Strong candidates will have a clear answer: external reviews, outsourced testing, board reporting and an honest view of where the arrangement’s limits are. Candidates who see no issue are a warning sign.
It is also worth asking how they have handled challenge on their own decisions in the past, and how they would want the board to hold them to account. The best combined holders welcome scrutiny, because they understand it protects them as much as the firm.
Compliance and Financial Crime Leadership
Combined and separate compliance officer and MLRO appointments. Every SMF search is led personally by Adrian Lawrence FCA
Combined Role
One person holding SMF16 and SMF17.
→ Combined SMF16 and SMF17 → Interim coverWhen to split the role →
Separate Roles
Dedicated compliance and MLRO appointments.
→ Compliance officer (SMF16) → MLRO (SMF17)Do you need a deputy MLRO? →
Assurance
Independent checks on compliance and AML.
→ Compliance monitoring → Head of internal audit (SMF5)What you can outsource →
Financial Crime
The wider financial crime team.
→ Financial crime leadership → Fractional MLROTransaction monitoring →
Every SMF search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
Can one person be both compliance officer and MLRO?
Yes. It is common in smaller firms and acceptable where it is proportionate and the person has the right experience and time. The firm should make sure there is independent assurance over the financial crime framework.
Who should check the MLRO’s work?
Someone independent of the financial crime framework: an external reviewer, an internal audit function, or an outsourced monitoring provider, with oversight from the board.
Is an independent AML audit a legal requirement?
The Money Laundering Regulations require an independent audit function where appropriate to the firm’s size and nature. Many smaller firms meet this expectation through a periodic external review.
Does the compliance monitoring plan need to cover financial crime?
Yes, for most firms. Financial crime is usually one of the higher-risk areas. Where the compliance officer is also the MLRO, the firm should consider having that part of the plan tested by someone else.
When should a firm split the roles?
Typically when financial crime risk is high, when volumes grow significantly, or when independent review keeps finding issues the combined holder hasn’t identified.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital search personally. View Adrian’s ICAEW profile.
Hiring a Compliance Officer and MLRO?
Whether you need one person for both roles or are ready to separate them, tell us about your firm. We’ll come back to you the same working day.
Adrian Lawrence FCA is the founder of SMF Capital and a Fellow of the Institute of Chartered Accountants in England and Wales and holds an ICAEW practising certificate in his own name. He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience working with boards, investors and business owners across the UK. He founded SMF Capital to help FCA and PRA-regulated firms appoint the Senior Managers the regulators expect, with the fit and proper assessment built into every search, and personally leads every Senior Manager Function search.