What is the role of the MLRO?

Every business with anti-money laundering obligations needs someone ultimately accountable for AML compliance and for handling internal suspicions of money laundering. 

Although in FATF guidance this person is called a compliance officer, different countries and supervisors use different labels. For example, this person is often called the MLRO, or the Money Laundering Reporting Officer (the title we’ll use in this article). 

The function is the same internationally: someone senior enough to make the call, and accountable when they do. For all regulated professionals, this role sits at the centre of your compliance framework.

What FATF requires

Recommendation 18 requires businesses to put in place anti-money laundering, counter-terrorist financing and counter-proliferation financing compliance management arrangements, including “the appointment of a compliance officer at the management level.” 

This person needs enough seniority, authority and access to records to do the job properly, and a direct line to senior management when something needs escalating.

Countries then build this into their own law. In the UK, Regulation 21 of the Money Laundering Regulations 2017 splits the FATF requirement into two roles: 

• A compliance officer responsible for the business’ overall AML systems and controls, often called the Money Laundering Compliance Officer (MLCO)
• A nominated officer who receives and assesses internal suspicions, the MLRO
• In smaller businesses, both roles are usually held by the same person

Other countries structure the same FATF requirement differently, so check how your own regulator has set it up.

The purpose of the MLRO

The MLRO acts as your business’ single point of contact for anti-money laundering matters. They oversee your compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and act as the link between your business, your AML supervisor and law enforcement agencies such as the National Crime Agency (NCA).

Their responsibilities typically include:

• receiving and assessing internal Suspicious Activity Reports (SARs);
• deciding whether to submit a SAR to the NCA;
• maintaining and updating the business’s policies, controls and procedures (PCPs);
• overseeing AML training and awareness;
• ensuring risk assessments and record-keeping are up to date;
• representing the business during AML reviews or inspections.

The role carries personal accountability under the law, which means the MLRO must be both knowledgeable and empowered to act independently when compliance is at stake.

Reviewing and reporting suspicions

FATF Recommendation 20 requires businesses to “report promptly their suspicions to the financial intelligence unit.” This is the core of an MLRO’s role. When a colleague raises an internal suspicion, the MLRO needs to:

1. Review the facts and supporting documentation
2. Decide whether the suspicion is reasonable and justified
3. Record the reasoning and any next steps taken
4. Submit an external SAR to the NCA where required

Some jurisdictions also expect businesses not to proceed with suspicious transactions until consent is given by the relevant authority or a statutory waiting period passes. Your own country’s law will set out its own version, so check what applies where you’re regulated.

Keeping your AML framework effective

The MLRO has overall responsibility for maintaining your business’ AML framework. This includes ensuring that written policies, controls and procedures (PCPs) are:

• reviewed at least annually, or sooner if risks or regulations change;
• aligned with the risks identified in your business-wide risk assessment;
• understood and followed by staff;
• supported by a clear audit trail.

They must also make sure that AML PCPs are not treated as a formality. The most common compliance failures identified by regulators often stem from generic or outdated documentation that doesn’t reflect the actual risks faced by the business. Those risks should be identified in the business-wide risk assessment.

Overseeing training and awareness

FATF Recommendation 18 also requires an ongoing employee training programme. Effective MLROs go further than the minimum. They make AML part of daily working life by:

• tracking completion of training and refresher sessions;
• ensuring role-specific training for high-risk areas such as client onboarding or source-of-funds checks;
• providing updates when regulations or threats change;
• encouraging staff to raise concerns without fear of reprisal.

Training and awareness are core to building a culture of compliance. Everyone in the business should understand the warning signs of money laundering and know when to escalate a concern.

Staying alert to new risks

The financial crime landscape changes quickly. The MLRO must keep the business informed of new threats, such as:

• emerging technologies, including deepfakes and fake IDs;
• sanctions risks linked to geopolitical events;
• crypto-assets and unregulated financial products;
• evolving typologies identified by supervisors and law enforcement.

They must also ensure the business’ risk assessment and controls are updated to reflect these developments. The UK’s 2025 National Risk Assessment, for example, flags weaknesses in many businesses’ ability to assess and respond to technological and cross-border risks. This is a gap that shows up in most jurisdictions, not just the UK.

Liaising with regulators and law enforcement

The MLRO communicates with external bodies on the business’ behalf, including:

• its supervisory authority;
• law enforcement or regulators during inspections;
• its national FIU for report submissions. 

During a supervisory visit, they’ll usually need to provide:

• training records;
• current risk assessments;
• policies with recent review dates;
• report logs and decision records. 

Well-documented systems make these reviews smoother and demonstrate compliance in practice.

What makes a good MLRO?

The MLRO needs a mix of technical knowledge, professional judgement and communication skills. The most effective MLROs are:

• Authoritative: They’re senior enough to influence decisions and stop risky work
• Knowledgeable: They’re well-versed in AML law and current risks
• Approachable: They’re trusted by colleagues to handle concerns fairly
• Organised: They’re able to maintain records and monitor actions efficiently
• Independent: They’re willing to challenge where necessary

They must also have enough time and resources to carry out the role effectively, something smaller practices sometimes overlook when appointing an MLRO alongside existing duties.

Why the MLRO role matters

The MLRO is not simply a compliance officer. They are the person who ensures your business is protected from the financial, regulatory and reputational fallout of money laundering. Their oversight helps prevent criminal abuse of professional services and provides assurance to supervisors that your business takes its obligations seriously.

For regulated professionals, a strong MLRO function is both a legal safeguard and a sign of good governance. By maintaining robust processes, encouraging openness, and staying alert to risk, the MLRO helps your business operate with confidence and integrity.