SMF17 MLRO: The Hiring Guide for FCA-Regulated Firms

SMF17 MLRO: The Hiring Guide for FCA-Regulated Firms

The SMF17 Money Laundering Reporting Officer appointment is unlike any other senior hire an FCA-regulated firm makes. The individual holds personal criminal liability under the Proceeds of Crime Act 2002 for failure to submit a Suspicious Activity Report where there are reasonable grounds to suspect money laundering. They hold personal regulatory accountability to the FCA under the Senior Managers and Certification Regime for the adequacy of the firm’s AML framework. They must be individually approved by the FCA before they can hold the function. And they must be capable of making independent judgements — about SAR consent, about customer due diligence standards, about escalation to law enforcement — under conditions of commercial pressure and time constraint that would compromise a less resilient individual. Smaller FCA-authorised firms often use a fractional Chief Compliance Officer to hold SMF16 a few days a month. For senior second-line hires, see our compliance and risk recruitment service.

This guide is written for CEOs, chairs, and boards of FCA-regulated firms who are making or replacing an SMF17 appointment. It covers what the function genuinely requires, how to assess candidates against those requirements, what the FCA’s approval process involves, what the realistic timeline looks like, and the most consequential mistakes firms make in this hire. For Exec Capital’s MLRO search service, see our MLRO Recruitment page.

It also covers the route most smaller firms actually take: a fractional or part-time MLRO, often combined with the SMF16 compliance oversight role, working a set number of days a month rather than sitting in a full-time seat. That model is legitimate, the FCA approves it routinely, and it is the most common SMF17 arrangement we are asked about. It only works if the time commitment, independence and cover arrangements are set up properly, and the sections below explain how.

What the SMF17 function genuinely requires

SMF17 is the Money Laundering Reporting Function, one of the senior management functions under SMCR. It is a function the firm must fill, not a prescribed responsibility that is allocated to someone who already holds another role. Core and enhanced SMCR firms must have an approved SMF17 holder, and limited scope firms need one too where they are required to appoint an MLRO under SYSC 6.3 (in practice, where they are within the Money Laundering Regulations). The individual must be approved by the FCA before they can perform the function. There is no minimum size threshold — a two-person FCA-authorised firm within scope of the Money Laundering Regulations needs an FCA-approved MLRO just as much as a major bank.

The core statutory duty of the MLRO is to receive internal Suspicious Activity Reports from across the business and to decide, for each report, whether the suspicion meets the threshold for external disclosure to the National Crime Agency under the Proceeds of Crime Act. Where the MLRO decides to submit an external SAR, they file it through the NCA’s online system and, where applicable, request a defence against money laundering (DAML, still widely called “consent”) to proceed with a transaction that might otherwise constitute money laundering. This is not a process function — the decision to submit or not submit is a personal legal judgement made by the MLRO alone, and getting it wrong carries criminal consequences.

Beyond the SAR function, the SMF17 holder owns the firm’s AML and CTF framework: the policies, risk assessments, customer due diligence standards, enhanced due diligence requirements, transaction monitoring programme, and staff training. They manage the firm’s relationship with the FCA on financial crime matters and with the NCA on SAR submissions. They report to the board on the AML risk profile and on the adequacy of the firm’s financial crime controls. In firms subject to the Money Laundering Regulations 2017, they are responsible for the firm’s documented AML risk assessment — the analysis of the money laundering and terrorist financing risks the firm faces given its products, customers, delivery channels, and geographies.

Three legal hooks, usually one person

Much of the confusion around this hire comes from the fact that three separate legal requirements tend to land on the same individual:

• The nominated officer. Regulation 21 of the Money Laundering Regulations requires a firm to appoint a nominated officer to receive internal disclosures and decide whether they give rise to knowledge or suspicion of money laundering or terrorist financing. The firm must tell its supervisor who the nominated officer is no later than 14 days after the appointment.
• The officer responsible for compliance. The same regulation requires firms, where appropriate to their size and nature, to appoint a board member or member of senior management as the officer responsible for the firm’s compliance with the Regulations. This can be the MLRO, but at larger firms it is often an executive director.
• The MLRO under the FCA Handbook. SYSC 6.3 requires an FCA-authorised firm to appoint an MLRO with responsibility for oversight of its compliance with the FCA’s rules on systems and controls against money laundering, and to give that person enough authority, independence, resources and information to do the job. Under SMCR, that person performs SMF17.

At most small and mid-sized firms the MLRO is also the nominated officer, so the SMF17 holder is the person making the SAR decisions. Larger firms sometimes separate the roles, with a Head of Financial Intelligence or a team of deputy nominated officers handling disclosures under the MLRO’s oversight. Whichever structure you use, the role profile and the Statement of Responsibilities should say plainly who holds which hook, because the FCA, the NCA and the firm’s auditors will all ask.

MLRO vs Nominated Officer vs SMF17 vs SMF16 vs Head of Financial Crime

These titles are used loosely in job adverts and on CVs, which is one reason MLRO searches go wrong at the briefing stage. The table below sets out what each one actually means.

The practical consequence for hiring is that “MLRO” on a CV can mean anything from an approved SMF17 at a bank to someone who was the nominated officer at an unregulated business with a handful of disclosures a year. Ask which hooks the candidate held, at what type of firm, and whether they were personally approved by the FCA for SMF17 (or CF11 under the old approved persons regime). Our MLRO job description sets out the role in a form you can adapt for an advert.

Firms outside SMCR that still need an MLRO

Not every firm that needs an MLRO needs an SMF17. Payment institutions and e-money institutions authorised under the Payment Services Regulations and Electronic Money Regulations are outside SMCR, so there is no Form A and no SMF17 approval. They are still within the Money Laundering Regulations, so they must appoint a nominated officer and an officer responsible for compliance, notify the FCA of those appointments, and keep them filled. The FCA also assesses the directors and the people responsible for managing the payment or e-money business, and firms must notify the FCA of changes to those individuals through Connect. In practice the MLRO of an authorised PI or EMI is usually one of the individuals the FCA looks at, and the FCA separately approves changes of controller. So the hiring standard for a PI or EMI MLRO should be every bit as high as for an SMF17, even though the approval mechanics differ. Our guide to senior hiring at payment institutions covers this in more detail.

Cryptoasset businesses are in transition. Firms registered with the FCA under the Money Laundering Regulations need a nominated officer today, and the FCA assesses whether their officers and managers are fit and proper. Under the new FSMA regime for cryptoassets, firms that want to carry on regulated cryptoasset activities from day one must apply through the FCA gateway, which opened on 30 September 2026 and closes on 28 February 2027, ahead of the regime taking effect on 25 October 2027. MLR registration does not convert automatically into authorisation. The FCA’s policy statement on applying the Handbook to cryptoasset activities (PS26/13) brings SMCR into scope, so authorised cryptoasset firms should plan for an FCA-approved SMF17 as part of the application rather than treating the MLRO as a registration-era role. Our crypto firm SMCR board guide sets out the wider senior manager picture.

The criminal liability dimension — what it means for hiring

No other executive appointment in an FCA-regulated firm carries the personal criminal liability that attaches to the SMF17 function. Under section 330 of the Proceeds of Crime Act, a person in a regulated sector who fails to disclose knowledge or suspicion of money laundering — or fails to disclose where they had reasonable grounds for suspicion — commits a criminal offence. The maximum sentence is five years’ imprisonment. Section 331 then applies a specific failure-to-disclose offence to nominated officers in the regulated sector who receive an internal report and do not pass it on when they should. The MLRO, as nominated officer, is the individual in the firm most directly exposed to this liability.

The criminal liability dimension has direct implications for the hiring process. It means the MLRO must have genuine, personal experience of making SAR decisions — not procedural involvement in a SAR function managed by someone else. It means they must have the independence of mind to make the right SAR decision even when the subject of the suspicion is a major client, a senior colleague, or a commercially significant transaction. And it means the board must genuinely support the MLRO’s independence — a firm that has historically pressured its MLRO on SAR decisions is a firm that creates criminal exposure for whoever holds the SMF17 function next.

Candidates who understand the liability dimension — and who ask the right questions about the firm’s SAR culture before they accept the role — are usually the right candidates. An experienced MLRO who does not ask about SAR volumes, SAR decision escalation procedures, and the board’s relationship with compliance before accepting an offer has either not thought through the personal exposure or is less experienced than their CV suggests.

The DAML process adds time pressure. Once a DAML request is made, the NCA has a notice period of seven working days to respond; if it refuses, a moratorium period of 31 days follows, which the courts can extend. During that time the MLRO has to manage the customer relationship without tipping off the customer, often while the front office is pushing for the transaction to complete. Candidates who have handled refused DAMLs, and can explain how they managed the client and the business through the moratorium, have been tested in a way that others have not.

Regulatory changes an incoming MLRO must be across

The MLRO’s framework has had to absorb a run of changes over the past eighteen months. A credible candidate in November 2026 should be able to talk through each of these and say what they mean for your firm specifically. If they cannot, that tells you how current their practice is.

• Amendments to the Money Laundering Regulations. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) were made on 9 June 2026, with most provisions in force from 30 June 2026. They replace many euro thresholds with sterling amounts, refine when enhanced due diligence is triggered for unusually complex or unusually large transactions, refer to FATF “call for action” countries in place of the old high-risk third country wording, add requirements for pooled client accounts, and extend trust registration rules. A new requirement for enhanced checks on correspondent relationships involving cryptoasset exchange and custodian wallet providers starts on 1 February 2027, and a revised change-in-control schedule for registered cryptoasset businesses takes full effect on 25 October 2027. Every MLRO should have updated the firm’s policies and risk assessment for the June 2026 changes by now.
• Failure to prevent fraud. The failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 took effect on 1 September 2025 for large organisations. The offence is not an AML requirement, but the “reasonable procedures” defence sits naturally with the financial crime function, and many boards have asked their MLRO to own it or at least co-own it with the general counsel. A candidate who has worked through a fraud risk assessment and the reasonable procedures guidance brings more to the role.
• Supervision reform. HM Treasury confirmed in October 2025 that the FCA will become the single AML supervisor for legal, accountancy, and trust and company service providers, replacing the professional body supervisors and OPBAS. It published its response on the FCA’s duties, powers and accountability as the new supervisor in June 2026. Legislation is still needed and, as at November 2026, no go-live date has been confirmed. This does not change how FCA-authorised firms are supervised, but it matters for MLROs at firms with group entities in professional services, and it will widen the pool of MLRO candidates who have worked under direct FCA supervision.
• JMLSG guidance. The JMLSG revisions page shows further amendments to Part I in February 2026 (including Chapter 3, which covers the MLRO) and September 2026, both awaiting HM Treasury approval at the time of writing. A good MLRO tracks these consultations rather than waiting for final approval.
• SMCR reform. The first phase of SMCR changes took effect on 24 April 2026. The FCA’s CP26/37 and the PRA’s CP14/26, published in October 2026, propose moving some senior manager roles from pre-approval to notification. SMF16 and SMF17 are not among them: they would stay pre-approved, which reflects how seriously the regulators treat the compliance and MLRO roles.
• The cryptoasset regime. Covered above. For any firm with crypto exposure, the gateway timetable now drives MLRO hiring decisions.

What distinguishes a strong SMF17 candidate

The technical knowledge floor for a credible SMF17 candidate is high: they need command of the Money Laundering Regulations, deep familiarity with the JMLSG guidance relevant to the firm’s sector, working knowledge of the NCA’s SAR submission system and consent process, and understanding of the FCA’s financial crime expectations as set out in the FCA’s financial crime guidance. These are not optional; they are the baseline. A candidate who is not already working at this technical level cannot be trained up to it within a timeframe that reduces the firm’s regulatory risk.

Above the technical floor, what distinguishes strong candidates is specifically: the volume and complexity of SAR decisions they have personally made; their experience of managing the FCA relationship on AML matters under supervisory pressure; their ability to build and maintain an AML risk assessment that genuinely reflects the firm’s evolving risk profile rather than a template exercise; and their track record of board communication that gives directors an accurate picture of financial crime risk rather than a reassuring one.

Sector-specific experience matters considerably at the SMF17 level. The financial crime typologies in retail banking are different from those in asset management, payments, consumer credit, and crypto. A candidate with deep AML experience in one sector can develop understanding of another, but the learning curve is steeper than it appears from a CV, and the firm’s regulatory risk during the learning period is real. Where the firm operates in a sector with a specific risk profile — payments with cross-border transfer risk, wealth management with PEP exposure, crypto with blockchain analytics requirements — sector-specific MLRO experience should be a prioritised rather than preferred criterion.

Two further qualities are worth testing directly. The first is proportionality: the ability to build a framework that fits the firm’s actual risk rather than importing a bank-grade control set into a ten-person adviser. Over-engineered frameworks are expensive, are not followed, and fail at supervisory review just as under-engineered ones do. The second is the ability to work with the people who generate the risk. An MLRO who is respected by the front office gets escalations early; one who is avoided gets them late or not at all.

Copy-ready MLRO role profile and Statement of Responsibilities wording

The FCA expects the MLRO to have a clear job description, and the Statement of Responsibilities submitted with Form A must match what the person will actually do. The wording below is a starting point you can adapt. It is not legal advice, and it should be checked against your firm’s permissions, group structure and responsibilities map before use.

Two points about the SoR catch firms out. First, if the MLRO is also taking the prescribed responsibility for financial crime, the SoR must say so and the responsibilities map must be consistent. Second, if the MLRO is fractional, the SoR should not imply a full-time presence. The FCA will compare the SoR with the time commitment stated in the application, and an SoR that describes daily oversight of transaction monitoring alongside a two-day-a-month engagement invites questions.

The MLRO annual report

JMLSG guidance expects senior management to commission a report from the MLRO at least once a year, and the FCA expects boards to understand and own the firm’s financial crime risk. The annual report is how both happen. It is also one of the first documents the FCA asks for when it reviews a firm’s financial crime controls, and one of the most useful things to read when you are assessing an MLRO candidate: ask to see a redacted example of one they wrote.

A good annual report usually covers:

• the firm’s current business-wide risk assessment and any changes to its risk profile over the year (new products, customer types, jurisdictions or delivery channels)
• regulatory and legislative changes and how the firm has responded, including the MLR 2026 amendments and any JMLSG changes
• internal reporting statistics: internal SARs received, external SARs filed, DAML requests and outcomes, and themes behind them
• customer due diligence and enhanced due diligence performance, including backlogs, periodic review completion and PEP and high-risk customer numbers
• transaction monitoring and sanctions screening effectiveness: alert volumes, tuning, false positive rates and quality assurance results
• training completion and the results of any testing
• findings from compliance monitoring, internal audit and any external reviews, with remediation status
• resourcing: whether the MLRO function has the people, systems and budget it needs, stated plainly
• recommendations for the board, with owners and dates

Boards should minute their discussion of the report and the decisions taken on its recommendations. A report that is noted without challenge every year is a warning sign the FCA recognises, and so is an MLRO who writes the same report every year.

Recognising candidates who are not ready for SMF17

The most dangerous MLRO candidates are those with strong AML credentials at the technical level who have not held personal decision-making authority. Individuals who have built AML frameworks, written policies, managed compliance monitoring programmes, and held significant compliance roles may present as ready for SMF17 without having made the kind of personal judgements the function requires.

The distinguishing characteristic is not seniority or title — it is decision ownership. An individual who has been the compliance director at a mid-size financial services firm may have approved and delegated SAR decisions without making them personally. An individual who has been the MLRO at a smaller firm with fewer resources but direct, personal accountability for every SAR decision has often developed a stronger capacity for the function than their more senior counterpart.

The interview questions that surface this distinction are concrete and situational: describe the three most difficult SAR decisions you have personally made in the past two years. What made them difficult? What did you decide? What happened? A candidate with genuine SMF17-level experience answers these questions with specificity and with the appropriate weight — they understand what was at stake, they describe the tension clearly, and they explain their reasoning. A candidate without that experience gives procedural answers that describe the SAR decision framework without a specific decision at the centre.

MLRO interview questions that test decision ownership

The single most useful question is the one above: ask the candidate to describe the most difficult SAR or DAML decision they have made, what the facts were, why it was hard, what they decided and how it turned out. A candidate who has held a substantive MLRO role will recall specific decisions clearly. A candidate whose answer describes the decision framework rather than a decision has usually not been the person whose call it was. The questions below build on that.

Decision-making and independence

• Tell us about a time a senior colleague or a major client put pressure on you over a disclosure. What did you do, and what happened to the relationship afterwards?
• Describe a case where you decided not to file an external SAR after an internal report. How did you document the reasoning?
• Have you ever had a DAML request refused? How did you manage the customer and the business during the moratorium without tipping off?
• When have you escalated a financial crime concern to the board against the wishes of the executive? What changed as a result?

Framework and risk assessment

• Walk us through the business-wide risk assessment you last wrote. What were the three highest risks, and how did they shape the controls?
• Looking at our business model, where would you expect our main money laundering and fraud risks to be?
• What did you change in your last firm’s policies after the June 2026 amendments to the Money Laundering Regulations?
• How do you decide whether a transaction monitoring rule is working? Give an example of one you retuned or retired.

Regulator and board

• Describe your most difficult interaction with the FCA on financial crime. What did they ask, and what did you do afterwards?
• Show us how you reported financial crime risk to a board. What did the board change because of your report?
• Have you been through a section 166 skilled person review, a Dear CEO letter follow-up or a financial crime thematic review? What was your role?

For fractional and part-time candidates

• How many other MLRO or SMF roles do you hold, and how many days a month does each take in practice, not on paper?
• Who covers SAR decisions when you are on leave or busy with another client, and how quickly can staff reach you?
• How do you stay close enough to the business to spot risks that nobody escalates?
• Have you ever stepped down from a fractional MLRO role? Why?

Score answers against a pre-agreed grid and have at least one interviewer who has held a regulated compliance or MLRO role. Boards that interview MLROs without that expertise tend to over-weight presentation and under-weight judgement.

The FCA approval process for SMF17

The formal approval process for an SMF17 appointment runs through the FCA’s Form A, submitted on Connect. The application is made by the firm, not the individual, and is accompanied by a Statement of Responsibilities setting out what the proposed MLRO will be accountable for. Before applying, the firm must satisfy itself that the candidate is fit and proper, which includes taking regulatory references from the candidate’s previous regulated employers covering the past six years and obtaining a criminal records check. The candidate also makes declarations covering fitness and propriety.

The statutory deadline is three months from receipt of a complete application, and the clock pauses while the FCA waits for further information or holds an interview. In practice, the FCA explains how it assesses senior management function applications, and since January 2026 it has measured itself against a voluntary target of deciding at least half of senior manager applications in 35 days or less; the government has also proposed cutting the statutory deadline to two months. Applications for straightforward appointments with clean regulatory histories often complete faster than the deadline. Applications that raise questions — where the candidate has a previous regulatory event to disclose, where regulatory references flag concerns, or where the candidate’s experience does not obviously match the complexity of the SMF17 function — will take longer and may require supplementary information from the firm.

The approval timeline means that from the point of offer acceptance to the point where the individual can formally hold the SMF17 function, the firm may be in a regulatory gap. This gap must be managed. SMCR allows a firm to appoint someone to cover a senior manager’s role without approval for up to 12 weeks in any consecutive 12-month period where the absence is temporary or reasonably unforeseen; beyond that, the cover itself needs approval. The FCA expects the gap to be filled promptly; operating without effective MLRO arrangements for an extended period is a regulatory breach in its own right.

Form A and approval timeline, step by step

For a fuller walkthrough of the form itself, see our Form A approval process guide, and for current processing times see how long FCA SMF approval takes. The fitness and propriety test the FCA applies is explained in our guide to fitness and propriety.

When SMF16 and SMF17 can be combined

The FCA permits one person to hold both SMF16 (compliance oversight) and SMF17 (money laundering reporting), and at smaller firms it is the norm rather than the exception. A wealth manager, IFA network member, consumer credit firm, broker or small asset manager rarely has enough financial crime work to justify a separate full-time MLRO, and a single, well-qualified compliance and MLRO lead is often a stronger arrangement than two thinly-spread individuals.

Combination works when:

• the firm’s financial crime risk is moderate and SAR volumes are manageable for one person alongside conduct compliance
• the individual has genuine depth in both conduct compliance and AML, rather than being strong in one and passable in the other
• the combined role has enough time allocated, whether full-time or fractional, and the SoR reflects both functions honestly
• there is a credible deputy or cover arrangement for SAR decisions when the holder is absent

It works less well when the firm has high inherent financial crime risk (cross-border payments, high-risk jurisdictions, cash-intensive customers, crypto), high SAR volumes, or a supervisory history on financial crime. In those cases the FCA is more likely to question whether one person can do both jobs, and a dedicated MLRO with a separate SMF16 is usually the safer structure. Our guide to SMF16 vs SMF17: one, both or a combined role sets out the decision in more depth, and dual SMF holders at smaller regulated firms covers the practicalities. Where you are recruiting the compliance side separately, see our SMF16 Head of Compliance recruitment service.

Fractional combined SMF16/SMF17 is the arrangement we are asked about most. It gives a small firm an experienced, FCA-approved compliance and MLRO lead for a set number of days a month, at a cost that reflects the firm’s size, and it avoids the trap of promoting a compliance analyst into an SMF role they are not ready for.

Interim MLRO — when and how

An interim MLRO is appropriate whenever the firm faces a gap in the SMF17 function — whether from unexpected departure, supervisory pressure requiring an immediate upgrade, or the period between a permanent appointment’s offer acceptance and FCA approval. The interim provides regulatory continuity: they receive internal SARs, maintain the AML framework, manage the FCA relationship, and ensure the firm is not operating without effective financial crime governance while the permanent appointment progresses.

FCA approval is specific to the firm, so an interim who holds or recently held SMF17 elsewhere still needs a Form A to hold the function at your firm on anything more than a temporary basis. What they can do is step in under the 12-week rule while the application is prepared, and someone with a recent, clean SMF17 approval is generally a lower-risk application. In practice, most interim MLROs deployed by specialist search firms have current or recent FCA approval and can begin operating quickly. For urgent requirements — where the firm needs an interim MLRO in place within days rather than weeks — direct sourcing through a specialist FCA compliance search firm is the fastest route. Our guide to interim SMF16 and SMF17 cover under FCA supervision explains how the FCA looks at these arrangements.

Interim MLROs are also used for remediation: after a section 166 review, a voluntary requirement or a critical internal audit finding, a firm may bring in an experienced interim to rebuild the framework while the permanent MLRO focuses on day-to-day decisions, or to hold the function while the board decides what kind of permanent MLRO it needs. For interim compliance leadership more broadly, see our interim Chief Compliance Officer service.

Fractional and part-time MLRO: when it works

A fractional MLRO is an experienced, FCA-approved MLRO who holds the SMF17 function at your firm on a part-time basis, usually alongside similar roles at other firms. A part-time MLRO is the same idea, often employed directly for a fixed number of days a week. Neither is a consultancy service: the individual is your SMF17, personally approved for your firm, personally accountable and personally exposed under the Proceeds of Crime Act. That is what makes the model work, and it is also what makes it go wrong when it is set up carelessly.

When fractional works

• Small and growing FCA-authorised firms with moderate financial crime risk: IFAs, wealth managers, small asset managers, brokers, consumer credit firms and lenders, insurance intermediaries.
• Start-ups applying for authorisation, where the FCA wants to see a credible MLRO named in the application but the business does not yet justify a full-time hire.
• Firms combining SMF16 and SMF17 in one experienced person.
• Firms between permanent MLROs, where fractional cover gives continuity without a full-time interim.

When it does not

• High SAR volumes, real-time transaction monitoring that needs daily MLRO judgement, or a large operations team that needs constant direction.
• Firms under active FCA scrutiny on financial crime, where the regulator will expect a visible, full-time presence.
• Firms whose risk profile involves fast-moving decisions (payments, crypto exchange, trade finance) unless there is a strong full-time deputy and the fractional MLRO’s availability is contractually guaranteed.

How many days a month?

There is no FCA formula. The right commitment depends on the firm’s risk assessment, customer numbers, SAR volumes, the size of any operations team below the MLRO, and whether the role is combined with SMF16. As a practical starting point from the mandates we see:

Whatever you agree, write it into the contract and the SoR, build in extra days for the annual report, the risk assessment refresh and any FCA engagement, and review it after six months. The commonest failure is a commitment set at the level the firm wanted to pay for rather than the level the risk required.

What the FCA expects of a fractional MLRO

The FCA does not prohibit part-time MLROs, and approves them routinely. What it looks for is the same as for any MLRO, tested more closely: sufficient seniority and authority within the firm; independence and direct access to the board, the FCA and the NCA; adequate resources and information; a UK base, which JMLSG guidance expects of the MLRO; and enough time to do the job. Expect the FCA to look at the candidate’s other roles and the time commitment stated in the application, and in some cases to interview the candidate about how they will cover the firm. A fractional MLRO with a clear time allocation, defined escalation routes and a named deputy is a straightforward application. One who holds a large number of other SMF roles, with no explanation of how the time adds up, is not.

Dependency and conflict risks

• Key-person dependency. One external individual holds the firm’s most personally exposed role. Agree in writing who receives internal reports when they are unavailable, how quickly they respond, and what happens if they resign. The 12-week rule helps, but only if someone is ready to step in.
• Distance from the business. A fractional MLRO who only sees what is sent to them will miss risk. Give them system access, attendance at relevant committees and a regular slot with the CEO and front office.
• Capacity across clients. Ask how many other roles they hold and test the answer. If several of their clients have an FCA visit or a SAR spike in the same month, which one gets their time?
• Self-review. If the MLRO’s own consultancy also provides your compliance monitoring, policy writing or training, they may end up reviewing their own work. Keep independent assurance, such as internal audit or an external review, in the structure.
• Commercial dependency. An MLRO whose income depends heavily on one client may find it harder to make an unpopular call. Independence is easier to protect when no single client dominates.
• Outsourcing. Where the MLRO is supplied through a firm rather than engaged individually, the arrangement may fall within the FCA’s outsourcing rules. Accountability stays with the approved individual and with your board either way.

Our fractional MLRO and part-time MLRO services place FCA-approved MLROs on exactly these terms, and the fractional MLRO guide covers the FCA’s position, when it works and when it doesn’t. If you need fractional compliance support alongside or instead of the MLRO, see our fractional compliance officer service.

Compensation and Package Structure

We have removed the pay ranges that previously appeared here, because pay for this role varies too much by firm type, sector, risk profile and arrangement for a single table to be reliable without a sourced survey behind it. What we can set out is how MLRO packages are structured, and what to get right in each element.

Two structural points matter more than the headline number. First, the MLRO’s variable pay should not be tied to revenue, new business or the volume of transactions processed: an MLRO rewarded for growth is an MLRO with a conflict. Balanced scorecards based on the quality of the framework, regulatory outcomes and remediation delivery are the norm. Second, at banks, building societies and investment firms the MLRO is likely to be a material risk taker, so deferral, malus and clawback rules apply. The bonus cap was removed from 31 October 2023, and the FCA and PRA have since revised the remuneration rules again (FCA PS25/15 and PRA PS21/25), so check the current position for your firm type before making an offer. For a market view on a specific role, talk to us.

The most consequential mistakes in MLRO appointments

Appointing on AML technical knowledge without testing decision-making independence is the most consequential mistake. A candidate who can recite the Money Laundering Regulations and describe a comprehensive AML framework but who has never been in a position where they had to make a difficult SAR decision against commercial pressure is not ready for SMF17. The technical knowledge is necessary but not sufficient. The decision-making independence is the thing that matters most, and it is the thing most easily overlooked by a board that is more comfortable assessing compliance knowledge than personal accountability.

Underestimating the board relationship dimension produces MLROs who build excellent technical AML frameworks that the board does not engage with. An MLRO who cannot communicate financial crime risk in terms that drive board-level understanding and accountability has failed at one of their most important functions — not because the framework is inadequate, but because the governance layer that should be overseeing it is not functioning. The FCA expects boards to understand and own the firm’s financial crime risk; an MLRO who allows the board to remain uninformed is allowing a governance failure.

Moving too slowly when the SMF17 vacancy arises is a regulatory risk in itself. Firms that treat the MLRO search as a normal executive hire — with a six-to-eight week search process followed by a three-month notice period — are routinely operating without an effective SMF17 for four to five months. The FCA’s expectation is that the vacancy is filled promptly. An interim or fractional MLRO deployed quickly after the vacancy arises resolves the regulatory continuity problem while the permanent search runs at the appropriate pace.

Three further mistakes come up regularly:

• Under-sizing a fractional arrangement. Agreeing a day or two a month because that is the budget, then discovering the firm’s risk profile needs much more. The FCA notices, and so does the MLRO, who is carrying personal exposure for a framework they do not have time to oversee.
• Promoting the compliance analyst. Giving SMF17 to the person who has been running the AML desk, without the decision-making record or the authority with the board, because it is quicker than a search. Sometimes it works. Often the FCA asks hard questions at application stage, or the firm finds out later.
• Leaving the SoR vague. A generic SoR that does not say who is the nominated officer, who holds the prescribed responsibility for financial crime, or how the role relates to SMF16, creates gaps that surface when something goes wrong.

MLRO Recruitment — Permanent and Interim

Exec Capital places MLROs and SMF17 holders across the UK financial services sector on permanent, interim and fractional terms, including combined SMF16/SMF17 roles at smaller firms. We help firms define the role and the time commitment, prepare the Statement of Responsibilities, run the search, and support the Form A process and regulatory references. For urgent interim or fractional requirements, call us directly on 0203 834 9616.

Our MLRO search service covers banks, payment and e-money institutions, wealth and asset managers, insurers and brokers, consumer credit firms and cryptoasset businesses preparing for authorisation. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate.

Related Guides and Services

• MLRO Recruitment — permanent, interim and fractional MLRO search across all regulated sectors
• SMF16 Head of Compliance Hiring Guide — how to hire for the Compliance Oversight function
• Fractional MLRO Guide — the FCA’s position, when it works and when it doesn’t
• Fractional MLRO — our fractional MLRO service for smaller FCA-regulated firms
• Part-time MLRO — a set number of days a week or month from an FCA-approved MLRO
• Head of Compliance Recruitment (SMF16) — compliance leadership search for FCA-regulated firms
• FCA Regulated Firm Recruitment — all SMF appointments

Frequently asked questions

Is the MLRO the same as the SMF17?

At an SMCR firm, yes: the person appointed as MLRO under SYSC 6.3 performs SMF17 and needs FCA approval. The MLRO is usually also the nominated officer under the Money Laundering Regulations, though larger firms sometimes split that role. Payment and e-money institutions need an MLRO but sit outside SMCR, so there is no SMF17.

Can our MLRO be part-time or fractional?

Yes. The FCA approves part-time and fractional MLROs routinely, provided the individual has enough time, seniority, independence, resources and a UK base, and there is cover for SAR decisions when they are unavailable. The time commitment should be set by the firm’s risk, not its budget.

How many days a month does a fractional MLRO need?

There is no fixed rule. A low-risk advisory firm may need a few days a month; a combined SMF16/SMF17 role or a firm with higher financial crime risk usually needs more, often one to two days a week or above. Set the commitment in the contract, add time for the annual report and risk assessment, and review it after six months.

Can one person hold both SMF16 and SMF17?

Yes, and at smaller firms it is common. It works where financial crime risk is moderate, the individual is strong in both conduct compliance and AML, and the role has enough time. Firms with high financial crime risk or high SAR volumes usually do better with separate holders.

How long does FCA approval for an SMF17 take?

The statutory deadline is three months from a complete application, with the clock paused for information requests. Since January 2026 the FCA has aimed to decide at least half of senior manager applications in 35 days or less. Allow extra time for regulatory references and criminal records checks before you submit.

What happens if our MLRO leaves suddenly?

Appoint temporary cover immediately. Under SMCR someone can cover the role without approval for up to 12 weeks in a 12-month period. Notify the FCA, make sure internal reports still reach a decision-maker, and start either a permanent search or a fractional or interim appointment straight away, with a Form A if the cover will run beyond 12 weeks.

Does the MLRO have to be based in the UK?

JMLSG guidance expects the MLRO of a UK firm to be based in the UK, and the FCA’s expectations on access and availability point the same way. A group MLRO based overseas is not usually an acceptable substitute for a UK-based SMF17.

Will the SMCR reforms remove the need to pre-approve the MLRO?

No. The FCA’s CP26/37 and the PRA’s CP14/26 propose moving some senior manager roles to a notification regime, but SMF16 and SMF17 would remain pre-approved.

Do cryptoasset firms need an SMF17?

MLR-registered cryptoasset businesses need a nominated officer now. Under the new FSMA regime, which takes effect on 25 October 2027, the FCA is applying SMCR to authorised cryptoasset firms, so firms applying in the gateway window (30 September 2026 to 28 February 2027) should plan for an FCA-approved SMF17.

Is the MLRO personally liable?

Yes, in two ways. They can commit a criminal offence under the Proceeds of Crime Act by failing to make a required disclosure, and as an approved senior manager they are personally accountable to the FCA under the conduct rules and the duty of responsibility.

Sources

• FCA — Senior Managers and Certification Regime (SMCR)
• Proceeds of Crime Act 2002
• Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017
• Money Laundering Regulations 2017, regulation 21 (internal controls)
• The Money Laundering and Terrorist Financing (Amendment) Regulations 2026
• NCA — Suspicious Activity Reports
• Joint Money Laundering Steering Group (JMLSG) Guidance
• FCA — Financial Crime and AML Guidance
• FCA — How we assess senior management function applications
• FCA — Cryptoassets: how the gateway will operate
• HM Treasury — AML/CTF supervision reform: duties, powers and accountability
• GOV.UK — Offence of failure to prevent fraud
• FATF — AML/CFT Recommendations

MLRO Recruitment | SMF16 Recruitment | Fractional MLRO | FCA Regulated Firms | CRO Recruitment