Hiring MLROs and Heads of Compliance in 2026: FCA Expectations and Best Practices

Why these two roles decide the application

For most licence applications, the money laundering reporting officer (MLRO) and the head of compliance are the two appointments the FCA examines most closely after the chief executive. They are the people who will keep the firm inside the rules once it is authorised, and the case officer tests whether they can. A strong candidate with direct experience of the firm's products shortens the assessment; a candidate whose experience does not match the business leads to interviews, further questions and sometimes a request to appoint someone else.

The MLRO is the person who receives internal reports of suspected money laundering, decides whether to report to the National Crime Agency (NCA), and oversees the firm's anti-money laundering systems. The head of compliance, often called the compliance officer, owns the compliance monitoring plan and advises the board on its regulatory obligations. In smaller firms one experienced person can hold both roles.

What the law requires

Three sets of rules apply, depending on the firm.

The Money Laundering Regulations 2017

Regulation 21 requires every firm in scope, where appropriate to its size and nature, to appoint a member of the board or senior management as the officer responsible for compliance with the regulations, to screen relevant employees before and during employment, and to set up an independent audit function for its controls. Every firm must appoint an individual in the firm as nominated officer, the legal term for the MLRO, and tell the FCA within 14 days of each appointment.

The FCA's SYSC rules

SYSC 6.3.8R requires an FSMA firm to give a director or senior manager overall responsibility for its anti-money laundering systems and controls, and SYSC 6.3.9R requires it to appoint an MLRO with the authority, independence and access to resources the role needs. The guidance in SYSC 6.3 adds that the MLRO acts as the focal point for all anti-money laundering activity, is expected to be based in the UK, and reports to senior management at least once a year on how well the controls are working.

The Senior Managers and Certification Regime

In FSMA firms the MLRO role is senior management function SMF17 and compliance oversight is SMF16. Both are approved by the FCA before the person starts. The firm's SM&CR guide explains the functions, statements of responsibilities and the 2026 changes under PS26/6.

The roles by type of firm

The MLRO and compliance roles exist in every regulated firm, but the approval route differs.

Payment and e-money institutions are outside SM&CR, so the MLRO is not a senior management function there. The FCA still assesses the MLRO's competence and integrity in the application, and the firm notifies the FCA of any change. Cryptoasset firms authorised under the new FSMA regime, which commences on 25 October 2027, will be FSMA firms, so applicants should plan for their MLRO and compliance roles to be assessed as senior management functions.

The safeguarding lead in payment and e-money firms

Since CASS 15 came into force on 7 May 2026, payment and e-money institutions must give a single director or senior manager of sufficient skill and authority responsibility for overseeing operational compliance with the safeguarding rules and reporting on it to the board (CASS 15.2.4R). In small firms this is often the compliance officer or the finance director. It belongs in the same hiring plan, because the case officer reviews it alongside the MLRO.

What the FCA looks for in the person

The FCA applies its fit and proper test: honesty, integrity and reputation; competence and capability; and financial soundness. For these two roles, competence carries the most weight, and it is judged against the firm's own business.

Experience matched to the business

The strongest candidates have done the same job, or worked closely under someone who did, in a firm with similar products, customers and payment flows. A remittance business looks for experience of corridor risk and agent oversight; a card issuer for transaction monitoring at volume; a crypto firm for blockchain analytics and the travel rule. Backgrounds in compliance, financial crime, legal, audit and regulatory consulting all count. Experience mainly in sales or front-line roles usually needs supplementing.

Training and qualifications

The FCA looks for training that is current, relevant to the firm's sector and deeper than an introductory course. A recognised professional qualification in anti-money laundering or compliance with an assessed examination carries more weight than attendance certificates.

Time and location

The role needs enough time to be done properly. Full-time appointments are normal for authorised payment and e-money institutions and for most FSMA firms with retail customers. A part-time MLRO can suit a small firm if the hours are proportionate to the volume and risk of the business and are set out in the application; in the firm's experience, a commitment of a few hours a week is rarely accepted for an authorised firm. The FCA expects the MLRO to be based in the UK, ideally at the firm's main place of business.

Seniority and independence

The MLRO and compliance officer need the standing to challenge the chief executive and the board, and direct access to the board. They should be independent of sales and other client-facing work, and any other duties should not create a conflict with the oversight role.

Using external advisers

Many firms use an outsourced compliance provider or consultant for monitoring reviews, policy drafting or training. That is acceptable, but the MLRO must be an individual in the firm, and the decisions stay with the firm's own people. The FCA expects the MLRO to understand the advice, decide whether and how to act on it, and be able to explain the decision.

An application that relies wholly on an external adviser to supply the firm's compliance knowledge prompts questions about whether the firm can run itself. The stronger model is an in-house MLRO and compliance officer supported by external specialists for independent testing and peak workload, with the arrangement documented in the outsourcing policy.

What the MLRO does once the firm is live

• Risk assessment: owns the business-wide risk assessment of money laundering, terrorist financing and proliferation financing, and updates it as products and customers change.
• Policies and controls: maintains customer due diligence, enhanced due diligence, sanctions screening and transaction monitoring procedures.
• Suspicious activity reports: receives internal reports, decides whether to report to the NCA and keeps a record of every decision. The nominated officer commits an offence under the Proceeds of Crime Act 2002 if they do not report a suspicion they hold.
• Defence requests: where the firm needs to proceed with a transaction it suspects, asks the NCA for a defence against money laundering. The NCA has 7 working days to respond and, if it refuses, a 31-day moratorium follows, which a court can extend.
• Training: makes sure staff are trained on their obligations when they join and regularly afterwards.
• Annual MLRO report: reports to the board on how the controls have operated, with recommendations, at least once a year.
• Regulatory contact: answers the FCA's financial crime questions and supports any review of the firm's controls.

The firm's article on financial crime controls in payment institutions sets out what the FCA expects those controls to contain.

What the compliance officer does

The compliance officer runs the compliance monitoring plan, tests whether the firm follows its own policies, reports findings to the board and tracks them to closure. They advise on new products and marketing, oversee complaints handling and regulatory reporting, and keep the firm's policies current with rule changes, including the Consumer Duty for firms with retail customers.

How to hire: a practical process

1. Define the role from the business plan. Set out the products, customers, countries and volumes the person will oversee, and the hours the role needs.
2. Decide on combined or separate roles. One person can hold both roles in a small firm if they have the time and experience; larger or higher-risk firms separate them.
3. Source candidates with matching experience. Look for people who have held the role at a firm with similar products, or have been the deputy to someone who did.
4. Interview on the firm's own risks. Ask candidates to walk through how they would assess a customer, escalate a suspicion or monitor a new product. The FCA may interview them in the same way.
5. Screen thoroughly. Check identity, employment history, qualifications, directorships and credit history, obtain a criminal record check no more than 6 months old and, for FSMA firms, regulatory references covering the past 6 years.
6. Document the appointment. Agree the reporting line to the board, the time commitment, resources and, in FSMA firms, the statement of responsibilities.
7. Apply or notify. Include the person in the authorisation application, or apply for SMF approval, or notify the FCA within 14 days under the Money Laundering Regulations, depending on the firm.

Timing

Interview questions that test FCA readiness

The FCA's own interviews of proposed MLROs and compliance officers focus on the firm in front of them, not general knowledge. Asking the same questions before appointment shows whether the candidate is ready.

• Which customers, products and countries in our business plan carry the highest money laundering risk, and why?
• Walk through the customer due diligence and enhanced due diligence you would apply to a high-risk business customer.
• Which transaction monitoring scenarios would you expect for our payment flows, and how would you tune them?
• An employee reports an unusual payment at 4pm on a Friday. What happens next, and when would you ask the NCA for a defence?
• What would your first annual MLRO report to the board contain?
• How would you test whether staff follow the policies, and what would you do with the findings?
• Which rules changed for our sector in the last 12 months, and what did firms need to do?

Clear, specific answers grounded in the business plan are what the case officer looks for. A candidate who answers in general terms needs a stronger induction before the application is submitted.

Sourcing key people for licence applications

Finding an MLRO or compliance officer with the right sector experience is often the longest step before an application can be submitted. Buckingham Capital Consulting sources key people for licence applications, including MLROs, compliance officers, safeguarding leads and UK-based directors for payment, e-money, cryptoasset and FSMA firms. Candidates are assessed against the firm's business plan and the FCA's expectations before they are put forward, so the people named in the application match what the case officer will test.

The same assessment applies to existing firms replacing an MLRO, preparing for a change of control or responding to FCA feedback on their financial crime controls. The firm's financial crime service covers the controls the new MLRO will own, and its guide to applying for FCA authorisation explains how key appointments fit into the application.

Frequently asked questions

References

1. Money Laundering Regulations 2017, regulation 21 (legislation.gov.uk)
2. FCA Handbook: SYSC 6.3 Financial crime
3. FCA Handbook: CASS 15 Safeguarding
4. Proceeds of Crime Act 2002, section 335 (legislation.gov.uk)
5. FCA: Senior Managers and Certification Regime
6. FCA: PS26/6 Senior Managers and Certification Regime review
7. FCA: Authorisations operating service metrics 2026/27 Q1

Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.

This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.