What Does an MLRO Do? The Money Laundering Reporting Officer Explained

On this page

1. 1What is an MLRO?
2. 2Is an MLRO a legal requirement in the UK?
3. 3What is the difference between an MLRO, an MLCO and a nominated officer?
4. 4What does an MLRO do day to day?
5. 5How does an MLRO decide whether to make a suspicious activity report?
6. 6Can an MLRO approve a suspicious transaction?
7. 7Can an MLRO be personally prosecuted?
8. 8How should staff make an internal report to the MLRO?
9. 9Who can be an MLRO?
10. 10Does a small business or sole trader need an MLRO?
11. 11Which AML supervisor does an MLRO deal with?
12. 12What should an MLRO’s annual report include?
13. 13What should a newly appointed MLRO do first?
14. 14What training does an MLRO need, and which courses help staff?
15. 15Frequently asked questions

This guide is for new MLROs, the partners and directors appointing one, and staff who want to know what happens when they raise a concern. For the mechanics of a report to the NCA, see our guide to suspicious activity reports; for the wider picture, what anti-money laundering is. It is general information, not legal advice.

What is an MLRO?

“MLRO” is the everyday name for the role the law calls the nominated officer. The Money Laundering Regulations 2017 define a nominated officer as a person nominated to receive disclosures under Part 7 of the Proceeds of Crime Act 2002 (POCA, money laundering) or Part 3 of the Terrorism Act 2000 (terrorist property). In plain terms, the MLRO is the internal destination for every suspicion in the business.

Regulation 21(5) sets out the core task. When a disclosure is made to the nominated officer, they “must consider it in the light of any relevant information which is available” to the business and decide whether it gives rise to knowledge or suspicion, or reasonable grounds for knowledge or suspicion, that someone is engaged in money laundering or terrorist financing. If it does, the MLRO reports to the NCA; if not, they record why.

The Financial Conduct Authority (FCA) describes the MLRO as “the focal point for all activity within the firm relating to anti-money laundering” (SYSC 6.3.10G). The role sits between front-line staff, who see the transactions, and the NCA’s UK Financial Intelligence Unit, which receives the reports.

Is an MLRO a legal requirement in the UK?

Yes, for almost every business covered by the Money Laundering Regulations. Regulation 21(3) says: “An individual in the relevant person’s firm must be appointed as a nominated officer.” Unlike the compliance officer role in regulation 21(1), it is not qualified by the size and nature of the business: a two-person estate agency needs one just as a bank does. Three further rules sit around it:

• Notifying your supervisor. Regulation 21(4) requires the business to tell its supervisor who the nominated officer is within 14 days of the first and any later appointment. HMRC also expects to be told about deputies.
• The sole practitioner exception. Regulation 21(6) disapplies the duty for an individual who neither employs nor acts in association with any other person (see below).
• FCA-authorised firms. SYSC 6.3.9R requires a firm, except a sole trader with no employees, to appoint an individual as MLRO and to make sure the MLRO has “a level of authority and independence within the firm and access to resources and information sufficient” to do the job. Under the Senior Managers and Certification Regime (SM&CR), acting as MLRO is the money laundering reporting function, SMF17 (SUP 10C.6.2R), so the person normally needs FCA approval first.

What is the difference between an MLRO, an MLCO and a nominated officer?

“Nominated officer” and “MLRO” are the same role under different names. The money laundering compliance officer (MLCO) is a separate role created by regulation 21(1)(a): “where appropriate with regard to the size and nature of its business”, a firm must appoint a board member or senior manager “as the officer responsible for the relevant person’s compliance with these Regulations”. The Solicitors Regulation Authority (SRA) uses the labels MLRO and MLCO; HMRC calls them the nominated officer and the compliance officer.

Can one person do both jobs? Yes, and in small firms it is common. The SRA’s December 2021 guidance for new role holders said that around 90% of the law firms it supervises choose to have one person hold both roles. HMRC recommends that they should not be the same person, because the compliance officer reviews the nominated officer’s handling of suspicious activity, but accepts this may not be practical in smaller businesses if you can give reasons. For FCA firms, SYSC 6.3.8R requires a director or senior manager to hold overall responsibility for anti-money laundering systems and controls and says that person “may also be the money laundering reporting officer”.

HMRC also recommends a deputy nominated officer to cover absences; in HMRC-supervised sectors the deputy must be included as a beneficial owner, officer or manager (BOOM) on the registration and pass the relevant checks.

What does an MLRO do day to day?

HMRC’s guidance lists the nominated officer’s responsibilities as receiving disclosures, evaluating them, reporting to the NCA, and requesting a defence against money laundering (DAML) or against terrorist financing (DATF) where the business wants to go ahead with a suspicious transaction. Around that legal core, most MLROs also:

• Answer staff questions. A quick, approachable answer to “is this worth reporting?” is what makes staff report early.
• Keep the SAR records. Each report, the decision and the reasons, whether or not a SAR was made. The SRA advises storing SARs centrally and securely, off client files.
• Manage cases after a report. Watching for further activity, answering law enforcement requests, deciding whether work can continue and making sure nobody tips the customer off.
• Brief staff. Everyone should know who the MLRO and deputy are and how to report.
• Feed back into the firm’s risk assessment. Trends in internal reports often show where the firm’s policies or customer due diligence are weak.
• Report to senior management. In FCA firms this includes at least an annual report (see below).

How does an MLRO decide whether to make a suspicious activity report?

The MLRO does not need proof. The question under regulation 21(5) is whether the information gives rise to knowledge or suspicion, or reasonable grounds for knowledge or suspicion, that a person is engaged in money laundering or terrorist financing. A sensible process looks like this:

1. Read the report and gather what the firm already holds. Regulation 21(5) says the MLRO must consider the disclosure “in the light of any relevant information which is available”. That means the customer file, due diligence records, earlier reports and, where relevant, the customer’s source of funds and source of wealth.
2. Apply the test, not a hunch. Is there a genuine suspicion, more than a vague feeling, that the property is criminal or linked to terrorism? Could an innocent explanation account for everything?
3. Decide and record. Note the decision, date, information considered and reasons. A reasoned decision not to report matters as much as a report.
4. If reporting, report as soon as is practicable. Under POCA section 331 the required disclosure goes to the NCA “as soon as is practicable” after the information reaches the MLRO.

SARs go through the NCA’s SAR Portal, available 24/7. How a SAR is structured and how DAML requests work are covered in our suspicious activity report guide.

Can an MLRO approve a suspicious transaction?

Not on their own. When a member of staff tells the MLRO about property they suspect is criminal before dealing with it, they need “appropriate consent” before going ahead, and in that situation the consent comes from the MLRO (POCA section 335). Section 336 limits when the MLRO may give it. The MLRO must first make a disclosure to the NCA and then either receive the NCA’s consent, or hear nothing by the end of the notice period of seven working days, or have the 31-day moratorium period expire after a refusal.

Section 336(5) makes it a criminal offence for a nominated officer to give consent when none of those conditions is met and they know or suspect the act is a prohibited act. The maximum sentence on indictment is five years’ imprisonment. The practical rule: never tell a colleague to “carry on” with a suspect transaction until the DAML process is complete. Courts can extend a moratorium under section 336A by up to 186 days in total, so ask early.

Can an MLRO be personally prosecuted?

Yes. The MLRO carries personal criminal liability for doing the job badly. The main offences are:

• Failure to disclose: nominated officers in the regulated sector (POCA s.331). Committed if an internal report gives the MLRO knowledge, suspicion or reasonable grounds for suspicion of money laundering and they do not report to the NCA as soon as is practicable. The “reasonable grounds” limb is objective: an MLRO can be liable for what they should have suspected.
• Failure to disclose: other nominated officers (POCA s.332). For nominated officers receiving disclosures under section 337 or 338, typically outside the regulated sector. It applies only where they actually know or suspect.
• Terrorist financing. Section 21A of the Terrorism Act 2000 is the regulated sector equivalent.
• Tipping off (POCA s.333A). Revealing a report or investigation in a way likely to prejudice an investigation; up to two years’ imprisonment.

Under section 334, the offences in sections 330 to 332 carry up to five years’ imprisonment on indictment. Section 331(6) gives a defence of “a reasonable excuse”, and section 331(7) requires a court to consider whether the MLRO followed relevant Treasury-approved guidance. So know your sector’s approved guidance and show in your records that you followed it.

There is regulatory exposure too: in FCA firms the MLRO is an approved senior manager, and other supervisors can take action against the business and, in some cases, individual officers and managers.

How should staff make an internal report to the MLRO?

For employees, the internal report is what protects them. Under POCA section 330, a person in the regulated sector who knows, suspects or has reasonable grounds to suspect money laundering commits an offence if they do not disclose it “as soon as is practicable” to a nominated officer or the NCA. Section 330(4)(a) means a report to the nominated officer satisfies the duty, provided it is made in the course of employment to the person the employer has nominated (section 330(9)). For employees who suspect that property they are about to handle is criminal, a disclosure to the nominated officer can also be an “authorised disclosure” under section 338(5).

A good internal report:

• is made promptly, ideally before any further step in the transaction, using the firm’s reporting route;
• says who is involved, what the property or transaction is, where it is and why the reporter is suspicious, sticking to facts;
• is not discussed with the customer or with colleagues who do not need to know.

Once the report is made, the decision belongs to the MLRO. Staff should not investigate themselves or ask the customer questions that might alert them, and should follow the MLRO’s instructions on whether work can continue.

Who can be an MLRO?

The regulations set no qualification or seniority level. They require “an individual in the relevant person’s firm”, so you can buy in advice and training but the role itself sits inside the business. HMRC says the nominated officer should be trustworthy, senior enough to access all customer files and records, knowledgeable enough to judge whether a SAR is appropriate, and able to make independent decisions on reporting.

The SRA says the MLRO should be senior enough to have “a voice of authority and the final say” on whether a report is made. Both the FCA and HMRC expect the MLRO to be based in the UK.

There are formal checks. The regulations define a “manager” as including a nominated officer, so in sectors listed in regulation 26 (auditors, insolvency practitioners, external accountants and tax advisers, independent legal professionals, estate and letting agents, high value dealers and art market participants) the MLRO must be approved by the supervisor before acting. HMRC says the nominated officer, compliance officer and any deputies must pass either its fit and proper test or its approval check. The SRA requires firms to seek its approval for anyone taking up either role, including a Disclosure and Barring Service check no more than three months old. In FCA firms, the SMF17 application is part of the senior manager approval process.

Does a small business or sole trader need an MLRO?

It depends on whether anyone else works with you. Regulation 21(6) removes the duty to appoint a nominated officer, and a compliance officer, only where the business “is an individual who neither employs nor acts in association with any other person”. HMRC says such a sole trader does not need a separate nominated officer but is personally responsible for the role’s duties and for reporting suspicious activity.

Two practical points follow. First, the exception is narrow. Taking on a single employee, even part time, or working in association with another person, brings the regulation 21(3) duty back, and the appointment must be notified to your supervisor within 14 days. Second, in a very small firm the MLRO will usually be the owner or a partner. That is fine, but the SRA asks new MLROs to check whether their other roles and fee-earning targets leave room for the work, noting that a SAR can take many hours to prepare.

Groups can share: HMRC says one individual may be nominated officer for several group entities if one person can effectively meet the responsibilities.

Which AML supervisor does an MLRO deal with?

Every regulated business has an anti-money laundering supervisor. It is told who the nominated officer is, may interview them during a review, and issues or adopts the guidance a court looks at under section 331(7).

This is changing. In 2025 the government decided to make the FCA a single professional services supervisor for anti-money laundering, taking over legal, accountancy and trust or company service providers from the professional bodies and HMRC. HM Treasury’s June 2026 consultation response sets out the new powers, but the transfer has not yet happened, so for now MLROs should keep working to their current supervisor’s guidance.

For sector-specific duties, see our guides to CPD requirements for accountants, training requirements for estate agents and CPD requirements for solicitors.

What should an MLRO’s annual report include?

In FCA-regulated firms, SYSC 6.3.7G says a firm’s systems and controls should include appropriate information to its governing body and senior management, “including a report at least annually” by the MLRO “on the operation and effectiveness of those systems and controls”. There is no equivalent rule in other sectors, but a short annual report is good practice anywhere. It usually covers:

• internal reports received, SARs and DAML requests made, and trends, without identifying customers;
• any changes in the firm’s money laundering risks, new services or new types of customer;
• the results of any independent audit and progress on its recommendations;
• training delivered and any gaps in the regulation 24 training record;
• resources: whether the MLRO, deputy and compliance team have enough time and support.

What should a newly appointed MLRO do first?

The SRA’s guidance for new role holders sets out first-day, first-week and first-month checklists that suit most sectors. In short:

• Confirm the business has notified your appointment to its supervisor within 14 days, and that any approval or fit and proper check is complete.
• Make sure every member of staff knows you are the MLRO, who your deputy is and how to contact you both.
• Register with the NCA SAR Portal now, not when the first urgent report arrives.
• Find where past reports and SARs are stored, and read recent ones.
• Read the firm-wide risk assessment and policies, and check the internal reporting route works.
• Set up a confidential decision log for each report, recording what you considered, what you decided and why.
• Agree a deputy and how cover works during holidays and sickness.
• Review the training record and plan training for staff and for yourself, using our guide to AML training requirements.
• Read your sector’s approved guidance.

What training does an MLRO need, and which courses help staff?

There is no mandatory MLRO qualification. Regulation 24 requires the business to make relevant employees aware of the law on money laundering, terrorist financing and proliferation financing, to give them regular training in how to recognise and deal with suspicious activity, and to keep a written record. The MLRO is a relevant employee too, and the SRA expects them to have deeper knowledge of AML risk than their colleagues.

Our courses are awareness training for the wider team, not specialist MLRO training. They do not qualify anyone to act as an MLRO and do not replace your supervisor’s guidance or your firm’s procedures, but a dated certificate can form part of the regulation 24 training record. Three courses fit together:

Together they cost £18 rather than £27 under the pay-for-2-get-3 offer. Employers training 5 or more staff can buy team places at £6 a course place, however many places they buy.

?

Frequently asked questions

What does MLRO stand for?

MLRO stands for money laundering reporting officer, called the nominated officer in the Money Laundering Regulations 2017. The MLRO receives internal reports of suspected money laundering or terrorist financing and decides whether to make a suspicious activity report to the National Crime Agency.

Is an MLRO a legal requirement?

Yes, for businesses covered by the Money Laundering Regulations. Regulation 21(3) requires an individual in the firm to be appointed as nominated officer, and the supervisor must be told within 14 days. The only exception is an individual who neither employs nor acts in association with anyone else.

What is the difference between an MLRO and an MLCO?

The MLRO receives internal reports and decides whether to report to the National Crime Agency. The MLCO is the board member or senior manager responsible for the firm’s overall compliance with the regulations, required where appropriate to the size and nature of the business. One person can hold both roles, as is common in smaller firms.

Can an MLRO go to prison?

Yes. Under section 331 of the Proceeds of Crime Act 2002, a nominated officer who fails to report knowledge, suspicion or reasonable grounds for suspicion from an internal report commits an offence carrying up to five years’ imprisonment. Tipping off is also an offence.

Does a sole trader need an MLRO?

Not if they work entirely alone. Regulation 21(6) exempts an individual who neither employs nor acts in association with any other person, but they remain personally responsible for reporting suspicious activity. Once they take on an employee or work in association with someone, they must appoint a nominated officer.

Does reporting to the MLRO protect employees?

Yes. In the regulated sector, a prompt report to the firm’s nominated officer, made in the course of employment, satisfies the employee’s duty to disclose under section 330 of the Proceeds of Crime Act 2002. The MLRO then decides whether to report to the National Crime Agency.

General information, not legal advice. This guide summarises regulations 3, 21, 24 and 26 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as amended, sections 330 to 338 of the Proceeds of Crime Act 2002, section 21A of the Terrorism Act 2000, the FCA Handbook (SYSC 6.3 and SUP 10C), HMRC’s anti-money laundering guidance for supervised businesses, the SRA’s guidance for new MLCOs and MLROs, NCA guidance on the SAR Portal and HM Treasury’s June 2026 consultation response on supervision reform, as checked on 24 October 2026. Always check the current law and your own supervisor’s guidance, and take advice on specific cases. Nexis CPD courses are CPD-accredited awareness training: they are not regulated qualifications and do not replace specialist MLRO training, your firm’s own policies and procedures or supervisor guidance.