The MLRO function is the role of the money laundering reporting officer: in UK rules, the individual a firm must appoint with responsibility for overseeing its compliance with the FCA's anti-money-laundering systems and controls, with enough authority, independence, resources and information to do it. At an asset manager or fund, the same person usually decides whether to accept each high-risk investor, approves every PEP relationship and every suspicious activity report, and answers to the regulator when a file turns out wrong. It is hard to do well because the MLRO signs files other people built, often at an administrator in another country, from documents in several languages. Botminds' Investor KYC/AML Onboarding gives the MLRO one page per investor, every line cited to its source, after an analyst has confirmed and a second reviewer has re-performed the file.
Quillfield Capital and its fund, investors and staff are fictional sample data from the solution; the rules are quoted from the FCA Handbook, UK legislation, EU law and the eCFR.
Five people sign or see one high-risk investor file: what each carried by hand, and what changes
Today
Draws the ownership chart from registry extracts and trust deeds, reads foreign articles through a browser translator and writes every reminder.
With agents
Opens a chain already unfolded and cited, confirms each node as the rating builds, approves reminders drafted in the investor’s language.
Still theirs: Confirms each fact. Never checks or approves her own file.
Today
Re-performs every file before the MLRO and sends back anything whose percentage he cannot trace.
With agents
Gets 14 checks pre-filled by a second model, each with its source, both readings of every owner, and one in twenty low-score discounts to sample.
Still theirs: Attests the file was read correctly.
Today
Approves every high-risk investor, decline and register discrepancy report from files assembled by hand.
With agents
Reads one page: rating, owners, hits and enhanced due diligence evidence, every line cited. Signs with a reason code.
Still theirs: Decides the risk. Approves changes to the risk model.
Today
Answers for every late file at a fund close.
With agents
Sees which files could miss a close and reassigns them; releases accepted accounts through a second person.
Still theirs: Releases the account, never the analyst.
Today
Rebuilds decisions from email, spreadsheets and screening exports.
With agents
Filters a sealed trail by file, person, agent and decision, with model and prompt versions.
Still theirs: Tests that the chain held.
What is the MLRO function?
In the UK it is a defined role. The FCA's SYSC 6.3.9 R requires a firm, other than a sole trader with no employees, to "appoint an individual as MLRO, with responsibility for oversight of its compliance with the FCA's rules on systems and controls against money laundering," and to give that person "a level of authority and independence within the firm and access to resources and information sufficient" to carry it out (FCA Handbook, SYSC 6.3.9).
The guidance beside the rule gives the role its shape. The FCA says the MLRO is "to act as the focal point for all activity within the firm relating to anti-money laundering," and that it "expects that a firm's MLRO will be based in the United Kingdom" (SYSC 6.3.10 G). For many firms under the senior managers and certification regime, acting as MLRO is itself a senior management function, SMF17, the "money laundering reporting function" (SUP 10C.6.2), which means the individual is approved by the FCA and personally accountable.
The Money Laundering Regulations add two appointments that often land on the same desk. Where appropriate to the firm's size and nature, a member of the board or senior management must be appointed as the officer responsible for the firm's compliance with the Regulations; and every firm must appoint a nominated officer, an individual in the firm, who receives internal suspicion reports and decides whether they give grounds to report (MLR 2017, reg. 21). The firm must tell its supervisor who holds both posts within 14 days of the first appointment.
What are the MLRO functions and responsibilities at a fund?
At a fund the MLRO carries four decisions the rest of the chain cannot make: whether to accept a higher-risk investor, whether a PEP relationship may start or continue, whether a suspicion is reported, and whether the firm's risk model and thresholds are right. Everything else, collecting, reading, unfolding, screening and rating, can be prepared by others and checked, but these four are judgments.
The PEP decision is written into law. UK regulation 35(5) requires senior management approval before establishing or continuing a relationship with a PEP or a PEP's family member or known close associate, together with measures to establish source of wealth and source of funds and enhanced ongoing monitoring (MLR 2017, reg. 35); Article 42 of the EU AML Regulation says the same from July 2027. PEP senior management approval: who signs, and on what evidence covers what that sign-off should rest on. In practice the MLRO is often that senior manager, or advises the one who signs.
The senior AML roles a fund may need, regime by regime
| Regime | Senior accountable role | Day-to-day AML role | Where it must sit |
|---|---|---|---|
| UK (FCA, MLR 2017) | Board or senior manager responsible for compliance with the Regulations (reg. 21(1)(a)) | MLRO under SYSC 6.3.9, usually also the nominated officer under reg. 21(3); SMF17 where the senior managers regime applies | The FCA expects the MLRO to be based in the UK; the nominated officer is an individual in the firm |
| EU (AMLR, from 10 July 2027) | Compliance manager: a member of the management body in its management function (Art. 11(1)) | Compliance officer: appointed by the management body, of sufficiently high standing, reports suspicious transactions (Art. 11(2)) | Within the obliged entity; reporting to the FIU is not outsourced except within the group in the same member state (Art. 18(3)(e)) |
| US mutual fund | The board, which approves the program in writing | A person or persons designated to implement and monitor the program (1024.210(b)(3)) | No location rule today; FinCEN’s April 2026 proposal would require a designated individual located in the United States |
| US adviser, from 1 January 2028 | The board, or a general partner or equivalent, approving the program | A designated AML/CFT person or persons (1032.210(b)(3)) | May delegate operations, but the adviser stays fully responsible |
Does a US fund need an MLRO?
Not by that name. US rules never use the term: a mutual fund must designate one or more people to implement and monitor the program's operations and internal controls (31 CFR 1024.210(b)(3)), and the adviser rule adopts the same words for RIAs and ERAs from 2028. Firms call that person the AML officer, the AML compliance officer or the BSA officer.
The role is thinner on the ground than the rules assume. In the 2016 benchmark FinCEN used for its adviser rule, about 24% of RIAs had designated an AML/CFT compliance officer (FinCEN, 89 FR 72156). A US manager with a UK or EU fund, or a UK-authorised affiliate, will need an MLRO for those entities anyway, and the same person can sign investor files across the group as long as each entity's own rules about location and appointment are met.
FinCEN's April 2026 program proposal would tighten the US side. Its redrafted mutual fund rule would require the designated individual to be "Located in the United States" and accessible to FinCEN's supervision (91 FR 18704). It is a proposal, but a fund group whose AML officer sits offshore should know it is on the table.
Who approves a high-risk investor?
The MLRO, or a senior manager the firm names, after a second reviewer has re-performed the file. The rules require senior approval for PEPs; for other high-risk investors the firm's own policy decides, and most policies send them to the MLRO. What the rules do not allow is approval by the person who prepared the file, or approval without the evidence the decision rests on.
One high-risk investor in Investor KYC/AML Onboarding: who prepares, who checks, who decides
Agent
PrepareCollector, Reader, Ownership, Screening and Risk agents build the file overnight: documents read, owners unfolded, hits proposed, rating proposed, every line cited.
Never: No agent accepts a document, clears a true match or approves an investor.
A person decides
ConfirmThe KYC analyst confirms each node of the chain and each screening decision; the rating builds as she confirms.
Agent
Re-deriveThe Checker agent re-reads every owner and percentage on a different model, from the documents alone, and pre-fills the 14-point check.
Never: Never edits a value: a disagreement blocks the node.
A person decides
Re-performThe quality control reviewer, never the analyst, passes or returns each of the 14 checks.
A person decides
DecideThe MLRO reads one page and signs: accept, accept with enhanced due diligence, return or decline, each with a reason code.
A person decides
ReleaseInvestor Operations releases the account as the second person; the analyst cannot.
What each signature in the file actually attests
A signature is useful only if it says what was checked. The analyst attests that each fact matches its document. The reviewer attests that the file was read correctly: owners of 25% or more identified, percentages re-computed through each layer, every screening hit decided with a reason, source of wealth evidenced. The MLRO attests to the risk decision. Operations attests that the account it opens is the one the MLRO approved.
Read that way, the chain answers the examiner's real question, which is not "who signed" but "what did each person know when they signed." The sample file shows the difference. Nordhavn Holding, a Danish family holding company subscribing €40,000,000, rated 78, High, because one 31% beneficiary through a Jersey trust is the spouse of a Portuguese government official. The analyst had confirmed all nine nodes by 8:45 a.m., the reviewer passed 14 of 14 checks at 10:05, and the MLRO signed at 11:20 with reason code A2, accept with enhanced due diligence, an annual review and monthly adverse-media monitoring.
The MLRO's page: rating, owners and evidence on one screen, beside the second reviewer's checks
Can the administrator's MLRO act for the fund?
It can do the work; whether it can hold the role depends on the regime. Under UK rules the nominated officer must be "An individual in the relevant person's firm" (reg. 21(3)), and an MLRO must have authority within the firm, so a UK manager can use an administrator's staff for files but needs its own officers. Under the EU AML Regulation from July 2027, the decision on a customer's risk profile and the decision to enter the relationship cannot be outsourced at all (Art. 18(3)).
US rules are looser on paper. FinCEN lets an adviser delegate some or all of its program, including to a fund administrator, provided the adviser stays fully responsible and can demonstrate the program's compliance to examiners. In practice that means the adviser's own designated person needs to see each high-risk decision, which is the same answer by a different route. AML outsourcing to a fund administrator works through the delegation agreement.
“The following tasks shall not be outsourced under any circumstances: … (c) decision on the risk profile to be attributed to the customer; (d) the decision to enter into a business relationship or carry out an occasional transaction with a client.”
Regulation (EU) 2024/1624, Article 18(3)
Where the days of a high-risk file go, and how much of it is signatures
By our estimate, about a sixth of the business days in a high-risk institutional file go to the second check and the MLRO's approval when the file is built by hand. The larger share is the work before them: building the checklist, chasing documents and reading registers and deeds in other languages. That is where the agents take the time, and why the signatures get faster too: the reviewer and the MLRO stop reconstructing the file and start reading it.
Where a high-risk investor file's business days go, by hand and with Investor KYC/AML Onboarding
By hand · about 18 business days
- Checklist and chasing documents · 33%
- Reading documents, unfolding the chain, screening · 39%
- Rating and enhanced due diligence · 11%
- Second check and MLRO · 17%
With the solution · about 8 business days
- Checklist and chasing documents · 50%
- Reading documents, unfolding the chain, screening · 18%
- Rating and enhanced due diligence · 19%
- Second check and MLRO · 13%
The first segment barely shrinks, and that is honest: an investor who takes a week to send a certified statute takes a week whatever software the fund runs. What changes is that the MLRO's day is spent on judgment. In the sample firm's settings, the MLRO also approves every change to the risk model and every register discrepancy report before it is filed, and receives a monthly report of every override.
What does the MLRO's signature mean if the file later proves wrong?
It means the MLRO decided on the evidence the file showed, and the question becomes whether that evidence was enough and honestly presented. A sign-off on a file that hid a proxy, or that the approver knew was incomplete, protects no one. OFAC's GVA Capital case turned in part on what senior management knew: the firm's leaders had dealt personally with the sanctioned investor before his designation, and OFAC found the violations wilful and imposed the $215,988,868 statutory maximum (OFAC, June 12, 2025).
The protection for an MLRO is a file in which every conclusion can be traced to its document and every disagreement is visible: the Checker's second reading beside the first, the screening decision beside its reason, the register discrepancy beside the deed. Investor KYC/AML Onboarding keeps that trail sealed entry by entry, with the agent and model version behind each proposal, for five years after the relationship ends. The investor due diligence checklist lists what such a file contains, and who signs a source of wealth file covers the same chain in private banking. To see the MLRO's page on sample files, start from Investor KYC/AML Onboarding.
Questions people ask
Is the MLRO the same as the compliance officer?
Not necessarily. Under UK rules the MLRO oversees AML systems and controls and is usually the nominated officer for suspicion reports, while the compliance oversight function (SMF16) covers regulatory compliance generally. Small firms often combine them; the EU AML Regulation separates a management-body compliance manager from a day-to-day compliance officer.
Does the MLRO have to be based in the UK?
The FCA's guidance in SYSC 6.3.10 says it expects a firm's MLRO to be based in the United Kingdom. It is guidance rather than a rule, but a firm that departs from it needs a reason the FCA would accept.
Who reports suspicious activity at a fund?
In the UK, the nominated officer, who must consider each internal disclosure and decide whether it gives grounds for knowledge or suspicion. In the EU from July 2027, the compliance officer reports to the financial intelligence unit. In the US, the fund or adviser files the SAR with FinCEN within the 30-day clock.
Must the supervisor be told who the MLRO is?
Yes, in the UK: under regulation 21(4) a firm must inform its supervisory authority within 14 days of first appointing the responsible board member and the nominated officer, and of any later change.
What does the second reviewer check before the MLRO signs?
In the sample firm, 14 points, among them: the investor matched to its register, every 25% owner identified and verified, percentages re-computed through each layer, trust roles, the senior managing official, valid IDs, proofs of address within three months, every party screened, every hit decided with a reason, PEP status and enhanced due diligence, source of wealth, the risk factors and the register discrepancy.