The MLRO Role
The Money Laundering Reporting Officer (MLRO) is a mandatory appointment under the FCA's requirements for all regulated firms. The MLRO is the single point of accountability for:
- Receiving internal suspicious activity reports from staff
- Evaluating whether the suspicion is well-founded
- Deciding whether to file a SAR with the NCA
- Maintaining records of all internal reports and decisions
- Ensuring the firm's AML policies and procedures are effective
The MLRO must be of sufficient seniority and authority to act independently and to escalate issues to the board as necessary.
Internal Escalation Process
The standard internal reporting chain follows this path:
Employee identifies concern
Unusual transaction, unexpected behaviour, mismatched profile
Document the concern
Specific details: what, when, why it raised suspicion
Report to MLRO
Optionally via line manager — but never delayed by this step
MLRO assesses
Evaluates report, may request more information
SAR filed with NCA
Or MLRO records rationale for not filing
You do not need to be certain. You just need to be suspicious. Report it and let the MLRO decide.
FCA Requirements & SM&CR
The FCA requires all authorised firms to appoint an MLRO and notify the FCA of that appointment. The MLRO's fitness is assessed as part of the Senior Managers and Certification Regime (SM&CR).
Senior management is accountable for ensuring adequate AML systems and controls, including allocating resources, ensuring MLRO authority, and responding promptly to deficiencies. The Barclays GBP 42 million enforcement action demonstrated the consequences of senior management failing to ensure adequate controls.
Record Keeping
All internal reports — whether or not they result in a SAR — must be retained for at least 5 years from the date the report was made. Records should include:
- The date the concern was raised
- The identity of the person raising the concern
- The details of the suspicious activity
- The MLRO's assessment and rationale
- Whether a SAR was filed, and the NCA reference number
- Any subsequent actions taken
Escalation Decision Tree
Work through this real-world scenario. Make the right choices at each step to complete the exercise.
You are processing a routine payment when you notice the customer's account has received 12 incoming transfers in the past week, all from different individuals, none of whom appear connected to the customer's business.
Incorrect
Three months later, the account is frozen by law enforcement as part of a money mule investigation. You are asked why you did not report your concern. Under s.330 POCA, failure to disclose carries a maximum penalty of 5 years' imprisonment.
You should always report if something doesn't feel right.
Correct
Good instinct. Documenting your concern is always the right first step.
You write down the specific details: 12 transfers, different senders, amounts ranging from GBP 2,000 to GBP 9,500, no apparent connection to the customer's stated business. Who do you report this to?
Acceptable
Your line manager agrees the pattern is unusual and asks you to submit a formal internal report to the MLRO. You do so. This is a valid path — but going directly to the MLRO is best practice.
Best Practice
You submit your internal report directly to the MLRO. This is perfectly acceptable and is the correct course of action if your line manager is unavailable, if you have any concern about involving them, or if you simply prefer to go directly.
The MLRO reviews your report. They may come back to you for additional details. They then decide whether to file a SAR with the NCA. What should you do now?
Incorrect — Tipping Off Risk
By asking the customer about the transfers, you risk committing the offence of "tipping off" under s.333A POCA (maximum 2 years' imprisonment). Never approach the customer about a matter that has been reported.
Let the MLRO and NCA handle it.
Correct
You have done exactly the right thing. You identified a concern, documented it, reported it through the proper channel, and maintained confidentiality.
Whether or not a SAR is ultimately filed, you have fulfilled your legal obligation.