The MLRO Annual Report: What the Board Should Expect

The board’s most important window into financial crime risk

Once a year, the Money Laundering Reporting Officer of an FCA-regulated firm should give senior management and the board a report on how well the firm’s anti-money laundering systems and controls are working. For many boards it is the single most important document they receive on financial crime. Done well, it tells directors where the firm’s money laundering, terrorist financing and sanctions risks lie, whether the controls are working and what needs to change. Done badly, it becomes a statistics pack that nobody reads.

This article explains why the report matters, what a good one contains, how the board should challenge it, and what it can tell you about whether your financial crime function, and your MLRO, has what it needs. It is written for boards, CEOs and MLROs, including those holding the SMF17 Money Laundering Reporting function.

Why the report is expected

The FCA’s Financial Crime Guide asks how regularly senior management commission reports from the MLRO, and states that this should be at least annually. It expects senior management to receive informative, objective information sufficient for them to meet their anti-money laundering obligations, and it lists as poor practice a board that never considers MLRO reports. Industry guidance from the Joint Money Laundering Steering Group also describes the MLRO’s annual reporting to senior management.

Behind that sits the Money Laundering Regulations 2017, which require firms to assess their money laundering risks, maintain policies, controls and procedures to manage them, and appoint a nominated officer to receive internal reports of suspicion and decide whether to report to the National Crime Agency. The annual report is how the board satisfies itself that those obligations are being met. For SM&CR firms, it is also part of the evidence that senior managers have taken reasonable steps.

The expectation is not limited to SM&CR firms. Payment institutions, e-money institutions and other firms within the Money Laundering Regulations have a nominated officer too, and boards there need the same assurance. Our payments compliance recruitment page explains how the MLRO role works at firms outside SM&CR.

What a good MLRO annual report contains

There is no prescribed template, and the report should be proportionate to the firm. Most good reports cover the following areas.

1. Executive summary. The MLRO’s overall view of the firm’s financial crime risk and the effectiveness of its controls, in plain language, with the key recommendations up front.
2. The business and its risk profile. Changes during the year in customers, products, delivery channels and geographies, and what they mean for money laundering risk.
3. The firm-wide risk assessment. When it was last updated, what changed and how the firm’s risk appetite applies.
4. Policies and procedures. What was updated during the year and why, including changes driven by new rules, guidance or sanctions regimes.
5. Customer due diligence. The make-up of the customer base by risk rating, enhanced due diligence on high-risk customers and politically exposed persons, and any backlog of overdue periodic reviews.
6. Monitoring and screening. How transaction monitoring and sanctions screening performed: alert volumes, false positive rates, tuning changes and any system issues.
7. Suspicious activity reporting. Numbers of internal reports, external reports to the NCA and defence against money laundering requests, with trends and themes. Our article on DAML requests in practice covers that process.
8. Assurance. Results of compliance monitoring, internal audit or external reviews of financial crime controls, and progress on findings.
9. Training. Completion rates, content changes and any targeted training for high-risk roles.
10. Breaches, incidents and regulatory contact. Any control failures, near misses, regulatory correspondence or law enforcement requests.
11. The MLRO’s resources. Whether the MLRO has sufficient time, staff, systems, access and seniority, and any constraints on their effectiveness.
12. Recommendations and the year ahead. Prioritised actions with owners and dates, and the emerging risks the MLRO expects over the next 12 months.

Good report or poor report?

A good report	A poor report
Gives a clear opinion on whether controls are effective	Lists activity without saying whether it worked
Explains trends and what drives them	Presents numbers without comparison or context
Is candid about weaknesses and backlogs	Reassures without evidence
Makes specific, prioritised recommendations with owners	Makes general statements of intent
Tracks last year’s recommendations to completion	Starts afresh each year
States plainly whether the MLRO has enough resource	Avoids the question

Questions the board should ask

• What is the MLRO’s overall opinion of our controls, and what would change it?
• Which risks have grown this year, and are our controls keeping pace?
• Where are our backlogs, in reviews, alerts or investigations, and when will they clear?
• Have any of last year’s recommendations not been completed, and why?
• What did independent testing of our controls find?
• Do you have enough people, systems and time to do the job? What would you need to do it properly?
• Is there anything you have been unable to do, or anyone you have been unable to access?
• Who covers the role when you are unavailable?

The board should minute its discussion, its decisions and the actions it agrees. The FCA’s guidance asks what senior management does with MLRO reports and what follow-up there is on recommendations, so a report that is noted without discussion is a weakness in itself.

What the report can tell you about your financial crime function

Read carefully, the MLRO’s annual report is also a test of whether the firm has the right financial crime leadership.

Signs the MLRO is overstretched. Growing review backlogs, rising alert volumes without matching resource, recommendations carried forward year after year, or an MLRO who also holds several other roles. Where one person holds both SMF16 and SMF17, a report that is thin on financial crime detail can be a sign that compliance work is crowding it out. Our article SMF16 and SMF17: one person or two? explains when to split the roles.

Signs the firm needs more resilience. If there is no deputy or alternate MLRO, internal reports may sit unreviewed when the MLRO is away. Our AMLRO recruitment page covers that role.

Signs the firm needs more seniority. If the report lacks a clear opinion, avoids difficult messages or is never challenged, the MLRO may not have the experience or standing the FCA expects. The Financial Crime Guide identifies an MLRO who lacks credibility and authority, through inexperience or lack of seniority, as poor practice.

Where the report points to a resourcing gap, options include adding a financial crime analyst, appointing a deputy MLRO, engaging a fractional MLRO with deeper expertise, or recruiting a more senior permanent MLRO through our MLRO recruitment team.

Sector points to watch

Consumer credit and BNPL. Reports should cover application fraud, first-party fraud and mule activity alongside traditional money laundering risk. See our consumer credit compliance recruitment page.

Payments and e-money. Expect detail on transaction monitoring tuning, sanctions screening performance, agent and partner oversight and fraud reimbursement. See our article on sanctions screening for payment firms.

Wealth management. Source of wealth and source of funds evidence and politically exposed persons usually dominate. See our article on source of funds versus source of wealth.

Cryptoassets. Travel rule compliance, blockchain analytics and the transition to the new FSMA regime should feature prominently. See our crypto MLRO guide.

Practical tips for MLROs writing the report

• Lead with your opinion and your top three recommendations. Directors may not read every page.
• Show trends over at least two years so the board can see direction, not just a snapshot.
• Be specific about resources. If you need more, say what and why.
• Track every previous recommendation to completion or explain why it changed.
• Keep detailed data in appendices and the narrative short.
• Present the report in person and invite challenge.

For more on the role itself, see our MLRO guide and our article on the SMF17 career path.

Frequently asked questions

Is the MLRO annual report a legal requirement?

The FCA’s Financial Crime Guide expects senior management to commission reports from the MLRO at least annually, and the board needs that information to meet its obligations under the Money Laundering Regulations. In practice, the FCA expects every firm with an MLRO to produce one.

Who should receive the report?

Senior management and the board, or the relevant board committee in larger firms. The board should discuss it and record its decisions.

Does a payments or e-money firm need an MLRO annual report?

Yes. Those firms are within the Money Laundering Regulations and have a nominated officer, even though they sit outside SM&CR. Their boards need the same assurance.

What if our MLRO’s report is weak?

Ask for a clearer opinion and specific recommendations, and consider whether the MLRO has the time, resources and seniority the role needs. A persistently weak report is often a sign that the firm needs to strengthen its financial crime leadership.