What Happens When Your MLRO Is Unavailable

Every firm we work with has thought carefully about who its MLRO is. Very few have thought about what happens on the Tuesday that person is in hospital, or on a flight, or two weeks into a holiday with patchy signal, and an internal report lands that needs a decision about whether to submit a suspicious activity report and whether to continue with a transaction.

This is the quiet single point of failure in small-firm financial crime arrangements. It is not a theoretical one. It is also one of the few compliance problems that is cheap to fix in advance and expensive to fix in the moment, which is a reason to treat it as a resourcing question rather than a policy question.

Why the MLRO is a harder gap to fill than most

Most senior roles tolerate absence. Work queues, decisions wait, and the business absorbs a fortnight without its Finance Director. The money laundering reporting officer role does not behave that way, for three reasons.

The first is that the obligations attach to the firm continuously. The nominated officer arrangements required under the Money Laundering Regulations are not suspended because the individual is away. Internal reports must still be received and considered; decisions on suspicion must still be made; consent, where it is needed, must still be sought.

The second is that the decisions are time-sensitive in a way that is genuinely unusual. A decision to delay a payment, to decline to act, or to seek a defence against money laundering has a clock attached to it. There is rarely a sensible option to wait for the MLRO to be back.

The third is that the role is personal. The SMF17 approval attaches to a named individual, and the annual MLRO report is written for that individual to own. A colleague cannot simply pick up the file and exercise the judgement, because the judgement is what the approval is for.

What firms typically have in place, and why it does not hold

When we ask what the cover arrangement is, we usually get one of four answers.

“The Compliance Officer covers it.” At many firms the SMF16 and SMF17 are the same person anyway, in which case there is no cover at all — there is one individual holding two functions, as we discuss in our piece on whether SMF16 and SMF17 should be one person or two. Where they are different people, a compliance oversight holder with no financial crime background is being asked to make suspicion decisions on an unfamiliar customer base, which is cover in name only.

“The MLRO checks email on holiday.” This is extremely common and it is the arrangement we would most like firms to stop relying on. It works until it does not, and when it does not — illness, bereavement, a flight, a resignation with immediate effect — the firm discovers the gap at exactly the moment it has no capacity to think about it.

“We have a deputy named in the policy.” Better, and often the right structure, but worth testing. Has the deputy ever actually made a decision? Do they have access to the systems, the customer files, the reporting portal credentials? Have they read the current business-wide risk assessment? A deputy who has never exercised the role is a name in a document rather than a control.

“We would use the twelve-week rule.” Also reasonable, and widely misunderstood. The arrangement in SUP 10C that allows a firm to cover an absence without a fresh approval is narrow: it is for an absence that was reasonably unforeseen and is expected to be temporary. It is not a mechanism for covering a resignation the firm knew about, and it does not create capability out of nothing — somebody still has to do the work. We set out the mechanics and the limits in detail in our page on temporary SMF16 and SMF17 cover and the twelve-week rule.

The deputy MLRO as a resourcing decision

The structure that works at most small and mid-sized firms is a properly constituted deputy: a second person who is trained, has access, has the context, and has actually handled live internal reports alongside the MLRO rather than only in a handover briefing.

Firms object that they do not have a second financial crime person to spare. That is usually true, and it is why the deputy function is increasingly bought in rather than built. A retained deputy arrangement with an experienced practitioner gives the firm continuity without a second full-time headcount, and has a useful side effect: it introduces a second pair of eyes to a function that otherwise runs entirely on one person’s judgement, which is a governance improvement in its own right. It is also, in our experience, a highly effective way to find a permanent MLRO when the incumbent eventually moves on, because the deputy already knows the book.

Where a firm does appoint a deputy internally, three things are worth doing properly. Give them live exposure rather than training slides — have them work the reports jointly for a quarter. Give them the access before they need it, including to any reporting portal, because credential problems are a surprisingly common cause of delay. And put their involvement in the annual MLRO report so that the arrangement is visible to the board rather than filed in a policy nobody reads.

The unplanned departure, which is the real stress test

Holidays are a scheduling problem. A resignation is a different category of event, and the one where firms get into difficulty.

The sequence that causes trouble is this: the MLRO resigns, the firm has three months of notice, and it uses two and a half of them to decide what kind of replacement it wants. Recruitment starts late. Because approval for a replacement SMF17 has to be obtained before they can hold the function, and that process takes the time it takes, the firm arrives at the last week of the notice period with no approved successor and reaches for an emergency arrangement. Our page on how long FCA senior manager approval takes is a useful reality check on the timetable at the point the notice is given, not a month later.

Two things make this far less painful. The first is starting the search at the beginning of the notice period rather than the end, which sounds obvious and is routinely not done. The second is separating the question of who will hold the function in the short term from the question of who should hold it permanently. Those are different decisions with different candidate pools, and conflating them is what produces a rushed permanent hire — the most expensive outcome available, because the firm then repeats the exercise in eighteen months. There is a well-developed market in interim and fractional cover specifically for this, and using it buys back the time to make the permanent decision properly.

What good cover looks like on paper

A firm that has this right can answer six questions without going to look anything up.

Who makes a suspicion decision if the MLRO cannot be reached within two hours? What access does that person have, and when was it last tested? What is the longest period the firm could run without an approved SMF17 before it had a regulatory problem? What is the plan if the MLRO resigns tomorrow with immediate effect? Who tells the FCA, and when? Where is this written down, and has the board seen it?

Most firms can answer two or three. The exercise of answering all six usually surfaces the gap faster than any policy review, and it tends to convert what felt like an abstract risk into a specific, small piece of work.

Sizing the role honestly while you are at it

Firms that look at cover almost always end up looking at capacity, because the two questions are the same question asked from different directions. If the function cannot survive a fortnight’s absence, it is worth asking whether it is adequately resourced when the MLRO is present.

The honest test is volume-based rather than headcount-based: how many internal reports a month, how many alerts, how many enhanced due diligence reviews outstanding, how long the backlog is, and whether the business-wide risk assessment has been refreshed on time. Where the answers show a function running at capacity, cover arrangements are not the fix — additional resource is, whether that is a deputy, an analyst, or a change in the shape of the SMF17 role itself. Our SMF17 MLRO function guide is a useful reference for what the function is expected to cover.

A note for firms about to grow

The firms most exposed to this are the ones whose volumes have grown faster than their financial crime resourcing, which in practice means firms that have recently added a product, a geography, a payment rail or a distribution channel. Growth of that kind increases internal report volumes and changes the risk profile without anybody deciding to change the compliance arrangements, and the single-point-of-failure problem gets sharper as it goes. If a firm has materially changed what it does in the last year and the financial crime function has the same shape it had before, the cover question is worth bringing forward.

We place MLROs, deputy MLROs and interim cover across payments, lending, wealth, insurance and cryptoasset firms, and a reasonable proportion of what we are asked for is precisely this: a second approved pair of hands so the firm is not one person’s diary away from a problem. It is a short conversation and usually a smaller piece of work than firms expect.

Start a search

Tell us about your finance hire

Share a few details about your business and the role. A member of our team will review your brief and come back to you to talk it through.

• ✓Reply within one working day, from a consultant who places finance leaders every day
• ✓Confidential from the first conversation, with no obligation to go ahead
• ✓Shortlists typically within three to seven days, faster for urgent interim cover

020 3287 9501recruitment@fdcapital.co.uk

Full Name *

Email *

Numbers *

Single Line Text *

Paragraph Text *

dropdown *I'm hiringI'm open to work opportunities

Please add me to your mailing list to receive news and updates from the team at FD CapitalYesNo

Start My Recruitment

Your details are used only to respond to your enquiry.