SMF16 and SMF17: One Person or Two?

The question almost every smaller regulated firm faces

Every Core and Enhanced firm under the Senior Managers and Certification Regime needs someone to hold the SMF16 Compliance Oversight function and, where the Money Laundering Regulations apply, someone to hold the SMF17 Money Laundering Reporting function. At larger firms these are clearly two jobs, held by two people with separate teams. At smaller firms the answer is less obvious. Should one experienced Head of Compliance and MLRO hold both, or should the firm appoint two individuals?

It is one of the first questions we discuss with clients on almost every compliance search, and the right answer changes as the firm grows. This article sets out what the rules allow, what the FCA looks for, when combining works, when it is time to split, and the middle options that many firms use in between.

What the rules allow

Nothing in SM&CR prevents one individual from holding both SMF16 and SMF17. The FCA’s approach to the regime, set out on its SM&CR pages, is that firms allocate functions in a way that is proportionate to their size and complexity. A single application can cover more than one function, and combined SMF16/17 holders are common at small Core firms such as IFAs, boutique investment managers and smaller lenders.

What the regime does require is that the individual is fit and proper for each function they hold, has the time to discharge them, and that the firm has an adequate compliance function and adequate anti-money laundering systems and controls. The Money Laundering Regulations 2017 separately require a nominated officer to receive internal suspicious activity reports and decide whether to report to the National Crime Agency. For a fuller explanation of each role, see our guides to SMF16 and SMF17.

What the FCA will look at

When one person holds both functions, the FCA’s questions tend to fall into four areas.

Capacity. Can one person genuinely cover compliance monitoring, regulatory change, board reporting, financial promotions, Consumer Duty evidence, the firm-wide money laundering risk assessment and suspicious activity reporting? In a small advice firm the answer is often yes. In a high-volume lender or payments business it often is not.

Competence across both disciplines. Compliance oversight and financial crime are related but different specialisms. Some excellent compliance professionals have limited hands-on financial crime experience, and some strong MLROs have never run a compliance monitoring programme. A combined holder needs credible experience in both.

Independence of review. The compliance monitoring programme should test the firm’s anti-money laundering controls. If the same person designed those controls and monitors them, the firm needs another source of independent challenge, such as internal audit, an external review or a periodic assessment by a third party.

Resilience. If the combined holder is ill, on leave or resigns, the firm loses both functions at once. The FCA will want to see a deputy MLRO and a plan for cover. Our page on SMF16 and SMF17 temporary cover under the 12-week rule sets out what happens when a combined holder leaves.

When combining SMF16 and SMF17 works well

• Small, low-complexity firms. Directly authorised IFAs, small wealth managers, boutique corporate finance and investment firms, where the compliance workload is steady and financial crime exposure is moderate.
• Firms with low suspicious activity volumes. If internal reports are occasional rather than daily, one experienced person can handle them alongside compliance oversight.
• Newly authorised firms. In the early months, one senior individual can build both frameworks consistently, provided the arrangement is reviewed as volumes grow.
• Firms using a fractional model. A fractional Head of Compliance and MLRO working one or two days a week is often the most cost-effective way for a small firm to get senior capability in both areas.

Our wealth management compliance recruitment page notes that combined holders are common at Core wealth and advice firms for exactly these reasons.

When it is time to split the roles

• Financial crime exposure rises. Payments, e-money, cryptoassets, high-volume consumer lending and cross-border business all bring a level of transaction monitoring, sanctions and fraud risk that usually justifies a dedicated MLRO. Our pages on payments compliance, consumer credit compliance and SMF16 and SMF17 for cryptoasset firms cover those sectors.
• Retail conduct work grows. If the Consumer Duty, vulnerable customers, complaints and financial promotions take up most of the Head of Compliance’s week, money laundering work will suffer.
• Suspicious activity volumes increase. When internal reports and defence against money laundering requests become a daily task, the MLRO role becomes a job in its own right.
• The FCA raises concerns. Supervisory feedback, a skilled person review or a voluntary requirement focused on financial crime or compliance oversight is often the trigger to separate the roles.
• The firm approaches the Enhanced threshold. Enhanced firms usually need deeper functions in both areas.
• The current holder is overstretched. If your combined holder is consistently working beyond their capacity, or one discipline is visibly getting less attention, it is time to split.

The middle options

The choice is rarely just one person or two equal hires. Many firms use an intermediate structure.

Structure	How it works	Suits
Combined holder plus deputy MLRO	One SMF16/17 holder, with a deputy who can receive and assess internal reports in their absence	Small firms wanting resilience without a second senior hire
Combined holder plus compliance manager	The senior holder sets direction; a manager runs monitoring and day-to-day tasks	Growing firms where workload, not expertise, is the constraint
In-house SMF16, fractional SMF17	A full-time Head of Compliance, with a specialist MLRO engaged part-time	Firms whose conduct workload is heavy but financial crime exposure is moderate
In-house SMF17, fractional SMF16	A full-time MLRO, with an experienced compliance oversight holder engaged part-time	Payments and crypto-adjacent businesses where financial crime dominates
Two full-time holders	Separate Head of Compliance and MLRO, each with their own team	Larger Core firms and Enhanced firms

A deputy MLRO is worth having in almost every structure. Our AMLRO recruitment page covers that role.

What each option costs

Costs vary by sector, location and firm size, and the figures below are indicative of the London market. Our compliance salary guide and MLRO salary guide carry fuller benchmarks.

• Fractional combined SMF16/17, one day a week: roughly £33,000 to £52,000 a year at typical day rates.
• Full-time combined Head of Compliance and MLRO: base salary typically £100,000 to £160,000, before bonus and on-costs.
• Two full-time holders: often £180,000 to £300,000 or more in combined base salary, before the cost of the teams beneath them.

The real comparison is not just salary. A combined holder who is overstretched can cost far more through missed issues, supervisory intervention or a skilled person review than the price of a second hire.

A simple decision checklist

1. How many internal suspicious activity reports do we receive in a typical month, and how many defence against money laundering requests do we make?
2. How much of our compliance workload is retail conduct work: the Consumer Duty, complaints, vulnerable customers and financial promotions?
3. Does our current or proposed holder have real hands-on experience in both compliance oversight and financial crime?
4. Who independently tests our anti-money laundering controls if the MLRO also runs compliance monitoring?
5. Who would cover both functions tomorrow if our combined holder resigned?
6. Are we adding permissions, products or volumes that will change the answer within the next year?

If the honest answers point in different directions, talk to us. We recruit combined and separate holders, permanent, interim and fractional, through our compliance recruitment and MLRO recruitment practices.

Hiring a combined holder: what to look for

If you decide to combine the roles, the candidate pool narrows. Look for someone who has held both functions before, or held one and deputised for the other. Test their financial crime experience as carefully as their compliance experience: ask how they have handled a difficult internal report, how they have tuned monitoring and how they keep up with sanctions changes. Ask how they would divide their time in a busy month, and how they would arrange independent review of their own controls. Our article on SM&CR interview questions includes questions you can adapt, and our guide to FCA SMF interviews shows what the regulator may ask your candidate.

Frequently asked questions

Is it allowed for one person to be both SMF16 and SMF17?

Yes. SM&CR does not prohibit it, and it is common at smaller Core firms. The individual must be fit and proper for both functions and have the time to perform them.

Does the FCA prefer the roles to be split?

The FCA expects arrangements proportionate to the firm’s size, complexity and risk. At a small, low-risk firm a combined holder is normal; at a firm with significant financial crime exposure, the FCA is more likely to question it.

Do we need a deputy MLRO if the roles are combined?

In practice, yes. Internal reports must be capable of being received and assessed when the MLRO is unavailable, and a combined holder is a single point of failure for two functions.

Can a fractional professional hold both roles?

Yes, at the right kind of firm. See our page on fractional compliance officer recruitment for the typical time commitments.