SMF17 MLRO: Career Path and What Firms Look For

The Money Laundering Reporting Officer is one of the few roles where an individual is personally named as accountable for a whole regulatory framework. At FCA-regulated firms holding investment permissions the role is SMF17 — a senior management function requiring pre-approval. This article sets out the route into it, and what firms and the regulator look for.

For the function itself in detail, our SMF17 MLRO function guide covers scope and responsibilities in full. This piece is about getting there.

What the role carries

The MLRO is the individual personally responsible for the firm’s anti-money-laundering framework and the point of contact with the National Crime Agency. The appointment sits under two frameworks at once: the Money Laundering Regulations 2017, which require the appointment of a nominated officer, and SM&CR, which brings FCA pre-approval, a Statement of Responsibilities, the Duty of Responsibility and Conduct Rules accountability.

In practice the MLRO owns the firm’s financial crime systems and controls, customer due diligence framework, transaction monitoring, sanctions screening and the suspicious activity reporting process — and is the person who decides whether a report goes to the NCA.

The experience that builds toward it

Credible SMF17 candidates typically bring depth across the financial crime disciplines rather than adjacent compliance breadth. The areas that matter:

• Customer due diligence and enhanced due diligence — including the risk-based approach and how it is evidenced.
• Transaction monitoring — system design, tuning, alert handling and the perennial false-positive problem.
• Sanctions screening — particularly in payments, where speed and accuracy pull against each other.
• Suspicious activity reporting — report quality, the consent regime and dealings with the NCA.
• Firm-wide risk assessment — building the assessment required under the Money Laundering Regulations, not just maintaining it.

Depth matters more here than in some other SMF roles, because the MLRO is expected to exercise personal judgement on individual reports and on the framework as a whole.

Where SMF17 sits against other functions

Candidates should be able to articulate the boundaries. Where the firm has SMF4, financial crime risk fits within the broader enterprise risk framework that SMF4 owns, while SMF17 retains operational AML accountability. Where SMF24 exists, transaction monitoring technology and the operational delivery of SAR investigation may sit within their accountability, though the AML framework itself rests with SMF17. In some structures, specific financial crime areas such as authorised push payment fraud are allocated to an SMF18 holder instead.

SMF17 is also very often held alongside SMF16, the Compliance Oversight function, particularly at smaller firms — a combination that broadens the role considerably and is worth understanding if you are aiming at it.

What the FCA looks for

The regulator has published its expectations for heads of compliance and MLROs, and they are worth reading before applying. The FCA expects firms to appoint individuals suitably competent and capable of performing the role effectively, with skills and knowledge from training and experience proportionate to the size of the firm and its risk of harm. Most successful applicants have completed relevant training before the application is made — so professional qualifications in financial crime are worth having, not merely nice to have.

The judgement the role actually requires

What distinguishes a strong MLRO from a competent financial crime manager is judgement under uncertainty. The role requires deciding, on incomplete information, whether a pattern of activity warrants a report; whether a customer relationship should be exited; whether a control failure is an isolated lapse or evidence of a systemic weakness. These decisions carry consequences in both directions — over-reporting swamps the system and the firm, under-reporting exposes the firm and the individual.

Firms interviewing for SMF17 probe this directly. Expect to be asked how you decided a borderline SAR, how you handled pressure from the business to retain a profitable but higher-risk relationship, and how you would escalate a concern the executive did not want to hear. Answers grounded in real decisions carry far more weight than descriptions of process.

The firm-wide risk assessment as a credential

The firm-wide risk assessment required under the Money Laundering Regulations is the document that anchors the whole framework, and it is a useful proxy for capability. A candidate who has authored one — genuinely assessing the firm’s exposure across customers, products, channels and geographies, and then driving controls from it — has demonstrated the systemic thinking the role needs. A candidate who has only maintained an inherited assessment has not.

Sector differences worth understanding

The MLRO role varies considerably by sector, and candidates should choose deliberately. Banking brings scale and mature systems but slower progression. Payments brings volume, speed and sanctions complexity, and is where much current hiring sits. Cryptoasset firms bring a distinct customer due diligence challenge and a supervisory environment that is still developing. Investment firms bring lower transaction volumes but complex ownership and source-of-wealth questions.

Each builds a different profile, and a first SMF17 in one sector does not automatically transfer to another. Candidates aiming at a particular destination should build there.

Positioning yourself for the step

The practical moves: build genuine breadth across the financial crime lifecycle rather than specialising narrowly in one control; get exposure to the decision-making end, particularly SAR decisions and escalation; develop the ability to engage with the regulator and with law enforcement; and take the relevant qualifications, because the FCA effectively expects them.

Sector choice matters too. Payments and cryptoasset firms carry higher financial crime risk profiles and correspondingly demanding MLRO roles, but they are also where much of the hiring is — and where a first SMF17 is often more attainable than at a large bank.

A note on timelines

SMF17 mandates typically run 18–30 weeks end to end including notice and FCA approval, and payments-sector mandates often run longer. Both candidates and firms should plan accordingly.

FD Capital recruits MLROs and financial crime leaders into FCA-regulated firms across banking, payments, investment and cryptoasset businesses.

The combined SMF16 and SMF17 role

At smaller firms the MLRO function is frequently held alongside SMF16, the Compliance Oversight function, and candidates should understand what that combination involves before pursuing it. It means owning both the firm’s general regulatory compliance framework and its financial crime framework — a wide brief that suits generalists with genuine financial crime depth, and stretches specialists who have only ever worked in AML.

The combination is common enough that it is often the fastest route to a first senior management function. It also carries correspondingly wide personal accountability, which is worth weighing honestly.

Preparing for the approval process

Because SMF17 requires FCA pre-approval, candidates should prepare for scrutiny in advance rather than at the point of application. That means having a clear account of your relevant training and qualifications, being able to evidence competence with specific examples rather than assertions, and being open about anything in your record that a regulator would want explained. The firm has to satisfy itself of your fitness and propriety and evidence that assessment; candidates who make that straightforward move through the process faster.

The relationship with the business

An MLRO who is seen purely as an obstacle will not be effective, and one who is seen as accommodating will not be safe. The role requires building enough credibility with the commercial side that the business brings problems early rather than working around the function — while retaining the willingness to refuse when refusal is right.

Candidates who can describe how they built that relationship, and how they handled the moment it was tested, demonstrate something firms genuinely struggle to assess from a CV. It is often the difference between two technically similar candidates.

Resourcing and the honest conversation

A recurring difficulty in the role is resourcing: the MLRO is accountable for a framework whose effectiveness depends on people and systems they may not control the budget for. Before accepting an SMF17 appointment, candidates should ask hard questions about the resourcing of the financial crime function, the state of the transaction monitoring system, the backlog of alerts, and whether the firm has any open regulatory findings in this area.

Accepting personal accountability for a framework that is under-resourced is a genuine risk. The strongest candidates negotiate that upfront rather than discovering it afterwards.

This article is general information about UK financial services regulation and recruitment practice. It is not legal or regulatory advice. Firms and individuals should take their own professional advice on their specific circumstances.

Adrian Lawrence

Adrian Lawrence FCA is the founder of FD Capital and a Fellow of the Institute of Chartered Accountants in England and Wales (ICAEW). He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience as a Chartered Accountant and finance leader working with private, PE-backed and owner-managed businesses across the UK. He founded FD Capital to connect growing businesses with the Finance Directors and CFOs they need to scale — and personally interviews candidates for senior finance appointments.