SMF17 Money Laundering Reporting Officer: MLRO Duties, Approval and CP26/37

SMF17, the Money Laundering Reporting function, is the Senior Management Function held by a firm's money laundering reporting officer (MLRO): the person who oversees the firm's compliance with the FCA's anti-money laundering systems and controls rules. Almost every firm in the Senior Managers and Certification Regime (SM&CR) that is subject to those rules must have one approved by the FCA before they start. It is an approved function, and the FCA's Phase 2 consultation, CP26/37, does not propose to make it notified.

What SMF17 covers

SUP 10C.6.2R defines SMF17 in one line: the function of acting in the capacity of the money laundering reporting officer of a firm. The duty to have one comes from SYSC 6.3.9R. A firm, except a sole trader with no employees, must appoint an individual as MLRO with responsibility for oversight of its compliance with the FCA's rules on systems and controls against money laundering, and must give that person enough authority, independence, resources and information to do the job. SYSC 6.3.10G describes the MLRO as the focal point for all anti-money laundering activity in the firm and says the FCA expects the MLRO to be based in the UK.

Typical titles are MLRO, Head of Financial Crime and, in smaller firms, Compliance Officer and MLRO. Like SMF16, SMF17 is often held by someone who is not on the board.

Example: an FCA-authorised consumer credit lender with 25 staff appoints its Head of Compliance as SMF17. He receives staff reports of suspicion, decides which to report to the National Crime Agency (NCA), runs the firm-wide financial crime risk assessment and writes the annual MLRO report to the board.

Which firms need an SMF17

The tiers come from SUP 10C Annex 1 and SYSC 23 Annex 1. The FCA's Senior Managers Regime page lists SMF17 among the functions the FCA approves alone at dual-regulated firms. Our Senior Management Functions guide maps every function by tier.

Payment institutions and EMIs. The FCA confirms that a firm registered or authorised only for payment services or e-money does not fall under the SM&CR. These firms still need a nominated officer under regulation 21(3) of the Money Laundering Regulations 2017 (MLRs). Regulation 21(7) adds that an EMI or payment service provider must appoint an individual to monitor and manage its compliance with its anti-money laundering policies and report to senior management at least annually. That person needs no SMF17 approval, but the FCA assesses the firm's management at authorisation. Our article on SM&CR for payment institutions and EMIs explains the difference. If the same group holds a FSMA permission, such as consumer credit, the FSMA firm's MLRO needs SMF17.

Cryptoasset firms. Authorised cryptoasset firms join the SM&CR when the UK regime starts on 25 October 2027. In PS26/13 the FCA said it particularly considers physical location for SMF16 and SMF17 applications and expects both holders to work from the firm's UK principal place of business.

MLRO, nominated officer and SMF17: three different things

These terms are often used as if they mean the same thing. They come from different laws.

The Financial Crime Guide notes that the MLRO is usually also the nominated officer. Most firms give all of these roles to one person, but they do not have to. Where they are split, write down who does what.

What the SMF17 holder is personally accountable for

Statement of Responsibilities. This is the document the FCA holds that lists what the holder answers for. For SMF17 it should cover oversight of the anti-money laundering framework, the internal reporting and NCA reporting process, the annual MLRO report and, if allocated, financial crime policy.

The relationship with prescribed responsibility D. SYSC 24 prescribes responsibility (d): responsibility for the firm's policies and procedures for countering the risk that the firm might be used to further financial crime. It includes the SYSC 6.3.8R duty to give a director or senior manager overall responsibility for anti-money laundering systems and controls. The firm may give responsibility (d) to the MLRO but does not have to. If it goes to someone else, the explanation of responsibility (d) in SYSC 24 says it then includes supervision of the MLRO. The FCA's guide adds that where the MLRO does not cover all financial crime or reports to someone more senior on it, responsibility (d) should go to that more senior person. Responsibility D survives CP26/37.

Conduct Rules. The six Individual Conduct Rules and the four Senior Manager Conduct Rules in COCON apply. SC1 and SC2 require reasonable steps so that the area is controlled effectively and complies with the rules. SC3 covers delegation to deputies and analysts. SC4 requires the holder to tell the FCA what it would reasonably expect to know, such as a serious control failure.

Duty of Responsibility. Under section 66A of FSMA, if the firm breaches a requirement in the MLRO's area, the FCA can act against the MLRO personally if they did not take the steps a person in their position could reasonably be expected to take. The criminal offences in the Proceeds of Crime Act apply separately.

The core duties in practice

Suspicious activity reports. Under section 330 of the Proceeds of Crime Act, staff in the regulated sector must report knowledge or suspicion of money laundering to the nominated officer. MLR 21(5) requires the nominated officer to consider each report against the information available to the firm. Where suspicion remains, section 331 requires a report to the NCA as soon as practicable. Where the firm wants to go ahead with a transaction that may involve criminal property, it can ask the NCA for consent, commonly called a defence against money laundering. Under section 335 consent is treated as given if the NCA does not refuse within seven working days, and a refusal starts a 31-day moratorium. The tipping-off offence in section 333A means staff must not alert the customer.

The annual MLRO report. SYSC 6.3.7G expects a report at least annually by the MLRO to the governing body and senior management on the operation and effectiveness of the anti-money laundering systems and controls. A strong report covers the firm-wide risk assessment, customer risk profile, internal and external reports, monitoring results, training, open issues and resourcing, and asks the board to decide on specific actions.

The wider framework. The MLRs require a written firm-wide risk assessment (regulation 18), policies, controls and procedures approved by senior management (regulation 19), employee screening and an independent audit function where appropriate (regulation 21) and regular training (regulation 24). The FCA's rules require regular assessment of the adequacy of the systems and controls (SYSC 6.3.3R).

Reasonable steps in practice

Our guides to designing an AML/CFT framework, transaction monitoring effectiveness and evidencing reasonable steps go further.

The first 90 days in the role

• Read the last MLRO report, recent internal audit or independent AML reviews, and any FCA correspondence on financial crime.
• Review the internal report log: open cases, decision quality and time from report to NCA submission.
• Check the firm-wide risk assessment is current and matches the firm's products, customers and countries.
• Confirm who holds responsibility (d), who is the nominated officer and who is the MLR compliance officer, and record it.
• Check transaction monitoring backlogs and sanctions screening coverage.
• Confirm cover arrangements for your absence, including deputies.
• Agree your reporting line, budget and access to the board in writing.
• Plan the next annual MLRO report from day one, with the data you will need.

Applying for approval

The firm applies on Form A through Connect. The FCA's application page lists what the form covers: role description, ten years of employment history, the Statement of Responsibilities, a competency assessment, a capacity and conflicts assessment, fitness and propriety questions, directorships, regulatory references and criminal records checks. A standalone long Form A carries a fee.

• Fitness and propriety. The firm must be satisfied the candidate is fit and proper before applying, under section 60A of FSMA. See our fitness and propriety guide.
• Regulatory references and criminal records. References go back six years and must be given within four weeks of a request. Criminal records checks are valid for six months and are not needed for internal or intragroup moves.
• Competence. Show anti-money laundering experience and a learning plan for any gaps.
• Interview. The FCA may interview where it has concerns that it cannot resolve on paper.
• Timing. The FCA must decide within three months of a complete application and has committed to a two-month target.
• Starting early. Performing SMF17 without approval breaches section 59 of FSMA. Temporary cover is allowed for up to 12 weeks for an unexpected vacancy, and if an application is submitted in that time the cover can continue until the FCA decides.

What CP26/37 would change for SMF17

CP26/37 leaves SMF17 as an FCA-approved role at every firm type. It is not on the notified list, and the FCA says it is not changing SMF roles at Core and Limited Scope firms. What would change around it:

• Responsibility D stays. Financial crime is one of only three prescribed responsibilities kept for all Core and Enhanced firms, with A and Z, plus J-3 for Enhanced firms.
• Statements of Responsibilities would be kept current internally and provided on request rather than refiled. None would be needed where one person holds every SMF, such as SMF3, SMF16 and SMF17 together.
• Temporary cover would extend from 12 to 18 weeks.
• Certification would end, so analysts and deputies would be assessed under the competent employee rules.
• Conduct Rules stay the same.

Consultation closes on 22 January 2027, with final rules expected in the first half of 2027. See our SM&CR Phase 2 guide.

Holding SMF17 with other functions

• SMF17 with SMF16. Common and accepted. One Form A, one Statement of Responsibilities. See our SMF16 Compliance Oversight guide.
• SMF17 with SMF3. The FCA's guide uses an executive director who is also MLRO as its own example of holding two SMFs.
• Group MLRO. Industry guidance accepts a group MLRO serving several group firms, with deputies where needed. Each firm still needs its own SMF17 approval and should show the time it receives.
• SMF17 with business roles. Avoid combining the MLRO role with sales or customer onboarding targets. The MLRO must be free to report to the NCA on their own authority.

How we support SMF17 holders

We prepare MLROs for the SMF17 role and support them once appointed. Our financial crime service covers the framework itself; our SM&CR work covers the individual.

• One-to-one Senior Manager training built on the person's own Statement of Responsibilities
• Drafting and review of the Statement of Responsibilities
• The Form A application and the fitness and propriety file
• FCA interview preparation
• Handover arrangements between outgoing and incoming MLROs

Our SM&CR support team also advises on how SMF17 fits with the SMF1 Chief Executive and other senior roles.