One resignation, two functions, no plan
Ask the founder of a small regulated business what would happen if their best salesperson left tomorrow, and you will usually get a decent answer. Ask what would happen if their Head of Compliance left tomorrow, and the answer is often a long pause.
This is a strange blind spot, because in a financial services business of twenty or thirty people, the compliance function is frequently the single most concentrated point of failure in the entire organisation. Not the most glamorous risk, not the one that gets board airtime, but the one most likely to stop the business trading in its current form.
How the concentration happens
Nobody designs it this way. It accumulates.
A firm gets authorised. It needs someone accountable for compliance, and someone to act as the money laundering reporting officer. At that size, hiring two senior people for two part-time problems is not realistic, so one experienced person takes both. That is entirely normal, the regulator permits it, and for a long time it works perfectly well.
What also accumulates, invisibly, is everything that person knows and nobody else does. The rationale behind the firm’s risk appetite. Which clients were onboarded with conditions attached. What the supervisor said on the last call. Where the gaps are in the monitoring programme and why they have been tolerated. Which of the firm’s policies describe what actually happens and which describe what someone hoped would happen.
Very little of that is written down in a form anyone else could pick up. It usually lives in one head.
What happens the morning after
The resignation itself is the easy part. What follows is a set of obligations that do not pause while you recover from the shock.
The regulator has to be told the individual has ceased to perform the function, on a deadline measured in business days rather than weeks. Any formal responsibilities they held have to be reallocated to someone else, and the documentation that records who is accountable for what has to be updated to match. Larger firms have a responsibilities map to revise as well.
And if that person was also the money laundering reporting officer, there is a statutory function with no gap in it. The law requires a nominated officer to receive internal reports of suspicious activity and decide whether to escalate them to the National Crime Agency. If a member of staff spots something the day after the MLRO clears their desk, somebody has to be in a position to receive that report and act on it. The obligation does not wait for recruitment.
This is the part that catches firms out. They are braced for a hiring problem and discover they have an operational one.
The regulator’s safety net, and what it is not
There is a mechanism for exactly this situation. The FCA’s 12-week rule allows a firm to fill a senior management role on a temporary basis with someone the regulator has not yet approved — and it was reformed in April 2026 to work rather better than it used to, giving firms a realistic window to recruit properly instead of in a panic.
It is a good safety net. It is not a succession plan, and the distinction matters more than most boards realise.
The rule only covers absences that are temporary or reasonably unforeseen. A sudden resignation qualifies. A long-signalled retirement does not, and neither does a vacancy the firm has simply chosen not to fill. A firm that reaches for the rule repeatedly is telling its supervisor something it probably did not intend to.
There is a second point that gets missed. Whoever steps into the seat is personally accountable under the conduct rules for the period they are covering. Asking a willing colleague to “hold the fort” is not a neutral favour. It places real regulatory obligations on them, and they are entitled to understand that before they agree.
FD Capital has published a detailed walkthrough of what to do when a Head of Compliance or MLRO resigns, covering the notification deadlines and the practical cover options, which is worth reading before you need it rather than after.
What a plan actually looks like
The useful version of this is unglamorous and takes about a day a year.
Name the understudy now. Decide, in advance, who covers if your compliance lead goes under a bus. Write it down. Tell them. If the honest answer is “nobody”, that is the finding, and it is better to discover it on a quiet Tuesday than in the week of a resignation.
Get the knowledge out of one head. Not a full procedures rewrite — a short, current document covering the open items, the supervisory relationship, the known gaps and the reasoning behind the judgement calls. The test is whether a competent stranger could pick it up and not be dangerous.
Insist on a documented handover. Whenever the departure is a resignation with a notice period, the handover is the single highest-value thing that notice period produces. Treat it as a deliverable with a deadline, not something that will happen naturally in the final fortnight.
Know what the market costs before you need it. Firms that have never priced interim or fractional compliance cover tend to make the decision badly under pressure. Experienced people who have held these roles before can often cover one to three days a week, which for a smaller firm is frequently not just the stopgap but the better permanent answer.
Separate the roles as you grow. Combining compliance oversight and the MLRO function is sensible at twenty people and increasingly uncomfortable at eighty. There is no bright line, but if the thought of losing both functions in a single afternoon makes you uneasy, that is the signal.
The wider point
Key person risk is a familiar concept in every other part of a business. Finance teams model it. Insurers will sell you a policy against it. Investors ask about it in diligence.
In compliance it tends to go unexamined, partly because the function is quiet when it is working, and partly because the person doing it is usually too busy to raise the question themselves. The irony is that compliance exists precisely to identify risks the business would otherwise carry without noticing — and it is often the one risk nobody has turned the lens on.
The firms that handle a compliance resignation well are almost never the ones that reacted brilliantly. They are the ones that spent an afternoon on it eighteen months earlier, wrote down who covers what, and then forgot about it until the day it mattered.
The FCA’s overview of the senior managers regime is on its website, and is a reasonable starting point for any board that has not looked at how accountability is allocated in their own firm recently.
Adrian Lawrence FCA is a Chartered Accountant and Fellow of the ICAEW, a former Finance Director of a listed company, and founder of FD Capital, which recruits senior finance and compliance professionals for regulated businesses across the UK.
