Anti-money-laundering obligations have become one of the biggest drivers of senior hiring at small UK financial firms, and the reason is not that the rules changed dramatically in any single year. It is that the expectations around them did, steadily, until the job looked different.
The Role at the Centre of It
Firms within scope of the money laundering regulations must appoint a Money Laundering Reporting Officer. At FCA-regulated businesses this is a formally designated role — code SMF17 — requiring regulatory approval before the person can start.
The MLRO receives internal reports when staff notice something that does not add up, and decides whether to escalate them to the National Crime Agency. They also oversee the systems meant to catch problems in the first place: customer checks, transaction monitoring, sanctions screening.
It is worth saying plainly that this is a judgement role rather than an administrative one. The cases that reach an MLRO are usually ambiguous — not clearly innocent, not clearly criminal, and commercially inconvenient whichever way they go.
Why the Workload Grew Without the Rules Changing Much
Three forces have pushed in the same direction.
Transaction volumes. Digital payments, open banking and app-based financial services have multiplied the number of transactions a small firm processes. Monitoring systems generate alerts in proportion, and every alert eventually needs a human decision.
Evidential expectations. It is no longer sufficient to have reached a reasonable conclusion. Firms are expected to show how they reached it, which turns each judgement into a documented judgement.
Scrutiny beyond the regulator. Banks now assess their customers’ financial crime controls before providing services, and will withdraw them. For payments and cryptoasset businesses in particular, a credible MLRO has become a condition of operating at all, quite separately from the regulatory requirement.
Volume, Not Size, Is What Matters
This is the piece firms most often get wrong, and it has a straightforward explanation.
Most compliance work scales with how complicated a business is. Financial crime work scales with how many transactions flow through it. Those move independently.
A payments firm can double its volume without changing its product. Its general compliance obligations look much the same. But monitoring alerts, escalations and source-of-funds enquiries can triple, and all of it lands on one person.
The practical result is that arrangements which work perfectly well at a small firm — a part-time MLRO, or one person covering both compliance and financial crime — break faster than anyone expects during a growth phase. The warning sign is a holder spending every available hour on alerts and never reaching the rest of the job.
What Firms Are Looking For
The shortage is not of people with the title. It is of people who have done the job in a comparable risk profile.
Someone who has run financial crime at a low-risk intermediary, with settled customers and predictable payments, is not automatically equipped for a cross-border payments business or a cryptoasset firm. The role has the same name and the decisions are different ones.
Two capabilities separate strong candidates. The first is the ability to hold a defensible position on an ambiguous case and write down the reasoning — as opposed to reporting everything defensively, which buries genuine signal, or waving things through to keep business moving. Both failure modes are common and both are visible in a file review.
The second is practical command of monitoring systems. Most firms generate far more alerts than anyone can meaningfully review. Someone who can tell the difference between a system producing signal and one producing noise, and who has tuned one rather than merely operated one, is worth considerably more than their CV suggests.
The Deputy Problem
Firms concentrate on the main appointment and give little thought to who covers absence.
Then the MLRO takes two weeks’ leave and nobody is making decisions. Internal reports accumulate. If something genuinely urgent arrives, there is nobody with the authority or system access to act.
A deputy who has been briefed, has access and has actually made decisions is the difference between an orderly fortnight and a problem. A name on an organisation chart is not a deputy, and the gap only becomes visible at the worst moment.
Where the Pressure Is Sharpest
Some business models make the role substantially harder, and the hiring market reflects it.
Cryptoasset firms sit at the top. Registration requirements, specific rules on transfers, and banking partners who ask searching questions about financial crime controls combine to make the appointment both essential and difficult. The pool of people who have genuinely done this in a crypto setting remains small relative to demand.
Cross-border payments is the second cluster, where correspondent relationships and jurisdictional risk add layers that a domestic-only firm never encounters. Consumer credit has its own version, driven less by exotic risk than by volume and by close attention to how customers in difficulty are treated.
Firms leaving a network to become directly authorised form a quieter category. They take on obligations a principal firm previously carried, often without fully appreciating which ones, and financial crime responsibility is frequently the item that surprises them.
What Boards Should Be Asking
For readers who sit on the board of a regulated business rather than running its compliance function, four questions are worth putting on the agenda.
What volume of alerts are we generating, and how has that moved over the past year? How many of them get properly reviewed? What happens when our MLRO is unavailable for a fortnight? And when did we last revisit the assessment of where our financial crime risk actually sits, as opposed to where it sat when the business was smaller?
These are not technical questions and they do not require the board to understand the detail. They are capacity questions, and the answers tend to reveal whether the arrangement still fits the business.
The annual report the MLRO provides to the board is the natural place for this. Treated as a formality it tells nobody anything. Treated as the moment the board finds out what its actual position is, it is one of the more useful documents a small regulated firm produces.
Why Pay Varies So Widely
MLRO compensation has a wider range than almost any comparable role, which makes published averages close to useless for planning.
The explanation is that the title spans genuinely different jobs. A part-time holder at a small intermediary with straightforward customers is doing something materially different from a function head at a high-volume payments business with a monitoring team beneath them — even though both carry the same designation.
Firm type and transaction volume drive the number far more than years of experience. Benchmarking against the wrong kind of business is the most common reason a preferred candidate declines an offer.
The Technology Question
A reasonable objection to all of this is that software should be absorbing the growth. Monitoring tools have improved, screening is largely automated, and onboarding checks that once took days now take minutes.
All true, and it has not reduced the need for senior judgement. Systems generate alerts; they do not decide anything. A firm with excellent technology and a nominal MLRO has bought a very efficient way of producing work that nobody is qualified to action.
In practice better tooling has shifted the workload rather than shrinking it. Fewer hours are spent gathering information and more are spent on the decisions that information surfaces — which are the harder, more consequential and less delegable part of the job.
The Timing Problem
Because the appointment requires regulatory approval, the timetable is not fully within a firm’s control. An application goes in with supporting evidence, and the business waits.
This matters more for this role than most, because an MLRO vacancy is not a seat sitting empty — it is a business where nobody is deciding whether suspicious activity gets reported, and that compounds daily.
There is a limited allowance for temporary cover without prior approval in defined circumstances. It is useful, narrower than firms assume, and not a substitute for planning. The practical rule is that a search should start on the day notice is given rather than when the person leaves, because approval runs after the offer rather than alongside the notice period.
What It Means for Smaller Firms
None of this requires a large business or a large budget. It requires honesty about three things: how many transactions the business actually processes and where that is heading, whether the person holding the role has done it in a comparable setting, and whether anyone credible can cover an absence.
Firms that get those three right generally manage. Firms that treat the appointment as a title to allocate tend to find out otherwise at the point somebody external takes an interest.
FD Capital recruits MLROs and deputy MLROs for regulated firms on permanent, fractional and interim bases — see SMF17 recruitment and its guide to the MLRO function.
