AML reviews and MLRO support for FCA‑regulated firms
Your MLRO reports to the board at least once a year on whether your anti-money laundering controls work. We test that answer independently, strengthen the MLRO role, and step in when the role is vacant.
What does an AML review actually test?
Whether your controls work in practice, not whether your policies exist.
A document review tells you what your firm says it does. An AML review tests what it actually does. We start with your business-wide risk assessment, follow that risk through your policies and procedures, and test a sample of customer files and alerts to see whether the controls were applied, recorded and escalated as they should have been.
The review is built to meet the requirement in regulation 21 of the Money Laundering Regulations 2017 for an independent audit function, where that is appropriate to the size and nature of your business. It examines the adequacy and effectiveness of your policies, controls and procedures, makes recommendations, and gives you the evidence to monitor whether they are implemented.
- Risk assessmentYour business-wide money laundering, terrorist financing and proliferation financing risk assessments, and whether they drive your controls.
- Policies and proceduresWhether they describe your real business, customers, products and channels, and reflect the 2026 amendments to the regulations.
- Customer due diligenceFile testing of CDD, enhanced due diligence, PEPs, source of funds and source of wealth, and ongoing monitoring.
- Monitoring and reportingTransaction monitoring, alert handling, internal suspicious activity reports and the MLRO's decisions on external SARs.
- SanctionsScreening coverage, list updates, match handling and escalation.
- People and governanceStaff screening and training, management information, the MLRO annual report and how the board acts on it.
What you receive: a RAG-rated findings report with the evidence for each finding, a prioritised remediation plan with owners and dates, and a board summary you can table as it stands.
What does the FCA expect of your MLRO?
Four things, and every one of them must be real rather than nominal.
Under SYSC 6.3.9R, a firm must appoint an individual as MLRO and give that person the authority, independence, resources and information to oversee its anti-money laundering systems and controls. Use the four tests below on your own firm.
Can your MLRO stop a customer being onboarded, or exit one, without being overruled on commercial grounds?
Is the MLRO free from targets or duties that conflict with an objective decision on a suspicion?
Does the MLRO have the time, people and systems to review alerts and files, rather than just sign them off?
Does the MLRO see the management information, customer data and complaints that reveal risk, without having to ask?
For most firms under SMCR, the MLRO role is a Senior Management Function (SMF17), which needs FCA approval before the person takes it on. Under the Money Laundering Regulations, the same person is usually the nominated officer who receives internal reports and decides whether to make a SAR, and the firm must tell the FCA who they are within 14 days of appointment. See FCG 3 and MLR 2017, regulation 21.
Which kind of MLRO support do you need?
That depends on who holds the role today, and for how long.
We provide three levels of support. The table shows who holds the role in each case, when each option fits, and what we do.
| Service | Who holds the MLRO role | When it fits | What we do |
|---|---|---|---|
| MLRO support | Your own MLRO. No change to who is approved. | You have an MLRO who needs expert back-up, a sounding board or more capacity. | Case and SAR decision support, EDD reviews, monitoring programmes, the MLRO annual report, training and regulatory updates. |
| Interim MLRO cover | One of our senior associate consultants, for a defined period. | Your MLRO has left unexpectedly, is on extended leave, or you are recruiting. | Keeps internal reporting, SAR decisions and board reporting running, and hands over a documented position to the permanent MLRO. |
| Appointed MLRO | A named senior associate consultant, appointed by your firm and, where SMCR applies, approved by the FCA as SMF17. | A smaller firm where no internal candidate has the experience or the independence the role needs. | Performs the MLRO function on an ongoing basis, with agreed time commitment, access rights and reporting lines set out in writing. |
Can you outsource your MLRO?
You can bring in an external person to hold the role. You cannot hand over the responsibility.
Your firm remains responsible for its anti-money laundering systems and controls whoever performs the MLRO role. SYSC 8 is clear that outsourcing a function does not transfer the firm's regulatory obligations. A director or senior manager must still hold overall responsibility for the firm's anti-money laundering systems and controls under SYSC 6.3.8R.
That is why an appointed MLRO from us is always a named individual, approved in their own right where SMCR applies, working to a written agreement that sets out their time commitment, their access to your systems and people, and their direct line to your board. The role is only as strong as the access it is given.
What happens when your MLRO leaves without warning?
You have up to 12 weeks to put cover in place without prior FCA approval, and longer if you apply in time.
Under the FCA's 12-week rule in SUP 10C.3A, an SMCR firm can appoint someone to cover a Senior Manager who is temporarily absent or has left unexpectedly, without first getting approval for that person. If the firm makes a valid and complete application for a permanent replacement within that period, the cover can continue until the application is decided.
The rule gives you time. It does not reduce what the role requires. The person providing cover must have the skills and knowledge to carry the responsibilities, and the firm should keep the arrangement as short as reasonably possible. Our interim cover is built on that basis: a defined period, a documented handover in and out, and support with the approval application for your permanent MLRO.
How do we work with you?
Engage
A free discovery call about your business, your current MLRO arrangements and what prompted the enquiry. We then confirm the scope, the team and a fixed fee in writing before any work starts.
Execute
We review documents, interview your MLRO and key staff, and test files and alerts. For MLRO roles, we agree the time commitment, access rights and reporting lines, then start the work.
Embed
We report our findings in plain language, agree remediation owners and dates with you, and follow up to confirm that changes are in place and working. Ongoing support is available through a monthly retainer.
Where do AML frameworks fall short?
In the firms we have reviewed, the gaps are rarely in the policy documents themselves. They sit between the documents and the day-to-day work:
- Business-wide risk assessments that score risk but do not change any control, customer journey or monitoring rule.
- Customer due diligence that is collected but not assessed, so a documented source of funds does not explain the activity on the account.
- Enhanced due diligence triggers applied inconsistently between staff, products or introducers.
- Monitoring alerts closed without a recorded rationale, leaving no evidence of the judgement made.
- MLRO annual reports that describe activity but do not say whether the controls are effective.
- Training that covers the law but not the red flags that are specific to the firm's own customers and products.
Our AML reviews and MLRO support are led by Lee Werrell, Chartered FCSI, FF.ISP, with more than 25 years in FCA regulation, and delivered by senior associate consultants with specialist anti-money laundering and financial crime experience.
What does it cost?
Every engagement has a fixed fee or a fixed monthly price, agreed in writing before work starts.
| Service | Price | How it is priced |
|---|---|---|
| Independent AML review | From £950 per consultant day | Fixed fee, set once we understand your size, customer base, products and the number of files to test. |
| MLRO support retainer | From £250 a month | Three monthly tiers, matched to how much support your MLRO needs. |
| Interim MLRO cover | From £950 a day | Agreed number of days a week for a defined period, reviewed at each month end. |
| Appointed MLRO | Quoted individually | Monthly fee based on your firm's risk profile, volumes and the time commitment the role needs. |
All prices exclude VAT.
Common questions
Is Compliance Consultant authorised by the FCA?
No. We are an independent consultancy that advises FCA-regulated firms. Where one of our consultants is appointed as your MLRO, your firm makes the appointment and, where SMCR applies, the FCA approves that individual. Your firm keeps responsibility for its own systems and controls.
How often should we have an AML review?
The Money Laundering Regulations do not set a fixed frequency. The review should be proportionate to the size and nature of your business. We recommend setting a frequency in your own policy based on your risk assessment, and bringing a review forward after any material change: a new product, a new customer segment, a change of MLRO, or a change in the law.
Can the same consultant be our MLRO and review our AML framework?
No. The review has to be independent of the function it examines. Where one of our consultants holds or covers your MLRO role, we will tell you at the outset that we cannot also provide your independent AML review, and we can recommend how to arrange it.
Who is responsible if an external MLRO misses something?
Your firm remains responsible for its anti-money laundering systems and controls. The MLRO is personally accountable for performing their role, and in an SMCR firm that includes their accountability as an approved Senior Manager. A written agreement that sets out the MLRO's time, access and reporting lines protects both sides.
We are a payment, e-money or cryptoasset firm outside SMCR. Does this apply to us?
Yes. SMCR does not apply to you, but the Money Laundering Regulations do. Where appropriate to the size and nature of your business, you need a board-level officer responsible for compliance with the regulations and a nominated officer, and you must tell the FCA who they are within 14 days of appointment.
Did the 2026 amendments change what we need to do?
Yes, for most firms. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 refine customer due diligence and enhanced due diligence requirements and convert thresholds from euros to sterling. Most of the changes came into force on 30 June 2026. Some cryptoasset provisions follow in 2027. Your risk assessment, policies and procedures should be checked against them.
Can anyone guarantee a clean outcome if the FCA looks at our AML controls?
No. No adviser can guarantee a regulatory outcome. What we can give you is an independent, evidenced view of where you stand, and a clear plan to close the gaps before anyone else finds them.
How confident is your board in its AML controls?
Tell us about your firm and your current MLRO arrangements. We will tell you what we would test first and which kind of support fits.
Making Compliance Work
Compliance Consultant | https://complianceconsultant.org | UK 0800 689 0190 | Int'l 020 8243 8620 | Discovery call: https://bit.ly/CCDiscovr
LinkedIn | Facebook | Twitter | Instagram | Pinterest
Compliance Consultant and Compliance Doctor are trading styles of UK Compliance Consultant Limited, Companies House number 14805896.
