WhatsApp and Telegram +44 7563 115980
[email protected]
An experienced Money Laundering Reporting Officer (MLRO) on an outsourced or interim basis, for payment, e-money, crypto, consumer credit and investment firms supervised by the Financial Conduct Authority (FCA).
Selected engagements from more than 250 licences obtained since 2013, for payment, e-money and cryptoasset firms.
Volkswagen
Payment InstitutionObtained Nexpay’s FCA Authorised Payment Institution licence.
Electronic Money InstitutionObtained Dzing Finance’s FCA Authorised Electronic Money Institution licence.
Obtained Orbital’s FCA Authorised Payment Institution licence.
The short answer
Every firm covered by the Money Laundering Regulations 2017 (MLRs) must appoint a nominated officer to receive internal suspicion reports and decide what goes to the National Crime Agency, and must tell its supervisor within 14 days. An outsourced MLRO fills that role under a written agreement: running the firm's anti-money laundering framework, deciding on reports, training staff and reporting to the board, while legal responsibility stays with the firm.
The Money Laundering Reporting Officer (MLRO) is the individual who oversees a firm's anti-money laundering (AML) and counter terrorist financing systems and decides which internal reports of suspicion are passed to the National Crime Agency (NCA) as Suspicious Activity Reports (SARs). The FCA describes the MLRO as the focal point for all anti-money laundering activity within the firm.
An outsourced MLRO is an experienced individual from outside the firm who is appointed to that role under a written agreement, for a defined number of days and with defined access to staff, systems and data. An interim MLRO does the same for a set period, usually while a permanent hire is recruited or approved. Neither arrangement moves legal responsibility: the firm, its board and the senior manager with overall AML responsibility remain accountable to the FCA. What the firm gains is judgement and experience it could not otherwise justify on a full-time salary, and a role holder who has seen how the FCA tests AML frameworks across many firms.
Three sets of rules define the role, and an outsourced arrangement must satisfy all of those that apply to your firm.
Outsourcing works best where the firm's money laundering risk can be overseen properly without a full-time role holder. Typical cases are a firm in the authorisation process that needs a credible, named MLRO in its application; a small payment, e-money or crypto firm with a clear customer base and manageable volumes; and a firm whose MLRO has left and which needs cover while a replacement is found and approved.
It works less well where volumes, customer types or geographies create enough alerts and decisions to need someone inside the business every day, or where the board cannot give the outsourced MLRO real access to systems and staff. The FCA judges the arrangement on substance: whether the MLRO has the authority and independence SYSC 6.3.9R requires, enough time to do the work and timely access to information. We assess this honestly at the start. Where a firm needs an in-house MLRO, we say so, and we can help recruit and onboard that person and hand over the framework in good order.
The service is set out in a written scope and service level agreement approved by your board, so the FCA can see exactly who does what. A standard scope includes:
When an MLRO resigns or is absent, the firm must keep the nominated officer role filled and notify its supervisor of the new appointment within 14 days under MLRs regulation 21(4). An interim MLRO can step in quickly, review open cases and confirm that no reporting decisions are overdue.
For firms under SM&CR, SMF17 approval is personal and specific to each firm: approval at one firm does not carry to another. The firm applies on Form A through the FCA's Connect system, and the FCA must decide within three months of receiving the application. Where the departure was unforeseen, the 12-week rule allows someone to cover the role temporarily. Following the FCA's Policy Statement PS26/6, in force from 24 April 2026, firms must now submit the application within those 12 weeks, rather than obtain approval within them. Payment institutions (PIs) and e-money institutions (EMIs) are outside SM&CR, but the FCA still assesses the individuals who run their AML framework, and the 14-day notification still applies.
The core duties are the same in every firm, but the risks and the FCA's focus differ by sector, and the MLRO's work programme, testing and board reporting should reflect the risks your own customers and products create.
Read our guide to financial crime controls for payment institutions
Every engagement follows the same four stages, scaled to the size of your firm and the urgency of the issue.
Assessment: we review your business model, customer and transaction data, risk assessment, policies, monitoring set-up and recent SARs, and interview the people involved. Written findings: you receive a clear report that states what meets the MLRs and SYSC, what does not, and the order in which gaps should be closed, so your board has a record of its own oversight. Remediation: we rewrite policies and procedures, recalibrate monitoring and screening, rebuild the risk assessment and train staff, working alongside your team rather than handing over a list. Ongoing support or outsourced roles: we act as your outsourced or interim MLRO, with board reporting, case decisions and regulator liaison, or we provide periodic oversight to an in-house MLRO.
Buckingham Capital Consulting (BCC) was established in 2013 and has obtained more than 250 licences in over 60 countries for payment, e-money and crypto firms. That licensing work means we have seen, from the application stage onwards, the controls, people and documents regulators expect to find when they test a firm after authorisation.
We do not stop at the licence. BCC also arranges banking and runs compliance for regulated firms, so the advice you receive reflects how a regulated business actually operates day to day: how its bank partners review it, how its regulator supervises it and how its own board needs to evidence control. Our aim is set out in one line: we open global markets to payment, e-money and crypto businesses, with the licences to enter, the banking to operate and the compliance to scale. If you are weighing your options, use the contact form to describe your firm and the issue, and we will reply with a proposed scope.
Yes. Neither the MLRs 2017 nor the FCA's SYSC rules forbid an external MLRO, but the firm stays legally responsible. The MLRO must have enough authority, independence, time, resources and access to information, and the FCA expects the MLRO to be based in the UK. In SM&CR firms the individual also needs SMF17 approval for that specific firm.
The nominated officer is the legal term in the MLRs 2017 and the Proceeds of Crime Act 2002 for the person who receives internal suspicion reports and decides whether to report to the NCA. The MLRO is the FCA's term for the person overseeing the firm's AML systems and controls. In most firms one individual holds both roles.
Regulation 21(4) of the MLRs 2017 requires firms to inform their supervisory authority of the individual appointed as nominated officer, and as compliance officer where required, within 14 days of the appointment. In SM&CR firms the MLRO also needs prior FCA approval as SMF17, applied for on Form A through Connect.
No. Payment institutions and e-money institutions are authorised under the Payment Services Regulations 2017 and Electronic Money Regulations 2011, not SM&CR, so SMF17 does not apply. They must still appoint a nominated officer under the MLRs 2017, notify the FCA within 14 days, and run AML controls that the FCA tests in supervision.
An interim MLRO takes ownership of open internal reports and makes sure no SAR decision is overdue, reviews alert backlogs and sanctions screening, confirms that the risk assessment and policies are current, and tells the board where the main gaps are. The firm notifies the FCA of the appointment and, if SM&CR applies, submits the SMF17 application.
Often, yes. The FCA expects a credible MLRO with relevant experience to be named in the application and to be able to explain the firm's AML framework at interview. An outsourced MLRO can fill that role from the start and later hand over to an in-house hire as the firm grows.
Tell us what you need and where you operate.