AML Governance for MLROs, MLCOs and Compliance Partners

Being named as a firm's Money Laundering Reporting Officer or Money Laundering Compliance Officer is not the same as being good at anti-money laundering compliance. Plenty of solicitors are handed the title, added to a policy document, and left to work out what it actually requires of them week to week. That gap between the title and the job is where firms run into trouble with the SRA, and where individual MLROs and MLCOs run into trouble personally.

This guide is about the role itself, not the mechanics underneath it. For how to build and document a compliant risk assessment, see our companion piece on firm-wide AML risk assessment for law firms, which covers Regulation 18 in depth; for fee-earner basics like client due diligence and red flags, see our AML training requirements for solicitors guide. Here, we're focused on governance: what the MLRO and MLCO roles legally are, what oversight looks like day to day, how these officers demonstrate assurance to the SRA, and the practical tensions - resourcing, independence, personal exposure - of holding either title.

Two roles, one regulation: MLRO and MLCO under Regulation 21

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017, as amended) create two distinct officer roles under Regulation 21, and it matters that they are legally separate, even though most firms fill both with the same person.

• The nominated officer (MLRO). Regulation 21 requires firms to appoint an individual to receive internal disclosures of suspected money laundering or terrorist financing and to decide whether those suspicions meet the threshold for a Suspicious Activity Report (SAR) to the National Crime Agency. This is the role most people mean when they say "MLRO". Failing to report a genuine suspicion is a criminal offence under the Proceeds of Crime Act 2002 and the Terrorism Act 2000, and that liability attaches to the individual who held the decision, not just the firm.
• The Money Laundering Compliance Officer (MLCO). Regulation 21 separately requires, where appropriate with regard to the size and nature of the business, a member of the board, or of the firm's senior management where there is no board, to be the officer responsible for the firm's compliance with the regulations. The MLCO's job is broader than SAR decisions: it is ownership of the whole AML framework - policies, controls, procedures, training, and whether the firm's practice actually matches what its documents say it does.

The SRA's own guidance for new MLCOs and MLROs notes that the large majority of firms combine both roles in one person, and for small and medium practices that is often the only realistic option. But combining the roles doesn't collapse the duties into one. An MLRO who never steps back to ask whether the firm's controls are actually working is not discharging the MLCO function, and an MLCO who never engages with how SAR decisions are actually being made is not discharging the MLRO function. Firms should be able to say, in writing, who is answerable for which duty - even where both sit with the same partner.

What oversight actually means day to day

"Oversight" is the word used constantly in AML policy documents and rarely defined in practical terms. For an MLRO or MLCO, it breaks down into a handful of concrete, recurring activities.

SAR decision-making and internal reporting lines

Every member of staff who forms a suspicion has an obligation to disclose it internally, and the firm's policy needs a clear, well-publicised route for that disclosure to reach the MLRO - not a vague instruction to "raise it with compliance". Once a disclosure lands, the MLRO assesses it against the legal threshold for suspicion, decides whether it needs to go to the NCA as a SAR, and does so without tipping off the client. We cover that decision-making process, and the tipping-off offences around it, in full in our guide to suspicious activity reports and tipping-off. From a governance perspective, the MLRO needs a defensible, documented reason for every internal report received - including the ones not escalated to a SAR, since the SRA will ask to see that reasoning too.

Escalation that actually works

Oversight also means having a route for problems that are not, individually, SAR-worthy but point to something systemic: a fee earner repeatedly missing source-of-funds checks, a practice area rubber-stamping risk assessments, a client relationship generating unusual instructions. A functioning escalation process lets staff flag these patterns to the MLCO without relying on someone informally deciding it's worth mentioning - through regular file reviews, a genuine open door for questions, and treating near-misses as information rather than embarrassments to bury.

Reporting to the board or partnership

The SRA expects, and good practice requires, the MLCO to report upward on the health of the firm's AML controls, not just downward to staff - typically at least an annual report to the board or partnership covering training completion, the volume and outcome of internal disclosures, audit findings, and any change in the firm's risk profile. The SRA's 2021 thematic review, "Money Laundering Governance: Three Pillars of Success," found that 87% of the 54 AML officers it looked at were equity partners or equivalent, which gives them direct access to the people who make resourcing and policy decisions. Where the MLRO or MLCO sits several rungs below partner level, oversight becomes slower and weaker by design, whatever the policy document says.

The independent audit function

Regulation 21 also requires firms, where appropriate to their size and nature, to arrange an independent audit of their AML policies, controls and procedures - testing whether they are adequate and actually followed, not just present on paper. Regulation 21 disapplies these requirements only for an individual who neither employs anyone nor acts in association with any other person, so in practice almost every firm needs to be able to show how it has dealt with audit. Two points matter for MLROs and MLCOs specifically:

• The SRA says the audit must be independent but does not need to be provided by someone outside the firm. Our view is that the MLRO and MLCO should not audit their own work, so a genuinely independent reviewer is safest: a separate partner with no AML responsibilities, an external consultant, or an internal audit function with clear separation from compliance.
• The audit tests the MLRO and MLCO's own work as much as anyone else's: whether SAR decisions were properly reasoned, escalations followed through, and board reporting reflected what was actually found.

There is no fixed legal frequency. The SRA's guidance says the MLCO should decide how often audits take place, so be ready to explain that choice by reference to the firm-wide risk assessment. An MLCO who can't say when the last audit took place, or what it found, will struggle to demonstrate effective oversight if the SRA asks.

Training and Regulation 24

Regulation 24 of the Money Laundering Regulations 2017 sits alongside Regulation 21 and is the training duty the MLCO is ultimately answerable for. A firm must take appropriate measures so that its relevant employees, and certain agents, are made aware of the law on money laundering, terrorist financing and proliferation financing and the related data protection requirements, and are regularly given training in how to recognise and deal with suspicious transactions and activities. The firm must also keep a written record of those measures, including the training given.

A relevant employee is one whose work is relevant to the firm's compliance with the Regulations or could help identify, mitigate, prevent or detect these risks, which in a law firm will usually include the MLRO and MLCO themselves. What counts as appropriate depends on the nature and size of the business and the risks it faces, and the firm may take account of guidance from approved bodies such as the SRA.

Demonstrating assurance to the SRA

The SRA does not expect perfection; it expects evidence that the firm knows where its risks lie and is actively managing them. For an MLRO or MLCO, being ready for an SRA visit, desk-based review or thematic review generally means being able to produce, without a scramble:

• Evidence that the SRA has approved each officer. The SRA says firms must seek its approval of anyone taking up either role, with a Disclosure and Barring Service check no more than three months old, and regulation 21(4) requires the firm to inform its supervisor within 14 days of the appointment.
• A record of internal disclosures received, decisions made on each, and the reasoning behind SARs filed and SARs not filed.
• Evidence of training delivered across the firm, tailored to role and risk exposure rather than a single generic session repeated every year.
• Minutes or reports showing the MLCO has reported to the board or partnership, and that the firm-wide risk assessment and policies have been reviewed and, where necessary, revised as a result.
• Findings from the independent audit function, and evidence that any issues it raised were actually acted on.

The common thread is that assurance is built from a paper trail generated continuously, not assembled retrospectively when a review is announced. Treat these records as ongoing evidence of a working system, not as paperwork, and you're in a far stronger position when the SRA comes calling.

What is changing in 2026

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) were made on 9 June 2026 and most of their provisions came into force on 30 June 2026, with some following later. The changes include sterling thresholds in place of euro amounts and new provisions on cryptoasset businesses. Because the 2026 changes are still being reflected in the consolidated text, check the current legislation.gov.uk versions of Regulations 21 and 24 before relying on the wording above.

Separately, in October 2025 the government confirmed that the FCA will become the single supervisor for legal, accountancy and trust and company service providers. No start date has been set, and the government says timing depends on parliamentary time and a detailed transition plan. Until firms are phased in, professional body supervisors including the SRA keep their AML supervision, so the SRA remains the body to which MLROs and MLCOs answer today.

The practical reality: resourcing, independence and personal exposure

The SRA's own research into what separates effective AML officers from struggling ones points to three consistent factors: authority, independence and resources. In practice, all three are harder to secure than the guidance documents suggest.

Resourcing. The SRA's 2021 review found that 46 of the 54 AML officers it looked at still carried a fee-earning caseload alongside their MLRO or MLCO duties, only 15 of the 54 had reduced billing targets, and only 48% had a deputy. An MLRO squeezed between chargeable hours and compliance duties will, under pressure, deprioritise the work that doesn't generate an invoice - which is precisely the work the regulations require.

Independence. An MLCO needs the standing to override a senior partner's preferred course of action on an AML matter, and that only works if it is genuinely backed by the firm's governance structure - not merely asserted in the policy manual. Where the MLRO or MLCO is junior to the partners whose client relationships they are sometimes required to question, independence exists on paper only.

Personal exposure. This is the sharpest edge of the role. The MLRO carries potential criminal liability for failing to report a genuine suspicion, and the MLCO carries accountability, in the SRA's eyes, for the adequacy of the firm's whole AML regime. Both risks sit with named individuals, not an abstract "the firm". That is why the role needs to come with real authority and real resource behind it - a title without either is exposure without protection.

None of this is a reason to avoid the role; it's a reason to insist, on appointment, that the firm's governance actually matches what Regulation 21 assumes it will look like: a genuinely senior officer, with a deputy, a reduced caseload where the firm's size warrants it, and a direct line to the partnership.

Frequently asked questions

Can the same person be both MLRO and MLCO?
Yes, and most firms combine the roles in one individual. Regulation 21 doesn't require separate people, but it does require both sets of duties to be fulfilled - SAR decision-making on one side, overall responsibility for the compliance framework on the other. Firms should record clearly which duties the combined role covers.

Does every law firm need an MLRO and MLCO?
Any SRA-regulated firm doing work within scope of the MLR 2017 needs a nominated officer, and firms of any meaningful size need a designated MLCO at board or senior management level. Regulation 21 disapplies the compliance-officer, audit and nominated-officer requirements only for an individual who neither employs anyone nor acts in association with any other person. Any other firm should expect to need both roles, scaled to its size and risk.

What happens if the MLRO decides not to file a SAR and turns out to be wrong?
Regulation 21(5) asks the nominated officer to decide, on the information available, whether a disclosure gives rise to knowledge or suspicion, or reasonable grounds for either, of money laundering or terrorist financing. The question is what the officer knew or should reasonably have suspected at the time, not whether the outcome later proves to have involved money laundering. This is why a documented decision-making process matters: an MLRO who can show how a decision was reached, and that it was reasoned rather than reflexive, is in a materially stronger position than one who cannot.

How does the MLCO role relate to the firm-wide risk assessment?
The MLCO typically owns the firm-wide risk assessment required under Regulation 18, working with the MLRO and compliance staff to keep it current. Oversight of that document - ensuring it is genuinely reviewed, not just re-dated - is one of the clearest, most checkable signs of effective MLCO governance. See our companion guide on firm-wide AML risk assessment for law firms for the detail.

Building the capability the role demands

Regulation 21 puts a specific, personal set of duties on named individuals, and neither the MLRO nor the MLCO role can be learned purely from a policy manual - it requires an understanding of the legal thresholds for suspicion, the audit and assurance expectations the SRA applies, and the governance structures that make independence real rather than nominal. If you're stepping into the role for the first time, or want to be confident your firm's governance would stand up to an SRA review, browse the Learnsignal CPD catalogue for current compliance and regulatory courses.

This article is general information only. It is not legal advice. Check the current legislation and SRA guidance, or take advice, before relying on it.