Appointing an MLRO: What SYSC 6.3 Requires

Most anti-money laundering guidance deals with what a firm must do. SYSC 6.3 deals with who must do it, and it is more specific than firms often realise — including one prohibition on where responsibility may be placed, and a provision that effectively makes the JMLSG guidance into a test of compliance.

The systems and controls duty

Under SYSC 6.3.1R a firm must ensure its anti-money laundering policies and procedures include systems and controls enabling it to identify, assess, monitor and manage money laundering risk, and those controls must be “comprehensive and proportionate to the nature, scale and complexity of its activities”.

“Proportionate” is not a licence to do less; it is a requirement to justify what you do against your own risk. And SYSC 6.3.3R adds a standing obligation to assess regularly whether the systems and controls remain adequate — so a framework designed once and left alone fails the rule even if it was adequate when written.

Appointing the MLRO

SYSC 6.3.9R requires a firm to appoint an individual as money laundering reporting officer, responsible for overseeing compliance with the FCA’s rules on money laundering systems and controls. The only exception is a sole trader with no employees.

The rule does not stop at appointment. The firm must ensure the MLRO has sufficient authority, independence, resources and information to carry out the role. Each of those four is capable of being deficient on its own, and an MLRO without authority is the most common version — a nominal appointment with no ability to stop business.

Guidance at SYSC 6.3.10G adds two expectations: the FCA expects the MLRO to be based in the United Kingdom, and describes the role as the focal point for all anti-money laundering activity within the firm.

Reporting follows from that. Under SYSC 6.3.7G(2) the MLRO should provide an annual report to the governing body and senior management on the operation and effectiveness of the systems and controls — covered in our guide to what to include in the MLRO annual report.

The allocation rule, and the prohibition inside it

Separately from the MLRO appointment, SYSC 6.3.8R(1) requires a firm to allocate to a director or senior manager overall responsibility for establishing and maintaining effective anti-money laundering systems and controls. That person may also be the MLRO, but the two duties are distinct: one oversees compliance, the other owns the framework.

Then the provision firms miss. SYSC 6.3.8R(2) states that this overall responsibility may not be given to a person approved to perform the “other overall responsibility function”.

That is a hard constraint on governance design. A firm that has swept miscellaneous accountabilities into a single catch-all senior role cannot put anti-money laundering overall responsibility there. It has to sit with a director or senior manager holding it as a named responsibility, which is a structural question to settle before an appointment is made rather than after.

Why the JMLSG guidance matters more than its status suggests

The Joint Money Laundering Steering Group guidance is guidance, not rules. But SYSC 6.3.5G provides that when the FCA assesses whether a breach of its money laundering systems and controls rules has occurred, it will consider whether the firm followed relevant provisions of “the guidance for the United Kingdom financial sector issued by the Joint Money Laundering Steering Group”.

In practice that converts the guidance into the yardstick. A firm that departed from relevant JMLSG provisions is not automatically in breach, but it will be asked to explain why its alternative approach was adequate — and the explanation has to be documented at the time, not constructed afterwards. Departing from JMLSG is a decision to record, with reasons.

Three obligations that sit outside SYSC

SYSC 6.3.4G reminds firms that they may have separate legal obligations under the Terrorism Act 2000, the Proceeds of Crime Act 2002 and the Money Laundering Regulations. These are criminal and regulatory duties running in parallel, with their own nominated officer concepts and their own consequences. Satisfying SYSC does not discharge them.

SYSC 6.3.11G points firms to the FCA’s Financial Crime Guide and its Financial Crime Thematic Reviews for practical steps — which is the FCA telling firms where its supervisory expectations are actually written down.

What this means for competence

The 2026 enforcement record is instructive here. Of the FCA’s 19 published fines in 2026, 17 were against individuals, commonly for breaches of integrity, due skill, care and diligence, and the Fit and Proper test, usually with a prohibition order attached. An MLRO is an individual holding a named oversight responsibility, with a rule requiring the firm to give them authority and independence — which is precisely the profile that attracts personal consequences when controls fail.

So the competence question is not only whether the MLRO knows the typologies. It is whether they have the standing to act on what they find, whether the overall responsibility is correctly allocated, and whether departures from JMLSG were documented. Our guides to sanctions screening and our CPD course library cover the underlying financial crime and governance disciplines.

Frequently asked questions

Must every firm appoint an MLRO?

Under SYSC 6.3.9R, yes, with one exception: a sole trader with no employees. The appointee must be an individual, and the firm must ensure they have sufficient authority, independence, resources and information.

Can the MLRO also hold overall responsibility for AML systems and controls?

Yes. SYSC 6.3.8R(1) requires overall responsibility to be allocated to a director or senior manager, and that person may also be the MLRO. The duties remain distinct.

Is there anyone who cannot hold AML overall responsibility?

Yes. SYSC 6.3.8R(2) prohibits allocating it to a person approved to perform the “other overall responsibility function”, so it cannot be absorbed into a catch-all senior accountability.

Does the firm have to follow JMLSG guidance?

It is guidance rather than rules, but SYSC 6.3.5G provides that the FCA will consider whether a firm followed relevant JMLSG provisions when assessing whether a breach occurred. Departures should therefore be deliberate and documented.

Must the MLRO be based in the UK?

The FCA expects so. SYSC 6.3.10G states that expectation and describes the MLRO as the focal point for all anti-money laundering activity within the firm.