MLRO Annual Report: What to Include and What Senior Management Should Do

The annual report from the money laundering reporting officer (MLRO) is one of the few documents that shows, in one place, whether a firm's anti-money laundering (AML) controls work. It also gives senior management evidence that they have understood and acted on the firm's money laundering risks. This guide uses the FCA's Financial Crime Guide, section FCG 3, to explain what such a report should help the board see, and how to structure one. The Guide is written for FCA-authorised firms, so other regulated firms, including accountancy practices, should treat it as a benchmark and follow their own supervisor's guidance. The report structure below is our suggestion, not a prescribed template.

Why the report matters

FCG 3 says senior management should own the firm's AML measures, understand its money laundering risks and make sure those risks are mitigated. Among the self-assessment questions it lists are who holds overall responsibility, what the reporting lines are, whether senior management receive objective information and how they follow up MLRO reports, which the Guide says should be commissioned at least annually. Its poor practice examples include a board that never considers MLRO reports and treating AML as a regulatory necessity instead of a real concern. A report that is written but never discussed therefore counts against the firm.

The MLRO's role in the Guide

The Guide describes the MLRO as the person who oversees the firm's AML compliance and acts as the focal point for AML activity. Good practice is an MLRO who is independent, knowledgeable, robust and well-resourced, with a direct reporting line to executive management or the board. Poor practice includes an MLRO who lacks credibility or seniority, does not understand the policies they oversee, or cannot quickly retrieve information on high-risk customers. For the role in a smaller firm, see our guide to the MLRO role in an accountancy firm.

A suggested structure for the report

Each section below maps to a theme in FCG 3. The headings are our own.

1. Governance and resources

Set out who holds responsibility, how the MLRO reports, and whether the MLRO has adequate resources, experience, access and seniority. Note any changes in the year, such as staff turnover or a change of MLRO. The Guide says the supervisor must be told of an appointee within 14 days under Regulation 21 of the Money Laundering Regulations.

2. Risk assessment

Summarise how the firm assessed money laundering, terrorist financing and proliferation financing risk under Regulation 18, which business areas carry greater risk, and what changed. The Guide asks whether the assessment informs day-to-day decisions on due diligence and relationship acceptance. Our guide to the firm-wide AML risk assessment explains the exercise.

3. Customer due diligence

Report on how well customer due diligence (CDD) was completed. Useful measures include the number of relationships where CDD was incomplete, how those were handled, and whether electronic verification and PEP database limits are understood. The Guide treats applying the same CDD regardless of risk, and untracked completion of checks, as poor practice.

4. Ongoing monitoring

Explain whether monitoring is adequate and effective, how unusual activity is challenged, and whether monitoring findings feed back into customer risk profiles. The Guide asks whether monitoring rules are reviewed regularly and treats staff accepting customer explanations without probing as poor practice.

5. Suspicious activity reporting

Give the number of internal reports, the number escalated to the National Crime Agency, and the quality of the decisions. Our guide to suspicious activity reporting covers the process. Do not include details that could tip off a customer in a document with wide circulation.

6. Training and culture

Record who was trained, when, and what was covered, and note any areas where understanding was weak.

7. Assurance and findings

List audits, reviews and testing carried out, the issues found and the progress on fixing them. The Guide mentions independent challenge of high-risk relationship decisions as good practice.

8. Priorities for next year

Finish with recommendations and decisions the board is asked to make.

What senior management should do with it

1. Put it on the agenda. Discuss it at a board or partners' meeting and minute the discussion.
2. Challenge it. Ask whether the numbers look right, what is missing and what the MLRO is worried about.
3. Approve actions with owners and dates. Track them until closed.
4. Check resources. Decide whether the MLRO has the time, tools and authority to do the job.
5. Keep the evidence. A dated report with a recorded response is what a supervisor will look for.

Common weaknesses to avoid

Reports often run to pages of statistics without conclusions, or repeat last year's text. The Guide's poor practice examples suggest what to avoid: information that does not give senior management an accurate picture of risk, and risk ratings that cannot be justified. A short report with clear findings and decisions beats a long one that is not read.

Frequently asked questions

How often should the MLRO report?

The FCA Guide says MLRO reports should be commissioned at least annually. Your own supervisor's rules or your firm's risk profile may require more frequent reports.

Who should receive it?

Senior management or the board, with a direct reporting line from the MLRO.

Does this apply to accountancy firms?

The Guide is addressed to FCA-authorised firms. Accountancy firms supervised elsewhere should check their supervisor's guidance, although the principles are a useful benchmark.

Next steps

Take your last MLRO report and compare it with the structure above. Check that it was discussed, challenged and acted on. To build your MLRO and compliance team's skills, explore Learnsignal's CPD courses.