Every accountancy practice within the Money Laundering Regulations 2017 must appoint a nominated officer to receive staff reports of suspicion and decide whether to report to the National Crime Agency, and most must also appoint a senior person responsible for compliance with the Regulations. Most firms give both jobs to one person, the money laundering reporting officer (MLRO). The supervisor must be told who holds each role within 14 days of the appointment.

Is the MLRO one role or two?

The Regulations never use the term MLRO. They create two separate appointments:

  • The nominated officer. Regulation 21(3) requires an individual in the firm to be appointed as nominated officer. This is the person who receives internal disclosures and, under regulation 21(5), must consider each one in the light of any relevant information available to the firm and decide whether it gives rise to knowledge or suspicion, or reasonable grounds for knowledge or suspicion, of money laundering or terrorist financing.
  • The officer responsible for compliance. Regulation 21(1)(a) requires, where appropriate to the size and nature of the business, one individual who is a member of the board (or equivalent management body) or of senior management to be appointed as the officer responsible for the firm’s compliance with the Regulations. ICAEW calls this person the money laundering compliance officer (MLCO); its smaller practices helpsheet also uses the term money laundering compliance principal.

ICAEW’s thematic review of the role, which surveyed 240 high or high medium risk firms, notes that most firms combine the two appointments into a single MLRO. HMRC’s guidance for the businesses it supervises recommends keeping them separate where possible, because the compliance officer reviews how suspicious activity reporting is handled, but accepts that a smaller business may combine them if it can give reasons.

Who can be appointed, and does a sole practitioner need one?

Regulation 21(6) disapplies both appointments where the firm is an individual who neither employs nor acts in association with any other person. A sole practitioner with no staff therefore carries the duties personally, including submitting suspicious activity reports, as HMRC’s guidance confirms. Once there is a single relevant employee, the appointments are needed.

CCAB guidance, as quoted by ICAEW, says the nominated officer should have:

  • sufficient seniority to enforce their decisions;
  • the authority to make external reports to the NCA without reference to another person;
  • the time, capacity and resources to review internal reports and make external reports in a timely manner.

For the compliance role, the same guidance adds an understanding of the business, its service lines and its clients, and enough seniority to direct the activities of all staff, including senior staff. ICAEW warns that an MLRO with no time to allocate to the role could leave the firm in breach of the Regulations. HMRC also recommends appointing a deputy nominated officer to cover absences, and expects both officers to be based in the UK.

The appointees must pass their supervisor’s approval checks as beneficial owners, officers or managers. ICAEW, for example, will only approve a new one after reviewing a criminal record (DBS) certificate.

What must be done when an MLRO is appointed or replaced?

Regulation 21(4) requires the firm to tell its supervisory authority the identity of the first nominated officer and the first compliance officer, and of any later appointment to either role, within 14 days. HMRC also asks to be told of deputies within the same period. The firm’s AML supervisor may be a professional body or HMRC; see AML supervision for accountants.

ICAEW’s checklist for a new MLRO includes:

  • registering on the NCA’s SAR Portal, or making sure the firm’s existing registration has the right contact details and passwords;
  • locating copies of earlier reports, since the portal does not store them, and checking they are held securely and confidentially;
  • making sure there is a procedure for recording the reasons for submitting, or not submitting, each internal report;
  • reading the firm wide risk assessment and the findings of the last supervisory visit;
  • updating written procedures and telling staff who the new reporting officer is and how to contact them.

What does the nominated officer actually decide?

When a member of staff reports a suspicion, that person’s own duty under section 330 of the Proceeds of Crime Act 2002 is discharged. The decision then passes to the nominated officer, who must weigh the report against everything the firm knows about the client. Under section 331, a nominated officer in the regulated sector commits an offence if, having received a section 330 disclosure that gives knowledge, suspicion or reasonable grounds for either, they do not pass the required information to the NCA as soon as practicable. The maximum penalty on indictment is five years’ imprisonment under section 334(2).

The nominated officer also handles requests for a defence against money laundering where the firm wants to carry on with an act that would otherwise be an offence. Section 336 limits when a nominated officer may give internal consent to such an act: only after reporting to the NCA and either receiving consent, hearing nothing within the seven working day notice period, or waiting out a 31 day moratorium following a refusal. A nominated officer who gives consent outside those conditions, knowing or suspecting the act is prohibited, commits an offence under section 336(5).

The mechanics of reporting are covered in suspicious activity reports for accountants. Whatever the outcome, ICAEW and HMRC both expect the reasons for a decision not to report to be documented.

What else is the MLRO responsible for?

Where one person holds the combined role, ICAEW lists ongoing responsibilities covering the firm’s AML systems, controls, policies and procedures under regulation 19, the firm wide risk assessment, regular monitoring of compliance, remedial action where monitoring finds weaknesses, and checking that the required criminal record checks have been carried out. In practice that means:

  • keeping customer due diligence procedures up to date and checking that they are followed;
  • making sure staff are trained and know there is no minimum amount below which suspicion need not be reported (see AML training for practice staff);
  • keeping internal and external reports secure and separate from client files;
  • overseeing the follow up after a report, including the risk of tipping off and whether the firm should keep acting.

Regulation 21(1)(c) also requires an independent audit function, where appropriate to the size and nature of the firm, to examine the adequacy of the firm’s policies and procedures and monitor compliance with its recommendations. ICAEW’s smaller practices guidance says independent does not mean external.

What should the MLRO report to the partners?

Regulation 19(2)(b) requires the firm’s policies, controls and procedures to be approved by senior management, so the MLRO needs a route to the partners or board. ICAEW recommends that regular reporting covers:

  • the results of internal or external compliance reviews and the action planned to fix failings;
  • the number of internal and external reports and any themes;
  • the risk profile of the client base, such as higher risk clients, politically exposed persons and high risk countries;
  • emerging risks and changes in the regulatory framework.

How might this work in a small firm?

Illustration only. A two partner practice with eight staff appoints one partner as MLRO, combining both roles, and a senior manager as deputy. It notifies its supervisor of both names within 14 days. A bookkeeper reports that a client’s takings have jumped with no explanation. The MLRO reviews the file, asks the client manager to make normal enquiries within the scope of the engagement, finds a plausible documented explanation, and records why no external report is needed. Six months later a second report about the same client arrives, and this time the explanation does not hold up. The MLRO submits a report through the portal, saves a copy on a restricted MLRO file, and tells the partners in the next quarterly report that one external report was made, without naming the client to anyone who does not need to know.

What are the common mistakes?

  • Not telling the supervisor of a new MLRO or compliance officer within 14 days.
  • Appointing someone too junior, or too busy, to challenge partners or make reports on their own authority.
  • No deputy, so internal reports sit unread during holidays.
  • Losing access to the SAR Portal or to copies of past reports when the MLRO changes.
  • Recording decisions not to report with no reasoning, or not at all.
  • Treating the role as purely reactive and never monitoring whether procedures are followed.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.