Compliance Officer, MLRO or One Person for Both? How Regulated Firms Structure SMF16 and SMF17

Almost every FCA-regulated firm within the Senior Managers and Certification Regime has to answer the same two questions sooner or later. Who will be our compliance officer? And who will be our money laundering reporting officer? For many firms, a third question follows immediately: should they be the same person?

These are the two Senior Manager Functions the regulator notices first. Compliance oversight, SMF16, makes one person accountable for the firm’s compliance function. Money laundering reporting, SMF17, makes one person accountable for its anti-money laundering arrangements and, usually, for deciding whether suspicions must be reported to the National Crime Agency. Get the structure wrong and the consequences show up quickly: an authorisation application that stalls, a supervisory visit that finds gaps, or a single overstretched individual trying to do two jobs that have outgrown them.

This article looks at how the right answer changes as a firm moves from authorisation, through early growth, to a larger and more complex business, and what to look for at each stage.

Two Functions, Two Sets of Responsibilities

It helps to start with what each role actually involves, because the overlap is real but smaller than many firms assume.

The FCA’s own material on the Senior Managers and Certification Regime and its Financial Crime Guide set out the expectations in more detail. The practical point is that each function needs real expertise. A compliance officer who has only ever supervised financial crime from a distance is not automatically a credible MLRO, and an experienced MLRO may never have owned a compliance monitoring plan.

Stage One: Applying for Authorisation

Firms applying for authorisation, particularly payments, e-money and cryptoasset businesses, have to name credible people in their applications, often before they have customers or revenue. The FCA scrutinises these appointments closely, because the people named are a large part of what it is being asked to trust.

At this stage, most firms appoint one experienced person to hold both functions, often on a fractional basis. That makes sense: the business is small, the risks are still taking shape, and two senior salaries are rarely affordable. But the person has to be genuinely strong in both disciplines and able to help build the framework the application describes, including the compliance monitoring plan, the business-wide risk assessment and the policies the regulator will read.

The common mistake is naming someone who is impressive on one side and thin on the other. For a payments or crypto firm, the financial crime side usually carries more weight, so a candidate with deep conduct experience but little practical AML experience is a risk to the application.

Stage Two: The Small, Established Firm

For many established smaller firms, such as directly authorised advice firms, brokers, smaller wealth managers and consumer credit firms, one person holding both functions remains the right answer for years. The conduct risk is manageable, the financial crime risk is moderate, and a single experienced individual, sometimes supported by outsourced monitoring or file-checking, can give the board a complete picture.

The key questions at this stage are about time and support. Is the combined holder spending enough time on both functions? Who covers urgent suspicious activity decisions when they are not working? Is routine monitoring work delegated so their time goes on judgement and oversight? Firms that answer these questions clearly, and document the answers, are in a strong position if the regulator asks.

Firms recruiting at this stage are looking for a specific profile: someone who has held or deputised for both functions, in the same kind of firm. SMF Capital’s page on recruiting a combined compliance officer and MLRO sets out how to test whether combining is right for a firm and what the regulator looks for in a joint SMF16 and SMF17 appointment.

Stage Three: Growth and the Case for Splitting

As firms grow, the balance shifts. More customers mean more alerts, more complaints and more regulatory change to implement. New products or markets can raise the financial crime risk sharply. A move from Core to Enhanced status brings a wider set of Senior Manager Functions and a more demanding regulatory relationship. At some point, one person can no longer do both jobs properly, however capable they are.

The warning signs tend to be consistent:

• the combined holder is regularly working well beyond the agreed time;
• alert backlogs or overdue customer reviews are building up;
• compliance monitoring is slipping to make room for financial crime work, or the other way round;
• internal audit, the external auditor or the FCA has raised findings in either area; or
• the board is receiving less detail on one function than the other.

When the signs appear, the firm usually has two routes. It can appoint a deputy, often a deputy MLRO or head of compliance monitoring, who may later step up into one of the Senior Manager roles. Or it can split the functions straight away, with the existing holder keeping the one that best matches their strengths and the firm recruiting for the other.

Stage Four: Separate Specialists

Larger firms, Enhanced firms, banks and firms with significant financial crime exposure almost always separate the two roles, each led by a specialist with their own team.

The compliance officer at this level is a senior conduct and regulatory specialist who leads a monitoring and advisory function, reports to the board and its committees, and manages a complex regulatory relationship. Firms recruiting for the role typically look for previous SMF16 approval at a comparable firm, and sector-specific regulatory depth. SMF Capital’s page on compliance officer recruitment for FCA-regulated firms covers what the role requires and how searches for it are run.

The MLRO at this level leads a financial crime function that may include screening, monitoring, investigations and sanctions teams. The best candidates combine technical depth with the judgement and authority to make difficult reporting decisions under pressure, and the presence to challenge the business when needed. SMF Capital’s page on MLRO recruitment covers the SMF17 role, the experience firms look for and the sectors where demand is highest.

A Quick Guide to the Right Structure

Getting the Appointment Approved

Whatever the structure, every SMF16 and SMF17 appointment needs the regulator’s approval before the person starts. The FCA assesses each candidate against the fit and proper standards of honesty, competence and financial soundness, and for a combined appointment it will look at both functions. Firms make the process smoother by confirming the structure first, writing a clear Statement of Responsibilities that sets out each function separately, checking candidates’ previous approvals and regulatory references before making an offer, and planning for notice periods and the regulator’s decision time.

It’s also worth thinking about continuity. Compliance officers and MLROs are among the most frequently recruited Senior Managers, and they move between firms regularly. A firm that knows who would cover each function if the holder left, and how it would recruit a successor, is far better placed than one that has to work it out under pressure.

The Bottom Line

There is no single right answer to whether a firm needs a compliance officer, an MLRO or one person for both. There is a right answer for each firm at each stage of its growth. Start from the firm’s risks rather than its budget, be honest about whether one person can do both jobs properly, and revisit the decision as the business changes. Firms that do this rarely find themselves with an overstretched Senior Manager, a stalled application or an awkward conversation with their supervisor.