If the target is FCA-regulated, the compliance function usually gets a paragraph in the legal report confirming the firm holds the permissions it claims to hold, and that is the end of it.

That is a considerable gap, because the compliance monitoring file is arguably the single most revealing document in the data room. It is the only place in a regulated business where somebody has systematically written down what is not working, and whether anybody fixed it. This is a guide for the CFO, finance director or deal lead on what to ask for and how to read it.

Why a regulated target is a different proposition

Three things make this unlike an ordinary acquisition.

You need the regulator’s permission to buy it. Acquiring control of an FCA-authorised firm requires prior approval under the change in control provisions of FSMA 2000, with notification thresholds that bite well below outright ownership. The statutory assessment clock runs for weeks after a complete notice, and it does not start until the notice is complete. That timetable sits on the critical path of the deal, and a target with a visibly weak control environment makes the approval conversation harder.

Liabilities you cannot see are often the largest ones. A past-business review, a redress programme or a remediation exercise can exceed the purchase price of a small firm. None of it appears on the balance sheet until somebody has quantified it, and the monitoring file is frequently where the first evidence of it sits.

The firm’s permission depends on people and arrangements, not just capital. Threshold conditions require adequate resources and appropriate non-financial resources on an ongoing basis. If the senior managers leave on completion, the thing you bought may not continue to satisfy the conditions of its own authorisation.

What to ask for

A compliance diligence request list that actually earns its place is short. These are the items that reward reading.

• The compliance monitoring plan for the current and previous two years, and the completed reports against each.
• The open actions log, with original dates, owners and current status.
• Board and committee papers where compliance was reported, for the same period.
• All correspondence with the FCA, including supervisory correspondence, information requests and any attestations given.
• Any skilled person report commissioned under section 166, and the remediation plan that followed.
• The breach register and the record of notifications made to the regulator.
• Complaints data and root cause analysis, with any redress paid.
• The firm-wide financial crime risk assessment and the most recent annual MLRO report.
• Statements of Responsibilities for every senior manager and, where the firm is Enhanced, the management responsibilities map.

If the seller cannot produce the first two items, that is itself the finding, and a significant one. A firm with no documented monitoring over three years has not been testing its controls, which means nobody — including the seller — knows what condition they are in. SMF Capital’s guide to compliance monitoring sets out what a functioning programme should have produced, and is a useful benchmark to read the target’s file against.

How to read the monitoring file

Coverage: what was planned and what was done

Compare the plan with the completed reviews, year by year. Consistent under-delivery indicates a function without the capacity to meet its own commitments. Look at which reviews were dropped: the areas that get deferred are rarely the low-risk ones, because low-risk reviews are quick and get done to show progress.

Closure: what happened to the findings

Take the open actions log and sort by original date. A long tail of actions raised two or three years ago and still open tells you more about the firm’s culture than any management presentation will.

Then test how closure happens. Where an action was marked complete, was there evidence, and did anyone retest? “Confirmed closed by the business” is not validation, and a file full of self-certified closures is a file that will not withstand supervisory examination.

Repetition: the same finding under new wording

Read three years of reports together and look for the issue that keeps coming back. Where the same problem resurfaces annually, whatever remedy was applied did not reach the cause, and that issue is your best available predictor of what will go wrong after completion. It is also, typically, the one the board was told had been dealt with.

Candour: what the ratings tell you about the culture

A monitoring file with no serious findings across three years is not evidence of a well-run firm. Far more often it means the testing never went deep enough to surface anything, or that whoever performed it understood which conclusions were unwelcome. Either way you are buying an unmeasured control environment, which is a worse position than buying a measured one with known problems.

Cross-check the monitoring file against the complaints data and the breach register. If complaints show a pattern that monitoring never detected, the programme was not looking where the harm was.

Key person risk in the SMF roles

This is the diligence finding most often missed, and the one most likely to cause a problem in the first quarter after completion.

Map the senior management functions against the individuals holding them. At a smaller target you will frequently find one person holding both the SMF16 Compliance Oversight and SMF17 Money Laundering Reporting functions, sometimes alongside an operational role. Establish three things about that person: whether they intend to stay, what their notice period is, and whether anything about the transaction gives them a reason to leave.

If they go, the firm loses two required functions at once. The statutory financial crime obligations do not pause while a successor is recruited and approved, and a buyer who has just taken control of a regulated business with no compliance leadership is in an uncomfortable position with a supervisor who is already watching the change of control. Our guide to temporary SMF cover and the 12-week rule explains the mechanism available, and SMF Capital’s urgent SMF replacement page covers how firms move when it happens without warning.

The practical mitigations are retention arrangements for the SMF holders through integration, an agreed handover specification if they are leaving, and a successor identified before completion rather than after. Our post on senior manager handovers sets out what the handover pack should contain.

Turning findings into deal terms

Compliance diligence findings rarely kill a deal. They should change its shape.

Quantify the remediation. Open actions, unaddressed repeat findings and gaps in monitoring coverage all represent work the buyer will have to fund. Price it as a cost rather than treating it as a risk to be noted.

Use specific indemnities where the exposure is identified but unquantified. A known past-business issue with an undetermined redress population is the textbook case for an indemnity rather than a price adjustment.

Build the resourcing into the plan. If the target’s compliance function was under-resourced for the business as it stood, it will be more so under an owner with growth plans. That cost belongs in the model from day one, not in year two when a supervisor raises it.

Decide who owns compliance on day one. Not in month three. The first board meeting after completion should receive a monitoring report, and somebody has to have produced it.

The question worth asking the seller

If you ask one thing in management meetings, make it this: what has your compliance monitoring found in the last two years that you were genuinely uncomfortable about, and what did you do? A seller who can answer specifically has a functioning programme. A seller who cannot think of anything has either an unusually well-run firm or a monitoring function that was never really looking — and the file will tell you which.

References and further reading

• Financial Services and Markets Act 2000 — the change in control provisions governing acquisitions of authorised firms.
• FCA: Senior Managers and Certification Regime — the accountability framework behind the SMF roles you are acquiring.
• ICAEW — the professional body for chartered accountants in England and Wales.
• SMF Capital: Compliance Monitoring Explained — the benchmark to read a target’s monitoring file against.

That is a problem, because unlike most cost lines, this one has a regulatory floor. The FCA does not merely prefer that firms resource compliance properly. It requires it, it tests it, and the finding that a function was under-resourced appears in enforcement notices with some regularity.

This is written for the CFO or finance director who owns the budget rather than the function. It sets out what the obligation actually is, how to size the requirement from the workload rather than from last year’s figure, what the realistic ways of buying capacity are, and how to defend the number to a board that regards compliance as overhead.

“Adequate resources” is a rule, not an opinion

Two separate obligations bite here, and they operate at different levels.

At firm level, adequate resources is one of the threshold conditions a firm must satisfy to hold and keep its permission. It covers financial resources, but it also covers people, systems and controls. A firm that cannot demonstrate it has the capability to run its regulated business compliantly is not meeting a condition of authorisation.

At function level, SYSC requires the compliance function to have the authority, resources and expertise to do its job, and to monitor and assess the adequacy and effectiveness of the firm’s arrangements. Our guide to SYSC covers the detail.

Both of these are judged on outcomes, not on spend. There is no published minimum, no percentage-of-revenue benchmark, and no safe harbour. What a supervisor assesses is whether the function is actually delivering what the firm’s risk profile demands — which means the honest way to build the budget is from the workload upwards.

What one person is actually being asked to do

Most small and mid-sized regulated firms run a compliance function of one. Before deciding whether that is adequate, it is worth writing down what that one person owns.

• The monitoring programme — planning it, performing the testing, writing up findings, tracking actions to closure and reporting to the board. SMF Capital’s guide to compliance monitoring gives a realistic picture of what a programme involves; it is not a part-time activity squeezed around other duties.
• Advice to the business — the queries that arrive daily and cannot wait, which is the work that crowds out everything scheduled.
• Financial promotions — review and sign-off, record keeping, and the approvals regime where it applies.
• Policies and procedures — drafting, annual review, and keeping them aligned with what the firm actually does.
• Training and competence — conduct rules training, certification where it applies, and evidencing both.
• Regulatory reporting and notifications — returns, breach reporting and keeping the supervisor informed.
• Financial crime — where the same person also holds SMF17, add the risk assessment, customer due diligence oversight, transaction monitoring review, suspicious activity reporting and the annual MLRO report.
• Project work — every new product, new permission, system change or regulatory initiative lands here.

Set that list against one full-time equivalent and the arithmetic usually fails somewhere. The question is not whether something gets dropped. It is which thing, and whether the firm chose it deliberately or discovered it in a supervisory review.

The four ways to buy capacity

Each has a different cost shape, and the right answer is usually a combination rather than a single choice.

A permanent hire

The default, and the right answer where the workload genuinely supports a full-time role. Remember that the true cost is not the salary: add employer’s National Insurance, pension, bonus, recruitment, equipment and the management time of someone who may have no compliance background supervising them. Our compliance salary guide carries current UK benchmarks by role and seniority.

The risk with a permanent hire at a small firm is seniority mismatch. A firm that can only afford a junior person for a role carrying SMF16 accountability has not solved its problem, it has relocated it.

Fractional or part-time senior capability

An experienced Head of Compliance or MLRO working one to three days a week gives a small firm genuine seniority at a cost it can carry indefinitely. For firms whose workload does not justify a full-time senior person but whose risk profile demands senior judgement, this is frequently the correct structural answer rather than a stopgap.

The constraint is that the time commitment has to be real and defensible. The FCA will expect the days contracted to match the responsibilities held, and a nominal arrangement will not survive scrutiny. SMF Capital’s fractional and part-time MLRO recruitment page covers how these engagements are typically structured.

Outsourced testing capacity

Buying in a consultancy to perform specific monitoring reviews is a sensible way to add testing capacity without adding headcount, and it has the useful side effect of introducing independence where an in-house person would be reviewing their own area.

The limit is accountability. Outsourcing the testing does not outsource the responsibility for it; the SMF16 still owns the programme and the conclusions. Our post on outsourcing the MLRO function sets out where the line falls.

A second pair of hands below senior level

Often the most cost-effective and least considered option. A compliance analyst or monitoring officer doing the file reviews, call sampling and evidence gathering frees the senior person to exercise judgement rather than performing clerical testing. For many firms this buys more real capacity per pound than any other option.

Where firms under-resource and get caught

Four patterns recur.

Growth without review. The compliance function was sized for the firm as it was three years ago. Headcount has doubled, a new product line has launched, and the compliance resource has not moved. This is the single most common failure, and it is a finance failure as much as a compliance one, because nobody triggered a review when the business changed.

The combined role at scale. One person holding both SMF16 and SMF17 is proportionate at twenty staff and increasingly indefensible at a hundred. There is no bright line, but if the same individual is designing the monitoring programme and owning the financial crime controls it tests, independence is already strained.

No cover. A single-person function with no deputy means that illness, resignation or a sustained project leaves the firm with no compliance capability at all. The regulatory obligations do not pause, and the 12-week rule is a safety net rather than a resourcing plan.

Authorisation commitments not funded. The regulatory business plan submitted at authorisation described a compliance function. Firms routinely describe what they intend to build and then fund what they can afford, and the gap between the two is a documented commitment the firm is not meeting. Our guide to the regulatory business plan covers what those commitments look like.

Building a number you can defend

A workable method, and one that produces a figure with reasoning attached rather than a guess.

Start from the obligations, not the headcount. List what the firm must do, by regime and by frequency. Monitoring reviews per year, promotions volume, training cycles, reporting deadlines, financial crime obligations. This is the demand side, and it is knowable.

Estimate the time each requires. Ask the person doing it. They will usually know, and the exercise itself tends to surface work that nobody had accounted for.

Allow properly for reactive work. Advice queries, incidents and ad hoc business requests consume a substantial share of any compliance function’s week. A plan built on the assumption that scheduled work fills the available days will fail in month one.

Identify the gap and price the options. The difference between what is required and what current resource can deliver is the decision. Price it as a permanent hire, as fractional days, as outsourced testing, and as a junior addition — the comparison is frequently counter-intuitive.

Record the decision and the reasoning. This matters more than the number. A board that considered the analysis, chose a level of resourcing and documented why is demonstrating reasonable steps. A board with no paper trail is not, whatever it spent.

Defending it to a board that sees overhead

The argument that works is not about risk appetite in the abstract. It is about the specific, quantifiable consequences of being found inadequate: a skilled person review commissioned at the firm’s own expense, a variation or restriction on permissions, remediation and redress programmes, and in the worst cases individual liability for the senior manager who accepted the resourcing.

A section 166 review alone routinely costs a multiple of what the resourcing gap would have cost to close, before accounting for management time and the supervisory relationship afterwards.

Framed that way, the compliance budget stops being a cost to be minimised and becomes an insurance decision with a knowable downside — which is a conversation finance leaders are well equipped to have.

References and further reading

• FCA: Senior Managers and Certification Regime — senior manager accountability for resourcing decisions.
• The Money Laundering Regulations 2017 — the financial crime obligations that fall on a combined compliance and MLRO function.
• ICAEW — the professional body for chartered accountants in England and Wales.
• SMF Capital: Compliance Monitoring Explained — the workload a monitoring programme actually represents.

That is not because boards do not care. It is because most directors who are not compliance professionals have no framework for judging whether what they are reading is good, adequate or quietly alarming. A report full of green ratings reads as reassuring. A report full of amber ratings reads as honest. Neither impression is reliable.

This is written for the CFO, finance director or non-executive who receives these reports and wants to interrogate them properly. You do not need to be a compliance specialist to ask good questions about monitoring. You need to know which six things to look at.

What the monitoring report is actually for

Compliance monitoring is the second line’s planned, risk-based testing of whether the firm’s controls are working in practice. It is not the same as first-line quality assurance, where a team checks its own output, and it is not internal audit, which sits in the third line and tests whether the second line itself is effective. If those distinctions are hazy, our guide to the three lines of defence model sets them out, and SMF Capital has published a thorough guide to compliance monitoring covering how a programme is built and run.

The obligation sits in SYSC, which requires firms to maintain a compliance function with the necessary authority, resources and expertise, and to monitor and assess the adequacy and effectiveness of the measures put in place. For most firms it is the SMF16 Compliance Oversight holder who owns the programme, and that ownership is part of what they are personally accountable for under the senior managers regime.

The board’s job is not to run the programme. It is to be satisfied that the programme is real, that it covers the things most likely to harm customers or the firm, and that what it finds gets fixed. Everything below is a way of testing that.

Six things to look at

1. Coverage against the plan

Start with the simplest question: what was the programme supposed to test this period, and what did it actually test?

A monitoring plan that was eighty per cent delivered is a resourcing conversation. A plan that was forty per cent delivered, with the shortfall concentrated in the higher-risk areas, is a different conversation entirely — because the areas that get dropped are almost never random. They are the ones that are difficult, politically awkward, or owned by someone senior who pushed back.

If the report does not show planned versus completed, ask for it. Its absence is itself a finding.

2. The rating distribution

Most programmes rate findings high, medium and low, or red, amber and green. Look at the spread rather than the individual items.

A report where almost everything is green usually means one of three things: the firm genuinely is well controlled, the testing is too shallow to find anything, or the person doing the testing does not feel able to write down bad news. The first is possible. The second and third are more common, and you cannot tell them apart from the ratings alone — which is why you ask what the testing actually involved.

A report where almost everything is amber is a different problem. It often means the rating scale is not being used to discriminate, and amber has become the safe answer that avoids both complacency and confrontation. If nothing is ever red, the scale has no top end and the board has no way of knowing what urgent looks like.

3. Overdue actions

This is the single most diagnostic number in the report, and it is frequently buried in an appendix.

Findings generate actions. Actions have owners and deadlines. The proportion that are overdue, and by how long, tells you whether the monitoring programme has any teeth. A firm that identifies issues diligently and then does not fix them is arguably in a worse position than one that never looked, because it has documented knowledge of a problem it failed to address. That is precisely the evidence trail an enforcement case is built on.

Ask who closes actions, and on what evidence. “The business confirmed it was done” is not validation. Somebody in the second line should have retested.

4. Repeat findings

Look back at the previous two or three reports. Is the same issue appearing again under slightly different wording?

A recurring finding means the root cause was never addressed. Usually the action taken was a reminder email, a policy update or additional training, when the actual cause was a system that allows the wrong thing to happen, an incentive that rewards it, or a team without the capacity to do it properly. Root cause analysis is the step most often skipped, and repeat findings are how you detect that it was skipped.

5. Sample sizes and how they were chosen

You do not need to be a statistician to ask two questions: how many did you look at, and how did you pick them?

Ten files out of four thousand is not a basis for concluding that a process is working. Nor is a sample the business selected and handed over. Risk-based sampling should deliberately over-weight the cases most likely to be wrong — new staff, unusual products, vulnerable customers, high-value transactions — rather than taking a convenient slice of the easiest records to pull.

6. Process testing versus outcome testing

This is the one that separates a modern programme from a dated one, and it is where the Consumer Duty changed what adequate looks like.

Process testing asks whether the required steps were completed and the boxes ticked. Outcome testing asks whether the customer ended up in a reasonable place. A file can be fully compliant on process and still represent a customer who was sold something unsuitable, charged more than the product was worth, or left without the support they needed. If every finding in your report is procedural, the programme is testing the wrong thing. Our Consumer Duty guide covers what outcome-based evidence is expected to look like.

The independence question

There is a structural issue that boards at smaller firms almost never raise, and it deserves a place on your list.

At a great many firms, one individual holds both the SMF16 Compliance Oversight function and the SMF17 Money Laundering Reporting function. That is permitted, it is proportionate for a small business, and it is extremely common. But it means the person who designs the monitoring programme, decides what gets tested, performs the testing and rates the findings is also the person who owns the financial crime controls being tested.

That is self-review, and no amount of professional integrity makes it structurally sound. A supervisor will ask how independence is achieved, and there are only a handful of honest answers: periodic external testing, an internal audit function where the firm is large enough to have one, genuine challenge from a non-executive or audit committee, or splitting the two roles. Our post on whether SMF16 and SMF17 should be held by one person or two covers when the combination stops being proportionate, and SMF Capital’s combined SMF16 and SMF17 recruitment page sets out how firms structure the roles when they decide to separate them.

The board does not need to solve this. It needs to have asked the question and recorded the answer.

Five questions worth asking out loud

• What did we plan to test this period, and what did we not get to?
• How many of the open actions are past their due date, and what is the oldest one?
• Which of these findings have we seen before?
• What is the largest sample we tested, and how were those cases selected?
• Who checks the work of the person who wrote this report?

None of these is hostile. All of them are the kind of question a senior manager should expect from a board doing its job, and asking them creates a record that the board applied challenge — which matters if the firm’s governance is ever examined, whether through a supervisory visit or a section 166 review.

When the honest answer is resourcing

Ask these questions consistently and a pattern often emerges. The plan is not being delivered, actions are slipping, samples are small, and the testing is procedural rather than outcome-focused. In most cases this is not a competence problem. It is one person trying to own a monitoring programme alongside advice, training, financial promotions approval, regulatory reporting and everything else that lands on a small compliance function.

That is a budget decision, and it belongs to the finance leader as much as to the compliance officer. SYSC requires the compliance function to have the resources to do its job, and “we could not afford it” is not a defence that has ever worked. The realistic options are a second pair of hands in the compliance team, outsourced testing capacity bought in for specific reviews, or senior part-time capability — and reasonable steps under SMCR is the standard against which the decision will be judged.

The board that asks these questions, documents the answers and funds the gap is in a materially stronger position than the board that received the report and moved to any other business.

References and further reading

• FCA: Senior Managers and Certification Regime — the accountability framework behind the SMF16 function.
• FCA: Consumer Duty — the outcome-based standard that reshaped monitoring expectations.
• ICAEW — the professional body for chartered accountants in England and Wales.
• SMF Capital: Compliance Monitoring Explained — a full practitioner guide to building and running a programme.

Once a year, the Money Laundering Reporting Officer of an FCA-regulated firm should give senior management and the board a report on how well the firm’s anti-money laundering systems and controls are working. For many boards it is the single most important document they receive on financial crime. Done well, it tells directors where the firm’s money laundering, terrorist financing and sanctions risks lie, whether the controls are working and what needs to change. Done badly, it becomes a statistics pack that nobody reads.

This article explains why the report matters, what a good one contains, how the board should challenge it, and what it can tell you about whether your financial crime function, and your MLRO, has what it needs. It is written for boards, CEOs and MLROs, including those holding the SMF17 Money Laundering Reporting function.

Why the report is expected

The FCA’s Financial Crime Guide asks how regularly senior management commission reports from the MLRO, and states that this should be at least annually. It expects senior management to receive informative, objective information sufficient for them to meet their anti-money laundering obligations, and it lists as poor practice a board that never considers MLRO reports. Industry guidance from the Joint Money Laundering Steering Group also describes the MLRO’s annual reporting to senior management.

Behind that sits the Money Laundering Regulations 2017, which require firms to assess their money laundering risks, maintain policies, controls and procedures to manage them, and appoint a nominated officer to receive internal reports of suspicion and decide whether to report to the National Crime Agency. The annual report is how the board satisfies itself that those obligations are being met. For SM&CR firms, it is also part of the evidence that senior managers have taken reasonable steps.

The expectation is not limited to SM&CR firms. Payment institutions, e-money institutions and other firms within the Money Laundering Regulations have a nominated officer too, and boards there need the same assurance. Our payments compliance recruitment page explains how the MLRO role works at firms outside SM&CR.

What a good MLRO annual report contains

There is no prescribed template, and the report should be proportionate to the firm. Most good reports cover the following areas.

1. Executive summary. The MLRO’s overall view of the firm’s financial crime risk and the effectiveness of its controls, in plain language, with the key recommendations up front.
2. The business and its risk profile. Changes during the year in customers, products, delivery channels and geographies, and what they mean for money laundering risk.
3. The firm-wide risk assessment. When it was last updated, what changed and how the firm’s risk appetite applies.
4. Policies and procedures. What was updated during the year and why, including changes driven by new rules, guidance or sanctions regimes.
5. Customer due diligence. The make-up of the customer base by risk rating, enhanced due diligence on high-risk customers and politically exposed persons, and any backlog of overdue periodic reviews.
6. Monitoring and screening. How transaction monitoring and sanctions screening performed: alert volumes, false positive rates, tuning changes and any system issues.
7. Suspicious activity reporting. Numbers of internal reports, external reports to the NCA and defence against money laundering requests, with trends and themes. Our article on DAML requests in practice covers that process.
8. Assurance. Results of compliance monitoring, internal audit or external reviews of financial crime controls, and progress on findings.
9. Training. Completion rates, content changes and any targeted training for high-risk roles.
10. Breaches, incidents and regulatory contact. Any control failures, near misses, regulatory correspondence or law enforcement requests.
11. The MLRO’s resources. Whether the MLRO has sufficient time, staff, systems, access and seniority, and any constraints on their effectiveness.
12. Recommendations and the year ahead. Prioritised actions with owners and dates, and the emerging risks the MLRO expects over the next 12 months.

Good report or poor report?

Questions the board should ask

• What is the MLRO’s overall opinion of our controls, and what would change it?
• Which risks have grown this year, and are our controls keeping pace?
• Where are our backlogs, in reviews, alerts or investigations, and when will they clear?
• Have any of last year’s recommendations not been completed, and why?
• What did independent testing of our controls find?
• Do you have enough people, systems and time to do the job? What would you need to do it properly?
• Is there anything you have been unable to do, or anyone you have been unable to access?
• Who covers the role when you are unavailable?

The board should minute its discussion, its decisions and the actions it agrees. The FCA’s guidance asks what senior management does with MLRO reports and what follow-up there is on recommendations, so a report that is noted without discussion is a weakness in itself.

What the report can tell you about your financial crime function

Read carefully, the MLRO’s annual report is also a test of whether the firm has the right financial crime leadership.

Signs the MLRO is overstretched. Growing review backlogs, rising alert volumes without matching resource, recommendations carried forward year after year, or an MLRO who also holds several other roles. Where one person holds both SMF16 and SMF17, a report that is thin on financial crime detail can be a sign that compliance work is crowding it out. Our article SMF16 and SMF17: one person or two? explains when to split the roles.

Signs the firm needs more resilience. If there is no deputy or alternate MLRO, internal reports may sit unreviewed when the MLRO is away. Our AMLRO recruitment page covers that role.

Signs the firm needs more seniority. If the report lacks a clear opinion, avoids difficult messages or is never challenged, the MLRO may not have the experience or standing the FCA expects. The Financial Crime Guide identifies an MLRO who lacks credibility and authority, through inexperience or lack of seniority, as poor practice.

Where the report points to a resourcing gap, options include adding a financial crime analyst, appointing a deputy MLRO, engaging a fractional MLRO with deeper expertise, or recruiting a more senior permanent MLRO through our MLRO recruitment team.

Sector points to watch

Consumer credit and BNPL. Reports should cover application fraud, first-party fraud and mule activity alongside traditional money laundering risk. See our consumer credit compliance recruitment page.

Payments and e-money. Expect detail on transaction monitoring tuning, sanctions screening performance, agent and partner oversight and fraud reimbursement. See our article on sanctions screening for payment firms.

Wealth management. Source of wealth and source of funds evidence and politically exposed persons usually dominate. See our article on source of funds versus source of wealth.

Cryptoassets. Travel rule compliance, blockchain analytics and the transition to the new FSMA regime should feature prominently. See our crypto MLRO guide.

Practical tips for MLROs writing the report

• Lead with your opinion and your top three recommendations. Directors may not read every page.
• Show trends over at least two years so the board can see direction, not just a snapshot.
• Be specific about resources. If you need more, say what and why.
• Track every previous recommendation to completion or explain why it changed.
• Keep detailed data in appendices and the narrative short.
• Present the report in person and invite challenge.

For more on the role itself, see our MLRO guide and our article on the SMF17 career path.

Frequently asked questions

Is the MLRO annual report a legal requirement?

The FCA’s Financial Crime Guide expects senior management to commission reports from the MLRO at least annually, and the board needs that information to meet its obligations under the Money Laundering Regulations. In practice, the FCA expects every firm with an MLRO to produce one.

Who should receive the report?

Senior management and the board, or the relevant board committee in larger firms. The board should discuss it and record its decisions.

Does a payments or e-money firm need an MLRO annual report?

Yes. Those firms are within the Money Laundering Regulations and have a nominated officer, even though they sit outside SM&CR. Their boards need the same assurance.

What if our MLRO’s report is weak?

Ask for a clearer opinion and specific recommendations, and consider whether the MLRO has the time, resources and seniority the role needs. A persistently weak report is often a sign that the firm needs to strengthen its financial crime leadership.

A new Head of Compliance takes on personal accountability from the day they start performing the SMF16 Compliance Oversight function. Under the Senior Managers and Certification Regime, the duty of responsibility means they can be held to account if a breach happens in their area and they did not take reasonable steps to prevent it. That makes the first three months unusually important. The new holder needs to understand the firm quickly, find any problems they have inherited, and put a credible plan in front of the board.

The first 90 days also shape how the rest of the business sees the role. A Head of Compliance who arrives, listens, prioritises sensibly and reports clearly earns trust. One who either changes nothing or tries to change everything at once can lose it fast.

This article sets out a practical 90-day plan from both sides: what the new Head of Compliance should do, and what the CEO and board should expect to see and provide. It applies whether the appointment is permanent, interim or fractional, and whether this is the firm’s first in-house Head of Compliance or a replacement for someone who has left.

Before day one

Good onboarding starts before the start date.

• Confirm the regulatory position. Is the new holder already approved for SMF16 at your firm, is a Form A application in progress, or are they covering under the 12-week rule while an application is prepared? Since April 2026, firms have 12 weeks to submit an application for a replacement, and the cover individual can continue until the FCA decides it. Our page on SMF16 and SMF17 temporary cover explains the timetable, and our Form A guide covers the application.
• Prepare the Statement of Responsibilities. Agree which prescribed responsibilities the new holder will carry, and make sure the document reflects what they will actually do. See our Statement of Responsibilities guide.
• Assemble the handover pack. If the previous holder is still in post, arrange an overlap. If not, gather the records they would have handed over. Our article on senior manager handover best practice lists what should be included.
• Arrange access. Systems, board papers, regulatory correspondence, the FCA’s online systems and key people’s diaries should all be ready on day one.

Days 1 to 30: listen, read and triage

The first month is about understanding the business and finding anything urgent. A new Head of Compliance should resist the temptation to rewrite policies straight away.

Meet the people who matter

The CEO, the chair and other non-executives, the other senior managers, the heads of each business area, the MLRO if it is a separate role, internal audit if there is one, and the people who do the day-to-day compliance work. Each conversation should cover what the business does, where people think the risks are and what they expect from compliance.

Read the essential documents

• the firm’s permissions and its entry on the FCA Financial Services Register
• the business plan and any regulatory business plan from authorisation
• correspondence with the FCA for the last two to three years, including any open requests or commitments
• the breach log, complaints data and any FOS decisions
• the compliance monitoring plan and recent results
• the latest Consumer Duty board assessment (see our article on what a good Consumer Duty board report looks like)
• the financial promotions approval records
• the compliance policies and procedures
• Statements of Responsibilities and, for Enhanced firms, the management responsibilities map
• recent board and committee minutes

Triage for urgent issues

The most important output of the first month is a short list of anything that needs immediate action. Typical examples are an unresolved breach that may need to be notified to the FCA under SUP 15, an overdue regulatory return, a commitment made to the FCA that has slipped, or a financial promotion that should not be live. Anything notifiable should be escalated and reported promptly; inheriting a problem is not a reason to delay.

Days 31 to 60: assess and plan

With the urgent issues identified, the second month is about forming a view of the compliance framework as a whole.

• Compliance risk assessment. Map the firm’s regulatory obligations against its business lines, products and customers, and rate where the risks are highest.
• Gap analysis. Compare the existing framework against that risk assessment. Where are policies missing, out of date or not followed in practice?
• Reset the monitoring plan. Make sure compliance monitoring is aimed at the highest risks, not simply repeating last year’s tests.
• Review management information. Does the board receive information that would tell it if something was going wrong? If not, design the MI it needs.
• Check resources. Is the compliance function adequately resourced for the firm’s size and risk? The FCA expects an adequate, independent compliance function, applied proportionately.
• Agree the interface with the MLRO. Where SMF16 and SMF17 are held by different people, agree how compliance monitoring will test financial crime controls. Where they are held by one person, plan for independent review. Our article SMF16 and SMF17: one person or two? covers the trade-offs.
• Deliver some quick wins. Fixing a slow financial promotions process or clarifying who signs off what builds credibility with the business.

Days 61 to 90: report and commit

By the end of the third month, the board should receive a clear written report from the new Head of Compliance. It should cover:

1. an honest assessment of the compliance framework, including what works well
2. issues found and how they have been or will be resolved, including any regulatory notifications made
3. the compliance risk assessment and the priorities that follow from it
4. a 12-month roadmap with milestones and owners
5. the revised compliance monitoring plan
6. resourcing needs, including any hires, systems or external support
7. the MI the board will receive in future

The board’s response matters as much as the report. A board that discusses it seriously, records its decisions and funds the agreed priorities gives the new Head of Compliance the backing they need. It also creates evidence that the firm, and its senior managers, took reasonable steps.

What the CEO and board should provide

• Access. A seat at the executive committee and a standing item at board meetings.
• Time. Space in the first month to listen and read, without being pulled straight into day-to-day sign-offs.
• Candour. An honest briefing on known problems. A new Head of Compliance who discovers something the CEO already knew about will trust the CEO less.
• Support for difficult messages. If the 90-day report identifies serious issues, the board should treat it as the system working, not as bad news to be softened.
• Budget. Agreement in principle that the priorities identified will be resourced.

How the plan differs for interim and fractional appointments

Interim. An interim Head of Compliance brought in after a sudden departure, or during supervisory pressure, compresses the first two phases into a few weeks. Their priority is to stabilise the function, deal with urgent regulatory matters and hand over a clear plan to the permanent appointee.

Fractional. A fractional Head of Compliance working one or two days a week will take longer to cover the same ground, so the plan needs to be prioritised more sharply. Agreeing the scope of each day, and who in the business supports the role between visits, is essential.

A note for candidates

If you are considering an SMF16 role, ask about the first 90 days before you accept. Ask what the previous holder left behind, whether there are open FCA matters, how the board engages with compliance and what budget exists. A firm that answers openly is far more likely to support you once you are in post. Our articles on career paths to SMF16 and SMF personal liability are useful background, and you can register with us for current roles.

Frequently asked questions

When does a new Head of Compliance become accountable?

From when they begin performing the SMF16 function, whether as an approved senior manager or as cover under the 12-week rule. Cover individuals are now subject to the Senior Manager Conduct Rules.

What if the new Head of Compliance finds a breach the previous holder did not report?

It should be assessed promptly and, if it is notifiable, reported to the FCA under SUP 15 without delay. Inheriting a problem is a reason to act quickly, not to wait.

Should the 90-day report go to the full board?

Yes, in most firms. It sets the compliance agenda for the year and records the board’s decisions on priorities and resources.

How can we make sure we hire someone who will handle the first 90 days well?

Ask candidates at interview how they would approach their first three months at your firm, and listen for a plan that balances listening, triage and reporting. Our compliance recruitment team can help you assess this.

In the space of three months in 2026, the FCA changed the rules in three areas that rarely get discussed together. In April it reformed the 12-week rule for covering senior manager absences. In May its strengthened safeguarding regime for payments and e-money firms came into force. In July it began regulating Buy Now Pay Later lending for the first time.

Each change has its own audience. Read them side by side, though, and a common thread appears: all three land on the same small group of people, the Heads of Compliance and Money Laundering Reporting Officers who carry personal accountability inside regulated firms. They change how quickly those people must be in place, what they need to know, and how firms can cover the gap when one leaves.

This article looks at each change from the hiring side. It explains what has changed, who is affected and what it means for the next Head of Compliance or MLRO you recruit. For the detail on each area, we have published dedicated pages on SMF16 and SMF17 temporary cover under the 12-week rule, payments and e-money compliance recruitment and consumer credit compliance recruitment.

Change one: the 12-week rule now gives firms time to recruit properly

What changed. Under the Senior Managers and Certification Regime, a firm can put someone into a senior management function to cover an absence that is temporary or reasonably unforeseen, without that person first being approved. Until April 2026, the firm had 12 weeks to apply for and obtain approval for a replacement. Because FCA approval can take up to three months, that window was often unworkable.

The FCA’s SM&CR review policy statement (PS26/6) changed that from 24 April 2026. Firms now have 12 weeks to submit a valid and complete application, and the person covering can continue until the FCA decides it. The same reforms brought the person covering within the Senior Manager Conduct Rules, cut the deadline for providing regulatory references from six weeks to four, and extended the validity of criminal records checks for new senior managers to six months.

What it means for hiring. Three things follow.

• Permanent searches no longer have to be rushed. When an SMF16 or SMF17 resigns, the firm can take the time to find the right permanent candidate rather than the first one who can be approved within 12 weeks. That favours better hiring decisions.
• Interim cover has become more valuable, and more scrutinised. Because the person covering can stay in post until the application is decided, interim cover may now last several months. And because that person is subject to the Senior Manager Conduct Rules, boards want interims who have held the function before and understand the accountability they are taking on.
• Deputies matter more than ever. The FCA has said it expects the rule to be used on a limited basis, with good succession planning covering most situations. A capable deputy Head of Compliance or deputy MLRO is the cheapest insurance a firm can buy.

The rule is not a licence to leave a function vacant. Form C must still be submitted within seven business days of the departing senior manager ceasing to perform the function, prescribed responsibilities must be reallocated, and an MLRO vacancy has an immediate operational consequence because suspicious activity reporting cannot stop. Our page on what to do when your SMF16 or SMF17 resigns sets out a week-by-week timetable, and our earlier article on the SM&CR Phase 1 reforms covers the rest of the package.

Change two: safeguarding has become a compliance discipline

What changed. From 7 May 2026, authorised payment institutions and e-money institutions became subject to the supplementary safeguarding rules in the FCA’s policy statement PS25/12. The rules require daily safeguarding reconciliations on business days, a monthly safeguarding return to the FCA, an annual safeguarding audit by a qualified auditor (with a limited exemption for firms safeguarding small amounts), and a resolution pack recording where customer funds are held and how they are managed.

What it means for hiring. Safeguarding used to be treated largely as a finance and operations process. The new regime has turned it into something boards and the FCA watch closely, and that has changed the people payments firms are looking for.

• A new role has emerged. Many payments firms are now hiring a dedicated Head of Safeguarding, sitting between finance and compliance, to own reconciliations, the monthly return, audit readiness and the resolution pack.
• Compliance leaders need safeguarding literacy. Even where a Head of Safeguarding exists, the Head of Compliance must understand segregation, reconciliation and what the auditor will test, so that they can provide genuine oversight and challenge.
• Remediation demand has risen. Firms whose first audit or monthly returns exposed weaknesses are bringing in interim compliance and safeguarding specialists to fix them.

There is also a point of confusion worth clearing up. Payment institutions and e-money institutions authorised only under the payments regulations sit outside SM&CR, so their Head of Compliance and MLRO are not SMF16 and SMF17 approvals. The FCA still assesses the individuals responsible for managing the business, and the MLRO is still a statutory role under the Money Laundering Regulations 2017. Our payments compliance recruitment page explains how accountability works at a payments firm and what a strong candidate looks like. For the finance side, see our guide to safeguarding client funds and our payments firm CFO recruitment page.

Change three: BNPL lenders need regulated compliance leadership for the first time

What changed. On 15 July 2026 the FCA began regulating Deferred Payment Credit, the product better known as Buy Now Pay Later, under the conduct rules set out in PS26/1. Lenders that were already active and registered for the temporary permissions regime can continue lending while their full authorisation applications are assessed. New entrants need authorisation before they start.

What it means for hiring. A third-party lender that becomes fully authorised is ordinarily a Core SM&CR firm, and needs an SMF16 Compliance Oversight holder and an SMF17 Money Laundering Reporting Officer. For many BNPL businesses, nobody in the firm has ever held an approved role. That creates demand for a particular kind of candidate.

• Consumer credit depth. The FCA expects these firms to meet the consumer credit rules on creditworthiness, arrears and forbearance, and financial promotions, alongside the Consumer Duty. Candidates who know the Consumer Credit sourcebook in practice are in short supply.
• Comfort with scale and data. BNPL is a high-volume, low-value, model-driven business. A credible Head of Compliance needs to interrogate automated decisioning and design monitoring that works at that volume.
• Timing around the application. The authorisation application names the firm’s senior managers, so the hire needs to happen before submission, not after. Firms that apply first and recruit later tend to face more questions from the FCA.

BNPL is only the newest part of a wider consumer credit market where Consumer Duty evidence, vulnerable customer treatment and collections conduct are all driving compliance hires. Our consumer credit compliance recruitment page covers which senior manager functions a lender needs, what to look for in candidates and how to time the hire around an authorisation.

What the three changes have in common

Taken together, these changes point to four trends that we expect to shape compliance hiring through 2027.

1. Niche combinations are scarce. Firms are no longer looking for a generalist compliance professional. They want someone who combines senior manager experience with a specific body of knowledge: consumer credit and data, payments and safeguarding, or financial crime and fraud. Candidates with those combinations are scarce and move quickly.

2. Speed decides interim and fractional hires. When an SMF16 or MLRO leaves, or an audit exposes a problem, the first credible interim shortlist usually wins. In our experience, a good shortlist delivered within 48 to 72 hours makes a material difference to whether the right interim is still available. Permanent searches run to a different clock, where getting the brief and the fit right matters more than raw speed.

3. Interim-to-permanent is becoming the default path. The reformed 12-week rule makes it easier to bring in an experienced interim, stabilise the function and then decide whether to apply for that person’s approval or run a permanent search in parallel. Many of the firms we work with now plan both tracks from the first conversation.

4. Fractional senior compliance is mainstream for smaller firms. For a small lender, an early-stage payments firm or a newly authorised business, a fractional Head of Compliance or MLRO working one to three days a week can provide genuine senior capability at a sustainable cost. The FCA will test whether the time commitment matches the firm’s size and risk, so the arrangement needs to be documented and supported by a deputy. Our article on outsourcing the MLRO function covers where the line usually falls.

Six questions every board should ask now

1. If our Head of Compliance or MLRO resigned tomorrow, who would cover from day one, and have we tested that they are fit and proper?
2. Do we have a deputy MLRO who can keep suspicious activity reporting running without interruption?
3. Does our compliance leader understand the specific rules that matter most to our business, whether that is consumer credit, safeguarding or financial crime?
4. Is our SMF16 and SMF17 time commitment, whether full-time or fractional, still proportionate to our size and risk?
5. If we are applying for authorisation, are the senior managers we will name in the application already identified?
6. Do we know where we would find an experienced interim within a week if we needed one?

If the honest answer to any of these is uncertain, it is worth acting before a resignation or a supervisory request forces the issue. Our compliance recruitment and MLRO recruitment teams can help you plan.

What this means for compliance professionals

For compliance professionals, the same changes create opportunity. Experience of a BNPL or consumer credit authorisation, a safeguarding audit or remediation, or a period of interim SMF cover is now highly marketable. Professionals who have held SMF16 or SMF17 before and are open to interim or fractional work are in particular demand. Our articles on career paths to SMF16 and the SMF17 career path explain how to position yourself, and you can register with us or browse current roles on our jobs board.

Frequently asked questions

Does the reformed 12-week rule mean we can leave the SMF16 role unfilled for longer?

No. The function must still be covered by a suitable person from the start, and the firm must submit a valid and complete application within 12 weeks. What has changed is that the cover can continue while the FCA decides that application.

Do payments firms need an SMF16 and SMF17?

Only if the entity is FSMA-authorised and within SM&CR. A firm authorised only as a payment institution or e-money institution still needs a Head of Compliance and a nominated officer, but the SMF designations do not apply. See our payments compliance recruitment page.

When does a BNPL lender need its SMF16 and SMF17 in place?

The individuals should be identified before the full authorisation application is submitted, because the application names the firm’s senior managers. See our consumer credit compliance recruitment page.

Is fractional compliance leadership acceptable to the FCA?

It can be, provided the time commitment is genuinely sufficient for the firm’s size and risk and the arrangement is documented, with deputy cover in place. As firms grow, the FCA will expect a more substantial commitment.

For a wider view of the compliance hiring market this year, see our article on the disciplines driving compliance recruitment.

Most small FCA-regulated firms do not start with an in-house Head of Compliance. They come through authorisation with the help of a compliance consultancy, which drafts the policies, sets up the monitoring programme and, in many cases, provides the individual who holds the SMF16 Compliance Oversight function. For a young firm with limited volumes, that is often exactly the right model.

But the arrangement that works at authorisation rarely works for ever. As the firm grows, adds products and attracts more supervisory attention, the gap between what a consultancy provides and what the business needs tends to widen. Knowing when to make the move to your own compliance leader, and how to do it without a gap in accountability, is one of the more important decisions a regulated firm’s board makes.

This article sets out the signs that you have outgrown your consultancy, the options between full outsourcing and a full in-house team, how to handle the handover, and what to look for in your first in-house hire.

Why firms start with a consultancy

There are good reasons for the consultancy model in the early years. Authorisation is a specialist project, and consultancies that run many applications know what the FCA expects. A new firm may not have the volume to keep a full-time compliance professional busy. And a consultancy can bring a team (monitoring specialists, financial crime experts, financial promotions reviewers) that a small firm could never employ directly.

Where the consultancy provides your SMF16 or SMF17, remember that the senior management function is held by an individual, not by the consultancy. That person carries personal accountability under the Senior Managers and Certification Regime, and the firm remains responsible for its compliance arrangements. Our article on outsourcing the MLRO function explores where that model works well and where it comes under strain.

Eight signs you have outgrown your compliance consultancy

1. Your consultancy hours keep rising. When ad hoc advice, extra monitoring and regulatory change work push the annual bill towards the cost of a salaried professional, the economics have shifted.
2. The board needs challenge in the room. If compliance input arrives as a quarterly report rather than as live challenge in product, marketing and board discussions, the firm is missing something a consultant visiting periodically cannot provide.
3. Response times are slowing the business. When product launches, financial promotions or client onboarding wait days for consultancy sign-off, compliance has become a bottleneck.
4. Supervisory contact is increasing. More FCA correspondence, data requests or a supervisory visit usually means the firm needs a compliance leader who knows the business intimately. See our guide to preparing for an FCA supervisory visit.
5. The Consumer Duty is demanding more evidence. Outcome monitoring and the annual board assessment require data from across the business. An embedded compliance leader is better placed to build that evidence. See how the Consumer Duty has reshaped the SMF16 role.
6. You are adding permissions, products or markets. A variation of permission, a new lending product or a move into payments brings new rules and new risk that need continuous oversight.
7. A breach or near miss exposed a gap. If an issue was spotted late or handled slowly, it is worth asking whether an in-house leader would have caught it sooner.
8. Investors or acquirers are asking questions. Due diligence on a regulated business always looks at compliance leadership. A named, embedded Head of Compliance reassures investors in a way a consultancy contract often does not.

The options between full outsourcing and a full team

Moving from a consultancy does not have to mean jumping straight to a full-time Head of Compliance with a team beneath them. There are several stages in between.

For many firms, stage two is the natural first step. A fractional Head of Compliance gives the board a named senior manager embedded in the business at a fraction of the cost of a full-time hire, and the arrangement can scale up as the firm grows. Our article SMF16 and SMF17: one person or two? helps decide whether your first hire should cover both functions.

The cost comparison

The comparison is rarely as simple as consultancy fees versus a salary. On the consultancy side, include the retainer, the ad hoc work billed on top, and the internal time your team spends briefing the consultants. On the in-house side, include base salary, bonus, pension, employer’s National Insurance, training, systems and recruitment.

As a rough guide to the London market, a full-time Head of Compliance at a smaller firm typically commands a base salary between £90,000 and £150,000, and a combined Head of Compliance and MLRO somewhat more. A fractional senior manager working one day a week usually costs between £30,000 and £52,000 a year. Our compliance salary guide carries fuller benchmarks.

The less visible part of the comparison is risk. A compliance leader who is in the business every day is more likely to catch issues early, and the cost of one supervisory intervention or skilled person review can exceed several years of salary.

Managing the handover from your consultancy

The move from a consultancy to an in-house or fractional leader needs careful planning, particularly where the consultancy provides your SMF holder.

Secure the records. Make sure you will receive the compliance monitoring plan and results, the breach and complaints logs, regulatory correspondence, financial promotions approvals, training records and the firm-wide money laundering risk assessment. If the consultancy’s individual was your MLRO, you need the records of internal reports and decisions, handled securely.

Plan the senior manager change. If the consultancy’s individual holds SMF16 or SMF17, the firm will need to notify the FCA when they step down and apply for approval of the replacement. Form C must be submitted within seven business days of the individual ceasing to perform the function. The best approach is usually to have your new hire identified and the Form A application prepared before the consultancy’s individual steps down. If timing slips, the reformed 12-week rule may help; see our page on SMF16 and SMF17 temporary cover.

Overlap where you can. A short overlap between the consultancy and your new hire lets open issues, regulatory relationships and context transfer properly. Our article on senior manager handover best practice lists what a good handover should contain.

Allow for approval time. The statutory deadline for the FCA to decide a complete application is three months. See our guide to how long SMF approval takes.

What to look for in your first in-house Head of Compliance

A builder, not just a maintainer. Your first in-house hire will inherit a framework designed by someone else. They need the judgement to keep what works and the energy to rebuild what does not.

Breadth. In a small team, the Head of Compliance covers everything from monitoring to financial promotions to training. A narrow specialist from a large firm can struggle without a team beneath them.

Prior SMF experience, or a credible path to it. A candidate who has held SMF16 before will reassure the FCA and your board. A strong deputy stepping up for the first time can work, but expect closer scrutiny at interview. Our guide to FCA SMF interviews explains what to expect.

Sector fit. A lender needs consumer credit experience, a payments firm needs financial crime depth, and an advice firm needs suitability and Consumer Duty expertise. See our pages on consumer credit, payments and wealth management compliance recruitment.

Commercial credibility. The best first hires are those the CEO wants in the room, because they find compliant ways to get things done.

Common mistakes

• Hiring too junior. A compliance officer without the experience to hold SMF16 leaves the firm still dependent on a consultancy for senior accountability, at extra cost.
• Giving the title without the authority. A Head of Compliance who is not on the executive committee or invited to board meetings cannot provide real challenge.
• Cutting the consultancy too early. Independent testing and specialist support still add value after an in-house hire. Many firms keep a smaller consultancy arrangement for monitoring.
• Forgetting the MLRO. If the consultancy’s individual was also your MLRO, you need a plan for SMF17 as well as SMF16, and a deputy MLRO.
• Leaving it until a crisis. Recruiting under supervisory pressure narrows your options and your negotiating position.

Frequently asked questions

Can a consultancy hold our SMF16 function?

No firm can hold an SMF; an individual must. Consultancies often provide an individual who is approved as your SMF16, but that person carries personal accountability and the firm remains responsible for its compliance arrangements.

Should our first in-house hire be full-time?

Not necessarily. For many small firms a fractional Head of Compliance working one to three days a week is the right first step. See our page on fractional compliance officer recruitment.

Do we still need a consultancy once we have an in-house Head of Compliance?

Often, yes, for independent monitoring, specialist reviews or projects. The difference is that your in-house leader directs the work rather than relying on it.

How long does the transition take?

Allow for the recruitment itself, the candidate’s notice period and FCA approval. For a permanent hire, three to six months from start to finish is common; a fractional or interim appointment can be much quicker.

Every Core and Enhanced firm under the Senior Managers and Certification Regime needs someone to hold the SMF16 Compliance Oversight function and, where the Money Laundering Regulations apply, someone to hold the SMF17 Money Laundering Reporting function. At larger firms these are clearly two jobs, held by two people with separate teams. At smaller firms the answer is less obvious. Should one experienced Head of Compliance and MLRO hold both, or should the firm appoint two individuals?

It is one of the first questions we discuss with clients on almost every compliance search, and the right answer changes as the firm grows. This article sets out what the rules allow, what the FCA looks for, when combining works, when it is time to split, and the middle options that many firms use in between.

What the rules allow

Nothing in SM&CR prevents one individual from holding both SMF16 and SMF17. The FCA’s approach to the regime, set out on its SM&CR pages, is that firms allocate functions in a way that is proportionate to their size and complexity. A single application can cover more than one function, and combined SMF16/17 holders are common at small Core firms such as IFAs, boutique investment managers and smaller lenders.

What the regime does require is that the individual is fit and proper for each function they hold, has the time to discharge them, and that the firm has an adequate compliance function and adequate anti-money laundering systems and controls. The Money Laundering Regulations 2017 separately require a nominated officer to receive internal suspicious activity reports and decide whether to report to the National Crime Agency. For a fuller explanation of each role, see our guides to SMF16 and SMF17.

What the FCA will look at

When one person holds both functions, the FCA’s questions tend to fall into four areas.

Capacity. Can one person genuinely cover compliance monitoring, regulatory change, board reporting, financial promotions, Consumer Duty evidence, the firm-wide money laundering risk assessment and suspicious activity reporting? In a small advice firm the answer is often yes. In a high-volume lender or payments business it often is not.

Competence across both disciplines. Compliance oversight and financial crime are related but different specialisms. Some excellent compliance professionals have limited hands-on financial crime experience, and some strong MLROs have never run a compliance monitoring programme. A combined holder needs credible experience in both.

Independence of review. The compliance monitoring programme should test the firm’s anti-money laundering controls. If the same person designed those controls and monitors them, the firm needs another source of independent challenge, such as internal audit, an external review or a periodic assessment by a third party.

Resilience. If the combined holder is ill, on leave or resigns, the firm loses both functions at once. The FCA will want to see a deputy MLRO and a plan for cover. Our page on SMF16 and SMF17 temporary cover under the 12-week rule sets out what happens when a combined holder leaves.

When combining SMF16 and SMF17 works well

• Small, low-complexity firms. Directly authorised IFAs, small wealth managers, boutique corporate finance and investment firms, where the compliance workload is steady and financial crime exposure is moderate.
• Firms with low suspicious activity volumes. If internal reports are occasional rather than daily, one experienced person can handle them alongside compliance oversight.
• Newly authorised firms. In the early months, one senior individual can build both frameworks consistently, provided the arrangement is reviewed as volumes grow.
• Firms using a fractional model. A fractional Head of Compliance and MLRO working one or two days a week is often the most cost-effective way for a small firm to get senior capability in both areas.

Our wealth management compliance recruitment page notes that combined holders are common at Core wealth and advice firms for exactly these reasons.

When it is time to split the roles

• Financial crime exposure rises. Payments, e-money, cryptoassets, high-volume consumer lending and cross-border business all bring a level of transaction monitoring, sanctions and fraud risk that usually justifies a dedicated MLRO. Our pages on payments compliance, consumer credit compliance and SMF16 and SMF17 for cryptoasset firms cover those sectors.
• Retail conduct work grows. If the Consumer Duty, vulnerable customers, complaints and financial promotions take up most of the Head of Compliance’s week, money laundering work will suffer.
• Suspicious activity volumes increase. When internal reports and defence against money laundering requests become a daily task, the MLRO role becomes a job in its own right.
• The FCA raises concerns. Supervisory feedback, a skilled person review or a voluntary requirement focused on financial crime or compliance oversight is often the trigger to separate the roles.
• The firm approaches the Enhanced threshold. Enhanced firms usually need deeper functions in both areas.
• The current holder is overstretched. If your combined holder is consistently working beyond their capacity, or one discipline is visibly getting less attention, it is time to split.

The middle options

The choice is rarely just one person or two equal hires. Many firms use an intermediate structure.

A deputy MLRO is worth having in almost every structure. Our AMLRO recruitment page covers that role.

What each option costs

Costs vary by sector, location and firm size, and the figures below are indicative of the London market. Our compliance salary guide and MLRO salary guide carry fuller benchmarks.

• Fractional combined SMF16/17, one day a week: roughly £33,000 to £52,000 a year at typical day rates.
• Full-time combined Head of Compliance and MLRO: base salary typically £100,000 to £160,000, before bonus and on-costs.
• Two full-time holders: often £180,000 to £300,000 or more in combined base salary, before the cost of the teams beneath them.

The real comparison is not just salary. A combined holder who is overstretched can cost far more through missed issues, supervisory intervention or a skilled person review than the price of a second hire.

A simple decision checklist

1. How many internal suspicious activity reports do we receive in a typical month, and how many defence against money laundering requests do we make?
2. How much of our compliance workload is retail conduct work: the Consumer Duty, complaints, vulnerable customers and financial promotions?
3. Does our current or proposed holder have real hands-on experience in both compliance oversight and financial crime?
4. Who independently tests our anti-money laundering controls if the MLRO also runs compliance monitoring?
5. Who would cover both functions tomorrow if our combined holder resigned?
6. Are we adding permissions, products or volumes that will change the answer within the next year?

If the honest answers point in different directions, talk to us. We recruit combined and separate holders, permanent, interim and fractional, through our compliance recruitment and MLRO recruitment practices.

Hiring a combined holder: what to look for

If you decide to combine the roles, the candidate pool narrows. Look for someone who has held both functions before, or held one and deputised for the other. Test their financial crime experience as carefully as their compliance experience: ask how they have handled a difficult internal report, how they have tuned monitoring and how they keep up with sanctions changes. Ask how they would divide their time in a busy month, and how they would arrange independent review of their own controls. Our article on SM&CR interview questions includes questions you can adapt, and our guide to FCA SMF interviews shows what the regulator may ask your candidate.

Frequently asked questions

Is it allowed for one person to be both SMF16 and SMF17?

Yes. SM&CR does not prohibit it, and it is common at smaller Core firms. The individual must be fit and proper for both functions and have the time to perform them.

Does the FCA prefer the roles to be split?

The FCA expects arrangements proportionate to the firm’s size, complexity and risk. At a small, low-risk firm a combined holder is normal; at a firm with significant financial crime exposure, the FCA is more likely to question it.

Do we need a deputy MLRO if the roles are combined?

In practice, yes. Internal reports must be capable of being received and assessed when the MLRO is unavailable, and a combined holder is a single point of failure for two functions.

Can a fractional professional hold both roles?

Yes, at the right kind of firm. See our page on fractional compliance officer recruitment for the typical time commitments.

What’s Actually Changing

The FCA published its final guidance — Policy Statement PS25/23 — in December 2025, closing a consultation process that had been running since 2023. Two things take effect together on 1 September 2026:

• A new Conduct Rule (COCON 1.1.7FR), extending explicit Conduct Rule coverage of non-financial misconduct to solo-regulated firms — asset managers, insurers, wealth managers, payments firms and others — bringing them onto more comparable footing with banks, which have operated under equivalent expectations for some years.
• New Handbook guidance on FIT, clarifying how non-financial misconduct feeds into the existing Fit & Proper assessment — including where the boundary between work and private life sits, how unproven allegations should (and shouldn’t) be weighed, and what “reasonable steps” looks like for managers handling a concern.

The FCA has been explicit about scope: firms are not expected to actively monitor employees’ private lives. The obligation is to act where a firm becomes aware of credible information — typically a formal finding such as a tribunal decision, regulatory sanction, or an internal disciplinary outcome reached through a fair process — that could call an individual’s fitness into question, not to go looking for it.

Why This Matters for Senior Appointments Specifically

The rule applies to conduct from 1 September 2026 onward, but its real bite for hiring firms sits in two places that were already part of the Fit & Proper and regulatory reference framework, now with a materially clearer standard attached:

Regulatory references. Firms will be obliged to disclose serious, substantiated personal misconduct in regulatory references going forward. For a hiring firm, this raises the practical question of whether the reference process it runs is actually probing for this — a template reference request that only asks about disciplinary action for Conduct Rule breaches in the old, narrower sense may not surface what the new guidance now expects to be captured.

Fit & Proper self-disclosure. The FCA’s guidance reinforces that self-disclosure questionnaires need to substantively probe conduct history, not just criminal and regulatory findings. A candidate self-disclosure form built around “have you ever been convicted of…” style yes/no questions was already thin practice before this guidance — it’s now clearly out of step with what the FCA expects firms to be capturing.

What Firms Should Do Before 1 September

The FCA’s own advice ahead of the deadline is for firms to review their approach to staff policies and conduct breach reporting. In practice, that tends to mean:

• Reviewing Conduct Rules training content to ensure NFM scenarios are covered explicitly, not left implicit within a generic “act with integrity” module
• Checking that self-disclosure questionnaires used in recruitment and annual certification substantively probe conduct history
• Reviewing the regulatory reference request and response templates in use, to confirm they align with the broader disclosure standard now expected
• Making sure hiring managers and HR understand where the new COCON rule sits alongside — rather than replacing — the existing Fit & Proper framework under FIT

For the fuller technical detail on how this affects the Fit & Proper Test specifically, see our Fit & Proper Guide, recently updated to cover the new rule. For the Conduct Rules dimension and how it sits within the wider SMCR framework, see our SMCR Guide.

How FD Capital Can Help

FD Capital places CFOs, Finance Directors, MLROs, Compliance Officers and senior risk professionals into FCA and PRA-regulated firms, and Fit & Proper due diligence has always been central to how we run these searches. If you’re recruiting a senior role at an FCA-regulated firm and want to make sure your process is ready for the standard the new guidance sets out, we’re happy to talk it through.

This article is provided for general information purposes and does not constitute legal or regulatory advice. Firms should take their own legal advice on compliance with the new FCA rules. FD Capital Recruitment Ltd is registered at Companies House (no. 13329383) and is operated by an ICAEW-registered practice.

We work with FCA-regulated firms across investment management, payments, consumer credit and wealth every week, placing candidates into exactly these functions. The question we get asked most often — by both firms and candidates — is not “what does the role involve” but “what actually happens if it goes wrong.” This article sets out the honest answer, drawing on real FCA enforcement outcomes rather than theoretical risk.

What the Senior Managers and Certification Regime Actually Changed

Before the Senior Managers and Certification Regime (SM&CR) came into force, regulatory accountability for a firm’s failings sat primarily with the firm itself. Individuals could be swept up in enforcement action, but establishing personal culpability required the regulator to build a case against a specific person’s conduct — often a slow and evidentially difficult process.

SM&CR inverted that dynamic for the most senior roles. Anyone approved to hold a Senior Management Function takes on a statutory Duty of Responsibility. If a regulatory breach occurs within their area of accountability, the burden shifts: the FCA does not need to prove the individual caused the failure. Instead, the individual has to be able to show they took reasonable steps to prevent it, identify it, or stop it continuing. That is a meaningfully different starting position from ordinary employment or even ordinary directorship.

This applies across the full range of Senior Management Functions — not just the compliance-specific ones. SMF1 (Chief Executive), SMF3 (Executive Director), SMF9 (Chairman), SMF16 (Compliance Oversight), SMF17 (Money Laundering Reporting Officer), SMF2 (Chief Finance), and the others each carry their own Statement of Responsibilities, and each holder is personally on the hook for their own area.

The Mechanics of Personal Accountability

A few structural features make SMF liability different from ordinary senior employment:

Personal FCA approval. A firm cannot simply appoint someone to a Senior Management Function. It submits a Form A application, and the individual is vetted and approved by the FCA before they can perform the role. Once approved, their name appears on the FCA’s public register, searchable by clients, counterparties, journalists and future employers alike.

A Statement of Responsibilities. Each SMF holder must have a current, written statement setting out precisely what they are accountable for. This is not internal housekeeping — the FCA can and does request these documents as part of supervisory work, and they form the reference point in any subsequent investigation.

Ongoing certification, not a one-off check. Firms must recertify annually that each SMF holder remains fit and proper. This sits alongside the FCA Conduct Rules, which apply to the individual at all times, not just during a live incident.

Enforcement can outlast the job. The FCA can and does take action against former SMF holders years after they have left a firm, as the cases below show. Moving on does not close the exposure.

What Enforcement Actually Looks Like: Real Cases

The theoretical exposure is significant, but it is worth being precise about how often it actually crystallises, and what it looks like when it does. Individual SMF enforcement cases are genuinely uncommon — but when they happen, the consequences are severe and the reasoning is instructive for anyone stepping into one of these roles.

Steven Smith — MLRO and Compliance Oversight, Sonali Bank (UK). FCA Final Notice, 12 October 2016. The FCA fined Smith £17,900 and prohibited him from ever again performing the MLRO or compliance oversight functions at a regulated firm — a prohibition explicitly extended to cover the equivalent SMF16 and SMF17 functions under the newer regime. What makes this case instructive is what the FCA did, and did not, accept as mitigation. The regulator acknowledged that Smith did not have sufficient senior management support and was overworked. That context reduced the outcome, but did not prevent it: the FCA still found his failings serious in their own right, because he had not taken any of the steps available to an MLRO in that position — escalating concerns to senior management, to the board or relevant committees, to internal audit, through his own annual MLRO report, or directly and confidentially to the FCA itself. Being under-resourced was not, on its own, a defence to failing to escalate. The bank itself was fined £3.25 million separately for the underlying AML systems failings.

David Brian Price — Executive Director and MLRO, CFP Management. FCA Decision Notice, 2023. Price received a financial penalty, a prohibition order, and withdrawal of his approvals. Note this is a decision notice rather than a final notice — procedurally, that means it reflects the FCA’s determination at that stage and can still be referred to the Upper Tribunal, rather than representing a fully concluded matter in the way a final notice does. The FCA’s finding centred on a failure to act with integrity in ensuring a pension transfer model complied with regulatory requirements, with his conduct assessed as reckless rather than merely negligent. Industry commentary at the time noted this was the first individual MLRO enforcement action since the Sonali Bank case nearly a decade earlier, underlining how rare — but how serious — these actions are.

The Trend Line Is Moving in One Direction

Individual cases remain infrequent in absolute terms, but the direction of travel matters more than the historical base rate. In the FCA’s most recent enforcement year, penalties imposed on individuals more than tripled compared to the prior year, and total fines across all enforcement action rose from roughly £38 million to somewhere between £179 million and £186 million. The majority of cases concerned financial crime, deficiencies in anti-money laundering controls, and governance failures — precisely the territory SMF16 and SMF17 holders are personally accountable for.

The FCA has also broadened its toolkit beyond fines: greater use of interventions, authorisation revocations, and other supervisory powers means a firm — and its senior managers — can face serious consequences well before a case reaches formal enforcement and a final notice. Firms under active supervision commonly see voluntary or imposed requirements long before anything becomes public, and named senior managers are the individuals whose conduct and competence come under scrutiny throughout that process.

Why the Fine Is Rarely the Real Penalty

Set against corporate fines running into the tens or hundreds of millions, a £17,900 personal fine can look almost incidental. It is not the number that matters. The prohibition order is the real consequence: a permanent, publicly searchable bar from ever again performing a Senior Management Function at any FCA-regulated firm. For a qualified accountant, compliance professional or executive who has built a career in regulated financial services, that is not a career setback — it is a career ending event in that sector.

This is precisely why candidates who are genuinely qualified to hold SMF16 or SMF17 — people with real, hands-on experience of client money reconciliation, AML frameworks and regulatory reporting — price this risk into what they will accept. A firm advertising one of these functions as a standard management role, without reflecting the personal exposure in the compensation and support structure around it, will struggle to attract someone senior enough to actually carry it well.

Structural Risk Factors Firms Should Address

A handful of structural issues come up repeatedly in FCA findings and in our own conversations with clients building out SMF-holding roles:

Self-review conflicts. Where the same individual prepares financial or compliance information and then signs off on its adequacy in an oversight capacity, that person has a materially harder job demonstrating “reasonable steps” if something goes wrong later. Firms taking on this structure — often unavoidable in smaller regulated businesses — should document how the conflict is managed, for example through an external compliance reviewer or periodic independent audit.

Under-resourcing. In the Sonali Bank case, part of the finding turned on inadequate resourcing and support from senior management. A firm that appoints an SMF16 or SMF17 holder without giving them the budget, headcount or authority to do the job properly is creating exactly the conditions that produced that enforcement outcome.

Handover and transition periods. Where a Senior Management Function is being transferred from one individual to another — common in growing firms bringing regulatory responsibility in-house for the first time — the handover period itself is a point of elevated risk. Responsibilities need to be clearly documented and the incoming holder needs genuine, evidenced readiness before the Form A application goes in, not just proximity to the outgoing holder.

Compensation misaligned with risk. Pricing an SMF-carrying role as though it were a standard operational management position, without reflecting the personal regulatory exposure, tends to either deter genuinely qualified candidates or attract candidates who have not fully understood what they are taking on. Neither outcome serves the firm well.

What This Means in Practice

For firms building out or restructuring their senior management function holders, the practical takeaways are straightforward. Be honest about the scope of accountability in the role from the outset — vague job titles and understated Statements of Responsibilities do not reduce real exposure, they just create confusion later. Resource the function properly, both in terms of budget and organisational authority. Document how any structural conflicts, such as self-review, are managed on an ongoing basis. And compensate the role in line with the personal risk being carried, not simply against a generic finance or compliance manager benchmark.

For individuals considering taking on an SMF16, SMF17 or any other Senior Management Function, the message from the enforcement record is consistent: genuine competence and documented reasonable steps are the best — and largely only — protection available. Enforcement cases turn on whether the individual can show they did what a competent person in that role should have done, with the resources and authority they had. That is worth establishing and evidencing from day one in the role, not after something has already gone wrong.

How FD Capital Helps

We place Senior Management Function holders — SMF16, SMF17, SMF2, SMF18 and related compliance and financial crime roles — into FCA-regulated firms on a permanent, interim and fractional basis. That includes firms taking on regulatory responsibility for the first time, and firms needing experienced cover during a supervisory or enforcement process. Because we work exclusively in this space, we can usually identify candidates with genuine, evidenced hands-on experience of the specific function a firm needs filled, rather than adjacent generalist experience.

If you are building out compliance or financial crime leadership, or need to understand what a role like this should realistically cost given the personal accountability attached, get in touch.

Related Reading