Money Laundering Reporting Officer (MLRO): role and responsibilities
If you have just been appointed MLRO, or you are the founder who has to appoint one, the job title tells you very little about what the role actually entails.
An MLRO is the person a regulated firm makes responsible for its anti-money laundering programme and, in particular, for deciding whether to report suspicious activity to the Financial Intelligence Unit. One named individual makes this decision, and in the UAE that individual can now be fined personally.
This guide sets out the MLRO responsibilities, the day-to-day, how the reporting decision works, how the UAE, the wider GCC and the UK differ, and where the role most often goes wrong.
MLRO's Responsibilities: Key Takeaways |
|
|
|
|
|
|
|
|
What is an MLRO?
An MLRO, Money Laundering Reporting Officer, is the senior individual a regulated business appoints to oversee its anti-money laundering and counter-terrorist financing controls and to receive, assess and, where justified, report suspicious activity to the national Financial Intelligence Unit.
The role exists because regulators want a single accountable person, at management level, who owns the AML programme and the reporting decision rather than a committee or a shared inbox.
In UAE federal law, the role is called the Compliance Officer; the Central Bank of the UAE, the DFSA, the ADGM and VARA all use “MLRO”.
In Bahrain, it is “MLRO” and “deputy MLRO”.
In the UK, the statutory role is the “nominated officer”, and the FCA regulates it as the SMF17 function. The duties overlap heavily, but the exact obligations come from each regime’s own text, which is why this article treats them separately.
Why regulators require the role: FATF Recommendation 18
FATF Recommendation 18 asks countries to require financial institutions to have programmes against money laundering and terrorist financing. Its Interpretive Note lists the appointment of a compliance officer at management level as one of the pillars of that programme.
FATF does not write national law; each country turns this into its own requirement, and the UAE’s Joint Guidance on the CO/MLRO function cites exactly this note as the origin of the role.
What are the main responsibilities of an MLRO?
An MLRO is responsible for the firm’s AML programme end to end:
overseeing transaction monitoring and screening
receiving internal reports and deciding whether to file with the FIU
keeping policies and the business risk assessment current
advising senior management on high-risk customers
training staff
acting as the point of contact for the regulator and the FIU
reporting to the board, and making sure records are kept
The precise list depends on the jurisdiction, but across the UAE, Bahrain and the UK those nine areas appear in some form in every rulebook.
Responsibility | What it means in practice | What a supervisor expects to see |
Transaction monitoring and screening oversight | Knowing how the monitoring system is designed, which scenarios it covers and how alerts are handled | Scenario documentation, tuning records, alert backlogs and ageing |
Suspicious report decisions | Receiving internal reports and alerts, assessing them, deciding to file or not, and documenting why | A decision log for every internal report, including the ones not filed |
AML programme, policies and risk assessment | Keeping policies consistent with the law and the firm’s own risk assessment, and proposing updates | Dated policy versions, a current business-wide risk assessment |
High-risk customer advice | Being consulted before senior management onboards or keeps a high-risk customer | Minutes showing the MLRO’s view and, where overruled, the recorded rationale |
Training | Designing, running and documenting training for staff, management and the board | Training plans, attendance records, content tailored to the firm’s risks |
Contact point | Answering requests from the regulator, the FIU and law enforcement, and giving them access to records | Response times, a log of requests and replies |
Reporting to the board and regulator | Periodic reports on the state of the programme, STR statistics, gaps and remediation | Board papers, the compliance report, evidence it was discussed |
Sanctions compliance oversight | Overseeing the screening programme and the handling of freeze orders | Screening configuration, freeze and unfreeze records |
Record keeping | Making sure CDD, transaction, STR and training records are retained for the required period | Retention policy, retrieval tests |
Overseeing transaction monitoring and screening
The MLRO responsibilities do not include running every alert personally. However, the UAE Joint Guidance expects the MLRO to understand the functionality and design of the transaction monitoring software, the scenarios it covers and the procedures for handling alerts.
In practice, this means the MLRO should be in the room when thresholds are set or tuned.
Appendix 1 of the same guidance lists “not sufficiently involved in the decision-making process for key controls such as sanctions screening, transaction monitoring and tuning” as a deficiency supervisors have found in practice.
Advanced Transaction Monitoring Tool
Detect, prevent, and resolve suspicious activities in real-time with azakaw’s AI-powered AML solution. Adopt a smarter and faster monitoring system that reduces false positives.
Deciding on suspicious transaction reports
This is the core of the role and responsibilities of a Money Laundering Reporting Officer, and it cannot be delegated away. Staff and systems raise suspicions; the MLRO decides.
In the UAE, the decision is to notify the FIU or to retain the matter with documented reasons, in full confidentiality.
In Bahrain, the MLRO makes the external report to the Financial Intelligence Directorate.
In the UK, the nominated officer decides whether a disclosure goes to the National Crime Agency.
The common thread is that the “no” decisions must be as well documented as the “yes” decisions, because that is what a supervisor will sample.
Maintaining the AML programme, policies and risk assessment
Policies are only useful if they match the law, the regulator’s current expectations and the firm’s actual risk. The MLRO has the responsibility to review them, test whether the business is following them and propose changes.
The Joint Guidance adds that the MLRO should develop or oversee the methodology for the business-wide risk assessment and its periodic refresh.
Advising on high-risk customers
The Joint Guidance expects the MLRO to be consulted before senior management takes a final decision to onboard or keep a high-risk customer.
Senior management can disagree, but if it does, the rationale and the mitigating measures should be recorded. This gives the MLRO a formal voice without turning every onboarding into an MLRO sign-off.
Read more on how firms classify these relationships in our guide to high-risk customers.
Training staff, senior management and the board
Training is a statutory duty in the UAE and a listed responsibility in Bahrain and the UK.
The expectation is not a generic annual e-learning module but a documented programme that reflects the firm’s own typologies and reaches the board as well as frontline staff.
Our article on AML training covers what a credible programme looks like.
Acting as the contact point for the regulator and the FIU
When the FIU asks for additional information on a report, or the supervisor requests records during an inspection, the MLRO answers.
The Joint Guidance also describes the MLRO as the primary point of contact for law enforcement requests and investigations.
Keeping records
The MLRO does not personally file every document, but is responsible for making sure the firm meets its retention obligations.
In the UAE, Cabinet Resolution No. 134 of 2025 requires records of transactions, CDD, ongoing monitoring and suspicious transaction reports to be kept for at least five years, with the clock running from the latest of several possible trigger events, including the end of the relationship or the completion of an inspection.
How does an MLRO decide whether to file a suspicious transaction report?
The MLRO receives an internal report or a monitoring alert, prioritises it, reviews the customer, the transaction and the context, and then decides whether there are reasonable grounds for suspicion.
If there are, the report goes to the FIU without delay. If there are not, the MLRO records why. At no point is the customer told that a report has been considered or filed.
The steps below are an illustrative example of how many firms organise this; they are not a mandated procedure, and each firm should follow its own regulator’s instructions.
Receive. An employee files an internal report, or the monitoring or screening system generates an alert.
Prioritise. High-risk situations, such as a potential sanctions match or an imminent outbound payment, are assessed first. The Joint Guidance expects a documented prioritisation process.
Review. The MLRO or the investigations team looks at the customer profile, expected activity, source of funds, counterparties and transaction history. An unusual transaction is a reason to look, not proof of anything.
Decide. Either there are reasonable grounds to suspect that funds are linked to a crime, or there are not. A red flag alone is rarely enough; the question is whether the explanation available fits.
File or document. If filing, the report goes to the FIU through its electronic system with all available information. If not, the reasons are recorded and kept.
Follow-up. After a report, the firm may add the subject to an internal watchlist, change the customer’s risk rating or increase monitoring. The Joint Guidance lists these as expected post-filing actions.
Keep it confidential. Nobody outside the need-to-know group, and never the customer, is told. In the UAE, the prohibition on disclosing that a report has been or may be filed applies to directors, officers and employees.
A fuller treatment of the filing side is in our guide to suspicious transaction reports and our article on how to report money laundering.
What does the MLRO report to the board and the regulator?
The MLRO's responsibilities also include reporting upward on the state of the AML programme:
how the firm’s risk exposure is changing
which regulatory changes need to be absorbed
the results of the business-wide risk assessment
the number and outcome of internal and external reports
resource constraints
the findings of audits and inspections together with remediation progress
In the UAE, this report also goes to the supervisor; in Bahrain it is an annual report to the board; in the UK the FCA expects an annual MLRO report to senior management.
The UAE position deserves care. Cabinet Resolution No. 134 of 2025 requires periodic reports to be submitted directly to senior management, with a copy sent to the supervisory authority on request, including senior management’s observations and decisions.
The earlier Cabinet Decision No. 10 of 2019 required semi-annual reports, and the UAE Joint Guidance still describes a bi-annual compliance report on that basis. Firms should follow the frequency their own supervisor currently instructs rather than assume either reading.
What matters more than frequency is content. The Joint Guidance lists “lack of reporting or inadequate reporting, and communication to relevant stakeholders” among the deficiencies supervisors have found.
A report that gives the board nothing to decide on is a report that has not done its job.
MLRO vs compliance officer vs deputy MLRO: what is the difference?
In many firms, the compliance officer owns the overall AML programme and the MLRO owns the reporting decision, while the deputy MLRO steps in when the MLRO is absent.
In the UAE, federal law names a single Compliance Officer who holds both sets of duties, and CBUAE guidance refers to that person as the MLRO; the split is a matter of how a firm organises its work, not a legal distinction.
VARA is the exception, treating the Compliance Officer and the MLRO as separate appointments under its Compliance and Risk Management Rulebook.
Role | Focus | Typical tasks | Reports to |
MLRO | The reporting decision and the AML/CFT programme | Assess internal reports and alerts, file with the FIU, oversee monitoring and screening, train, liaise with the regulator | Senior management and the board; the supervisor for the compliance report |
Compliance officer (where separate) | Regulatory compliance across the business | Policies, compliance monitoring, regulatory change, conduct and licensing matters | Senior management and the board |
Deputy / alternate MLRO | Continuity | Support the MLRO, take over in their absence, often handle day-to-day case work | The MLRO; the board in the MLRO’s absence |
A deputy is a formal requirement in several regimes, not a nice-to-have.
The DFSA requires Authorised Firms to appoint a deputy; Bahrain’s CBB Rulebook requires a deputy MLRO who must be resident in Bahrain unless agreed otherwise; and CBUAE guidance for some sectors refers to an Alternate Compliance Officer with their own appointment conditions.
What are an MLRO’s responsibilities in the UAE?
In the UAE, every financial institution, DNFBP and virtual asset service provider must appoint a Compliance Officer at management level, who has independence in decision-making and appropriate competence and experience.
Article 22 of Cabinet Resolution No. 134 of 2025 gives this officer five statutory duties, and supervisory authorities must approve the appointment in advance. CBUAE guidance treats this Compliance Officer as the firm’s MLRO.
On top of the statute sits a cross-regulator Joint Guidance that spells out what supervisors expect to see in practice.
Article 22 lists the Money Laundering Reporting Officer’s duties as:
Monitoring transactions related to the crime.
Reviewing records and assessing suspicious transaction data, then deciding whether to notify the FIU or to retain the matter with documented reasons, in full confidentiality.
Reviewing the internal AML/CFT/CPF systems and procedures, assessing their consistency with the law, evaluating the firm’s level of compliance, proposing updates, and preparing periodic reports submitted directly to senior management, with a copy to the supervisor on request.
Developing, implementing and documenting training programmes for employees.
Cooperating with the supervisory authority and the FIU, providing data on request and giving their staff access to records.
Article 49(18) of the same Resolution requires each supervisory authority to keep an updated list of the Compliance Officers of the entities it supervises, notify the FIU, and require prior approval before an appointment.
In other words, the MLRO is a regulator-approved position across the UAE, not an internal title.
What the UAE Joint Guidance on the CO/MLRO function adds
The Joint Guidance on the AML/CFT/CPF Compliance Officer/Money Laundering Reporting Officer Function was issued by the UAE Supervisory Sub-Committee and applies to entities supervised by the CBUAE, the SCA, the Ministry of Justice, the Ministry of Economy & Tourism, the DFSA, the FSRA, VARA and the General Commercial Gaming Regulatory Authority.
It states that it is guidance, not legislation, and that the law prevails where they differ. What it adds is operational detail:
The CO/MLRO should hold a senior position, be operationally independent, have direct access to the board, and be free of conflicts of interest, including not having day-to-day responsibility for sales or customer relationship management.
The board should give the CO/MLRO the resources the role needs, naming transaction monitoring tools, sanctions screening systems and timely access to data among them.
The CO/MLRO should be subject to a fit and proper assessment on appointment.
The expanded role list covers transaction monitoring oversight, STR/SAR decisions with a prioritisation process, policies, the AML/CFT/CPF programme, the business risk assessment, the sanctions compliance programme, consultation on high-risk customers, training, the contact-point role, the compliance report and oversight of record keeping.
DIFC, ADGM and VARA: where the rules differ
The financial free zones and Dubai’s virtual asset regulator layer their own rulebooks on top of federal law.
The DFSA’s AML module and the ADGM’s AML Rulebook both require an MLRO who is resident in the UAE (the DFSA with stated exceptions for certain categories), and the DFSA requires Authorised Firms to appoint a deputy.
VARA’s Compliance and Risk Management Rulebook requires VASPs to appoint an MLRO who is a fit and proper person, reviews that appointment annually, and keeps the MLRO separate from the Compliance Officer appointment.
Rule references and residency exceptions should be checked against the current version of each rulebook.
Can the MLRO role be outsourced?
It depends on the regulator, and the texts do not say the same thing.
The Joint Guidance states that the CO/MLRO role and the entire compliance function must not be outsourced under any circumstances, while specific AML tasks, such as enhanced due diligence, training or system support, may be outsourced after obtaining a letter of no objection from the supervisor.
DFSA guidance, by contrast, refers to an externally appointed MLRO who must have the seniority and capacity the role requires.
A firm should ask its own supervisor rather than rely on a general answer.
How do MLRO requirements compare across the GCC and the UK?
The duties converge, but the title, the appointment process and the reporting rhythm differ by regime.
The table covers only positions verified against a primary source at the time of writing; Qatar, Oman and Kuwait are not included for that reason.
Jurisdiction | Who must be appointed | What stands out |
UAE (federal) | A Compliance Officer at management level, approved in advance by the supervisor. CBUAE guidance calls this person the MLRO. | Five statutory duties under Cabinet Resolution No. 134 of 2025. Periodic reports go directly to senior management. |
DIFC (DFSA) | An MLRO, ordinarily resident in the UAE, plus a deputy for Authorised Firms. | The MLRO is a licensed function and reports to the governing body at least annually. |
ADGM (FSRA) | An MLRO, resident in the UAE, with appropriate seniority, experience and independence. | The appointment is filed with the Regulator. |
Dubai VASPs (VARA) | An MLRO who is a fit and proper person, separate from the Compliance Officer. | The appointment is reviewed every year. Suspicious transactions go to the UAE FIU; records are available to VARA on request. |
Bahrain (CBB) | An MLRO approved by the CBB in advance, resident in Bahrain, plus a deputy MLRO. | The role cannot be outsourced. Annual report to the board. A vacancy must be filled within 180 days. |
Saudi Arabia | A senior officer responsible for the AML/CTF compliance function: the compliance officer under SAMA’s guide, the MLRO under the CMA rules. | Senior management must appoint a director or senior manager with direct responsibility for AML/CFT compliance. |
United Kingdom | A nominated officer under the Money Laundering Regulations 2017; FCA firms hold this as the MLRO (SMF17), approved by the FCA. | A nominated officer who fails to make a required disclosure can commit an offence under the Proceeds of Crime Act. |
Fully Compliant Everywhere
Learn how azakaw makes MLRO life easier with an AI-powered AML solution that uses regulator-specific templates or allows you to create your own rules and workflows.
Who can be appointed as MLRO?
An MLRO has to be senior enough to make a reporting decision that business lines will not like, independent enough that nobody can override it, and experienced enough to understand the firm’s risks and the law.
Every regime examined here requires management-level seniority and some form of fitness and propriety check, and most require the regulator’s prior approval.
Seniority, independence and access to the board
The UAE Resolution requires the Compliance Officer to be at management level with independence in decision-making.
The Joint Guidance adds direct access to the board and freedom from conflicts, and lists “absence of a dedicated and independent CO/MLRO who holds a senior position” and “restricted access to senior management and the board” as deficiencies found in practice.
Bahrain’s rulebook is explicit that the MLRO must be a member of senior management with authority to act without interference from business line management, and must not be combined with roles that create conflicts, such as internal auditor or business line head.
Fit and proper checks and regulator approval
The Joint Guidance expects a fit and proper test covering integrity, qualifications, experience and skills, supported by a documented professional path in AML/CFT.
VARA reviews the appointment annually. In the UK, SMF17 holders are individually approved by the FCA. Our guide to the best AML certifications covers the qualifications regulators and employers tend to look for.
Can an MLRO be held personally liable?
Yes. In the UAE, this is no longer just a theoretical point. On June 24, 2026, the Central Bank of the UAE fined a foreign bank branch AED 20 million for repeated anti-money laundering, counter-terrorist financing, and sanctions failures.
Additionally, the branch's Head of Compliance and Money Laundering Reporting Officer was personally fined AED 300,000 for failing to carry out his duties.
The bank was not named, and the penalties were imposed under the Central Bank law.
The practical lesson is not that MLROs should fear the regulator, but that the role needs to be able to evidence what it did: that it was consulted, that it reported upward, that it asked for resources, and that its decisions were documented.
An MLRO without authority or resources is exposed precisely because none of that evidence will exist.
In the UK, personal exposure runs through a different route: a nominated officer who fails to make a required disclosure can commit a criminal offence under the Proceeds of Crime Act.
Where do MLROs most often fall short?
Appendix 1 of the UAE Joint Guidance lists the deficiencies supervisors have observed when assessing the CO/MLRO function.
They are a useful self-assessment for any firm:
Limited oversight of the firm’s compliance programme and local operations, with tasks outsourced to or run from regional offices.
The CO/MLRO not sufficiently involved in decisions on key controls such as sanctions screening, transaction monitoring and their tuning.
Limited oversight of quality assurance over the application of customer due diligence.
No or limited oversight of search and freeze orders received from the FIU.
Absence of a dedicated, independent CO/MLRO holding a senior position.
Inadequate oversight of the remediation of gaps identified in gap analyses.
Lack of adequate reporting and communication to the board, senior management and the supervisor.
Lack of experience and understanding of the UAE’s AML/CFT/CPF obligations.
Lack of accountability or ownership.
Insufficient seniority and restricted access to senior management and the board.
Not understanding what a tailored, fit-for-purpose AML/CFT/CPF programme requires for the firm’s risk.
Most of these are governance failures rather than technical ones. They are fixed by a written mandate, a reporting line to the board and the resources to exercise oversight, not by another policy document.
Audit-Proof Your MLRO Function
Most enforcement fines stem from poor governance, not bad policies. Empower your compliance team with automated evidence tracking and full operational control.
How technology helps with the MLRO responsibilities
An MLRO’s accountability is personal, but the evidence that supports it is produced by systems: the monitoring scenarios, the screening configuration, the case files and the records.
The Joint Guidance expects the board to give the MLRO transaction monitoring tools, sanctions screening systems and timely access to data, and expects the MLRO to understand how the monitoring system is designed.
What the role needs from that technology is fairly specific:
Monitoring the MLRO can explain. Documented scenarios and thresholds, and a record of every tuning change, so the MLRO can show involvement in the decisions supervisors ask about.
Screening with a manageable alert load. High false positive rates consume the hours the MLRO needs for the decisions that matter.
Case management with a decision trail. Every internal report and alert, its review, its outcome and the reasons, retrievable for the retention period.
Onboarding data the MLRO can reach. KYC and KYB information, risk ratings and UBO details available when a high-risk customer decision is being taken.
Audit-ready records. Reports, approvals and overrides captured where an inspector can find them.
azakaw, the MLRO's Best Friend
azakaw brings onboarding, AML and sanctions screening, transaction monitoring and case management into one platform with records built for audit, which gives an MLRO a single place to oversee the controls the role is accountable for.
Frequently asked questions
What does MLRO stand for?
MLRO stands for Money Laundering Reporting Officer. The “reporting” in the title is deliberate: whatever else the role covers, its defining duty is to decide whether the firm files a suspicious transaction or activity report.
Who does the MLRO report to?
To senior management and the board, and to the supervisory authority for the periodic compliance report. The Joint Guidance expects direct access to the board, and Bahrain’s rulebook requires the annual report to go to the board with a copy to senior management.
Can a director or business owner be the MLRO?
It depends on the regulator and on conflicts of interest.
The UAE Joint Guidance expects the MLRO not to have day-to-day responsibility for sales or customer relationships, and Bahrain’s rulebook prohibits combining the role with functions that create conflicts, such as business line head.
Smaller firms often combine MLRO and compliance officer, which Bahrain permits where the business is limited in volume and spread.
Do real estate brokers, law firms and other DNFBPs need an MLRO?
In the UAE, yes. Cabinet Resolution No. 134 of 2025 requires financial institutions, DNFBPs and VASPs alike to appoint a Compliance Officer at management level.
Real estate brokers, dealers in precious metals and stones, lawyers, notaries, accountants and company service providers all fall within the DNFBP definition when carrying out the listed activities.
What goes into an MLRO report?
Typically, the state of the AML programme, changes in risk exposure, regulatory developments, the results of the business-wide risk assessment, internal and external report statistics, resource constraints, and audit and inspection findings with remediation status.
The Joint Guidance lists these as the matters the MLRO should discuss with the board.
What happens when the MLRO is absent or resigns?
The deputy or alternate acts in their place where one is required. Bahrain’s rulebook requires interim arrangements immediately and a CBB-approved permanent replacement within 180 days of the vacancy. UAE supervisors require prior approval of any new appointment.
What is the difference between an MLRO and a nominated officer?
In the UK, “nominated officer” is the statutory term under the Money Laundering Regulations 2017 and the Proceeds of Crime Act for the person who receives internal disclosures and decides on external ones.
“MLRO” is the FCA’s term, regulated as SMF17. In most FCA-regulated firms, the same person holds both.
What qualifications does an MLRO need?
No regime examined here prescribes a specific certificate. The UAE Joint Guidance expects a documented professional path in AML/CFT, VARA requires a fit and proper person, and regulators assess experience and integrity rather than a qualification.
Recognised certifications help evidence competence.
How long must AML records be kept?
In the UAE, at least five years from the latest of the relevant trigger events, which include the completion of the transaction, the end of the business relationship, the closure of the account, the completion of an inspection or investigation, or a final court judgment. Other jurisdictions set their own periods.
Conclusion
The MLRO is the person a regulated firm has chosen to be accountable for its defences against money laundering and terrorist financing. The duties are clear enough on paper: monitor, decide, report, train, cooperate and keep records.
What determines whether the role works is whether the firm gives it the seniority, independence, information and tools it needs, and whether the MLRO can later show what was done and why.
In the UAE, where the regulator has now fined an MLRO personally, that evidence is the difference between a role that protects the firm and one that merely carries the blame.
Related articles
DISCLAIMER: This content is provided for general informational purposes and does not constitute legal or regulatory advice. AML and compliance requirements, including the title, duties and appointment conditions of the Money Laundering Reporting Officer, vary by jurisdiction, business type and regulatory status, and are subject to change. Organisations should consult the applicable legislation, the guidance of their own supervisory authority and qualified legal or compliance professionals where necessary.
Sources
Cabinet Resolution No. 134 of 2025 (Articles 3, 19, 21, 22, 25, 49), uaelegislation.gov.ae
Joint Guidance on the AML/CFT/CPF Compliance Officer/MLRO Function in the UAE, Supervisory Sub-Committee, centralbank.ae
CBUAE Rulebook, section 2.2.1 Role of the Compliance Officer/MLRO
CBUAE press release, 24 June 2026, penalty on a branch of a foreign bank and its Head of Compliance and MLRO
Central Bank of Bahrain Rulebook, Financial Crime module FC-4 (Volume 5 text consulted; amended May 2026)
VARA Compliance and Risk Management Rulebook, Part III.A
DFSA AML module; ADGM FSRA AML Rulebook chapter 12 (seen in excerpts)
SAMA AML/CTF Guide; CMA AML/CTF Rules (seen in excerpts)
FATF Recommendation 18 and Interpretive Note; UK Money Laundering Regulations 2017, POCA 2002, FCA SYSC 6.3
