Outsourcing Your MLRO / Compliance Officer? There's one thing you can't outsource.
Can I outsource my MLRO / Compliance Officer and AML team?
This is one of the most common questions we get asked. It usually arrives in one of two forms.
The first version comes from founders preparing an FCA application. They've just realised they need to name an MLRO on the forms, they don't have the budget to hire one full-time, they're not qualified to do it themselves, and the FCA submission deadline they've been chasing for six months is suddenly less abstract.
The second version comes from compliance leaders at firms that already have authorisation, but where the existing AML setup has stopped working. The internal MLRO has left, or moved into a different role, or quietly been doing both jobs for too long. The firm needs cover, options, and a view on whether the answer is hire, outsource, or some combination of the two.
The short answer to both is the same: yes, you can outsource the MLRO function and the wider AML team. No, you cannot outsource the firm's accountability for any of it. And the shape of what good looks like depends entirely on what kind of firm you are, what your AML risk profile actually looks like, and where you are in your growth.
This piece walks through all three of those: what the rules actually allow, when outsourcing is the right answer (and when it isn't), and what good looks like in practice.
The roles you're actually trying to fill
Before any of this becomes useful, it's worth being precise about which roles we're talking about, because the language is loose and the rules are not.
The MLRO (Money Laundering Reporting Officer) is the senior individual responsible for the firm's compliance with the Money Laundering Regulations 2017 and related financial crime obligations. The MLRO receives internal disclosures of suspicious activity, decides whether to file Suspicious Activity Reports with the National Crime Agency, and is the firm's regulated point of contact for AML matters. For FCA-regulated firms, the MLRO function is:
SMF17 under the Senior Managers and Certification Regime, meaning the individual must be approved by the FCA personally and is named on the FCA Register. They carry personal regulatory liability under SMCR and personal criminal liability under the Proceeds of Crime Act 2002.
The Nominated Officer is the term used in the Money Laundering Regulations 2017 themselves. For FCA-regulated firms, the Nominated Officer and the MLRO are the same person. The distinction matters mostly for non-FCA-regulated firms (lawyers, accountants, estate agents under their own AML supervisory regimes) where the Nominated Officer role exists but SMF17 doesn't.
The Deputy MLRO covers when the MLRO is unavailable. This isn't a separately approved SMF function, but the FCA expects firms to have a credible succession arrangement in place. For a single-MLRO firm with no deputy, a couple of weeks of unplanned absence can become a regulatory issue.
The MLCO (Money Laundering Compliance Officer, sometimes referenced via SYSC 3.2.6IR) is the director or senior manager with overall responsibility for the firm's AML systems and controls framework. In smaller firms this is usually the same person as the MLRO. In larger firms, the two roles are separated, with the MLCO focused on strategy and framework and the MLRO focused on operational reporting and SAR decisions.
The wider AML team is everyone else doing the day-to-day work: KYC analysts onboarding new customers, EDD analysts reviewing higher-risk relationships, transaction monitoring analysts working alerts, sanctions screening teams, financial crime investigations, the lot. None of these are individually approved roles. They are operational resourcing.
With those distinctions in place, the rest of the article makes more sense.
Can you outsource your MLRO?
Yes, with one major exception and a number of conditions.
The general principle is set out across the FCA Handbook and the Money Laundering Regulations. SYSC 8 governs outsourcing for FCA-regulated firms, and its central rule is short and unambiguous: outsourcing must not result in the delegation by senior management of their responsibility. You can outsource the activity. You cannot outsource the accountability. Whatever happens, the firm and its senior managers remain on the hook.
That principle applies just as cleanly to AML as to anything else. The MLRO can be an external appointment. The KYC team can be a managed service. The transaction monitoring tooling can be a third-party platform. None of that reduces the firm's responsibility for the quality of its AML controls.
The major exception is dual-regulated firms. Banks, building societies, and certain investment firms that are regulated by both the FCA and the Prudential Regulation Authority sit under PRA expectations that the MLRO will be an employee of the firm, not an external appointment. The PRA's view is that the personal accountability and independence requirements of the role can't be adequately maintained through an outsourced arrangement at that scale of firm. If you're applying for a banking licence, this matters. If you're applying for a Payment Institution, E-Money Institution, MiFID investment firm, consumer credit, or any of the other FCA-only solo-regulated permissions, it doesn't.
The firm-specific approval point is the other thing worth being precise about. Each SMF17 approval is tied to a specific firm. One individual can hold SMF17 for multiple firms simultaneously, which is exactly what makes the fractional model work. But each appointment requires its own application, its own Statement of Responsibilities, its own fitness and propriety assessment, and its own FCA approval. There is no portable SMF17 licence that an MLRO carries from firm to firm.
The approval process itself runs through the FCA's Connect portal, typically takes three to six months, and involves Form A, a Regulatory Reference, and the Statement of Responsibilities. For Enhanced Firms, it can also involve an FCA interview, and the MLRO may hold a Prescribed Responsibility specifically for financial crime prevention, which raises the bar further.
For the wider AML team and the operational AML function, the position is more straightforward. SYSC 8 and SYSC 13.9 set out the rules on outsourcing operational functions, which apply whether the function in question is IT, customer service, or financial crime operations. The firm must do proper due diligence on the provider, have a written agreement, maintain ongoing oversight, ensure the FCA can access information about the outsourced activity, and have a credible business continuity and exit plan.
What firms cannot do is treat outsourced AML as something that has happened to someone else. The 2024 Dear CEO letter to Annex 1 firms on AML common control failings was specifically pointed on this. The FCA found firms relying on generic outsourced processes that hadn't been tailored to the firm's actual risks, and was clear that "one size does not fit all." Outsourcing AML controls is permitted. Outsourcing the thinking about your own AML risk is not.
Should you?
This is where the legal answer stops being useful and the commercial judgement starts.
The case for outsourcing is strong in most fintech contexts, particularly early on.
Cost. A senior, experienced, SMF17-approved MLRO commands a salary that early-stage fintechs almost never need full-time. Day rates for established fractional MLROs run between £900 and £1,400 in the current market, with payments and crypto specialists at the upper end. A fractional engagement might run two or three days a month for a small payments firm, scaling up with growth. The arithmetic against a full-time hire usually favours the fractional model until the firm is well into its growth phase.
Speed. Experienced fractional MLROs are typically already SMF17-approved at multiple firms, and the firms they work with often share characteristics. Onboarding is faster than recruiting, vetting, hiring and inducting a new senior manager from scratch, particularly given the three-to-six-month FCA approval window for any new SMF17 appointment.
Quality. At small firm scale, the calibre of MLRO you can attract on a fractional basis often exceeds what you could attract full-time. A senior compliance professional who runs SMF17 for half a dozen firms and has handled multiple FCA supervisory engagements is a very different proposition from a junior MLRO who has only ever seen one firm and one regulatory dialogue.
Independence. A fractional MLRO doesn't depend on any single firm for their livelihood, which arguably makes them more able to push back on commercially uncomfortable decisions. Independence is one of the things the FCA specifically looks for, and an MLRO whose mortgage depends on next quarter's revenue is structurally compromised in a way that a fractional one isn't.
Application stage specifically. For firms going through FCA authorisation, the case is almost overwhelming. The firm needs an SMF17 nominated and approved as part of the application. The firm doesn't have the revenue to support a permanent senior hire yet. The application benefits from an MLRO who has run other applications and knows what the FCA will look for. Founders who try to nominate themselves as MLRO without the underlying competence frequently fail the FCA's fitness and propriety assessment, lose months in the process, and end up with a worse outcome than if they had brought in an external MLRO from the start.
The case against outsourcing, or rather the case for transitioning out of it, builds over time.
AML risk profile outgrowing the model. A firm processing a few hundred transactions a month, with a predominantly UK retail customer base and a simple product, can run a fractional MLRO indefinitely. A firm processing millions of transactions, with cross-border flows, complex corporate customers, and a higher proportion of higher-risk relationships cannot. The trigger for transition is usually some combination of transaction volume, customer complexity, and geographic reach. Firms tend to underestimate how quickly they cross it.
Cultural integration. The MLRO is meant to influence first-line behaviour. That requires visibility, presence, and the kind of relationships that don't really develop on two days a month. As the firm grows and the AML function becomes more embedded in commercial decision-making, the part-time arrangement starts to feel stretched.
FCA scrutiny. Firms with active financial crime dialogue with the FCA, recent s.166 reviews, or thematic review participation need an MLRO who can be visibly and substantively present. This is the point at which the day rates start running at the upper end of the range, and the point at which the conversation about transitioning to a permanent hire becomes a serious one.
The "title-only" risk. The single most common failure pattern is the firm that has technically appointed an external MLRO but hasn't given them adequate access to systems, data, personnel or the board. They've outsourced the title but not the function. The FCA's supervisory teams are well-practised at spotting this pattern, and the consequences fall on the firm, not the absent MLRO.
For the wider AML team, the picture is different again. Outsourcing KYC, transaction monitoring, EDD and sanctions screening is mainstream and entirely permitted, as long as the firm retains oversight and the controls are tailored to the firm's actual risks rather than generic vendor templates. The mistake firms make here is buying a process rather than commissioning one. A managed KYC service that runs the same checks for every fintech customer it has is not, by itself, an adequate KYC framework for any single firm.
How do you outsource your MLRO (and do it properly)?
Whatever shape your AML setup takes, the test the FCA applies is the same: substance over form. The MLRO function being adequately performed matters. The MLRO function being named on the FCA Register, in isolation, does not.
For a fractional or outsourced MLRO arrangement to stand up under scrutiny, certain things need to be in place.
A written agreement that defines the scope, time allocation, deliverables, and responsibilities of the engagement. Adequate access for the MLRO to the firm's systems, transaction data, customer information, board, and senior management. Documented escalation paths for SAR decisions, regulatory queries, and AML issues. A clear board reporting cadence, with the MLRO producing reports that the board actually reads and engages with. Regular review of whether the arrangement is still proportionate to the firm's risk profile. Business continuity arrangements, including a credible position on what happens if the relationship ends or the individual is unavailable for an extended period.
The same principles apply to the wider AML function. Generic, untailored outsourced controls are the failure pattern the 2024 Dear CEO letter called out specifically. What the FCA looks for is evidence that the firm understands its own AML risks, has designed controls proportionate to those risks, and is actively overseeing the third parties carrying them out. The vendor doesn't get to decide what risk the firm takes. The firm does.
The transition trigger from outsourced to embedded MLRO is worth thinking about early, even if the move itself is some way off. The signs that the fractional model is reaching its shelf life are usually: rising transaction volume, expanding customer profile, geographic expansion, FCA dialogue becoming more substantive, growth in headcount across the first line of defence, and the MLRO finding themselves repeatedly stretched against the time the firm has bought. None of these are reasons to panic. All of them are reasons to start planning the next stage.
Where we come in
We provide outsourced and fractional MLRO services to fintech and regulated technology firms across the UK, both during the FCA authorisation process and on an ongoing basis post-authorisation.
For firms going through authorisation, we hold SMF17 on the application, manage the FCA approval process for the role, and stay in place for as long as the firm needs us. For authorised firms, we run the MLRO function as an extension of your team: receiving internal disclosures, making SAR decisions, owning the AML framework, and reporting to your board. Where it makes commercial sense to keep the MLRO outsourced indefinitely, we'll tell you. Where you've outgrown the fractional model and need to transition to an embedded MLRO, we'll tell you that too, and help with the transition itself.
The same principle applies to the wider AML function. We can hold MLRO and provide deputy MLRO cover, work alongside an internal team you've already built, or scope a hybrid arrangement that fits your specific risk profile and stage of growth. What we won't do is run a generic process and call it bespoke. The 2024 Dear CEO letter on AML common control failings made the FCA's view on that approach very clear.
In summary
"Can I outsource my MLRO and AML team?" almost always carries the same underlying meaning. The founder or compliance leader asking it knows they need an AML function. They know they can't yet justify, or attract, or afford to build it entirely in-house. And they need to know what the FCA will accept.
The answer is yes, in most fintech firm types you can outsource both the MLRO role and the wider AML function, provided you do it properly. You cannot outsource the firm's accountability. You cannot get away with a title-only appointment. And whatever you do, you have to be able to show the FCA that the function is being performed substantively, not just named.
The harder question is what good looks like for your firm specifically. That depends on your firm type, your AML risk profile, your stage, your trajectory, and the kind of FCA dialogue you've got ahead of you. It's a conversation worth having before you set up the arrangement, not after.
If you'd like to talk through what an outsourced MLRO arrangement might look like for your firm, whether you're preparing an FCA application or reviewing an existing AML setup post-authorisation, get in touch. We work with fintech and regulated technology firms across the UK on fractional and outsourced MLRO services, deputy MLRO cover, and the broader AML compliance function.
Comments