MEMA Guides / MLRO interviews
Preparing for an MLRO interview: a practical guide
What the FCA or a board is testing, how to explain your risk assessment, onboarding and suspicion reporting, and a two-week plan to prepare.
- 14 daysto tell your supervisor after appointing a nominated officer (regulation 21(4))Source
- At least annuallyinformation to senior management on how well AML policies, controls and procedures work (regulation 21(7)(d), payment and e-money firms)Source
The guide in 30 seconds
Practical guidance- 01Explain how it was builtBe able to say who wrote the risk assessment, what went in, who challenged it, who approved it and what it changed.
- 02Name every decision makerFor an amber or red customer, say who decides, what they need and what happens if the customer does not provide it.
- 03Be honest about SARs and timeSay what you have and have not done, and give your hours as a number with named cover.
Explore the chapters
Read them in order, or jump to the one you need.
01The MLRO's legal and regulatory roleThere is no single source for the MLRO role. Different instruments apply to different firms, and an interviewer expects you to know which applies to yours.
02The business-wide risk assessmentExpect to be asked who wrote the risk assessment, what data went in, who challenged it, who approved it and what changed as a result.
03Customer due diligence: when checks come back amber or redThe regulations do not use the words amber and red. They are labels in your own system. The FCA's question is what your procedure does with each outcome.
04SARs, independence and timeThese questions test you, not your documents: whether you have reported suspicion, whether you could say no to an owner, and whether you have the hours.
05Question bank, mock interview and two-week planUse the question bank to find answers you cannot yet give, then follow a two-week plan that starts with the documents and ends with rest.
Chapter 01 · The starting point
The MLRO's legal and regulatory role
There is no single source for the MLRO role. Different instruments apply to different firms, and an interviewer expects you to know which applies to yours.
An MLRO interview is a conversation in which the FCA, or a board, tests whether you can carry out the role described on paper. This guide is for future MLROs and for anyone preparing for that conversation. It covers the legal role, what the FCA tests, answer frameworks for the hardest questions and a two-week plan. Our Insights article "Preparing for an MLRO interview with the FCA (SMF17)" gives the short version; this guide goes further with worked examples.
Where appropriate with regard to the size and nature of its business, a relevant person must... appoint one individual who is a member of the board of directors... or of its senior management as the officer responsible for the relevant person's compliance with these Regulations
| Source | What it says | Who it applies to |
|---|---|---|
| MLR 2017, reg 21(1)(a) | Appoint one board or senior management member as the officer responsible for compliance, where appropriate to size and nature | Relevant persons under the MLR 2017 |
| MLR 2017, reg 21(3) to (5) | Appoint a nominated officer, tell your supervisor within 14 days, and have the nominated officer consider disclosures | Relevant persons under the MLR 2017 |
| MLR 2017, reg 21(7) | An appointee to monitor and manage AML compliance, giving senior management information on effectiveness at least annually | E-money issuers and payment service providers |
| SYSC 6.3.9R | Appoint an MLRO with authority, independence and access to resources and information sufficient for the job | Firms subject to SYSC 6.3 |
| SUP 10C.6.2R | Defines the money laundering reporting function (SMF17) | Firms within the SM&CR where SMF17 is listed |
| POCA ss 330 to 331 | Offences of failing to disclose, for regulated-sector staff and for nominated officers | Regulated sector and nominated officers |
The MLRO in a small payment firm: the jobs behind the title
Overseer of AML compliance
Owns the risk assessment, policies and controls, and checks they work.
Nominated officer
Receives internal reports and decides whether to report to the National Crime Agency.
Reporter to the board
Gives senior management information on how well controls work, at least annually.
Trainer and adviser
Makes sure staff know what to do and who to tell.
Regulator contact
Is the person the FCA expects to speak to about financial crime.
The FCA's Financial Crime Guide says that where it refers to guidance on SYSC requirements, this "may also be relevant to compliance with... corresponding requirements in the Payment Services Regulations and the Electronic Money Regulations" (FCG 1.1). SYSC 6.3 and FCG 3.2 do not apply to such firms by their own terms. They are the benchmark the FCA uses in interviews, which is why this guide uses them.
Chapter 02 · What the FCA tests first
The business-wide risk assessment
Expect to be asked who wrote the risk assessment, what data went in, who challenged it, who approved it and what changed as a result.
Regulation 18(1) requires a relevant person to "take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject". It must take into account risk factors relating to its customers, the countries or geographic areas in which it operates, its products or services, its transactions and its delivery channels (regulation 18(2)(b)). Regulation 18(4) requires an up-to-date written record of the steps taken, and regulation 18(6) requires the assessment to be provided to the supervisor on request.
Five questions you will be asked about the risk assessment
Stage 1 of 5
1. Who wrote it?
Name the person, their role, and what they relied on. If a consultant helped, say what you changed and why.
- Name the author and the date
- Say what you added to any template
- Be ready to explain every section
Stage 2 of 5
2. What went in?
The regulation 18(2) factors: customers, geography, products, transactions and delivery channels, with the data and sources behind each.
- List the data sources
- Show how each factor was rated
- Say what you could not measure yet
Stage 3 of 5
3. Who challenged it?
Show that someone other than the author tested it, such as a director, an adviser or a peer firm, and what they changed.
- Name the challenger
- Show one change they caused
- Record it in the document history
Stage 4 of 5
4. Who approved it?
Regulation 19(2)(b) requires the resulting policies, controls and procedures to be approved by senior management. Show the record.
- Cite board or committee minutes
- Show the approval date
- Say who attended
Stage 5 of 5
5. What did it change?
The FCA asks how the risk assessment informs day-to-day operations and treats it as good practice when it informs the design of controls.
- Name one control the assessment shaped
- Say what you stopped or restricted as a result
- Show the review date
| Factor | Example risk | Rating | Control it drives |
|---|---|---|---|
| Customers | Small businesses with complex ownership | Higher | Ownership evidence before activation |
| Geography | Payments to two corridors with weaker local controls | Higher | Lower limits and monthly review of the corridor |
| Products | Cash-in at agent locations | Medium | Agent training and limits |
| Transactions | Rapid in and out with little retained balance | Higher | Monitoring rule on pass-through activity |
| Delivery channels | Fully remote onboarding | Medium | Document verification plus liveness check |
Worked example: "Walk me through how the risk assessment was put together"
Weak answer
- "We used a template and adapted it."
- No named author, challenger or approver
- Cannot say which risks rank highest or why
- "We review it regularly."
Strong answer
- "I wrote it in March from our customer and corridor data, my co-director challenged it, and the board approved it on 14 April."
- Customer, geography, product, transaction and channel risks, each with a rating and a control
- One change it caused: lower limits on a corridor
- Review every six months, and sooner after a new product, corridor or agent
Regulation 19(1)(b) requires policies, controls and procedures to be regularly reviewed and updated, and regulation 19(4)(c) requires measures so that the money laundering risks of new products, business practices or technology are assessed. The FCA's guidance says: "Firms must regularly review their risk assessment to ensure it remains current" (FCG 3.2.3). Expect a growth scenario in the interview: say which control would break first if volumes doubled, and what you would change.
Before you are asked about the risk assessment
- Read it against regulation 18 and tick each factor you can evidence
- Write one page on how it was built, challenged and approved
- Find the approval record and confirm the date
- Pick one control it changed, and one thing you decided not to do
- Note the review date and the triggers for an earlier review
- Prepare one growth scenario and the control that would break first
Chapter 03 · Controls in practice
Customer due diligence: when checks come back amber or red
The regulations do not use the words amber and red. They are labels in your own system. The FCA's question is what your procedure does with each outcome.
Regulation 28(12) says that the way a firm applies customer due diligence (CDD), and its extent, "must reflect... the risk assessment carried out by the relevant person under regulation 18(1)" and the firm's assessment of risk in the particular case. Regulation 28(11) requires ongoing monitoring, including scrutiny of transactions and keeping CDD information up to date.
Regulation 33(1) requires enhanced due diligence (EDD) in listed cases, including "any case identified as one where there is a high risk of money laundering or terrorist financing" under the firm's own risk assessment, where a customer has provided false or stolen identification and the firm proposes to continue dealing with them, and unusually complex or unusual transactions. Regulation 33(5) lists measures EDD may include, such as additional independent sources and a better understanding of the customer's background, ownership and financial position.
What a strong answer covers
Definition and hold
What each status means, which checks or scores produce it, and whether the customer can transact while the case is open. Give an example of an amber case and a red case.
Extra information
What you request, such as source of funds, source of wealth or ownership documents, and why, linked to regulation 33(5).
Sign-off
Who approves, in what role, and how they stay independent of the sales target. Senior management approval is mandatory for politically exposed persons under regulation 35(5)(a). For other high-risk cases the regulations leave the route to your procedures, so name it. Say where the decision is logged.
Failure
What happens if the information is not provided. Regulation 31(1) requires a firm unable to apply CDD to refuse the relationship or transactions, terminate an existing relationship, and "consider whether the relevant person is required to make a disclosure" under the Proceeds of Crime Act or the Terrorism Act 2000.
| Status | What it means | Customer can transact? | Who decides |
|---|---|---|---|
| Green | Identity verified, no screening hits, lower-risk profile | Yes, standard limits | Onboarding analyst |
| Amber | A hit to review, incomplete ownership evidence or a higher-risk country | No, until cleared | MLRO or deputy |
| Red | Failed identity check, adverse media match or unexplained source of funds | No | MLRO, with a SAR consideration recorded |
| PEP | Politically exposed person or a close associate | No, until approved | Senior management, as regulation 35(5)(a) requires |
Worked example: "What happens if checks come back amber?"
Weak answer
- "We investigate and decide."
- No definition of amber, and no named approver
- No answer on whether the customer can transact
- Silent on what happens if the customer does not reply
Strong answer
- "Amber means an unresolved screening hit or incomplete ownership evidence. The account stays on hold."
- "We ask for the ownership chart and source of funds, and a second analyst reviews. I sign off."
- "If the customer does not respond in 10 working days, we decline and I record whether a SAR is needed."
- Every step is in the case log, which I sample monthly
Third-party tools: what to be ready to explain
- Which tools you use for ID verification, screening and customer records, and what each is for
- How you chose them, and what due diligence you did on the provider
- What each covers and what it does not
- How you test its output yourself, and how you handle false positives and false negatives. The duties in regulations 28 and 33 sit on you, not the provider
- Who reviews alerts, and how quickly
- What happens if the tool is down, and who owns the failure plan
Chapter 04 · The personal questions
SARs, independence and time
These questions test you, not your documents: whether you have reported suspicion, whether you could say no to an owner, and whether you have the hours.
The MLRO usually holds the nominated officer role. Under section 330 of the Proceeds of Crime Act 2002 (POCA), a person in the regulated sector commits an offence if they know or suspect, or have reasonable grounds for knowing or suspecting, that another person is engaged in money laundering, and do not make the required disclosure to a nominated officer or an authorised National Crime Agency (NCA) person "as soon as is practicable". Section 331 is the nominated officer's equivalent. A report to the NCA is a suspicious activity report (SAR). Section 331(6) provides a defence of reasonable excuse, and whether anyone is liable in a given case depends on the facts.
must then consider whether a report to NCA is necessary based on all the information at their disposal
Nominated officer practice, in the FCA's words (FCG 3.2.10)
Poor practice
- Passes all internal reports to the NCA without considering whether they truly are suspicious
- Dismisses concerns escalated by staff without reasons being documented
Good practice
- Considers each report on all the information available
- Files SARs that "set out a clear narrative of events and include detail that law enforcement authorities can use"
- Records the reasoning, including for decisions not to report
Answering "Have you ever completed a SAR?"
Answer the question first
Yes or no, in one sentence. Do not exaggerate. If you have not filed one, say so.
If yes, describe the process
What prompted it, how you decided, how you recorded your reasons and what the report contained, without breaching confidentiality or tipping off anyone.
If no, say what you would do
On receiving an internal report: acknowledge it, assess it on all the information, write down the decision and reasons, file where required, and manage customer contact so no one is tipped off.
Show the record
Describe the log of decisions not to report, and who other than the decision maker reviews it.
Independence: three common set-ups
You hold shares, or half the votes.
- Show a direct line to the board and a written right to refuse or exit customers
- Say how a decision to decline a profitable customer is protected from being overruled by owners
- Have an example of a decision that cost revenue
You are also Compliance Officer or a director.
- Explain which decisions you take as which role
- Say who challenges you when you check your own work
- Show a second line or outside review for the combined role
An external provider supports an in-house MLRO.
- The firm still needs an accountable individual with knowledge, capacity and authority
- Be clear what the provider does and what only you can decide
- Show how the provider reports to you and how you oversee it
SYSC 6.3.9R(2) requires the MLRO to have "a level of authority and independence within the firm" and access to resources and information sufficient for the role. The FCA's guidance lists as good practice an MLRO who "is independent, knowledgeable, robust and well-resourced, and poses effective challenge to the business where warranted", with "a direct reporting line to executive management or the board". It lists as poor practice an MLRO who "lacks credibility and authority, whether because of inexperience or lack of seniority". For time, FIT 2.2.1G asks "whether the person has adequate time to perform the controlled function and meet the responsibilities associated with that function". The FCA asks for hours, not percentages.
An illustrative weekly timetable. The figures are made up. Replace them with your own, and show the busiest week and who covers when you are absent.
Illustrative example Not FCA figures. Use your own.
Self-check: are your personal answers ready?
Tick each area your plan already covers. Your ticks stay in this browser only.
Chapter 05 · Putting it together
Question bank, mock interview and two-week plan
Use the question bank to find answers you cannot yet give, then follow a two-week plan that starts with the documents and ends with rest.
These questions are drawn from a recent payment institution interview, from preparation packs we have produced for firms and from the FCA's own guidance. They are not a script. The right-hand column outlines what a strong answer covers.
| Question | A strong answer covers |
|---|---|
| What are your responsibilities as MLRO and nominated officer? | Oversight of AML compliance, internal reports and SARs, reporting to the board, training and regulator liaison. Cite regulation 21 |
| How will your decisions be independent if you are also an owner or hold another role? | Direct line to the board, written authority to refuse or exit customers, no commercial targets, and an example of a decision that cost revenue |
| How many hours a week will you spend on the role? | A figure in hours, a calendar, named deputy cover, and how it scales with volume |
| Who do you report to and how often? | Named recipient, frequency, content of the MLRO report and what the board did with the last one |
| Which risks rank highest and why? | Customer, geography, product, transaction and channel risks with the controls that mitigate each |
| How often is the risk assessment reviewed, and what triggers an earlier review? | A review cycle and named triggers: new product, corridor, agent, incident or regulatory change |
| Which legislation and guidance did you use? | MLR 2017, POCA, the FCA's Financial Crime Guide and industry guidance, with an example of how each shaped a control |
| Question | A strong answer covers |
|---|---|
| How do you onboard a customer, step by step? | Identification, verification, purpose of relationship, screening, risk rating and activation, with who does each step |
| When do you decline or exit a customer? | Regulation 31 triggers, the risk appetite statement and a SAR consideration step |
| How do you treat politically exposed persons? | Identification, senior management approval, source of wealth and funds, enhanced monitoring |
| How is transaction monitoring generated and reviewed? | Rules and thresholds, who reviews alerts, timescales, escalation to the MLRO and a sample of a closed alert |
| What would you change first if volumes doubled? | A specific weak point and the planned fix |
| What happens when a colleague raises a concern? | Channel, acknowledgement, assessment, written rationale and feedback to the colleague |
| How do you keep a record of decisions not to report? | A log with reasons, reviewed by someone other than the decision maker |
| How do staff know what to do? | Training, procedure, examples of red flags and testing |
Illustrative example Not FCA figures. Use your own.
The two weeks, day by day
- Days 1-2Collect the documentsRisk assessment, AML policy, onboarding flow, escalation procedure, last MLRO report, organisation chart. Output: one folder and a list of gaps.
- Days 3-4Re-read the risk assessmentAgainst regulation 18. Trace who approved it and what changed. Output: a one-page summary.
- Days 5-6Walk an onboarding caseInclude an amber and a red case and name every decision maker. Output: a flow chart and a sign-off table.
- Day 7List third-party toolsPurpose, limits and owner. Output: a tool register.
- Days 8-9Prepare SAR answersYour experience, the internal reporting route and the decision log. Output: short notes and an anonymised example.
- Day 10Independence and timeOwnership, reporting lines, weekly hours and cover. Output: a timetable and an escalation statement.
- Days 11-12Mock interview aloudUse the question bank, record it and listen back. Output: a list of vague or inconsistent answers.
- Day 13Fix inconsistenciesBetween documents and between people. Output: updated documents.
- Day 14Final run-throughPrepare your own questions and rest. Output: a short crib of facts and figures, not a script.
How to run the mock interview
Choose someone who has not read your documents
They ask what a reader would ask. A colleague who knows the answers lets you skip the hard parts.
Use the real conditions
Camera on, no script, about an hour. Ask the five questions you fear most, then a few you have not seen.
Record, listen, score
Mark each answer specific, consistent, owned and honest about limits. Vague answers go on the fix list.
Fix and repeat
Update the document or the answer, then rerun the questions that failed.
Questions to ask the interviewer
- Which areas will the conversation cover, and who will be there?
- Is there a document you would like to see beforehand?
- What information do you need from me afterwards, and by when?
- Will the conversation be recorded?
- What happens next, and when will we hear?
Where this comes from
Sources
Every number and rule in this guide comes from these pages. Check them before you rely on anything, as rules change.
- Money Laundering Regulations 2017, regulation 18
- Money Laundering Regulations 2017, regulation 19
- Money Laundering Regulations 2017, regulation 21
- Money Laundering Regulations 2017, regulation 28
- Money Laundering Regulations 2017, regulation 31
- Money Laundering Regulations 2017, regulation 33
- Money Laundering Regulations 2017, regulation 35
- Proceeds of Crime Act 2002, section 330
- Proceeds of Crime Act 2002, section 331
- FCA Handbook SYSC 6.3: Financial crime
- FCA Handbook SUP 10C.6: Money laundering reporting function
- FCA Handbook FIT 2.2: Fitness and propriety, honesty, integrity and reputation
- FCA Handbook FCG 3.2: Money laundering and terrorist financing, governance and risk assessment
- FCA: Senior Managers and Certification Regime
- FCA: How we assess SMF candidates
- Payment Services Regulations 2017, regulation 6
This guide is general information, not legal or regulatory advice. Rules and FCA expectations change; check the sources and take advice on your firm's circumstances.