Preparing for an MLRO interview with the FCA (SMF17)
What an MLRO's legal and regulatory role covers (MLR 2017 reg 21, SYSC 6.3.9R, SMF17, POCA), what the FCA tests, an MLRO question bank with strong-answer outlines and a two-week preparation plan.
Michaela Clarke
Operations & Compliance Coordinator
On this page
The short answer
An MLRO interview tests whether you can run the firm's anti-money laundering arrangements as described: how the business-wide risk assessment under MLR 2017 reg 18 was built and approved, what happens when customer checks fail, how SARs are handled under POCA, and whether you have the independence, authority and time for the role. SYSC 6.3.9R and SMF17 apply only to firms within their scope, so know which regime covers yours.
What firms should do now
4 steps to get ready
- 1
Trace the risk assessment from inputs to approval
Write one page on who built the business-wide risk assessment, what data it used, who challenged it, who approved it and what changed as a result.
- 2
Document the amber and red onboarding routes
Define each status, what extra information is requested, who signs it off by role and what happens if the customer does not respond.
- 3
Evidence independence and capacity
Record your reporting line, any ownership or commercial conflict, your weekly hours across roles and who covers your absence.
- 4
Rehearse SAR and escalation answers
Prepare an honest account of your SAR experience and the internal route from staff concern to nominated officer decision, with a written rationale.
An MLRO interview is a conversation in which the FCA, or a board, tests whether you can carry out the role described on paper. Prepare by being able to explain, in plain words and with evidence, how the risk assessment was built, how customer checks escalate, what you do when you suspect money laundering, and why you have the independence and capacity to do it. This guide is for future MLROs and for anyone preparing for such a conversation. It complements our broader guide to FCA authorisation interviews and our service page on FCA interview preparation.
Want the full walk-through? Our free guide, Preparing for an MLRO interview, follows an illustrative MLRO through the risk assessment, onboarding outcomes, SARs, independence and time, with strong and weak answers side by side, a full question bank and a two-week preparation plan, with a PDF to download.
The MLRO's legal and regulatory role
There is no single source for the MLRO role. Different instruments apply to different firms, and an interviewer will expect you to know which applies to yours.
| Source | What it says | Who it applies to |
|---|---|---|
| MLR 2017, reg 21(1)(a) | "Where appropriate with regard to the size and nature of its business", appoint one individual who is a member of the board or senior management "as the officer responsible for the relevant person's compliance with these Regulations" | Relevant persons under the MLR 2017 |
| MLR 2017, reg 21(3) to (5) | An individual in the firm "must be appointed as a nominated officer". The firm must tell its supervisor within 14 days of the appointment. A nominated officer who receives a disclosure must consider it and decide whether it gives rise to knowledge or suspicion, or reasonable grounds for it | Relevant persons under the MLR 2017 |
| MLR 2017, reg 21(7) | An electronic money issuer or payment service provider must appoint an individual to monitor and manage compliance with, and the internal communication of, its AML policies, controls and procedures, including providing "information to senior management about the operation and effectiveness of its policies, controls and procedures whenever appropriate and at least annually" | E-money issuers and payment service providers |
| SYSC 6.3.9R | A firm must appoint an individual as MLRO "with responsibility for oversight of its compliance with the FCA's rules on systems and controls against money laundering" and ensure the MLRO has "a level of authority and independence within the firm and access to resources and information sufficient" to carry out that responsibility. A sole trader with no employees is excepted | Firms subject to SYSC 6.3 |
| SUP 10C.6.2R (SMF17) | "The money laundering reporting function is the function of acting in the capacity of the money laundering reporting officer of a firm" | Firms within the SM&CR where SUP 10C Annex 1 lists SMF17 |
| POCA ss 330 to 332 | Offences of failing to disclose, for staff in the regulated sector (s 330) and for nominated officers (s 331) | Regulated sector and nominated officers |
Which regime are you in?
The label "SMF17" matters only if your firm is within the SM&CR. The FCA's SM&CR page describes the regime as applying to FSMA-authorised firms. Payment institutions and e-money institutions are authorised under the Payment Services Regulations 2017 (PSRs) and the Electronic Money Regulations 2011, not FSMA, and their individuals are assessed on the good repute and knowledge and experience test. If you are an MLRO at such a firm, the interview will still cover the same ground, but the legal anchor is regulation 21 of the MLR 2017 rather than SMF17. The FCA's Financial Crime Guide (in its introduction, FCG 1.1) says that where it refers to guidance on SYSC requirements, this "may also be relevant to compliance with... corresponding requirements in the Payment Services Regulations and the Electronic Money Regulations".
For SM&CR firms, our guide to SMF16 and SMF17 in a small firm explains how the functions are allocated and when a firm needs a holder. We do not repeat that here.
The nominated officer and SARs
The MLRO usually holds the nominated officer role. Under POCA s 330, a person in the regulated sector commits an offence if they know or suspect, or have reasonable grounds for knowing or suspecting, that another person is engaged in money laundering, and do not make the required disclosure to a nominated officer or authorised NCA person "as soon as is practicable". Section 331 is the nominated officer's equivalent: an offence if the officer, having received a disclosure, does not make the required disclosure to a person authorised by the NCA Director General "as soon as is practicable". A report to the NCA is a suspicious activity report (SAR).
The FCA's Financial Crime Guide (FCG 3.2.10) says the nominated officer "must then consider whether a report to NCA is necessary based on all the information at their disposal". It lists as poor practice an officer who passes "all internal reports to NCA without considering whether they truly are suspicious" and one who "dismisses concerns escalated by staff without reasons being documented".
What the FCA tests
The business-wide risk assessment
Regulation 18(1) requires a relevant person to "take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject". It must take into account risk factors "relating to... its customers; the countries or geographic areas in which it operates; its products or services; its transactions; and its delivery channels". Regulation 18(4) requires an up-to-date written record of the steps taken, and regulation 18(6) requires the assessment to be provided to the supervisor on request.
Expect to be asked: who wrote it, what data went in, who challenged it, who approved it, and what changed as a result. Regulation 19(2)(b) requires the resulting policies, controls and procedures to be "approved by its senior management". The FCA's guidance asks "How does the risk assessment inform your day-to-day operations?" and lists as good practice evidence that the risk assessment "informs the design of anti-money laundering controls". Our guide to business and customer risk assessments shows how to build one.
Customer due diligence and enhanced due diligence
Regulation 28(12) says the way a firm applies customer due diligence (CDD), and its extent, "must reflect... the risk assessment carried out by the relevant person under regulation 18(1)" and the firm's assessment of risk in the particular case. Regulation 28(11) requires ongoing monitoring, including scrutiny of transactions and keeping CDD information up to date.
Regulation 33(1) requires enhanced due diligence (EDD) in listed cases, including "any case identified as one where there is a high risk of money laundering or terrorist financing" under the firm's own risk assessment, where a customer has provided false or stolen identification and the firm proposes to continue dealing with them, and unusually complex or unusual transactions. Regulation 33(5) lists measures that EDD may include, such as additional independent sources and a better understanding of the customer's background, ownership and financial position.
When onboarding checks come back amber or red
The MLR 2017 do not use the terms amber and red. Those are labels in a firm's own system. The FCA's question is what your procedure does with each outcome. A strong answer covers:
- Definition. What each status means, and which checks or scores produce it.
- Hold. Whether the customer can transact while the case is open.
- Extra information. What you request (for example source of funds, source of wealth, ownership documents) and why, linked to regulation 33(5).
- Sign-off. Who approves, in what role, and how they are kept independent of the sales target. Senior management approval is mandatory for politically exposed persons under regulation 35(5)(a). For other high-risk cases, the regulations leave the approval route to your procedures, so name it.
- Failure. What happens if the information is not provided. Regulation 31(1) requires a firm unable to apply CDD to refuse to establish the relationship or carry out transactions, to terminate an existing relationship, and to "consider whether the relevant person is required to make a disclosure" under POCA or the Terrorism Act 2000.
- Record. Where the decision and rationale are logged, and how you test that the procedure is followed.
Third-party tools
Firms often rely on external providers for ID verification, screening and customer records. An interviewer will ask which you use, how you chose them, what they cover and what they do not. The duties in regulations 28 and 33 are placed on the relevant person, so a vendor does not take over your legal responsibility. Be ready to explain how you test the tool's output, how you handle false positives and false negatives, who reviews alerts, and what happens if the tool is down.
Keeping controls fit for purpose as the business grows
Regulation 19(1)(b) requires policies, controls and procedures to be regularly reviewed and updated, with a written record of changes. Regulation 19(4)(c) requires measures so that when new products, business practices or technology are adopted, the money laundering risks are assessed. Regulation 21(7)(d) expects the MLRO of a payment or e-money firm to give senior management information on operation and effectiveness "at least annually". The FCA's guidance states: "Firms must regularly review their risk assessment to ensure it remains current" (FCG 3.2.3). Bring a growth scenario: more customers, a new corridor, a new product, a new agent. Say which control would break first and what you would change.
SAR experience
The question "Have you ever completed a SAR?" is common. If you have, be ready to describe, without breaching confidentiality or tipping off anyone, what prompted it, how you decided, how you recorded your reasons and what the report contained. The FCA's guidance on good practice is that SARs "set out a clear narrative of events and include detail that law enforcement authorities can use". If you have not filed one, say so, then explain what you would do on receiving an internal report and how you would learn the process. Do not exaggerate.
Independence and conflicts
SYSC 6.3.9R(2) requires "a level of authority and independence within the firm". The FCA's guidance lists as good practice that the MLRO "is independent, knowledgeable, robust and well-resourced, and poses effective challenge to the business where warranted", and has "a direct reporting line to executive management or the board". It lists as poor practice an MLRO who "lacks credibility and authority, whether because of inexperience or lack of seniority". Although SYSC 6.3 applies to specific firms, payment and e-money applicants are asked the same questions.
The conflict that comes up most is the MLRO who is also a shareholder, a director with commercial targets or a person who holds another control role. If you hold half the votes, say how a decision to decline a profitable customer would be protected from being overruled by the owners, and what you would do if it were.
Time and capacity
The FCA asks for hours, not percentages. For SMF candidates, FIT 2.2.1G asks "whether the person has adequate time to perform the controlled function and meet the responsibilities associated with that function". Prepare a weekly timetable showing your hours across roles, the busiest periods and who covers when you are absent. SYSC 6.3.9R(2) also asks for "access to resources and information sufficient" for the role. For options on cover and outsourcing, see our guide to MLRO resourcing.
MLRO question bank
These questions are drawn from a recent payment institution interview, from preparation packs we have produced for firms and from the FCA's own guidance. The second column outlines what a strong answer covers.
Role and independence
| Question | A strong answer covers |
|---|---|
| What are your responsibilities as MLRO and nominated officer? | Oversight of AML compliance, receipt and assessment of internal reports, SARs, annual reporting to the board, training, and regulator liaison. Cite regulation 21 |
| How will your decisions be independent if you are also an owner or hold another role? | Direct line to the board, written authority to refuse or exit customers, no commercial targets, a route to escalate, and an example of a decision that cost revenue |
| How many hours a week will you spend on the role? | A figure in hours, a calendar, named deputy cover, and how it scales with volume |
| Who do you report to and how often? | Named recipient, frequency, content of the MLRO report and what the board did with the last one |
Risk assessment and policies
| Question | A strong answer covers |
|---|---|
| Walk me through how the business-wide risk assessment was put together and approved. | Inputs under regulation 18(2), sources, who challenged it, the approval record, and one change it caused |
| Which risks rank highest and why? | Customer, geography, product, transaction and channel risks, with the controls that mitigate each |
| How often is the assessment reviewed, and what triggers an earlier review? | A review cycle and named triggers: new product, corridor, agent, incident or regulatory change |
| Which legislation and guidance did you use? | MLR 2017, POCA, the FCA's Financial Crime Guide and industry guidance, with an example of how each shaped a control |
Customer due diligence
| Question | A strong answer covers |
|---|---|
| How do you onboard a customer, step by step? | Identification, verification, purpose of relationship, screening, risk rating and activation, with who does each step |
| If checks come back amber or red, what happens? | Status definitions, hold, escalation route and timescales |
| What extra information do you ask for, and who signs it off? | Source of funds and wealth, ownership evidence, rationale, a named approver, and what happens if the customer refuses |
| When do you decline or exit a customer? | Regulation 31 triggers, the risk appetite statement and a SAR consideration step |
| How do you treat politically exposed persons? | Identification process, senior management approval, source of wealth and funds, enhanced monitoring |
Systems, monitoring and growth
| Question | A strong answer covers |
|---|---|
| Which third-party systems do you use for screening, ID verification and customer records? | Names, purpose, due diligence on the provider, testing of output, ownership of alerts and failure plan |
| How is transaction monitoring generated and reviewed? | Rules and thresholds, who reviews alerts, timescales, escalation to the MLRO and a sample of a closed alert |
| How will you keep controls fit for purpose as the business grows? | Volume and risk triggers, resourcing plan, annual effectiveness review, assurance or audit |
| What would you change first if volumes doubled? | A specific weak point and the planned fix |
Suspicion reporting
| Question | A strong answer covers |
|---|---|
| Have you ever completed a SAR? | An honest answer, with the process: internal report, assessment, decision, filing, record, and handling of customer contact without tipping off |
| What happens when a colleague raises a concern? | Channel, acknowledgement, assessment, written rationale and feedback to the colleague |
| How do you keep a record of decisions not to report? | A log with reasons, reviewed by someone other than the decision maker |
| How do staff know what to do? | Training, procedure, examples of red flags and testing |
Two-week preparation plan
| Days | Focus | Output |
|---|---|---|
| 1 to 2 | Collect the documents: risk assessment, AML policy, onboarding flow, escalation procedure, last MLRO report, organisation chart | One folder and a list of gaps |
| 3 to 4 | Re-read the risk assessment against regulation 18. Trace who approved it and what changed | One-page summary of how it was built and approved |
| 5 to 6 | Walk a customer through onboarding, including an amber case and a red case. Name every decision maker | A flow chart and a sign-off table |
| 7 | List third-party tools with their purpose, limits and owner | Tool register |
| 8 to 9 | Prepare SAR answers: your experience, the internal reporting route and the decision log | Short written notes and an example, anonymised |
| 10 | Draft your independence and time answers: ownership, reporting lines, weekly hours and cover | A timetable and an escalation statement |
| 11 to 12 | Mock interview aloud using the question bank. Record it and listen back | A list of vague or inconsistent answers |
| 13 | Fix inconsistencies between documents and between people | Updated documents |
| 14 | Final run-through; prepare your own questions; rest | A short crib of facts and figures, not a script |
How MEMA can help
MEMA Consultants prepares MLROs and boards for regulator and role interviews. We test the risk assessment, the onboarding flow and the escalation route, rehearse the questions that are hardest to answer and help you close gaps before you are asked about them. We do not script answers or promise outcomes. Start with the FCA interview preparation page, see our support for MLROs and financial crime leads or our financial crime services, and book a call if you want to talk it through.
Frequently asked questions
Do I need to be approved as SMF17?
Only if your firm is within the SM&CR and SUP 10C Annex 1 lists SMF17 for it. SUP 10C Annex 1 also notes that, for a limited scope firm that is a sole trader, the money laundering reporting function does not apply where the sole trader has no employees. Payment and e-money firms are assessed on the good repute and knowledge and experience test instead.
Is the MLRO personally liable for failures?
The POCA offences in sections 330 and 331 attach to individuals, including nominated officers, who fail to make required disclosures. Section 331(6) provides a defence of reasonable excuse. Whether any individual is liable in a particular case depends on the facts, so take legal advice on specific situations.
Can the MLRO role be outsourced?
Firms use external support, but the firm still needs an accountable individual with enough knowledge, capacity and authority. See our guide to MLRO resourcing and our explainer on the outsourced MLRO.
Will the FCA tell me the questions in advance?
For SMF approvals the FCA says: "We will tell you in advance what areas we wish to explore at the interview." For other applications, ask the case officer for the topics.
Need expert regulatory guidance?
Our ex-regulator team helps firms work through complex requirements and evidence compliance with confidence.