Outsourced MLRO and financial crime support
That stands up to scrutiny.

It visibly drives something. A supervisor traces your CDD triggers and monitoring thresholds back to the risks this document identifies. An assessment refreshed annually that nothing downstream depends on reads as a formality.

Risk-based triggers applied consistently, not case by case. The test is whether two similar customers onboarded months apart were treated the same way, and whether the file shows why enhanced diligence was or was not applied.

Records of how thresholds were set and, more importantly, adjusted — with the reasoning. Back-testing against known cases, and sample testing of transactions that generated no alert at all. The unalerted sample is the part firms skip.

The complete path from the staff member who raised it to your filing decision — including the cases where you decided not to file. Recording the outcome is not the same as recording the reasoning; what has to be visible is that you weighed the information actually available to you at the time.

At least quarterly, and substantive: SAR volumes and outcomes, typology trends, monitoring effectiveness results, CDD remediation status, training completion. Enough that the board could not later say it was unsighted.

Direct access to the board, access to customer and transaction data without asking permission, and the ability to escalate without interference. Firms that appoint an MLRO and then withhold the data are a recurring FCA finding — and the exposure lands on you.

You can appoint an external SMF17, and smaller and newly authorised firms often do. What you cannot outsource is the responsibility: under SYSC 8 the firm stays accountable for the activity and its senior managers keep their SM&CR obligations. A credible arrangement needs a documented agreement, genuine access to systems and management information, enough time allocated to do the job, and board oversight. An application where external support is the firm's only compliance resource will probably be refused.

Personal and criminal. Under POCA ss.330–332, a nominated officer who receives an internal report and does not report to the NCA where there are reasonable grounds for suspicion commits an offence carrying up to five years' imprisonment. It is one of the few roles in a regulated firm where the individual, not the firm, is in the frame.

The obligation is to keep it current, which in practice means reviewing it at least annually and whenever the business changes materially: a new product, a new market, a new distribution channel, or a shift in customer base. An assessment that has not moved while the business has is the version supervisors find hardest to accept.

Firms above the revenue threshold submit the FCA's annual financial crime data return, which the regulator uses to benchmark sectors and identify systemic weaknesses. Whether it applies to you depends on your permissions and revenue, and it is worth confirming rather than assuming — the return is also a useful internal check on whether your own MI can answer the questions it asks.