The MLRO Annual Report: What to Include

Where the requirement comes from

The starting point is the FCA Handbook. SYSC 6.3 requires firms within its scope to take reasonable care to establish and maintain effective systems and controls to counter the risk that the firm might be used to further financial crime. As part of that, the firm must ensure appropriate provision of information to its governing body and senior management, including a report at least annually by that firm's money laundering reporting officer on the operation and effectiveness of those systems and controls. SYSC 6.3.9R then requires the firm, unless it is a sole trader with no employees, to appoint an individual as MLRO with responsibility for oversight of its compliance with the FCA's rules on systems and controls against money laundering.

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 reinforce the governance around this. Regulation 21 requires a relevant person, where appropriate to the size and nature of its business, to appoint one individual who is a member of the board or of senior management as the officer responsible for compliance with the Regulations, and to appoint a nominated officer under Regulation 21(3). Regulation 21 also requires an independent audit function to examine and evaluate the adequacy and effectiveness of the firm's policies, controls and procedures. The FCA's Financial Crime Guide confirms that where SYSC 6.3.9R requires a firm to have an MLRO, that individual can be the same person appointed under Regulation 21, so the two regimes join up in practice.

The annual report is where these threads meet. It is the MLRO's structured account of whether the arrangements required by the Regulations are working, delivered to the people the FCA holds responsible for AML. The Financial Crime Guide is explicit that senior management should take responsibility for the firm's anti-money laundering measures, which includes knowing about the money laundering risks to which the firm is exposed and ensuring that steps are taken to mitigate those risks effectively.

The report's governance role

The value of the report lies in what senior management do with it. The FCA's Financial Crime Guide sets out a set of self-assessment questions for firms on governance, and one of them asks directly how regularly senior management commission reports from the MLRO, noting that this should be at least annually, what they do with the reports they receive, and what follow-up there is on any recommendations the MLRO makes. A report that is written, tabled and then ignored fails that test.

The Guide draws the point out further in its examples of good and poor practice. Among the examples of poor practice, it lists the situation where the board never considers MLRO reports. Among the good practice examples for governance, it points to documentation provided to senior management that gives an accurate picture of the risk to which the firm would be exposed. The message is consistent: the report exists to support informed decisions and challenge at board level, not to sit in a folder.

This is why the report should conclude, not just describe. The MLRO is expected to reach a view on the effectiveness of the firm's systems and controls and to make recommendations where improvement is needed, so that senior management have something to act on. A strong report ends with a clear position and a short, prioritised set of actions with owners and timelines, so that the follow-up the FCA expects can actually be tracked.

What the report must cover

SYSC frames the report around the operation and effectiveness of the firm's systems and controls, so that assessment is the spine of the document. The FCA's Financial Crime Guide then describes the kinds of management information that senior management should receive, and this maps closely onto the content an annual report should draw together. That information includes an overview of the financial crime risks to which the firm is exposed, information about emerging risks and any changes to the firm's risk assessment, legal and regulatory developments and their impact on the firm's approach, and an overview of the effectiveness of the firm's financial crime systems and controls.

The Guide's management information examples also cover relevant information about individual business relationships. These include the number and nature of new business relationships, in particular those that are high risk, the number and nature of relationships terminated due to financial crime concerns, the number of transaction monitoring alerts, details of any true sanction hits, and information about suspicious activity reports considered or submitted where relevant. The Guide notes that this information may come from more than one source, including the compliance department, internal audit, the MLRO or the nominated officer, which is exactly why the annual report is useful as a single consolidated view.

The Joint Money Laundering Steering Group has published a suggested aide memoire for the MLRO annual report. It is presented as a helpful framework rather than formal guidance, and it stresses that the report should focus on outcomes rather than simply listing a lot of statistics, and should conclude on the effectiveness of the firm's AML systems and controls while making recommendations for improvement, including on resources. The table below brings together the areas the sources point to.

Assessing systems, controls and the risk assessment

The core of the report is the MLRO's honest assessment of whether the firm's AML systems and controls are working. This is where the report earns its place, because SYSC 6.3 asks specifically for a view on the operation and effectiveness of those controls rather than a description of what they are. The MLRO should look across the whole control environment, from customer due diligence and ongoing monitoring to escalation and reporting, and say plainly which parts are effective, which are under strain and which need investment.

The report should also revisit the firm's risk assessment. The FCA's management information examples include an overview of the financial crime risks to which the firm is exposed, information about emerging risks, and any changes to the firm's risk assessment. The annual report is a natural moment to check whether the business-wide risk assessment still reflects reality, given any new products, new markets, new customer types or new delivery channels the firm has taken on during the year.

Where the assessment identifies weaknesses, the report should be specific about them. The JMLSG framework suggests summarising details of any material control failures identified, including issues that may amount to rule breaches, together with any remedial action taken. Being candid here protects the firm as well as the MLRO, because it demonstrates that problems are surfaced to senior management and dealt with, which is precisely the follow-up the FCA expects. A single place to log and track those actions, such as the control workspace, makes it far easier to show that recommendations were owned and closed.

SARs, monitoring, training and resourcing

Suspicious activity reporting is central to the firm's AML obligations, so the annual report should give senior management a clear view of it. The FCA's management information examples reference information about suspicious activity reports considered or submitted. In practice a good report will cover the volume of internal disclosures made to the nominated officer, how many progressed to external reports to the National Crime Agency, and any themes in what was reported, so that senior management can see whether the firm's detection and escalation routes are working.

Alongside SARs, the report should address ongoing monitoring and sanctions. The Financial Crime Guide's management information examples include the number of transaction monitoring alerts and details of any true sanction hits. The JMLSG framework suggests describing the firm's arrangements for sanctions compliance, such as the lists used, the frequency of checks and who is screened. Training is another expected theme, and the JMLSG framework suggests summarising the firm's training policy along with the timing of any rolling programme, so that senior management can judge whether staff are properly equipped.

Finally, the report should address resourcing. The JMLSG aide memoire is explicit that the report should consider whether resources to assist the MLRO function are sufficient, and the Financial Crime Guide's self-assessment questions ask whether the MLRO has sufficient resources, experience, access and seniority to carry out the role effectively. Raising a resourcing gap in the annual report, in front of the board, is one of the most effective ways an MLRO can secure the support the role needs.

How to produce the annual report

A useful report is built over the year, not assembled the night before the board meeting. Because the FCA's management information examples span risk, controls, relationships, monitoring, sanctions and SARs, the MLRO needs data feeds from several functions, so it helps to agree in advance what information will be gathered and from where. The JMLSG framework is a helpful starting scaffold, but each firm should tailor it to its own business, since SYSC and the Regulations both require arrangements that are proportionate to the size and nature of the business.

The steps below set out a practical way to produce the report. The aim throughout is the outcome the FCA's governance self-assessment describes: a report that senior management genuinely consider, act on and follow up. Structuring the firm's wider financial crime controls and governance records in one place makes the annual data-gathering exercise far less painful.

One final point on tone. The report should conclude, as the JMLSG framework suggests, on the effectiveness of the firm's AML systems and controls, and should carry forward clear, prioritised recommendations. A report that reaches a view and drives a small number of well owned actions will do more for the firm, and for the MLRO personally, than a long document that lists activity without judgement.

Conclusion

The MLRO annual report is a governance document with a clear regulatory home. SYSC 6.3 requires firms to provide their governing body and senior management with a report at least annually from the MLRO on the operation and effectiveness of the firm's systems and controls against money laundering, and the Money Laundering Regulations 2017 and the FCA's Financial Crime Guide set the wider expectations around the roles and the information senior management should receive. Built around an honest assessment of effectiveness, and covering risk, SARs, monitoring, sanctions, training, control failures and resourcing, the report gives the board what it needs to own the firm's financial crime risk.

The test the FCA applies is not whether the report exists but whether senior management commission it, consider it and act on its recommendations. The JMLSG framework is a helpful guide to content, but the judgement, the conclusion on effectiveness and the prioritised recommendations are what make a report worth reading. If you want a single place to gather the evidence, track the recommendations and demonstrate that follow-up happened, you can request a demo to see how a structured platform can support the annual report end to end.

Frequently asked questions