AML Compliance Officer MLRO

The compliance officer is responsible for the firm's anti-money laundering policies, procedures and controls in day-to-day operation. Article 11(2) of the Anti-Money Laundering Regulation (AMLR) adds three specific tasks. The officer covers the implementation of targeted financial sanctions. The officer is the contact point for competent authorities. The officer reports suspicious transactions to the financial intelligence unit, a task Article 69(6) assigns to this role by name.

Other articles add to the list. The compliance officer draws up the firm's business-wide risk assessment, which management then approves (Article 10(2)). The officer approves the content of the checks on skills and integrity that staff in compliance roles must pass. Those staff must tell the officer about any close private or professional relationship with a client (Article 13). Neither rule applies where the firm is a natural person, or a legal person whose activities one natural person performs (Article 13(4)). The officer also writes the report on how the firm's controls are working, which goes to the management body at least once a year (Article 11(6)).

The AMLR calls the role compliance officer. Some countries use the name money laundering reporting officer, or MLRO, for a comparable role. The regulation does not use that name.

The compliance manager is a member of the firm's management who answers for compliance as a whole. The compliance officer does the daily work. Article 11 of the AMLR requires both functions, and the table shows how they differ.

Neither appointment moves responsibility away from the top. The recitals to the AMLR say that responsibility for compliance rests ultimately with the management body of the firm.

Yes, where the firm's business and size justify it. Article 11(7) allows the same natural person to perform both functions where the nature of the business, including its risks and complexity, and its size justify it. Those functions may also be combined with other functions, so a partner can hold them next to client work.

Where the obliged entity is a natural person, or a legal person whose activities are performed by one natural person only, that person carries out the tasks of Article 11.

A firm in a group has a further option. Where its size and the low risk of its activities justify it, it may appoint as compliance officer someone who performs that function in another entity of the group (Article 11(2)). The group itself needs a compliance manager at group level and, where its activities justify it, a compliance officer (Article 16(2)).

Article 9(4) set 10 July 2026 as the deadline for the EU's Anti-Money Laundering Authority to issue guidelines on what firms should take into account when deciding the extent of their internal policies, procedures and controls, in particular the staff allocated to the compliance functions.

The management body in its management function appoints the compliance officer (Article 11(2)). That is the body responsible for the day-to-day management of the firm. Which body that is depends on how the firm is set up under national law.

The compliance officer may be removed only after prior notification to that management body. The firm must then notify its supervisor and say whether the decision relates to the officer's tasks under the AMLR. The officer may give the supervisor information about the removal, on request or on the officer's own initiative.

Some firms are subject to checks on their senior management under Article 6 of Directive (EU) 2024/1640 or under other EU law. In those firms the compliance officer must be verified against the same requirements.

Independent enough that commercial interests cannot override the officer's decisions. Article 11(4) requires the firm to make sure those decisions are not undermined or unduly influenced by its commercial interests. It must also protect the officer against retaliation, discrimination and other unfair treatment. Article 69(7) repeats that protection for the task of reporting suspicions.

The officer needs a direct line upwards. Under Article 11(5) the compliance officer can report directly to the management body in its management function. Where a supervisory board exists, the officer can report to it independently. The officer can raise concerns and warn the management body where specific risk developments affect the firm.

The officer also needs the means to do the work. The firm must give the compliance functions adequate resources, including staff and technology, in proportion to its size, nature and risks. The persons responsible must have the power to propose any measure needed to make the controls effective (Article 11(3)). Everyone involved in applying the AMLR must have access to the information and data their tasks require (Article 11(5)).