MLRO and nominated officer: a guide for small UK firms

Nominated officer, MLRO and compliance officer: the three labels

Regulation 21 sets out two roles. Guidance uses different names for them.

HMRC’s supervision handbook says appointing an MLRO “is not a requirement of the MLR 2017” and that businesses “may use the term MLRO as a job title”, so check what the role covers in your firm. The CCAB guidance for accountants (July 2026) notes that “the role of the MLRO is not defined in legislation”. The Legal Sector Affinity Group (LSAG) and the SRA use MLRO for the nominated officer and MLCO for the compliance officer. Whatever you call them, your written policy should name each person and their deputy.

Do you need an MLRO? It depends on your set-up

If you work entirely alone, regulation 21(6) says paragraphs (1) and (3) of regulation 21 “do not apply where the relevant person is an individual who neither employs nor acts in association with any other person”. You do not appoint a nominated officer or a compliance officer. HMRC is clear that you “will personally be responsible for fulfilling the duties of the roles”, including making SARs.

If you have even one employee, or you work in association with someone else, you must appoint a nominated officer. That includes a part-time administrator. LSAG’s example of the exemption is a sole practitioner who “does not employ any staff nor use any agents”.

Whether you also need a separate compliance officer depends on the size and nature of your business. Regulation 21(10) says you must base that decision on your firm-wide risk assessment. HMRC generally expects larger or more complex businesses to appoint one. Record your reasoning either way.

Can one person do both jobs? In a small firm, usually yes. HMRC recommends separate people, but accepts this is not always practical in smaller businesses, provided you can give reasons. The SRA reports that around 90% of law firms have one person in both roles.

Who should hold the role

The law sets no seniority level, but HMRC says the person should be trusted, “senior enough to have access to all your customer files and records”, knowledgeable enough to judge whether a SAR is needed, and able to “make independent decisions”. LSAG adds that the decision to report, or not, “must not be subject to the consent of anyone else”.

In a 1–10 person firm this usually means a director, partner or the owner. HMRC and the FCA both expect the person to be based in the UK. CCAB and LSAG stress time and resources: if your nominated officer is also your busiest fee earner or negotiator, plan how reports will be dealt with quickly.

Appointment, notification and approval

Notify within 14 days. Regulation 21(4) requires you to tell your supervisor who your first nominated officer and first compliance officer are, and about any later appointment, within 14 days. HMRC also expects deputies to be notified within 14 days.

Get the person approved. Regulation 26 says no one may be a beneficial owner, officer or manager (BOOM) of an accountancy, tax, legal, estate agency or letting agency firm unless the supervisor has approved them. CCAB and LSAG both treat the nominated officer as a “manager”, and LSAG says the person must be approved “prior to their appointment”. Regulation 26 does allow someone to act while their application is being decided, but HMRC recommends checking for relevant convictions before you appoint anyone.

Sector detail: estate agents, letting agents, accountants, solicitors and financial advisers.

What the nominated officer does

Receives internal reports. Under section 330 of the Proceeds of Crime Act 2002 (POCA), anyone in the regulated sector who knows or suspects money laundering, or has reasonable grounds to, must tell the nominated officer (or the NCA) as soon as practicable. CCAB guidance points out that telling a line manager or colleague “is not enough”.

Assesses each report. Regulation 21(5) says the nominated officer must consider each report “in the light of any relevant information which is available” to the firm and decide whether there is knowledge, suspicion or reasonable grounds for either.

Reports to the NCA when the test is met. SARs go through the NCA’s SAR Portal. Register your firm before you need it. The portal does not keep a copy of what you submit, so HMRC says you should keep a copy of every SAR yourself and store it securely. The SRA adds that SARs should not be kept on client files.

Asks for a DAML when needed. If your firm wants to go ahead with something that could otherwise be a money laundering offence, such as completing a sale or paying money away, the nominated officer must ask the NCA for a defence first. HMRC says you should not go ahead during the notice period, and doing so may be an offence. The notice period is 7 working days, starting on the first working day after the disclosure (POCA s336). If the NCA refuses, you must wait a further 31 days. A court can extend that period by up to 31 days at a time, to a maximum of 186 extra days (POCA s336A). A DAML cannot be given after the event, and it is not an approval of the transaction.

Records every decision. HMRC expects a record of the concern, your assessment and why you did or did not submit a SAR. CCAB suggests a simple reporting log with a reference number for each internal report.

Reports to management. CCAB says the MLRO should report to the board or equivalent “at least annually” in writing. LSAG expects the same. In a small firm this can be a two-page note to the partners or directors.

Keeps training going. Regulation 24 requires regular training for relevant staff and a written record of it. HMRC expects training “as a minimum” once a year. All staff must be told who the nominated officer is, and should know how to report internally and how to avoid tipping off.

Deputies and outsourcing

Appoint a deputy. It is not a legal requirement, but HMRC recommends appointing a deputy “from within your business” to cover absences, and the SRA calls it good practice. HMRC expects deputies, like the nominated officer, to pass the approval check or the fit and proper test. LSAG adds that the MLRO and any deputies need direct access to the SAR Portal and the internal SAR records.

Outsource the help, not the role. Regulation 21(3) requires “an individual in the relevant person’s firm” to be appointed. You can buy in training, policy drafting and advice from a consultant, but the reporting decision stays with your nominated officer. CCAB guidance says that where parts of your procedures are outsourced, the MLRO “retains ultimate responsibility”. The same applies to software: AML Buddy runs your client identity and screening checks and gives you a timestamped report for the file, but whether to make a SAR is always your nominated officer’s decision.

Personal liability, stated plainly

These offences apply to individuals. Reporting promptly and recording your reasons is how you stay on the right side of them.

The failure-to-disclose offences have defences, including a reasonable excuse. Under section 331(7), a court must consider whether the nominated officer followed relevant guidance approved by HM Treasury, such as the CCAB guidance for accountants. A properly made disclosure is also not treated as a breach of confidentiality (POCA s337).

Tipping off does not stop you asking normal questions. HMRC says tactful enquiries are part of customer due diligence. What you must not do is tell the client, or anyone else, that a report has been made or is being considered, where that is likely to prejudice an investigation.

Who does what in a 1–10 person firm

If you are a sole trader with no staff, every row is yours.

Checklist for setting up the role

1. Decide who will be the nominated officer and whether the same person will also be the compliance officer. Record the reasons in your risk assessment.
2. Check the person is eligible and apply for supervisor approval as a BOOM before they take up the role (HMRC approval check, SRA with DBS, professional body or FCA).
3. Tell your supervisor within 14 days of the appointment, and do the same for any deputy and every later change.
4. Name the nominated officer and deputy in your AML policy, with a simple internal reporting form. Our AML policy templates include this section.
5. Register on the NCA SAR Portal before you need it.
6. Set up a confidential SAR log, stored away from client files, with a reference for every internal report and the reasons for each decision.
7. Train every member of staff when they join and at least once a year, and keep a record of who was trained and when.
8. Write a short annual report to the owners or partners, and record what they decided.

Not sure where your firm stands? Try our 2-minute AML health check, then read how to prepare for an HMRC AML inspection and our guide to customer due diligence.

This guide is general information, not legal advice. Your supervisor’s guidance and your own risk assessment decide what is right for your firm.