What Does a Crypto MLRO Do? Compliance Officer Role & Requirements in 2026

The MLRO, or Money Laundering Reporting Officer, is the single most important compliance appointment a crypto business makes. It is the named individual who carries personal responsibility for the firm's anti-money laundering and counter-terrorist financing programme. The role is not unique to crypto: it has existed in banking and professional services for decades. What is new is that licensed and registered crypto firms now sit squarely within the same obligation.

The MLRO has two distinct legal responsibilities. The first is the duty to report suspicion of money laundering to the national financial intelligence unit, for example the National Crime Agency in the United Kingdom. The second is to ensure the firm as a whole complies with the applicable money laundering regulations. Everything an MLRO does flows from those two pillars: the reporting line and the ownership of the control framework.

For a crypto firm specifically, the MLRO must understand more than traditional AML. They need a working grasp of FATF crypto guidance, blockchain analytics, wallet tracing, and the Travel Rule that attaches sender and recipient data to virtual asset transfers. If you are new to the underlying obligations, our companion guide on AML and KYC explained sets out the framework the MLRO is appointed to run.

The MLRO sits at the centre of the firm's financial crime defences. The most visible duty is handling suspicious activity. Staff who notice something unusual raise an internal report to the MLRO, who investigates, gathers context, and decides whether the suspicion warrants a formal Suspicious Activity Report to the authorities. That decision is the MLRO's alone, and it is the point at which a firm's internal concern becomes a legal disclosure.

Beyond reporting, the MLRO owns the AML control framework. That means designing and maintaining the firm's written policies, overseeing customer due diligence and enhanced due diligence, running transaction monitoring, managing sanctions and watchlist screening, and ensuring the Travel Rule data process works for covered transfers. The MLRO also drives staff training so that the people raising internal reports know what to look for.

Crucially, the MLRO is a reporting line to the top of the firm. They are expected to brief the board or senior management on financial crime risk, escalate systemic weaknesses, and act as the firm's main point of contact with the supervisor. Where a firm operates a no-questions-asked model, those defences collapse, which is exactly the failure pattern we examine in our analysis of the risks of no-KYC exchanges.

The terms MLRO, AML compliance officer, and compliance officer are often used loosely, but regulators draw real distinctions. A compliance officer has the broad mandate of keeping the firm within all of its regulatory obligations, including conduct, governance, reporting, and the design of AML policy. The MLRO is the narrower, statutory role focused on suspicious activity reporting and the operational AML function. In larger firms the two are separate people; in smaller firms one person may lawfully hold both, subject to the regulator's approval.

The table below sets out where the responsibilities differ. Getting this structure right is a governance decision that regulators scrutinise closely during licensing, and our compliance advisory service helps firms design a defensible split before they apply.

The obligation to appoint an MLRO is not optional for a regulated crypto business. It flows from international standards down into national law. At the global level, FATF Recommendation 18 requires obliged entities, including virtual asset service providers, to run an internal AML and CFT programme that includes the appointment of a compliance officer at management level, alongside internal policies, employee screening, and an independent audit function.

In the European Union, crypto-asset service providers authorised under MiCA, Regulation (EU) 2023/1114, are designated obliged entities under the EU anti-money laundering framework. That means the full AML and CFT regime applies, not a lighter version: customer due diligence, the Travel Rule for transfers of EUR 1,000 or more, transaction monitoring, five-year record retention, and a named, qualified MLRO. National competent authorities expect to see a clear three-lines-of-defence model and fit and proper key function holders before they authorise a CASP. Our AML and KYC compliance service builds this structure into the licensing engagement.

The same logic applies under legacy national VASP regimes and standalone registrations such as the FCA cryptoasset register in the UK. As the MiCA transitional period for grandfathered VASPs winds down across the EU through 2026, firms moving from a national VASP registration to a full CASP authorisation are finding that the MLRO appointment is examined more rigorously than before, not less.

An MLRO cannot simply be appointed by the firm. The candidate must satisfy the regulator's fit and proper assessment, the test of whether an individual has the honesty, integrity, competence, and financial soundness to hold a key function. The regulator examines AML experience, professional qualifications, criminal and disciplinary history, and the candidate's capacity to actually do the job given other commitments.

In the United Kingdom the role is formalised as SMF17, the Money Laundering Reporting Officer Senior Management Function under the FCA's Senior Managers and Certification Regime. A firm in scope must have an FCA-approved SMF17 holder, and the FCA states that it pays particular attention to the competence and capability of SMF17 candidates, expecting their skills and knowledge to be proportionate to the firm's size and its risk of harm.

For a crypto MLRO, regulators increasingly look for more than a generic AML background. Recognised credentials such as an ACAMS certification, a legal or finance education, and demonstrable knowledge of FATF crypto guidance, the Travel Rule, and blockchain analytics all strengthen the case. Substance matters too: a growing number of supervisors expect the MLRO to be locally resident, genuinely available, and on the firm's own payroll rather than a remote name on the application.

The flip side of holding a key function is personal accountability. The MLRO is not a passive title; it carries individual exposure for the firm's AML failures. Under accountability regimes such as the FCA's Senior Managers and Certification Regime, an approved MLRO can face individual enforcement action, financial penalties, or a prohibition order that bars them from working in regulated financial services.

The exposure also runs to the reporting duty itself. Where an MLRO knows or suspects money laundering and fails to make the required disclosure, that omission can carry personal criminal liability in many jurisdictions, separate from any action against the firm. This is precisely why the role demands genuine authority and resources: an MLRO who is denied the information or independence to do the job is being set up to carry a risk they cannot manage.

For founders, the practical lesson is that the MLRO must be empowered, not just named. A credible candidate will ask hard questions about reporting lines, budget, and board access before accepting the role, because their own licence to operate in the industry is on the line alongside the firm's.

The Suspicious Activity Report workflow is the operational heart of the MLRO role. The five steps below describe the path from an employee's first concern to a filed disclosure and the records that evidence it. The detail varies by jurisdiction, but the sequence is consistent across regimes.