MLRO responsibilities: A first-100-days checklist

1. Get your appointment letter on file

The board or senior management must appoint you in writing, with the scope and the authority spelled out. Inspectors ask for this early, and a verbal appointment is not an answer.

What the role is in law

The Criminal Justice Act does not use the title MLRO. Section 54 lets the Central Bank direct a firm to appoint an individual at management level, which the Act calls a compliance officer, to monitor and manage compliance with its AML policies, and separately to appoint a member of senior management with primary responsibility for AML measures. The Central Bank’s AML guidelines expect both roles to exist in any firm of substance, or a documented reason why not. In regulated financial firms the senior role has been a pre-approval controlled function since April 2022: PCF-52, Head of Anti-Money Laundering and Counter Terrorist Financing Compliance. The compliance officer role is a controlled function in its own right, so the firm has to certify your fitness and probity every year.

The guidelines also say what the compliance officer needs in order to function: an independent reporting line to the board, unrestricted and direct access to any information and to adequate resources, enough seniority to be heard, and being reachable by staff who have a concern. If any of those is missing, the letter is the place to fix it.

What the letter should say

• Which legal entities and business lines you cover
• Your authority to file a report without anyone’s sign-off, to stop a transaction, and to see any record in the firm
• Your reporting line to the board and the right to go to it directly
• Your deputy, by name, and who acts when you are both away
• The budget and the people allocated to the function
• The date, and the Central Bank approval reference if the role is a PCF

2. Read the business-wide risk assessment

It should be current and should describe your actual client book. If it is more than twelve months old, or reads like a template with the firm name dropped in, refreshing it is the first substantive job.

What section 30A requires

The business risk assessment is a statutory document. Section 30A requires it to weigh at least five factors: the types of customer, the products and services, the countries the firm operates in, the types of transaction, and the delivery channels. It has to take account of the national risk assessment and of Central Bank guidance, it has to be documented, and it has to be kept up to date. An inspector reads it to decide whether the firm understands its own exposure before looking at anything else.

A good one rates inherent risk for each factor, names the controls that reduce it, states the residual risk, and shows the data the ratings rest on: how many customers in each risk band, how many PEPs, which jurisdictions, which products. It carries the date the board approved it and the trigger events that would force a refresh before the next annual cycle, such as a new product, a new market or a change in the national assessment.

3. Read the AML policies and procedures

They have to line up with the Acts, with Central Bank guidance, and with the risk assessment. Look specifically for gaps in beneficial ownership, sanctions screening, enhanced due diligence triggers, STR escalation, tipping-off safeguards, training cadence and record retention.

The policy set the Act expects

Section 54 says what the policies must cover: assessing and managing risk, internal controls including internal reporting, monitoring, customer due diligence, suspicious transaction reporting, record keeping and training. Since 2018 the firm also needs a specific, independent and anonymous channel through which staff can report breaches of the Act internally, proportionate to its size. The Central Bank guidelines add that the board approves the policies and any material change, and that they are formally reviewed at least once a year.

The commonest defect is a policy that restates the Act instead of describing the firm. “Enhanced due diligence will be applied where the risk is high” is not a procedure. The procedure says which customers, which extra documents, who approves, and where the approval is recorded.

4. Meet the team

Sit with each team lead and ask how CDD is applied in practice, what makes someone escalate, who has been trained, and how a PEP gets identified. The gap between the policy and the practice is where most AML failures live, and you will only find it by asking.

Six questions that find the gap

• Show me the last customer you onboarded, and walk me through the file
• When did you last decide not to take someone on, and why?
• What would make you pick up the phone to me?
• How do you know a customer is a PEP?
• What happens to an alert nobody has time to look at?
• When were you last trained, and on what?

5. Review the STR log

Look at internal escalations and filed reports over twelve months against the size and risk of the client book. Zero escalations from a firm of any size is a red flag. So is a high volume with no recorded outcomes.

What the log should record

For every internal escalation: the date and time it reached you, your decision and the reasoning, including the decisions not to report, the time any report went to FIU Ireland and Revenue through goAML, and what happened with the customer afterwards. Section 42 requires the report as soon as practicable after the suspicion forms, and the firm cannot proceed with the transaction until the report has been sent, so the log needs timestamps rather than dates. The guide to suspicious transaction reports covers the decision itself.

6. Check sanctions screening

Confirm screening happens at onboarding and on an ongoing basis, and that the lists cover EU, UN, and where relevant OFAC and HMT. Pull a random sample of clients and ask to see the evidence.

When screening finds a match

The Central Bank is the competent authority for financial sanctions at financial firms, and its instruction is unambiguous: freeze the account or stop the transaction immediately, then report the hit through the Financial Sanctions Return Form on the Central Bank Portal. The procedure should say who decides whether a hit is a true match, how that decision is recorded, who files the return, and whether a suspicious transaction report is also needed. Check too that the lists update automatically. A screening tool working from last month’s list is a control that does not exist.

7. Audit the training file

Twelve months of records: who was trained, when, what they scored, and which version of the content they took. If the answer is a folder of slide decks with an attendance sheet, this is the quickest meaningful improvement available to you.

What section 54(6) asks for

Everyone involved in the business, which the Act says includes directors and officers, must be instructed on the law and given ongoing training on recognising a suspicious transaction and on what to do once they have. Two things follow. The board needs a training record too, and the content has to include your own escalation procedure, not just the generic offences. A score shows the person understood it, a certificate shows when, and the content version shows what they were taught. Keep all three.

8. Test sample CDD files

Take five recent files across risk categories and read them as an inspector would. Is everything present? Is the risk rating defensible on its face? Does the monitoring log show anything actually happened?

9. Review what reaches the board

Board packs should carry AML metrics: training completion, STR volumes, risk assessment refresh dates, and open findings. If none of that is going up, design the report and get it signed off.

The annual report the Central Bank expects

The Central Bank guidelines say the compliance officer delivers a report to the board at least once a year, that the board discusses it in detail, and that the minute reflects the discussion rather than noting that the report was received. AML should also be a standing agenda item. A workable annual report covers:

• Changes to the business risk assessment and the reasons for them
• Customer due diligence: new customers by risk band, periodic reviews due and overdue, the remediation backlog
• Suspicious transaction reporting: escalations, reports filed, reports declined and why, requests from FIU Ireland
• Sanctions and PEP screening: hits, true matches, returns filed
• Training: completion rates by team, the board’s own training, who is overdue
• Inspection, audit and review findings, with open actions and owners
• Resourcing, systems, and the changes in law or guidance due next year

10. Test the breach-response process

Run a tabletop. A suspicious transaction lands at four o’clock on a Friday. Who does what? If the answer takes longer than the exercise, rebuild the process and retest inside thirty days.

The answer the exercise should produce: the person who spotted it escalates to you in writing, you decide, the transaction does not proceed until any report has gone, nobody tells the customer anything that could tip them off, and the file records each step with the time. Then test the edges. What if you are on leave? What if the customer is on the phone demanding the transfer? What if the suspicion is about a colleague?

11. Check record retention

Section 55 requires customer due diligence and transaction records to be kept for at least five years after the relationship ends or the last transaction, whichever is later. Many firms keep six, to match tax and company law, and that is fine if the policy says so. Confirm where the records live, that the clock starts on the right date, and that disposal happens. Resolve any contradiction between the AML retention rule and the GDPR storage limitation policy now, in writing.

12. Plan your own training

The Central Bank expects an MLRO to be competent, current and able to evidence both. Keep your own training up to date, subscribe to the Central Bank bulletins, and put a quarterly typology review in the diary.

Competence is also the first of the three fitness and probity standards. Because the compliance officer role is a controlled function, the firm certifies every year that you meet them, and your training record is the evidence it relies on. If you hold PCF-52, the same file supports the Central Bank’s own view of you.

The first MLRO report

At the end of the hundred days, write it up for the board: what you found, what you have fixed, what is still open and by when. Present it and have it minuted. It is the single clearest piece of evidence that the role is being discharged.

After the hundred days: The annual cycle

The first hundred days set the baseline. What the Central Bank then expects to see is a cycle that repeats, with evidence at each step:

• Business risk assessment. Refreshed at least annually and on trigger events, approved by the board
• Policies and procedures. Formally reviewed at least annually, re-approved where the changes are material, and re-communicated to staff
• Customer reviews. Periodic due diligence refreshes on a frequency set by risk rating, with the overdue list reported upward
• Training. Everyone at least annually, new joiners before they deal with customers, the board included
• Board report. At least annually, discussed and minuted
• Central Bank returns. The sector-specific Risk Evaluation Questionnaire, submitted through the Central Bank Portal on the timetable the Bank notifies
• Independent testing. A review of the framework by internal audit or an external party, which the Central Bank can direct under section 54
• Your own certification. The firm’s annual fitness and probity certificate for your role, with the due diligence behind it
• Horizon scanning. Amendments to the Acts, new Central Bank guidance, the EU anti-money laundering package and the next national risk assessment

Put the dates in one calendar and share it with the board secretary. Most inspection findings are not about things the firm did wrong. They are about things it did once and never repeated.