MLROs and BSA Officers: Who Is Accountable for AML Compliance

Financial firms need a clearly accountable person to run their anti-money-laundering, or AML, framework. In the United Kingdom and much of Europe, that person is commonly called the money laundering reporting officer, or MLRO. In the United States, banks designate a Bank Secrecy Act, or BSA, officer.

The titles are sometimes used loosely, especially by global fintechs, but they arise from different legal regimes. Both roles sit at the point where transaction monitoring, customer information, staff concerns and formal reports to authorities meet. Neither title removes responsibility from the institution, its board or senior management.

UK: the MLRO and internal suspicion reports

In the UK, the MLRO is generally the firm’s nominated officer for handling internal reports of knowledge or suspicion of money laundering or terrorist financing. Employees who identify potentially suspicious activity should escalate it through the firm’s internal process. The MLRO, or an authorised deputy, assesses the information and decides whether a disclosure should be made to the National Crime Agency, or NCA.

Where a report is required, the MLRO may submit a suspicious activity report, or SAR. A SAR is a confidential report to law enforcement, not an accusation and not proof that a crime occurred. In some cases, a firm may also seek a defence against money laundering before proceeding with a transaction or dealing with property. The legal tests, timing and process are fact-specific.

UK rules under the Money Laundering Regulations require relevant firms to appoint a nominated officer and, where appropriate to the size and nature of the business, an MLRO. Firms should not assume that one job title answers every governance requirement. The precise arrangement depends on the firm’s regulated activities and risk profile.

EU: a similar function, with national differences

EU anti-money-laundering rules require obliged entities, such as banks and many payment firms, to establish internal reporting channels and designate responsible compliance personnel. EU legislation sets the broad framework, but each member state implements it in national law. As a result, the title MLRO, the formal appointment process, reporting lines and personal exposure can differ between countries.

In practice, an EU MLRO or equivalent compliance officer commonly receives internal alerts, oversees escalation, determines whether the threshold for a report to the national financial intelligence unit is met, and maintains the firm’s AML policies. A cross-border group should avoid assuming that a UK reporting structure automatically satisfies local EU requirements.

US: the BSA officer runs the AML programme

In the US, a bank’s BSA officer is the individual designated to coordinate and monitor compliance with the Bank Secrecy Act and related AML obligations. The role is a core part of a bank’s written BSA/AML programme. The programme must also include internal controls, independent testing, ongoing training and risk-based customer due diligence, or CDD.

The BSA officer typically oversees the institution’s suspicious activity reporting process, including whether the bank files a SAR with the Financial Crimes Enforcement Network, or FinCEN. The filing is the bank’s responsibility, not the personal filing of the officer. Still, the officer must ensure that alerts are investigated, decisions are documented, filings are timely and SAR confidentiality is protected.

• Maintain and update risk-based AML, sanctions and suspicious-activity policies and procedures.
• Oversee transaction-monitoring alerts, investigations, escalation and SAR decision-making.
• Deliver or coordinate role-appropriate staff training and track completion.
• Serve as a principal contact for examiners, auditors, FinCEN and, where applicable, other regulators or law enforcement.
• Report material risks, backlogs, control failures, SAR metrics and remediation progress to senior management and the board or a board committee.
• Coordinate customer due diligence, beneficial ownership and higher-risk customer controls with onboarding and operations teams.

Accountability requires authority and independence

An MLRO or BSA officer cannot perform effectively if commercial teams can override investigations, suppress reports or deny access to records. The role needs sufficient seniority, resources and independence to challenge revenue-generating functions. It should have a clear route to senior management and the board, particularly when risks remain unresolved.

Personal accountability is real, but it is not identical in every jurisdiction. UK law can impose personal criminal consequences in particular circumstances, including failures connected to required disclosures, while regulators may take action against individuals for serious compliance failures. In the US, naming a BSA officer does not automatically make that person personally liable for every institutional failure. However, regulators can pursue individuals who cause, participate in or fail to address serious violations, depending on the facts and their authority.

Documentation matters in both systems. A defensible file should show what information was reviewed, who made the decision, why the reporting threshold was or was not met, and how any control weakness was corrected. Firms must also prevent unlawful “tipping off,” meaning improperly revealing that a SAR or equivalent report has been made or is being considered.

Smaller firms and fintechs

A small payments company may have one senior compliance leader covering AML, sanctions, fraud and privacy, while a large bank may separate investigations, monitoring, quality assurance and reporting into specialist teams. Combining functions can be reasonable when risks and volume are limited, but it creates conflicts and capacity constraints. A founder, chief operating officer or head of legal should not be named merely as a formality if they lack time, knowledge or independence.

Fintechs often use external consultants, monitoring vendors and outsourced operations. Those arrangements can provide expertise, but they do not outsource accountability. The firm must retain oversight of alert quality, reporting decisions, recordkeeping, testing and vendor performance. It must also ensure the designated officer can obtain data from product, engineering and customer-support systems quickly enough to investigate suspicious activity.

A governance role, not a checkbox

The practical distinction is straightforward: a UK MLRO is chiefly the internal recipient and decision-maker for suspicion reports under the UK reporting framework, while a US BSA officer is the designated leader of a bank’s wider BSA/AML programme. In both cases, the job is effective only when the officer has credible authority, direct reporting access and evidence that the firm acts on identified risks.

This explainer is general information, not legal advice. UK, EU and US AML obligations vary by entity type, regulator, product, risk exposure and, in the EU, national implementation. Firms should obtain jurisdiction-specific legal and compliance advice when designing appointments, escalation procedures or reporting controls.