Why Financial Crime Is a Senior Management Issue

Financial crime is one of the FCA’s most consistent priorities, and failures in anti-money laundering and sanctions controls have led to some of the largest penalties in UK financial services. Those cases rarely turn on a single mistake by the MLRO. More often, they involve business growth outpacing controls, under-resourced compliance teams, management information that hid backlogs, or commercial pressure that overrode risk concerns. Those are senior management and board failures.

The Money Laundering Regulations 2017 reflect this. As well as requiring a nominated officer to handle suspicious activity reports, they require firms, where appropriate to their size and nature, to appoint a member of the board or senior management responsible for compliance with the Regulations. Under the Senior Managers and Certification Regime, responsibility for the firm’s policies and procedures for countering the risk that it might be used to further financial crime is one of the Prescribed Responsibilities that must be allocated to a Senior Manager.

Who Is Accountable for What

The MLRO

The SMF17 Money Laundering Reporting Officer, where the firm has one, is responsible for the firm’s anti-money laundering systems and controls, and usually acts as the nominated officer for suspicious activity reporting to the National Crime Agency. They produce the annual MLRO report, which should give the board a candid view of the firm’s financial crime risk and controls.

The Senior Manager With the Financial Crime Prescribed Responsibility

This may be the MLRO, or another Senior Manager such as the chief executive or an executive director. They’re accountable for the firm’s overall policies and procedures on financial crime, which can extend beyond money laundering to fraud, sanctions, bribery and market abuse.

Business Line Senior Managers

The Senior Managers who run customer-facing businesses are accountable for how financial crime risks are managed in their areas, including customer onboarding, due diligence and monitoring. The first line owns the risk, even though the second line oversees it.

The Board

The board sets the firm’s appetite for financial crime risk, approves its approach and oversees whether it’s working. It should receive and challenge the MLRO report, ensure the function is adequately resourced and make sure growth plans take financial crime risk into account.

The Areas Regulators Focus On

Business-Wide Risk Assessment

Firms must understand the financial crime risks in their business: customers, products, geographies and delivery channels. A generic risk assessment that doesn’t reflect the firm’s actual business is a common weakness.

Customer Due Diligence

Firms must know who their customers are and understand the nature of their business, with enhanced due diligence for higher-risk customers. Backlogs in periodic reviews are a frequent concern.

Transaction Monitoring

Monitoring systems must be calibrated to the firm’s risks, alerts must be investigated promptly, and backlogs must be visible to senior management.

Sanctions

Firms must screen customers and transactions against sanctions lists and act on matches. The Office of Financial Sanctions Implementation enforces financial sanctions in the UK, and the FCA also expects firms to have effective systems and controls. Sanctions regimes have expanded significantly in recent years, raising the demands on firms.

Resourcing

Regulators look closely at whether financial crime functions have enough people, with the right skills, to deal with the firm’s volumes and risks, particularly at fast-growing firms.

What Good Board Oversight Looks Like

• A candid MLRO report that the board discusses properly, not just notes.
• Clear risk appetite for financial crime, including which customers and activities the firm won’t accept.
• Meaningful management information on due diligence backlogs, alert volumes and ageing, suspicious activity reports, sanctions matches and resourcing.
• Growth and financial crime considered together, so that new products, markets or customer segments come with the controls to match.
• Independent assurance, through internal audit or external reviews, of whether controls actually work.
• Direct access for the MLRO to the board and its committees.

Common Failings

• Growth outpacing controls. Customer numbers rising faster than onboarding and monitoring capacity.
• Hidden backlogs. Management information that reports activity but not the growing pile of overdue reviews or alerts.
• An isolated MLRO. An MLRO without the authority, resources or board access to do the job.
• Box-ticking risk assessments. Assessments that don’t reflect the firm’s real business.
• Commercial overrides. Higher-risk customers accepted against compliance advice without proper escalation.

Fraud and Scams

Financial crime oversight isn’t only about money laundering. Fraud, including authorised push payment scams, has become one of the most significant sources of consumer harm in UK financial services, and firms face growing expectations to prevent it and to support victims. Boards should make sure fraud risk is covered in the firm’s financial crime framework, with clear senior ownership, management information on losses and reimbursements, and a view of how fraud controls affect vulnerable customers.

Technology and Data

Modern financial crime controls depend on technology: screening systems, transaction monitoring, identity verification and increasingly machine learning. Senior Managers need to understand how these systems are calibrated, how they’re tested and what happens when they fail. A monitoring system that generates too few alerts may look efficient but miss real risk. One that generates too many can create backlogs that hide genuine concerns.

Fractional MLROs and Smaller Firms

Many smaller firms use a fractional or interim MLRO. That can work well, provided the individual has enough time for the firm’s volumes and risks, genuine access to the business and its data, and the authority to challenge. The board remains responsible for making sure the arrangement is adequate. SMF Capital’s article on when interim and fractional SMF appointments work covers the considerations.

Recruiting Financial Crime Leadership

Experienced MLROs and financial crime leaders are in demand, particularly those with experience in fast-growing firms, payments, crypto-assets or remediation. When recruiting, firms should test not only technical knowledge but the candidate’s ability to challenge, to communicate risk clearly to the board and to lead a team under pressure. For board-level and executive appointments at larger regulated firms, Exec Capital, a sister practice of SMF Capital, runs FCA-regulated executive search, and SMF Capital recruits MLROs and other Senior Managers across the regulated market.

Questions for Boards

• Which Senior Manager holds the financial crime Prescribed Responsibility, and is that clear to everyone?
• Does the MLRO report give us a candid view, and do we challenge it?
• Do we see backlogs in due diligence and monitoring, not just activity volumes?
• Are our growth plans matched by financial crime controls and resources?
• When did we last have independent assurance that our controls work?
• Does the MLRO have direct access to the board?

The Bottom Line

Financial crime is a whole-firm risk, and accountability for it runs from the board through the chief executive and business line Senior Managers to the MLRO. Firms that treat it that way, with honest management information, adequate resources, independent assurance and a board that challenges, are better protected against both financial crime and the regulatory consequences of failing to prevent it. For more on the Senior Manager Functions involved, see SMF Capital’s guide to SMF16 and SMF17.