SMF16 and SMF17: Compliance Oversight and the MLRO Explained

If SMF9, SMF10, SMF11 and SMF14 are the designations that keep non-executive directors up at night, SMF16 and SMF17 are the two that keep everyone else in a regulated firm up at night. Compliance Oversight and the Money Laundering Reporting Officer function sit at the sharp end of day-to-day regulatory accountability — closer to the operational coalface than any board-level designation, and consequently some of the most frequently recruited SMF roles we see. This guide sets out what each actually covers, where firms most often get the appointment wrong, and what a strong candidate looks like.

Two Functions, Frequently Combined, Rarely Identical

SMF16 is the Compliance Oversight function. SMF17 is the Money Laundering Reporting Officer. At smaller firms the two are very often held by the same individual, and job adverts frequently list them together as a single “SMF16/17” hire. That practical reality shouldn’t obscure the fact that they are two distinct accountabilities with two distinct skill sets sitting underneath them — a firm combining the roles needs a candidate genuinely strong in both areas, not a compliance generalist who happens to also hold the MLRO badge.

SMF16 — Compliance Oversight

The Compliance Oversight function carries personal accountability for the adequacy and effectiveness of the firm’s arrangements to comply with its regulatory obligations. In practice that covers a wide waterfront: the firm’s compliance monitoring programme, its regulatory permissions and whether the business is actually operating within them, its approach to conduct risk, its handling of complaints and regulatory reporting, and — increasingly — its Consumer Duty obligations across the products and services it offers.

What the FCA is actually testing for

An SMF16 holder is not expected to catch every individual compliance failure personally. What the FCA does expect is that the compliance function is properly resourced, genuinely independent of the business lines it oversees, and structured so that problems are actually escalated rather than smoothed over. Where a firm’s compliance function exists on paper but has no real authority to challenge the business — because it’s under-resourced, because it reports through a commercial line rather than direct to the board, or because its head has no genuine standing with senior management — the regulatory failure, when it surfaces, lands on the SMF16 holder personally.  To find our more visit SMF Capital

The independence test

The single most common weakness we see in SMF16 appointments is a Head of Compliance who is capable technically but has no real authority in the room — brought in to tick a regulatory box rather than to actually shape how the business operates. A strong SMF16 candidate needs the technical grounding, certainly, but also the seniority and personal authority to say no to a commercially attractive proposal and make it stick.

What a strong SMF16 candidate looks like

Direct prior experience holding Compliance Oversight or an equivalent senior compliance role at a comparable regulated firm; a track record of building or running a monitoring programme rather than simply inheriting one; genuine fluency in the specific regulatory regime the firm operates under — consumer credit, payments, insurance distribution, investment business — rather than generic compliance experience; and, critically, evidence of having actually challenged the business successfully in a previous role, not just having sat on committees where challenge was theoretically possible.

SMF17 — Money Laundering Reporting Officer

The MLRO function carries personal accountability for the firm’s anti-money laundering and counter-terrorist financing systems and controls — receiving internal suspicious activity reports, deciding whether to file a Suspicious Activity Report with the National Crime Agency, and overseeing the firm’s wider AML policies, customer due diligence standards and ongoing monitoring.

A genuinely personal liability

The MLRO role carries a specific feature that sets it apart from most other SMF designations: the individual can face personal criminal liability under the Proceeds of Crime Act and the Money Laundering Regulations if they fail to report knowledge or suspicion of money laundering appropriately. This is not simply a regulatory accountability that could result in a fine or a ban — in a worst case, it is a personal criminal exposure. Firms recruiting for SMF17 sometimes underweight quite how seriously this changes the calculus for a genuinely capable candidate deciding whether to take the role.

What the FCA and NCA expect

Beyond the SAR decision-making itself, the MLRO is expected to maintain a firm-wide understanding of its money laundering risk exposure — which customer types, products, jurisdictions and transaction patterns carry the greatest risk — and to make sure the firm’s customer due diligence and ongoing monitoring are actually calibrated to that risk rather than applying a uniform, tick-box process regardless of risk profile.

What a strong SMF17 candidate looks like

Direct experience of AML systems and controls at a comparable regulated firm, ideally including having actually made SAR filing decisions rather than only having reviewed a process on paper; sector-specific financial crime knowledge matched to the firm’s actual risk exposure — trade-based money laundering for a trade finance business, transaction monitoring at scale for a payments firm, source-of-wealth checks for a wealth manager; and a demonstrable willingness to take the reporting decision seriously even where it’s commercially inconvenient, since a MLRO who defers to commercial pressure on SAR decisions is not fulfilling the function’s purpose.

Where Firms Go Wrong Recruiting SMF16/17

Underselling the seniority the role needs. Compliance Oversight and MLRO are sometimes budgeted and briefed as mid-level compliance hires with an SMF designation attached, rather than as the senior, board-facing roles the FCA actually expects them to be. A candidate strong enough to genuinely challenge the business will not take a role pitched, priced or positioned as a junior function.

Combining the roles without testing for both skill sets. A strong SMF16 compliance generalist is not automatically a strong MLRO, and vice versa — financial crime expertise and broad regulatory compliance expertise are related but distinct disciplines. Where the roles are combined, both need to be assessed properly rather than assuming competence in one implies competence in the other.

Treating Form A as a formality. As with every SMF designation, the FCA’s fit and proper assessment — evidenced against honesty and integrity, competence and capability, and financial soundness — needs to be built into the search itself. A candidate assessed properly against the specific accountability of SMF16 or SMF17 from the outset clears Form A far more smoothly than one selected on general seniority and tested only afterwards.

Under-resourcing the function after the appointment. Recruiting a strong SMF16 or SMF17 holder and then leaving them without adequate budget, headcount or genuine board access sets the appointment up to fail regardless of how good the hire was. The regulatory accountability sits with the individual, but the firm has to actually resource the function for that accountability to be dischargeable.

What SMF16/17 Roles Typically Pay

Many smaller regulated firms — particularly newly authorised businesses and firms scaling up ahead of full authorisation — engage SMF16/17 support on a fractional or interim basis rather than as a full-time hire, which brings the cost down considerably while still meeting the FCA’s expectation of genuine, senior compliance oversight.