+971568428813
Contact Us
About Us
FAQ
iGaming Talent Factory
Why It Works
Feedback
Contact Us
How it works
Industries
iGaming Talent Factory
Blog
Contact Us
Industries
Close
How it works
iGaming Talent Factory
+971568428813
Blog
Home
/
Blog
/
Compliance Officer vs MLRO: Do You Need Both?

Compliance Officer vs MLRO: Do You Need Both?

Hirexel Blog cover: Compliance Officer vs MLRO: Do You Need Both?
Last updated: 10 November 2026

Key takeaways

  • The MLRO owns anti-money laundering and the decision on suspicious activity reports; the Compliance Officer owns the wider regulatory framework.
  • Dubai's VARA lets the Compliance Officer and the MLRO hold each other's role if the duties do not conflict, and factors the extra role into its fit and proper assessment.
  • The FIAU in Malta allows an MLRO to hold other roles in the firm, provided conflicts of interest are avoided.
  • The FCA treats compliance oversight (SMF16) and money laundering reporting (SMF17) as two separate senior management functions, each needing approval.
  • Combining the roles saves a hire early on, but plan the split before the combined role becomes a bottleneck.
Compliance officer vs MLRO is one of the first hiring questions a new fintech, crypto or iGaming firm faces: do you need two people, or can one person hold both roles? The short answer is that the roles are different, many regulators allow one person to hold both in a smaller firm, and the combination needs a plan for when it stops working.
This guide is for founders, COOs and HR leads who are planning a licence or a first compliance team. It explains what each role owns, what the UK, Malta and Dubai regulators say about combining them, and what to look for if you hire one person for both.

Compliance officer vs MLRO: who owns what

The MLRO (Money Laundering Reporting Officer) is responsible for anti-money laundering and counter-terrorist financing. In the UK, the Money Laundering Regulations 2017 call this person the nominated officer. When staff report a suspicion, the nominated officer must consider it and decide whether it gives rise to knowledge or suspicion of money laundering or terrorist financing.
The Compliance Officer is responsible for the firm's compliance with all the rules that apply to it, not only AML. That covers licence conditions, conduct rules, compliance policies, monitoring and reporting to the board.
VARA's Compliance and Risk Management Rulebook is a useful reference because it sets out both roles side by side:
Area Compliance Officer (VARA) MLRO (VARA)
Scope All applicable laws and regulatory requirements, including consumer protection and AML/CFT AML/CFT laws and regulatory requirements
Policies Develops and implements compliance policies and procedures, including the business continuity and disaster recovery plan Develops and implements AML/CFT policies and procedures
Risk Assesses emerging issues and risks Conducts AML/CFT risk assessments and updates policies to address them
Reporting Reports compliance activities and compliance audits to the board Monitors and reports suspicious transactions; reports to the board quarterly on AML/CFT effectiveness
Minimum experience At least five years in a compliance function At least two years handling AML/CFT matters
Other conditions Fit and proper, approved by VARA, resident in the UAE or a UAE passport holder, full-time employee, reports directly to the board Fit and proper
Other regulators use different titles and split the work differently, but the logic is the same: one role is about financial crime, the other is about regulatory compliance as a whole.
In the UK there is a third role to be aware of. Regulation 21(1)(a) of the MLRs requires a firm, where appropriate to its size and nature, to appoint a board member or senior manager as the officer responsible for compliance with the MLRs. For electronic money issuers and payment service providers, regulation 21(7) also requires an individual to monitor and manage compliance with the firm's AML policies, controls and procedures. Know which of these appointments your firm needs before you write a job description.

Can one person hold both roles?

It depends on the regulator and on the size of the firm.
Dubai (VARA). The rulebook says the Compliance Officer may hold more than one non-client facing role within the VASP, including the MLRO and the head of the risk function, provided the roles do not create conflicting duties. The same rule applies from the MLRO side. VARA takes the other roles into account when it decides whether the person is fit and proper.
Malta (FIAU and MGA). FIAU guidance says the MLRO can hold additional functions or roles within the firm but must avoid conflicts of interest. It lists examples of where conflicts arise: beneficial owners, qualifying shareholders, client relationship managers and employees with target-based pay. The FIAU also expects firms to consider the number of appointments the MLRO holds and the time they can dedicate to each. For gaming licensees, the MGA requires approval of each key function, publishes a conflicts table, and asks applicants to check it before applying for an additional role.
UK (FCA). The FCA lists compliance oversight (SMF16) and money laundering reporting (SMF17) as separate senior management functions. Its Senior Managers Regime guidance explains, using the CEO and Chair as an example, that where one individual holds two functions the firm applies for both. Each function is assessed for fitness and propriety. For which firms need an SMF16, the FCA points to SYSC 1 Annex 1 and SUP 10C.6.1 in its Handbook.
EU (AMLR, from 10 July 2027). The EU Anti-Money Laundering Regulation creates a compliance manager on the management body and a compliance officer appointed by it, and allows one person to perform both where the size and nature of the business justify it. This is about two AML roles, not about combining AML with general compliance, so national rules still decide the wider question.
For the hiring side of the MLRO role in detail, see How to Hire an MLRO for a Crypto or Fintech Company.

Hiring a Compliance Officer, an MLRO or one person for both?

Send us the job description and we will look for candidates who have held the same combination of roles under your regulator.

Why combining works early and fails later

Combining the roles makes sense at the start. Before launch there are few customers, few alerts and one set of policies to write. One experienced person can build both frameworks, talk to the regulator with one voice and save you a senior salary.
The combination starts to fail as the business grows. Suspicious activity work is urgent and arrives every day; wider compliance work, such as policy reviews, monitoring plans and regulatory change, is important but easy to postpone. When one person holds both, the urgent work tends to win. Other warning signs:
  • Alert and case backlogs that one person cannot clear.
  • Board reports that cover AML in detail but say little about the rest of the framework.
  • New products, markets or licences that each bring their own rules.
  • The regulator asking who covers the role when the holder is absent.
Agree in advance what will trigger the split, for example a new licence, a new market or a level of case volume your board sets. Then the second hire is a planned step, not a reaction to a finding.

What to look for if you hire one person for both

If you decide on one person, the profile is narrower than for either role alone:
  • Experience of both frameworks. Someone who has written AML policies and a compliance monitoring plan, not only one of them.
  • Experience at your stage. Building from scratch is a different job from maintaining a mature framework in a large firm.
  • Regulator contact in both areas. Ask which regulator meetings, information requests or inspections they handled, and on which topics.
  • No conflicting interests. Not a shareholder, not paid on sales targets, not managing client relationships.
  • Capacity. Check other appointments they hold. Regulators look at time commitment, and so should you.
  • Willingness to build a team. The right candidate expects to hire an analyst or a deputy as volumes grow, rather than defending the combined role.
If you need cover while you search for the permanent hire, read Interim vs Permanent Compliance Hires: When Each Makes Sense first. Some regulators look carefully at key roles held by short-term contractors.

What we recommend

  1. List the roles your regulator requires and check whether it allows one person to hold both, and under what conditions.
  2. If you combine the roles, write down what the person owns in each and the conflicts you have ruled out.
  3. Hire for experience of both frameworks at your stage, and check the candidate's other appointments.
  4. Set the triggers for splitting the roles now: a new licence, a new market or a case volume your board agrees.
  5. Budget for the second hire, or for an analyst, before the triggers are reached.

FAQ

What is the difference between a Compliance Officer and an MLRO?

The MLRO owns anti-money laundering and counter-terrorist financing, including the decision on whether a suspicion is reported to the authorities. The Compliance Officer owns the wider regulatory framework, such as compliance policies, staff training on all applicable rules, monitoring and reporting compliance to the board. VARA in Dubai, for example, lists separate duties for each role in its Compliance and Risk Management Rulebook.

Can the MLRO and the Compliance Officer be the same person?

Often yes, but it depends on the regulator. VARA allows its Compliance Officer and MLRO to hold more than one non-client facing role, including each other's, provided the roles do not create conflicting duties. The FIAU in Malta allows an MLRO to hold additional roles in the firm as long as conflicts of interest are avoided.

Does the FCA allow one person to be SMF16 and SMF17?

The FCA treats compliance oversight (SMF16) and money laundering reporting (SMF17) as two separate senior management functions, each with its own approval. Where one individual holds two senior management functions, the firm applies for both. Check with the FCA how it will view the combination for your firm's size and risk.

Does a crypto company in Dubai need both a Compliance Officer and an MLRO?

VARA's rulebook requires a VASP to appoint a Compliance Officer and an MLRO, each with their own duties. The Compliance Officer must have at least five years of compliance experience, be resident in the UAE or hold a UAE passport, be a full-time employee and report directly to the board. The MLRO must have at least two years of experience handling AML/CFT matters, and the two roles may be held by one person if the duties do not conflict.

Does an EMI or payment institution in the UK need a separate compliance person for AML?

Under regulation 21(7) of the Money Laundering Regulations 2017, an electronic money issuer or payment service provider must appoint an individual to monitor and manage compliance with its AML policies, controls and procedures. This is in addition to the nominated officer, commonly called the MLRO, who decides on suspicious activity reports.

When should a company split the Compliance Officer and MLRO roles?

Split the roles when one person can no longer give both enough time, when suspicious activity work crowds out wider compliance work, or when the regulator questions the combination. FIAU guidance asks firms to consider the number of appointments an MLRO holds, the time they can dedicate to each and possible conflicts of interest.

The bottom line

The compliance officer vs MLRO question is not about titles: one role owns financial crime, the other owns regulatory compliance as a whole, and a small firm can often give both to one experienced person if the regulator agrees and the duties do not conflict. Plan the split from the start. Hirexel recruits Compliance Officers and MLROs for fintech, crypto, blockchain and iGaming firms, including candidates who have held both roles under the same regulator you are applying to.

Not sure whether to hire one person or two?

Book a call to talk through your licence, your volumes and the profile that fits.

Sources

  1. FCA, Senior Managers Regime: https://www.fca.org.uk/firms/senior-managers-and-certification-regime/senior-managers-regime
  2. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 21: https://www.legislation.gov.uk/uksi/2017/692/regulation/21
  3. VARA, Compliance and Risk Management Rulebook (19 May 2025): https://rulebooks.vara.ae/sites/default/files/en_net_file_store/VARA_EN_123_VER20250519.pdf
  4. FIAU Malta, MLRO and Outsourcing: https://fiaumalta.org/app/uploads/2020/02/10.-MLRO-and-Outsourcing-1.pdf
  5. Malta Gaming Authority, Key Functions: https://www.mga.org.mt/licensee-hub/key-function/
  6. Malta Gaming Authority, Key Functions Conflicts Table: https://www.mga.org.mt/app/uploads/Key-Functions-Conflicts-Table.ods
  7. Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation), Article 11: https://eur-lex.europa.eu/eli/reg/2024/1624/oj