How to Hire an MLRO for a Crypto or Fintech Company

+971568428813

About Us

FAQ

iGaming Talent Factory

iGaming Talent Factory

Blog

Home

Blog

How to Hire an MLRO for a Crypto or Fintech Company

Last updated: 10 November 2026

Key takeaways

In the UK, Malta and Dubai the regulator assesses key compliance people individually, so your MLRO hire becomes part of the licence or registration file.
The FCA expects the MLRO of a crypto applicant to help prepare the application and to be the permanent MLRO, not an interim placeholder.
AML experience in a bank does not prove someone can run AML for a crypto exchange, payments firm or EMI: look for the same business model.
Check what the candidate personally owned: regulator meetings, suspicious activity decisions, monitoring tools, policies they wrote.
Combining the MLRO and Compliance Officer roles is possible under some regimes, such as VARA in Dubai, if the duties do not conflict. Check your regulator first.

The right time to hire MLRO candidates is before your licence application, not after it. In most regimes your Money Laundering Reporting Officer is a person the regulator vets individually, through a fit and proper assessment, an approval form or an interview. A weak candidate can delay the application or cause it to fail.

This guide is for founders, COOs and compliance leads at crypto and fintech firms who are hiring an MLRO for the first time or replacing one. It covers timing, the experience that matters, how to test it in interviews, the red flags, and when one person can also be your Compliance Officer.

Why the MLRO hire is part of your licence file

In the UK, the Money Laundering Regulations 2017 require a firm to appoint a nominated officer, the person usually called the MLRO, and to tell its supervisor who that person is. Under the Proceeds of Crime Act 2002 the nominated officer receives internal reports of suspicion and decides whether to disclose them to the National Crime Agency. For firms authorised under FSMA and covered by the Senior Managers and Certification Regime, money laundering reporting is a senior management function (SMF17), and the FCA must approve the person before they take it on.

For crypto firms the FCA is direct about it. Officers and managers of a cryptoasset business are subject to fit and proper requirements under regulation 58A of the MLRs. The FCA expects the MLRO to be heavily involved in preparing the registration application and to be the permanent MLRO if the firm is registered. It has seen applicants put forward an interim MLRO, and says this prevents it from assessing the permanent one. Candidates should be ready for a fit and proper interview, which the FCA generally expects them to attend in person, and the FCA will refuse applications where the MLRO lacks fitness and propriety. The FCA has also consulted on moving cryptoasset firms from MLR registration to full FSMA authorisation (CP25/25), so check which regime applies when you apply.

Malta works the same way in practice. The MGA requires prior approval of every key function, including the AML role, and applicant MLROs sit an interview held by the MGA's AML unit together with the FIAU. Under the FIAU's rules, the MLRO of a firm licensed by the MFSA or the MGA needs that authority's approval.

The practical conclusion: treat the MLRO as a licence dependency. If the person is hired after the policies are written and the application is filed, they will be defending documents they did not write, in an interview about a business they barely know. For more on how regulators assess people in these roles, see Key Function Holders: What Regulators Check Before Approving a Hire.

How regulators look at the MLRO

Regime	How the MLRO is assessed	Points to check before you hire
UK, FSMA-authorised firms	Senior management function SMF17, FCA approval before the person starts	Also the nominated officer under the MLRs; the supervisor must be told who holds the role
UK, crypto firms registered under the MLRs	Fit and proper assessment under regulation 58A, usually with an interview	The FCA expects the permanent MLRO, not an interim, at application stage
Malta, MGA licensees	AML key function, prior approval, MLRO eligibility form, interview with the MGA and the FIAU	Two years as an MLRO or in a comparable senior role plus a relevant degree or an approved AML qualification, or four years of such experience; check the MGA conflict matrix
Malta, FIAU (all subject persons)	MLRO of an MFSA or MGA licensed firm is approved by that authority	FIAU guidance covers MLROs based outside Malta, time commitment and the number of other appointments held
Dubai, VARA	Compliance Officer must be fit and proper, approved by VARA, full-time and resident in the UAE or a UAE passport holder	The Compliance Officer may also hold the MLRO role if the duties do not conflict
EU, AMLR (applies from 10 July 2027)	Compliance officer appointed by the management body; compliance manager sits on the management body	One person may hold both roles where the size and nature of the business justify it

Look for the same business, not just "AML experience"

AML in a bank is not the same job as AML in a crypto exchange, a payments institution, an EMI or an iGaming operator. The risks, the data and the tools are different. A bank MLRO usually inherits a mature framework, a large team and long-established monitoring. A crypto MLRO often builds the framework, works with blockchain analytics and wallet screening, deals with travel rule data and handles high volumes of fast onboarding.

The FCA notes there is no legal requirement for an MLRO to hold a specific formal qualification. What it assesses is whether the person has adequate skills and experience for the role, with particular attention to cryptoassets. So weight direct experience in your business model above certificates and above the size of a previous employer.

If your firm is at application stage, experience of a successful licence or registration with the same regulator is the strongest signal you can find. The same logic applies to senior compliance hires generally: see Hiring a Head of Compliance for a Crypto Company Applying for a Licence.

What to check when you hire MLRO candidates

Focus on what the candidate personally did, not what their team did. Four areas separate real MLROs from people with the title:

Regulator interactions. Which regulators have they dealt with directly? Did they attend the interviews, answer information requests, handle an inspection or a remediation?
Suspicious activity reporting. Did they make the final decision to file or not file a SAR or STR, or did they draft reports for someone else to sign? Ask them to walk through a borderline case and how they documented the decision.
Transaction monitoring. Which tools did they use, and did they set and tune the rules or only clear alerts? Ask how they handled false positives and alert backlogs.
Policies. Did they write the AML policy, the business risk assessment and the procedures, or only follow them? Ask for a redacted sample.

A good interview test comes from the FCA itself. In its video guidance for payments and digital asset firms, the FCA describes asking MLROs how money laundering and terrorist financing could happen in the firm, how its products could be misused, and how the controls prevent it. Ask your candidates the same three questions about your products. A strong MLRO will give specific answers about your customer types, payment flows and assets. A weak one will give generic AML language.

Hiring an MLRO before your licence application?

Send us the job description and we will look for MLRO candidates with experience in your type of business and your regulator.

Send us the job description

Red flags

Title without ownership. A deputy or "AML manager" who never signed off a report, never met the regulator and never owned a policy is not yet an MLRO, whatever the CV says.
A pattern of short roles at start-ups that lost their licences. One failed firm proves little. Several in a row deserve a direct question about what happened and what the candidate did about it.
No availability to be based where the regulator requires. Some regimes set residence or location rules for key roles, such as VARA's UAE residence requirement for the Compliance Officer. Confirm the rule for your licence before you shortlist.
Too many other appointments. The FIAU considers the number of appointments an MLRO holds and the time they can give each one, and VARA considers other roles when assessing its Compliance Officer. A portfolio MLRO may not pass.
Generic answers. If the candidate cannot explain how your product could be abused, the regulator will notice in the interview.

Can your MLRO also be your Compliance Officer?

Small firms often combine the two roles, and some regulators allow it. VARA lets the Compliance Officer hold more than one non-client facing role, including MLRO, as long as the roles do not create conflicting duties. The EU Anti-Money Laundering Regulation, once it applies, lets one person hold both the compliance manager and compliance officer roles where the size and nature of the business justify it. The MGA publishes a conflict matrix for key functions: it treats the AML function as incompatible with the data protection role, and internal audit as incompatible with every other key function.

If you hire one person for both, look for someone who has run both a full compliance framework and AML reporting, and agree in advance when the roles will split as volumes grow. For the full comparison, see Compliance Officer vs MLRO: Do You Need Both?.

What we recommend

Confirm what your regulator requires of the MLRO (approval, interview, location, whether the role can be combined) before you write the job description.
Start the search before you file the application, so the MLRO can help write the policies they will be asked to defend.
Shortlist for experience in your business model and with your regulator, ahead of the size of previous employers or certificates.
Interview with the regulator's own questions applied to your products, and ask for redacted examples of policies and risk assessments the candidate wrote.
Take references that test ownership: who signed off reports, who met the regulator, who wrote the framework.

FAQ

When should a crypto company hire its MLRO?

Before or during the licence or registration application, not after it. The FCA expects the MLRO of a crypto applicant to be heavily involved in preparing the application and to be the permanent MLRO if the firm is registered. Hiring late can delay the application.

Does the FCA assess the MLRO of a crypto firm?

Yes. Officers and managers of a cryptoasset business are subject to fit and proper requirements under regulation 58A of the Money Laundering Regulations 2017, and the FCA says candidates should be prepared for a fit and proper interview. The FCA states it will refuse applications where the MLRO lacks fitness and propriety.

Can I use an interim MLRO for an FCA crypto registration?

The FCA has said that putting forward an interim MLRO prevents it from assessing the fitness and propriety of the permanent MLRO. It expects the MLRO named in the application to be the permanent one. Plan the permanent hire before you apply.

Can the MLRO and the Compliance Officer be the same person?

It depends on the regulator. Dubai's VARA allows its Compliance Officer to hold more than one non-client facing role, such as MLRO, if the roles do not create conflicting duties. The EU Anti-Money Laundering Regulation, which applies from 10 July 2027, allows one person to hold both the compliance manager and compliance officer roles where the size and nature of the business justify it.

What experience should an MLRO have for a crypto exchange?

Hands-on AML experience in the same type of business, not only AML in a bank. A crypto exchange MLRO should have worked with wallet screening, blockchain analytics and travel rule data. The FCA says there is no legal requirement for formal MLRO qualifications but assesses whether the person has adequate skills and experience, especially for cryptoassets.

Does an MLRO in Malta need regulator approval?

Yes, for firms licensed by the MFSA or the MGA, the MLRO requires approval of that authority. The MGA treats the AML role as a key function that needs prior approval, an MLRO eligibility form and an interview held by the MGA's AML unit together with the FIAU.

What are the red flags when hiring an MLRO?

A senior title without ownership, such as a deputy who never signed off reports or met the regulator. Several short roles at start-ups that lost their licences, without a clear explanation. A candidate who cannot be based where the regulator requires, or who already holds too many other appointments.

The bottom line

To hire an MLRO well, treat the role as part of your licence, not a back-office vacancy: hire early, hire for your business model, and test what the candidate personally owned. Hirexel recruits MLROs and compliance leads for crypto, fintech, blockchain and iGaming firms, and screens candidates against the regulator's fit and proper expectations before you meet them.

Planning your MLRO hire?

Book a call to talk through timing, the profile you need and what your regulator will look at.

Book a call