How to Structure an MLRO Annual Report That Evidences Effective Financial Crime Controls

The MLRO annual report is the single document the FCA will reach for first when it wants to understand how seriously a firm takes financial crime. Too many reports read as compliance theatre: a tour of policies, a list of training completions, and a conclusion that controls are 'operating effectively' with nothing underneath it. A credible report does the opposite. It shows the MLRO has looked hard at the control environment, named what is not working, and set out what will change.

Start With the Risk Picture, Not the Control Inventory

Open with the firm's financial crime risk assessment and how it has moved since the last report. What has changed in the customer base, products, geographies, delivery channels, and threat environment? If the business has entered higher risk corridors, launched new products, or onboarded a correspondent relationship, say so and explain the implication for the control framework.

The FCA reads this section to test whether the MLRO genuinely understands the firm. A generic risk summary that could belong to any firm of the same type is a red flag. Tie the risk picture to specific exposures: PEP concentrations, cash intensive sectors, high risk jurisdictions by percentage of book, crypto related flows, and so on.

Report Control Performance Against Measurable Standards

For each control pillar, customer due diligence, ongoing monitoring, screening, transaction monitoring, SAR process, training, record keeping, set out:

• The standard the control is designed to meet
• Quantitative performance data covering the full reporting period
• Known weaknesses, exceptions, and their root causes
• Remediation status with owners and dates

Transaction monitoring is where most reports get thin. Include alert volumes, true positive rates, backlog ageing, tuning activity performed, model validation outcomes, and the rationale for threshold changes. If alert quality is poor, say so. A report that claims 98 percent of alerts are false positives without any analysis of calibration will not survive scrutiny.

Do the same for SARs: internal reports received, external SARs filed, DAML requests, timeliness, and thematic patterns. Trends matter more than totals.

Be Explicit About Issues, Incidents, and Near Misses

This is the section the FCA mines hardest. Cover audit findings, second line assurance outcomes, regulatory correspondence, material incidents, control failures, and any instances where financial crime risk was accepted outside standard appetite. For each, state what happened, what it revealed about the control environment, and what is being done.

What most firms get wrong: presenting issues as isolated events. What good looks like: linking issues to root causes in governance, resourcing, technology, or culture, and showing how the remediation addresses the cause, not just the symptom.

Address Resourcing and Capability Honestly

State headcount, vacancy rates, attrition, skills gaps, and whether the function has the budget and tooling it needs. If the MLRO believes resourcing is inadequate, the report must say so. A report that is silent on resourcing, followed by a control failure that resourcing would have prevented, is indefensible under SMCR.

Set Out Forward Priorities With Commitment

Close with a dated action plan covering the next twelve months: risk assessment refreshes, system changes, policy updates, training, assurance activity, and specific remediation milestones. Each item should have an owner, a date, and a measure of success. This is what the board will track and what the FCA will ask about next year.

The Governance Wrap

The report should be reviewed by the audit or risk committee, approved by the board, and the board's challenge and conclusions minuted. A clean approval with no recorded challenge suggests the board did not read it properly. Encourage challenge and capture it.

Your Next Decision

Before signing the next report, ask yourself one question: if the FCA requested the underlying evidence for every assertion in the document tomorrow, could you produce it within forty eight hours? If not, the report is not ready, and the gap tells you where to focus.

Frequently Asked Questions

How long should the MLRO annual report be?

Long enough to evidence the judgements made, short enough that the board will read it. For most firms that means thirty to sixty pages of main report, with detailed data and evidence in annexes.

Should the report name individuals responsible for failings?

Name functions and accountable executives where relevant under SMCR. The point is not blame but clarity on ownership. Anonymous issues rarely get fixed.

How candid should we be about control weaknesses?

Fully candid. A report that overstates control effectiveness is a bigger regulatory and personal liability for the MLRO than one that identifies problems and commits to fixing them. The FCA expects honest self assessment.

Does the FCA actually read these reports?

Supervisors request them routinely, particularly before visits, after Dear CEO letters, and when considering escalation. Assume every word will be read and tested against other evidence.

How should the report connect to the firm wide risk assessment?

The two documents should be consistent and cross referenced. Divergence between the FWRA and the MLRO report, for example on inherent risk ratings or control effectiveness, is a common finding in supervisory reviews.