The legal duties, FCA expectations and 2026 safeguarding rules that shape compliance and MLRO hiring at payment institutions and EMIs, and who to hire first.
A UK payments firm or e-money institution (EMI) must name a compliance officer, a nominated officer for suspicious activity reporting (the MLRO), and an individual who monitors and manages its anti-money laundering controls. Its directors and managers must be of good repute with the knowledge and experience to run a payments business. Since May 2026 it must also give one director or senior manager responsibility for safeguarding oversight. The FCA tests these people at authorisation, often in a fit and proper interview, and keeps testing them through supervision.
This guide is for founders, CEOs and boards of payment institutions and EMIs hiring a Chief Compliance Officer, an MLRO, or one person to do both.
Yes. The requirements sit in three places.
What payments firms do not have, today, is the Senior Managers and Certification Regime (SM&CR). Payment institutions and EMIs are authorised under the PSRs and EMRs rather than FSMA, so there are no SMF16 or SMF17 approvals to apply for. That may change. HM Treasury's Modernising Payment Services Regulation consultation, open from 14 July to 6 October 2026, asked whether enhanced accountability for senior managers of payments and e-money institutions would help manage financial crime risk. Hire as though personal accountability is coming, because the direction of travel points that way.
The MLRO owns financial crime. The Chief Compliance Officer owns everything else the regulator can hold the firm to. In a small firm they are often the same person. In a scaling one they rarely should be.
The MLRO typically covers:
The Chief Compliance Officer typically covers:
The overlap is where problems start. Agent networks, embedded finance partners and cross-border corridors are both conduct and financial crime risks. Whoever you hire, write down which of them owns each one.
The FCA has been unusually specific. In its guidance video for payments and digital asset applicants, its authorisations team notes that the latest National Risk Assessment found payments and digital assets firms particularly susceptible to money laundering. It then sets out what it looks for in an MLRO.
The practical point for hiring: a candidate with a strong CV from a bank who cannot explain your payment flows, your corridors and your onboarding journey in plain terms will struggle in that interview. Product fluency matters as much as regulatory knowledge.
They raise the bar significantly. The FCA's PS25/12, published in August 2025, introduced new safeguarding rules for payments and e-money firms that came into force on 7 May 2026. Under them, firms must:
The governance rule is the one that affects hiring. New CASS 15.2.4R requires a firm to allocate to a single director or senior manager of sufficient skill and authority responsibility for oversight of its operational compliance with the safeguarding regime, and for reporting on it to the governing body.
That person is often the CFO or COO, because safeguarding sits close to treasury and finance operations. Compliance still needs someone who understands reconciliations, relevant funds and insurance or guarantee arrangements well enough to test them. If your compliance lead has only ever worked in AML, this is a gap to close, either in the hire or in the team around them.
The FCA's February 2025 letter to payments firm CEOs is the clearest statement of supervisory priorities. It names weaknesses in governance, oversight and leadership as a root cause of many of the regulatory issues the FCA sees in the sector. It sets expectations that bear directly on the compliance hire:
Nothing in regulation 21 prevents one person from holding the compliance officer, nominated officer and regulation 21(7) roles, and many early-stage EMIs combine them. The question is capacity and independence, which are exactly the tests the FCA describes.
Combining them tends to work when the firm has a single product, a limited number of corridors, no agent network and modest alert volumes. It stops working when the MLRO spends most of the week on suspicious activity decisions and has no time left for safeguarding, Consumer Duty or regulatory change. At that point the firm needs a dedicated MLRO reporting into a Chief Compliance Officer, or two peers reporting to the CEO and board.
Fractional and consultant MLROs are common in pre-authorisation applications, and for a firm with no customers yet that can be reasonable. Be careful about relying on it after launch.
Regulation 21(3) requires the nominated officer to be "an individual in the relevant person's firm". The FCA asks whether the MLRO has sufficient time. And the authorisation conditions turn on the competence of the people responsible for managing the business. A part-time MLRO covering several firms, with no feel for your daily flows, is hard to defend on all three counts once you are processing live payments.
A sensible pattern is a fractional MLRO to build the framework and support the application, with a permanent MLRO hired in time to own the controls before launch. Plan the search early. Experienced payments MLROs are in demand, and a good one may have a notice period of several months.
The EU's new Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027 and formalises two roles under Article 11:
The regulation also requires firms to protect the compliance officer from retaliation and from decisions being unduly influenced by commercial interests, to notify the supervisor of a removal, and to let the compliance officer report directly to the management body. For groups running an EMI in both the UK and the EU, that means two clearly owned sets of roles, not one person stretched across both.
Hire the MLRO first if you are pre-authorisation. The FCA has published detailed expectations for that role and tests the candidate directly, so a weak appointment puts the whole application at risk. Add a Chief Compliance Officer when you have a second product line, an agent or partner network, material safeguarded balances, or a second jurisdiction.
Signals of a strong payments MLRO or CCO:
Warning signs:
Use the FCA's own questions in your interview process. If a candidate cannot answer them well for your business after a proper briefing, the regulator will reach the same conclusion.
Structure first. The compliance lead should report to the CEO with direct access to the board or risk committee and to the non-executive directors. That reflects both the FCA's emphasis on independent challenge and the EU's direct reporting requirement. Give them a budget they control for monitoring tools and headcount. A compliance officer who has to ask the commercial team for permission to hire an analyst is not independent in any meaningful sense.
On pay, the market for experienced payments MLROs and compliance heads is competitive, especially for people who have already taken a firm through authorisation. Avoid tying a meaningful share of their variable pay to revenue or onboarding volumes, which undermines the independence the FCA tests for. For current ranges, see our salary guide.
List every control role your regime requires: compliance officer, nominated officer, the regulation 21(7) individual, and the safeguarding oversight owner. Name who holds each, where they sit, and whether they would pass an FCA interview about your business today. Then hire into the gaps.
Spearpoint Search runs retained searches for fintech and payments leadership, including compliance and MLRO appointments, and will tell you plainly if the role as scoped will not survive regulatory scrutiny or attract the right people. If you are hiring, see how we work with clients. If you are a compliance leader weighing a move, start here. For Sam's deeper take on why boards sometimes hire for cover rather than capability, read The Hire Isn't the Point. The Cover Is. in Talent Before Capital.
This article is general information, not legal or regulatory advice. Requirements vary by firm, activity and jurisdiction, and regulators update their rules and guidance. Take advice from qualified counsel before applying for authorisation or making control function appointments.
Yes. Regulation 21 of the Money Laundering Regulations 2017 requires every UK payment institution and EMI to appoint a nominated officer to receive internal suspicion reports, which is the role known as the MLRO. Firms must also, where appropriate to their size, appoint a board member or senior manager responsible for AML compliance, and tell the FCA who holds both roles within 14 days of appointment.
Not currently. Payment institutions and EMIs are authorised under the Payment Services Regulations and Electronic Money Regulations rather than FSMA, so there are no SMF16 or SMF17 approvals. HM Treasury's 2026 consultation on modernising payments regulation asked whether enhanced senior manager accountability should apply to the sector, particularly for financial crime, so firms should expect clearer individual accountability over time.
Yes. Nothing in regulation 21 prevents one person holding both roles, and it is common in early-stage firms. The FCA will look at whether that person has enough time and sufficient independence, for example whether they also have commercial responsibilities. As products, corridors, agents and alert volumes grow, most firms separate the roles or build a team beneath the combined lead.
The FCA says it does not expect formal qualifications, but it has seen better applications where the MLRO has completed detailed external AML training. Without that, it expects a strong working knowledge of the UK Money Laundering Regulations. It often tests this in a fit and proper interview, asking how money laundering could occur in the firm and how its controls prevent it.
Under CASS 15.2.4R, which came into force on 7 May 2026, a payments or e-money firm must allocate to a single director or senior manager of sufficient skill and authority responsibility for oversight of its operational compliance with the safeguarding regime and for reporting to its governing body. This is often the CFO or COO, with compliance testing the arrangements.