The MLRO Annual Report: What to Include and How to Make It Useful
Once a year, the person responsible for a firm's AML compliance has to stand in front of the board and answer a simple question: is our AML program working? The MLRO annual report — called the compliance officer's report or AML annual report in some regimes — is the document that answers it.
It is also one of the documents supervisors look at first. A good report shows a firm that understands its risks and is managing them. A thin one suggests a board that isn't being told what it needs to know.
This guide covers who needs to produce the report, what it should contain, and how to make it useful to the board rather than a once-a-year formality.
Who needs to produce one
The underlying principle is international: FATF Recommendation 18 requires firms to have compliance management arrangements, with a compliance officer at management level, and senior management is accountable for the effectiveness of AML controls. Regular reporting from the compliance officer to senior management is how that accountability works in practice.
Some regimes make the annual report explicit. In the UK, for example, the FCA expects the governing body of an authorised firm to commission a report from its MLRO at least annually, assessing the operation and effectiveness of the firm's systems and controls for managing money laundering risk. Industry guidance such as the JMLSG Guidance sets out what such a report typically covers. Elsewhere, the obligation may be framed as regular reporting by the compliance officer to the management body — the EU's new Anti-Money Laundering Regulation, which applies from 10 July 2027, includes a requirement of this kind.
Even where no annual report is formally required, producing one is good practice. It is the most efficient way to evidence senior management oversight.
What to include
There's no mandatory template, but a strong report generally covers the following.
1. Executive summary and overall opinion
Lead with your conclusion. Is the AML control framework operating effectively? Where are the material weaknesses? What do you need the board to decide or approve? Many board members will read only this section, so make it count.
2. Changes in the regulatory and threat environment
New laws, rules and supervisory guidance that took effect in the year or are coming soon, changes to FATF lists and national risk assessments, new sanctions regimes, and emerging typologies relevant to your business. Explain what each change means for the firm, not just that it happened.
3. The business-wide risk assessment
A summary of the current business-wide risk assessment: key risks, changes since last year and why, and whether residual risk sits within the board's risk appetite.
4. Customer risk profile
The number of customers by risk rating, the proportion that are high risk, PEPs and customers linked to high-risk countries, and how these have moved over the year. Unexpected trends — for example, a sharp rise in high-risk customers from a single channel — deserve explanation.
5. Due diligence and ongoing monitoring
Onboarding volumes and rejections, EDD cases, the status of periodic KYC reviews including any overdue backlog, and the performance of transaction monitoring: alert volumes, investigation times and backlogs.
6. Suspicious activity reporting
The number of internal reports raised by staff, the number of external reports made to the financial intelligence unit, and the time taken from internal report to decision. Use aggregate figures only — the report shouldn't contain details that could identify subjects, and access to it should be limited accordingly.
7. Sanctions
Screening coverage, match volumes, any true matches, any breaches or near misses, and any reports made to the relevant sanctions authority.
8. Training
Completion rates by population, what the training covered, any targeted training delivered during the year, and how you assessed whether it was effective. See our guide to AML training requirements.
9. Audit, testing and supervisory findings
Findings from independent testing, internal quality assurance and supervisory engagement, with the status of each remediation action and any that are overdue.
10. Resources
Whether the compliance function has enough people, skills and systems to do its job. If it doesn't, this is the place to say so — and to ask for what's needed.
11. Action plan
Priorities for the coming year, with owners and target dates. Include the status of last year's action plan, too: the board will want to know whether what was promised last year was delivered.
Making the report useful
- Give an opinion, not just data. A report of statistics without analysis leaves the board to draw conclusions it isn't equipped to draw. Say what the numbers mean.
- Compare with last year. Trends tell the board more than single figures.
- Be candid about weaknesses. A report that finds no problems is rarely believed by a supervisor. Identifying issues and showing a plan to fix them is a sign of a healthy program.
- Make decisions explicit. If you need approval of the risk assessment, an increase in budget or acceptance of a risk, ask for it clearly.
- Evidence the discussion. The report alone isn't enough. Board minutes should show that it was discussed, challenged and acted on.
Timing and planning
The report usually needs to be ready for a specific board meeting, so work backwards from that date. Gathering the data, drafting, review by senior management and board paper deadlines can easily take six to eight weeks. Some firms align the report with their financial year end; others time it to follow the annual review of the risk assessment so the two can be presented together.
Either way, it belongs on your AML compliance calendar with a named owner and a start date well before the board meeting. For a UK-focused checklist of contents, Regmindr's guide on what to include in an MLRO annual report is a useful companion to this one.
Key takeaways
- The MLRO annual report is how the compliance officer tells senior management whether the AML program is working — and how the board evidences oversight.
- Lead with an overall opinion, then cover the risk assessment, customer risk, CDD and monitoring, reporting, sanctions, training, findings, resources and the action plan.
- Analyse, compare with last year and be candid about weaknesses.
- Make sure board minutes show the report was discussed and acted on.
Much of the data in a good annual report comes straight from your AML program — risk assessment, customer risk ratings, reviews and findings. Regpin keeps that information in one place, so the report is easier to produce and easier to evidence. Book a demo to see how.
This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.