Hiring an AML Officer / MLRO
Licensing and operating aren’t two separate problems
People tend to think of AML compliance in two chunks — get through the application, then deal with the rest later. But EU regulators don’t really see it that way. Their expectations don’t stop at approval; if anything, they get more demanding once a business is actually moving money.
Before approval, a supervisor wants to see someone real in the seat — not a name added to a form the week before submission, but a person with a background that actually fits. After approval, that same regulator still expects the role to be doing something: overseeing transactions, flagging what looks wrong, filing reports when needed, being reachable if a question comes in. Very few outside providers cover both halves well. Most are good at one and basically absent for the other, which leaves a business scrambling to find someone new right when it can least afford the gap.
There’s a second, quieter version of this mistake that’s arguably worse because it’s harder to spot. Plenty of companies do build a solid AML function going into licensing — hire someone competent, get through the review cleanly. Then eighteen months pass. The company adds a product line, opens in a second country, doubles its transaction volume, and nobody stops to ask whether the same person, working the same way, is still enough. They’re not, usually. The role has to grow with the business, and that growth doesn’t happen automatically just because the original setup was fine at the time.
Think about what actually changes in that window. A payments company that started with a single product and a few thousand customers a year might, eighteen months later, be running three products across two markets with tens of thousands of active accounts. The AML Officer who was perfectly capable of manually reviewing a handful of flagged transactions a week is now facing dozens a day, plus new customer types, plus new payment rails that didn’t exist when the original policy was written. Nobody planned to under-resource compliance. It just quietly stopped matching the business it was supposed to protect, one incremental change at a time.
It’s not just banks
If you assume this only applies to obviously «financial» companies, you’re already behind. Payment processors and neobanks are the easy examples, sure. But crypto exchanges and custodians fall under it too, and that requirement is only getting more specific as MiCA rules bed in. So do casinos and betting operators, because of how fast and how large the money moving through them tends to be. Real estate brokers, jewelers, art dealers, auction houses — all captured, because a single big, infrequent transaction is exactly the kind of thing someone laundering money is looking for. Currency exchanges, money transmitters, insurers, corporate service providers — the list is longer than most founders expect, and a decent chunk of them find out only once a bank or regulator brings it up.
There’s also a group that doesn’t fit neatly into any sector: businesses whose AML program was built purely to get a licence approved, with no real intention of running it afterward. Or businesses about to be sold, or about to raise a round, where someone on the other side is finally going to look closely at how serious the compliance actually is. These are often the most exposed, mostly because nobody flagged the problem until it was already sitting across the table from an investor.
It’s worth pausing on why sector assumptions get this wrong so often. People tend to judge AML risk by how a business feels — whether it looks like a bank or moves money the way a bank does. But regulators judge risk by transaction size, frequency, and how easy it is to disguise the origin of funds moving through it. An auction house selling a handful of paintings a year, each worth six figures, can carry more genuine laundering risk than a payments app processing thousands of ten-euro transfers a day, purely because large, opaque, low-frequency deals are exactly the kind of thing that’s hard to trace and easy to justify after the fact. A business that doesn’t look «financial» can still be sitting squarely inside the requirement, and plenty of them only discover that the first time a bank asks an uncomfortable question about a client’s source of funds.
Where this actually falls apart
Here’s the part nobody likes to say out loud: a policy and a working program are not the same thing, and a lot of providers will happily sell you one while letting you assume you bought the other.
What tends to happen when that gap gets exposed:
Applications stall, sometimes get rejected outright, because the underlying framework doesn’t hold up once someone reads past the first page. Bank accounts close with no warning, once the business is actually live and moving money. Inspections turn into remediation orders — or something worse. Investors go quiet, or come back with a lower number, the moment the compliance story feels shaky. And often, whoever was carrying the compliance function alone just burns out and leaves, taking most of the institutional knowledge with them.
None of this shows up while things are calm. It shows up the second someone with real leverage stops skimming and starts asking follow-up questions — wanting the actual transaction log behind a flagged alert, or asking why a borderline case never got escalated, or just catching the AML Officer off guard with something they weren’t ready to answer. A business with a real function answers in a few minutes. A business running on paperwork alone hesitates, or improvises, or tells a story that doesn’t quite add up — and that hesitation usually says more than the actual answer would have.
Why does that matter so much? Because nobody asking these questions actually cares whether a document exists somewhere on a server. They’re checking whether the person in charge genuinely understands the business well enough to answer something they weren’t handed a script for. A policy copied from a template or written by someone who’s never actually looked at the transaction data falls apart under exactly that kind of pressure.
Picture how this actually plays out for a mid-sized payments company going through a routine bank review. The bank’s compliance team asks for the escalation log tied to a client flagged three months earlier for unusual transaction patterns. If the AML Officer can pull it up in the meeting, walk through what was reviewed, explain why it was or wasn’t escalated to a suspicious activity report, and show the reasoning was documented at the time, the review closes in an afternoon. If instead the request triggers a scramble — someone digging through email threads trying to reconstruct what happened, nobody quite sure whether a report was actually filed — the bank doesn’t wait around for a good explanation. It restricts the account, or closes it, and moves on. The underlying business might be entirely legitimate. It doesn’t matter. The bank isn’t in the business of giving second chances on this particular question.
Why the gap keeps showing up
AML used to be something mostly banks worried about. That’s not true anymore, not in the EU. Any business moving real money or high-value goods is in scope now, and supervisors expect the program to be working from the moment an application lands, not stitched together after the fact.
Part of the problem is talent. Finding someone who actually understands both EU AML law and the specifics of, say, crypto custody or sportsbook operations, is a narrow search — narrower than most founders assume going in. Regulators generally won’t accept «we’re still looking» once an application is under review.
Part of it is calibration. Set monitoring too loose, real risk slips past unnoticed. Set it too tight, and the team spends its time drowning in false alerts instead of catching anything real. There’s no way to set this once and walk away — it needs constant small adjustments as the business’s own transaction patterns shift.
Part of it is just how often the rules move. Guidance shifts, enforcement priorities change, and a policy that was fine a year ago can quietly be out of date without anyone noticing until a supervisor points it out. The EU’s newer AML Regulation — the Single Rulebook that came into force to standardize requirements across all Member States — is a good example of exactly this kind of shift. Obligations that used to vary meaningfully from one national regulator to another are being pulled into one shared framework, and businesses that built their compliance function around an older national standard are discovering they now need to meet a different, more specific bar.
And part of it is bandwidth, plainly. Reports, escalations, internal reviews — none of that pauses because the founders are busy closing a deal or shipping a product. Somebody has to own it continuously, and in most small teams, that somebody is already doing three other jobs.
There’s also a cost dimension to this that founders tend to underestimate at the outset. A qualified AML Officer or MLRO with real sector experience isn’t cheap to hire full-time, especially in markets like the Netherlands, Ireland, or Germany where compliance salaries have climbed sharply as demand has outpaced supply. A small or mid-sized business weighing a full-time senior hire against outsourcing the function to a firm that already has the expertise in place is often making a genuinely close call financially — and a lot of founders default to the in-house hire simply because it feels more permanent, without actually running the comparison on cost, continuity, or coverage.
What actually convinces a bank or a regulator, in the end, isn’t how the policy reads. It’s whether there’s real evidence behind it — an actual history they can check.
Two options, neither one really enough
Most of the market splits into two choices, and honestly, neither one alone gets the job done.
One is buying software — monitoring tools, screening databases. Useful, but it leaves the actual judgment calls to the business: who decides a flagged transaction needs a formal report, who explains emerging risk to a board, who fields a regulator’s question during an inspection. A tool doesn’t do any of that. A person does. Plenty of AML software vendors market their platforms as compliance solutions in themselves, and technically the software does what it says on the tin — it screens, it flags, it scores. What it can’t do is stand in front of a regulator and answer for the business, which is precisely the moment a business finds out that the software was never the whole answer.
The other is hiring a smaller regional firm that writes a policy, places a hire, gets you through one specific application, and then the relationship ends. The moment the business is approved, or needs to expand somewhere new, it’s starting from zero with someone who doesn’t know its history at all. That reset costs more than it looks like on paper — every switch loses the accumulated understanding of a business’s actual risk, its client base, the reasoning behind past decisions. And increasingly, regulators and banks want to see a continuous history, not a pile of disconnected engagements.
What’s missing from both is something that starts during licensing and just keeps running — through the approval, past it, and still there when someone finally decides to test it for real.
Operating in more than one country makes this harder
EU AML rules are supposed to be harmonized, but national regulators still interpret and enforce them differently enough that something built for one country’s supervisor can fall short somewhere else. A function built to actually hold up needs to survive whichever regulator happens to be looking, not just the one it was originally designed around — and that’s a much higher bar than most in-house setups, or most single-market consultancies, are actually built for.
Businesses working across the EU, UK, US, UAE, and Latin America increasingly treat compliance as one connected problem instead of a set of separate country-by-country projects. Something built in isolation for one jurisdiction tends to show its cracks the moment a business expands, applies for a second licence somewhere, or tries to open a new bank account in a different market. What one national regulator waves through, a bank in a neighboring country might consider thin — and a business that didn’t see that coming ends up rebuilding its whole compliance story under time pressure, right when it needs to move fast.
There’s a newer wrinkle here too. The EU has been building out a central AML authority meant to coordinate national supervisors and push toward more consistent enforcement across the bloc, rather than leaving each Member State to interpret shared rules however it sees fit. As that coordination tightens over the next few years, the gap between «good enough for one country’s regulator» and «good enough everywhere» is likely to shrink — which is good news for consistency long-term, but not much comfort for a business trying to satisfy today’s patchwork of standards right now.
What good actually looks like in practice
So, what separates a real function from a decorative one? The difference isn’t always obvious from the outside.
A real function has documentation that was created at the time a decision was made, not reconstructed afterward when someone asks for it. It has an AML Officer who can explain, off the cuff, why a specific client was or wasn’t escalated — not because they memorized a script, but because they were actually involved in the decision. It has monitoring thresholds that get revisited periodically, not set once during onboarding and left untouched for years. It has a clear line of communication to the business’s leadership, so that risk isn’t something discovered by accident during an audit but something senior management already has visibility into. And it has continuity — the same institutional understanding of the business’s risk carrying forward, rather than resetting every time a provider relationship ends.
None of that requires a huge team or an enormous budget. It requires the function being treated as ongoing work rather than a one-time deliverable, and it requires whoever holds the AML Officer role having enough authority and enough context to actually do the job, rather than just holding the title.
What actually separates the two outcomes
The AML Officer role isn’t something you check off once. It’s the actual center of whether a compliance program is real or just looks real on a page. The businesses that get this right don’t treat licensing and ongoing operation as different projects — they build one thing that holds up before approval and keeps holding up long after. The ones that get it wrong tend to find out at the worst possible moment, in front of exactly the regulator, bank, or investor who finally decided to dig in.
Getting it right isn’t only about avoiding disaster. It’s about having something that actually fits the business behind it — someone with real standing, real understanding of the risk, and the ability to answer a hard, unscripted question without flinching, whenever that question happens to come.
SOURCES
Regulation (EU) 2024/1624 (AMLR) — Official Text — eur-lex.europa.eu
Regulation (EU) 2024/1624 (AMLR) — Full Text — anti-money-laundering.eu
AMLA — Official EU Authority Website — amla.europa.eu
AMLA Governance — amla.europa.eu
AMLA — EU Careers Overview — eu-careers.europa.eu
AMLA Takes Major Step Toward Harmonised EU Supervision — amla.europa.eu
Explainer: Towards AMLA’s Direct Supervision (PDF) — amla.europa.eu
Understanding Article 11 of EU Regulation 2024/1624 — compliance360.mt
New Group-wide Requirements under Art. 16 AMLR — anti-money-laundering.eu
Direct Supervisory Powers of the New European AML Authority — jonesday.com
Money Laundering Reporting Officer (Glossary) — compliancebureau.org
Core Responsibilities of an MLRO — shuftipro.com
