1. What an MLRO is (paras 3.9 / 7.9)
The MLRO is the central reporting point for suspicious transactions and the principal liaison with the Joint Financial Intelligence Unit (JFIU) and law enforcement. The Guideline expects the MLRO to play an active role in identifying and reporting suspicious transactions — not a rubber stamp.
Three core supervisory duties (para 3.9):
- Review internal disclosures and exception reports — decide, on all available information, whether a JFIU report is needed
- Keep records of those internal reviews — report or not, the reasoning must be documented
- Provide guidance on avoiding tipping-off — a colleague telling a client "we reported you" is a separate offence
A key protection (para 7.9): the institution must ensure the MLRO has full staff cooperation and complete access to all relevant documents. An MLRO blocked from seeing files is a systemic failure, not a personal one.
2. Who qualifies — the eight tests (para 3.7)
Senior management should ensure, so far as practicable, that the MLRO is:
| Requirement | What it means in practice |
|---|---|
| (a) Appropriately qualified with sufficient AML/CFT knowledge | No licence-type exam, but you must show training and how you stay current |
| (b) Independent of operational and business functions (size permitting) | Small firms may double-hat — but not the front-line person who originates their own transactions |
| (c) Normally based in Hong Kong | An offshore MLRO must explain how duties are discharged |
| (d) Sufficient seniority and authority in the firm | A junior clerk as MLRO is an inspection finding |
| (e) Regular contact with — and direct access to — senior management | "Reports must pass three layers" is a process failure |
| (f) Fully familiar with applicable law/regulation and the firm's business risks | Not just the rules — how your clients actually behave |
| (g) Timely access to all obtainable information | CDD records, circulars, regulator updates must reach the desk |
| (h) Adequate resourcing, including a suitable deputy | No cover during leave or after departure = a gap |
3. Internal reporting — how the pipe must run (7.13–7.15)
Policies must ensure all staff know who the MLRO is and how to file internal reports (7.13)
Internal reports must reach the MLRO without undue delay (7.13)
Managers outside the AML/reporting function may never filter staff reports — the shorter the chain the better (7.14)
A staff member who reports to the MLRO per policy has fully discharged their statutory duty (7.15) — the ball is then with the MLRO
4. Filing out — JFIU timing (7.20)
Once the MLRO reviews an internal report and concludes there is knowledge or suspicion → disclose to the JFIU (via STREAMS) as soon as reasonably practicable. Reports can precede the suspicious transaction or follow it — the standard is speed, not batching.
The statutory duty comes from s.25A(1) of DTRPO/OSCO and s.12(1) of the UNATMO — failure to report is a criminal offence, regardless of the amount involved.
5. The "decided not to report" safe harbour (7.21) + records
An MLRO who, in good faith and after considering all available information, concludes there are no suspicious circumstances is "unlikely" to incur criminal liability — provided the deliberation and actions are properly documented. An undocumented "I thought about it" does not exist in an enforcement interview.
- Further suspicion on the same client still gets reported (7.30) — one past STR is no immunity
- Record contents (7.31): report date, handler, assessment outcome, whether it led to an STR, and where supporting documents are kept
6. Personal accountability — MLROs do get suspended
The CEO, director, RO and MLRO of a brokerage (Shum Chun Wai) was suspended for ten months (from 15 July 2021) — firm AML failures plus failure to discharge MLRO duties. The release explicitly cites the Guideline paragraphs on the MLRO role: "I didn't know what an MLRO does" is not a defence.
A 2025 SFC circular restates it: senior management — including MLROs — who fall short face supervisory action (licensing conditions, business restrictions) and disciplinary action up to licence revocation.
7. Official sources
| Document | Link |
|---|---|
| AML/CFT Guideline (for LCs and SFC-licensed VASPs), chapters 3, 7, 9, 11 | sfc.hk ↗ |
| Anti-Money Laundering Ordinance, Cap. 615 | elegislation.gov.hk ↗ |
| Joint Financial Intelligence Unit — STREAMS filing | jfiu.gov.hk ↗ |
| Enforcement news 21PR77 — CEO/MLRO suspended 10 months | sfc.hk enforcement ↗ |
8. FAQ
Can a small firm have one person act as both CO and MLRO?
Yes — para 3.6 allows the same staff member to hold both functions, depending on firm size. Small firms commonly have the RO or compliance head double-hat. But the person must still pass all eight para 3.7 tests.
Does the MLRO need SFC approval?
No — it is an internal appointment. If the person also serves as AML/CFT Manager-In-Charge, that MIC appointment must be notified to the SFC under the MIC regime.
How quickly must suspicion reach the JFIU?
"As soon as reasonably practicable" after the MLRO concludes suspicion exists (7.20); staff reports must reach the MLRO "without undue delay" (7.13). In practice: same-day internal filing, documented assessment, same-day STREAMS where suspicion stands.
Is deciding not to report a criminal risk?
Good faith + all available information + documented reasoning → "unlikely" criminal liability (7.21). But failure to report is a crime under s.25A — the safe harbour covers reasonable, recorded judgement, not inaction.
Can the SFC discipline an MLRO personally?
Yes — the 21PR77 MLRO was suspended ten months. The role is personally accountable, not a title.