What this means
Start with the exact decision in front of you.
A PML holder in an MLRO or other specified management office may face scrutiny of governance, resources and reasonable steps. Job title alone does not show what the individual knew, controlled or escalated.
Immediate priorities
Organise the position before responding.
Preserve role descriptions, reporting lines and delegated authorities
Build a chronology of risk decisions and escalations
Collect board, committee and resource evidence
Detailed guidance
The procedure, evidence and possible route from here.
01
Define the specified management office
A PML can attach to specified management roles, including compliance, finance, strategy and particular AML or board functions. Begin with the role in force during the alleged failures, not the person's current title. Secure job descriptions, governance terms, reporting lines and board delegations. The Commission may assess what the holder actually directed, but responsibility should not be inferred solely from the label MLRO, director or head of compliance.
For an MLRO concern, distinguish statutory reporting functions, operator AML controls and wider customer-risk systems. Identify which tasks the holder owned, which were delivered by teams and what information escalated to them. For other management offices, use the same discipline. A PML holder can be accountable for oversight without personally completing every control, while adequate delegation still requires information and follow-up suited to risk.
- Fix the role and period precisely
- Separate personal, team and board responsibilities
- Identify information that reached the holder
02
Evidence decisions and reasonable management
Build a chronology of risk decisions, challenge, resource requests, assurance, escalation and remediation. Board packs and committee minutes may be incomplete, so add source communications and data available at the time. Explain why a decision was made, who implemented it and what monitoring was planned. Later knowledge should not be used to portray an earlier risk judgment as dishonest or careless without analysing what was then reasonably known.
The operator may accept failings as part of a regulatory settlement. That can be relevant but does not automatically determine the individual's knowledge or suitability. Compare settlement facts with the personal evidence and identify disagreement expressly. Equally, avoid blaming the operator for matters clearly within the holder's remit. A credible account acknowledges gaps and explains corrective action while preserving accurate boundaries of authority.
- Link management choices to contemporaneous information
- Document challenge, resources and follow-up
- Compare operator admissions with personal evidence
03
Address licensing objectives and suitability
The Commission regulates to keep crime out of gambling, ensure fairness and openness, and protect children and vulnerable people. Connect the alleged management failure to the relevant licensing objective rather than discussing governance in the abstract. Evidence on customer impact, AML exposure, duration and recurrence can affect seriousness. Cooperation and remediation may matter, but they do not replace a finding on what happened.
A section 116 outcome can affect conditions, suspension, revocation, warning or financial penalty where available. Prepare separate submissions on facts, personal suitability and sanction. If the holder has left the operator, explain present role and future safeguards, but do not assume departure ends the review. The PML is personal and can affect work across the industry until surrendered, suspended or revoked under the proper process.
- Tie the concern to a licensing objective
- Address personal suitability after factual findings
- Explain future role and safeguards accurately
Key questions
Keep the analysis tied to this stage.
The holder's actual responsibility and knowledge
Whether reasonable management steps were taken
How operator systems affected individual action
Advice is provided only by the regulated firm that accepts a matter.
Common questions
Clarifying the route without assuming the outcome.
Is an MLRO personally responsible for every operator AML failure?
No. The holder's actual responsibilities, knowledge, authority, oversight and decisions need evidence, although an MLRO role can carry significant personal duties.
Can a PML review continue after leaving the operator?
Yes. A PML is personal, and departure from one business does not necessarily resolve suitability or regulatory action.
Connected guidance
Continue through the topic map.
Use the hub for the full sequence or choose the connected route that matches the notice.
Official sources
Check the material for this question.
Sources checked 19 September 2026. Rules change, so compare the current notice and linked official material and tell the operator if a citation or summary needs correction.