Every relevant person on the Isle of Man must appoint a Money Laundering Reporting Officer (MLRO). Code para 23(1) makes it a hard requirement: the MLRO is the named individual who receives internal disclosures, assesses them, and decides whether to report externally to the Financial Intelligence Unit. That reporting function is the MLRO's alone — it cannot be delegated away or diluted by committee. What the MLRO is not responsible for is compliance monitoring. The Island splits those two jobs deliberately: the MLRO handles disclosures under Code para 27, while a separate "suitable person at management level" under Code para 30 monitors and tests whether your AML/CFT controls actually work. There is no combined "MLCO" role here. If you have arrived from Jersey, Guernsey or Gibraltar expecting one, the Isle of Man does not use that title.
Getting the appointment right matters because the duties attach to a person, not a policy. This is about deciding who you must appoint, what statutory functions sit with them, and precisely what they carry personally once they take the role.
Who you must appoint, and what the Code requires of them
Code para 23(1) requires a relevant person to appoint an MLRO to exercise the functions set out in paras 25 and 27 — receiving internal disclosures and deciding on external reporting. That is the core of the role, and it is not optional. Para 25 establishes that the internal reporting chain must run to the MLRO: when a member of staff forms a suspicion, the route for that disclosure leads to this named individual and no one else.
The Code then sets a standard for how effective that person must be. Code para 23(2) requires that the MLRO be either sufficiently senior in the organisation or have sufficient experience and authority; have a right of direct access to the officers of the relevant person; have sufficient time and resources to carry out the role properly; and retain responsibility for all external disclosures, including where a branch or subsidiary sits in another jurisdiction. Read those four together and the intent is clear: the MLRO cannot be a junior appointee who has to seek permission to escalate, cannot be someone squeezed into the role with no capacity, and cannot hand the reporting decision off to a parent company overseas.
This is where the "can we make the MLRO part-time or outsourced?" question really lands. There is no general residence requirement for the MLRO in the Code — the one exception is Code para 24(1)(a), which requires the MLRO of an insurer, insurance intermediary or insurance manager to be resident on the Island. Outside that insurance-sector rule, the Code does not in itself bar a non-resident or outsourced MLRO. But it does demand seniority, direct access, time and resources, and retained responsibility for every external disclosure — an arrangement that cannot meet those four tests fails para 23(2) whatever it is called. Separately, licenceholders subject to the Financial Services Rule Book 2016 must appoint a resident Head of Compliance, so for regulated firms the practical picture usually includes an Island-based compliance presence in any event.
If you are working out whether your current MLRO arrangement meets the para 23(2) tests, we can review it with you.
What the MLRO is personally on the hook for
The heart of the role is the reporting decision. Under Code para 27(1), where an internal disclosure has been made to the MLRO, that person must assess it to determine whether there are reasonable grounds for knowing or suspecting money laundering or the financing of terrorism. This is a judgement the MLRO makes on the evidence in front of them — not a rubber stamp on someone else's view. Code para 27(2) then sets the consequence: where the MLRO knows or suspects, or has reasonable grounds to know or suspect, they must make an external disclosure to the Financial Intelligence Unit as soon as is practicable.
Those two paragraphs are what an accountable person takes on with the MLRO title. You are the individual who has to reach a view on each internal disclosure, and the one who has to report to the FIU when the threshold is met. "As soon as is practicable" is not "when it is convenient" — a report that sits unactioned while the MLRO deliberates is the kind of thing that becomes a finding. The decision and its timing are both personal.
That is precisely why para 23(2) insists on seniority, direct access and resources: the Code wants someone with the standing to act on a suspicion without having to persuade the business first, and the time to do the assessment properly. Where the MLRO is unavailable, Code para 23(3) permits — but does not require — the appointment of a Deputy MLRO to act in their absence. For most relevant persons a Deputy is discretionary. For licenceholders subject to the Financial Services Rule Book 2016 it is not: the Rule Book requires a Deputy MLRO, and the Handbook is clear that a Deputy should be of similar status and experience to the MLRO. A Deputy who could not credibly make the same reporting decision defeats the purpose of having one.
Why compliance monitoring is a separate role
This is the point that most often trips up firms and their advisers coming from other jurisdictions. On the Isle of Man, deciding on disclosures and checking that your AML/CFT programme works are two distinct functions held by two distinct people.
The MLRO's remit, as we have set out, is disclosures. Compliance monitoring sits under Code para 30. Para 30(3) and (4) require a relevant person to ensure there is a "suitable person at management level" responsible for monitoring and testing compliance with the AML/CFT framework — and that person must meet the same effectiveness test as the MLRO: sufficiently senior, with direct access, and with sufficient time and resources. Under para 30(1) and (2), that person establishes the procedures for monitoring and testing and submits a report to senior management at least annually. Their job is to test whether the controls do what they are supposed to, and to tell the top of the house what they found.
The AML/CFT Handbook is explicit about who this person should be. At §6.1 the Authority states that it expects the para 30 "suitable person" to be the firm's Head of Compliance — the holder of Controlled Function R13 — for regulated firms, or the compliance officer for registered firms. It also indicates that this person should ideally be independent from whoever designed or carried out the procedures being tested, for the obvious reason that you cannot objectively audit your own work. So the structure is a genuine split: the MLRO and Deputy MLRO handle disclosures under paras 25 and 27; the Head of Compliance or para 30 suitable person handles monitoring and testing.
This answers "do we need an MLCO like Jersey or Guernsey?" and "isn't the MLRO enough?" directly. You do not need an MLCO, because the Isle of Man does not have that role — a full-text search of the Code and the Handbook returns "Money Laundering Compliance Officer" and its abbreviation zero times. And the MLRO is not enough alone, not because the MLRO is inadequate, but because the Code deliberately assigns monitoring to a different person under para 30. Collapse the two into one seat and your compliance monitoring is being marked by the same person whose framework it is meant to test.
If your firm has been trying to run both functions through one appointment, or is unsure who your para 30 person is, we can map the split for you.
Common mistakes we see
The most frequent is the overloaded MLRO — a genuinely senior person given the title but no protected time, so assessments under para 27 queue up behind the day job. Para 23(2)(c) requires sufficient time and resources, and an MLRO who cannot get to disclosures promptly is not meeting it. The second is the collapsed role: one person named as both MLRO and the para 30 monitoring person, which the Code's structure does not contemplate and which destroys the independence the Handbook expects at §6.1. The third is the absent Deputy — a licenceholder under the Financial Services Rule Book 2016 that has never appointed the Deputy MLRO the Rule Book requires, leaving no one able to act when the MLRO is on leave. And the fourth is the offshore reporting decision, where a group tries to route external disclosures through a head office elsewhere; para 23(2)(d) keeps that responsibility with the Island MLRO.
Underlying most of these is a governance point worth stating plainly. The relevant person is ultimately responsible for AML/CFT compliance regardless of any outsourcing or reliance on third parties, and the AML/CFT Handbook's guidance on Code para 4 requires that the firm's procedures and controls be approved by senior management. Appointing an MLRO does not transfer the firm's responsibility to that individual — it discharges a specific duty within a framework the board still owns. The appointments only work when they sit inside proper governance, which is the same discipline that runs through the customer risk assessment and the statistical return that evidences your BRA. For how these roles fit the wider framework, our overview of the April 2026 AML/CFT Handbook sets out the landscape.
We help Isle of Man firms get these appointments right — the MLRO, the Deputy, and the para 30 monitoring role — so each one meets the test the Code sets for it.
Frequently asked questions
Does the Isle of Man have an "MLCO"?
No. The Isle of Man does not use the title Money Laundering Compliance Officer — the term appears nowhere in the AML/CFT Code or the Handbook. It is a Channel Islands and Gibraltar term. On the Island the functions are split: the MLRO and Deputy MLRO handle disclosures under Code paras 25 and 27, while a separate "suitable person at management level" under Code para 30 — typically the Head of Compliance — handles monitoring and testing.
Can the MLRO be outsourced, part-time or non-resident?
The Code sets no general residence requirement for the MLRO; the one exception is Code para 24(1)(a), which requires the MLRO of an insurer, insurance intermediary or insurance manager to be resident on the Island. Any arrangement, however structured, must still satisfy Code para 23(2): sufficient seniority or experience and authority, a right of direct access, sufficient time and resources, and retained responsibility for all external disclosures. An outsourced or part-time model that cannot meet those tests does not comply.
Do we need a Deputy MLRO?
For most relevant persons, Code para 23(3) makes the Deputy MLRO permissive — you may appoint one to act in the MLRO's absence. For licenceholders subject to the Financial Services Rule Book 2016, it is mandatory: a Deputy MLRO must be appointed, and if appointed the Handbook expects them to be of similar status and experience to the MLRO so they can credibly make the same reporting decisions.
What is the MLRO personally accountable for?
For the disclosure function. Under Code para 27(1) the MLRO must assess each internal disclosure to determine whether there are reasonable grounds to know or suspect ML/FT, and under para 27(2) must make an external disclosure to the Financial Intelligence Unit as soon as is practicable where the threshold is met. That decision and its timing sit with the individual MLRO. The firm remains ultimately responsible for compliance overall, but the reporting judgement is personal.
Appoint the MLRO for the disclosures, appoint the compliance monitor for the testing, and never ask one person to sit in both chairs — the Code wrote them as two seats for a reason.
