The role of MLRO was enshrined in UK law back as far as 2007. But over a decade later, even the definitions of institutions like the Law Society can seem at best ambiguous or at worst vague.
Many think the first task is to undertake a financial crime risk assessment. It's not. Step one is to get clear guidance from senior management on the firm's overall risk assessment and risk appetite, as these are the primary drivers for the financial crime risk assessment.
An MLRO needs clear written guidance on the risks their firm has identified, the level of appetite to take on the various risk levels and a commitment to provide adequate resources to manage these risks.
Everything from there on follows a relatively structured model.