MLRO and Deputy MLRO

The Money Laundering Reporting Officer (MLRO) is accountable for the institution's suspicious transaction reporting and its AML controls. In FlowSentry, the MLRO and the Deputy MLRO hold identical permissions. The deputy exists so that there is always a second senior decider: when the MLRO records a suspicion or makes a change, the deputy decides or approves it, and the other way round.

Important: Multi-factor authentication is mandatory for the MLRO and Deputy MLRO. On first sign-in you are sent to Security & MFA (/account/mfa) to enrol an authenticator app before you can continue. Adding a passkey as well is recommended.

What you can do

You have everything an analyst and senior analyst can do, plus the following.

Suspicion and reporting

• Decide each suspicion in MLRO decisions: File STR, Return to the investigator, or Do not file with grounds.
• Each suspicion shows its goAML readiness; File STR opens only once the check passes with no errors. Run Check goAML readiness to re-check and to see which report fields were filled from your data.
• View the STR register on Reporting, download watermarked XML and export the register.
• Prepare the FIU portal hand-off: download the bundle, upload it to the goAML portal yourself, then record the portal reference.
• Record an FIU rejection and return a report for correction.
• See STR-restricted cases and the Reporting KPIs dashboard.

Approvals

• Approve or reject rule versions, and switch built-in scenarios off or on through approval.
• Confirm true matches and approve proposed clears on screening hits.
• Propose and approve list changes and good-guy exclusions (never the same item).
• Review and approve onboarding applications, including high-risk ones.
• Approve KYC changes, EDD sign-offs, risk overrides and risk model activations.
• Complete an EWRA cycle as the sign-off.

Supervision and oversight

• Supervise the alert queue, bulk close where policy allows, and run QA review.
• See the AI usage dashboard and every other dashboard.

Where you work

Page	Route	What for
MLRO decisions	/approvals	Decide each suspicion
My approvals	/approvals/inbox	Every four-eyes item waiting for you
Reporting	/reporting	STR register, CTR register, FIU hand-off
Reporting KPIs	/dashboards/reporting	Filing volumes, timeliness and FIU rejections
Alerts & cases	/alerts	The queue and every case, including STR-restricted ones
QA review	/qa	Sampled alert closures
Rule library	/monitoring/rules	Approve rule versions
Screening	/screening, /screening/exclusions, /screening/lists	Hits, exclusions and lists
Risk models and EWRA	/risk/models, /risk/ewra	Model activation and enterprise-wide risk assessment
EDD workbench	/risk/edd	Sign off high-risk relationships
KYC changes	/customers/kyc-changes	Approve KYC changes
Dashboards	/dashboards	Every dashboard your institution uses

What needs a second person

The MLRO and deputy check each other. A few examples:

You make	The other decides	Step-up
A suspicion you recorded yourself	The Deputy MLRO (or the MLRO, if the deputy recorded it)	Yes, to file
A list change or exclusion you proposed	Another list approver	Yes
A replacement report after an FIU rejection	A different MLRO or deputy	Yes

If you open a suspicion you recorded, the page tells you: "You recorded this suspicion — another decider (the designated deputy) must decide it."

Step-up actions

You will be asked for a fresh second factor (at most five minutes old) when you:

• file an STR or mark reports as uploaded to the FIU portal;
• confirm a true match or approve a proposed clear;
• approve a list version, internal list change or exclusion;
• approve a rule, a KYC change, a risk override or a model activation;
• approve a high-risk onboarding application;
• complete an EWRA cycle.

What you cannot do

• Approve your own work. The server refuses with "The approver must be a different person from the author (segregation of duties)."
• Submit to the FRC from inside FlowSentry. FlowSentry prepares, validates and tracks the report; the upload to the goAML portal is yours.
• Change tenant settings, connect data sources or approve mappings. Those belong to administrators.
• Let an AI assistant decide. It can draft a narrative; only you file.

Note: Your institution sets the suspicion clock (two business days by default). Items show "MLRO decision due" so you can see what is closest to its deadline.

A typical day

1. Open MLRO decisions and check Awaiting a decision and Due within 24 hours.
2. For each item, read the narrative, grounds, indicators, transactions and evidence.
3. Run Check goAML readiness. Fix the data, not the report.
4. File STR, Return with what more is needed, or Do not file with grounds.
5. On Reporting, prepare the FIU portal hand-off and record portal references.
6. Clear My approvals: rules, screening confirmations, KYC changes, overrides.
7. Review Reporting KPIs and Operations & SLA for backlogs and overdue filings.

Related

• User roles at a glance
• Draft and file an STR
• MLRO guide
• Compliance and governance guide
• Sign in and MFA