Compliance department: what it does, how to structure it and who to hire first

A compliance department is the team that makes sure a company follows the laws, regulations and internal policies that apply to it, and can prove it to its regulator. At a fintech, PSP or crypto firm its core is financial crime, and you build it in a fixed order: a board member who owns compliance, then a money laundering reporting officer (MLRO), then analysts, then specialists, with an independent audit checking all of it.

The order matters more than the headcount. Regulators rarely fine a company for being small. They fine it because its controls did not keep pace with its growth. The FCA wrote that Starling's "financial crime controls, however, failed to keep pace with its growth" (2024 final notice, £29 million), and that key parts of Monzo's framework "did not keep pace with the Firm's expansion" (2025, £21 million).

What does a compliance department do?

A compliance department is the second line of defence: it sets the rules the business follows and checks that it follows them, independently of the teams that sell. (The first line is the business itself; the third is independent audit. See the three lines of defence.)

In a financial crime context, its job breaks down into five functions:

• Policy and risk assessment: the business-wide risk assessment and the policies that follow from it.
• Onboarding: KYC on individuals, KYB on companies, including the ownership structure and UBO verification.
• Screening and monitoring: sanctions, PEP and adverse media screening, transaction monitoring, periodic reviews.
• Reporting: suspicious activity reports to the financial intelligence unit, and the regulator's returns.
• Training and assurance: staff training, quality checks and the link with internal or external audit.

Beyond financial crime, the same department usually owns data protection, conduct and consumer rules, whistleblowing, regulatory change monitoring and the licence itself. A bank splits these into separate teams; a fintech usually puts them under one head of compliance. This guide focuses on the financial crime core, because that is where the law names the people.

What is the difference between compliance and legal?

Legal tells the business what it can do; compliance makes sure it does what it must, every day, and reports to the regulator. Small firms often put them under one executive, but the compliance officer must stay independent of the business lines it controls.

Who is legally required in a compliance department?

Two roles are named in law, and they are not the same person by default.

The board member responsible for compliance. Today, Article 46(4), Directive (EU) 2015/849 asks you to identify that board member "where applicable"; in the UK it is regulation 21(1)(a) of the Money Laundering Regulations 2017. From 10 July 2027, the EU Anti-Money Laundering Regulation makes it universal: every obliged entity must appoint "one member of the management body in its management function" as compliance manager, who must also ensure "sufficient human and material resources" are allocated (Article 11(1), Regulation (EU) 2024/1624).

The compliance officer, or MLRO. The UK name is MLRO: the FCA requires that the MLRO has "a level of authority and independence within the firm and access to resources and information sufficient" for the job (SYSC 6.3.9 R), and at FSMA-authorised firms under the Senior Managers and Certification Regime it is a senior management function, SMF17 (SUP 10C.6.2 R). From July 2027, the AMLR requires a compliance officer appointed by the management body "with sufficiently high hierarchical standing", responsible for the day-to-day policies, procedures and controls, the contact point for regulators and the person who files suspicious transaction reports (Articles 11(2) and 69(6), Regulation (EU) 2024/1624).

National names differ, the substance does not:

Can one person be both? From July 2027, yes, where the nature of the business, its risks and its size justify it (Article 11(7), AMLR). Today, for banks, PIs and EMIs, the EBA expects a separate compliance officer at management level unless the firm is a sole trader or has "a very limited number of employees" (EBA/GL/2022/05, paragraphs 25 and 32). In Germany the Geldwäschebeauftragter sits directly below management, reports to it and must have a deputy (GwG section 7(1) and (5)).

Compliance department structure: the org chart at each stage

There is no regulatory headcount. There is a sequence that every supervisor recognises.

Stage 1: licence application. A founder or executive sits on the board as the compliance owner. A named MLRO is in post before you file: the regulator assesses this person, interviews them and reads the policies they wrote. Independent audit is bought in. No analysts yet.

Stage 2: first customers. The MLRO plus one or two KYC analysts doing onboarding and screening review. The MLRO still writes policy, reviews escalations and files every report. Training starts here, and it has to be on record: today under Article 46(1), Directive (EU) 2015/849 and, in the UK, MLR 2017 regulation 24(1)(b), which requires a written record of the training given; from July 2027 the AMLR requires training programmes that are "duly documented" (Article 12).

Stage 3: scale. Split the work by function: onboarding, screening and monitoring, each with a lead. Appoint a deputy MLRO so reporting never depends on one person's holiday. A head of compliance or chief compliance officer may now sit above the MLRO, covering conduct, payments rules and licensing as well as financial crime.

Stage 4: several licences or countries. One MLRO per regulated entity, usually with local presence (EBA paragraph 28 expects the officer to normally work in the country of establishment; GwG section 7(5) requires it in Germany), and a group function that sets methodology. Quality assurance becomes its own team.

Throughout, the independent audit stays separate. Today the directive asks for an independent audit function where the size and nature of the business justify it (Article 8(4)(b), Directive (EU) 2015/849). From July 2027 the AMLR requires one or, failing that, an external expert (Article 9(2)(b)). The EBA already says it "should not be combined with the AML/CFT compliance function" (paragraph 65).

What should a fintech hire first?

The MLRO, before the analysts. Three reasons. The regulator meets this person during authorisation. The MLRO writes the risk assessment and the policies the analysts will apply, and analysts hired before the rules exist invent their own. And suspicious activity reporting is a personal responsibility of the compliance officer, which an analyst cannot hold.

Then hire analysts for review volume, and specialists (transaction monitoring, sanctions) when a single type of work fills a full role. Hire a deputy MLRO as soon as the MLRO's absence would stop reporting.

Worked example. Northpay, a fictional EMI applicant, hires an MLRO six months before filing. At launch it adds two KYC analysts and outsources its audit. Eighteen months later, with business customers in three countries, onboarding is split from screening, a deputy MLRO is appointed and periodic reviews are automated by risk level. The MLRO stops reviewing routine files and starts reviewing the system that reviews them.

How many compliance teams depend on one reviewer?

On Dotfile, in 46% of compliance teams with three or more reviewers, one person takes more than half of the manual check decisions. In 45% of teams with three or more reviewers, two people take more than 80%.

That is a key-person risk before it is a productivity problem. When the busiest reviewer is also the MLRO, every holiday becomes a backlog and every escalation waits for the same desk. Fix it with structure, not heroics: route files by risk level and workload, give low-risk files to analysts with clear approval rights and keep the MLRO on what only the MLRO can do.

Method: Dotfile analysis, October 2026. Manual check approvals and rejections in customer workspaces on Dotfile over the past year, teams with at least three reviewers and a minimum decision volume; aggregates only.

How Dotfile supports a compliance department

Dotfile routes cases to analysts by risk level, country or workload through assignment rules, sets what each role can do on cases, checks and risk through custom roles, and logs every decision with its author, timestamp and comment in the approval flow. Periodic reviews run on a schedule set per risk level. The decision stays with your team.

FAQ

What is a compliance department in a company?

The function that keeps the company within the laws and regulations that apply to it, and can prove it. In financial services, its core is anti-money laundering: customer due diligence, screening, monitoring and suspicious activity reporting.

Can the founder be the MLRO?

From July 2027 the AMLR allows it in a very small firm (Article 11(7)). In practice most regulators expect a dedicated MLRO with financial crime experience before authorising a PI, EMI or CASP, and the officer "cannot be subordinate to a person who has responsibility for managing" the business lines it controls (EBA/GL/2022/05, paragraph 31).

Who does the MLRO report to?

The MLRO must be able to report directly to the management body. The EBA already expects independence from the business lines for banks, PIs and EMIs (EBA/GL/2022/05, paragraph 31); from July 2027 the AMLR writes the direct line into law for every obliged entity (Article 11(5)), with protection against retaliation and decisions that are not "unduly influenced by commercial interests" (Article 11(4)).

Can we outsource the compliance department?

Tasks, yes; accountability, no. The AMLR lists what can never be outsourced. See what you can outsource in compliance.

How much does a compliance team cost?

People, by a distance. See the cost of a compliance team for sourced salaries by role, loaded costs and the build vs buy maths.