Crypto compliance officer · MLRO role
Crypto Compliance Officer 2026 — MLRO Role and Responsibilities Guide
The crypto compliance officer role under MiCA is more demanding than founders typically anticipate. The MLRO (Money Laundering Reporting Officer) function alone runs broader than pre-MiCA VASP register expectations. The combined compliance role — AML plus prudential plus conduct plus DORA — typically requires a senior-tier hire with EUR 120-200k loaded annual cost. This is the role in practice.
The crypto compliance officer is the senior management function responsible for CASP compliance with applicable regulatory frameworks — AML, conduct of business, prudential, ICT and operational resilience under DORA, customer asset protection, and ongoing supervisor relationship. The role typically combines MLRO duties with broader compliance oversight depending on operator scale and organisational structure.
Quick facts
| Parameter | Value |
|---|---|
| Role categories | Standalone Head of Compliance, MLRO, DPO, Risk Officer — combined or separate depending on operator scale |
| Senior management function | Recognised senior management function under MiCA Article 68 and national equivalents (e.g. UK FCA SMF-16, SMF-17) |
| Substance requirements | Jurisdiction-resident, extensive industry experience, regulatory engagement track record, fit-and-properness clearance |
| Typical compensation | EUR 120,000-200,000 base + benefits (mid-tier CASP); EUR 200,000-400,000 (premier-tier or considerable CASP) |
| Reporting structure | Direct reporting to board or CEO; functional independence from commercial operations |
| Approval requirement | Supervisor approval required at CASP authorisation; ongoing supervisor relationship maintained throughout role tenure |
| Personal liability | Material personal liability for breach — civil penalties, regulatory sanctions, in extreme cases criminal liability |
| Team build | Compliance officer typically leads team — AML analysts, compliance specialists, operational compliance staff scaling with operator size |
What the role actually involves
The crypto compliance officer role under MiCA combines several functions:
MLRO (Money Laundering Reporting Officer) duties. Customer due diligence framework oversight, suspicious activity reporting to national FIU, AML programme management, sanctions screening oversight, internal AML training, supervisor relationship for AML matters.
Broader compliance leadership. Conduct of business compliance, prudential compliance, ICT/DORA operational resilience compliance, customer asset protection compliance, market abuse compliance under MiCA Title VI, ongoing supervisor relationship management.
Senior management responsibility. The role typically operates as senior management function with direct board reporting, functional independence from commercial operations, and personal accountability for compliance outcomes.
Team leadership. Compliance officer typically leads compliance team scaling with operator size — AML analysts, compliance specialists, operational compliance staff, sometimes dedicated sanctions officers and DPO.
External engagement. Supervisor relationship, FIU engagement, industry compliance community participation, professional development. The external dimension is substantial.
The role is not a back-office function. Under MiCA, the compliance officer is one of the most consequential senior management hires the operator makes.
Role splits at different scales
Small CASPs (under 10 staff). Single compliance officer combines MLRO + Head of Compliance + sometimes DPO functions. The combination is permitted but produces capacity strain at growth. Many small CASPs operate the combined role for initial 12-24 months before splitting.
Mid-tier CASPs (10-50 staff). Typically split into Head of Compliance + MLRO as separate roles. Head of Compliance manages broader framework; MLRO focuses on AML and FIU relationship. DPO sometimes shared with broader operations. Risk officer typically standalone.
Substantial CASPs (50+ staff). Full senior management split — Head of Compliance, MLRO, DPO, Chief Risk Officer all standalone roles. Compliance team has dedicated specialists for AML, sanctions, conduct, prudential, market abuse, customer asset protection. Supervisor relationship has dedicated relationship-management capacity.
Premier-tier / significant CASPs. Group-level compliance organisation with multiple senior compliance officers across functions. Subsidiary-level compliance officers for international operations. Chief Compliance Officer at C-suite level.
The split decisions depend on operator profile, regulatory environment, and specific business model. Single-officer designs at substantial-CASP scale face supervisor scrutiny and operational stress.
Substance requirements
MiCA Article 68 and national equivalents impose substance requirements on the compliance officer role:
Jurisdiction residence. Compliance officer typically must be resident in the CASP’s home jurisdiction. Non-resident compliance officers face supervisor refusal at authorisation. Residence-flexibility exists at premier-tier banks but not typically at CASPs.
Substantive industry experience. 5-10 years in regulated financial-services compliance, with substantive crypto-asset operational experience. Pure-finance background without crypto-asset experience produces supervisor skepticism.
Professional qualifications. ACAMS (Association of Certified Anti-Money Laundering Specialists), ICA (International Compliance Association), CISI Crypto Certificate, national equivalents. Multiple qualifications typical for senior roles.
Fit-and-properness clearance. Supervisor reviews candidate against fitness-and-properness criteria — industry experience, regulatory history (own and prior employers’), criminal record, civil litigation history, personal financial probity. The review is substantive.
Full-time commitment. Compliance officer role expects full-time engagement. Part-time, fractional, or outsourced arrangements face supervisor refusal at authorisation review.
Compensation and economics
Crypto compliance officer compensation reflects the role’s senior management positioning and substantive responsibilities:
Mid-tier CASP Head of Compliance: EUR 120,000-200,000 base salary plus benefits and bonus structure. Total loaded cost EUR 160,000-280,000 including employer social contributions, benefits, equity where applicable.
MLRO at separate role: EUR 90,000-150,000 base. Total loaded EUR 120,000-200,000.
Premier-tier CASP Head of Compliance: EUR 200,000-400,000 base. Total loaded EUR 280,000-550,000.
Premier-tier Chief Compliance Officer (substantial CASP): EUR 300,000-600,000+ base plus equity. Total loaded compensation can exceed EUR 800,000+.
Geographic variation. Lithuania, Estonia, Czech Republic at the lower end of range. Netherlands, Ireland mid-range. UK, Germany, Switzerland at premium end.
The cost is substantial relative to small CASP operating economics. Some operators underprice the role at hiring — typically with consequences at supervisor authorisation review or operational performance.
Personal liability framework
Compliance officers face personal liability for role performance:
Civil regulatory penalties. National supervisor penalty frameworks include personal liability provisions for senior management failures. UK FCA SMR framework imposes personal liability up to GBP 700,000 for senior management breaches. EU national frameworks vary but include comparable provisions.
Loss of personal authorisation. Supervisor can revoke individual senior management function approval, ending the person’s ability to hold senior management roles at regulated entities. This is the most-feared personal consequence.
Criminal liability. In extreme cases (deliberate violation, knowing facilitation of crime), criminal liability applies under national law. EU AML framework includes criminal penalty provisions for AML breach. Russia/Iran sanctions violations include criminal exposure.
Civil litigation. Customer or third-party civil claims for compliance officer-related losses. D&O insurance typically covers but limits apply.
The personal liability dimension means compliance officers operate with real care. Operators should expect compliance officers to push back on commercial pressure to relax controls — that pushback is part of the role.
Supervisor relationship management
Compliance officers manage the operator’s supervisor relationship across multiple dimensions:
Authorisation engagement. Pre-application engagement, application filing, information request response, fit-and-properness interview attendance, conditional approval condition management.
Ongoing supervision. Routine supervisory engagement, periodic reporting, examination preparation and response, supervisor inquiry handling.
Incident reporting. ICT incidents (DORA framework), AML reporting via FIU (SAR/STR), data protection breaches (DPA), customer complaints escalation to supervisor where applicable.
Material change notification. Article 83 qualifying holdings changes, material business model changes, senior management changes, operational restructuring — all require supervisor notification with compliance officer leading.
Enforcement engagement. Where supervisor enforcement action commences, compliance officer leads operator response — formal representations, internal investigation coordination, remediation framework development.
The relationship management is substantive. Compliance officers spend material time on supervisor-facing activity throughout role tenure.
Team build and operational structure
Compliance officer typically leads compliance team. Team structure scales with operator:
Small CASP team: 1-3 compliance staff including compliance officer. AML analyst handles customer due diligence and transaction monitoring. Compliance specialist handles broader framework. Single team member often covers DPO function part-time.
Mid-tier team: 5-10 compliance staff. AML team (MLRO + 2-4 analysts), broader compliance team (compliance officer + 2-4 specialists), risk officer, DPO sometimes shared with operations.
Substantial CASP team: 15-50+ compliance staff. Dedicated AML, sanctions, conduct, prudential, market abuse, customer asset protection teams. Operational compliance specialists. Supervisor relationship management capacity.
Premier-tier team: 50-200+ compliance staff at group level. Multi-jurisdiction compliance organisation. Specialist functions including conflict-of-interest management, suitability assessment, complaints handling.
Team build is a substantial recurring cost — typically 1-3% of CASP operating revenue at maturity. Operators that underinvest in compliance team face material supervisor risk.
Practical takeaways
The crypto compliance officer role is one of the most consequential CASP hires. Three principles for operators:
Hire for real crypto experience plus traditional compliance credentials. Pure-finance background without crypto experience fails supervisor review. Pure-crypto background without regulated-services experience misses framework understanding. The right hire has both.
Plan role split at appropriate scale. Combined MLRO + Head of Compliance + DPO works at small scale but produces capacity strain at growth. Plan role split timing as part of operator scaling strategy.
Engage supervisor pre-application on candidate fit. Fit-and-properness review at authorisation is substantive. Pre-engagement on candidate qualifications reduces approval risk and surfaces concerns before formal application.
For corrections, updates, or counsel referrals on crypto compliance officer recruitment and role design, email [email protected].
Pitfalls and nuances
1 Hiring a compliance officer without real crypto experience
MiCA fit-and-properness review tests real crypto-asset operational understanding. Pure-finance compliance officers without crypto experience face supervisor skepticism at approval. Operators that hire on traditional-finance credentials alone face authorisation challenges and operational gaps post-authorisation.
2 Treating compliance officer as part-time or fractional role
MiCA expects real senior management commitment. Part-time or fractional compliance officer arrangements face supervisor refusal at authorisation. The role requires full-time engagement from genuine senior-tier candidate with appropriate compensation.
3 Combining MLRO + Head of Compliance + DPO + Risk Officer in single role
Role-combining is permissible at small-CASP scale but operationally problematic. The functions have potential conflicts — AML reporting independence vs broader compliance, data protection vs AML data retention. Single-role designs face supervisor scrutiny and operational stress at scale.
4 Filing without supervisor pre-approval engagement
The compliance officer faces supervisor fit-and-properness review at CASP authorisation. Operators that file without prior supervisor engagement on the compliance officer candidate produce avoidable approval risk. Pre-engagement allows supervisor to flag concerns before formal application.
Frequently asked questions
What does a crypto compliance officer do?
Oversees CASP compliance with regulatory frameworks — AML, conduct, prudential, ICT/DORA, customer asset protection.
Is the MLRO and compliance officer the same role?
Depends on operator scale. Small CASPs combine MLRO and Head of Compliance into single role.
What qualifications does a crypto compliance officer need?
Substantial industry experience (typically 5-10 years in regulated financial-services compliance), relevant professional qualifications (ACAMS, ICA, CISI Crypto, national equivalents), fit-and-properness clearance through supervisor, and real crypto-asset operational understanding.
Can a crypto compliance officer be outsourced?
Generally no for the senior management function. MiCA Article 73 outsourcing rules allow specific function outsourcing but the senior management responsibility cannot be fully outsourced.
What is the compliance officer's personal liability?
Material. Civil penalties for regulatory breach where compliance officer failed in duties. Senior Management Function liability under SMR-equivalent frameworks. In extreme cases (deliberate violation, knowing facilitation) criminal liability under national law.
Get matched
Working through a crypto-licensing decision?
Get an editorial shortlist of firms matched to your business — customer market, model, jurisdiction, and stage. Free, and not influenced by sponsorship.
Get a firm shortlist →