“I used to spend the first week of every year writing the MLRO Annual from scratch. Now Otto drafts all 14 sections from our live registers and I sign it.”
Your MLRO Annual Report from real data: 5 days down to 5 minutes.
Trusted by 250+ UK-regulated firms · Built by compliance professionals, for compliance professionals.
Book a Consultation
“I used to spend the first week of every year writing the MLRO Annual from scratch. Now Otto drafts all 14 sections from our live registers and I sign it.”
Spreadsheets, Outlook folders and a consultant's inbox — one supervisory letter away from a very bad month. Where most small regulated firms are stuck.
Customer risk, PEP register, UBO list, sanctions hits, SAR log, G&H, third-party DD. Every MLR 2017 obligation scattered across workbooks nobody version-controls. When the regulator asks for your 5-year evidence trail, you're flicking between FINAL_v7 and an email thread.
You can outsource the work. You can't outsource SMF17. You still sign the MLRO Annual, you still carry the personal regulatory risk, and the consultant still hands you back a Word doc every December that's half template and half last year's version.
SAMLA 2018 is strict liability. A confirmed sanctions match means OFSI within 24 hours, a detailed report in 21 days, and a frozen-funds report inside a month. If you're still emailing the sanctions screener asking “is this a true hit?”, you're already late.
The 14-section MLRO Annual Report under JMLSG takes an experienced MLRO 3–5 days to write from scratch each year. REP-CRIM. Board quarterly. Audit findings. Training matrices. The regulatory reports never stop arriving, and they're all due at once.
If your MLRO workflow currently lives in spreadsheets, a consultant's inbox and the fortnight before the supervisory visit, the Financial Crime Suite is for you.
Three things make it different. Nine capabilities turn it into the system the SMF17 holder runs the firm from. One module covering every UK financial-crime regime — live, evidenced, locked, the day the visit lands. Modular monthly pricing.
Most financial-crime tools ship templates and generic chatbots. RegTechPRO is built on three load-bearing principles that produce regulator-grade output your supervisor can read.
Six regulator-grade reports — 14-section JMLSG Annual, REP-CRIM, Board Quarterly, Executive Summary, Comprehensive Hybrid, Supervisor Readiness dry-run — all grounded in your live registers. PEPs by name. Sanctions hits as tables. SARs from your log.
132 structured questions across 14 chapters. Every one Otto-remediable with a Critical/High/Medium/Low action plan citing MLR 2017, POCA, SAMLA, Bribery Act, CFA 2017, UK MAR, FCG or JMLSG by regulation. Tracked. Evidenced. Always live.
AML, CDD/EDD, TM, Sanctions, ABC, SAR/STOR, Market Abuse, Tax Evasion, Anti-Fraud — every UK obligation in one module. A pillar-weighted Health score the Board can read at a glance and click through to the work. Not a status view. A routing system.
Built for the regulator visit. Built to stand up.
Every closed year auto-locks into a permanent read-only snapshot on 1 January. The 2026 report you signed still looks identical in 2029 when the regulator asks.
Audit-grade · Calendar-lockedEvery field change carries the email and role of who attested it. SMF17 accountability stops being a claim and becomes a click-through history — cited by name into Otto's reports.
SM&CR-readyEvery document attached anywhere — section, gap question, register — collated into one filterable view. Files live in your own Drive, open in one click. "Show me the evidence" stops being a 4-hour spreadsheet hunt.
Drive-nativeOtto sits as regulator and runs a 12-question desk-based exam — verbatim regulatory anchors, evidence cited from your registers, GREEN/AMBER/RED grade with remediations. Signable PDF in 30 seconds.
RAG-graded · SignableOtto won't draft a thin report. Before generation, every section is graded GREEN/AMBER/RED — and a single "Fix this" button takes you straight to the missing fields. No more half-drafted reports the MLRO has to bin.
QA-gatedRegulator letter lands. 14-day window. Click once: ZIP with all 6 Otto reports, Disclosures Log CSV, Gap Analysis CSV, every register CSV, MLRO Calendar as .ics. Everything they could ask for, packed in seconds.
Built for SUP 1513 recurring obligations seeded out of the box — REP-CRIM, OFSI Annual Frozen Funds, FATF reviews, BWRA refresh, sanctions checks. Mark complete and the next due date auto-advances. Export to Outlook or Google in one click.
SUP 16.23 · MLR reg 24Internal SARs, external SARs, DAML requests, STORs, sanctions hits, tipping-off events — every disclosure-class event in one cross-cutting view. Filter, search, export. True MLRO oversight in one click.
POCA · UK MAR · OFSIGetting Started Wizard imports your customer-risk and PEP registers from CSV, attaches your last MLRO Annual and BWRA, opens the 132-question Gap Analysis. Permanently on the dashboard for every refresh.
CSV import · Always availableNine regimes, 25 live registers, 30 regulator-minimum controls and a 132-question Gap Analysis — all feeding Otto's six regulator-grade report formats.
Affordable, modular monthly pricing · No tier gate. No add-ons. No setup fee.
A glimpse of the operating system the MLRO works in every day — many more screens sit behind these. Click any tab to look inside.
The MLRO's morning glance. Health score, 10-pillar RAG breakdown, key statutory dates and the 30-control checklist on one screen. Every weakness sits one click from the work that fixes it.
Tune the model to your firm's risk profile. Weight CDD, transactions, geography, products and channels independently — the score moves with your judgement, not the regulator's average.
30 regulator-minimum controls. Mapped to statute. Attested by name. Every check carries a rule reference, a named owner and a full audit trail. Pass or fail. No grey zone.
132 questions. Mapped to JMLSG and MLR 2017. A live, signed-off gap register that turns weaknesses into tracked actions with named owners, deadlines and Drive-attached evidence — supervisor-ready.
Every control, every check, evidenced. Drive-attached documents tagged to the source rule, year-locked at sign-off and instantly searchable for the regulator visit you weren't expecting.
Every CDD, EDD and PEP file in one register. Risk-rated, review-tracked, evidence attached. SLA timer on the dashboard so a stale review never reaches the regulator's eye first.
Every alert, every disposition, evidenced. Threshold breaches, peer comparisons, ML/TF typologies — investigated, dispositioned and tied to the SAR or false-positive note that closed it.
OFSI, OFAC, EU, UN — screened, recorded, defended. Every match, every clearance, every false-positive logged with a named reviewer and the rationale the regulator wants to see.
Every SAR, DAML, STOR and tipping-off event in one view. Filter, search, export. The cross-cutting MLRO oversight your spreadsheet stack pretends to deliver — and never has.
Every gift, every hospitality, every conflict — logged. Pre-approval workflow, threshold rules, named approver, year-end declaration. The bribery-defence the regulator expects.
UK MAR — captured the moment it happens. STOR triggers, suspicious-trading reviews and insider lists in one screen. Documented, dated, defensible — without the email-chain archaeology.
13 statutory obligations, seeded out of the box. REP-CRIM, OFSI Annual Frozen Funds, FATF reviews, BWRA refresh. Mark complete — the next date auto-advances. Export to Outlook or Google in one click.
Every country, scored. FATF lists, EU high-risk jurisdictions, OFSI sanctions and regulator priority themes — synced to your CDD register so a high-risk customer flags before they board.
The Supervisor Readiness dry-run. 12 questions the supervisor will ask, your evidence-backed answer, your gap, your fix. Walk in prepared, not surprised.
Every regulator-grade report, ready when the regulator asks. REP-CRIM, MLRO Annual, JMLSG, BWRA, Sanctions Self-Audit — status, owner, last-refreshed, one-click open.
14 sections. JMLSG-aligned. Drafted in 60 seconds. Otto pulls from your live registers — PEPs by name, sanctions hits as tables, SARs from the log. Three days of MLRO drafting collapsed to a click.
Long compliance days, gentler on the eyes. A full dark mode across every Financial Crime screen — same WCAG-compliant contrast, same audit accuracy, just easier to live in.
The JMLSG-aligned annual report your regulator asks for under SYSC 6.3 — drawn from your live BWRA, CDD registers, TM alerts, sanctions hits and SAR log. Three days of MLRO drafting compressed into one SMF17 review cycle.
Otto drafts all 14 sections of the JMLSG MLRO Annual from your live registers — BWRA ratings, customer risk, PEPs, TM alerts, sanctions hits, SARs and DAML outcomes — each claim cited to MLR 2017, POCA, SAMLA, the Bribery Act, CFA 2017, UK MAR, JMLSG or the FCG, traceable to source.
The NCA and your regulator both ask the same question on every supervisory visit: show us your disclosures log. Here it is. MLRO-decisioned within 72 hours, cross-referenced to the customer file, and preserved beyond the five-year MLR retention floor.
| Raised by | Disclosure / alert | Date raised | Status |
|---|---|---|---|
|
Amina Okonkwo
Onboarding Analyst · 1LoD
|
Internal SAR: UBO on corporate onboarding declined source-of-wealth question twice; PEP proximity flagged on OFSI rescreen. | Mar 24, 2026 | DAML filed |
|
Rajesh Iyer
TM Analyst · 2LoD
|
Structuring pattern on MID-risk SME: 14 sub-£10k inbound faster payments in 7 days against a £38k historic monthly average. | Mar 12, 2026 | MLRO review |
|
Helena Brandt
Sanctions Officer · 2LoD
|
OFSI 94% fuzzy match on beneficiary account. Name variant on Russia SSI list. Payment quarantined; OFSI notified within 24 hrs. | Feb 27, 2026 | Cleared |
|
Daniel Acheampong
Deputy MLRO · SMF17 cover
|
Tipping-off risk escalation: relationship manager asked about account freeze reason; POCA s333A briefing re-delivered firm-wide. | Feb 14, 2026 | Resolved |
|
Priya Narayanan
Head of Compliance · 2LoD
|
External SAR to NCA: politically exposed client instructed third-country transfer inconsistent with stated wealth source. | Jan 30, 2026 | NCA acknowledged |
MLR 2017 reg 21 and SYSC 6.3 demand personal accountability, not a committee. The MLRO (SMF17) confirms adequacy, the senior manager responsible for financial crime (SMF2) counter-signs, and the CEO (SMF1) attests. Once locked, the report is immutable and reproducible across the NCA’s five-year MLR retention window.
Click once. Otto drafts the 14-section JMLSG MLRO Annual and the REP-CRIM return from your live registers — a signable PDF in a minute, not the usual 3–5 days. Same for the Board Quarterly, Executive Summary, Comprehensive Hybrid and Supervisor Readiness dry-run.
'/%3E%3Ccircle cx='25' cy='27' r='3.4' fill='%23fff'/%3E%3Ccircle cx='39' cy='27' r='3.4' fill='%23fff'/%3E%3Cpath d='M26 39 Q32 44 38 39' stroke='%23fff' stroke-width='2.8' stroke-linecap='round' fill='none'/%3E%3C/svg%3E)
Two jobs. She answers any AML, CDD/EDD, PEP, sanctions, SAR or market-abuse question — cited to MLR 2017, POCA, SAMLA, the Bribery Act, CFA 2017, UK MAR, JMLSG or FCG. And she drafts the 14-section MLRO Annual (plus five more formats) from your live registers — your actual PEPs, sanctions hits and SARs.
“When does EDD trigger under MLR 2017 reg 33?” “Is this OFSI hit a true match, and what do we do in 24 hours?” Otto answers from MLR 2017, POCA, SAMLA, the Bribery Act and JMLSG — and your live Financial Crime data — in seconds, with citations.
Otto writes the MLRO Annual, REP-CRIM and Board Quarterly from your live registers, and answers any AML, sanctions or SAR question — cited to statute. See her draft your MLRO Annual in a live demo.
From MLROs to Heads of Financial Crime: how firms moved their BWRA, registers and MLRO reporting into one live operating system — and stopped fearing the visit.
I used to spend the first week of every year writing the MLRO Annual from scratch — flicking between the PEP workbook, the sanctions log, the SAR folder and a dozen emails. Now Otto drafts all 14 sections from our live registers and I sign it. I answer a supervisor in 30 seconds, not 30 minutes.
We're an estate agency with £12m turnover — AML reporting is mandatory, but we had no system. Financial Crime Suite gave us the PEP screening, transaction monitoring and SAR logs we needed. We're HMRC-supervised for AML rather than FCA, but the same MLR 2017 duties apply — and now we've got proof we're meeting them.
Everything you need to know about the MLRO workflow, Otto’s 14-section report, the Gap Analysis, and how the module sits inside MLR 2017, POCA and SAMLA.
