AML compliance has always technically been a board responsibility. In practice, it has often functioned as something boards approved a budget for and otherwise left to the compliance function. That gap between technical and practical accountability is what 2026's regulatory reforms are closing, in the UK, the EU, and further afield, with senior management and board members named as directly, sometimes personally, answerable for programme effectiveness.
MemberCheck, an enterprise AML platform, works with compliance teams who report into exactly this kind of board oversight. What follows is a practical governance framework, not a training curriculum, for what boards and senior management actually need in place.
Why Governance Moved to the Top of the Regulatory Agenda
In the UK, the government is transferring AML supervision of legal and accountancy firms from bodies such as the Solicitors Regulation Authority and the Institute of Chartered Accountants in England and Wales to the Financial Conduct Authority, in a move explicitly intended to bring greater emphasis on senior management responsibility and closer scrutiny of whether controls work in practice, not just whether they're documented. Recent FCA enforcement has reinforced the point: fines against Monzo, Barclays, and Nationwide for AML control failings in the tens of millions of pounds sent a clear signal that weak governance, not just weak technology, gets punished. 2026 KYC/AML Outlook
In the EU, AML/CFT supervisory mandates formally transferred from the European Banking Authority to the new Anti-Money Laundering Authority (AMLA) in January 2026, with AMLA's own work programme reinforcing the need for clear accountability and documented board-level oversight as a specific supervisory focus area. In the UAE, new AML legislation goes further still, defining senior management broadly enough to include CEOs, general managers, and board members, and making clear that responsibility for compliance cannot be fully delegated to compliance officers or external advisers; senior individuals can face liability for failures such as inadequate systems and controls, even where they weren't directly involved in the underlying breach.
What 'Tone at the Top' Actually Requires
Tone at the top is often treated as a cultural nicety. Regulators treat it as a governance mechanism with specific, evidenceable components: the board setting and approving the compliance programme, not merely rubber-stamping it; senior management actively communicating and reinforcing that programme rather than delegating the messaging entirely to compliance; and consequences, not just recognition, being visibly applied when standards aren't met. A programme that exists only in policy documents, without demonstrable senior engagement, is exactly the gap current reforms are designed to close.
The Core Governance Structure
| Element | What It Requires |
|---|---|
| Board-level oversight | Design and approval of AML policy, ongoing review of programme effectiveness, not a one-time sign-off |
| Money Laundering Reporting Officer (MLRO) | Sufficient authority, resourcing, and independence from business operations to escalate directly to senior management or the board |
| Three lines of defence | Business operations (first line), independent compliance oversight (second line), and internal audit testing effectiveness (third line) |
| Resourcing | Board-approved budget for compliance staff, technology, and training, reviewed against actual risk, not held flat by default |
| Reporting cadence | Regular board or board-committee reporting on programme status, incidents, and emerging risk, not just annual review |
| Documented risk assessment | Reviewed at least annually or when the business changes materially, with the rationale for programme design recorded |
The MLRO independence point is easy to state and often poorly implemented. Best practice keeps the MLRO out of day-to-day business operations, including receipt, transfer, or payment of funds, specifically so they can escalate concerns without a conflict between compliance judgement and operational or revenue pressure. Where an MLRO reports through a business line rather than directly to senior management or the board, that reporting line itself is a governance weakness worth examining.
Documenting Accountability, Not Just Having It
The regulatory direction across every jurisdiction reforming AML governance in 2026 converges on one point: it isn't enough for accountability to exist informally. It needs to be documented, with named individuals, clear escalation paths, and evidence that the board actually reviewed and engaged with compliance reporting rather than receiving it. Treat governance gaps the same way you would treat any other risk issue: assign ownership, define an escalation path, and be able to show why the programme is designed the way it is, not just that it exists.
