Dual-Hat CEO and Collapsing AML Controls at a Gibraltar DLT Provider
Rock Exchange Ltd is a Gibraltar DLT provider licensed by the GFSC, serving 12,000 retail clients. It has 28 staff and annual revenue of £9m; 30% comes from clients in higher-risk jurisdictions. Its CFO, Elena, also holds the compliance officer role. The MLRO resigned six weeks ago, and the interim MLRO is the head of customer support, who has no AML qualification. A GFSC supervisory review found 2,300 unclosed transaction-monitoring alerts, 41 high-risk clients onboarded without enhanced due diligence, and no evidence that the board reviewed the firm's business risk assessment since 2022. The GFSC has set a 30-day deadline for a remediation plan and has reserved its position on enforcement action. The board now wants to appoint Elena as CEO while she retains compliance oversight, arguing this will 'streamline decision-making'. The chair asks you, as external compliance counsel, for a board paper before the next GFSC meeting.
1. Can the board appoint Elena as CEO while she retains the compliance officer role? Identify the governance and AML issues and state what you would advise.
Read the worked answer
No, not on the current facts. Combining CEO and compliance officer concentrates executive power and compliance oversight in one person, creates an inherent conflict between commercial delivery and challenge, and weakens the compliance function's independence. Gibraltar's fitness-and-propriety and senior-management expectations require clear allocation of responsibilities, direct compliance access to the board, and segregation of incompatible functions. The GFSC is already concerned about board oversight; approving the dual role would signal that the board has not grasped the issue. Elena may be fit for one role, but not both simultaneously. The board should either keep her as CFO and appoint an independent CEO, or appoint her CEO and recruit a qualified, independent compliance officer who reports to the board. Either change is a senior-management change requiring GFSC notification or approval under the firm's licence conditions. The interim MLRO is also not fit for the MLRO role: the MLRO must have sufficient AML knowledge, seniority and access to the board. The board should appoint a qualified interim MLRO immediately, notify the GFSC, and document why the interim arrangement is temporary.
2. What immediate remediation steps and regulatory notifications should the board take before the GFSC meeting, and how should it handle the 2,300-alert backlog?
Read the worked answer
The board should create a board-level remediation sub-committee, appoint a qualified MLRO and compliance officer, and give them sufficient staff and authority. It should pause onboarding of high-risk clients until enhanced due diligence is operating properly, review the 41 affected files, and consider exiting clients where EDD cannot be completed. It must update the business risk assessment, minute decisions that show challenge and ownership, preserve all records, and notify the GFSC of the MLRO change, the proposed senior-management change and the remediation plan. If the firm concludes that breaches occurred, it should take legal advice on self-reporting rather than waiting for the GFSC to discover them.
The alert backlog should not be cleared first-in-first-out. The team should triage by risk: sanctions and PEP matches first, then higher-risk jurisdictions, unusual values, structuring and rapid movement of funds. Each closure should record the rationale and evidence. An independent reviewer should sample the work. The board should receive weekly metrics on backlog, closures and quality, and the GFSC should see the same metrics. Temporary staff may help, but only under experienced supervision.
3. What are the directors' personal exposures, and what should the board paper recommend on accountability?
Read the worked answer
Directors owe duties to the company and must act within the regulatory framework. They cannot delegate regulatory responsibility to the MLRO or compliance officer and then claim ignorance. The GFSC can impose conditions, restrict the licence, fine the firm, and question the fitness and propriety of individual directors and senior managers. Personal exposure increases where the board has ignored repeated red flags, approved an obviously conflicted structure, or allowed inaccurate information to go to the regulator.
The board paper should recommend a clear accountability map: a board-owned financial crime risk assessment, a compliance committee with an independent chair, direct reporting lines for the MLRO and compliance officer, and minuted challenge of commercial proposals. It should reject the dual CEO/compliance role, set a timetable for a permanent MLRO and compliance officer, and record that the board, not the MLRO alone, owns the remediation. It should also recommend training for all directors on AML governance and their personal obligations.