MLRO Dashboard

A single-pane-of-glass for the firm's appointed MLRO. It pulls the action queue, programme health, period summary, calendar, ACR status, SAR pipeline, programme oversight, and quick exports onto one page so the MLRO can triage the day's compliance work in one read.

Where it lives

Sidebar → MLRO Dashboard (or /firm/mlro).

The standalone /firm/mlro-queue page from Phase 31 now redirects to /firm/mlro#action-queue; the queue lives as a card inside the dashboard rather than a separate page.

Who sees what

Three caller views, all gated server-side by mlro_dashboard_summary:

Role	Sees
Appointed MLRO	Full dashboard: every card actionable
Firm owner	Full dashboard, read-only; SAR pipeline summarised but not detailed (POCA s.333A)
Manager	Full dashboard minus SAR (replaced with a locked tile explaining the restriction)
Staff / non-member	Redirected to /firm/dashboard (the dashboard is restricted to MLRO and senior staff)

Who can see and act on SARs

SAR records are restricted by the database itself, not just hidden on screen. Only your appointed MLRO or deputy MLRO (Settings, Compliance, MLRO appointments) can open a SAR, review or escalate an internal report, or prepare, submit, acknowledge or withdraw an external SAR. If your firm has not appointed an MLRO, the firm owner can do this until you do.

Anyone who raises an internal report can still see the report they made. Everyone else, including managers and the owner once an MLRO is appointed, sees SAR counts only. SAR items in the action queue, the AML calendar and report exports follow the same rule. The SAR buttons (Prepare SAR, Submit, Mark reviewed, Dismiss, Escalate) only appear for the people who can use them; everyone else can still report a suspicion with Report to MLRO on the client profile. An MLRO appointment held by someone with the auditor role does not give access to SARs.

DAML requests

When an external SAR asks the NCA for consent to go ahead (a defence against money laundering, POCA s.335), record it on the SAR: the date of the request, then the outcome (consent granted, consent refused, or deemed consent) and its date. Certivus shows when the 7 working day notice period ends (weekends and England and Wales bank holidays do not count) and, after a refusal, when the 31 day moratorium ends. Both dates also appear on the AML calendar, but only for the people who can read SARs, because showing them to anyone else would reveal that a SAR exists.

The cards

Action queue

Live list of items needing the MLRO's attention: AML hits awaiting disposition, internal SARs awaiting review, stale external SAR drafts, material-change flags, overdue reassessments, PCP / audit review overdue. Sorted by urgency (high → medium → low). Counts also surface as a banner on /firm/dashboard.

Compliance Health

Reads the 12-factor compliance health score (Phase 29). Traffic-light summary + factor breakdown. Same widget that the home dashboard shows, mirrored here so the MLRO doesn't have to hop pages.

Period summary

Current-vs-previous-period counts for AML hits dispositioned, internal SARs, external SARs, and reassessments. Period selector top-right (30d / 90d / 1 year; defaults to 1 year per MLR reg 21).

Calendar

Upcoming AML calendar items (next 14 days). Pulls from list_aml_calendar (Phase 21).

Annual Compliance Review (ACR)

Status of the active ACR if one's in progress, otherwise the latest completed one. Deep-links to the ACR wizard at /firm/compliance/annual-review (Phase 78c).

SAR pipeline

MLRO + firm owner only. Externally-filed SARs by status, internal SARs by review state. Hidden from managers + staff under POCA s.333A (tipping-off offence). The card UI captures the restriction so it's clear why it's gated.

Programme oversight

MLRO appointment status (active / overdue / missing), training completion rate, PCP last-reviewed, FWRA last-completed. These underpin the 12-factor health score, surfaced raw here so the MLRO can see exactly which factor is dragging the score.

Quick exports

One-click links to the supervisor-facing PDFs: Annual MLRO Report, Compliance Pack, Audit Log slice.

Period selector

Top-right of the header. Three windows:

• 30 days: operational view (this month)
• 90 days: quarterly check-in
• 1 year (default): MLR reg 21 oversight window

Selection persists in the URL (?period=30) so links you share or bookmark land on the right period.

Audit trail

Every dashboard visit writes a firm.mlro_dashboard.viewed row to the firm-scoped audit log (Phase 79c), once per session per firm per calendar date, so the trail captures daily engagement without spamming. Visible in Settings → Compliance → Audit Log filtered by "MLRO appointment" or by searching for mlro_dashboard.viewed. Supervisors routinely ask for evidence that the MLRO is actively overseeing the programme; this log answers that.

Deep links

Use these anchors when linking from emails, help docs, or other surfaces:

• /firm/mlro#action-queue: top of the action queue
• /firm/mlro#compliance-health: health card
• /firm/mlro#period-summary: period counts
• /firm/mlro#calendar-and-acr: calendar + ACR row
• /firm/mlro#acr-status: just the ACR card
• /firm/mlro#sar-pipeline: SAR pipeline (role-gated)
• /firm/mlro#programme-oversight: programme oversight row
• /firm/mlro#quick-exports: quick-exports footer

The scroll-margin is set so the anchor lands below your top nav.

Accessibility

Each card section is wrapped in an HTML <section> with an aria-labelledby heading (visually hidden). The period selector is a role="radiogroup" with per-option role="radio" aria-checked. Icons in the header and inside alerts are marked aria-hidden="true" (the surrounding text is what screen readers should announce).

Plan access

Core MLRO tools, client risk assessments and firm-wide risk assessments are free for every firm, including pay as you go. SAR preparation, beneficial-owner PDFs, check/audit PDFs and per-client or per-company compliance packs are also free.

The firm-level inspection pack, full annual MLRO report, bulk re-scoring and news feed are included on every plan from £59 a month (Starter, Professional, Scale and Custom). Pay as you go can preview the annual report using its own data, with a diagonal watermark on every page and a -preview.pdf filename. Other paid toolkit entry points show an upgrade card. Anything already generated stays readable and downloadable.