In short: Plan on 6–12 weeks from brief to an approved start date. The search itself is rarely the slow part: we usually deliver a shortlist within 2–4 weeks. Most of the time goes on the candidate's notice period and the regulator's sign-off. In Cyprus, statutory notice runs from 1 to 8 weeks depending on length of service. In the UAE, contracts must set notice between 30 and 90 days, and since January 2026 executive appointments at CMA-licensed firms need prior approval.
If you are applying for a licence, or your MLRO has just resigned, here is where the weeks go and how to win some of them back.
First, the job title
The role has different names depending on the regulator. That matters when you search, because candidates use the local title on their CVs.
- Cyprus (CySEC): the role is the AMLCO, Anti-Money Laundering Compliance Officer. Candidates are expected to hold CySEC's AML certificate, and many CIFs combine the role with Head of Compliance.
- UAE (CMA, formerly SCA): usually called the MLRO, and often combined with Head of Compliance at smaller licensees.
The timeline, stage by stage
| Stage | Cyprus (CySEC) | UAE (CMA) |
|---|---|---|
| Brief and market mapping | 3–5 days | 3–5 days |
| Shortlist of screened, certified candidates | 2–4 weeks | 2–4 weeks |
| Interviews, references, offer | 1–3 weeks | 1–3 weeks |
| Candidate's notice period | 1–8 weeks statutory (contracts may be longer) | 30–90 days by law |
| Regulator step | Notification/assessment of the appointment | Prior Authority approval for executive appointments (from 1 Jan 2026) |
| Typical total | 6–10 weeks | 8–12+ weeks |
Why notice periods dominate
Cyprus. Under the Termination of Employment Law, statutory notice is 1 week after 26 weeks' service, 2 weeks after one year, and rises in steps to 8 weeks after six years. A senior AMLCO with long tenure, or with a longer contractual notice clause, can easily add two months.
UAE. Federal Decree-Law 33 of 2021 requires contracts to set notice between 30 and 90 days. Senior compliance hires are frequently on the full 90 days.
Why the regulator step needs its own slot
Since 1 January 2026, when the SCA was reconstituted as the Capital Market Authority under Federal Law No. 32 of 2025, board and executive appointments at licensed entities need prior Authority approval, and the Authority can reject a nomination. Prepare the CV, qualifications and fit-and-proper documents during the notice period, not after it.
In Cyprus, check whether the candidate's CySEC certificates are current. Renewal needs annual CPD, due by the end of February. A lapsed certificate can delay a start that is otherwise ready.
Five ways to shorten the timeline
- Start before you need the person. If you are applying for a licence, start the MLRO search while the application is still with the regulator. On a pay-on-placement fee, an early start costs you nothing.
- Screen for "approval-ready" candidates. That means candidates with current CySEC AML or CISI UAE accreditation, a clean regulatory history and a recent comparable approval. They move through the regulator step faster.
- Make the offer decision in days, not weeks. Good MLROs usually have more than one process running. A two-interview process with a pre-agreed salary band avoids losing your first choice.
- Negotiate the notice period. Offer a start bonus or buy-out, or agree an early release with the current employer. This is common at senior level.
- Arrange interim cover where your regulator permits it. An empty AML function is a supervisory risk. Ask your regulator what temporary arrangement is acceptable while the permanent hire works their notice.
What slows searches down
- A salary band set below market. Our compliance cost guide has current ranges.
- Requiring an exact product match (for example "crypto CFDs only") when an adjacent background would get approved.
- Relocation and a work permit for a non-EU candidate in Cyprus, or a visa transfer in the UAE. Our work permit assistance runs this in parallel.
FAQ
How long does it take to hire an MLRO in Cyprus? Usually 6–10 weeks from brief to start. The shortlist takes 2–4 weeks, and the candidate's notice (1–8 weeks statutory) and the CySEC step take up most of the rest.
How long does it take to hire an MLRO for a CMA (SCA) licence in the UAE? Usually 8–12 weeks or more. UAE notice periods are 30–90 days, and since 1 January 2026 executive appointments at CMA-licensed firms need prior approval.
Is the AMLCO the same as the MLRO? They do the same job. In Cyprus the CySEC title is AMLCO, while in the UAE and many other jurisdictions it is called the MLRO.
Can one person be both Head of Compliance and MLRO? Often yes, especially at smaller firms, but the regulator will look at whether one person has the time and authority to do both properly.
How fast can HRFinEase send candidates? For most regulated roles we send a shortlist of screened candidates within 2–4 weeks of the brief.
Sources
- Termination of Employment Law 24/1967, Art. 9, via Eurofound legislation database
- UAE Federal Decree-Law No. 33 of 2021, Art. 43, as summarised by Khaleej Times
- Al Tamimi & Co., UAE capital market regulatory overhaul: key changes from 1 January 2026
- CySEC certification and CPD requirements, summarised by Salvus Funds