Filling statutory officer roles on an interim basis: MLRO, DPO, compliance officer

Short answer: Money laundering reporting officers (MLROs), data protection officers (DPOs) and compliance officers can generally be filled on an interim or outsourced basis in Switzerland and Germany. The conditions differ: an external DPO is expressly allowed under art. 37(6) GDPR, while a German MLRO must be notified to the regulator in advance under section 7(4) GwG. Senior management always keeps responsibility.

This guide is for executive boards, heads of compliance and general counsel who need an outsourced compliance officer or another statutory officer role covered for a period in Germany or Switzerland. For each role it sets out the legal basis in both countries, what can be external, and what to watch when appointing and notifying.

Which officer roles the law requires

The main statutory roles are the anti-money laundering function at financial intermediaries, the data protection officer in Germany and the compliance function at banks. The table shows where each duty sits and whether an external or interim appointment is possible.

The difference between reinforcement and outsourcing matters. Under staff leasing (Swiss Personalverleih, German Arbeitnehmerüberlassung or temporary agency work) the professional is integrated into the organisation and the company directs the work. In Switzerland, staff leasing is therefore generally not outsourcing under FINMA Circular 2018/3. In Germany, MaRisk AT 7.1 treats agency workers as part of an institution's staffing; whether a specific case is outsourcing is for the institution to decide and document.

Money laundering reporting officer (MLRO)

The MLRO is the most tightly regulated officer role, and the Swiss and German rules differ markedly.

• Switzerland: the financial intermediary designates one or more qualified people as its money laundering unit. The unit advises line management and senior management without relieving them of responsibility (art. 24 AMLO-FINMA). External people are allowed only if an in-house unit is impossible or disproportionate given the firm's size or organisation (art. 25(4) AMLO-FINMA).
• Germany: obliged entities such as credit, financial services and payment institutions appoint an MLRO at management level and a deputy (section 7(1) GwG). Appointment and removal must be notified to the supervisory authority in advance (section 7(4) GwG). The MLRO must work in Germany and report directly to senior management.
• Outsourcing in Germany: according to BaFin's interpretative guidance (July 2025) the function itself can be outsourced; the provider and the individual must be notified at least two weeks before the start. Such outsourcing always counts as material.

In Germany the deputy is the first answer to a vacancy. If the deputy is also unavailable or capacity is short, an interim professional can take on the role inside the company through staff leasing. More on the role in our guide to the interim MLRO and AML team.

Data protection officer and data protection adviser

The DPO is the easiest officer role to fill externally, because the GDPR provides for it expressly.

• Germany and the EU: mandatory where core activities involve large-scale, regular and systematic monitoring or large-scale processing of special categories of data (art. 37(1) GDPR), and, while section 38(1) BDSG applies, where at least 20 people are usually engaged in automated processing. The DPO can be an employee or work under a service contract (art. 37(6) GDPR). Contact details must be published and reported to the supervisory authority (art. 37(7) GDPR).
• Switzerland: private controllers may appoint a data protection adviser, but there is no obligation (art. 10 FADP). If a data protection impact assessment shows a high risk, a controller can skip consulting the Federal Data Protection and Information Commissioner (FDPIC) if it has consulted an independent adviser reported to the FDPIC instead (art. 23(4) FADP).

In Germany it is not enough to share out the tasks during a vacancy: a named person is needed again, and the notification to the supervisory authority must be updated. See our guide to a data protection officer vacancy and our data protection and AI governance page.

Compliance function and compliance officer

A compliance function is mandatory for banks in both countries; outside financial services it is mostly voluntary but common. In Germany every institution designates a compliance officer responsible for the function's tasks (MaRisk AT 4.4.2 para. 5); if that person changes, the supervisory board must be informed in advance (para. 8). In Switzerland banks run compliance as an independent control function with direct access to the board of directors (FINMA Circular 2017/1).

An outsourced compliance officer, in the sense of fully outsourcing the function, is possible for German institutions only by exception: MaRisk AT 9 para. 5 allows it only for certain subsidiaries within groups and for small institutions. Interim cover within the company is far more common. For a leadership vacancy, see our guide on what to do when the head of compliance leaves.

Other roles: export control, information security, whistleblowing

Beyond the three classic officer roles, companies name, or must name, people for other functions. The legal basis depends on the sector and the rulebook and needs checking case by case.

• Export control: companies that export often name a person responsible towards the authorities. Interim professionals frequently handle the day-to-day screening and documentation.
• Information security: many regulated companies run an information security function; the requirements follow from the relevant supervisory rules.
• Whistleblowing channel: in Germany, employers with usually at least 50 employees must set up an internal reporting channel, and certain financial firms regardless of size (section 12 HinSchG). For a comparison, see our guide to whistleblowing rules in Germany and Switzerland.

Appointment, notification and documentation

An interim appointment is only as good as its paperwork. Work through these steps:

1. Clarify the duty: which role is required by law and which is voluntary? Start from the table above.
2. Choose the model: staff leasing if the person should be integrated and take direction from the company; freelancing if a clearly defined mandate is enough. For the MLRO, regulatory constraints may rule out an external mandate or require staff leasing.
3. Appoint: a written appointment by senior management covering tasks, authority, reporting line and deputy.
4. Notify: German MLRO to the supervisory authority in advance (section 7(4) GwG); DPO to the data protection authority (art. 37(7) GDPR); change of compliance officer to the supervisory board (MaRisk AT 4.4.2 para. 8).
5. Protect independence: check and document conflicts of interest and grant access to all necessary information.
6. Plan the exit: fix the end of the mandate, the successor and the change of notifications.

Limits: what cannot be delegated

Senior management's responsibility cannot be delegated. The Swiss money laundering unit advises without relieving management of responsibility (art. 24 AMLO-FINMA), and under section 6(7) GwG responsibility stays with the obliged entity when tasks are transferred. In Switzerland, ultimate direction, core management tasks and strategic decisions cannot be outsourced, including taking on and ending client relationships (FINMA Circular 2018/3). Alpinum does not give legal advice and does not take responsibility for outcomes: Alpinum provides the professional, and the company directs the assignment.

Frequently asked questions about interim statutory officers

Can an MLRO be appointed externally?

In Germany, yes: the role can be outsourced after prior notification (section 6(7) GwG), and BaFin requires notice at least two weeks before the start and treats it as material outsourcing. In Switzerland an external money laundering unit is allowed only where an internal unit would be impossible or disproportionate given the firm's size or organisation (art. 25(4) AMLO-FINMA).

Can a data protection officer be appointed on an interim basis?

Yes. Art. 37(6) GDPR expressly allows a DPO who works under a service contract. What matters is expertise, independence and an updated notification to the supervisory authority. In Switzerland the data protection adviser is voluntary (art. 10 FADP) and can also be appointed for a limited period.

Does the appointment have to be notified to the regulator?

It depends on the role. German obliged entities notify the MLRO and deputy in advance (section 7(4) GwG). The DPO's contact details go to the data protection authority (art. 37(7) GDPR). For a change of compliance officer, MaRisk requires the supervisory board to be informed; the institution checks any further notification duties, for example under the WpHG, separately.

Who is liable if something goes wrong?

Responsibility for meeting the obligations stays with senior management, even when an interim professional performs the role. Art. 24 AMLO-FINMA and section 6(7) GwG say so expressly for anti-money laundering. How liability and insurance are split between the company and the professional is set out in the contract and depends on the model.

How long can an interim appointment last?

The rules on officer roles set no maximum term. In Germany, however, staff leasing is capped: an agency worker may be assigned to the same client for at most 18 consecutive months (section 1(1b) Temporary Agency Work Act, AÜG). Plan early who will take the role on permanently; a move into the team (temp-to-perm) is possible.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in Switzerland and provides anti-money laundering, data protection and compliance professionals through staff leasing and freelancing, including for formal officer roles. Tell us about the role and timing, and we will propose suitable profiles.

• Interim compliance: compliance officers and statutory roles on a temporary basis
• Compliance outsourcing: what can be outsourced and what stays in-house
• Roles and practice areas: all guides
• Guarantor duty and criminal liability of compliance officers in Germany and Switzerland
• Discuss your needs

Last updated: 11 November 2026.