The Legal Obligation
An AML training programme for an FCA-regulated firm must meet regulation 24 of the Money Laundering Regulations 2017. Relevant employees, and agents whose work is in scope, must know the law on money laundering, terrorist financing and proliferation financing, must be trained regularly to spot and deal with suspicious activity, and the firm must keep a written record of that training. The FCA then expects the training to fit each role and the firm's own risk assessment, and to be tested, not just delivered.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) impose a clear obligation on firms to provide AML training. Regulation 24(1) requires firms to take appropriate measures to ensure that relevant employees are:
- Made aware of the law relating to money laundering, terrorist financing and proliferation financing (financing weapons of mass destruction), and of the data protection requirements relevant to the regulations
- Regularly given training in how to recognise and deal with transactions and other activities or situations that may be related to money laundering, terrorist financing or proliferation financing
Regulation 24(1)(b) also requires the firm to keep a written record of these measures, including the training given to relevant employees and to agents whose work is in scope.
The FCA, as the supervisory authority for financial services firms, assesses compliance with these requirements through its supervisory framework. The FCA's Financial Crime Guide (FCG) provides detailed guidance on what constitutes adequate AML training.
Who Needs AML Training?
MLR 2017 requires training for all "relevant employees": broadly defined as anyone whose work is relevant to the firm's compliance with the regulations, or who is likely to encounter money laundering or terrorist financing in the course of their duties. In practice, this means:
All customer-facing staff. Employees who interact with customers, process transactions, or handle account opening and ongoing relationship management must understand AML obligations, red flags and reporting procedures.
Compliance and risk staff. The compliance team must have deep knowledge of the regulatory framework, the firm's policies and procedures, and current ML/TF typologies.
Senior management. Board members and senior managers must understand their personal responsibilities under MLR 2017 and the SM&CR, including their obligation to ensure the firm maintains adequate AML systems and controls.
Support functions. Staff in finance, HR, IT and operations may encounter money laundering indicators in the course of their work and should receive appropriate awareness training.
New joiners. AML training should be part of the induction process, delivered before or as soon as practicable after the employee begins handling customer-related activities.
Agents. Payment and e-money firms that use registered agents must extend training to agent staff and record it. Our guides to the UK electronic money institution licence and the UK authorised payment institution licence explain how agent oversight fits into authorisation.
A practical way to set depth by role:
| Role group | Minimum content | Suggested depth |
|---|---|---|
| Board and senior managers | Firm risk assessment, personal responsibilities, AML management information | Annual briefing plus updates on material change |
| Customer-facing and onboarding staff | Customer due diligence, red flags, internal reporting route, tipping off | Induction plus annual refresher with scenario tests |
| Transaction monitoring and investigations | Alert handling, typologies, escalation, record-keeping | Detailed role training and on-the-job coaching |
| MLRO and compliance | Full legal framework, emerging typologies, FCA findings | Ongoing professional development |
| Support functions and agents | Red flag awareness and the reporting route | Induction plus annual awareness |
Designing a Risk-Based Training Programme
The FCA is clear that generic, one-size-fits-all AML training is insufficient. Training must be tailored to the firm's specific risks and the employee's role.
Step 1: Identify training needs. Map all roles within the firm against the AML activities they perform. A customer onboarding agent has different training needs from a transaction monitoring analyst, who has different needs from the MLRO.
Step 2: Assess firm-specific risks. The training content must reflect the firm's own money laundering risk assessment. If the firm operates in high-risk jurisdictions, provides services to high-risk customer segments, or handles high-value transactions, the training must address these specific risks and the controls the firm has in place.
Step 3: Develop role-specific content. Create training modules tailored to each role group. Core content (legal framework, firm policy, reporting obligations) can be common, but practical application should be role-specific.
Step 4: Select delivery methods. Consider a mix of e-learning for foundational knowledge, face-to-face or virtual sessions for practical application and case studies, and on-the-job coaching for complex roles like transaction monitoring and enhanced due diligence.
Step 5: Assess effectiveness. Training must be assessed, not merely delivered. This means testing employees' understanding through quizzes, practical exercises, or scenario-based assessments. The FCA looks for evidence that training has been effective, not just that it has occurred.
Core Training Content
An adequate AML training programme must cover the following topics, with depth appropriate to the employee's role:
The legal framework. An overview of MLR 2017, the Proceeds of Crime Act 2002 (POCA), the Terrorism Act 2000, and relevant FCA rules and guidance. Employees should understand the criminal offences associated with money laundering and the penalties for non-compliance.
The firm's ML/TF risk assessment. Employees should understand the firm's key money laundering and terrorist financing risks, how these are assessed, and how the firm's policies and procedures mitigate these risks.
Customer due diligence (CDD). Training must cover the firm's CDD procedures, including: standard CDD, simplified CDD and enhanced CDD; the circumstances in which each applies; identification and verification requirements; ongoing monitoring obligations; and how to handle situations where CDD cannot be completed.
Suspicious activity reporting. All relevant employees must understand how to recognise suspicious activity, how to make an internal suspicious activity report (SAR), the role of the MLRO, and the tipping-off offences. Practical examples and case studies are essential.
Sanctions. Training must cover the UK sanctions regime, the firm's screening procedures, what to do when a potential match is identified, and the consequences of sanctions breaches.
Politically exposed persons (PEPs). Employees involved in CDD must understand PEP identification, the enhanced due diligence requirements for PEPs, and the firm's policies on PEP relationships.
Transaction monitoring. For employees involved in transaction monitoring, training must cover the firm's monitoring systems, alert investigation procedures, escalation processes and documentation requirements.
Record-keeping. Employees must understand the firm's record-keeping obligations, including what records must be maintained, for how long, and in what format.
Frequency and Refresher Training
MLR 2017 requires training to be provided "regularly." The FCA does not prescribe a specific frequency, but industry practice and regulatory expectation is:
Annual refresher training for all relevant employees, covering updates to the legal framework, new ML/TF typologies, changes to the firm's policies and procedures, and emerging risks.
Ad hoc training when material changes occur, such as new regulations (e.g., changes to sanctions lists), new products or services, new customer segments or markets, and significant changes to the firm's risk profile.
A current example is the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621). Among other changes, enhanced due diligence now applies to unusually complex transactions rather than all complex ones, and mandatory country-based enhanced due diligence is limited to countries on the FATF "call for action" list. Most provisions are already in force, and the new cryptoasset correspondent due diligence rules start on 1 February 2027. Firms holding or seeking UK cryptoasset AML registration should update training content to match.
Induction training for new joiners, delivered as part of the onboarding process and completed before or as soon as practicable after the employee begins performing regulated activities.
Assessment and Effectiveness
The FCA expects firms to go beyond recording attendance at training sessions. Firms must be able to demonstrate that training has been effective: that employees have understood the content and can apply it in practice.
Effective assessment methods include:
- Post-training quizzes or tests with a defined pass mark
- Scenario-based exercises requiring employees to identify red flags and take appropriate action
- Practical assessments embedded in day-to-day work, such as reviewing an employee's CDD files or SAR submissions
- Monitoring key performance indicators such as SAR quality, CDD completion rates and false positive rates in transaction monitoring
Where assessment identifies knowledge gaps, firms must provide additional training and reassess. The training programme should be iterative, with content refined based on assessment outcomes and emerging risks.
Record-Keeping
Firms must maintain comprehensive records of AML training activities, including:
- Training plans setting out the content, frequency and target audience for each module
- Records of training delivered, including dates, content covered and attendees
- Assessment results for each employee
- Records of any remedial training provided
- Evidence of training content reviews and updates
MLR 2017 does not set a separate retention period for training records. Many firms keep them for at least five years, in line with the period regulation 40 sets for due diligence and transaction records, so they are available for FCA inspection.
Common FCA Findings
The FCA's supervisory work regularly identifies deficiencies in firms' AML training:
- Generic content. Training does not reflect the firm's specific risks, products or customer base. Employees receive the same generic module regardless of their role.
- No assessment. Training is treated as a content delivery exercise. Firms cannot demonstrate that employees have understood the material.
- Insufficient coverage. Key topics such as sanctions, PEPs, or enhanced due diligence are covered superficially or not at all.
- Infrequent delivery. Training is provided once at induction and not refreshed, or refresher training is repeatedly deferred.
- Poor records. Firms cannot evidence who received training, when, and whether they passed any assessment.
- No board engagement. Senior management and board members do not receive AML training appropriate to their oversight responsibilities.
Practical Recommendations
Align training to your risk assessment. Your AML training programme should directly reflect the risks identified in your firm-wide money laundering risk assessment. If your risk assessment identifies particular jurisdictions, customer types or products as higher risk, your training must address these.
Invest in quality content. Consider using a combination of internal expertise and external providers. Internal content ensures firm-specific relevance; external providers can bring current typology knowledge and industry benchmarks.
Make training engaging. Regulatory training has a reputation for being dry. Use case studies, real-world examples (anonymised), and interactive elements to improve engagement and retention.
Track and report. Implement systems to track training completion, assessment results and competence gaps. Report training metrics to the board as part of regular compliance reporting.
Review annually. The training programme itself should be reviewed and updated at least annually to reflect regulatory changes, new risks and lessons learned from internal and external events.
Frequently asked questions
The Money Laundering Regulations 2017 require training to be provided "regularly." While no specific frequency is prescribed, annual refresher training is the common market standard, with additional training provided when material changes occur: such as new regulations, new products or services, or changes to the firm's risk profile. New joiners must receive AML training as part of their induction.
AML training must cover the legal framework (MLR 2017, POCA, Terrorism Act), the firm's specific ML/TF risk assessment, customer due diligence procedures, suspicious activity reporting, sanctions obligations, PEP requirements, and record-keeping obligations. Content must be tailored to the employee's specific role, not delivered as a generic module.
Yes. Senior management and board members must receive AML training appropriate to their oversight responsibilities. The FCA expects senior managers to understand the firm's ML/TF risks, the adequacy of its AML systems and controls, and their personal responsibilities under the Money Laundering Regulations and the SM&CR.
The FCA expects firms to go beyond recording attendance. Effective assessment methods include post-training quizzes with defined pass marks, scenario-based exercises, practical assessments of day-to-day work (such as reviewing CDD files or SAR submissions), and monitoring KPIs like SAR quality and CDD completion rates. Knowledge gaps must be addressed through additional training.
Yes. Regulation 24 covers agents whose work is relevant to the firm's compliance, and the firm must keep a written record of the training they receive. Payment and e-money firms usually deliver induction and annual training to agent staff and check it during agent reviews.
Regulation 24(1)(b) requires a written record of the training measures taken. A useful record shows the content, who attended, when, test results and any follow-up training. Many firms keep these records for at least five years.
Yes. Since the 2022 amendments, regulation 24 requires staff to be made aware of the law on proliferation financing, meaning funding the spread of weapons of mass destruction, as well as money laundering and terrorist financing.
Definitive guides on this topic
The permanent reference pages this article relates to.