Training programme: what the decision maker looks at
A decision maker reviewing an AML training programme checks five things: who is covered, how often training repeats, whether content matches each role's risk exposure, how completion is recorded, and who signs off on the annual review. Missing any one of these turns an internal exercise into a supervisory finding.
How the review actually works
Obliged entities are expected to run a training programme that reaches every employee whose role touches client onboarding, transaction monitoring or reporting. The compliance function drafts the programme. A designated decision maker — typically the money laundering reporting officer, or a director with delegated compliance responsibility — approves it and reviews it at set intervals.
The review does not test knowledge in the abstract. It tests whether the programme still matches the entity's current risk exposure: new products, new markets, new typologies seen during the reporting period. A programme that reads well but ignores a product launched six months ago is treated as out of date, whatever the training log shows.
What changes once the review starts
Before the review opens, gaps in training coverage sit as an operational risk. Once the review is open, the same gaps become a documented finding, and the decision maker has to record what was found and what will close it. After sign-off, the record becomes evidence — the file a supervisor asks for first if a control failure surfaces later.
The point of no return sits at sign-off. A programme approved without addressing a known gap cannot later be described as pending correction. Once it is signed, it is the current standard, gap and all.
Stages, documents, timing
| Stage | Document produced | Typical timing |
|---|---|---|
| Coverage check | Staff list mapped against the training log | 1–2 weeks |
| Gap review | List of flagged roles and modules | about 1 week |
| Content update | Revised training modules | 2–4 weeks, depending on scope |
| Sign-off | Dated approval record | a single meeting or written approval |
| Filing | Consolidated training file | same week as sign-off |
What to do, in order
- Compliance officer pulls the current training log and compares it against the current staff list, role by role.
- Compliance officer flags any role added or changed since the last review — new product lines, new jurisdictions served, new outsourced functions.
- Training content owner updates modules that no longer match current typologies or product scope.
- Decision maker reviews the updated programme against the flagged gaps, not against last year's approval.
- Decision maker signs off with a dated record, naming what changed and why.
- Compliance officer files the signed programme together with the underlying evidence, not as separate documents.
Who signs off, and by when
The decision maker is not a committee by default. In most obliged entities it is the money laundering reporting officer, sometimes joined by a board member with delegated compliance responsibility where scale requires it. The forum is not a hearing — it is a documented approval, often a single meeting with the gap report on the table.
Sign-off should close within the same review cycle it opened. Leaving it open into the next reporting period is itself a finding, independent of how good the underlying programme is.
If your situation is different
If a supervisory complaint lands before the training file closes, the two matters do not merge: A complaint triggers a review authorisation who decides and explains who takes that separate decision and on what timeline.
If the entity sits inside a group that is being reorganised, responsibility for the programme can move with the underlying business, in much the same way that When a group restructuring moves the rights determines who takes over control elsewhere in the group.
If a required review deadline is missed and the file lapses, the fix follows the same logic set out in When a validation deadline was missed: the missed date does not cancel the underlying obligation, but it does change who has to act next and how quickly.
Where the training obligation is written into an outsourcing or vendor contract, a mismatch can surface years later — the same mismatch covered in When the contract term outlives the product, where the service keeps running after the contract's terms stop fitting it.
Related publications
Independent audit of controls step by step covers the parallel review that examines the whole control framework, not only training.
What this page does not cover
This page does not set the exact syllabus for a given role, does not fix a mandatory number of training hours, and does not decide which authority will examine the sign-off record during an inspection. Those points depend on the entity's risk profile and on the specific supervisory expectations that apply to it, and they are worked out case by case.
Checked
Checked: this overview reflects training programme practice as commonly implemented by obliged entities, current as of 1 March 2025. It describes a process, not a statutory text, and it does not rely on any single regulatory provision — the sequence of steps holds regardless of which specific rule ultimately requires the training.
FAQ
How long does training programme take in practice?
A full review cycle typically runs four to six weeks from the first coverage check to filed sign-off, longer if content modules need substantial rewriting.
Which documents are needed to start?
The current staff list, the existing training log, and a short note of any role, product or jurisdiction that changed since the last review.
What happens if a staff member does not complete the assigned training?
The compliance officer records the missed completion and escalates it to the staff member's manager. The decision maker cannot sign off the programme as fully implemented until the gap closes or is formally accepted as a residual risk.