AML Training Requirements: Who, How Often, and How to Document It

Every AML control eventually depends on a person. Someone has to notice that a transaction doesn't make sense, ask the awkward question about source of funds, or decide whether to escalate a concern. Training is what equips them to do it — and it is a legal requirement in virtually every AML regime.

This guide covers what the rules require, who needs training, how often, what it should cover and how to evidence it.

What the rules require

FATF Recommendation 18 requires firms to have programs against money laundering and terrorist financing that include an ongoing employee training program. National laws turn this into specific obligations. Some examples:

In the EU, AML law requires firms to take measures proportionate to their risks, nature and size so that relevant employees are aware of the AML rules, including data protection requirements, and can recognise and deal with suspicious activity.
In the UK, the Money Laundering Regulations require firms to make relevant employees aware of the law and regularly train them to recognise and deal with suspicious transactions, and to keep a written record of the training.
In the US, training is one of the core pillars of a BSA/AML compliance program.

The common thread: training must be relevant, regular and recorded.

Who needs training

"All staff" is a reasonable baseline, but the depth of training should depend on the role.

Customer-facing and onboarding staff — the first line of defence. They need to understand CDD, red flags and how to raise a concern.
Operations and payments staff — who see transactions and can spot unusual patterns.
Compliance and financial crime teams — who need in-depth, technical training on investigations, reporting, sanctions and regulatory change.
Senior management and the board — who need to understand their accountability, the firm's key risks and what good oversight looks like.
Agents, contractors and outsourced staff who perform relevant functions on your behalf. Responsibility for their training stays with you.

New joiners should be trained before or shortly after they start doing relevant work — not at the next annual cycle.

How often

Most regimes require training to be "ongoing" or "regular" without setting a fixed frequency. In practice, the widely accepted standard is:

Training on joining, before or shortly after starting relevant work.
A refresher at least annually for all relevant staff.
Targeted training when something changes — a new law, a new product, a new typology, or a gap identified by audit or a supervisor.
More frequent, in-depth training for higher-risk roles.

Whatever frequency you choose, put it in your policy and meet it. Supervisors are much more likely to criticise a firm for missing its own standard than for the standard itself. Track training rounds on your AML compliance calendar like any other recurring obligation.

What training should cover

The core for everyone

What money laundering, terrorist financing and sanctions evasion are, and why they matter
The firm's legal obligations and the personal consequences of breaching them
The firm's key risks, drawn from the business-wide risk assessment
How to recognise red flags relevant to the role
How to raise an internal suspicious activity report, and to whom
The prohibition on tipping off
Data protection obligations when handling AML information

Role-specific content

Onboarding teams: CDD and EDD procedures, beneficial ownership, PEPs, and document verification. See CDD vs EDD.
Operations: transaction red flags, alert handling and escalation.
Compliance: investigation techniques, report writing, sanctions, regulatory updates.
Senior management: governance responsibilities, risk appetite, reading management information and the MLRO annual report.

Generic, off-the-shelf training can cover the basics. But supervisors increasingly expect content tailored to the firm's own products, customers and typologies. Real (anonymised) cases from your own business are more effective than textbook examples.

Evidencing training

If you can't prove training happened, a supervisor will assume it didn't. Keep:

The training materials for each version, so you can show what staff were taught at a particular time.
Attendance or completion records per employee, with dates.
Assessment results, where you test understanding — and what happened to those who failed.
A training plan showing who needs which training and when.
Follow-up on non-completion, including escalation to managers.

Keep these records in line with your AML record-keeping policy.

Measuring effectiveness

Completion rates show that training happened, not that it worked. Signs that training is effective include:

the volume and quality of internal suspicious activity reports — a business area that never raises any may not recognise red flags;
quality assurance results on CDD files;
assessment scores over time; and
fewer repeated errors in audit findings.

Report on these in management information, and use them to target next year's training.

Key takeaways

Training is required by FATF and by virtually every national AML regime, and must be relevant, regular and recorded.
Train staff on joining, refresh at least annually, and add targeted training when something changes.
Tailor content to the role and to the firm's own risks.
Keep materials, completion records and assessments — and follow up on non-completion.
Measure effectiveness, not just completion.

Training is one part of a risk-based AML program. Regpin helps compliance teams manage the whole program, from risk assessment to controls — book a demo to see how.

This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.