When a customer’s activity does not fit their stated business, can your staff identify the concern, apply the right checks and explain when to escalate?
Completion records alone do not show whether staff can apply what they learned. FCA supervisory findings highlight gaps in practical examples, internal procedures, checks of understanding and training follow up.
Recent FCA publications identify weaknesses in practical examples, alignment with internal procedures, staff awareness and completion follow up. They also describe stronger approaches that connect training with business risks, staff roles and findings from the firm’s own controls.
In its January 2025 review of money laundering through the markets, the FCA identifies supplementing general training with business and role specific content as good practice.
The FCA's July 2024 PEP review found that 10 of the 15 firms reviewed needed to improve staff training. Eight lacked practical examples, including case studies and examples of good and poor practice.
The FCA’s May 2026 sanctions findings identified gaps in training on applicable sanctions regimes, employee responsibilities and evasion indicators. Good practice included tailoring training to the firm’s exposure and providing additional training for teams in higher risk control areas.
Use cases drawn from the work participants actually do.
For a payment firm, that might mean examining an unexpected change in payment corridors or funds arriving from unrelated third parties.
For an investment business, it might involve unexplained asset transfers or trading without an apparent economic rationale.
The exercise should require staff to explain what concerns them, what information they need and what their next action should be.
Practical check: Can staff recognise how the risk would appear in their own work?
Training needs to explain how the firm expects its controls to be applied.
The FCA’s 2024 PEP review found inconsistencies between training and staff guidance in three firms, including different PEP definitions and unexplained risk categories.
The 2025 markets review found that policy and procedure updates were rarely formally acknowledged by staff or included in annual training.
A person may know what enhanced due diligence means while remaining unclear about the firm’s evidence standards, approval requirements or escalation process.
JMLSG Part I, paragraphs 7.29–7.31, says staff should be trained on how the firm’s products and services could be misused and on the procedures relevant to their roles.
In practice, sessions should work through:
What information and evidence to obtain.
How to apply and record the risk assessment.
When additional checks or approval are required.
What an escalation should contain and who receives it.
What staff can communicate to the customer within their authority.Use a realistic case to follow the process from initial concern to documented decision. If the procedure is unclear or conflicts with the training, resolve that inconsistency alongside the learning gap.
For firms preparing an FCA application, AML framework support for FCA authorisation can establish the procedures that staff training then needs to explain.
Practical check: Can staff explain what to check, what to record and when to escalate?
The FCA’s March 2024 Dear CEO letter to Annex 1 financial institutions identified training that was not tailored to staff roles and omitted topics such as SAR reporting. Interviews with some employees also revealed low financial crime awareness.
The FCA Financial Crime Guide, section 2.2.6, asks how firms assess training effectiveness and identifies practical case studies, testing and checking staff understanding as good practice.
The 2025 markets review also highlights spot checks, feedback and alerts raised as ways to assess training effectiveness. QA findings and near misses can help identify where further training is needed.
Check foundational knowledge.
Ask participants to identify missing evidence, reconsider a risk rating and draft an escalation, explaining their reasoning.
Review subsequent work to check whether staff apply what they learned.
The assessment should reflect the audience. Operational staff need to recognise concerns and follow procedures. Compliance teams need greater technical depth. Boards need to interpret management information, challenge weaknesses and make informed decisions about resources and remediation.
Where several participants make the same error, consider whether the cause is a knowledge gap, ambiguous guidance or a process that is difficult to operate.
Practical check: Can participants apply the material to a realistic case and explain their reasoning?
The 2025 FCA markets review identifies overdue training without management escalation as poor practice.
JMLSG Part I, paragraphs 7.45 and 8.24, says records should show who was trained, when, what was covered and how effectiveness was assessed, including test results where appropriate.
A useful training register should therefore bring together:
The relevant staff and training required for their roles.Delivery dates and the material used.Attendance or completion status.Assessment results and identified learning gaps.Outstanding actions, owners and follow up.Keep the version of the material delivered with the record. A completion entry alone may not explain whether the session covered the firm’s current procedures.
Training needs should also be reviewed between scheduled refreshers. JMLSG paragraphs 7.22 and 7.24 link content and frequency to business risks and staff roles, including changes in responsibility.
An annual programme should have a way to respond to new risks, amended procedures and weaknesses found through monitoring or file reviews.
Practical check: Can the firm show who needed training, who completed it and what follow up remains?
Agree these five points before choosing the format or preparing the material:
Use the business model and risk assessment to select relevant exposures and cases.
Set objectives for operational staff, specialist teams and management oversight.
Identify evidence requirements, decision criteria, approvals and escalation routes.
Agree suitable exercises, feedback and any subsequent checks of application.
Establish the records, outstanding actions and responsibility for addressing learning gaps.
Use these points to scope bespoke AML training and compare providers’ proposals.
If you first need to establish where training or control gaps exist, an independent AML audit can help define the scope.
Regulation 24 of the Money Laundering Regulations 2017 sets out core AML training requirements, including regular training for relevant employees and agents and written records of the measures taken. Those measures must reflect the business’s nature, size and risks. The FCA findings above illustrate weaknesses and good practice within specific supervisory contexts.
askMLRO delivers live AML training for staff, compliance teams, MLROs and boards, tailored to your risks and procedures. Sessions combine practical cases with assessments, attendance records and learning points for follow up. Individual technical sessions and continuing mentoring are also available.