Training programme: stages and deadlines
An AML training programme for obliged entities in the digital-assets sector runs through five stages: needs assessment, curriculum design, delivery, verification of understanding, and record-keeping. Each stage carries its own internal deadline, usually tied to a start date or a role change. The verification stage is the point of no return: without a signed or logged confirmation, the entity cannot show the training happened at all.
Practical consequence
A training programme that leaves no record is treated the same as a training programme that never ran. Supervisors and internal auditors look for dated confirmations, not good intentions. Delay does not cost a missed session; it opens a gap in the audit trail that widens the longer it stays unclosed.
Stages and typical deadlines
| Stage | What happens | Typical internal deadline |
|---|---|---|
| Needs assessment | Compliance function maps roles against exposure to onboarding, monitoring and sanctions screening | Before the annual training calendar is approved |
| Curriculum design | Content is matched to role: front-line, back-office, senior management | Ahead of each intake or role change |
| Delivery | Session run, live or recorded, using role-specific scenarios | Within the entity's own onboarding window |
| Verification | Test, quiz or signed acknowledgement confirming understanding | Immediately after delivery, same session where possible |
| Record-keeping | Attendance, content version and test result filed centrally | Ongoing, kept for the entity's own retention period |
What to do
- Compliance officer confirms which roles fall in scope before the calendar is set.
- HR or compliance schedules the session against the employee's start date.
- Trainer or compliance officer delivers the session with role-specific material.
- Compliance officer collects a signed or logged confirmation of understanding.
- Records team files the confirmation with the content version used.
- Compliance officer sets the next refresher and flags anyone who has not completed the session.
Who decides
The compliance officer or money laundering reporting officer owns the programme and signs off on content and cadence. Senior management approves the annual calendar and resources it. Where the entity sits inside a group, the group function may set minimum content, but the local officer stays responsible for delivery and records at entity level. Questions on scope can overlap with governance elsewhere in the file; see A key function holder resigns authorisation who decides and for how that overlap is handled when the role itself changes hands.
Two common scenarios
If the employee is new, the training deadline runs from the start date, not from the date the role turns client-facing. Delivery before first client contact is the safer default.
If the employee moves into a new role mid-year, for example sanctions screening, the gap triggers a fresh needs assessment rather than a wait for the next annual cycle.
If training material is supplied under a third-party licence, a separate question can arise over what the entity is actually entitled to keep and reuse; see When a distributor claims an implied licence for how that question is framed.
If the training platform itself sits on a technology licence, a change to that licence does not automatically stop the underlying support obligation; see When support ends but the licence continues for how that split is resolved.
What this page does not cover
This page describes the internal sequence of a training programme. It does not set out the substantive content that AML training must include, and it does not replace the entity's own risk assessment. It also does not decide how findings from an independent audit of controls should be closed once a training gap is identified.
Related publications
The sequence that often follows a training gap sits in a separate file: Independent audit of controls step by step.
If the file grows wider
Where a supervisor's request touches training as part of a broader governance review, the first steps differ from a routine training cycle; see When a supervisor asks about governance in detail.
For a related scope question in a different file, where only part of a range is in dispute, see When the claim covers only part of the range.
Verified
Reviewed: 14 January 2025. This page sets out the general procedural sequence followed by obliged entities in the digital-assets sector for staff training programmes. It does not cite specific statutory provisions; the substantive obligations behind the programme are addressed on separate pages within this file.
FAQ
How long does a training programme take in practice?
Delivery itself is usually a single session, live or recorded. The full cycle from needs assessment to filed record tends to span a few weeks, driven by scheduling rather than by the content itself.
Which documents are needed to start?
A role map, a content outline matched to that map, and a template for recording attendance and test results. Without the third document, delivery cannot be evidenced later.
What happens if a staff member does not complete the assigned training?
The compliance officer logs the gap and sets a short remedial deadline. An unresolved gap is carried into the next internal review as an open item, not closed off by the passage of time.