When training records are requested: what to do first
When a supervisor, auditor, or correspondent bank asks for staff AML training records, secure the current file first, confirm the exact scope of the request, and name one contact person before anyone replies. Do not send raw personnel files until the legal basis and the retention period are both confirmed. The first hour after the request arrives sets the tone for everything that follows.
Foundation
Obliged entities that operate as crypto-asset service providers under Regulation (EU) 2023/1114 (MiCA) carry an anti-money-laundering training obligation as part of their authorisation conditions. A training programme exists on paper from day one; the records prove it also existed in practice.
Where the same staff process crypto-asset transfers, Regulation (EU) 2023/1113 (TFR) sets out the information that must accompany each transfer. Training records for that team show whether staff actually applied those checks, not just whether they attended a session.
Neither regulation names a specific retention period for training files. That gap is filled by internal policy and by general recordkeeping practice, not by a number this page can quote.
Practical consequence
A written request for training records rarely arrives out of curiosity. It usually means the requesting authority already suspects a gap between the programme described in policy and what staff did in fact receive. The clock starts on the date of the letter, not on the date you open it.
Missing the reply window changes the nature of the review. What began as a request for one file can widen into an inspection of the whole AML programme, including onboarding, monitoring, and reporting lines. That widening is the real cost of a slow first response.
What to do first
| Step | Who does it | Timing |
|---|---|---|
| Confirm receipt and read the exact scope | Compliance officer | Same day |
| Freeze the training file as it stands, no edits | Compliance officer, HR | Before anything else |
| Map which staff and which sessions are covered | Compliance officer | Within one to two days |
| Check the retention period against internal policy | Compliance officer, legal | Before any disclosure |
| Draft a single response with one named contact | Compliance officer | Before the deadline in the letter |
| Log every document sent, with date and recipient | Compliance officer | Ongoing |
Freezing the file matters more than it looks. If a gap in training records is discovered internally after the request has already been sent, a late correction can read as an attempt to fix the record after the fact.
Who decides
The national authority responsible for AML supervision of crypto-asset service providers decides whether the training programme meets its expectations. It does so on the evidence sent, which typically includes attendance logs, testing results, session content, and internal correspondence about the programme.
The authority does not decide in a vacuum. It compares what was delivered against what the entity itself described in its own AML policy and, where relevant, in its authorisation file under MiCA. A mismatch between the two is the finding most often reported.
Edge cases
If the request for training records arrives at the same time a key function holder resigns, the two files intersect: training completion evidence and the resignation timeline both get pulled into the same review. See A key function holder resigns authorisation for that separate sequence.
If the training material itself was supplied under a licence that distinguishes exclusive from sole use, check who actually holds the right to reproduce or edit the content before you hand copies to a supervisor. See When exclusive and sole are used interchangeably.
If the compliance methodology behind the training has been claimed as an invention elsewhere, and a dispute over that claim is running in parallel, keep the two matters on separate tracks. See When the same invention is granted to someone else.
If the platform used to deliver and log the training sits under a technology contract whose support has already ended while the licence continues, confirm you can still export the historical logs before the deadline runs out. See When support ends but the licence continues.
Limits of this page
This page does not decide what counts as an adequate training programme for your specific staff and product mix. It does not replace a review of the actual letter you received, which may set its own deadline and scope. It does not cover retention periods, which sit in internal policy rather than in the two regulations named here.
Verified
Checked against the source texts as of 5 March 2025. Sources used: Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both in force from 30 December 2024.
Frequently asked questions
What is the first step when training records are requested?
Freeze the current file, read the exact scope of the request, and appoint one named contact before any document leaves the building.
Which deadline is already running?
The deadline stated in the letter itself, counted from its date, not from the date it was opened or forwarded internally.
Who decides, and on what evidence?
The national authority supervising the entity's AML compliance, based on attendance logs, testing results, session content, and internal correspondence about the training programme.
Related situations
A related sequence follows a similar pattern in a different part of AML supervision: When a correspondent relationship is ended.