Anti-money laundering guidance for supervised businesses

AMLG11030 - Guidance for all sectors: Training

10.3 Training

Training is a core component of effective compliance with the Regulations. Ensuring that your staff are well trained to understand risks, identify activities or transactions that may indicate suspicion, and correctly apply the business’s PCPs is crucial to the success of your business in managing and mitigating the risks of money laundering, terrorist financing and proliferation financing that it faces.

What are the training requirements?

The Regulations require you to take appropriate measures to ensure that relevant employees and any agents used by your business:

• Are made aware of the law relating to money laundering, terrorist financing, proliferation financing and data protection, insofar as it is relevant to the implementation of the Regulations.
• Are provided with regular training on how to recognise and deal with transactions and other activities or situations which may be related to money laundering, terrorist financing or proliferation financing.

In determining what measures are appropriate to achieve this, you must take account of the nature and size of your business and the nature and extent of the risks of money laundering, terrorist financing and proliferation financing to which your businesses is subject. HMRC recommends, however, as a starting point, that relevant employees and agents should be given regular training on:

• The Regulations,
• HMRC guidance,
• The risks money laundering, terrorist financing and proliferation financing posed to the business,
• The vulnerabilities of the business’s products, services and business channels; and
• The business’s PCPs in relation to the prevention of money laundering, terrorist financing and proliferation financing.

Who is a relevant employee?

A relevant employee is an employee whose work is:

• Relevant to the business’s compliance with any requirement in the Regulations; or
• Otherwise, Capable of contributing to:
  • The identification or mitigation of the risk of money laundering, terrorist financing or proliferation financing to which the business is subject; or
  • The prevention or detection of money laundering, terrorist financing or proliferation financing in relation to the business.

This definition applies regardless of seniority and includes staff in administrative, operational, customer‑facing, supervisory, and compliance roles where their work touches on regulated activity or money laundering, terrorist financing or proliferation financing controls.

An agent is a business or person that is appointed by a principal to undertake relevant activity on the principal’s behalf. A business that is registered for anti-money laundering supervision can appoint multiple agents which is known as an agent network.

 

Training around POCA and TACT obligations

Additionally, under POCA and TACT, individual members of staff face criminal penalties if they are involved in money laundering or terrorist financing, or if they do not report their knowledge or suspicion of money laundering or terrorist financing where there are reasonable grounds for their knowing or suspecting such activity. It is important, therefore, that all staff are made aware of these obligations, and are given training in how to discharge them.

You must ensure that all staff, not just relevant employees and agents, are made aware of the identity and responsibilities of the business’s nominated officer and, if applicable, compliance officer.

You should make sure that all staff know:

• How and when to make internal disclosures to the nominated officer.
• How to report suspicious activity externally via SARs.
• How to avoid committing a “tipping off” offence.

For more information on reporting suspicious activity, see AMLG11100.

 

When should training be delivered?

Relevant employees and agents should be given appropriate training at the start of their employment and agents should be trained at the time of onboarding.

Ongoing training should also be given at appropriate intervals. HMRC expects as a minimum that training is delivered annually with higher risk businesses conducting training on a more frequent basis.

However, the business must also reassess training needs whenever circumstances arise that indicate further, or earlier training may be necessary. This includes the following:

• Where competency issues become apparent after training has been delivered,
• When new or emerging risks are identified,
• When there are changes to the Regulations or internal PCPs,
• When employees change roles or take on new responsibilities,
• When new products, services, technologies or delivery channels are introduced.

In all such cases, training should be refreshed promptly.

 

How should training be delivered?

Training may be delivered using a mix of approaches, including:

• Online learning modules,
• Focused classroom or workshop based training (recommended for higher risk businesses),
• Training videos.Relevant videos may encourage interest, but re-showing the same video may produce diminishing results.

It may be necessary to tailor the training approach to best suit your specific relevant employees and agents and their needs.

Important note: Whilst procedures manuals, internal guidance notes or updates, whether paper or digital, are useful for relevant employees and agents to refer to as and when appropriate throughout their employment and can supplement more dedicated forms of training, they are not generally written as training material. Although you can choose to use external training providers it is important to remember that you remain responsible for ensuring that your business complies with its training obligations under the Regulations, and you should take care to ensure that the training is comprehensive, relevant and tailored to your business and its practices.

What records must be kept?

Regardless of the training approach that you take, you must keep a written record of the measures you have taken to comply with your training obligations and, in particular, the training that you have provided.

Your training record will need to be provided to HMRC on request in any compliance intervention to demonstrate you have complied with you obligations under the Regulations and followed this guidance. HMRC expects that record to include the following information:

• Who received training,
• The date training was provided,
• The content and format of the training,
• Any assessment of its effectiveness.

 

What if staff are located outside the UK?

Where UK business operations are carried out by staff located overseas:

• They must receive training on, and follow, the PCPs applicable to the UK business, and
• They should also comply with any relevant local training requirements in the country where they operate.