AML Training: More Than An Annual Tick-Box Exercise

HMRC’s updated guidance has raised the bar for AML training. Stephen Williamson, Lead AML Consultant at FCS Compliance, explains what has changed and what it means in practice.

For many property businesses, anti-money laundering training has traditionally been treated as a periodic compliance exercise: staff complete a course, the certificate is filed and the business moves on.

HMRC’s updated guidance makes clear that this is no longer enough. Training must be regular, relevant to the risks faced by the business and effective in helping staff recognise and respond to suspicious activity. In other words, the focus is not simply on whether training has taken place, but on whether people can apply it when it in practical situations.

That is an important distinction to take on board. Money laundering risk rarely presents itself as a neat textbook example. It is more likely to appear as an unusual source of funds, an unexplained third-party payment, an overly complex ownership structure or a customer who is reluctant to provide information. Staff need the confidence to notice when something does not feel right, know what questions they can reasonably ask and understand when a concern should be escalated.

What has changed?

The Money Laundering Regulations have long required relevant employees and agents to receive regular AML training. What HMRC’s updated guidance now provides is a much clearer benchmark for what “regular” means.

HMRC expects training to be delivered at least annually. Higher-risk businesses may need to provide it more frequently, and firms should not simply wait for the next annual session if something changes in the meantime.

Earlier or additional training may be needed when:

• weaknesses or gaps in staff knowledge become apparent
• new or emerging risks are identified
• legislation, HMRC guidance or the business’s own policies and procedures change
• employees move roles or take on new responsibilities
• the business introduces new services, technology or ways of working.

 This means that annual training should be viewed as the minimum level, rather than the complete training programme.

The guidance also places greater emphasis on who should be trained. It is not limited to the MLRO, senior managers or members of a dedicated compliance team. It applies to employees whose work contributes to the identification, prevention or mitigation of financial crime risk, regardless of their seniority. In a property business, that is likely to include customer-facing, administrative, operational, supervisory and compliance staff.

All staff should also understand who the nominated officer is, how and when to raise an internal concern, and the importance of avoiding tipping off.

Training should reflect the business people actually work in

One of the most useful messages within the updated guidance is that training should be relevant and tailored to the business and its practices.

A generic online course may provide a useful introduction to the law, but it cannot always explain how AML risks arise within a particular firm. The risks faced by a national estate agency group will not be identical to those encountered by a small independent firm, an auction house, a buying agent or a business operating in the prime property market.

Effective training should therefore connect the legal requirements to the work employees carry out each day. For example:

• At what stage must customer due diligence be completed?
• What should an employee do if purchase funds are coming from somebody other than the buyer?
• When does a company or trust structure require closer examination?
• What should happen if the customer’s explanation does not match the information or documents provided?
• Who makes the final decision when a concern is escalated?

These are the situations in which staff need practical answers. Training becomes far more valuable when employees can recognise themselves, their customers and their own processes in the examples being discussed.

Attendance is not the same as understanding

HMRC expects businesses to keep records showing who received training, when it was provided, its content and format, and any assessment of its effectiveness.

Keeping an attendance record or course certificate remains important, but it only demonstrates that somebody was present or completed a module. It does not necessarily show that they understood the material or can apply it.

Businesses should consider how they will assess this. A short knowledge check can be helpful, but effectiveness can also be demonstrated through scenario-based discussion, file reviews, quality assurance checks and monitoring the standard of internal suspicious activity reports. If the same mistakes continue to appear after training, that may indicate that the content, delivery or follow-up needs to change.

This does not need to become an unnecessarily complicated exercise. The aim is simply to establish whether the training has improved people’s knowledge, confidence and decision-making and to address any gaps that remain.

What should firms do now?

The first step is to review when AML training was last delivered and who received it. Firms should then consider whether the content remains current and reflects both HMRC’s latest guidance and their own policies, procedures and risk assessment.

It is also worth asking a few practical questions:

• Does the training cover the risks specific to our customers, services and locations?
• Is the content appropriate for the responsibilities of the people receiving it?
• Do staff know how to apply our procedures, rather than simply describe the law?
• Can we show that the training was understood and effective?
• Is there a process for providing refresher training when something changes?

Where different teams have different responsibilities, a single course may not be enough. Frontline staff need to recognise warning signs and understand when to escalate. Managers need to supervise decisions and reinforce good practice. MLROs and senior leaders require a deeper understanding of risk, internal reporting and the decisions for which they are accountable.

The practical value of getting training right

Good AML training does more than satisfy a regulatory requirement. It helps staff deal with customers confidently and consistently, reduces unnecessary delays and makes it less likely that important warning signs will be overlooked.

It can also improve the customer experience. Employees who understand the reason for AML checks are better able to explain requests clearly and proportionately. This can prevent customers from receiving conflicting messages or being asked for documents without a clear rationale.

Most importantly, effective training protects the business and the people within it. Staff who understand the risks are better equipped to make sound decisions, raise concerns promptly and avoid inadvertently exposing themselves or their employer to financial crime.

The annual training requirement should therefore be seen as an opportunity to test whether a firm’s AML framework works in practice. A certificate may show that training happened. The real outcome is a team that knows what to look for, what to do next and why it matters.

 

---

About the Author

---

More from Stephen:

• 
  AML Training: More Than An Annual Tick-Box Exercise
• 
  AML Rules and HMRC Guidance Have Changed: What Property Businesses Need to Know
• 
  Billionaires’ Row and Tehran’s Money: What Estate Agents Must Learn from a £150m London Property Empire