Staff Training

A compliance program only works if the people doing the work know what it requires of them. Training is the obligation that connects the document to the practice.

The obligation sits in s 26F(4)(e) of the AML/CTF Act 2006. As part of its AML/CTF policies, a reporting entity must deal with providing training to people who are employed or otherwise engaged by the firm and who perform, or will perform, functions relevant to the firm's obligations.

Who needs training

The test is the function, not the job title or the employment arrangement. Training is required for anyone who performs work relevant to the firm's obligations, which includes people who are not employees, such as contractors engaged on a regular basis.

In practice, that means:

• Frontline staff who deal with customers, open engagements, or handle client money
• Anyone who can form the suspicion that triggers reporting, which is a wider group than most firms assume
• The AML/CTF Compliance Officer, whose role carries its own competence expectations
• Senior managers, who approve the risk assessment and the policies (s 26P(1)), and the governing body, which receives reports on them (s 26P(2)). Both need enough understanding to oversee the program

Anyone in the firm can form a suspicion

A suspicious matter reporting obligation can arise for anyone in the firm who notices something. That is why training is not limited to the compliance team. Someone who has never been told what to look for cannot be expected to escalate it.

What it must cover

Section 26F(4)(e) requires training in relation to two things:

1. The risks of money laundering, terrorism financing and proliferation financing that the firm may reasonably face in providing its designated services.
2. The obligations imposed on the firm by the Act, the regulations, and the AML/CTF Rules.

The first is firm specific. A general course on money laundering typologies does not discharge it. Training has to address the risks that arise from the services this firm provides, to the customers this firm serves.

Training also has to recur, because the risk assessment changes as the firm changes, and the training has to keep pace with it.

Training assignments for a firm, showing each person, the assigned module, and completion status.

The training record is part of the obligation

Training records fall under record keeping. You need to be able to show, on request, who was trained, in what, and when.

That generally means:

• Who was assigned training, and when
• What the training covered, and the version of it they completed
• Evidence of completion, such as an attestation with a timestamp
• Refresh dates, so you can show currency rather than a single historical event

Keep training records

From a regulator's perspective, training that cannot be evidenced did not happen. The same principle applies across the regime: the obligation is to do the thing and to be able to demonstrate it.

Keep the record where the training happened, and keep it retrievable. A completion spreadsheet that nobody can trace back to the individual is weaker evidence than it looks.

Where this sits in Duely

Training is administered from the People and Training area of the product. Duely assigns training to individuals, records completion as an attestation, and tracks currency, which feeds both the compliance health view and the reminders that go out ahead of a due date.

The AML/CTF Compliance Officer is responsible for ensuring training happens, because s 26F(4)(e) places the obligation on the entity and the officer is the person answerable for the program. See Appoint your AMLCO for that role in full.

A staff member's own training view, showing assigned modules and completion status.

Related pages

• Record keeping, which covers retention of training records.
• Appoint your AMLCO, for the officer responsible for training oversight.
• Review and evaluation, which tests whether training is working.
• Build your program, because the program must describe your training approach.