AML training for small FCA-regulated firms
Small financial services firms bear greater responsibility for anti-money laundering (AML) training than firms in other sectors due to the inherent risk in their business. The Financial Conduct Authority (FCA) requires regulated firms to demonstrate that each staff member knows their AML responsibilities, including customer due diligence, and is trained to recognise and report suspicious activity. Firms must keep a written record of the training provided and be able to evidence it. The regulations require regular training; although there is flexibility based on business size, complexity and risks, firms typically opt for annual training.
CoreCompliance gives small firms without a compliance team AML training they can keep current and records that show it was done, from £349 a year for a single user.
✓ AML, sanctions and related courses in your CoreCompliance subscription✓ Dated completion records for every person you assign✓ 30-day free trial, no card needed
What the Money Laundering Regulations 2017 require on training
Three regulations in the Money Laundering Regulations 2017 (MLR 2017) shape what a small relevant person has to do: the training duty in regulation 24, the internal controls in regulation 21, and the firm-wide risk assessment in regulation 18. Firms subject to the FCA's Senior Management Arrangements, Systems and Controls sourcebook (SYSC) also have SYSC 6.3.
Regulation 24
Training
Relevant employees are made aware of the law and regularly given training.
The firm must take appropriate measures so relevant employees, and agents doing that kind of work, know the law on money laundering, terrorist financing and proliferation financing and the data protection requirements that go with it, and are regularly trained to recognise and deal with suspicious transactions and situations. It must keep a written record of the measures and the training given.
Regulation 21
Internal controls
A nominated officer, and controls in proportion to size and nature.
Every relevant person must appoint a nominated officer to receive internal reports of suspicion (regulation 21(3)). Where appropriate to its size and nature, it must also appoint a board member or senior manager as the officer responsible for compliance and give senior management information on how its controls are working at least once a year (regulation 21(1)).
Regulation 18
Firm-wide risk assessment
Identify and assess the money laundering risks your business faces.
The steps must be appropriate to the size and nature of the business, and the firm must keep an up-to-date written record of them. The assessment also tells you which staff are relevant employees for training.
Regulation 24: for a small firm
- What is appropriate depends on your firm's nature, size and risks (regulation 24(3))
- No course, format or annual cycle is prescribed: the word is regularly
- The written record is part of the duty, not an optional extra
Regulation 21: for a small firm
- Name your nominated officer and tell staff who it is
- Decide, and record, which regulation 21(1) controls fit a firm of your size
Regulation 18: for a small firm
- This is your firm's own analysis: no course produces it
- Revisit it when your business, products or customers change
SYSC 6.3, for firms it applies to
For firms it applies to, SYSC 6.3 (Senior Management Arrangements, Systems and Controls) requires anti-money laundering systems and controls proportionate to the firm, a regular assessment of them, a director or senior manager with overall responsibility, and a Money Laundering Reporting Officer (MLRO), except for a sole trader with no employees. The FCA's guidance says those controls should include appropriate training and a report from the MLRO at least annually (SYSC 6.3.7G).
Changes in 2026
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 were made on 9 June 2026, and most of their changes took effect on 30 June 2026. They impact customer due diligence, enhanced due diligence, sterling thresholds and pooled client accounts. The training duty in regulation 24 was not changed. Some cryptoasset provisions will come into effect in 2027.
Who needs what training
Regulation 24 reaches every relevant employee: anyone whose work is relevant to your compliance with the regulations, or could help identify, reduce, prevent or detect money laundering risk (regulation 24(2)). In a small firm, this effectively means all employees.
All staff
A first full course, then shorter refreshers at the interval your risk assessment sets.
Courses that support it- Anti-Money Laundering and Counter-Terrorist Financing (30 minutes)
- Anti-Money Laundering refresher, financial services version (15 minutes)
- Customer Due Diligence and Tipping Off for client-facing staff (10 minutes each)
- Suspicious Activity Reporting (10 minutes)
Managers
People who sign off new clients or products, or receive escalations from staff.
Courses that support it- Anti-Money Laundering and Counter-Terrorist Financing (30 minutes)
- Financial Sanctions Compliance (45 minutes)
- Senior Management Arrangements Systems and Controls (25 minutes)
The MLRO and the senior manager responsible
The MLRO and the director or senior manager with overall responsibility for anti-money laundering controls (SYSC 6.3.8R and 6.3.9R) should review the same courses as all staff and managers, and a few additional ones. They should study the Joint Money Laundering Steering Group (JMLSG) guidance and seek in-person advice if necessary. In Senior Managers and Certification Regime (SM&CR) firms, the money laundering reporting function is Senior Management Function 17 (SMF17) (SUP 10C.6).
Additional courses and resources- Counter-Proliferation Financing (10 minutes)
- Money Laundering Red Flags
- Terrorist Financing Red Flags
- Senior Management Arrangements Systems and Controls (25 minutes)
- JMLSG guidance
- Anti-Money Laundering Professionals Forum (AMLP Forum)
Sanctions apply to every UK firm
Unlike the Money Laundering Regulations, financial sanctions do not depend on your permissions. The Office of Financial Sanctions Implementation (OFSI) says all individuals and legal entities within, or carrying on activities within, the UK must comply with UK financial sanctions in force, and so must UK nationals and UK-established entities wherever they operate (OFSI general guidance). The FCA's Financial Crime Guide (FCG) says the same (FCG 7.1).
For a small firm, that means staff who onboard clients or make payments know what a sanctions check is, when to run it and who to tell about a possible match. The Financial Sanctions Compliance course (45 minutes, all staff) covers that. The checks themselves, and the record of them, are your firm's.
What a small firm should be able to show
Training is one part of the evidence. The rest is work your firm writes and keeps itself.
Training can support
- A dated training record for each relevant employee, and what the training covered (regulation 24(1)(b))
- Evidence that refreshers happen at the interval your firm chose
- Completion figures for any report to senior management
Your firm writes and keeps
- The firm-wide risk assessment, kept up to date in writing (regulation 18)
- Policies, controls and procedures, and who your nominated officer is (regulation 21)
- For firms subject to SYSC 6.3, the MLRO report to senior management, which the FCA's guidance expects at least annually (SYSC 6.3.7G)
- Records of sanctions checks and any internal reports of suspicion
AML training courses in your CoreCompliance subscription
All of these are online, and each completion is recorded against the person and the date. Durations are taken from the course pages. Regulation 24 sets no refresher cycle, so the cycle below is a starting point for your own risk assessment, not a legal requirement.
Anti-Money Laundering and Counter-Terrorist Financing
CoversRecognising money laundering and terrorist financing, risk-based customer due diligence, red flags, when and how to report a suspicion, and not tipping off. Based on UK legislation.
When to use itThe first full course for new joiners and anyone without a recent record.
View the courseAnti-Money Laundering refresher (financial services version)
CoversThe three stages of money laundering, the offences and penalties, and staff obligations on customer due diligence and suspicious activity reporting.
When to use itThe shorter course for the years in between, at the interval your firm sets.
View the courseFinancial Sanctions Compliance
CoversWhat financial sanctions are, the steps a firm takes to comply, and how to seek advice and report matches. Based on UK legislation.
When to use itFor staff who onboard clients or handle payments.
View the courseCustomer Due Diligence
CoversWhy due diligence matters, carrying it out properly, and the red flags in the process.
When to use itFor client-facing staff, alongside the main course.
View the courseTipping Off
CoversThe risk of tipping off a person under investigation, and dealing with them without doing so.
When to use itFor anyone who speaks to clients.
View the courseSenior Management Arrangements Systems and Controls
CoversHow responsibilities are allocated and recorded, and the systems and controls the FCA Handbook expects.
When to use itFor the MLRO, the senior manager responsible and other managers.
View the courseAML training questions from small firms
Anti-money laundering
Does a small independent financial adviser (IFA) firm need AML training?
It depends on its permissions. A firm whose regular business is providing investment services on a professional basis is a financial institution under regulation 10(2)(c) of the Money Laundering Regulations 2017, unless an exclusion applies, and relevant persons must train relevant staff under regulation 24. An adviser who acts in respect of long-term insurance, such as pensions or life cover, is also within regulation 10. Confirm your own position against your permissions.
How often should staff do AML training?
The regulations do not set a frequency. Regulation 24 requires relevant employees to be regularly given training, with the measures appropriate to the firm's nature, size and risks. A firm can choose a yearly refresher, but the cycle is the firm's to set and to justify from its own risk assessment.
Does the MLRO need different training?
The Money Laundering Reporting Officer (MLRO) needs to understand what all staff are taught, and also the firm's systems and controls and the duty to report to senior management. SYSC 6.3 gives the MLRO responsibility for oversight of the firm's anti-money laundering systems and controls. Specialist training for the role itself is usually separate from staff training.
Does sanctions training count as AML training?
No. They are separate regimes. Anti-money laundering training meets the duty in regulation 24 of the Money Laundering Regulations 2017, which applies to relevant persons. Financial sanctions apply to every UK firm under the sanctions legislation. Training staff on both makes sense, because the checks happen at the same moments, when a client is taken on or a payment is made.
What records of AML training do we need to keep?
Regulation 24(1)(b) requires a written record of the measures taken and, in particular, of the training given to relevant employees. In practice that means who was trained, on what, and when.
Did the 2026 changes to the Money Laundering Regulations change the training duty?
No. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 took effect mostly on 30 June 2026 and changed customer due diligence, enhanced due diligence, thresholds and pooled client accounts. The training duty in regulation 24 was not amended.
Our firm only arranges general insurance. Do we need AML training?
General insurance broking is not named in regulation 10 of the Money Laundering Regulations 2017. The FCA describes general insurance intermediaries as having more limited anti-money laundering responsibilities, but they are still subject to the Proceeds of Crime Act 2002, and every firm must comply with financial sanctions. Awareness training helps staff meet those duties.
Try the AML course yourself
Start a 30-day free trial with no card. You can browse the whole collection and start up to five courses yourself, including the AML courses on this page. Assigning courses to your team and keeping their completion records come with your CoreCompliance subscription, from £349 a year for a single user, excluding value added tax (VAT).
Start free trialSources
- Money Laundering Regulations 2017, regulation 10 (legislation.gov.uk)
- Money Laundering Regulations 2017, regulation 18 (legislation.gov.uk)
- Money Laundering Regulations 2017, regulation 21 (legislation.gov.uk)
- Money Laundering Regulations 2017, regulation 24 (legislation.gov.uk, up to date to 25 October 2026)
- Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (legislation.gov.uk)
- Institute of Chartered Accountants in England and Wales (ICAEW), Parliament approves AML reform package (July 2026)
- FCA Handbook, SYSC 6.3 Financial crime
- FCA Handbook, SYSC 1 Annex 1 Detailed application of SYSC
- FCA Handbook, SUP 10C.6 FCA required functions
- FCA Financial Crime Guide, FCG 3.1 and FCG 7.1
- OFSI, UK financial sanctions general guidance (updated 28 January 2026)
- Joint Money Laundering Steering Group (JMLSG), current guidance
Keep reading related topics
Harassment Law Changes: What Employers Need to Show After...
13 minute read
On 30 October 2026 the duty to prevent sexual harassment rose to all reasonable steps, and employers become liable when a third party harasses their staff. Learn what the implications are for small businesses.
How to Choose the Right Compliance Training Platform | SME...
3 minute read
Choosing the right compliance training solution for your small business can feel difficult. Many options are available but not designed or priced for smaller businesses. Read our step-by-step guide on how to find the right fit for your business.
