Anti Money Laundering Training – Thematic Review

This thematic report sets out our findings on AML training in the legal sector. As first line of defence, AML training is one of the most effective controls to prevent fee earners and firms becoming inadvertently involved in money laundering. Staff training and awareness has long been recognised as a key AML and counter terrorist funding (CTF) control.

Keeping money launderers out of legal services has long been a priority of ours. Firms we regulate often handle significant amounts of money or can help to disguise transactions through their services. This makes them attractive targets for criminals and funders of terrorism who want to launder money.

Under regulation 24 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR), firms must make sure relevant employees receive regular AML training.

As well as the regulations, under the Proceeds of Crime Act 2002 (POCA) and Terrorism Act 2000, staff could face criminal penalties if they are involved in money laundering or terrorist financing. It is therefore important they are equipped with the relevant knowledge and skills to identify money laundering and terrorist financing risks.

Under regulation 24(1) of the MLRs, firms must ensure fee earners who undertake work within scope of the MLR:

• Are made aware of the law relating to money laundering, terrorist financing and the requirements of data protection which are relevant to the MLRs,
• Are regularly provided with training in how to recognise and deal with transactions and other activities which may be related to money laundering or terrorist financing, and
• Can identify and report suspicions of money laundering or terrorist financing.

The MLRs require that all relevant employees and any agents used by firms are trained. Firms may decide to treat all employees as relevant employees which brings the added benefit of allowing more fluid internal transfers of staff across roles and work areas. This includes support staff (such as those who deal with clients, handle client money or otherwise assist with compliance) also play an important part in identifying AML red flags.

In determining what training is required, firms should consider its size and nature, and the areas of risk identified in the AML firm wide risk assessment.

Sole practitioners must also ensure they are adequately trained to protect their practice from money laundering risks.

Under regulation 24(1)(b), firms must keep a comprehensive written record of all training undertaken including:

• training documentation (presentations, notes, hand-outs, copies of online content etc)
• attendance records
• dates of training
• the results of any assessments carried out.

This information must be made available to us on request.

To comply with our Code of Conduct for Solicitors, RELs and RFLs, all solicitors must maintain their competence to carry out their role. This means they must keep their professional knowledge and skills up to date.

To comply with our Code of Conduct for Firms, all firms must make sure managers and employees maintain their competence, and keep their professional knowledge and skills up to date.

Further, the Code of Conduct for Firms obliges them to comply with legislative requirements, including making sure regular AML training is provided in accordance with regulation 24 of the MLRs, and that records of that training are maintained. 

We undertook this thematic review to better understand how firms were complying with the requirements of regulation 24 MLRs and to identify examples of good and poor practice.

Our AML inspections

Reviewing AML training has always featured as part of our onsite AML inspection process. Between April 2022 and April 2023, we carried out a total of 151 onsite AML inspections. We found 42 firms who were non-compliant with one or more of the regulations. As part of our regulatory action, 19 of these firms were given direction on training and maintaining training records. That such a high percentage (45) had issues suggests a lack of training and poor records management can lead to other issues of non-compliance.

Over the years, we have increased our assessment of what firms do in this area. Now for example, in preparation for an onsite inspection, firms are required to provide copies of the content of any training materials so we can assess the quality.

This thematic shares examples of good and poor training practices we have seen from our onsite inspections.

Firms

We also engaged with the profession outside of our onsite inspections. In January 2024, we held a roundtable event with 65 of the largest firms we supervise, where training was discussed in detail. In April 2024, we met with a group of sole practitioners to better understand how they stay on top of key AML changes.

We also met with firms who have an international presence to see if there are any differences in terms of their training practices.

Training Providers

We worked closely with AML training providers from across the industry to understand how they develop their training packages. These providers hold a breadth of knowledge and helped share experiences around what firms are looking for when they are seeking training. They also helped provide an insight into the attitude and behaviours around training.

Other AML Supervisors

Finally, we met with representatives from other professional body supervisors. We worked closely with the Law Society of Scotland and the Institute of Chartered Accountants in England and Wales (ICAEW) to understand how they assess the quality of training in their industries. As part of these meetings, we shared our respective approach to enforcement action against firms who had failed to provide training, or where these organisations deemed training to be ineffective.

We have discussed our findings with the Legal Sector Affinity Group (LSAG). The LSAG is made up of both regulatory and representative bodies for legal services in the UK. It has produced guidance on the MLRs, which constitutes official guidance.

Good quality training is a key control to help protect firms against money laundering. It is therefore important fee earners receive effective training, so they are aware of the risks they need to look out for.

We expect firms to put in place a comprehensive AML training programme which is relevant to the legal sector and specific to their firm. We have developed guidance that covers good and poor practice that we have seen through our engagement with the industry. It also outlines different methods, which we consider to be good practice, which firms and sole practitioners can use to undertake training.

To assist firms, we have produced a checklist (PDF 6 pages, 370KB) for firms to use when developing an AML training programme. The checklist provides an overview of the areas we consider will contribute to an effective training programme, as well as other useful tips to help comply with regulation 24 MLR.

This checklist is not exhaustive. If you choose to use our training checklist, you should adapt this to make sure any training you provide covers all potential risk areas relevant to your firm. You can develop your own training checklist if this better suits your particular firms needs.

AML onsite inspections

Firms and sole practitioners undertaking work within scope of the MLRs must carry out training as required under regulation 24 MLR. As part of our inspection process, we ask firms to provide copies of training materials to assess their effectiveness. We also request copies of any training records to help determine who has received training and when this was last provided.

We carried out 237 onsite AML inspections between April 2023 and April 2024. At the end of each inspection, firms are rated as being compliant, partially compliant or not compliant. We have analysed the training against the outcome the firm received. 

We found:

• Firms who provided effective training content were significantly more likely to be rated as compliant following an onsite AML inspection.
• Firms were more likely to be deemed compliant where recent (within the last year) AML training had been provided.
• Where money laundering compliance officers (MLCOs) had undertaken additional training, firms were around 50 per cent more likely to be compliant  compared with firms where the MLCO had not undertaken any additional training.

Good practice

We observed plenty of good practice from firms.

Several firms explained they have tried to change the way in which AML training is perceived. AML training is often directive, focusing on regulations and outlining what fee earners must do to comply. This led to feedback from fee earners that the key messages are often detached from how and why they are relevant to a role, leading to the importance of the training being overlooked. This has resulted in some fee earners becoming disengaged with the topic, despite it being such an important area.

Some firms explained they have tried to combat this by making AML training as interactive and engaging as possible. This includes incorporating real-life case studies, to help keep training relevant and interesting.

For example, one firm we spoke with explained they always try to share local news articles where money laundering has taken place. This helps reinforce the message that money laundering is a real threat and that proceeds of crime are still laundered in the UK. It also highlights how fee earners can act as effective gatekeepers to prevent legal services being used by criminals trying to disguise money obtained in a dishonest or illegal way. Linking these examples to how the AML controls work well in preventing this can help mitigate risks as well as protect firms.

A large number of firms shared the same feedback: While annual e-learning modules are useful and can help serve a purpose, AML training should be ongoing. Most firms found rolling out frequent training or supplementing e-learning with additional methods helps keep AML at the forefront of people's minds.

Recognising people learn in different ways, some firms are moving away from traditional approaches, for example, completing online e-learning modules, and are now incorporating other methods into their training. Often, this training is department specific and helps cover the specific risks which people face in their day-to-day role.

One firm's training focused on real life situations, using examples of where suspicious clients have attempted to instruct the firm. Another firm explained they make use of e-learning modules, but complete these in small groups, mixing people from across different teams. This collaborative approach helps create discussion around AML risks and how different teams would approach these.

Some firms have also tried to change the perception of AML training by highlighting why it is important and how it can benefit fee earners from a commercial and reputational perspective. Good compliance can promote good business, a message which firms often shared as part of their AML training.

Another firm made use of AML 'lunch and learn' sessions, which were delivered by its compliance team. This involved quizzes and competitions and helped raise AML awareness and keep sessions light and engaging. It also had the benefit of getting people to interact with its compliance team.

Firms also incorporated 'bite size' AML training as they felt this method kept fee earners more engaged than lengthier sessions. These shorter, more targeted communications have the benefit of reinforcing key AML messages and can be very effective when used alongside other training methods.

We were also encouraged by the continuous training methods carried out by the sole practitioners we spoke to. These include attending AML webinars and conferences, as well as subscribing to dedicated AML updates to keep on top of developments.

Poor practice

While most firms we inspected implemented some form of AML training, there were a small number of firms who had not. This was highlighted when we spoke to fee earners at these firms, who were often unclear on key aspects of AML compliance, such as source of funds/source of wealth checks and enhanced due diligence. These are key controls fee earners must be aware of to help protect against potential money launderers.

Some firms also failed to keep a record of who had completed AML training. Firms must keep a comprehensive written record of all training undertaken at the practice, as required under regulation 24(1)(b). An up-to-date training log helps demonstrates firms are providing staff with the money laundering training they need.

Similarly, there was a small number of firms who failed to follow up with fee earners who had not completed their AML training. Maintaining detailed training records will identify any fee earners who have not received AML training and will help determine when updated training should be provided.

Some firms relied on AML training which was provided as part of external accreditation schemes. While this can be useful, the training provided should be relevant to the types of services the firm provide to their clients. Generic AML training will only provide a brief awareness of risks and should be supplemented with more tailored AML training.

Many firms also failed to provide AML training to fee earners on their own internal AML policies, controls and procedures. For example, firms often failed to provide training to their fee earners on their client and matter risk assessing process. This often led to client and matter risk assessments being missing from files which is a breach of the MLRs.

The importance of culture

Firms' approach to AML training can help encourage a culture of compliance. Fee earners should be equipped with the relevant skills to prevent money laundering. Senior management should create an environment that allows for and encourages fee earners to take sufficient time out to complete AML training. Allowing fee earners the time to complete training will help encourage a culture of compliance and help mitigate the risks of becoming involved in money laundering.

In order to maintain a positive reputation, firms are keen to avoid being connected to matters that may cause severe financial, reputational, and potentially regulatory consequences. It's therefore important to train employees so they can remain vigilant as they work.

Many firms spoke about the 'tone from the top', and how this plays an important role in training. Several firms we spoke with explained they often have partners deliver AML training, to help demonstrate how important this issue is, and how everyone has a part to play.

Some firms have implemented controls, such as preventing time recording on matters, until training has been completed by an individual. Others have suggested that new practising certificates should be linked to the completion of mandatory training.

Those firms with a US connection also shared their experiences around culture. As there are different AML legislative requirements between firms with offices in England and Wales and those in the US, rolling out a standard AML training programme can lead to challenges. One firm explained how they reduced this risk by tailoring the training to explain the differences between the UK and US legislation.

We worked closely with 13 training providers from across the industry to better understand how they develop their training packages and gain an insight into training behaviours.

The methods in which training is now delivered has evolved significantly over the years. Traditional training methods, such as e-learning modules, are now just one of many ways training can be provided. Many of the providers we spoke with have developed innovative ways to showcase their content to help keep training engaging and interactive.

What they are seeing

As more people are working remotely, many of the providers explained there has been a shift away from face-to-face training and a higher demand for webinars or online training. These sessions can be delivered more frequently and will often cover popular topics, for example, recent case studies involving money laundering, or fines handed out by either us or the Solicitors Disciplinary Tribunal (SDT).

We were also encouraged to learn that many firms are now asking for bespoke training to be delivered by the providers. Often, this training will follow an independent audit which has taken place at the firm and has highlighted certain areas which require improvement.

Recognising that people are busy, many providers have also explained that firms are now looking for "bitesize" training content. For example, one provider explained that 60% of their users are now accessing training content in a more flexible manner. As a result, they have started to produce material via different media sources, such as podcasts, blogs, articles or games. This provides the opportunity for people to undertake training in many accessible formats at a time which suits them.

Challenges

A reoccurring theme from the training providers is the large proportion of firms who still treat AML training as a 'tick-box' exercise which is completed on an annual basis. Firms will approach training providers asking for a generic, one size fits all AML training package. While these are useful, often they will not be specific to the risks the firm faces. Where training is too generic and not related to a firm's specific processes, it's unlikely a firm will see any change in their working practice. It is far better for training to be treated as an on-going exercise, and not something which is static and completed once a year. For example, where there have been changes to legislation, the updates should be circulated in a timely manner to keep practice up to date.

Most providers acknowledged the move to online training and webinars as being positive in terms of the costs and flexibility they provide. However, these can also present a challenge, as people may become distracted and can stop focusing on the training. In addition, the providers have found people are far less likely to ask questions during or following online training. It can also be difficult to read a person's body language when training is delivered remotely, which can make it difficult to interpret whether people are engaged and if the key messages have landed and are understood. To mitigate this, many providers insist on cameras being on when training is being delivered remotely or supporting online training with an additional form of face-to-face delivery.

Most providers also spoke about cultural issues within firms which can often be a challenge. There are occasionally a small number of fee earners, particularly those who are experienced, who feel they have completed AML training in the past and undertaking additional training therefore does not apply to them. While experience will help with identifying risks, the AML landscape is constantly changing, and criminals are finding different ways to launder the proceeds of crime, therefore it is important to keep on top of the changes and attend regular training.

Another challenge providers often face is that firms are reluctant to sign up to regular AML training, as they see this as being repetitive and ineffective. While firms accept AML training is important, bad experiences in the past have made it difficult to get fee earners on board. Keeping training relevant, engaging and up to date is the best way to overcome this.

Through our research, onsite inspections and engagement with training providers, we have identified several key areas which we feel are important when creating an effective training programme. These are categorised as relatable, ongoing, leadership and engaging, or ROLE for short.

R - Relatable

AML training should be relevant to an individual's role. Often, firms sign up to a training package which is not related to the risks they face. The purpose of AML training is to equip fee earners with the relevant skills and knowledge they need to protect the practice from being targeted by criminals. Training should be tailored to the firm.

Similarly, training should be delivered at a level that everyone can access, from partners to support staff.

To develop a bespoke training package, you should first consider the AML risks your firm faces, alongside any procedures you have in place to mitigate the risks. You may consider:

• Reviewing your firm wide AML risk assessment, as required by regulation 18 MLR, to identify the risks your firm faces.
• Reviewing your AML policies, controls and procedures, as required under regulation 19 MLR, to identify the steps fee earners should take to mitigate the risks.
• Carrying out a sample of file reviews and/or a regulation 21 MLR independent audit. This will help highlight any widespread AML issues which may be addressed through ongoing training. A good training programme will assess the training needs of the firm and its employees and seek to address that issue.

O - Ongoing

Criminals are always finding new ways to launder their money. In addition, the AML landscape is constantly changing, from updates to legislation to changes in technology. AML training should therefore be treated as an ongoing control and provided regularly.

There are various ways firms can do this which fall outside of formal or traditional training methods. These can include sharing articles, blogs and webinars relating to money laundering, attending team meetings and providing updates around potential risk areas. These ad-hoc updates are an effective way of keeping money laundering at the forefront of fee earners minds.

L - Leadership

A firm's approach to compliance starts with senior management. To embed a culture of compliance, senior management must be on board. This will help shape fee earners' approach and attitudes towards training and AML compliance.

To overcome this, firms should move away from a traditional tick box approach to training in favour of a more holistic approach. This includes ensuring AML training is provided on an ongoing basis, through methods outlined above.

Many firms want a 'one-size-fits-all' training package, where all the answers are given to fee earners. While there may be similarities between firms, each firm will have its own individual risks. Internal policies, controls and procedures will also differ from firm to firm. The training you provide must therefore be tailored to your practice and the services you provide.

Senior management can assist with this by feeding into what they want to see covered as part of their package. This could include real life scenarios where suspicious clients have attempted to instruct their firm.

Many training packages test the user's knowledge at the end the module. While this may address the question around fee earners engagement with online training, often these tests can fail to test a fee earner's ability of what they have learnt. Equally, these tests do not establish a fee earner's knowledge of their own internal policies and procedures.

Another concern is that this merely encourages memorisation of an answer superficially, rather than why they should do it. Senior management therefore have a role to play, by continuously assessing the impact of training and checking whether training objectives have been taken on board by fee earners.

This could be done by having follow up exercises with fee earners after training has been delivered – either individually or as part of team meetings – to discuss the content of the training. These conversations can help generate discussion around certain topics or situations fee earners have found themselves in. It also helps to keep training more practical and engaging.

Undertaking file reviews may also help determine whether training has been effective. If files are missing certain AML documents this may suggest more training is required or reminders given, at the very least. Feedback around why these AML documents are a key control can also help reinforce the importance.

Senior management must also ensure a record of any formal AML training which has been provided, is maintained. It is also prudent to keep copies of any AML information which has been shared by email. This will help you meet the requirement under regulation 24(1)(b). The records should also be reviewed to ensure all fee earners have completed training and where members have not attended, this should be followed up.

E - Engaging

AML training should be engaging. By keeping training engaging, fee earners are more likely to be on board and take away key messaging.

Fee earners are more likely to be engaged with AML training if they feel it is relevant to their role. Much of the feedback we received is that fee earners are less likely to be engaged where training is solely focused on the legislative requirements of the MLR.

While understanding the requirements of the MLR does have a part to play in AML training, the training you provide should not be exclusively dedicated to the regulations. One way to assist with this is to include case studies or live examples as part of your training. The inclusion of immersive scenarios - where fee earners are asked to set out what steps they would take in certain situations – will also help to test understanding, keep training more interactive and relevant to a fee earners role.

The use of mixed media sources, such as videos, audios and text, will also help to keep training more engaging, particularly to those who learn through visual or auditory means.

Any relevant person who carries out work within scope of the MLR will be required to undertake AML training, as required under regulation 24 MLR. This includes agents, for example contractors or temporary staff.

You will need to determine which staff are responsible for completing work within scope of the MLR. Further information on the scope of the MLR can be found here.

We have, on some occasions, observed firms who have only delivered training to some fee earners, for example, those in the conveyancing department, despite providing a range of services which are in scope of the MLR. This is not good practice and could lead to a non-compliant inspection outcome.

The LSAG AML guidance sets out that employees who are capable of contributing to the identification, mitigation, prevention or detection of money laundering also require AML training. This includes support staff, such as those who deal with clients, handle money or assist with compliance. These individuals play an important role in identifying AML red flags.

You may decide to treat all employees as relevant employees. This will help mitigate risks and allow more fluid internal transfers of staff across roles and work areas.

The purpose of your AML training is to equip your employees with the relevant skills and expertise to detect and prevent money laundering in their day-to-day role. This should include:

• Making employees aware of the law relating to money laundering and terrorist financing, and to the requirements of data protection. This needn't be long or overly complex, but any relevant persons should have an awareness.
• Identifying money laundering "red flags".
• An overview of risks identified in your firm-wide AML risk assessment.
• Your AML/CTF policies, controls, and procedures.
• Client due diligence (CDD) and enhanced due diligence (EDD) and ongoing monitoring.
• Carrying out source of funds/source of wealth checks.
• Identifying suspicious activity and the processes for internal reporting, and where necessary for making a disclosure to the National Crime Agency (NCA).
• Record keeping and data protection requirements.
• Updates to any relevant regulations.
• Proliferation financing.

Solely asking fee earners to read your AML policy would not satisfy training requirements under regulation 24 MLR.

The content you deliver should be accurate and up to date. Training should be tailored to specific roles and responsibilities of staff and the risks identified in your firm-wide AML risk assessment. Staff who work in higher risk areas or alongside higher risk clients will require more in-depth AML training to help them spot suspicious activity.

For example, conveyancing is high risk for money laundering; property is an attractive asset for criminals because of the large amounts of money that can be laundered through a single transaction. Firms should have appropriate controls in place to mitigate this risk, such as carrying out source of funds/source of wealth checks. Providing tailored training to fee earners around this process will help protect firms from handling the proceeds of crime.

As the risk of fraud increases, you may also choose to train staff on identifying forged documents. This may be particularly useful for employees who are involved in the identification and verification process.

We would encourage firms to follow the ROLE format when developing a training program.

LSAG AML guidance sets out that some form of high-level, basic AML awareness/refresher training should be taken annually across all relevant employees.

Our expectation is that employees should receive training at regular and appropriate intervals. This should provide updates on any new developments and to refresh existing knowledge. How often this is provided can be determined on a risk-based approach. You may decide, for example, that more frequent AML training is provided to employees working in higher risk areas or alongside higher risk clients.

Findings from our 2023 – 2024 inspections suggest that firms who had provided more recent AML training were more likely to be compliant.

Ongoing training may include:

• Attending team meetings to provide in house AML updates, including changes to AML policies, controls and procedures.
• Watching webinars by persons suitably qualified and experienced in AML matters.
• Completion of AML-specific online training sessions.
• Attending AML conferences.
• Review of relevant website materials and documents published by the SRA, Financial Action Task Force (FATF), law enforcement, government.
• Sharing AML updates, for example, where a country has been added to/removed from the high risk third countries list.

Where new or existing relevant staff take on a role, you should ensure AML training is provided as soon as possible after they join, ideally as part of their induction process and before undertaking any regulated work after being deemed competent.

You must ensure a record any formal AML training which has been provided is maintained as required under regulation 24(1)(b). We will continue to ask for training records and content as part of our onsite inspections.

Findings from our 2023 – 2024 inspections suggest that where MLCOs/MLROs undertook additional training, the firm were more likely to be deemed compliant.

There is no explicit requirement on MLCOs/MLROs to undergo any training over and above the rest of the firm. In reality, the obligations on MLCOs/MLROs are different to fee earners and staff and they should have a wider scope of knowledge on which to draw.

Undertaking additional training or relevant professional AML-related qualifications to competently carry out duties is likely be beneficial.

MLROs must be trained on the technical requirements of making a disclosure to the NCA.

MLCOs/MLROs can maintain their competence through a variety of methods, including:

• Webinars
• Online training
• Attending specialist conferences
• Attending specialist round-table discussions and workshops with peers
• Reading specialist articles and publications.

These will all help with keeping knowledge up to date. Training need not be costly, and there are a range of free resources available.

Our Competence Statement says all solicitors they need to:

• Take responsibility for their personal learning and development.
• Reflect on and learn from their practice and learn from other people.
• Accurately evaluate their strengths and limitations in relation to the demands of their work.
• Maintain an adequate and up-to-date understanding of relevant law, policy and practice.
• Adapt their practice to address developments in the delivery of legal services.

The guidance sets out a wide range of steps that can assist firms with meeting our continuing competence requirements, including:

• Encouraging and reminding solicitors, for example, through regular email updates.
• Supporting reflection, by adding reflective discussions to team meeting agendas.
• Wider skills and tailored approaches, for example, inviting speakers from other fields to deliver talks on issues.
• Online training. While face-to-training can be valuable, hybrid working has resulted in more online learning. You can support this by signposting to external resources if you don't have your own internal training resources.
• Encouraging mentoring and coaching, by inviting solicitors to deliver training to their colleagues, for example, about specific skills or legal issues.

Legal Sector Affinity Group Anti-Money Laundering Guidance for the Legal Sector 2023 (PDF 217 pages, 2.3MB)

AML training checklist – what to look for when developing a training package (PDF 6 pages, 370KB)

Money laundering