AML training requirements: who to train, on what, and the evidence to keep

AML training requirements are the easiest obligation to satisfy on paper and the hardest to prove in a room with an examiner. The statute asks for training. The programme document says training happens. Then the examiner asks who was trained, on what, when, and what changed as a result. For a bank, credit union or licensed money services business settling cross-border payments, that question now reaches people the plan was never written for: the operations staff who release a payout, and the treasury staff holding a settlement balance on a public blockchain.

What do AML training requirements actually say?

The obligation is short and old. In the United States, the money services business programme rule at 31 CFR 1022.210 sets out four pillars: internal policies, procedures and controls, a designated compliance officer, independent review, and education or training of appropriate personnel. Banks and credit unions carry the parallel obligation under their own programme rules. The Anti-Money Laundering Act of 2020 added a direction that programmes be effective and risk based, and examiners now read that back into every pillar, training included.

Canada is more prescriptive. Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, FINTRAC requires an ongoing training programme for employees, agents and others authorised to act on the entity's behalf, together with a written training plan. Internationally, FATF Recommendation 18 asks for internal controls that include screening procedures and an ongoing employee training programme. None of these texts specify a curriculum. That is deliberate, and it is why the plan carries the weight.

Who needs AML training, and how often?

The phrase in the US rule is appropriate personnel, not all personnel. Appropriate is a judgement the firm has to make and record. The honest test is exposure. Can this person's decision let a payment through, stop one, or change data that a later control depends on? If so, they are in scope.

That usually catches more people than the compliance team expects. Onboarding analysts and their reviewers are obvious. So are the payment operations staff who clear a screening hit or release a held payout. Relationship and sales staff matter because they hear the customer's story before the file does. Treasury staff who move a settlement balance matter because that balance now sits in the payment path. Developers and product staff matter too, because a screening rule coded wrong fails quietly.

Frequency is not fixed by US statute. The workable standard is a baseline course at hire, a refresh on a stated cycle for everyone in scope, and targeted sessions when something changes: a new corridor, a new product, a new list, a new typology, or a finding from the independent audit. FINTRAC expects the plan itself to state how often training happens, which is a useful discipline. If the plan cannot answer that question, neither can the firm.

What must training cover when settlement runs in stablecoins?

A stablecoin settlement leg does not change the obligation. It changes the content. Training built for wires leaves staff unprepared for the questions an on-chain leg raises, and that gap shows up in the quality of their escalations long before anyone audits it.

Four areas need their own material. First, the asset and the path: what a payment stablecoin is, who issues it, what redemption depends on, and which chain carried the settlement. Second, counterparty and wallet risk: what a wallet screening result means, how direct exposure differs from indirect exposure, and why a clean name screen is not a sanctions decision. Third, the Travel Rule in practice: which originator and beneficiary data must travel with a transfer, what to do when the counterparty cannot receive it, and why identifying data never belongs on a public chain. Fourth, irreversibility: once a settlement leg confirms there is no recall, so the control has to bite before release.

Teach the ISO 20022 vocabulary as well, because it is the language the rest of the payment speaks. Staff who handle exceptions should know what a pacs.008 carries, what a pacs.002 status report is telling them, and that a pacs.004 is a new payment back rather than an undo. That is not technical trivia. It is what lets an operations analyst describe a case accurately to compliance.

Training is not a slide deck with an attendance sheet. It is the moment an operations analyst holds a release and asks a question the file cannot answer. If the training did not produce that question, it did not happen.

How do you build an AML training plan that survives review?

The plan is a short document, and it should be derived from two things the firm already owns: the enterprise AML risk assessment and the role map. The risk assessment says where the exposure is. The role map says who touches it. Training is the bridge between them, and writing it in that order is what stops the course becoming a tour of the statute.

• Start from the risk assessment. List every inherent risk rated medium or higher, then name the roles whose decisions affect it.
• Define audiences, not job titles, because titles drift. Onboarding, payment operations, treasury, relationship management, technology, senior management and the board each need a different depth.
• Write one learning objective per audience that states a decision rather than a topic. Operations staff should be able to decide when to hold a payout, not merely recognise the phrase sanctions screening.
• Put the cadence and the event triggers in the plan itself, including sessions for a new corridor, product, list or audit finding.
• Build the assessment before the content, so the course teaches to a test drawn from your own alert, hold and escalation history.
• Record delivery, completion, scores and remediation, and keep the materials as delivered rather than only the current version.
• Review the plan annually against the refreshed risk assessment, and after any material finding, then document what you changed and why.

Two details do most of the work. Use your own cases, redacted, instead of generic examples, because staff remember a hold they recognise. And give senior management and the board a short session of their own, since a reviewer will test whether the people accountable for the programme understand what it does.

What training evidence does an examiner ask for?

The file a reviewer reads is narrower than the one most firms prepare. Expect requests for the written plan and its approval, the materials as delivered for the period under review, attendance and completion records by name and role, assessment results with evidence that failures were remediated, and the link from content back to the risk assessment and to audit findings.

The FFIEC BSA/AML Examination Manual directs examiners to whether training is tailored to roles, documented and retained, which is a fair summary of what goes wrong in practice. Keep records of who was trained and what they were shown. A learning platform export is usually enough. A policy statement that training occurs, with no artefact behind it, is not.

Where does AML training quietly fail?

The common failures are structural rather than lazy. Universal content for every role teaches nothing to anyone, because an operations analyst and a relationship manager need different decisions. Contractors, agents and payout partners get left out, although the Canadian rule names agents explicitly and FATF Recommendation 14 holds a licensee responsible for the programme behind its agents. New joiners wait for the annual cycle and work live payments untrained for months.

Two more failures are specific to this business. Technology staff are excluded, so thresholds and list refresh logic get changed by people never taught what the control is for. And training lags the product: a new corridor or a new chain goes live, and the material describing it arrives a quarter later. Both surface in alert quality well before they surface in an audit report.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross-border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs. Settlement runs in regulated stablecoins such as USDC and USDT on public blockchains and completes in minutes with on-chain auditability, and because the platform is ISO 20022 native, with pacs.008 customer credit transfers, pacs.009 interbank legs, pacs.002 status reports and pacs.004 returns tracked end to end by UETR, the staff being trained work in the messaging they already know rather than a separate crypto workflow. KYB and KYC onboarding, KYT, sanctions and PEP screening, FATF Travel Rule data in IVMS101 form, a compliance workbench and a tamper-evident audit trail sit alongside the payments themselves, so the cases a course is built from and the records a reviewer asks for come out of one place.