AML Training Under MLR 2017 Regulation 24: What HMRC and SRA Check

Regulation 24 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) is short, but supervisors inspect it closely. This guide is not a general training overview. It sets out what regulation 24 requires and what two UK supervisors, HM Revenue and Customs (HMRC) and the Solicitors Regulation Authority (SRA), say they check and have found. For the wider picture, see our guides to AML training for accountants and AML training requirements for law firms.

What regulation 24 requires

According to HMRC's Economic Crime Supervision Handbook, regulation 24 requires a business to take appropriate measures to make relevant employees and agents aware of the law on money laundering, terrorist financing and proliferation financing, including data protection requirements. It must also give them regular training on recognising and dealing with activity that may relate to those risks. Staff are relevant if their work is relevant to the business's compliance with MLR 2017, or if they could contribute to identifying, mitigating, preventing or detecting those risks. If a business identifies an employee as not relevant and HMRC is satisfied, that person need not be trained.

HMRC says regulation 24 requires a written record of the training provided and its contents. In regulation 24(3), the business should consider its nature, size and risk exposure when deciding what is appropriate.

What HMRC says training should cover

HMRC's handbook says training should cover MLR 2017, Part 7 of the Proceeds of Crime Act 2002 and sections 18 and 21A of the Terrorism Act 2000, how to recognise and deal with suspicious activity, what suspicious activity may look like using sector red flags published on GOV.UK, what to do when customer activity raises suspicion, data protection requirements, and relevance to the business and its specific risks. The regulations do not prescribe a format. HMRC lists face-to-face or online sessions, webinars, conferences, internal meetings and reading as options, alone or combined, and allows external providers.

Frequency

MLR 2017 sets no fixed schedule. HMRC says businesses should train new starters and review training when legislation changes, staff change roles, products or services change, or the risk assessment, policies, controls or procedures change.

What HMRC checks on inspection

HMRC says it tests whether breaches of other requirements, such as failing to identify risk or carry out customer due diligence, occurred and whether training gaps contributed. It also asks whether training is generic or tailored to roles and how often it is refreshed, whether there is a planned schedule, a training log and staff sign-off, how new starters are handled, whether training includes tests with a pass mark and what happens if it is not met, and whether training is proportionate to the business's risks. When reviewing records, it looks at whether all relevant staff were trained, when initial training was completed relative to starting relevant work or receiving system logins, and whether training is first-time or ongoing. It may also interview staff about what suspicious activity looks like, how and when to report it, and what to tell a customer if a transaction is delayed or refused.

The handbook gives one example. A cheque casher held regular training but kept no record of dates or topics. An interviewed employee explained suspicious-activity recognition and handling well, but HMRC still treated the missing record as a breach of regulation 24(1)(b).

What the SRA found in its thematic review

On 30 October 2024 the SRA published a thematic review of AML training. It cites nearly 400 AML inspections between April 2022 and April 2024, a roundtable with 65 of the largest firms it supervises, and work with 13 training providers. According to the SRA, in 2022-23 there were 42 firms non-compliant with one or more regulations, and 19 of them were directed to improve training and training records. The SRA says this suggests training and record-keeping gaps can lead to other compliance failures. It also reports that firms whose money laundering compliance officer had additional training were around 50 percent more likely to be compliant, and that firms with effective content or recent training within the last year were more likely to be rated compliant.

Good practice the SRA saw

• Real-life case studies, including local money laundering news and examples of suspicious clients.
• Ongoing training such as short sessions and bite-size content, not annual e-learning alone.
• Department-specific training, and partners delivering training to show senior commitment.
• Blocking time recording on matters until training is complete, or linking practising certificates to mandatory training.

Poor practice the SRA saw

• A small number of firms provided no AML training, and fee earners were unclear on source of funds and wealth checks and enhanced due diligence.
• Some firms kept no record of who completed training or failed to follow up on non-completers.
• Reliance on generic training packages without tailoring, and training that did not cover the firm's own policies, controls and procedures.
• Training given only to some departments despite the firm's services being in scope.

The SRA expects a firm-specific programme, regular rather than one-off training, training for new staff as soon as possible and ideally before regulated work, coverage of all relevant employees including support staff and relevant agents or contractors, and written records of materials, attendance, dates and assessment results. It says simply asking staff to read the AML policy does not meet the requirement. It recommends a framework called ROLE, standing for relatable, ongoing, leadership and engaging.

Our suggestions for a defensible training file

These are Learnsignal's suggestions, not supervisor requirements. Keep a register of relevant staff and cross-check it against client files and system access. Record the date, topic, trainer and assessment result for every session. Tie each module to your own risk assessment so that training reflects your clients and services. Test understanding and record what happens when someone fails. Plan refreshers around the triggers HMRC lists, such as new legislation or new services. Courses are available through Learnsignal CPD.

What we could not confirm

We read HMRC's handbook page and the SRA review rather than the text of regulation 24 on legislation.gov.uk, so check the current wording there. The SRA figures relate to law firms and may not apply to other sectors. We did not review the Financial Conduct Authority's or other supervisors' expectations, and we have not confirmed whether HMRC has updated its handbook since we read it.

Frequently asked questions

Does MLR 2017 say how often staff must be trained?

According to HMRC, MLR 2017 does not set a fixed schedule, though it expects training for new starters and reviews when circumstances change.

Do I need to keep records of training?

HMRC says regulation 24 requires a written record of the training provided and its contents, and it treated a missing record as a breach even where staff understood the topic.

Is reading the AML policy enough?

The SRA says simply asking staff to read the policy does not meet the requirement.