How to Assess a Compliance Training Provider: What to Verify and What to Ignore

Most procurement questions asked of training providers are the wrong ones. Course counts, platform screenshots and client logos tell a buyer very little about whether the training will satisfy a regulator. The questions that matter are the ones with verifiable answers — and in regulated sectors, several of those answers are published on public registers the buyer can check without asking the supplier at all.

This guide sets out what to verify, where to verify it, and which claims to treat as unevidenced until proven.

Check accreditation yourself, on the register

Accreditation is the one claim a buyer never has to take on trust, because awarding bodies publish their approved providers.

Accountancy. ACCA operates three tiers of learning partner approval — Platinum, Gold and Silver — and publishes every approved partner in its own learning partner directory, with the tier and the exams each is approved for. Platinum is tied to teaching the full qualification and requires pass rates exceeding global averages; Gold meets the same benchmark areas at a lower pass-rate threshold; Silver is still working toward Gold. A directory lookup takes under a minute and returns the tier, the location and the approved exam list.

Ireland, regulated financial services. The Central Bank publishes the qualifications it recognises under the Minimum Competency Code, by product category and awarding body — Qualified Financial Adviser, the Accredited Product Adviser designations, Certified Insurance Practitioner and the rest. A provider cannot self-certify equivalence. If the qualification is not on the Central Bank’s list for the product category, it does not satisfy the Code for that category.

US legal. Continuing legal education is accredited state by state. New York, for example, grants Accredited Provider status only to organisations that have already sponsored at least eight separate CLE courses in the preceding three years, and the status lasts three years. Accreditation in one state does not generally confer credit in another.

The useful procurement question is therefore not “are you accredited?” but “name the register, the awarding body and the categories, and we will look it up.” A provider reluctant to be looked up has told you something.

Ask what the system evidences, not what the catalogue contains

In every regulated sector the obligation is evidential. So the sharper questions are about outputs:

• Can it show the training requirement per role, separately from what each person has completed, with the date the requirement was last reviewed?
• Can it produce the gap between required and completed, and evidence that someone acted on it? CQC’s guidance expects both.
• Can it hold supervision status as a current state, so you can answer “who is cleared to work unsupervised today?”
• Can it retain records for the right period, where the clock starts when a person stops an activity? FCA TC 3.1.1R sets five years for MiFID business, three for non-MiFID, and indefinitely for pension transfer specialists.
• Can it produce any previous version of a record? SYSC 28.4.2R requires that for insurance continuing professional training.
• Can an individual export their own record? SYSC 28.4.3R and 28.4.4R mean a firm must not prevent an employee obtaining a copy.
• Can it evidence completion across a defined population inside a short deadline? The SRA has proposed a targeted-learning power with examples set at two and three months.

Most platforms answer the second question well and several of the others poorly. Scoring a shortlist against this list separates suppliers far more effectively than a feature matrix.

Treat four categories of claim as unevidenced

Pass rates. Unless sourced to the awarding body with a date and a cohort definition, a pass rate is a marketing number. Note that ACCA’s Platinum tier itself requires pass rates above global averages, so a provider’s tier is better evidence than its own statistics.

Regulator approval of content. Few regulators approve training content. The ICO, for instance, does not require or endorse a particular data protection qualification, and the SRA has said it would not authorise providers of the ethics discussions it has proposed. A claim that content is “regulator approved” should be tested against what that regulator actually operates.

CPD hour equivalence. Hours are defined by the receiving body, not the provider, and the rules differ sharply. Ireland’s Minimum Competency Code requires at least one hour on ethics and excludes diversity, equity and inclusion modules altogether. California requires at least 12.5 of its 25 MCLE hours to be participatory rather than self-study. A course that counts in one regime may count partially or not at all in another.

Comparative claims about rivals. A provider asserting a competitor’s price, pass rate or market share without a named, dated source is telling you about its standards of evidence, not about its competitor.

Three contractual points worth settling early

Data portability. If you leave, you need the records, in a form that satisfies your retention obligation — which for pension transfer specialists is indefinite. Establish the export format and whether version history travels with it.

Named responsibility. SYSC 28.4.1R requires a firm to be able to give the FCA, on request, the name of the person responsible for the record-keeping requirement. That responsibility stays with you; outsourcing the platform does not outsource it.

Content currency. Regulatory content ages badly and sometimes abruptly. CQC is replacing its single assessment framework and removing scoring; Ireland’s Code of Conduct on Mortgage Arrears was revoked and consolidated into the Consumer Protection Code 2025. Ask who is responsible for updating content when a regime changes, and how quickly.

A short verification sequence

Look up the accreditation on the awarding body’s register. Ask for the tier and approved categories, and check them. Score the platform against the evidential questions above rather than the feature list. Ask for the source and date behind any statistic. Settle export, retention and content-update responsibility in the contract.

For the underlying requirements, our guides to CQC training records and FCA training and competence records set out what each regulator expects a system to produce. Our CPD course library sets out what we cover.

Frequently asked questions

How do I verify a training provider’s accreditation?

Through the awarding body rather than the provider. ACCA publishes its approved learning partners with their tier and approved exams; the Central Bank of Ireland publishes the qualifications it recognises by product category; US CLE accreditation is held and published state by state.

Is “regulator approved” a meaningful claim?

Usually not. Most regulators set competence requirements without approving training content. The ICO does not specify or endorse particular data protection credentials, and the SRA has said it would not authorise providers for the ethics discussions it has proposed.

Do CPD hours transfer between regimes?

Not reliably. The receiving body defines what counts. Ireland’s Minimum Competency Code mandates at least one ethics hour and excludes diversity and inclusion modules; California requires at least half of its MCLE hours to be participatory. Check against the specific regime.

What is the most overlooked procurement question?

Retention and export. Records must often outlast the contract — indefinitely for pension transfer specialists under FCA TC 3.1.1R — so the export format, and whether version history comes with it, matters more than most platform features.