The L&D Manager in a Regulated Firm: What the Rules Put on You

In most organisations the learning and development manager is a people function. In a regulated one, the role sits inside the compliance perimeter, because a substantial set of rules land on whoever is responsible for training — and several of them are evidential duties that a regulator will test directly.

This guide sets out what the rules actually put on the training function across health and social care, financial services, legal practice and Ireland, and which parts of the job are therefore not negotiable.

You own an evidential obligation, not a delivery target

The single most important shift for an L&D manager moving into a regulated sector is that delivering training is not the obligation. Being able to demonstrate competence is.

FCA TC 3.1.1R requires appropriate records to demonstrate compliance with the whole Training and Competence sourcebook — which covers assessing competence, supervising staff until they are assessed as competent, and maintaining competence afterwards. Completion data evidences none of those three on its own.

CQC Regulation 18(2)(a) requires staff to receive appropriate support, training, professional development, supervision and appraisal. CQC’s guidance expects training needs to be assessed when employment starts and reviewed at suitable intervals, and completed and required training to be tracked with action taken quickly where requirements are not met.

Practically, that means the function has to hold two datasets rather than one: what each role requires, and what each person has done. Most learning platforms are built around the second.

Retention is your problem, and the clock is unusual

Retention periods in regulated training are not calculated from the training date. Under FCA TC 3.1.1R the clock runs from when the employee stops carrying on the activity — five years for MiFID business, three for non-MiFID, and indefinitely for pension transfer specialists.

Two consequences land squarely on L&D. Leaver records cannot be purged on exit, and a single pension transfer specialist turns part of the archive into a permanent record that a global retention rule will quietly destroy. In insurance distribution, SYSC 28.4.2R additionally requires the firm to be able to produce any version of a continuing professional training record, which means version history rather than current state.

Individuals have rights over their own records

SYSC 28.4.3R and SYSC 28.4.4R provide that a firm must not prevent an insurance employee from obtaining a copy of their records. CQC’s Regulation 18(2)(c) requires registered professionals to be enabled to provide evidence to their own regulator that they meet its standards.

So the training function needs a route for an individual to extract their own record in a form their professional body will accept — for NMC revalidation, for a practising certificate renewal, for a move to another firm. A reporting suite that only serves managers creates a compliance problem as well as an employee-relations one.

Hours are sometimes prescribed, and sometimes prescribed oddly

Where annual hours apply, they are usually specific about content as well as volume. Ireland’s Minimum Competency Code requires 15 hours a year for MiFID services and for insurance staff, 6 for certain mortgage credit board members, and 10 or 20 for crypto-asset staff depending on whether they give information or advise. At least one hour must relate to ethics, the hours must cover a range of competencies rather than one topic, sustainability training has counted since 1 January 2025, and diversity, equity and inclusion modules do not count at all.

That last exclusion is the kind of detail that invalidates a curriculum built in good faith. Any L&D manager running a general compliance programme in Ireland should audit what proportion of it is actually creditable.

Some requirements cannot be met by e-learning

This constrains delivery model, not just content. The SRA’s April 2026 consultation proposes three hours a year of facilitated group discussion on professional ethics, with groups of between three and twelve including the facilitator, and facilitators needing a practising certificate or roll membership, three years’ practice since admission and no regulatory record. New York requires newly admitted attorneys to take Ethics credit only in a live or fully interactive format, and requires independent sponsor verification of participation for on-demand content.

A catalogue strategy built entirely on self-paced modules cannot satisfy those requirements. Where they apply, the function needs a facilitation capability and attendance records naming the facilitator.

Supervision status is part of the record

CQC expects new staff to be supervised until they demonstrate they can work unsupervised, and expects clinical or professional supervision in line with each regulator’s own requirements — which differ by register, so a single blanket rule across a mixed workforce will not do. The FCA’s regime likewise treats supervision until assessed competent as part of what records must demonstrate.

That makes “who is cleared to work unsupervised today?” a question the training function should be able to answer instantly. In most organisations it cannot, because supervision sign-off lives in a manager’s inbox.

Regimes change, sometimes abruptly

Two current examples worth tracking, because both invalidate existing material. CQC is replacing its single assessment framework with separate sector frameworks and removing scoring, with a full consultation response due during 2026 — so content and reporting anchored on quality statements and scores will need re-basing, while Regulations 17 and 18 remain unchanged and are the stable anchor. And Ireland’s Code of Conduct on Mortgage Arrears has been revoked, its requirements consolidated into the Consumer Protection Code 2025 as Regulations 221 to 264.

Keeping a dated source reference against each mandatory course is unglamorous and saves the function from teaching a withdrawn framework.

What good looks like

A regulated training function can answer, without preparation: what each role requires and when that was last reviewed; the gap between required and completed, and who acted on it; current supervision status; the retention clock for each population; which previous version of a record applied at a given date; and how an individual extracts their own evidence.

Our guides to CQC training records and FCA training and competence records set those requirements out regulator by regulator, and our CPD course library covers the training itself.

Frequently asked questions

Is compliance training the L&D function’s responsibility or compliance’s?

The regulatory duty sits with the firm, but the evidential work — role requirements, tracking, gap reporting, retention, individual records — generally sits with whoever runs training. In insurance distribution, SYSC 28.4.1R goes further and requires the firm to be able to name the person responsible for record-keeping on request.

How long should training records be kept?

It depends on the activity and the clock starts when the person stops it. FCA TC 3.1.1R sets five years for MiFID business, three for non-MiFID and indefinitely for pension transfer specialists. CQC does not set a period, referring instead to data protection legislation.

Can everything be delivered as e-learning?

No. The SRA has proposed facilitated group ethics discussions with capped group sizes and qualified facilitators, and New York requires live or fully interactive delivery for newly admitted attorneys’ ethics credit, with independent verification of participation for on-demand formats.

Do completion rates satisfy a regulator?

No. CQC expects completed and required training to be tracked with prompt action on gaps, and FCA TC requires records demonstrating competence assessment and supervision, not attendance alone.