No Regulation Requires Annual AML Training: the Rule Says ‘Appropriate Personnel,’ Examiners Expect a Refresher

Your bank trains everybody on anti-money laundering once a year. Ask where the annual part of that habit came from and the answer is usually a policy document citing itself. The regulation that policy rests on never says it.

That regulation is worth reading before your next examination, for a reason that has nothing to do with training less. An examiner at that examination will ask why your interval is annual, and will want a risk-based justification for it. A program believing the law requires 12 months has no justification to offer.

The distance between what the rule says and what examiners expect is the subject here. What the rule says is 4 words long. The same 4 words set no interval, and what examiners expect has governed industry practice for 2 decades.

What the Rule Says, Word for Word

Those 4 words are the entire training element in the program rule for banks. They read "training for appropriate personnel", and the section lists them alongside 4 other minimum requirements a compliant program must include. Searching that same section for annual, annually or periodic returns nothing, because all 3 words appear in it 0 times.

Reading down the right-hand column of that table makes the point. The column is empty for all 5 minimum elements, because the rule leaves the timing to the institution that knows its own risk. The fifth element was added later and follows the same pattern.

Where the Customer Due Diligence Rule Fits

That fifth element reaches outward to a second regulation. The second regulation is the customer due diligence rule, which requires covered financial institutions to identify and verify the beneficial owners of their legal entity customers using risk-based procedures throughout. Neither of those 2 regulations sets a training interval anywhere in its text, which is the point most programs miss.

That absence surprises people who assume the newer rule tightened everything it touched. What that newer rule does add is an obligation of ongoing monitoring to identify and report suspicious transactions, and the monitoring itself runs continuously on no schedule at all. Monitoring with no stated training cycle is the whole of the problem your own written policy has to solve for itself.

Where the Annual Cycle Came From

Industry practice filled the gap, and your policy inherited it from the industry. Practice is written down in the FFIEC BSA/AML Examination Manual, which examiners work from and which asks for periodic training tailored to each person's responsibilities. No interval appears in it either, and the annual habit began there.

The manual expects training to reflect current developments, regulatory changes, supervisory guidance, your own policies and the mix of products and customers you hold. An institution whose product set changed twice in a single year has a much harder case for one annual refresher than an institution that changed nothing at all. An institution's interval follows its own risk, which is the reasoning an examiner wants to see documented.

What to Write Down in Place of a Date

Writing that reasoning down takes about a page. The page needs to name the risk factors you considered, the audiences they produce and the frequency each audience gets. It also needs a review date, because reasoning ages fast.

Those inputs reduce to 4 questions at a bank of any size:

• Record which products and customer types changed in the past 12 months.
• Record which roles touch those products directly.
• Set the frequency per audience, and say why each one differs.
• Set the date you will revisit the risk itself.

Why the Filing Volume Beats the Calendar as an Argument

Risk is a moving thing, as those 4 questions imply, and the filing numbers show how far it moves. Filing numbers are large, because Forvis Mazars, reading FinCEN's own statistics, counted more than 4.105 million suspicious activity reports filed during 2025, a record and an increase of 7.99% on 2024. Depository institutions alone filed more than 2.193 million of them, which was an increase of 7.66% on their own 2024 total.

Those 2.193 million reports describe what your front line must catch. A bank filing more reports each year is a bank whose front-line staff are making more judgment calls, and those judgment calls are the thing that training changes. The volume of those reports answers an examiner far better than a date in the diary does.

Who "Appropriate Personnel" Covers

Judgment calls are not evenly spread, which is what the word appropriate is doing in those 4 words. Appropriate covers a teller, a branch manager, a lending officer and a board member, and none of those 4 needs the same thing. The scoping decision is yours, and your documentation of it gets examined.

One term to keep out of that documentation is "KYC training", which sounds official and is not. The phrase appears in neither the program rule nor the examination manual, both of which speak of a customer identification program and of customer due diligence. Borrowing industry shorthand into a policy document invites a question about your documentation that you gain nothing by answering.

What KC Library Gives a Bank Compliance Team

Scoping by role is the easy half of that documentation, and keeping 4 separate courses current between reviews is the half that defeats most small compliance teams. A course written in 2024 describes typologies that have since moved on. Rewriting 4 of them every year defeats a small team.

KC Library holds more than 50,000 training videos across 5 categories and adds new ones every week, which keeps that material current as typologies change underneath it. Pairing the library with KC LMS gives you role-based assignment and a dated completion record against each named person. A lending officer and a teller then receive different material without anybody maintaining 2 lists by hand.

For a banking and finance business, the useful change is to stop citing a rule that does not exist. Write down why your interval suits your risk, scope the audience by role, and keep the content moving between reviews. AML compliance training then rests on a documented judgment, which is the thing an examiner was asking about all along.

Frequently Asked Questions

1. Does any regulation require annual AML training for banks?

No. The anti-money laundering program rule for banks requires training for appropriate personnel and states no frequency. The words annual, annually and periodic do not appear in the section at all, so the interval is a risk-based decision the institution makes and documents.

2. Where does the annual expectation come from?

From examination practice. The FFIEC BSA/AML Examination Manual asks for periodic training tailored to each person's responsibilities and reflecting current developments, regulatory changes, supervisory guidance and your own products and customers. It names no frequency, and the annual refresher grew up around it as industry convention.

3. What does appropriate personnel mean?

It is left to the institution. A teller, a branch manager, a lending officer and a board member all need training and none of them needs the same training. The scoping decision is yours, and the documented reasoning behind it is what an examiner reviews.

4. Is KYC training a regulatory requirement?

No, and the phrase is not a regulatory term. Neither the program rule nor the examination manual uses it; they use customer identification program and customer due diligence. Writing industry shorthand into a policy document creates an obligation nobody asked you to take on.

5. How does the customer due diligence rule change the training picture?

It adds a fifth minimum element to the program rule, requiring risk-based procedures for ongoing customer due diligence, including ongoing monitoring to identify and report suspicious transactions. It sets no training interval. What it does create is a continuous duty, which strengthens the case for training that follows risk and not a date in the diary.

References

1. 31 CFR 1020.210, Anti-money laundering program requirements for banks.
2. 31 CFR 1020.210, Legal Information Institute.
3. 31 CFR 1010.230, Beneficial ownership requirements.
4. FFIEC. BSA/AML Examination Manual, BSA/AML Training.
5. FinCEN. SAR Stats.
6. Forvis Mazars. Suspicious Activity Report Filings Hit Record in 2025.