What training an FCA firm must give its staff in 2027
Two kinds of training are required by name for almost every FCA firm: anti-money laundering training under the Money Laundering Regulations, and Conduct Rules training under the Senior Managers and Certification Regime. Firms must also keep staff competent for their roles.
Most of the rest is not named in a rule, but is expected all the same. Bribery, tax evasion, fraud, sanctions, data protection and harassment law all turn on whether the firm had adequate or reasonable procedures, and training is one of the first things a regulator, prosecutor or tribunal asks about.
This page sets out what applies, where the requirement comes from, and how often to train.
At a glance
| Training | Who needs it | Where it comes from | How often |
|---|---|---|---|
| Anti-money laundering and CTF | Relevant employees and agents of every MLR firm, including Annex 1 firms | MLR 2017, regulation 24 | Regularly; annual refresher is the expected norm |
| Conduct Rules | Everyone the Conduct Rules apply to in an SM&CR firm | FSMA section 64B; COCON | On joining or a change of role, then annual refresher |
| Non-financial misconduct | Conduct Rules staff, from 1 September 2026 outside banking | COCON | With Conduct Rules training |
| Competence for the role | Every employee | SYSC 5 | As roles and rules change |
| Anti-bribery | All staff, more for those dealing with third parties | Bribery Act 2010, section 7 | Annual refresher |
| Anti-tax evasion | Staff and others acting for the firm | Criminal Finances Act 2017, Part 3 | Annual refresher |
| Failure to prevent fraud | Large organisations and their groups only; good practice for others | Economic Crime and Corporate Transparency Act 2023 | Annual refresher |
| Sanctions | Client-facing, onboarding and payments staff | UK sanctions regulations; OFSI expectations | Annual refresher |
| Data protection | Anyone handling personal data | UK GDPR accountability principle | Annual refresher |
| Harassment prevention | All staff, more for client-facing roles | Equality Act 2010, sections 40 and 40A | Annual refresher |
| Market abuse | Anyone with access to inside information or who trades | UK MAR; SYSC 6 | Annual refresher |
| Cyber and operational resilience | All staff | SYSC; operational resilience rules | Annual refresher |
Training the rules require by name
Anti-money laundering
Regulation 24 of the Money Laundering Regulations 2017 requires a firm to make its relevant employees, and agents doing similar work, aware of the law on money laundering, terrorist financing and proliferation financing, and of the data protection requirements that go with it. It must also give them regular training in how to recognise and deal with suspicious activity, and keep a written record of the training given (regulation 24).
This applies to Annex 1 firms in exactly the same way as to authorised firms. A relevant employee is anyone whose work bears on the firm's compliance with the Regulations or could help identify, prevent or detect money laundering, which in a small firm is usually everyone. HMRC's own guidance treats a missing training record as a separate breach from missing training (HMRC ECSH63415).
The 2026 amendments to the Regulations, in force since 30 June 2026, are a reason to make sure this year's course is not last year's.
Conduct Rules
Under the Senior Managers and Certification Regime, a firm must tell each person which Conduct Rules apply to them and take all reasonable steps to make sure they understand how the rules apply to their role (FSMA section 64B). In practice that means training on joining, on any change of role, and a refresher each year. Since 1 September 2026, the Conduct Rules also reach serious bullying, harassment and violence in firms outside banking, so non-financial misconduct now belongs in the same training.
Competence
Every firm must employ people with the skills, knowledge and expertise their responsibilities need (SYSC 5). It is a general duty rather than a syllabus, but it is the rule a supervisor reaches for when staff plainly do not understand what they are doing.
Training that adequate procedures require
These laws rarely say "you must train". They make the firm liable unless it can show it had adequate or reasonable procedures, and every official guidance note on what that means lists training. A firm that cannot produce a training record has no realistic defence.
- Bribery. A firm commits an offence if someone acting for it pays a bribe, unless it had adequate procedures to prevent it (Bribery Act 2010, section 7). The Ministry of Justice guidance makes communication, including training, one of its six principles.
- Tax evasion. The same structure applies to anyone acting for the firm who helps another person evade tax (Criminal Finances Act 2017, Part 3). The defence is reasonable prevention procedures, and HMRC's guidance expects training proportionate to the risk.
- Fraud. The failure to prevent fraud offence, in force since 1 September 2025, applies to large organisations: those meeting two of more than 250 employees, more than £36 million turnover and more than £18 million in assets, measured across the group. A small firm in a large group can be caught. For everyone else it is a sensible addition to anti-bribery and tax evasion training rather than a requirement.
- Sanctions. Sanctions are prohibitions, not risk ratings, and breaches can be pursued on a strict liability basis. Staff who onboard clients or handle payments need to know to stop a transaction first and ask questions second.
- Data protection. UK GDPR makes the firm responsible for being able to show compliance. Training anyone who handles personal data is one of the first measures the ICO looks for.
- Harassment. Employers must take all reasonable steps to prevent sexual harassment, and from 30 October 2026 can be liable for harassment of their staff by clients and other third parties. Acas lists training among the expected steps (Acas).
- Market abuse. UK MAR requires firms to have arrangements to detect and report suspicious orders and transactions. Anyone who sees inside information or places trades needs to know what insider dealing, unlawful disclosure and manipulation look like in their own work.
What changes in 2027
Four changes due next year will affect what this year's training needs to cover.
- 18 March 2027: operational incident reporting. A joint FCA, PRA and Bank of England regime for reporting operational and cyber incidents begins. Staff need to know what an incident looks like and who to tell, quickly.
- During 2027: harassment regulations. Regulations specifying the steps employers must take to prevent sexual harassment are expected, formalising what is currently guidance (CMS).
- From 2027: AML supervision of professional services. Law firms, accountants and trust and company service providers move to FCA supervision for AML. They will meet the same regulation 24 duty, with a new supervisor checking it.
- 25 October 2027: cryptoasset market abuse. A market abuse regime for cryptoassets begins, bringing the insider dealing and manipulation concepts to firms and staff dealing in them.
Keeping a record that stands up
The record matters as much as the training. For each person, keep the course, the edition, the date completed, the test score and the certificate. Show the board a summary at least once a year, including who is overdue and what was done about it.
Three things undermine a record in practice: the same course sat every year so nobody learns anything, no evidence of a test, and no trace of new joiners being trained in their first weeks.
How Fundsure can help
Our 20 CPD-assessed courses cover every area in the table above. Each is rewritten as the rules change and carries the year of its edition. Courses are scheduled and chased for you in the Fundsure Portal, with named certificates that can be checked online and a record that exports to Excel and feeds the quarterly board report.
Every course is included at £120 per person per year plus VAT. MLR-registered firms that only need AML can take that course alone at £60. To see a course before you buy, ask us for a demo link.