Bank compliance training: why course completion isn’t enough

Oct 06, 2026

5 min read

Summarize with AI

Financial institutions invest heavily in compliance training every year and track completion closely. But finishing a module doesn’t show how someone will act when the right choice is unclear. If audits keep turning up the same mistakes, it raises a simple question: why do people who completed the training still make these errors?

In October 2024, TD Bank pleaded guilty in proceedings involving Bank Secrecy Act and money laundering conspiracy violations. The US Department of Justice resolution imposed over $1.8 billion in penalties and described an inadequate AML program spanning January 2014 to October 2023. A parallel OCC action imposing a $450 million penalty identified deficiencies in customer due diligence, customer risk ratings, suspicious activity processes and training, alongside staffing and governance.

Similarly, the FCA’s £21.1 million ($28.4 million) fine against Monzo in July 2025 shows how that gap can surface in practice. The regulator found weaknesses in the bank’s financial crime controls as Monzo grew, including insufficient guidance for investigating transaction monitoring alerts and work carried out by staff who lacked experience or training. A completion record wouldn’t have shown those problems.

By Ivan Grabovski

Head of E-commerce & Retail

Verified expert

Every article at Innowise is created by authors with real-world experience. They understand the topic beyond theory and bring insight from real projects.

17+ years of experience

Verified expert

17+ years of experience

Ivan guides e-commerce giants through high-pressure transformations. He builds resilient digital ecosystems and scalable architectures that allow businesses to handle massive loads and provide a conversion-focused user experience.

Expertise

E-commerce Retail Delivery management

Let's talk

Where annual compliance training falls short

The substance is narrow and worth reading carefully.

A tokenized deposit stays a deposit offered by the institution. The bank keeps responsibility for the underlying obligation. Distributed ledger technology changes how the claim is represented and transferred, not what it is under the existing framework. That is the whole ruling.

Now the part that got much less attention. Institutions remain responsible for the existing legal, technology, cyber and third-party risk requirements, and OSFI expects banks to consult their lead supervisors before launching a novel product. So the legal question is settled, and the operational one is wide open. Those are two different problems, and the second one is the expensive one.

I would frame it this way for any bank reading it: you no longer have to argue that your product is legal. You still have to prove that you can run it.

Different roles need different practice. Retail staff and trade finance teams make different compliance decisions. General policy training explains the rules, but employees still need examples that match the scenarios they are likely to facee.
Knowledge fades over time. A rule covered once a year may be difficult to recall months later, especially if employees rarely use it. Short follow-up sessions help keep the right response familiar.
Workplace errors don’t always feed back into training. QA reviews and audits show where people are still making mistakes. If those errors never influence the training content, the same gaps may remain.

Changes can’t always wait for the annual course. New products or revised controls change what employees need to know long before the next scheduled training round.

What compliance as a capability means

Completion shows an employee finished a module. Capability shows whether that employee would make the right call on a live case when the rule alone does not spell out the answer.

By compliance capability, I mean the ability to apply the rules in the workplace, which I break down into four layers:

Regulatory knowledge: does the employee understand the rule and internal policy that apply to the case?
Compliance risk recognition: do they spot the facts that need closer attention?
Compliance decision-making: do they choose the right next step within their authority?
Operational compliance: do case records show that they took the required action and documented it?

A gap can appear in any layer, and the response depends on where it occurs. An employee who knows the rule and recognizes the risk can still choose the wrong response, and a course that repeats the rule will not close that particular gap.

Take a transaction monitoring analyst reviewing an alert. They may identify a risk indicator but be unable to explain the next step required by the bank’s procedure. The assessment then shows which part of the decision needs attention when planning compliance training for banks.

Learn how to assess compliance capability by role

How to check whether employees apply the training

After the assessment shows where the problem is, the bank needs to check whether the same problem appears again after training or a process change. A quick quiz right after training only shows how well employees remember the material at that moment. I’d revisit the same capability later, using a new scenario, and compare the result with the first assessment.

If the same issue shows up again, I’d look beyond the training. If an onboarding mistake keeps happening, I’d check both the procedure and the employee’s understanding. Even when employees know the rule, conflicting instructions can lead to repeated errors.

For bank compliance training, follow-up should happen when a weakness returns rather than waiting for the next annual course. A knowledge or judgment gap may call for more practice. A process issue needs procedural changes, followed by another assessment to see whether the problem remains.

Where AI and assessment software fit

Once the bank knows which capability needs attention, technology can help with two parts of the process. AI can help draft training material for that need, while assessment software can keep the follow-up tied to the original issue.

For banked online compliance training and AI compliance training, I recommend starting with approved regulatory sources and the bank’s own policies. The draft should reflect the employee’s role and authority, and a compliance reviewer should approve it before employees receive it. AI governance and compliance training should also define how that review is recorded and how drafts are sent back for revision.

Assessment software becomes useful when the bank checks the same issue again after making a change. Innowise’s work with Vidda Solutions, a Norwegian RegTech provider, shows one way to do that. The platform uses role- and risk-based assessments and provides recommendations for individual employees. Test owners can mark a recommendation as implemented and relaunch the assessment later, so they can track whether the gap remains over time. You can read the full case study for a closer look at the setup.

Where to start

I wouldn’t start compliance training for bank employees by adding a new LMS or expanding the course library. Instead, I’d pick one high-risk role and see how employees handle tough situations compared with what the job requires. Any emerging gaps will show the bank where to focus training and help check progress later. Once the bank can track capability in one role over time, it can use the same approach for other roles.

Know what needs attention before adding another course

Use the capability model to see whether the problem sits with training or with the process around it

Contact us

Book a call or fill out the form below and we’ll get back to you once we’ve processed your request.

Name

Company

Phone

Message

Send us a voice message

Attach documents

Upload file

You can attach 1 file up to 2MB. Valid file formats: pdf, jpg, jpeg, png.

By clicking Send, you consent to Innowise processing your personal data per our Privacy Policy to provide you with relevant information. By submitting your phone number, you agree that we may contact you via voice calls, SMS, and messaging apps. Calling, message, and data rates may apply.

You can also send us your request
to contact@innowise.com

What happens next?

Once we’ve received and processed your request, we’ll get back to you to detail your project needs and sign an NDA to ensure confidentiality.

After examining your wants, needs, and expectations, our team will devise a project proposal with the scope of work, team size, time, and cost estimates.

We’ll arrange a meeting with you to discuss the offer and nail down the details.

Finally, we’ll sign a contract and start working on your project right away.