Online AML Training: Who Actually Completed It?

Training requirements and participation evidence are different questions

UK obligations vary with the business, its regulatory status and the employee’s role. The FCA Handbook’s SYSC 6 provisions address compliance and financial crime controls for firms within their scope. They do not prescribe one universal online training platform or learner-verification method.[1]

Regulation 24 of the Money Laundering Regulations 2017 addresses staff awareness and regular training for relevant persons within its scope. HMRC’s related guidance discusses identifying relevant employees and maintaining written training records.[2][3]

These requirements should be checked against the firm’s circumstances. They are not a basis for claiming that every employer must use identity verification or course monitoring.

They do, however, make it worth asking what a training record actually establishes. A record that an account completed a module and a record of the named employee’s participation are not the same evidence.

A login identifies an account, not necessarily its user

An employee signs into a training platform. Their account opens an AML module and later generates a completion certificate.

The system has recorded activity against an account. Without further evidence, it may not establish whether the intended employee personally participated throughout the training.

Another person could use the account. An automated agent could work through online modules. A session could remain open while its intended learner is elsewhere. None of these possibilities means a particular employee has acted improperly; they explain why a completion status alone leaves questions unanswered.

The same distinction applies to online conduct, anti-bribery, information security and other compliance training. The content changes, but the record still needs to connect learning activity to a person if an organisation intends to rely on it as evidence of participation.

Verification at enrolment is the beginning, not the whole record

Identity verification can establish who is enrolling in online training. That is a useful starting point, but a check at enrolment does not establish who participates later.

Course monitoring addresses the next part of the record: linking participation during online training to the verified learner.

Together, these functions help answer a narrower, more practical question than “Did this employee become competent?” They document the identity associated with the training and participation during it.

They do not certify that the learner understands every obligation, will apply the material correctly or that the firm has met every regulatory requirement. Those conclusions need their own basis.

What should a training team ask?

Before buying anything new, understand how your existing records are produced.

- What identifies the learner? Is the training record linked only to an email address, or to a verified person? - When is identity checked? Only at enrolment, or during online training as well? - What participation evidence is retained? Does the record contain documented verification events and participation signals, or just a completion timestamp? - Can authorised staff retrieve the evidence? A useful record needs to remain accessible for review. - What happens when a session is interrupted? Learners need a clear route to resolve verification difficulties and continue their training. - What does the certificate claim? Its wording should not promise more than the underlying record supports.

These are operational questions, not a list of statutory requirements. Any monitoring approach should also be proportionate, explained to learners and handled through the organisation’s privacy and data-protection processes.

Keep participation separate from compliance conclusions

A more informative record makes its boundaries clear. Identity verification documents a verification process. Participation evidence documents involvement in online training. A completion status records the outcome recognised by the training platform.

None of these, alone, certifies competence or establishes that an organisation’s financial crime controls are adequate.

This separation helps firms avoid two opposite mistakes: treating a completion certificate as proof of everything, or dismissing it as proof of nothing. It is evidence of something specific. The question is whether that is enough for the purpose for which it is being used.

Where Asgard fits

Asgard Authenticate provides learner identity verification and course monitoring for online training. It links the enrolled learner to documented participation and supports defensible training records.

Participation prompts support the learner during training rather than turning the session into an examination.

Asgard does not proctor examinations, assessments or quizzes. It does not provide customer identity checks, financial compliance advice or competence certification. Its role is to document who participated in online training—not decide whether a firm’s regulatory obligations have been met.

For financial services training teams, that is a focused contribution: clearer evidence behind the completion record, without changing the organisation’s responsibility for training content and requirements.

Start with the record you already have

Take one completed online training record and ask what it establishes. Can your team explain how the learner’s identity was verified, what participation was documented and how those records connect?

If the answer stops at “their account completed it”, there is an evidence gap worth reviewing.

The aim is not a promise of regulatory approval. It is a training record that means what it says: documented online participation linked to the employee enrolled.