The conventional wisdom
When financial crime controls break down, the standard response is predictable: roll out more training. Your firm just failed a regulatory review? Launch a mandatory KYC refresher course. Employees missed red flags? Add another module to the onboarding curriculum. The Financial Conduct Authority found gaps in your controls? Schedule quarterly training sessions and call it fixed.
This training-first reflex has become compliance dogma. It's comforting because it's measurable, defensible in audit reports, and creates the appearance of action. You can point to completion rates, quiz scores, and certificates. When regulators ask what you're doing about control weaknesses, "we've enhanced our training program" sounds like a serious answer.
But here's the uncomfortable truth: if your KYC checks have gaps, training probably isn't your real problem.
The real issue
The FCA's warning that U.K. financial services firms still have potentially serious gaps in their financial crime controls reveals something training can't solve: a design problem masquerading as a knowledge problem.
Most compliance professionals can recite KYC requirements in their sleep. They know they should verify customer identity, understand the nature of business relationships, and monitor for suspicious activity. The issue isn't that your team forgot these principles between training sessions. It's that your processes make thoroughness optional, or worse, actively discourage it.
Consider what actually happens during customer onboarding. Your relationship managers face pressure to close deals quickly. Your operations team processes dozens of files daily with minimal time per case. Your technology flags potential issues, but someone still needs to investigate them, and that someone has seventeen other priorities. Training tells people what perfect KYC looks like. Your workflow tells them what's actually expected.
This disconnect explains why firms keep failing reviews despite investing heavily in training programs. You're treating a systems failure as an education failure.
The evidence
Look at where KYC breakdowns typically occur. They don't happen because someone never learned the definition of a politically exposed person. They happen because:
- Your case management system doesn't force documentation of why a flag was cleared. An analyst can click "reviewed" without explaining their reasoning, and the file moves forward.
- Your customer risk ratings rely on dropdown menus that don't capture the actual risk profile. Everyone learns to select "medium" because "high" triggers additional approvals that delay onboarding.
- Your enhanced due diligence procedures exist in a policy document but aren't built into your workflow. People know they should do more checks on certain customers, but the system doesn't prompt them or provide easy access to the right databases.
- Your quality assurance reviews sample 2% of files quarterly. An employee who cuts corners has a 98% chance of never being caught, and they know it.
These aren't knowledge gaps. They're design choices that make compliance harder than it should be.
The firms that pass regulatory reviews don't necessarily train more. They build processes where the compliant path is the easiest path. Their systems enforce mandatory fields before a file can advance. Their risk ratings trigger automatic escalations. Their case management tools require narrative explanations, not just checkboxes.
What to do instead
Start by auditing your KYC workflow for friction points where compliance becomes optional. Shadow your team for a week and watch where they make judgment calls without clear guidance or documentation requirements.
Then fix the process, not the person. If analysts are clearing alerts without adequate investigation, don't send them to another training session. Change your case management system so it won't let them close an alert without documenting specific review steps. If customer risk ratings are consistently too low, don't lecture about risk assessment. Redesign the rating tool with better prompts and examples, or require supervisory approval for certain classifications.
Build quality checks into the workflow itself, not just at the end. If enhanced due diligence should include adverse media screening, make that screen a mandatory step in your system. If certain customer types require additional documentation, configure your platform to reject incomplete files.
Make your technology do the remembering. Your KYC system should know which checks are required for which customer types and refuse to advance without them. It should flag inconsistencies automatically. It should surface relevant information at the point of decision, not force analysts to hunt through multiple databases.
And yes, you still need training, but make it practical. Instead of annual refreshers on KYC principles, train people on your actual system's features and requirements. Show them how to document their reasoning effectively. Walk through real examples of what adequate due diligence looks like in your workflow. Train supervisors on quality review techniques, not just policy requirements.
When training is necessary
Training does matter in specific situations. When regulations change, your team needs to understand new requirements before you can redesign processes around them. When you hire people from outside financial services, they need foundational KYC education. When you introduce new technology, people need to learn how to use it effectively.
Training is also essential for judgment calls that can't be fully systematized. Understanding the context behind red flags, recognizing patterns of suspicious activity, and knowing when to escalate unusual situations all require education and experience, not just better software.
And if your investigation revealed that people genuinely don't understand core concepts, then yes, training is part of the solution. But be honest about what you're seeing. Are people failing to apply knowledge they have, or do they truly lack that knowledge?
The real power of training comes after you've fixed your processes. Once you've built systems that make compliance easier, training helps people understand why those systems exist and how to use them effectively. It reinforces good design rather than compensating for bad design.
If the FCA is still finding gaps in your financial crime controls despite your training efforts, stop adding modules. Start examining whether your processes actually enable the behavior you're trying to train. Sometimes the best compliance investment isn't another course. It's a workflow that makes cutting corners harder than doing it right.
