What must employees do about AML, and how must they be trained?

Employees are the firm's first line of defence and carry personal duties. They must cooperate with the compliance officer and report to them, without delay, anything that comes to their attention about transactions or business relationships where there is even a slight suspicion of money laundering or terrorist financing. It does not matter whether the information came up in the office or outside it, so long as it concerns the firm's customers or their transactions.

Employees can be held personally liable if they fail to report information or a suspicion. They report to the compliance officer, not straight to MOKAS, and never warn the customer. Under Article 26 of the Law, reporting internally in line with the firm's procedures is how an employee meets the legal duty to disclose; the compliance officer then decides what goes to MOKAS. Firms must also have procedures for recruiting staff and assessing their integrity.

The Law requires firms to keep employees informed about the firm's systems and procedures, the AML/CFT legislation, the supervisor's directives, the relevant EU rules and data protection requirements, and to train them regularly to recognise and handle suspicious transactions and activity. CySEC's Directive adds that every firm needs a complete education and training programme so that staff fully understand their legal obligations.

The compliance officer designs the programme's structure and content, identifies which departments and people need further training, prepares and applies an annual training plan, and assesses whether the training was adequate. The results, including how effectiveness was measured, go into the Annual Report. Good training uses real cases, including how a pattern was first spotted and what happened next, so that staff learn to recognise typologies that are otherwise hard to see.

Everyone, including senior management and the Board, but not in the same way. The programme is structured differently for new and existing staff and for each department, according to the services it provides and the risks it faces. The Board and senior management must be adequately trained too, and CySEC expects them to approve the compliance officer's annual training programme; a programme designed for the Board, focused on its responsibilities and on why the AML programme matters, is the recommended way to do this. The timing, frequency and content are set to fit each firm and change with new legal requirements, staff duties and wider developments.

CySEC's training circular requires firms to train staff before they start working for the firm and at least once a year after that, with prompt updates in between on new risks, typologies, legislation and internal procedures. Because the requirement is tied to working for the firm, training received at a previous employer does not replace it. Formats can include classroom seminars, online courses, conferences and forums, internal meetings on AML issues, and guidance notes or newsletters.

To avoid a tick-the-box exercise, firms measure whether training works, for example with tests after each course and minimum pass marks, and adapt the material and delivery to the results. A typical programme covers the basics of money laundering and terrorist financing, the legal framework and the firm's own procedures, offences and penalties including disciplinary action, customer due diligence and the economic profile, ongoing monitoring, recognising and reporting suspicion, handling difficult customers, record keeping and data protection, sanctions screening, and case studies.