Last reviewed 5 November 2026 against the sources linked in this post.
AML KYC training teaches onboarding staff to decide who gets an account, using rules that regulators set. FinCEN's Year in Review lists 4.8 million suspicious activity reports among the Bank Secrecy Act reports filed in fiscal year 2025. Onboarding is where a customer's file starts: who they are, what they say they do, and whether anything does not fit.
This is a list of 10 ready-made courses for KYC and onboarding managers in banks, fintechs and credit unions. Several of the courses are built on US federal rules, so check the rules that apply to your own institution. Each entry says what the course covers, why an analyst needs it and what the room does in the session. Each group ends with an Our pick, followed by a rollout order and a way to run the sessions live.
All 10 courses at a glance
| Course | What it covers | Length | US legal duty on covered institutions? |
|---|---|---|---|
| Know your customer / customer identification program | Minimum customer data, verification, beneficial owners | 40 min | Yes |
| Anti-money laundering & Bank Secrecy Act | The three stages of laundering, CTRs, SARs | 50 min | Yes |
| OFAC sanctions compliance | Sanctions lists, screening hits, escalation | 40 min | Yes |
| Identity theft Red Flags Rule | Warning signs in account opening and servicing | 30 min | Yes, where the rule covers you |
| Consumer protection & UDAAP | Fair sales, marketing and servicing practices | 35 min | CFPB can act against covered persons |
| Code of conduct | Integrity and a decision test for grey areas | 35 min | None cited here |
| Conflicts of interest | Disclosing relationships before deciding | 25 min | None cited here |
| Phishing & social engineering | Spotting and reporting attacks | 30 min | None cited here |
| Data classification & handling | Labelling and protecting customer files | 25 min | None cited here |
| Social engineering, fraud and deepfakes: phone, payment and impersonation scams | Impersonation and payment fraud | 35 min | None cited here |
Customer identification and AML
These four are the heart of onboarding. The first three come from the regulations that shape what an analyst does with a new account, and the fourth from the rule on identity theft.
Know your customer / customer identification program
The US customer identification program rule says a bank must obtain, at a minimum, a name, date of birth for an individual, an address and an identification number before opening an account, and must verify identity within a reasonable time afterwards. This 40-minute course walks through those minimums, documentary and non-documentary checks, beneficial owners of legal entities and what to do when a customer cannot be verified. In the session, run the case practice with a scenario like this: a customer's address does not match their ID, so decide what to ask for and who to tell.
Anti-money laundering & Bank Secrecy Act
FinCEN says the Bank Secrecy Act regulations require financial institutions to keep records of cash purchases of negotiable instruments and to report certain activity. This course covers the three stages of laundering, the cash transaction report rule, structuring and suspicious activity reports, including the rule against tipping a customer off. Analysts need it because onboarding is where later alerts get their context. Use its structuring and red-flags lessons in the room: is this deposit pattern normal or worth a closer look?
OFAC sanctions compliance
OFAC's own FAQ says all US persons must comply with OFAC sanctions, including US citizens, permanent residents, entities in the United States and US-incorporated entities and their foreign branches. Analysts who screen new customers need to know how to handle a hit: hold, escalate, block or reject. The course also covers list-based and country-based sanctions and the 50 percent ownership test. In the session, put the ownership question to the room: a company is 30 percent owned by one sanctioned person and 25 percent by another, so what is its status?
Identity theft Red Flags Rule
The FTC says the Red Flags Rule requires many businesses and organisations to implement a written identity theft prevention program if they have covered accounts. Account opening is where a stolen identity can be used, so this 30-minute course trains analysts to spot the five categories of warning signs, respond and report through the programme owner. Run a Pick Answer scenario with a credit report showing a fraud alert and let teams choose the next step before the answer appears.
Our pick: Know your customer / customer identification program. Onboarding decisions start with knowing who the customer is, and this course teaches the minimum data and how to verify it.
Fair onboarding and conduct
Declining or restricting a customer is a decision with consequences, so these three set the standard for how analysts make it.
Consumer protection & UDAAP
Federal law lets the Consumer Financial Protection Bureau act to prevent covered persons and service providers from engaging in unfair, deceptive or abusive acts or practices. This 35-minute course teaches the three tests and how to classify everyday sales, marketing and servicing practices. Analysts need it because account opening involves scripts, forms and disclosures that a customer may read as a promise. In the session, use its poster example: "no monthly fee" was true, so what is the problem? The answer shows why the overall impression counts.
Code of conduct
This course covers why integrity matters and gives analysts a four-question decision test for grey areas, plus how to speak up and recognise retaliation. Analysts approve and decline customers, and a clear test keeps those calls consistent. In the session, run its scenario round and ask the room to vote on each grey-area case before discussing it.
Conflicts of interest
An analyst who onboards a relative, a former colleague or a friend's business has at least a potential conflict, even if nothing improper happens. The course introduces actual, potential and perceived conflicts and teaches "disclose, then decide". Use its sorting activity in the room: each case goes into a pile, for example disclose, recuse or no issue.
Our pick: Consumer protection & UDAAP. The other courses help analysts spot the suspicious customer. This one helps them treat the confused one fairly.
Data security and fraud
Onboarding files hold documents criminals want, so the last three courses are about protecting them.
Phishing & social engineering
This 30-minute course traces how a business email compromise unfolds, how to spot phishing across email, text, voice and QR codes, and how to verify a request through an independent channel. In the session, show a realistic request for "urgent" customer documents and ask teams, by poll, whether to send them.
Data classification & handling
An onboarding file is full of IDs, addresses and tax numbers, so analysts need to label, store, share and dispose of data by its sensitivity level. The course explains classification levels, what each allows and what to report when something is mishandled. Its sample question is a good opener: what does "anyone with the link" mean?
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
This 35-minute course covers impersonation and bank-detail change requests: the tactics, the rule of verifying money requests using a known number, and what can now be faked by voice and video. Use its scenarios in the session: a polite, senior-sounding request arrives, so what do you do first?
Our pick: Social engineering, fraud and deepfakes. This course drills one habit that defuses a convincing request: verify it through a number you already hold.
How to roll the plan out
Start with the courses that cover a US legal duty and your onboarding procedure: customer identification, AML and the Bank Secrecy Act, OFAC and, where it covers you, the Red Flags Rule. For banks, the federal regulation lists training for appropriate personnel as one element of an AML programme. Then schedule refreshers for the fraud and phishing courses. Finish with role-specific depth, such as UDAAP for analysts who handle disclosures.
Add the rules your location needs. This list is built on US federal rules, and a bank, credit union or fintech in another country, or a US state with extra duties, should add its own regulator's requirements. No source cited here sets how often training must be repeated, so ask your regulator and set a frequency in your own programme.
Anchor each session to the same fact. FinCEN's Year in Review lists 4.8 million suspicious activity reports in fiscal year 2025, which is a reminder of how large the reporting system is. Keep attendance records and the questions raised.
The CDD rule gives the group a shared definition of its job. FinCEN says it requires covered institutions to identify and verify customers and beneficial owners, understand the nature and purpose of customer relationships and monitor on an ongoing basis. If you are building a programme for the whole compliance team, our guide to compliance officer training covers the wider course list. For the warning signs frontline staff should escalate, see our list of AML red flags.
Ways to run these courses on AhaSlides
You can offer all 10 in three formats:
- Self-paced courses. Use the AhaSlides course creator to send each analyst a course to complete before they handle live cases.
- A live Q&A deck. Collect questions from the team ahead of the session, then answer them in the room. For running it well, see our 9 tips for a successful Q&A session.
- Pre and post surveys. Measure what changed in the same session, and see how to track employee training completion.
Four slide types do most of the work:
- Pick Answer. Ask: "A customer's address does not match their ID. Do you open, ask for more, or escalate?" Show the split before you reveal the answer.
- Word Cloud. Ask: "What makes a new customer feel wrong to you?" The biggest words show what the team notices first.
- Rating Scale. Ask, before and after: "How confident are you handling a sanctions screening hit?" Rate from 1 to 5 and compare the averages.
- Open Ended. Ask: "What would you want to know about a customer before approving them?" Answers can be anonymous, so people say what they think.
FAQ
What is KYC training?
It teaches staff to verify who a customer is and understand their risk when opening and maintaining an account. In the US, the customer identification program rule sets the minimum information banks must collect and the verification they must plan for.
What is the difference between KYC and AML?
KYC is about identifying and understanding customers, and AML is the wider set of controls to detect and report money laundering. FinCEN describes customer identification, beneficial ownership, understanding the customer relationship and ongoing monitoring as the CDD rule's core.
Who needs KYC training?
Onboarding staff, KYC analysts, branch employees who open accounts and the compliance teams who review their work. The 10 courses above are grouped so a team can split them by role.
How often is KYC training required?
No source cited here sets a fixed frequency. For banks, the regulation lists training for appropriate personnel as part of an AML programme, so ask your regulator what it expects and keep records of who completed what.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
