Last reviewed 2 November 2026 against the source linked in this post.
The auditor asks one question you cannot answer from memory: show me who was trained on what, and when. The US Department of Justice tells its prosecutors to assess periodic training and certification for all directors, officers, relevant employees and, where appropriate, agents and business partners, and to ask how the company measures whether the training works.
That is the practical test for compliance officer training. Certification bodies cover your own credentials. This list covers the other side: the 15 ready-made courses your function can deliver, in 4 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The legal points describe US federal guidance, so use this as a syllabus, not a ruling.
All 15 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| Code of Conduct | Gifts, honesty, conflicts and speaking up | 35 min | No |
| Conflicts of Interest | Declaring and managing conflicts | 25 min | No |
| EU: Whistleblower Protection | Reporting channels and protection from reprisal | 30 min | Yes (EU Directive 2019/1937, via national law) |
| Anti-Bribery & Corruption (FCPA) | Gifts, third parties and grey areas | 40 min | Yes (US federal) |
| UK: Bribery Act 2010 | Bribery offences and adequate procedures | 35 min | Yes (UK) |
| UK: Modern Slavery Awareness | Spotting signs and reporting | 30 min | Related (UK Modern Slavery Act 2015: statement duty only) |
| Anti-Money Laundering & Bank Secrecy Act | Cash reporting, structuring and suspicious activity | 50 min | Yes (US federal) |
| OFAC Sanctions Compliance | Sanctions red flags and escalation | 40 min | Yes (US federal) |
| Banking Conduct, Regulation and Prudential Risk Essentials | Conduct, fair treatment and risk types | 40 min | No |
| Annual Compliance Refresher Quiz for Financial Teams | Quiz-based yearly refresher | 20 min | No |
| Who Is Responsible? AI Act Roles, Deployer Duties and AI Governance | AI roles, risk levels and intake | 45 min | No |
| EU: AI Literacy (EU AI Act Article 4) | AI literacy for all staff | 35 min | Yes (EU AI Act) |
| Data Classification & Handling | Classifying and handling sensitive data | 25 min | No |
| Phishing & Social Engineering | Spotting and reporting attacks | 30 min | No |
| Social Engineering, Fraud and Deepfakes | Payment, phone and impersonation scams | 35 min | No |
A law behind a topic does not always mean it requires a course. Check your own obligations with counsel.
Ethics, conflicts and speaking up
Code of Conduct
The code is the foundation document, and a compliance officer's job is to make it understood, not just signed. This 35-minute course has 6 lessons covering why integrity matters, the rules in brief, a decision framework, grey areas and speaking up, with a 10-question final check. Run the grey-areas lesson live: put a gift scenario on screen and let the room vote before you reveal the policy answer.
Conflicts of Interest
Conflicts are a common thing for staff to disclose, and hard to standardise. This 25-minute course covers why conflicts matter, the rules, a decision framework, grey areas, and how to disclose or report someone else's conflict. It gives you one consistent way to ask "should I have told someone?". A Pick Answer quiz on four borderline cases shows where your people draw the line.
EU: Whistleblower Protection
The course page bases this 30-minute course on Directive (EU) 2019/1937. It covers why speaking up matters, the rules, a decision framework, grey areas and what protection looks like. Compliance teams usually run the reporting channel, so they need managers who know not to react badly to a report. Try an anonymous Open Ended slide: "What would stop you reporting a concern?"
Our pick: Code of Conduct. Every other course in this list leans on it, and a code people can apply beats a code people have signed.
Bribery, sanctions and financial crime
Anti-Bribery & Corruption (FCPA)
This 40-minute course covers the Foreign Corrupt Practices Act in six lessons: why integrity matters, the rules, a decision framework, grey areas, speaking up and a 10-question check. The grey areas are where gifts, hospitality and third parties trip people up. Compliance officers need it because agents and partners are often where the risk sits. Use a Rating Scale: "How confident are you that you could spot a risky payment request?" from 1 to 5, before and after.
UK: Bribery Act 2010
For teams with UK operations, this 35-minute course covers the Bribery Act's offences, including the failure of commercial organisations to prevent bribery, across six lessons. It is aimed at all staff and associated persons, which matters because a compliance officer has to evidence what the organisation did to prevent bribery. Test it with a scenario: a supplier offers a "thank you" holiday. Learners decide, then see the answer.
UK: Modern Slavery Awareness
Supply-chain statements are only as good as the people who can spot the signs. This 30-minute course defines modern slavery and its forms under the Modern Slavery Act 2015, teaches the signs, what to do and not do, and where to report. The Act requires a statement from larger commercial organisations; it does not require staff training, which is one thing a statement may describe. Add a Word Cloud: "What would make you suspect something was wrong at a supplier?" The answers tell you what to add to your site-visit checklist.
Anti-Money Laundering & Bank Secrecy Act
Written for bank and credit union frontline staff, this 50-minute course covers the Bank Secrecy Act programme, cash over $10,000, structuring and red flags, and suspicious activity reports. It ends with case practice and a 12-question check, so you have a score to file. Our guide to AML red flags goes deeper on the signs.
OFAC Sanctions Compliance
This 40-minute course teaches what sanctions cover, what is allowed and not allowed, red flags and duties, and how to escalate correctly. Staff do not need to be sanctions experts; they need to know when to stop and call you. Show three transaction summaries in a Pick Answer quiz and ask which one should be escalated.
Our pick: Anti-Bribery & Corruption (FCPA). Gifts, hospitality and third parties show up in almost every sector, so it earns its place in nearly any programme.
Regulatory refreshers for financial firms
Banking Conduct, Regulation and Prudential Risk Essentials
This 40-minute course is built for compliance and risk champions. It covers why conduct and risk matter, who supervises what, fair treatment in five habits, operational, market and liquidity risk, and which rule applies in grey areas. It gives non-specialists a shared vocabulary. A good moment is the "sort the events" activity, where learners place incidents into the right risk category.
Annual Compliance Refresher Quiz for Financial Teams
This is a 20-minute, quiz-based annual refresher for financial teams. It has no template page yet, so there is no link to give you; check the template library for it later. A short quiz each year gives you the completion and score records a reviewer asks to see. Our guide to annual compliance training has a yearly checklist you can adapt.
Our pick: Banking Conduct, Regulation and Prudential Risk Essentials. It is the only course in the group you can open today, and it builds the vocabulary the other refreshers assume.
AI, data and fraud risk
Who Is Responsible? AI Act Roles, Deployer Duties and Your Organisation's AI Governance
Compliance often ends up owning AI governance. This 45-minute course opens with a pilot that went live unreviewed, then covers provider and deployer roles, risk levels, an intake-to-approval path and grey areas such as bought-in features. It has 8 fields for your own policy and contacts. Run the "sort the use case" activity live with your own tools.
EU: AI Literacy (EU AI Act Article 4)
This 35-minute course is for all staff and covers why AI literacy matters, the rules in brief, a decision framework, grey areas and speaking up. A compliance officer's job is to show the programme exists and who completed it. Poll the room first: "Which AI tools did you use at work last week?" The answers often reveal tools you did not know about.
Data Classification & Handling
Compliance sets the classification scheme and then has to police it. This 25-minute course covers what is covered, allowed and not allowed, red flags and duties, case practice and how to escalate. It cites ISO/IEC 27001:2022 Annex A 5.12 on its page. Ask learners to sort everyday documents into the right class, then discuss the ones they disagreed on.
Phishing & Social Engineering
Phishing is a familiar route to a data breach, so your programme should be able to show staff have been trained. This 30-minute course covers the threat today, anatomy of an attack, spotting red flags, protecting yourself and how to respond and report, with a 12-question final check. A Pick Answer "real or phish?" round works well live.
Social Engineering, Fraud and Deepfakes: Phone, Payment and Impersonation Scams
Written for finance teams, this 35-minute course covers convincing requests, verifying the money, and faked voices and video. It belongs in a modern curriculum because payment fraud can arrive by voice and video as well as email. Walk learners through the new-bank-details scenario and ask what was missing.
Our pick: Who Is Responsible? AI Act Roles, Deployer Duties and Your Organisation's AI Governance. Someone has to own AI risk, and this course helps your organisation decide who before a regulator asks.
How to roll the plan out
The Department of Justice looks at whether training is risk-based, tailored to the audience and measured for effect. Build the plan in that order.
- First 30 days: the Yes courses that apply to your locations (FCPA, UK Bribery Act, AML and OFAC where relevant), plus the Code of Conduct for every new starter.
- Within the first quarter: conflicts, whistleblowing, data classification and phishing for everyone, and the AI courses for the teams using AI.
- Each year: a refresher on the core topics, with a quiz and a record of scores. Our guide to annual compliance training helps you plan the calendar.
- Role-specific depth: banking conduct, deepfakes and fraud for finance teams, modern slavery for procurement.
Add your state or country rules where your offices are, and ask counsel what applies.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live session deck, or both, with a pre-course and post-course survey so you can show what changed.
- Pick Answer: show four gift or payment scenarios and ask which one to escalate.
- Word Cloud: ask "What would make you suspect something was wrong at a supplier?" The biggest words show what to add to your checklist.
- Rating Scale: before and after a course, ask "How confident are you that you could spot a risky payment request?" from 1 to 5.
- Open Ended: collect anonymous answers to "What would stop you reporting a concern?" so you hear what people would otherwise keep to themselves.
FAQ
What training does a compliance officer need?
Compliance officers need ethics, anti-bribery, financial crime, data protection and sector regulation knowledge. The 15 courses above cover the training you deliver to staff; your own professional training depends on your sector.
Do you need a certification to be a compliance officer?
Not always, but certification is common and some employers expect it. Whatever your credential, documented staff training is what shows the programme works.
What should a compliance training programme include?
A code of conduct, conflicts, anti-bribery, whistleblowing, data protection and your sector's rules, with records of who completed what and their scores.
How often should compliance training be refreshed?
Annually for core topics, and again whenever the rules or your risks change. Use a short quiz for the yearly refresher so completion is easy to record.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified employment lawyer or the regulator.
