Last reviewed 5 November 2026 against the sources linked in this post.
Payments training that works is training for the people who can stop a payment. The US Treasury's sanctions office, OFAC, lists 14 enforcement actions in 2025 with penalties and settlements totalling USD 265,746,819, against companies and individuals, not only banks.
This list is for payments operations managers and compliance trainers who plan annual training for wire, card and trade-finance teams. You get 9 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The sanctions points describe US federal guidance, so treat this as a syllabus, not a ruling.
All 9 courses at a glance
| Course | What it covers | Length | US rule cited in this post |
|---|---|---|---|
| OFAC sanctions compliance | Screening, red flags and what to do with a hit | 40 min | Not cited here (OFAC guidance below) |
| Payments, cards and trade-finance operations | How card, wire and trade flows work and where checks sit | 40 min | Not cited here |
| Consumer protection and UDAAP | Fees, disclosures and complaints on payment products | 35 min | Not cited here |
| Fraud and scam recognition for customer-facing staff | Scam patterns and when to challenge a payment | 35 min | Not cited here |
| Social engineering, fraud and deepfakes | Fake bank details, cloned voices and urgent requests | 35 min | Not cited here |
| Phishing and social engineering | Business email compromise and how to respond | 30 min | Not cited here |
| Code of conduct | A decision test for grey areas | 35 min | Not cited here |
| Conflicts of interest | Disclose, then decide | 25 min | Not cited here |
| Data classification and handling | Labelling, storing and sharing payment data | 25 min | Not cited here |
OFAC's Framework for OFAC Compliance Commitments recommends that a sanctions compliance programme include training for all appropriate employees and personnel on a periodic basis, and at a minimum annually. It is guidance, not a law, and it lists training as one of five components alongside management commitment, risk assessment, internal controls and testing and auditing. Nothing on OFAC's pages names a particular course, so the table does not treat it as a rule.
Sanctions and payment operations
OFAC sanctions compliance
Screening is a daily control that can stop a wire reaching a blocked party. This 40-minute course has 7 lessons, from why sanctions matter and why liability is strict, to list-based and country sanctions, red flags such as evasion and transshipment, what to do with a screening hit, reporting deadlines and recordkeeping. It ends with a 12-question final check. A Pick Answer on a company owned 30% by one sanctioned party and 25% by another is a quick way to practise how ownership is assessed, though the course page decides how the rule is taught.
Payments, cards and trade-finance operations
Staff are better placed to spot a problem payment when they know where each check sits. This 40-minute course follows how money moves, accounts and instruments, card payments, cross-border payments and letters of credit, exceptions and discrepancies, and reconciliation. An ordering activity that puts a card payment's steps in order helps newer staff see why one mismatch turns an item into an exception.
Consumer protection and UDAAP
Fees, disclosures and complaints on card and payment products fall under consumer protection practice. This 35-minute course explains who enforces the unfair, deceptive and abusive practices rules, applies the three tests, sorts allowed from not-allowed practices and shows how to escalate a misleading script. It ends with a 10-question final check. Use the "just fix my card" scenario to practise not selling when a customer only wants help.
Our pick: OFAC sanctions compliance. It covers a control that can stop a payment, and its lesson on what to do with a screening hit gives staff a clear next move.
Fraud and scam defence
Fraud and scam recognition for customer-facing staff
Operations staff can learn scam patterns in payment requests before funds leave the account. This 35-minute course covers how scams use pressure, the common scam types, red flags and supportive questions, and a set of "challenge or proceed?" scenarios, ending in a final assessment. Add a Word Cloud on "what would make you call the customer back?"
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
Cloned voices and fake executive calls push urgent payments out. This 35-minute course follows a convincing request for new bank details, then covers the tactics, how to verify the money by calling a number you already hold, faked voices and video, and why seniority and secrecy are pressure, not proof. For more attack types, see our guide to social engineering examples.
Phishing and social engineering
Payment redirection scams often start with a phishing email. This 30-minute course traces a business email compromise step by step, teaches the red flags across email, SMS, voice, QR codes and AI deepfakes, and covers what to do after clicking, replying or paying. It ends with a 12-question final check.
Our pick: Social engineering, fraud and deepfakes. Its core habit, verifying a change of bank details through a channel you already trust, is a low-cost control a payments team can add today.
Conduct, conflicts and data
Code of conduct
Staff need a standard when a client or colleague pressures them to rush a payment. This 35-minute course covers why integrity matters, the rules in brief, a decision framework, grey areas and how to speak up, with a 10-question final check. Run "not sure means stop and ask" as a live poll.
Conflicts of interest
Side interests and gifts can change who gets paid and how fast. This 25-minute course defines actual, potential and perceived conflicts, lists common types, teaches "disclose, then decide" and shows how to complete a disclosure. It ends with an 8-question final check.
Data classification and handling
Payment files carry account and identity data that must be labelled and handled correctly. This 25-minute course explains the classification levels, how to label, store, share and dispose of data, and how to report mishandling. It ends with a 10-question final check. Its "anyone with the link" question suits teams that send files between systems.
Our pick: Data classification and handling. Payment files travel between teams, and one clear rule on where they may go helps cut avoidable incidents.
How to roll the plan out
Order it by the cost of a miss. With OFAC listing 14 actions and USD 265.7 million in 2025, start with the course that teaches staff to stop a payment.
- First week of a new starter: OFAC sanctions compliance and the payments operations course.
- First month: fraud and scam recognition, social engineering and deepfakes, and phishing.
- First quarter: consumer protection, code of conduct, conflicts of interest and data handling.
- Each year: a refresher on the sanctions course, which OFAC's framework guidance of training at a minimum annually supports, a yearly refresher on the other courses as your policy sets, and a short update whenever a new scam pattern appears.
- When it applies: outside the US, replace the US federal courses with your own regulator's equivalent and ask your compliance team what applies in your country.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A deck, or both, with a pre and post survey to see what changed.
- Pick Answer: show a payment request with four possible next steps, such as an urgent call from a "director" to release a wire.
- Word Cloud: ask "What makes you skip a check?" The biggest words show where to brief first.
- Rating Scale: before and after, ask "How confident are you holding a payment with a possible sanctions hit?" from 1 to 5.
- Open Ended: collect anonymous near-misses at the end of a live session.
FAQ
What training do payments operations staff need?
Payments staff typically need sanctions screening, fraud and scam recognition, data handling and a code of conduct. Set the refresh interval in your own policy; only OFAC's framework guidance of at least annually for sanctions is cited here. The courses above cover those topics, and your own systems training covers the tools.
What is OFAC sanctions training?
OFAC sanctions training teaches staff to screen customers and payments against sanctions lists and to hold and escalate a possible match. OFAC's framework recommends it for all appropriate personnel, and at a minimum annually.
How often should payments staff be retrained on fraud?
Set the interval in your own policy and add short updates when a new scam pattern appears. No rule cited in this post sets a fraud-training interval.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
