In brief. Anti money laundering training is a legal obligation for all obliged entities under Italian and EU AML law. It is not a formality: regulators and prosecutors look closely at the quality and frequency of training when assessing compliance and corporate criminal liability under D.Lgs. 231/2001. The new EU framework (AML Single Rulebook, Regulation (EU) 2024/1624, applicable from 10 July 2027) raises the bar, with structured expectations on programme design, content, recipients and documentation. International Lawyers Associates (ILA) designs and reviews AML training programmes for Italian and international obliged entities.

At a glance

  • AML training is a legal duty under Article 16(3) of D.Lgs. 231/2007 for all obliged entities in Italy.
  • The training must reach all relevant staff: front office, back office, AML officer, management and board.
  • Programmes must cover legal framework, internal policies, red flags, CDD and STR procedures, with regular updates.
  • The AML Single Rulebook (Regulation EU 2024/1624) will harmonise training obligations across the EU from 10 July 2027.
  • Quality of training is a key factor in the 231 defence: a “paper” training programme will not protect the entity from corporate liability.
  • ILA delivers tailored AML training in English and Italian, with sector-specific content for financial institutions, professionals and crypto-asset service providers.

Article 16(3) of D.Lgs. 231/2007 requires obliged entities to ensure permanent training programmes for their personnel, aimed at the correct application of the AML rules. The duty is reinforced by sectoral guidance from Banca d’Italia, IVASS and CONSOB. The EU AML Single Rulebook (Regulation 2024/1624) will make the duty directly applicable across the EU from 10 July 2027.

The rationale is straightforward: AML rules require judgement on the ground. Customer due diligence, identification of beneficial owners, recognition of suspicious patterns, decisions to file STRs — none of these can be automated entirely. They depend on staff applying the policies correctly in real situations. Training is what turns a policy on paper into operational behaviour.

Who must be trained

The duty extends to all relevant staff within the obliged entity:

  • Front-line staff in contact with customers (account opening, KYC, payments, advisory).
  • Back-office staff processing transactions or maintaining customer records.
  • AML officer and compliance team — with deeper, role-specific content.
  • Internal audit — for the testing role.
  • Management — including specific sessions for the board on governance, risk appetite, regulatory interactions.

Outsourced functions (e.g. external CDD providers) are also in scope: the obliged entity remains responsible for ensuring the third party has equivalent training in place.

What the training must cover

The minimum content typically includes:

  • Legal framework: D.Lgs. 231/2007, the EU AML package (Regulation 2024/1624, Regulation 2024/1620, Directive 2024/1640), sectoral guidance, FATF recommendations and country evaluation.
  • Predicate offences: tax offences, fraud, corruption, drug trafficking, organised crime — with operational signs relevant to the entity’s sector.
  • Internal policies and procedures: risk assessment, CDD, EDD, STR, record-keeping, ongoing monitoring.
  • Red flags and typologies: layering through shell companies, trade-based laundering, crypto-related schemes, real estate transactions, cash-intensive businesses.
  • Sectoral risks: politically exposed persons, high-risk third countries, complex cross-border structures.
  • Practical case studies drawn from real enforcement actions and FIU typologies.
  • Reporting routes: how to escalate within the entity and file with the UIF.
  • Tipping-off prohibition: how to handle communications with customers.
  • Sanctions and personal liability: administrative and criminal exposure of individuals.

Frequency and documentation

The applicable rules do not set a mandatory annual frequency, but supervisory practice generally expects:

  • periodic refresher training at least annually for all relevant staff;
  • immediate ad-hoc training when there are significant regulatory developments, internal policy changes or material incidents;
  • onboarding training for new hires before they assume AML-relevant duties;
  • deeper sessions for the AML officer and compliance team.

Documentation is essential. The entity must keep records of:

  • training content delivered;
  • attendance, with names and roles;
  • assessment results (where applicable);
  • updates to the programme over time.

In a regulatory inspection or criminal proceeding, this documentation is the proof that the duty has been fulfilled.

AMLA expectations and the new EU framework

The EU AML Authority (AMLA), based in Frankfurt and operational since 2025, will directly supervise selected high-risk cross-border entities from 2028 and is expected to issue technical standards and guidelines relevant to internal policies, including training. Even for entities not directly supervised by AMLA, the standards will set the benchmark against which national supervisors assess training programmes.

The direction of travel is clear: more structured programmes, role-specific content, more rigorous documentation, demonstrable understanding by recipients (not mere attendance).

Why a “paper” programme fails

In the context of corporate criminal liability under D.Lgs. 231/2001 (Article 25-octies for money laundering), the entity is liable for offences committed in its interest unless it has adopted and effectively implemented an organisational, management and control model (modello 231). The model must include adequate AML training. A programme that exists only on paper — slides circulated by email, no assessment, no documented attendance — will not function as a defence.

Prosecutors and judges have repeatedly assessed the effectiveness of training as one of the indicators of the model’s adequacy. Effective training means: structured content, clear timeline, attendance documented, refresher schedule respected, content tailored to roles and risks.

FAQ

Is AML training mandatory for all obliged entities in Italy? Yes. Article 16(3) of D.Lgs. 231/2007 requires permanent training programmes for relevant staff.

How often must AML training be delivered? The law sets no fixed frequency; in practice, at least annual refreshers, with ad-hoc training on regulatory or internal changes and onboarding for new hires. Higher frequency is expected for higher-risk roles.

Who must attend? All staff involved in AML-relevant activities: front office, back office, AML officer, internal audit, management.

Does outsourced CDD remove the training duty? No. The obliged entity remains responsible for the conduct of AML activities and must ensure third parties have equivalent training in place.

Is AML training a defence under D.Lgs. 231/2001? A robust, effective and documented programme is part of the modello 231 defence. A paper-only programme is not.

When to contact the firm

If your entity is reviewing its AML programme, facing a regulatory inspection, or designing training for new sectors (crypto, gaming, payment services), contact the firm. We design and review programmes that work both in operations and in the 231 defence.

Request a confidential consultation — response within 24 hours.