AML Onboarding: Role-Based Induction for New Bank Employees

A new bank employee passes the anti-money-laundering course and starts advising customers alone the next morning. In the exercise, she could identify the beneficial owner. In the actual system, documents are missing, her usual contact is unavailable and the customer wants an immediate decision. Onboarding must close precisely this gap: between knowledge, supervised application and explicitly limited permission to work independently. A course certificate alone does not adequately describe those three different states of readiness.

This guide concerns German credit institutions and describes an organisational induction process, not a separate legal standard. Its working example is a regional bank recruiting three employees for customer advice, payment operations and quality assurance. Everyone receives a shared foundation, followed by different exercises and permissions. Adapt the sequence to the institution's risk analysis, internal procedures and actual responsibilities. References to the first working week or an initial review meeting are local planning choices, not statutory deadlines asserted here. Name the responsible owner and deputy before induction begins.

1. Separate the legal foundation from local implementation

Section 6(2), point 6 of the German GwG specifies initial and ongoing employee instruction about typologies, current methods and relevant requirements, including data protection. Subsection 1 also requires appropriate internal safeguards, monitoring of their effectiveness and updates when necessary. For induction planning, this means matching the institution's actual risk situation and continuing beyond the initial course. This provision does not itself prescribe a universal course format or an identical annual number of training hours for every employee. Local implementation must therefore be more thoughtful than a standard calendar reminder.

The AML function defines learning objectives and critical errors; the line manager translates these into activities and supervised steps. HR organises assignments, available learning time and follow-up, but does not replace professional sign-off. For mandatory training without spreadsheet chaos, connect each person with a role, learning component and accountable owner. A separate practical-induction status prevents an automatically completed course from being mistaken for permission to handle customers independently. Technical access rights require another explicit check: passing a learning module must not silently grant broader access to live customer systems.

2. Build an activity matrix before the start date

Describe each target role through observable actions rather than department names alone. Advisers may collect information and recognise missing evidence; payment staff handle assigned items within defined authority; quality assurance checks documented processing steps. For every activity, the matrix records the required knowledge, who demonstrates it, the conditions for practice and the person authorised to sign it off. Add a clear stopping point: which uncertainty requires escalation, and which decision explicitly belongs to another function? This makes the matrix useful during work rather than merely descriptive on paper.

The shared foundation should explain customer due diligence under section 10 GwG as a connected process: identification, beneficial ownership, the purpose of the relationship, risk-based checks concerning politically exposed persons and ongoing monitoring. New employees do not have to decide every specialist situation themselves, but must understand their own task and its limits. Exercises should distinguish missing information, a documented inconsistency and an issue already evaluated by an authorised specialist. The answer comes from the institution's approved checks and responsible decision-maker, not from guessing what a customer probably intended.

3. Prepare secure access and protected practice data

Before the first exercise, the manager and responsible administrator check that the training environment, personal accounts and approved procedures are available. An introduction to passwords, MFA and passkeys supports this step without replacing the bank's access-control rules. Nobody should borrow a supervisor's credentials to work around missing permission. If a technical prerequisite is unavailable, postpone and record the affected practical activity. A scheduled start date is not a reason to suspend controls temporarily, and the person responsible for resolving the access problem should be named.

Begin with entirely synthetic customer profiles and coherent sample documents. Integrated GDPR training for employees explains which information belongs in learning systems, notes or internal messages and which does not. Actual cases enter only through an approved working process with the necessary permissions and safeguards. Even an apparently harmless screenshot can expose customer information. A fictional case number is sufficient for the exercise; the training record does not need a real customer's identity document or complete transaction history. Demonstrate this separation explicitly instead of assuming that confidentiality is self-explanatory.

4. Move from demonstration to supervised handling

During the first demonstration, the supervisor walks through a complete sample case and explains decisions aloud: which fact is checked, where the evidence is stored and why a piece of information is insufficient. The new employee then handles a comparable case, explaining each transition herself. The supervisor does not silently correct mistakes in the background; deviations are discussed explicitly. A further case with modest variations tests whether the employee understood the process or merely remembered the click sequence from the original example. Observation should focus on reasoning as well as system use.

A useful exercise concerns a fictional corporate customer whose submitted documents contain inconsistent information about its control structure. The new employee identifies the precise inconsistency, records the processing status and uses the prescribed clarification route. She does not invent a beneficial owner to populate a mandatory field. The supervisor also checks whether she recognises when independent processing must stop. If the due diligence requirements specified in section 10(9) GwG cannot be fulfilled, legal restrictions apply; the practical consequences must be reflected in the institution's approved operating procedure.

AI-generated

5. Practise escalation under time pressure

A second case changes the working conditions rather than the technical question: the usual contact is away, a customer is waiting and a colleague suggests a quick exception. The new starter must find the deputy route and provide a concise handover. Practice in suspicious-activity escalation develops this transition without turning induction into another general guide to suspicious cases. Assess whether facts, unresolved points and completed steps remain distinguishable. Unsupported judgements about a person or their background do not belong in a factual handover, even when the team feels under pressure.

The reporting duty under section 43 GwG applies to the obliged entity when the specified facts exist and requires reporting to the FIU without undue delay. An internal induction or approval process must not delay that statutory process. Employees therefore learn the escalation route that is actually available and the organisational responsibility, rather than just a name on a slide. Simulate the first contact being unavailable too. The exercise ends only once the matter has reached a responsible function and ownership of the next steps has been clearly accepted.

6. Define customer communication and adjacent topics

The prohibition on disclosure under section 47 GwG deserves its own conversation exercise. New employees must not casually reveal an intended or submitted suspicious-activity report to customers or other third parties; statutory exceptions are not a matter of personal discretion during a customer conversation. Practise neutral, internally approved wording about processing status without inventing an explanation. Bring in the responsible person when uncertainty remains. The important outcome is that customer pressure leads neither to prohibited disclosure nor to a premature promise about what will happen next.

An irregularity is not necessarily only an AML matter. A changed beneficiary may also require practice in financial-sector fraud prevention; a sales decision may involve conflicts of interest in investment advice. Mark the relevant review routes and their interfaces in the role plan. Assign additional topics according to actual responsibilities instead of distributing everything indiscriminately. The new employee should recognise that a completed fraud check does not automatically replace an AML assessment, and that several responsible functions may be involved in parallel without making their respective responsibilities interchangeable.

7. Decide sign-off using observable criteria

Before assessment, define a small set of concrete criteria: the person locates the current procedure, recognises a decision-relevant gap, records facts clearly, reaches the designated contact and stays within their authority. A strong quiz score can support this observation but cannot replace it. Assess critical errors separately rather than offsetting them against correct knowledge answers. Someone who improperly discloses sensitive information in a case exercise needs targeted follow-up and another observation, even with a high overall course score. The resulting decision should remain reasoned and traceable.

Sign-off explicitly states its scope: for example, independent processing of defined standard cases while specified exceptions remain supervised. Assign an owner and an agreed review date to unresolved learning points. A role change, revised procedure or new risk prompts a check for additional instruction. A blanket statement such as fully trained is of little use here. Combine the approved activity with the procedure version and any continuing restriction. A substitute manager can then understand which tasks may safely be assigned to the new employee without reconstructing the entire induction history.

AI-generated

8. Maintain evidence and improve the process

For traceable training records, connect the person, role, learning objectives, content version, date, supervising and approving functions, and outcome. Keep practical observation distinguishable from course completion. The participant record documents the learning decision, not the entire customer case; access and retention follow the applicable institutional policy. Sample checks should establish whether the relevant exercise actually supports the sign-off. Without those connections, a large export is not persuasive evidence that someone can perform their specific task and understands the boundaries attached to it.

Allocate actual capacity for supervision. An experienced colleague expected to answer every question immediately while carrying a full caseload becomes a bottleneck. Agree protected practice time, available deputies and a manageable scope for initial tasks. Absence or part-time working should lead to an adapted sequence, not silently omitted content. Handle a delayed practical sign-off transparently; do not conceal it through backdating or a tick in the HR system. Record what remains unfinished so that scheduling decisions reflect the real state of readiness.

At the first review, the manager and AML function compare recurring questions, common documentation errors and the availability of designated contacts. Ask new employees which instruction was difficult to understand at the moment of use. Repeated uncertainty may indicate an unclear process rather than missing knowledge alone. Revise the affected example or handover step, and inform already inducted colleagues if their procedure changes. This connects ongoing instruction with actual operational experience and helps avoid repeatedly training people around the same unresolved process weakness.

The ConformBase finance-sector package can support shared foundations, role-based assignment and digital completion records. The current offer covers AML prevention, securities compliance and fraud prevention as an addition to a suite. Institution-specific instruction, supervised handling and decisions about authority remain separate responsibilities of the bank. Start with a small group, then examine where handovers generate questions. Improve those transitions before scheduling additional learning hours. Reliable onboarding makes the next safe working step clear instead of merely lengthening the list of completed courses, and it provides a usable basis for ongoing instruction.