If you're the person whose name is on the AML program, you already know the quiet weight of the role. The regulation doesn't just ask your institution to have controls. It asks you, specifically, to be the accountable person for whether those controls work. When an examiner arrives, the question lands on your desk, not the org chart's.
Here's the part that keeps people up at night, though few say it out loud: you are accountable for the competency of your people, and you cannot actually measure it.
You can measure whether they completed the training. You can pull attendance for the annual AML refresher, the new-hire onboarding, the module you rolled out when the procedure changed. Every one of those will show a reassuring number. What none of them tells you is whether the analyst on your team can actually recognize a structuring pattern when it's sitting in front of them, dressed up to look ordinary. That is the thing you're accountable for. It's also the thing your records don't capture.
Completion is not the same as capable
AML work is judgment work. That's what makes it hard and that's what makes the training gap dangerous.
A completion record tells you someone sat through a session on suspicious activity. It does not tell you they can tell a false positive from a real one, or that they'll escalate the transaction that doesn't fit rather than clear it to hit their queue target, or that they understand why a self-hosted wallet transfer changes the picture. Those are judgment calls made under time pressure, with incomplete information, in situations the training never exactly described. Passing a multiple-choice quiz about red flags and spotting a red flag in the wild are different skills, and only one of them shows up in your reporting.
The regulation knows this. Examinations increasingly probe not whether training happened but whether the compliance function is genuinely effective, whether your people can apply what they were taught. "We trained everyone" is becoming the weakest sentence in the room, because everyone in the room knows training and competency are not the same word.
The gap you can't see is the gap you're accountable for
There's a particular discomfort in being responsible for something you can't observe. You've done everything the program requires. The training was delivered, on schedule, to the right people, with records to prove it. And still, if you're honest, you couldn't tell an examiner with confidence which of your analysts would catch the hard case and which would miss it. You're vouching for a competency you're taking on faith.
That gap doesn't announce itself. It stays invisible right up until a missed suspicious activity report, an examination finding on program effectiveness, or an enforcement action that traces back to a judgment your team was supposed to be equipped to make. At that moment the completion records, the thing that felt like protection, become the evidence of how little you actually knew.
And it compounds. Knowledge decays. The analyst who understood the escalation logic in January may not hold it in September, and nothing about an annual completion cycle would surface that drift. You're not just unable to measure competency at a point in time. You're unable to see it erode.
What would actually let you sleep
The thing that would change the picture isn't more training. Your people probably get enough training. It's the ability to know, per person, whether they actually hold the judgment the role requires, and to see it when that knowledge slips, before it matters rather than after.
That is a different measurement than completion. It's harder to produce, because judgment is harder to assess than attendance. But it's the measurement that matches your actual accountability. If you're the one answerable for whether your people can do the work, the report worth having is the one that tells you whether they can, not the one that tells you they showed up.
The completion number will always be easy to pull, and it will always look fine. The question is whether "fine" is a word you'd want to stake your name on. You already are.
This piece discusses regulatory accountability in general terms and is not legal or compliance advice. Specific obligations depend on your institution, jurisdiction, and regulator.
