AML Training for Non-Specialist Teams: What the Front Line Needs to Know

AML training usually reaches the specialists and misses the people who actually meet the customer. The compliance officer knows the risk-based approach. The estate agent, the accountant, the car dealership sales manager and the corporate services administrator are the ones who see the transaction, and they frequently received a slide deck three years ago.

That gap is where most anti-money laundering failures happen. This guide is about closing it: who counts as an obliged entity in Finland and Sweden, what AML and KYC training for non-specialist employees should actually contain, how suspicions are reported, and what the EU AML package changes for the training you deliver.

Who is an obliged entity, including the ones who do not know

The first problem is scope. A meaningful proportion of businesses caught by AML rules do not think of themselves as being in financial services at all.

Beyond banks, payment institutions, insurers and investment firms, national money laundering legislation in both Finland and Sweden reaches a long list of other businesses:

Professional services. Accountants and auditors, tax advisers, and lawyers in respect of certain activities.

Property. Real estate agents, including rental brokerage.

Corporate and trust services. Trust and company service providers.

Trade. Dealers in goods above cash thresholds, and art dealers and intermediaries.

Gambling and crypto. Gambling operators and virtual asset service providers.

If any of that describes your business, you have obligations that include customer due diligence, monitoring, reporting suspicions, keeping records and, explicitly, training your staff. The training obligation is not implied. The Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017) and the Swedish Money Laundering Act (2017:630) both require obliged entities to ensure employees receive training appropriate to their role. In other words, AML training is a legal requirement, not a nice-to-have.

Supervision is fragmented in both countries. In Finland, Finanssivalvonta supervises the financial sector, with separate supervisors for many non-financial obliged entities, for gambling, and the Bar Association for advocates. Sweden has Finansinspektionen for the financial sector, county administrative boards for several non-financial categories, and separate arrangements for lawyers. Confirm which supervisor applies to you before assuming, because businesses regularly report to the wrong one.

What AML training for employees must cover

Not the risk-based approach. Not the three stages of money laundering, which is interesting and changes nothing about what an employee does on Tuesday. Effective AML training for front-line staff comes down to five things.

Who our customer is, and how we establish that. Identification and verification as a workflow they follow, not a theory. This is the KYC part of AML and KYC training.

What is unusual for our business. This is the highest-value content and it must be specific to the organisation. An unusual transaction at a car dealership looks nothing like an unusual transaction at an accountancy practice. Generic red flag lists fail precisely because they are generic.

What to do when something is unusual. Who to tell, how fast, and what happens next. The answer is never that the employee decides whether it is money laundering.

The tipping-off prohibition. Employees must not tell the customer, or anyone else outside the reporting chain, that a report has been made or is being considered. Non-specialists breach this constantly and in good faith, usually by trying to be helpful about a delay.

That reporting a suspicion is not an accusation. The threshold is suspicion, not proof or even balance of probabilities. Front-line staff routinely fail to report because they cannot substantiate what they noticed, which is not the test.

The test is suspicion, not proof. An employee who waits until they can substantiate what they noticed has already waited too long, and an employee who tells the customer a report is coming has committed the most common good-faith breach in AML.

The reporting routes

Employees do not report to the authority. They report internally to the nominated person, who assesses and files if required. Training should make the internal route unmistakable, and should include what happens when the nominated person is unavailable.

The external destination differs by country. In Finland, suspicious transaction reports go to the Financial Intelligence Unit within the National Bureau of Investigation (rahanpesun selvittelykeskus). In Sweden, they go to Finanspolisen within the Police Authority.

The instruction to the customer-facing employee is the same in both countries: recognise, do not investigate, do not tell the customer, escalate internally the same day.

What changes with the EU AML package

This is the part that gives AML training a reason to be reviewed now rather than in two years.

The EU adopted a package that replaces much of the current directive-based patchwork with a directly applicable regulation, Regulation (EU) 2024/1624, alongside a new directive and a new EU-level supervisory authority, AMLA, based in Frankfurt and established by Regulation (EU) 2024/1620. The regulation harmonises customer due diligence, beneficial ownership and reporting requirements across member states rather than leaving them to national transposition, which is the most consequential structural change in EU AML since the framework began.

The AML Regulation applies from 10 July 2027, the transposition deadline for the new directive also falls in 2027, and AMLA’s direct supervision of selected entities is planned to begin during 2028.

Two practical implications for a Nordic obliged entity. First, national divergence between Finland and Sweden should narrow, which is genuinely helpful for groups operating in both. Second, requirements that were previously matters of national interpretation become directly applicable text, so training content built on national guidance will need review.

The Nordic context

Two features are worth stating because they shape risk perception locally.

Nordic banks were central to the enforcement wave that reshaped European AML supervision, following the cases involving Baltic operations in the last decade. Every Nordic compliance professional knows those cases, and referencing them is a more effective framing device than any international example.

Cash use in Finland, Sweden, Norway and Denmark is among the lowest in the world. That makes cash a stronger anomaly signal here than almost anywhere, and it is a genuinely useful training point: a customer who wants to use cash in a market where practically nobody does has done something that requires explanation, even at amounts that would be unremarkable elsewhere.

Training frequency and evidence

National legislation requires training appropriate to the role and does not usually set a fixed interval, but supervisors expect it to be regular and current. In practice an annual cycle with role-differentiated depth is the baseline expectation in the sector, with additional training when the business changes, when a new product or customer segment is introduced, or when guidance is updated.

Keep the record. Supervisors ask for training records early in an inspection, and they ask for content, not just completion. Evidence that a specific employee received specific content on a specific date, with the version retained, is what satisfies them.

Building the AML compliance training programme

Split it into three layers.

Everyone customer-facing. A short, mandatory, business-specific module, refreshed annually, built around your own transactions and your own red flags.

The nominated person and internal assessors. A deeper module for the nominated person and anyone assessing internal reports.

Senior management. A separate briefing on their responsibilities and on the supervisor relationship.

Then test whether it worked in the only way that matters, which is whether internal reports are being raised at all. An obliged entity with front-line staff and no internal reports over a year does not have clean customers. It has staff who are not recognising or not raising.

Frequently asked questions