Financial Crime Training and Competence

1. Purpose and scope

The group operates across 28 jurisdictions with different definitions, thresholds and reporting routes. A single global curriculum would teach the wrong thing in most of them. The curriculum therefore has a common core and a jurisdiction module that reflects local obligations.

Scope covers permanent staff, fixed-term staff, secondees, contractors holding system access and the directors of every group entity. Contractors without access to client data complete the core module alone and are recorded separately in the completion report.

Completion is a condition of continued system access. Training is not a development activity in this policy and it is not optional for senior staff. The same standard and the same deadline apply to the Executive Committee as to a first-year analyst.

2. Definitions

Competence means the ability to recognise a financial crime indicator in the work a person actually does, and to act on it correctly and quickly. It is assessed by scenario rather than by recall of definitions, because recall does not predict behaviour on a live file.

A high-risk role is one carrying authority to accept a client, release a payment, approve an exception or configure a screening control. The group recorded 54 high-risk roles across the six divisions at 30 June 2026, held by people in 21 offices.

The core curriculum is the set of modules every person completes. The advanced curriculum is the additional training for high-risk roles. The jurisdiction module is the local overlay for the office where a person is based and is rewritten when a local obligation changes.

3. Principles

Training is specific to the desk. A private-wealth adviser in Nassau and a quantitative developer in Singapore meet different indicators, and the material reflects that difference rather than presenting one generic case to both. Generic material teaches people to click through rather than to look.

Assessment is real. The pass mark is 80 per cent and the question bank rotates each year. A person who fails twice is retrained in person by a member of the financial crime team rather than by repeating the same module a third time.

Learning is refreshed by events. When a control failure occurs anywhere in the group, an anonymised case is added to the curriculum within 90 days, and the case names the control that failed rather than the person who was operating it.

4. The curriculum

The core curriculum runs to 8 modules and takes about 5 hours in total. It is delivered online, in English, with translated notes for the offices that need them. Each module ends with a scenario drawn from the sectors in which the group originates.

The advanced curriculum adds 4 hours a year for high-risk roles, delivered live in groups of no more than 12. It works through group cases: an ownership chain that could not be traced, a payment held for eight days, a hospitality entry recorded three weeks late.

The jurisdiction module covers local reporting obligations, the identity of the local reporting officer and the local record-keeping period. It is written before an office opens in a new jurisdiction and is a condition of that office accepting its first client.

• Module one: money laundering indicators in life-science origination.
• Module two: client due diligence and beneficial ownership.
• Module three: sanctions screening and match resolution.
• Module four: bribery, corruption and hospitality.
• Module five: fraud and payment controls.
• Module six: the facilitation of tax evasion.
• Module seven: internal reporting routes and confidentiality.
• Module eight: record keeping and retention.

5. Completion requirements and assessment

Requirement 5.1. New joiners complete the core curriculum within 30 days of starting and before receiving authority to accept a client or release a payment. Directors complete it within 60 days of appointment and repeat it on the same cycle as staff.

Requirement 5.2. Every person repeats the core curriculum annually and completes it by 31 October. High-risk roles complete the advanced curriculum in the same window. Group completion reached 100 per cent for the 2025 cycle, with 9 people finishing after the deadline.

Requirement 5.3. Non-completion is escalated to the line manager after 14 days, to the division head after 30 days and to the Executive Committee after 45 days. System access is withdrawn at 60 days and restored only on completion.

6. Roles and responsibilities

The Group Head of Learning and Competence owns the curriculum and the completion record. The Group Head of Financial Crime approves the content of every module and every case study. Line managers are accountable for completion within their teams and are reported on by name.

The Compliance & Conduct Committee approves the annual curriculum plan before the cycle opens. The Remuneration Committee is informed of any non-completion at year end, and non-completion is taken into account in the annual performance review.

7. Monitoring, breaches and review

Completion is reported monthly by office, division and role type. Assessment scores are reported in bands so that weak topics can be identified without exposing individuals. Repeated weakness in one topic triggers a rewrite of that module before the next cycle.

Delivering training without approved content, or recording a completion that did not happen, is a breach of this policy and of the Code of Conduct. Training records, assessment results and attendance registers are retained for 7 years.

This policy is reviewed annually. Version 4.2 took effect on 13 January 2026, raised the pass mark from 70 per cent to 80 per cent and added jurisdiction modules for the two Caribbean representative desks opened in 2024 and 2025.