Why Compliance Training Still Fails

The Cost of a Check-the-Box Culture

📅 May 15, 2025

In late 2024, headlines lit up with news of a $3 billion fine slapped on one of North America’s largest banks. The cause? Years of anti-money laundering failures that let illicit funds slip through the cracks. What made it even more alarming was this: employees had technically done everything right—on paper, as they must have completed the mandatory compliance training. The boxes were checked, the certificates filed. But clearly, something critical was missing.

Unfortunately, this story is all too familiar. Many institutions have robust training programs in place—at least in theory. Staff watch the videos, take the quizzes, and click “complete.” But when compliance becomes just another task to get through, the real goal—changing behavior and actually reducing risk—gets lost in the shuffle.

The truth is, traditional compliance training often focuses more on proving that training happened than on making sure it works. And that “check-the-box” mentality leaves organizations vulnerable—to costly mistakes, regulatory enforcement actions, and reputational damage.

U.S. Department of Justice Press Release (October 11, 2024)

“For nearly a decade, TD Bank failed to update its anti-money laundering compliance program to address known risks. As bank employees acknowledged in internal communications, these failures made the bank an ‘easy target’ for the bad guys.”

⚠️ Regulators aren’t satisfied with training that exists on paper. They want to see programs that shape behavior, reduce risk, and evolve with emerging threats.

In this article, we’re digging into why compliance training still fails, even in well-intentioned institutions. We’ll look at what’s broken, what it’s costing us, and how a smarter, more strategic approach can turn training into a true line of defense—rather than a missed opportunity.

The Check-the-Box Mentality: What It Looks Like

So what exactly is a “check-the-box” approach to compliance training?

At its core, it’s when the primary goal of training shifts from learning to simply proving that training occurred. It’s the kind of training program where success is measured by completion rates and attendance logs—not by how well employees understand the material, let alone how they apply it in their day-to-day roles.

You’ve probably seen the signs:

Time spent over takeaways: Training is treated as a time requirement. As long as the employee spends 30 minutes on the module, they’re good to go—even if they skimmed through and retained very little.
Same old content: Year after year, the same outdated slides resurface, with little attention paid to evolving risks, real case studies, or recent enforcement actions.
One-size-fits-all modules: Whether you’re in the first line, second line, or third line of defense (see our Three Lines of Defense and Three Lines of Defense: Case Study articles to learn more about the lines of defense), you get the same generic training—even if the risks you face are very different.
Low engagement or contextual application: There’s little to no interaction, no contextual relevance, and no follow-up. It’s passive learning at best—and passive learning rarely sticks.

So why does this happen?

In many cases, it comes down to pressure—pressure to show auditors and regulators that training has been completed; pressure to roll out training at scale with limited resources; and pressure to do it quickly. Without strong internal champions pushing for strategic learning, the easiest route becomes the default: launch the same cookie-cutter content to everyone, check the completion box, and call it a day.

But that approach misses the point. In today’s dynamic risk environment—where threats evolve quickly and regulators are increasingly scrutinizing the quality of compliance programs—a box-ticking culture won’t cut it. If training doesn’t resonate, risks don’t get flagged. And when risks go unnoticed, institutions pay the price.

Previous Next

1 2 3 4 5 6

Why Traditional Training Misses the Mark

Let’s be honest—most people don’t walk away from a compliance training session feeling inspired or better equipped to manage risk. And it’s not because they don’t care. It’s because the training isn’t always built to help them succeed in the real world.

Here’s why so many traditional training programs fall flat:

It Doesn’t Feel Relevant

If you’ve ever sat through a training and thought, “This has nothing to do with my job,” you’re not alone. A major issue with many compliance programs is that they treat everyone the same. Whether you’re a customer service rep in a retail branch or managing cross-border payments in a trade finance unit, you might get the exact same content—when in reality, the risks you face and the decisions you make are completely different. Without real-world examples that match the challenges staff encounter, the training just doesn’t stick.

It’s Easy to Forget

Even when the information is useful, the way it’s delivered often gets in the way. Think long, text-heavy modules, monotone voiceovers, or walls of legal definitions. People zone out. They click through. And a week later, they’ve forgotten most of it. That’s not a learner problem—that’s a design problem. Without repetition, real-life scenarios, or interactive moments to break things up, retention is minimal.

No One Knows If It’s Working

For many institutions, success is measured by how many people completed the training. But checking a box doesn’t mean someone actually learned anything—or that they’ll apply it when it counts. There’s rarely follow-up to see if people can recognize a suspicious transaction six months later, or if that new sanctions update changed how teams operate. Without measuring comprehension or behavior change, it’s impossible to know whether the training is actually reducing risk.

It Doesn’t Evolve with Risk

Risk changes fast—especially in the financial sector. But training often lags behind. Institutions roll out annual modules that don’t reflect current threats, emerging technologies, or regulatory focus areas. For example, while regulators are turning their attention to digital asset risks and AI-driven fraud, many programs are still running the same fraud or AML training from years ago. When training doesn’t reflect what’s actually happening in the risk environment, it becomes performative—just another thing to get through before moving on to “real” work.

The Real-World Costs of Ineffective Training

When compliance training is treated as a formality, the consequences aren’t just theoretical—they’re very real, and very costly.

Repeat Offenses

It’s one thing for an employee to complete a training module. It’s another for them to apply what they’ve learned when it matters. We’ve seen time and again how staff who’ve technically fulfilled all their training obligations still fail to follow basic procedures—allowing high-risk transactions to go unreported, missing red flags in KYC files, or failing to escalate suspicious activity. The problem isn’t that they didn’t take the training—it’s that the training didn’t stick.

Regulatory Fines and Investigations

Regulators aren’t just checking whether training happened. Increasingly, they’re asking how effective it was. In several recent enforcement actions—such as the $3 billion penalty against TD Bank in 2024 and earlier actions against institutions like HSBC and Standard Chartered—deficiencies in staff training were explicitly cited. The message is clear: if your program is superficial or out of sync with current risks, it can be used against you in an investigation.

Cultural Consequences

Poorly designed training doesn’t just fail to educate—it erodes trust. Employees come to view compliance as a box-ticking exercise, not a real business risk. This leads to training fatigue, eye-rolling during mandatory modules, and a general sense of disengagement. And when compliance doesn’t feel meaningful internally, it’s far less likely to be taken seriously in practice.

Reputational Damage

Once your institution’s name is tied to a major compliance failure, everything changes. Regulators look more closely at your entire program. Clients—especially institutional ones—may begin to question your internal controls. Media scrutiny adds fuel to the fire. And even after the fine is paid, that reputational hit lingers, complicating relationships with investors, partners, and stakeholders.

Previous Next

1 2 3 4 5 6

A Problem with a Solution

The truth is, compliance training that merely checks the box isn’t just ineffective—it’s risky. It creates blind spots, undermines your culture, and leaves your institution exposed to exactly the types of failures training is meant to prevent.

As the regulatory space evolves and risks become more complex, it’s not enough to say training happened. Financial institutions need programs that actually work—ones that engage, educate, and empower employees to recognize and respond to real-world threats.

In our upcoming article, Rethinking Compliance Training — Smarter Strategies for Real Institutional Impact, we’ll explore what that kind of training looks like. From smarter design principles to risk-based tailoring and meaningful measurement, we’ll show how financial institutions can shift from box-ticking to behavior-changing—and why it’s not just a compliance win, but a business advantage.

E-Learning Courses

Explore our suite of compliance e-learning courses covering an array of financial crime compliance topics. All courses are designed to maximize retention of relevant knowledge and are available for customization.

Explore Courses

Video Library

An on-demand video library designed for today’s risk environment, this expert-led training program make complex topics clear, practical, and engaging—ideal for onboarding, upskilling, or refreshing core compliance knowledge across your teams.

Explore Videos

Recommended Blogs

Dirty Barrels

September 24, 2026

While oil and gas is one of the world's most valuable and strategically important industries, it is vulnerable to corruption. Explore how corruption risks can arise throughout the lifecycle of an oil and gas transaction.

Synthetic Identities

January 8, 2026

Fraud generates billions in proceeds every year, and the use of AI significantly increases the speed, scale, and likelihood of success. Synthetic identities are already leveraged to open accounts used to commit fraud and launder money. Explore red flags and actions financial institutions must take to detect and respond to AI-enabled synthetic identities.

Deepfake Deep Dive

August 27, 2025

Artificial intelligence (AI) can increase the volume, value, and effectiveness of fraud attacks such as CEO fraud. Financial institutions should take action to protect themselves – and their customers.

The Network, Not the Node

June 5, 2025

Data analytics and advanced technologies are critical tools to take effective action against increasingly complex criminal networks. In this article we consider the best practices a financial institution could apply when implementing data analytics strategies and solutions, and what the future holds.

AI vs. Human Judgment

April 9, 2025

AI is helping financial institutions stay on top of their game while making processes faster and more efficient. But with recent advancements, one question keeps coming up: Will AI replace compliance professionals? In this article, we explore where AI excels versus human judgment.

The Heat is On

February 24, 2025

Explore the key insights and implications from Transparency International’s 2024 Corruption Perceptions Index.

The Green Gold Rush

January 13, 2025

Explore the corruption risks in the green transition mining and minerals sector, a rapidly growing industry fraught with challenges that expose businesses to bribery, fraud, and reputational damage. Discover strategies to protect your operations and ensure compliance in the race for sustainable energy solutions.

Toward a Financial Integrity Risk Management Program

December 19, 2024

This article explores the commonalities between AML, sanctions compliance, ABC, fraud risk management, and export control compliance programs and recommends that organizations consider using a holistic financial integrity risk management and compliance framework.

Safeguarding Trust – How to Balance Innovation and Security in Gen AI-Powered Compliance

December 12, 2024

This article explores how privacy-first architecture, robust guardrails, and source transparency can build trust while ensuring responsible AI deployment in compliance solutions.

Previous Next