Why most AML training fails the audit — and what to fix

Auditors don't care that 96% of staff "completed" your AML course. They care whether you can prove who watched the bribery scenario, what they answered, and when. Most courses can't.

The four-line tracking spec we never compromise on

Every AML course we ship is wired against the same four xAPI verbs — experienced, answered, passed, completed — plus per-question result objects. SCORM 1.2 fallback uses cmi.suspend_data for the granular journey and cmi.success_status for the headline.

Where most builds go wrong

The single biggest failure mode is firing completed on the last slide instead of after the assessment passes. Auditors spot it immediately: people skip-to-end and the course logs them as fully trained. Fix it by gating completion on score, not slide index.

The audit pack we hand over

• Traceability matrix — every learning objective mapped to a regulation clause (FATF rec 10, 11, 17 etc).
• Test script — every interaction has a pass/fail acceptance check signed off by the SME.
• Version log — signed snapshots so auditors can prove what was live on a given date.
• Completion certificate template — PDF with employee, date, score, course version.

Real numbers

A European banking client failed an FCA spot-check on 2024's training. We rebuilt it with the spec above. Next year's audit took two hours instead of two weeks, and zero findings on the eLearning track.