When FATF assessors arrive for a mutual evaluation, they do not simply review policies and procedures. They interview board members. They ask what training you have received on money laundering, terrorist financing and sanctions. They request evidence that the training occurred, that it was appropriate to your role, and that your institution can demonstrate completion.
The FATF board training requirements exist because the Financial Action Task Force recognizes that governance begins with informed oversight. A board that does not understand typologies, red flags and regulatory expectations cannot effectively challenge management, approve risk appetite or allocate resources to financial-crime prevention. Assessors therefore examine whether your institution's training program reaches the board, whether the content is tailored to governance responsibilities, and whether records exist to prove both.
For board members and audit committee chairs at Saudi banks, money-service businesses and investment firms, the weeks before a mutual evaluation are not the time to discover gaps. This article presents three questions every director should ask now to confirm that your institution's financial-crime training program meets the standards assessors will verify.
Question One: Does the Board Receive Training Distinct from Management and Staff?
FATF Recommendation 1 requires that countries ensure financial institutions understand their anti-money laundering and counter-terrorist financing obligations. The Saudi Arabian Monetary Authority translates this into supervisory expectations that boards receive training appropriate to their governance role, not generic content designed for front-line staff.
Assessors look for evidence that your institution distinguishes between audiences. A board member does not need to know how to complete a suspicious-transaction report, but must understand the institution's risk appetite for customer segments, the adequacy of the compliance budget, and the red flags that should prompt escalation from management. Training that conflates these audiences signals weak governance.
What Assessors Verify
During interviews, assessors ask board members to describe the training they have received. They listen for specifics: the topics covered, the format, the frequency. Vague answers raise concerns. Detailed answers—mentioning case studies relevant to the institution's risk profile, discussion of emerging typologies, or scenarios involving board-level decisions—demonstrate that training occurred and that it was designed for directors.
Assessors also request documentation. They want to see agendas, attendance records and materials that show the board session was distinct from staff training. If your institution cannot produce these records, or if the records show that board members attended the same session as branch staff, the assessor notes a deficiency.
What to Ask
Ask your chief compliance officer or head of financial crime to show you the most recent board training materials. Compare them with the materials provided to front-line staff. If the content is identical, or if the board has not received dedicated training in the past twelve months, you have identified a gap that must be closed before the evaluation.
Question Two: Is the Training Tailored to Our Institution's Risk Profile?
Generic training—content that could apply to any financial institution in any jurisdiction—does not satisfy FATF standards. Assessors expect training to reflect your institution's specific risks: the customer segments you serve, the geographies you operate in, the products you offer, and the vulnerabilities identified in your most recent risk assessment.
SAMA's AML and CTF rules require institutions to conduct enterprise-wide risk assessments and to ensure that all staff, including senior management and the board, understand the results. Training is the mechanism by which this understanding is built. If your board training does not reference your institution's risk assessment, it is not compliant.
What Assessors Verify
Assessors compare training content with the institution's business model and risk assessment. They ask whether the board has been briefed on the specific risks the institution faces. For example, if your institution serves a significant number of non-profit organizations, has the board received training on terrorist-financing risks in that sector? If you operate cross-border payment services, has the board been trained on sanctions-evasion techniques and correspondent-banking vulnerabilities?
They also examine whether training content includes local and regional case studies. Training that relies exclusively on international examples, without reference to risks observed in the Kingdom or the Gulf region, suggests the program was purchased off the shelf rather than tailored.
What to Ask
Ask to see the agenda and materials from the most recent board training session. Identify whether the content references your institution's risk assessment, your customer base, and your product mix. If the training could have been delivered to any institution without modification, it is insufficient. Request that future sessions include case studies and scenarios drawn from your institution's actual risk profile and the typologies observed by SAMA and FATF in the region.
Question Three: Can We Produce Completion Evidence for Every Board Member?
FATF assessors do not accept assurances. They require evidence. For training, this means attendance records, assessment results, and certificates that prove each board member completed the program and demonstrated understanding.
The absence of records is a serious finding. It suggests either that training did not occur or that the institution does not take compliance seriously enough to document it. Either conclusion harms the institution's evaluation.
What Assessors Verify
Assessors request a list of all current board members and ask to see training records for each. They check dates to confirm that training is current—typically within the past twelve months. They look for assessments or certifications that demonstrate participants were tested on the material, not simply present in the room.
They also ask about refresher training. A single session three years ago is not sufficient. Financial-crime risks evolve, regulations change, and typologies emerge. Assessors expect to see an annual training plan that includes the board.
What to Ask
Ask your compliance or training team to produce attendance records and assessment results for every current board member. Verify that the records are complete, dated, and stored in a format that can be retrieved quickly during an examination. If any board member lacks a record, schedule remedial training immediately.
Ask to see the institution's annual training plan. Confirm that it includes a dedicated board session, scheduled at a specific date, with defined content and assessment criteria. If no plan exists, direct management to prepare one.
What This Means for Board Oversight
These three questions are not administrative details to delegate. They are governance responsibilities. A board that cannot demonstrate it has received appropriate, tailored, and documented financial-crime training cannot credibly claim to oversee the institution's AML and CTF program.
The mutual evaluation is not an audit of the compliance department. It is an assessment of the institution's entire control environment, and that environment begins with the board. Assessors will ask you what you know, how you learned it, and whether you can prove it. The time to prepare your answers is now.
Preparing the Board for the Evaluation
Institutions preparing for the FATF mutual evaluation should ensure that financial-crime training reaches the board, reflects the institution's specific risks, and produces verifiable completion records. Training materials should be available in Arabic and English to accommodate all board members. Sessions should include case studies relevant to the institution's customer base and product mix, and every participant should complete an assessment that demonstrates understanding.
Our Financial Crime Awareness Training service provides role-based training for the board, front line, operations and compliance teams, with completion evidence for regulators. We profile audiences, roles and risk exposure, tailor cases and content for each audience, deliver in-person or virtual sessions with assessments, and provide attendance and assessment records along with an annual training plan. Board and senior management briefings focus on governance responsibilities, risk appetite and escalation scenarios, distinct from front-line red flags and case studies. Participants who pass the assessment receive verifiable certificates. Training materials are delivered in Arabic and English, and content can be provided in a format your learning platform supports if you prefer to host it internally.
The mutual evaluation will test whether your board can answer the assessors' questions with confidence and evidence. Ensuring that your training program meets FATF standards is not a compliance task—it is a board responsibility.
