What training evidence do I need for ECCTA Principle 5?

Principle 5 of the ECCTA reasonable procedures guidance covers communication and training. It requires evidence that the organisation communicated its fraud prevention procedures to relevant staff and associated persons, and that training was proportionate to the risk profile of each role.

The most common gap is generic compliance training that covers fraud briefly alongside anti-bribery and data protection, with no evidence it was specifically tailored to ECCTA failure-to-prevent-fraud obligations or the individual's role in associated-person oversight.

For in-house training, evidence includes: dated attendance or completion records, the training content itself (slides, materials, or a summary), evidence of who delivered it and their qualifications, and evidence of how often training is refreshed.

For training delivered by third-party providers, keep the provider's completion certificate, the syllabus or course description, and confirmation of the date and attendees. If the provider is a law firm or regulated adviser, note their credentials.

Associated persons — particularly agents and intermediaries — are a frequent gap. Generic onboarding does not satisfy Principle 5 if those individuals are in a position to commit fraud on the organisation's behalf. Role-specific training, documented and dated, is required.