Online compliance training: practice, not box-checking

Mandatory compliance training is training that a law, a European regulation or a regulator requires of certain employees. It covers anti-money laundering, insurance distribution, personal data, anti-corruption, digital resilience or harassment. Short answer: the rules require the training, rarely its format. Practicing the conversation is what makes those hours useful.

Many organizations meet the obligation with annual online compliance training that people finish by clicking through. The records are up to date, but behavior does not change. This page surveys the obligations (many of them European, and relevant to US companies operating in the EU), explains why that format wears out and shows how to complement it with debriefed role-plays. Each theme links to a detailed article.

What are the mandatory compliance trainings?

There is no single obligation, but a series of laws and regulations aimed at different populations. Here is the overview, with what each text really asks for. The French provisions are presented as such: they apply in France and are not transposed here to other countries.

• Anti-money laundering and counter-terrorist financing (AML/CFT). In France, article L. 561-34 of the Monetary and Financial Code requires covered entities to inform their staff regularly. They must also put in place suitable training programs. The detail is in the article on AML/CFT training and the due diligence interview.
• Insurance distribution (IDD). In France, article R. 512-13-1 of the Insurance Code sets a minimum of fifteen hours of training a year. See the 15-hour IDD training.
• Data protection (GDPR). Regulation (EU) 2016/679 entrusts the data protection officer with awareness-raising and training of staff (article 39(1)(b)). See the GDPR training for employees.
• Anti-corruption (Sapin II). This is a French law: article 17 of law no. 2016-1691 of December 9, 2016 provides for a training scheme for managers and the most exposed staff. See the Sapin II anti-corruption training.
• Digital resilience (DORA). Regulation (EU) 2022/2554 has applied since January 17, 2025. Its article 13(6) asks financial entities for ICT security awareness programs. See the DORA training.
• Cybersecurity (NIS2). Directive (EU) 2022/2555 targets the training of management bodies (article 20) and cyber hygiene practices (article 21). See the NIS2 training for executives.
• Artificial intelligence (AI Act). Article 4 of Regulation (EU) 2024/1689 deals with AI literacy. See the article 4 obligation.
• Harassment. In France, article L. 1153-5 of the Labor Code requires the employer to prevent sexual harassment. Article L. 1153-5-1 requires a designated contact person in companies of at least 250 employees. See harassment prevention. For the United States, see our guide to sexual harassment training requirements.
• Professional ethics. Codes of conduct, conflicts of interest, integrity: see the ethics training and, for public officials, ethics in the French civil service.

Two remarks on this overview. First, some texts change quickly. Regulation (EU) 2026/1744 of July 8, 2026 rewrote article 4 of the AI Act. It now speaks of measures to promote AI literacy. For NIS2, the French bill known as “Résilience” was still under discussion in October 2026. Its examination in the National Assembly was withdrawn from the agenda with no new date, according to Leto Legal.

Second, none of these texts requires e-learning. The Insurance Code specifies that the training may be followed in person or remotely, in one or several sessions. The choice of format therefore belongs to the organization. Always check the text in force on Légifrance or EUR-Lex before building a program.

Why annual e-learning does not change practice

A compliance module conveys information: what the rule says, what is forbidden, whom to turn to. That is useful for knowing. But compliance errors rarely occur through ignorance of the rule. They occur at the moment when it has to be applied facing a person who expects something else.

Three mechanisms explain the gap between knowing and doing.

• Forgetting. Information read once, without use, fades quickly. A module taken in March is no longer available in October, when the customer insists.
• Context. The module asks multiple-choice questions. Reality brings a person who gets irritated, a colleague who is waiting, a sales quota in the background. The rule has to hold within that tension.
• Wording. Knowing that you must decline a gift does not teach the sentence that declines without causing offense. Words are worked on aloud, not by checking a box.

The completion rate then measures attendance, not competence. You will find this distinction developed in the article on completion versus competence. Weariness is added to it: the same module every year, with the same questions, mainly teaches people to answer fast. We come back to this in the article on fatigue with annual regulatory training.

What role-play brings to mandatory training

A compliance reflex is a habit learned by repetition, in a context close to the real one. Spoken role-play reproduces that context: a counterpart speaks, insists, changes tone, and the learner must answer on the spot. These are the conditions of the field, without the risk of the field.

Three properties make spoken practice effective.

1. It forces you to formulate. Saying aloud “I can’t accept this invitation, but thank you” fixes the sentence far better than reading it.
2. It exposes you to pressure. A counterpart who insists, makes you feel guilty or invokes urgency triggers the same stress as in the real situation. You learn to get through it.
3. It can be replayed. After a debrief that quotes what was said, the learner starts again and changes one thing. This loop makes people progress, whereas a module is redone identically.

This thesis also holds for security. Our series on security awareness training and vishing shows the same mechanism. A verification reflex is built by practicing the call, not by reading an instruction.

How to build a compliance path through practice

The aim is not to remove the regulatory content, but to put it in the right place. The module sets the framework, the role-play exercises the habits. Here is a method in five steps.

1. Start from real cases. With compliance and managers, list three or four difficult situations. For example: a customer who refuses to justify a transaction, a supplier's gift, a request for access to data.
2. Write the scenario from the learner's point of view. Define the counterpart, what they want, their level of pressure, and what the learner must obtain or refuse.
3. Set observable criteria. “Asked the question about the origin of funds” is observable. “Was vigilant” is not.
4. Debrief on the words. Quotes of what was said serve as material: what worked, what needs rephrasing.
5. Have people replay, at spaced intervals. One practice a quarter on a different case is better than one long annual session.

The wordings to work on first are short.

“I have to ask you this question, it’s an obligation for all our customers.”

“I can’t process this request by phone, let me explain the procedure.”

“I’d rather discuss it with my compliance contact before answering you.”

These sentences protect the employee without accusing the counterpart.

The situations to train, theme by theme

Each obligation has its typical conversation. Here are the ones that come up most, with the article that details them.

Due diligence, insurance and data: the exchange with the customer

An advisor must question a customer about the origin of funds, as an ordinary procedure. An insurance distributor must gather needs before recommending a contract. An employee receives a phone request for access to personal data. These three situations are detailed in the articles on AML/CFT, IDD and GDPR.

Integrity, ethics and harassment: the exchange with a colleague or a third party

A supplier's gift, an approach from an intermediary, a conflict of interest or a colleague's inappropriate remark are conversations under social pressure. The Sapin II training, the ethics training and harassment prevention return to them, with scenarios adapted to each profession.

Digital resilience and AI: everyday vigilance

DORA, NIS2 and the AI Act ask for staff and management to be trained. The technical content is learned through a module. The habits are worked on through practice: verifying a caller, reporting an incident. They extend our cybersecurity series, for example with the callback procedure through an independent channel.

Public sector: reception and ethics

Public officials receive the public, get requests for favors and apply secularism (laïcité) rules. The article on ethics in the French civil service describes how to stage these situations.

Common mistakes in a compliance program

A few pitfalls come back from one organization to another. Spotting them makes it possible to correct a program without redoing it.

• Confusing obligation and format. Many think the law requires e-learning. The texts speak of training, duration, population, records. Re-read them before locking in a tool.
• Training everyone on everything. An identical module for management, advisors and assistants suits no one. The texts themselves speak of functions and exposure.
• Assessing with an end-of-module quiz. The quiz checks immediate memory. It says nothing about the reaction facing a counterpart who insists.
• Concentrating training in one week a year. Forgetting works against a single session. Small, spaced practices are more effective.
• Forgetting the debrief. Without precise feedback on what was said, the learner does not know what to change.
• Not linking the themes. An unusual transaction, a fake bank caller and a request for access to data call on the same reflexes. You have to verify, then refuse or redirect.

To hold a refusal, the article on saying no on the phone under pressure provides reusable sentences. They apply to all compliance themes.

Proving the training and measuring what it changes

A regulator or an auditor asks for records: who was trained, on what, when, with what result. The Insurance Code says so explicitly. Companies and intermediaries must be able to produce the list of training followed, with the date, duration, methods and themes. Attendance certificates remain necessary.

Yet they do not show that the person knows how to do it. A debriefed practice session provides another type of proof: observed criteria, quotes, progress from one session to the next. The article on proof of training and the audit trail details what to keep.

To steer, track at least three indicators. The first is the share of criteria met in the first session. The second is the progress at the following session. The third is the number of situations met in the field that had been practiced. The last one links the training to compliance as lived.

Building role-play into a mandatory path

Face Up lets trainers create their own role-plays from their real cases. The learner speaks, by voice or on video, with a persona played by an AI. It can be a customer who gets irritated, a supplier who offers an invitation or a colleague who insists. Trainers write their scenarios with a design assistant: there is no fixed catalog.

After each session, the learner receives a debrief. It shows the objectives met or missed, their strengths, their points to improve, an action plan and quotes of what they said. They can play again. The connection to LMSs is made through LTI 1.3, which makes it possible to build these sessions into a path already in place. The role-play is then added to the module; it does not replace it.

Who decides the content of a mandatory training?

The text sets the principle, the organization sets the content. For the IDD in France, an order of the minister in charge of the economy lists the skills targeted, under article R. 512-13-1. For Sapin II, the organization relies on its corruption risk mapping. For the GDPR, the data protection officer plays a central role.

In every case, compliance, HR and managers benefit from building the training situations together. Managers know the real pressures. Compliance knows what the regulator expects. The trainer turns these two viewpoints into playable scenarios.

Frequently asked questions

Can compliance training be done remotely?

In most cases, yes. The French Insurance Code explicitly allows training in person or remotely, in one or several sessions. Check the text applicable to your sector, because some obligations specify the content or the population concerned.

Does a role-play count toward the mandatory hours?

That depends on the text and on your regulator. For the IDD, the training must update the skills needed for the functions performed, and you must be able to justify themes, duration and methods. A documented role-play meets this requirement if it is recorded.

Should everyone be trained in the same way?

No. Sapin II targets managers and the most exposed staff, DORA all employees and management with content adapted to their functions. Target situations by profession: an advisor and a buyer do not face the same pressures.

Where should you start?

Choose a theme where the gap between the rule and practice is known, then write a scenario from a real case. A first session followed by a debrief is enough to judge the value before rolling it out more widely.

To turn one of your mandatory trainings into a debriefed role-play, book a demo and bring the case that gives you the most trouble.