Compliance training software for an FCA-regulated firm has one main job: to prove, person by person, that your people are trained and competent for the role they do. That means a full audit trail (who completed what, which version, when, and how they scored), CPD records for advisers, reporting by role and regulated entity, and exports you can hand to your board or the FCA. Content library and course design matter too, but if the records can’t answer an FCA question, the software has failed.
This guide sets out what the rules actually require of your training records, the features that follow from them, and the questions to ask a provider before you sign.
What does the FCA require from your training records?
There is no FCA rule that names a particular kind of software. The requirements come from the duties on competence and conduct, and each one creates something your system has to record.
| Requirement | Source | What your software needs to show |
|---|---|---|
| Employ people with the skills, knowledge and expertise their responsibilities need | SYSC 5.1.1R | Role-based training, so each person gets what their job requires |
| Be able to demonstrate knowledge and competence to the FCA on request (MiFID business) | SYSC 5.1.5AB R | Records you can produce quickly, by person and role |
| Review competence “on a regular and frequent basis” | TC 2.1.12R | Dated assessments and refreshers, not a one-off induction |
| Retail investment advisers complete at least 35 hours of CPD a year, with 21 hours structured | TC 2.1.15R and TC 2.1.16G | CPD logs per adviser, with structured and unstructured hours |
| Keep records of CPD completed by each adviser | TC 2.1.24R | A CPD record that survives audits, moves and leavers |
| Take steps so staff understand the conduct rules, including “the provision of suitable training” | FSMA section 64B | Conduct rules training assigned to everyone in scope, with completion evidence |
| Certificates for certified staff last 12 months | FSMA section 63F | Training and assessment evidence that feeds each annual fitness and propriety check |
| Training and competence records support the board’s Consumer Duty assessment | FCA FG22/5 | Reports by role and team that drop into the annual board report |
The Training and Competence sourcebook (TC) applies where employees carry on certain activities for retail clients, so advisers in an IFA or wealth manager are in scope in a way a back-office team may not be. SYSC 5.1.1R and the conduct rules reach far wider. For the general duty to keep records, TC points you to SYSC 9.1.1R, and your own record-keeping policy sets how long they are kept.
What should compliance training software do for an FCA firm?
Work back from the table and most of the feature list writes itself.
A real audit trail
Completion and a date are the minimum. A defensible record also shows which version of the course the person took, their score, how many attempts they needed and, for scenario-based modules, the decisions they made. When the FCA or your auditors ask how you know someone understood the conduct rules, “they finished the course” is a weak answer. “They scored 90% on these ten scenarios in March, on the version that reflected the new vulnerability policy” is a strong one.
Check that records can’t be quietly edited, and that changes by administrators are logged.
Role-based learning paths
A compliance officer, a paraplanner and a call handler need different training. Good software assigns paths by role, team and regulated entity automatically, so a new joiner gets the right courses on day one and a person who changes role picks up the gaps. This is also how you meet the FCA’s expectation in Consumer Duty work that training reflects each person’s role.
CPD tracking for advisers
If you employ retail investment advisers, you need a CPD record for each one: hours, structured or unstructured, the activity and the date. A lot of CPD happens outside the LMS (conferences, webinars, reading), so the software should let advisers or supervisors log external activity alongside completed courses. If CPD sits in a separate spreadsheet, you have two records to reconcile at audit time.
Reporting your board and the FCA can use
You will want reports by person, team, role, site and legal entity, showing completions, overdue training, scores and certificates. Your annual Consumer Duty board report needs training data broken down by role, and our guide to Consumer Duty training covers what the FCA has said good evidence looks like. Exports should be simple: a CSV or PDF you can attach to a board pack without manual tidying.
Recertification and reminders
Annual and periodic training (conduct rules, AML, data protection, market abuse) needs automatic reassignment and reminders, with escalation to managers when someone is overdue. Tie the timing to your certification cycle, so the evidence is ready before each annual fitness and propriety assessment rather than chased afterwards.
Joiners, movers and leavers
Single sign-on with Microsoft or Google, plus a link to your HR system, keeps the user list accurate. It also stops a common audit problem: leavers’ accounts deleted along with their training history. Make sure records are archived when someone leaves.
Security and data protection
Training records are personal data. Ask where the data is hosted, whether the provider signs a data processing agreement under UK GDPR, how backups work and what security certification the supplier holds. Cyber Essentials is a sensible minimum for a UK supplier.
Content that fits the firm
The software holds the evidence. Whether behaviour changes depends on the content. Generic courses are fine for general topics. For conduct, Consumer Duty, vulnerability and your own products, the FCA has repeatedly criticised training that does not reflect how the firm actually works. Check whether the platform can host your own SCORM or xAPI modules, so bespoke content and library courses sit in one record.
Questions to ask a compliance training software provider
Take these into any demo. A provider who works with regulated firms should answer all of them without hesitation.
- Show me the full record for one learner: course version, score, attempts and scenario answers.
- Can administrators edit completion records, and is every change logged?
- How do advisers record external CPD, and can I report structured and unstructured hours separately?
- Can I report by legal entity as well as by team and role?
- What happens to a leaver’s records, and how long are they kept?
- How are refreshers reassigned, and who gets told when someone is overdue?
- Where is the data hosted, who are your sub-processors, and will you sign a data processing agreement?
- Can you migrate our existing completion history with the original dates?
- How quickly can you update a course when the FCA changes a rule or publishes new findings?
- What does the price include: licences, hosting, support, content updates?
The last two catch many firms out. A platform that is cheap per learner but charges for every content change gets expensive in a year with several FCA publications.
Common gaps we see in FCA firms’ training records
From building compliance training for regulated organisations, the same problems come up:
- Completion-only reporting. The system knows who finished but not what they understood. Scenario-based assessment fixes this.
- No version history. The course was updated after a policy change, but the records can’t show who took which version.
- CPD in spreadsheets. Adviser CPD lives outside the LMS and has to be reconciled by hand before every audit.
- Lost history. Records from an old LMS were left behind in a migration, or leavers were deleted.
- One course for everyone. A single annual module that does not reflect anyone’s actual role, which is the weakness the FCA keeps finding in Consumer Duty reviews.
Our article on UK compliance training problems covers these in more depth.
What the 2026 SM&CR changes mean for your software
The FCA’s PS26/6, published in April 2026, made the first set of changes to the Senior Managers and Certification Regime. From 10 July 2026 firms no longer need to certify the same person for several overlapping certification functions. The certificate itself is still valid for 12 months under section 63F.
The bigger changes depend on legislation. HM Treasury has proposed taking the Certification Regime out of the Act so it can be replaced through regulators’ rules, and the FCA and PRA expect to consult on that second phase later in 2026. Whatever comes next, firms will still need to show their people are competent. Choose software where learning paths and reports are easy to reconfigure, so a change in the regime means new settings rather than a new system.
How Capytech helps
The Capytech LMS gives you a branded academy with role-based learning paths, certificates and a training record for each person, which supports your T&C and CPD evidence. You can report completions, scores, compliance status and certificates by person, team, role or site, and export them for audits, your Consumer Duty board report or an FCA visit. It is hosted in the UK on AWS in London with daily UK backups, uses single sign-on with Microsoft or Google, and we sign a data processing agreement with every client. Capytech UK is Cyber Essentials certified. If you are moving from another system, past completion records can come across with their original dates as part of a quoted migration.
For content, we build FCA compliance e-learning around your own products, procedures and customers, with scenario-based assessments that capture decisions as well as scores. With FastTrack, updates are unlimited and text changes are turned around within 48 hours, so training keeps pace with the FCA. Ready-made courses for general topics come from our course library, and everything can be delivered in any language.
Frequently asked questions
It is a learning management system set up to assign, deliver and record mandatory training, so a firm can prove its people are trained for their roles. For FCA-regulated firms that means audit trails, CPD records for advisers and reports by role and entity, as well as the courses themselves.
Look for records that show course version, date, score, attempts and scenario answers for each person, a log of any administrator changes, and archived records for leavers. You should be able to export that history quickly when the FCA or your auditors ask.
It can, if it records external CPD as well as completed courses. Retail investment advisers need at least 35 hours of CPD a year, 21 of them structured, under TC 2.1.15R and TC 2.1.16G, and the firm must keep records of it. Check that the system reports structured and unstructured hours separately.
For general topics it can be. For conduct, Consumer Duty, vulnerability and your own products, the FCA has criticised training that does not reflect how the firm works, so most firms combine library courses with modules built around their own policies and customers.
The FCA does not set one frequency for all training. TC requires competence to be reviewed on a regular and frequent basis, certificates under SM&CR last 12 months, and most firms run annual refreshers plus updates whenever rules or procedures change.
A branded LMS your people will actually use
The Capytech LMS gives you your own branded academy, apps and reporting, hosted in the UK and run by our team.