Do In-House Training Certificates Still Meet FCA Requirements?

Yes. In-house training certificates are still acceptable under FCA rules, and nothing in the FCA's requirements obliges a firm to buy third-party accreditation for its internal training. What the rules do expect is evidence: that the training was structured, that competence was assessed, and that the record can be produced and relied on later. The question worth asking is therefore not whether your certificates are externally accredited, but whether they would stand up if someone asked you to prove what they represent.

What the FCA actually asks for

The FCA's Training and Competence sourcebook sets expectations around employees being competent for the role they perform, remaining competent, and being appropriately supervised, with the firm keeping records that demonstrate all of this. It is framed around outcomes and evidence rather than around who issued a certificate.

Under the Senior Managers and Certification Regime, the evidential side becomes sharper. Firms assess and certify that certified staff are fit and proper, and that assessment is repeated. Training records are part of how a firm supports that judgement, which means they need to be specific about what was covered and durable enough to be produced a year or two later.

None of that requires an external accreditation logo. It does mean an editable file with a name, a date and a course title on it is doing less work than it appears to.

The gap is usually format, not content

Most firms we speak to have good internal training. Subject matter experts write it, it is delivered by people who know the business, and it is closer to the firm's actual risk profile than anything bought off the shelf. There is rarely a case for replacing it.

The weakness sits one step later, in how completion is recorded. A certificate produced as a Word file or an editable PDF cannot be distinguished from one that was altered afterwards. A certificate that names a course but not what the course covered leaves a reviewer with no way to judge whether the training was relevant to the role. A record held only in a mailbox or a shared drive is a record that depends on someone remembering where it is.

These are all fixable without touching the training itself.

What a certificate needs to carry to be useful as evidence

• Defined learning content. Not just the course title, but what the training set out to achieve and what the learner can do as a result. Open CPD structures this as aims, skills and outcomes, so every certificate states them.
• Tamper resistance. The record must not be editable after issue. If it can be changed, its evidential value depends entirely on trust in whoever holds the file.
• Independent verification. A reviewer should be able to confirm the certificate is genuine without asking the firm that issued it. An open verification link does this in seconds.
• A durable audit trail. Who was trained, on what, when, and under whose authority, retrievable without manual reconstruction.

A certificate that carries those four things answers the questions a compliance review will ask. One that carries none of them puts the burden back on the firm to explain itself.

You do not need to outsource the training

There is a persistent assumption that meeting a regulatory expectation means buying something external. For training content, that is usually the wrong instinct. The firm knows its products, its customers and its risks better than an external provider does, and internal delivery keeps that knowledge where it belongs.

What can usefully be brought in is the certification layer. Open CPD does not review, validate or endorse training content, and does not claim to. What it does is give internal training a structured, verifiable output: certificates tied to stated learning outcomes, a permanent record that cannot be edited after issue, a public verification page, and an audit trail that builds itself as certificates are issued.

Providers describe this accurately as systems accredited through Open CPD, or CPD certified by their own organisation. The training remains yours. The evidence gets stronger.

What this looks like in practice

A firm running mandatory annual training for certified staff sets up a course profile once, stating the aims, the skills the training builds and the outcomes expected in the role. Each cohort is issued certificates against that profile, in bulk if needed. Every certificate resolves to a public achievement page showing exactly what the training covered and a unique verification ID. When the annual fit and proper assessment comes round, the training evidence is already in a form somebody else can check.

The change is administrative rather than pedagogical, which is why it tends to be quick. The content that took years to get right stays exactly as it is.

A sensible next step

Take one existing internal course and look at the certificate it currently produces. Ask whether a reviewer holding only that certificate could tell what the training covered, and whether they could confirm it was genuine without contacting you. If the answer to either is no, the fix is in the certificate, not the course.

You can see how the verification side works on the verification page, and the structure itself is set out in how it works. Firms in regulated sectors should always confirm their own position with their compliance function, since requirements differ by permission and by role.