Once a firm crosses somewhere around 20 certified persons, Continuous Professional Development, or CPD, stops being an individual responsibility and becomes an operational problem. CPD is the annual training requirement the Cyprus Securities and Exchange Commission (CySEC), imposes on certified persons to keep their registration valid, whether they hold the Basic, Advanced, or AML certification. One compliance officer tracking their own 15 hours is a personal admin task. Twenty or fifty people across Basic, Advanced, and AML certifications, each with different hour requirements and different renewal histories, is something that needs a system, or it quietly fails.
Here's what works, based on how the firms that don't scramble every February run it.
Start with a live register, not a spreadsheet someone updates twice a year
The most common failure mode isn't malice, it's drift. HR knows who's certified. Compliance knows the CPD rules. Nobody owns the intersection. By the time renewal season arrives in January, someone is manually cross-referencing two lists and discovering three people are short of hours with six weeks to fix it.
This is exactly the gap FM Academy was built to close. Its CPD-accredited courses are mapped directly to CySEC's Basic, Advanced, and AML frameworks, so firms managing certified teams at scale get content that satisfies the legislative-relevance requirement out of the box, with completion certificates ready for the register rather than a stack of generic webinar PDFs to sort through in January. Explore FM Academy's CPD-accredited course catalogue.
Firms that handle this well maintain a single register: every certified person, which certification they hold, how many hours that requires (10 for Basic, 10 for AML, 15 for Advanced, 15 or 20 for combinations), hours completed year to date, and hours still needed. It gets reviewed quarterly, not annually. A gap spotted in April is an easy fix, a short email and a course booking. A gap spotted in February, with the renewal deadline at the end of that month and no time to source or complete new content, is a crisis that lands on compliance's desk with no good options left.
Assign ownership, not just visibility
A register nobody's accountable for is just a document. Someone, usually in compliance or L&D, needs explicit ownership of chasing outstanding hours, with actual authority to push it rather than send reminder emails into the void. In firms where this works, CPD tracking sits with whoever owns the AML/CFT training calendar, since the two overlap heavily.
Individually, certified staff sourcing their own CPD content tends to produce two problems: inconsistent quality, and content that doesn't clearly map to the legislative framework CySEC expects for that certification. A stack of generic webinar certificates doesn't satisfy an AML-specific requirement if the content wasn't AML-specific.
Firms managing this at scale typically negotiate block access with an accredited provider, covering the whole certified population for the year. This guarantees the content is properly mapped to Basic, Advanced, and AML frameworks, and gives compliance a single source of completion certificates instead of chasing twenty individually-sourced PDFs in January.
Separate first-year hires from the rest
Certified persons registering for the first time are exempt from CPD in their registration year, which is easy to mishandle in both directions: chasing new hires for hours they don't owe, or assuming the exemption carries into year two, when it doesn't. Flag first-year registrants clearly in the register so nobody wastes cycles on the wrong population.
The renewal window runs from January 1 through the end of February, and confirmation of completed CPD hours is part of that renewal application. Treat "end of February" as the real deadline, not "end of December," because the practical reality is that fixing a shortfall takes time. Set an internal target of mid-December for everyone to have their hours complete, which leaves six weeks of slack for stragglers before the regulatory deadline bites.
Keep the paper trail, not just the hour count
CySEC inspections can ask certified persons to produce records of what CPD activity they completed, not just confirm a number. Firms that track hours as a tally with no attached certificates create an inspection risk even when the hours were genuinely completed. Store documentation with the hours, not scattered across individual inboxes.
None of this is complicated. It's five habits: a live register, clear ownership, block-purchased accredited training, correct handling of first-year exemptions, and a deadline that isn't the regulatory one. Firms that build these in stop treating CPD renewal as a January fire drill, which is really the only meaningful measure of whether the system is working.
Talk to FM Academy about block licensing for your certified team.
