Compliance Officer: Training and certification at a glance 2026

The professional suitability of a compliance officer results from Section 130 OWiG in conjunction with ISO 37301:2021 (compliance management systems). Persons subject to supervision must carefully select, qualify and monitor representatives, otherwise there is a risk of fines of up to 10 million euros according to Section 30 OWiG as well as personal liability of the management according to the principles of the Siemens/Neubürger judgment of the LG Munich I from 2013. Anyone who works as a compliance officer or would like to fill such a position is faced with a confusing market of TÜV courses, university certificates, DIIR courses, international SCCE and ICA programs and numerous online boot camps. The question of which training is recognised does not depend on a single position, but on the industry, task profile, risk landscape and the expectations of the responsible supervisory authority.

This article organises the most important training formats, shows the examination requirements and explains what evidence a management should present in the event of an audit. You will receive a concrete overview of the duration, costs and content, a comparison of the relevant certificates, a classification of the international programs and a pragmatic plan on how you can verifiably manage orders, qualifications and reporting lines in accordance with ISO 19600 and ISO 37301. The article also shows how the CIVAC workspace, as a compliance platform and officer-as-a-service, provides evidence and makes audit inquiries answerable in minutes. The appointment certificate, signed, filed, verifiable.

The requirement for the professional suitability of a compliance officer does not arise from a single paragraph, but from the interaction of several standards. Section 130 OWiG requires management to exercise appropriate supervision, including the selection of qualified representatives. § 31 BGB attributes the behaviour of its organs and representatives to the legal entity. ISO 37301:2021 requires documented competence in Section 7.2, including education, training and experience. Industry-specific regulations such as MaRisk (BaFin), WpHG (§ 80), KWG (§ 25a), GwG (§ 7) or the DCGK set further minimum technical standards. In case law, the LG Munich I in the Siemens/Neubürger judgment and the BGH have repeatedly made it clear that the selection of unsuitable representatives itself represents a breach of duty on the part of management.

It follows: A compliance officer does not need a specific state approval, but rather reliable evidence. This usually consists of three building blocks. Firstly, a formal degree in law, business administration, business law, business psychology or a comparable discipline. Secondly, an additional professional qualification, such as a TÜV or DIIR certificate or a university certificate. Thirdly, continuous training with documented participation, specialist literature and conference visits. What counts in the audit is not the most beautiful course, but rather the complete documentation along these three axes. This is exactly where our role workspace for compliance officers comes in: qualification matrix, appointment certificate, reporting line and training plan are available in an audit-proof manner and are linked. The auditor calls, the evidence is ready. On the other hand, anyone who works with a file folder and isolated PDFs risks fines in accordance with Section 30 OWiG of up to 10 million euros per offense in an emergency, personal liability for management as well as damage to the reputation of supervisors and business partners.

The market for compliance officer training in Germany is dominated by four provider groups. The TÜV academies (South, Rhineland, North, Hesse) offer modular courses to become Compliance Officers (TÜV) and Compliance Managers (TÜV), typically 5 to 12 days, exam with personal certificate according to DIN EN ISO/IEC 17024, costs between 3,500 and 6,500 euros net. The DIIR (German Institute for Internal Auditing) is aimed at auditors and compliance professionals with a curriculum that is closely based on the Certified Internal Auditor (CIA). Duration 10 to 15 days, costs from 5,800 euros, with your own personal certificate and regular recertification every three years.

The Frankfurt School of Finance offers the Certified Compliance Professional and the Master of Compliance, more academic and close to the financial market, duration 6 months to 2 years, costs 8,000 to 24,000 euros. EUCLID, ECGI and the University of Augsburg complement the picture with university certificates in white collar criminal law and corporate governance, often as part-time LL.M. programs. Internationally, companies often rely on SCCE (Society of Corporate Compliance and Ethics) or ICA (International Compliance Association), especially for companies with US connections or FCPA risks. There are also industry-specific programs from BaFin (such as the compliance officer course in the securities business) and sector associations such as the German Chamber of Commerce and Industry. The choice does not depend on the prestige of the provider, but on the industry and task profile. A compliance officer in an investment company needs knowledge of the WpHG, while in a logistics group he needs LkSG and sanctions know-how. ISO 37301:2021 requires that management consciously select this suitability and document it in the agent directory. A comparison of the curricula and the respective examination depth belongs in the personnel decision, not in a later audit discussion with the examination body.

A recognised compliance officer course regularly covers eight subject areas. First: Basics of corporate governance, three-line model, structure of a CMS according to IDW PS 980 or ISO 37301. Second: Anti-corruption, Sections 299, 331 ff. StGB, FCPA, UK Bribery Act, gift and invitation guidelines, third-party audit. Third: money laundering prevention according to the AMLA, AMLA Regulation 2024/1624, due diligence, suspicious activity reports to the FIU, KYC processes. Fourth: antitrust law, GWB, market abuse regulation (MAR), insider trading, dawn raid preparation. Fifth: Data protection according to GDPR and BDSG-new, interfaces to the DSB, ROPA maintenance, Art. 33 GDPR notification in 72 hours. Sixth: Whistleblower protection according to HinSchG (July 2023), establishment of an internal reporting office, protection against reprisals. Seventh: sanctions, export controls, EU sanctions packages, Russia embargo, dual use. Eighth: supply chain due diligence according to LkSG and CSDDD (effective 2027), CSRD reporting obligations.

The examination usually includes a written exam (90 to 180 minutes), a case study (10 to 20 pages) and an oral defence of 20 to 30 minutes in front of a three-member examination committee. Those who pass receive a personal certificate with a period of validity (typically 3 years, then recertification with proof of training of at least 60 hours). A certificate alone is not enough for later orders in the company. The management must create an appointment certificate with a description of tasks, reporting lines, rights to information and protection against discrimination. On the CIVAC FAQ page you will find the twelve most frequently asked questions about reliable documentation. Others run compliance like a filing cabinet. We run it like software., with versioning, an audit trail and links to the respective obligations. Every test begins with the question of proof, not with the question of activity, and the platform technically reflects this exact sequence. Anyone who completes a course immediately loads the certificate into their personnel file and links it to the appointment certificate so that recruiting, HR and management share the same view.

The investment in compliance officer training varies considerably. A TÜV compact compliance officer course (5 days) costs between 3,500 and 4,500 euros net. The extended compliance manager (TÜV) with 10 days is 5,500 to 6,500 euros. University certificate programs such as the Frankfurt School's Certified Compliance Professional cost 8,000 to 12,000 euros, while master's programs cost 18,000 to 24,000 euros. In addition, there are travel costs (typically 800 to 1,500 euros per course), examination fees (300 to 800 euros), teaching materials (200 to 500 euros) and recertification fees every three years. Anyone who learns part-time should plan an additional 8 to 12 hours of self-study per week.

Employers cover the costs in full in 78 percent of cases if the training is linked to an order. When taking on a compliance function internally, a repayment clause over 2 to 3 years is common, staggered according to length of stay. Educational leave (5 days per year in 14 federal states, with the exception of Saxony and Bavaria), advancement BAföG (for master's equivalent qualifications) and, in individual cases, the Federal Employment Agency's Qualification Opportunities Act are applicable. If management wants to do cost accounting differently, compare the structure of an internal CO function (salary 75,000 to 130,000 euros per year plus training and tools) with the officer-as-a-service model. CIVAC will provide an appointed compliance officer within 2 working days, including the appointment document, reporting line and workspace access. Licence the workspace for your internal representatives, or have our representatives order it. The choice depends on company size, industry, risk profile and the question of whether compliance should be anchored strategically or operationally. In any case, management requires a robust business case that weighs personnel, tool and training costs against the risk arising from Section 30 OWiG, reputational damage and contractual penalties from supplier relationships.

ISO 37301:2021 replaces the older ISO 19600:2014 and is formulated as a certifiable standard. Section 7.2 (Competence) requires that the organisation determine, ensure and document the required competence. Section 7.3 (Awareness) requires that all employees are aware of the compliance policy and its contribution to the effectiveness of the CMS. Section 9 (Assessment of Performance) requires measurement of effectiveness using measurable indicators, such as number of reports, duration of investigation, rate of follow-up action. Both requirements can only be met if there is a structured training plan and training participation is documented in an audit-proof manner. Mere stamps on attendance lists are not enough for an ISO auditor.

In practical terms, this means: per compliance officer at least 24 to 40 hours of training per year, at least one conference (for example the German Compliance Day, the CCZ Congress or the SCCE Compliance and Ethics Institute), specialist literature (CCZ, ZRFC, BB, compliance consultants), internal training and awareness campaigns. The topics in 2026 will be dominated by CSRD/ESRS reporting, EU AI Act (staggered from August 2026 for high-risk systems), NIS-2 (implemented from October 2024 in the EU, federal law in preparation) and the EU Money Laundering Regulation with the new supervisory authority AMLA in Frankfurt. The obligation to train applies not only to the compliance officer, but also to all risk-relevant functions, such as sales, purchasing, HR and IT. In the CIVAC workspace you can plan training matrices, participation and audits centrally; 490 ready-to-use audit templates cover the most common audit questions and are linked to the relevant mandatory points. Anyone who is serious about compliance does not view qualification as a static certificate, but rather as a continuous process. Audit-proof, documented, § 130 OWiG-proof. In practice, a rolling 12-month plan that combines compulsory and elective modules, internal sparring and external conferences and links them to the annual risk analysis has proven successful.

The general compliance officer training covers 70 percent of the tasks. For the remaining 30 percent, you need specializations that depend on the industry. In the banking and insurance sector, AML specialists are in demand, usually with the CAMS certificate (Certified Anti-Money Laundering Specialist) from ACAMS or the ICA Diploma in Anti Money Laundering. The EU AMLA Regulation (Regulation 2024/1624) tightens the requirements from 2027 and introduces central supervision in Frankfurt. Insurers and investment firms require additional training on MiCAR (Markets in Crypto-Assets Regulation) and the digital operational resilience act DORA (Regulation 2022/2554).

ESG and supply chain requirements are growing fastest in medium-sized companies. CSRD (Corporate Sustainability Reporting Directive) requires large capital market-oriented companies to report on sustainability in accordance with ESRS from the 2026 reporting year. LkSG (Supply Chain Due Diligence Act) has been in effect for companies with 1,000 or more employees since 2024; the EU-CSDDD will largely replace it from 2027 and expand the scope of application to the European internal market. Compliance officers with an ESG mandate should also attend GRI, SASB or TCFD training. A third growing area is AI compliance: The EU AI Act (Regulation 2024/1689) staggers obligations between February 2025 (prohibited systems) and August 2026 (high-risk systems). Compliance officers need a basic understanding of risk classification, technical documentation, data quality, conformity assessment and post-market monitoring. CIVAC operates its workspace with EU data residency and ISO/IEC 27001:2022 ISMS, so that even sensitive compliance data does not leave the European legal area and the 93 controls of the Appendix A list are consistently applied. The respective specialization is named in the appointment certificate and visibly maintained in the platform's qualification matrix. Anyone who serves several areas of responsibility at the same time should also document how conflicts of interest can be avoided, for example by separating the ESG and AML functions in larger companies.

Anyone who works in an internationally active company or comes into contact with US regulators (DOJ, SEC, OFAC) should think about international certificates. The SCCE (Society of Corporate Compliance and Ethics) awards the Certified Compliance and Ethics Professional (CCEP) and CCEP-International (CCEP-I). The exam consists of 115 questions in 2 hours, a pass rate of around 75 percent, and requires 80 to 120 hours of preparation. Cost including membership and exam is approximately $1,500. An annual recertification with 20 CCB points is mandatory. SCCE membership also opens access to the HCCA for the healthcare sector.

The ICA (International Compliance Association) offers diploma programs in Anti Money Laundering, Financial Crime Prevention, Compliance and Governance, often recognised in the UK, Singapore and the Middle East. Typically lasts 6 to 12 months, costs £3,500 to £7,500. For compliance officers with a capital market connection, the CFA with ethics module or the FRM certification is relevant, but more as a supplement. In the data protection area, the CIPP/E of the IAPP is considered a European standard and is often compatible with the DPO role according to Art. 37 GDPR. Within the EU, supervisory authorities generally accept the German TÜV, DIIR and university certificates as equivalent, provided the content and number of hours are comparable. During the ordering process, management checks suitability based on the task, not the certificate name. The CIVAC module for external compliance officers provides a comparison matrix with which HR and management can compare applicant profiles against industry and risk profiles and prepare the order in an audit-proof manner. Applicants also benefit because the target profile is transparent and the subsequent appointment is made with a clear list of tasks.

Training alone does not make a person an effective compliance officer. Three more building blocks are necessary. Firstly, the appointment certificate: in writing, signed by the management, with a description of tasks, reporting line, rights to information, access to board issues and protection against discrimination in accordance with Section 4f BDSG-old-analog. Secondly, the reporting line: direct access to management, regular reports (at least quarterly, monthly in regulated industries), ad hoc escalation in critical issues, supervisory board report at least annually. Thirdly, the resources: budget, employees, training budget and tools including workspace, whistleblower system and risk management tools.

In the event of an audit, the auditor (BaFin, auditor according to IDW PS 980, ISO certification body according to ISO 37301) typically asks for twelve points. Appointment certificate, CV and certificates of the CO. Reporting line and actual reports for the last 24 months. CMS manual and compliance program with versioning. Risk analysis and its updating at least annually. Training plan and proof of participation at the individual level. Whistleblower channel with anonymous entry options according to HinSchG. Examination protocols including the four-eyes principle. Follow-up measures, consequences, labour law steps. Audit reports and management reviews. Effectiveness measurement with KPIs and maturity model. Improvement measures with deadline and person responsible. Communication with supervisors and external bodies. Anyone who manages all of this in Word, Excel and mailboxes will lose in the first audit stress test. In the CIVAC workspace, the appointment certificate, reporting line, audit templates and evidence are linked, versioned and with read and write rights per role. The auditor calls, the evidence is ready. Each reporting period ends with a signed management review entry that records the status, risks and outstanding actions. This creates a continuous thread from training to ordering to the annual effectiveness measurement, and it is precisely this thread that auditors look for in every round of audits. Even short-term changes to the board of directors or supervisory board are less frightening because the chain of responsibility continues to be transparently documented.

Whether you want to train as a compliance officer yourself, develop an internal CO or outsource the function: the requirements from Section 130 OWiG, ISO 37301:2021 and industry-specific regulations are the same. Reliable qualifications, clear orders, functioning reporting lines and audit-proof evidence. CIVAC bundles these requirements as a compliance platform and officer-as-a-service. Licence the workspace for your internal representatives, or have our representatives order it. In the first case, your employees receive appointment certificate templates, reporting line templates, 490 audit templates and a training plan with proof of further training as well as a qualification matrix that makes gaps visible. In the second case, we provide an externally appointed compliance officer in 2 working days, instead of the 2 to 6 weeks of the classic search for an officer. In both models, the entire proof runs on a platform with EU data residency and ISO/IEC 27001:2022 ISMS.

We discuss the appropriate path in a 30-minute initial consultation. They describe the industry, size, existing compliance landscape, audit dates and open gaps from the last management review. We show you the workspace, the appointment certificate, the SLA and the onboarding script for the first 30 days. Turn reading into an assignment. Write to info@civac.de or use the contact form on civac.de. A compliance officer without documented suitability is the most expensive booking rate in your financial year in the event of a fine. With CIVAC it is the cheapest insurance against Section 30 OWiG, because every order, every report and every training course is verifiably documented. Anyone who has put the workspace into operation will experience the next audit as a routine instead of a stress test because content, versions and those responsible remain clearly assigned. This resilience counts not only towards regulators, but also towards customers, investors and supervisory boards, who are increasingly demanding verifiable compliance as a prerequisite for contracts and investments.