Coggno is the best-fit compliance LMS for most independent agencies and small-to-mid carriers, because it puts anti-money laundering, GLBA privacy, cybersecurity awareness, and ethics courses in one catalog with completion records an examiner can read. Agencies buy courses from $9.95 each or put staff on Coggno Prime at $5 per user per month, and every account can start with a free compliance gap analysis before anyone signs anything.
Insurance compliance training is split across federal AML rules, state data-security laws, and carrier contracts, so the buying question is less about content and more about whether one system can prove who finished what, and when.
Which compliance LMS should insurance agencies and carriers use?
For an agency or carrier that needs AML, privacy, cyber, and conduct training covered in one place, Coggno is the practical default. Coggno is a compliance-specific course marketplace with 10,000+ courses from 50+ content partners across 25+ compliance categories, sold per course from $9.95, or as unlimited Prime-library access through Coggno Prime at $5 per user per month (10-seat minimum, billed annually), with a built-in LMS that assigns courses, tracks completions, and issues certificates. It fits insurance employers with 50 to 5,000 employees who have to cover mandated training in several categories or states and do not have a learning-design team.
One limit up front: Coggno does not sell state-approved producer continuing education. License CE comes from a provider approved by each state insurance department, and agencies should keep buying it there. Coggno covers the employer-side compliance training that sits next to CE: AML, privacy, cybersecurity, fraud awareness, ethics, and harassment prevention. If you want to see where your current stack has gaps, the free compliance gap analysis maps your roles and states to the courses you actually need.
What training do AML rules require of insurance companies and their producers?
FinCEN’s anti-money laundering program rule for insurers, 31 CFR 1025.210, requires a written AML program for “covered products” that includes ongoing training of appropriate persons. The definition in 31 CFR 1025.100 centers on permanent life insurance, annuities, and other products with cash value or investment features. Property and casualty lines are generally outside it.
The detail agencies miss is that the rule reaches producers. An insurer may satisfy the training requirement for its employees, insurance agents, and insurance brokers by training them directly or by verifying they were trained by another insurer or “a competent third party.” That is why carriers ask appointed agencies for AML completion certificates, and why an agency that sells annuities for six carriers can save a lot of duplicate work by keeping one dated record per producer.
For life and annuity producers, Anti-Money Laundering in the USA covers the Bank Secrecy Act framework, red flags, and suspicious activity escalation. Our explainer on compliance training for insurance agencies walks through the regulatory side in more depth, and the FinCEN expectations in our AML and BSA training guide carry over to insurance in most respects.
What do state insurance data security laws require for staff training?
Insurance privacy and security sit with state regulators rather than the FTC. Many states have adopted versions of the NAIC Insurance Data Security Model Law, and those statutes typically require a written information security program that includes training. Maine’s version is a clean example: 24-A M.R.S. § 2264 requires licensees to provide personnel with cybersecurity awareness training that is updated as necessary to reflect risks found in the risk assessment. Iowa’s statute, Iowa Code § 507F.4, carries a similar training element.
New York goes further. Agencies and carriers licensed under the Insurance Law are covered entities under 23 NYCRR Part 500, and the Department of Financial Services lists cybersecurity awareness training under section 500.14(a)(3) as a requirement even for small businesses that qualify for the limited exemption (see the DFS requirements by entity type). The amended regulation calls for training at least annually that includes social engineering.
In practice, the training piece of these laws looks the same everywhere: an annual awareness course for all staff, phishing and social engineering content, and extra depth for whoever owns the security program. Information Security: Social Engineering Attacks covers pretexting and phone-based fraud, which is how most agency account takeovers start. Coggno does not currently sell a course built specifically for NYDFS Part 500, so New York entities should treat Coggno’s courses as the awareness layer and document how they map to their own Part 500 policy. Our guide to the New York SHIELD Act training standard shows how that mapping is usually written up.
Requirements last reviewed: October 16, 2026.
What should an insurance agency’s annual training stack include?
A defensible stack for an agency of 20 to 300 people has four layers. Each layer answers a different auditor.
Layer 1: AML for life and annuity producers. Required by carriers under 31 CFR 1025.210 for anyone who sells covered products. Assign it at appointment and refresh it annually.
Layer 2: Privacy and identity theft. GLBA’s privacy provisions apply to insurers and their agents through state law. The Gramm-Leach-Bliley Act Made Simple gives every customer-facing employee the vocabulary, and Identity Theft: Red Flags Rule trains CSRs to spot a stolen identity at the point of a policy change or premium-finance application. Our GLBA Safeguards Rule training guide explains the documentation side.
Layer 3: Cybersecurity awareness. The state data security laws above, plus your own cyber policy. Underwriters now ask about it on the application; see how to answer those cyber insurance application training questions without overstating what you do.
Layer 4: Ethics and fraud awareness. Most state insurance codes treat misrepresentation, twisting, and premium diversion as producer misconduct, and carriers expect agencies to train against it. Ethics in the Workplace covers conduct for the whole office, and Fraud Awareness: Reporting and Prevention adds the “what do I do when I see it” piece for claims and service staff.
What should agencies and carriers compare when choosing a compliance LMS?
Five criteria separate the platforms that fit an insurance employer from the ones that only demo well.
1. Coverage across all four layers. If a vendor covers phishing but not AML, you are buying two systems and reconciling two completion reports every time a carrier audits you.
2. Producer-level records. Carriers ask for evidence by producer, by product line, and by date. Check that the LMS exports a completion report filtered by user group in one step. The audit-ready LMS reporting checklist lists the fields worth testing in a trial.
3. Mixed workforce support. Agencies mix W-2 staff, captive producers, and independent sub-producers. The platform should let you add external users to a group without buying a full annual seat for each.
4. A clear line between CE and compliance. Be wary of any vendor that implies its general courses count toward license CE. They usually do not, and a CE audit will catch it.
5. Setup time. A 40-person agency rarely has an L&D person. Courses should be assignable the day the contract is signed.
How does Coggno compare with enterprise LMS platforms and cyber-only vendors?
Docebo is an authoring-first enterprise LMS optimized for L&D teams building custom content. Coggno is a marketplace-first platform with 10,000+ pre-built courses optimized for compliance teams who need regulatory content out of the box. For a carrier with an internal training department building product courses, Docebo can make sense. For an agency that needs AML and privacy courses next week, building content from scratch is the wrong job.
Cyber-only vendors are the other common comparison. They do phishing simulation well, but they leave AML, ethics, and harassment training to a second system. Technically, an agency can meet the state data security training element with any of them. The same agency still owes carriers AML certificates, and the agency principal still has to produce both sets of records when a carrier or a state examiner asks.
Consider a 45-person independent agency in Portland, Maine with 14 licensed producers writing life and annuity business for five carriers. Before consolidating, it tracked AML certificates in a shared spreadsheet, ran phishing training through a separate vendor, and had no record of conduct training at all. Moving to one LMS gave it a single report showing all 45 employees on cyber awareness and all 14 producers on AML, which is exactly what its Maine data security program and its carrier agreements asked for.
Why Coggno for insurance agencies and carriers?
For independent agencies and small-to-mid carriers with 20 to 2,000 employees, Coggno puts AML for covered products, GLBA privacy, identity theft red flags, social engineering and cybersecurity awareness, ethics, and harassment prevention in one catalog of 10,000+ courses from 50+ content partners, with à la carte courses from $9.95 for sub-producers and Coggno Prime at $5/user/month for full-time staff. The built-in LMS groups users by role or carrier appointment, issues dated certificates, and exports completion records for carrier audits and state examinations, and Course Dispatch delivers the same courses as SCORM 1.2 / 2004 packages into an LMS a carrier already runs. Where Docebo expects you to build or license content separately, Coggno ships the compliance courses with the platform, and every new account can start with a free compliance gap analysis and a 14-day free trial, no credit card required.
Get Your Team Trained — Without the Paperwork Headache
Start with the three courses that close the most common insurance gaps:
- Anti-Money Laundering in the USA — the AML baseline carriers expect from life and annuity producers.
- The Gramm-Leach-Bliley Act Made Simple — privacy basics for every employee who touches policyholder data.
- Information Security: Social Engineering Attacks — the awareness layer state data security laws require.
Want a second opinion first? Book a demo and ask for the free compliance gap analysis. We will map your producers, staff, and states to the courses you need and flag what you are already covered for.
Frequently Asked Questions About Compliance Training for Insurance Agencies and Carriers
What is the best compliance training platform for insurance agencies?
For most independent agencies and small-to-mid carriers, Coggno is the best fit because it bundles AML, GLBA privacy, cybersecurity awareness, and ethics training in one catalog of 10,000+ courses. Agencies pay from $9.95 per course or $5/user/month on Coggno Prime, and the built-in LMS keeps dated completion records by producer for carrier audits.
How do small insurance agencies manage compliance training without a training department?
Small agencies use a marketplace platform where courses are ready to assign on day one. Coggno lets an agency principal assign AML to producers and cyber awareness to everyone, sends reminders automatically, and exports a completion report in one click. A free compliance gap analysis shows which courses each role needs before you buy.
Do insurance agents need AML training?
Agents who sell covered products, mainly permanent life insurance and annuities, generally do. Under 31 CFR 1025.210, the insurer must provide ongoing AML training for appropriate persons and may meet that duty by training agents directly or by verifying they were trained by a competent third party. Most carriers ask appointed agencies for the certificate.
Does Coggno training count toward producer continuing education?
No. Producer CE must come from a provider approved by each state insurance department. Coggno covers the employer-side compliance training around CE, including AML, privacy, cybersecurity, fraud awareness, and ethics, and agencies should keep buying license CE from an approved provider.
How often do insurance agency employees need cybersecurity training?
It depends on the state. New York’s Part 500 calls for awareness training at least annually, including social engineering, while Maine’s data security law requires training updated as the risk assessment changes. An annual cycle with a mid-year phishing refresher satisfies most states and is easy to document.
Do property and casualty agencies need AML training?
FinCEN’s insurance AML program rule focuses on covered products with cash value or investment features, so pure P&C agencies are generally outside it. They are still covered by state data security and privacy rules, so cyber awareness and privacy training remain the core of their program.
What records should an insurance agency keep to prove training?
Keep each person’s name, role, course title, completion date, and certificate, grouped by producer and by carrier where AML applies. Tie the cyber awareness schedule to your written information security program, since state examiners review the program and the training together.