ACAMS CAMS Cheat Sheet

Terrorist Financing vs. Money Laundering

Proliferation Financing

The Risk-Based Approach

The risk-based approach is central to CAMS. Controls should be proportionate to risk.

Inherent Risk, Controls, and Residual Risk

A practical risk assessment asks:

1. Who are the customers?
2. Where are they located or transacting?
3. What products and services are used?
4. How are services delivered?
5. What transaction types and volumes are expected?
6. What controls exist?
7. What residual risk remains?

Core Risk Categories

Risk-Based Does Not Mean

• Ignoring low-risk customers.
• Accepting all high-risk customers.
• Applying the same controls to everyone.
• Replacing judgment with a risk score.
• Treating documentation as optional.

It means the institution uses documented judgment to apply stronger or different controls where the risk is greater.

AML Program Governance

A sound AML program is not just software. It requires governance, accountability, controls, testing, and culture.

Core AML Program Elements

Three Lines of Defense

Trap: The first line cannot outsource all responsibility to compliance. Business units own the risk they generate.

Independent Testing

Independent testing should assess whether controls are designed well and operating effectively. It may review:

• Customer risk scoring.
• CDD and EDD files.
• Beneficial ownership documentation.
• Sanctions screening disposition.
• Transaction monitoring alert quality.
• Suspicious activity investigations.
• Reporting timeliness and quality, where applicable.
• Training completion and relevance.
• Governance and management information.
• Prior issue remediation.

CDD Decision Table

CDD vs. EDD vs. Ongoing Monitoring

Source of Funds vs. Source of Wealth

Beneficial Ownership Red Flags

Sanctions Screening Decision Path

    flowchart TD
	    A[Potential match from screening] --> B[Compare identifiers]
	    B --> C{Clearly not same party?}
	    C -- Yes --> D[False positive; document rationale]
	    C -- No --> E{Strong or possible match?}
	    E -- Possible --> F[Escalate for review; gather more identifiers]
	    E -- Strong --> G[Apply hold/block/reject/escalate per policy and applicable law]
	    F --> H[Final disposition and audit trail]
	    G --> H

Screening Quality Factors

Sanctions and Screening

Sanctions compliance and AML monitoring are related but not the same.

Screening Match Review

A screening match is not automatically a true hit. Review:

• Name similarity and aliases.
• Date of birth or incorporation.
• Address and nationality.
• Identification numbers.
• Ownership and control.
• Vessel, aircraft, wallet, or other identifiers.
• Transaction counterparties and intermediaries.
• Geographic links.
• Quality of data and transliteration issues.

Sanctions Evasion Red Flags

• Use of shell or front companies.
• Sudden changes in trade routes.
• Vague goods descriptions.
• Payments routed through unrelated third parties.
• Use of intermediaries in high-risk jurisdictions.
• Ownership changes shortly before transactions.
• Avoidance of obvious references in payment messages.
• IP, shipping, or documentation inconsistencies.
• Links to dual-use goods or restricted sectors.

Wire Transfers and Correspondent Banking

Trade-Based Money Laundering

Securities, Insurance, and Investment Products

Real Estate and High-Value Assets

Virtual Assets

Correspondent Banking

Correspondent banking allows one financial institution to provide services to another, often across borders. It is high risk because the correspondent may have limited visibility into the respondent bank’s customers.

Key Risks

• Nested relationships.
• Payable-through accounts.
• Weak respondent AML controls.
• High-risk jurisdictions.
• Shell banks.
• Poor transparency over originators and beneficiaries.
• Sanctions exposure.

Due Diligence Focus

Trap: A correspondent bank must understand the respondent relationship; it usually cannot identify every underlying customer in normal correspondent activity, but it must manage the risk appropriately.

Trade-Based Money Laundering

Trade-based money laundering uses trade transactions to move value and disguise proceeds.

Common TBML Methods

TBML Review Clues

• Goods inconsistent with customer business.
• Unusual shipping route.
• Inconsistent invoice, bill of lading, and payment data.
• Newly formed companies with high trade volume.
• Use of free trade zones without clear need.
• Dual-use goods or sanctioned-sector exposure.
• Repeated amendments to letters of credit.
• Payments from or to unrelated offshore entities.

Alert vs. Case vs. SAR/STR

Strong Investigation File Characteristics

SAR/STR Narrative Checklist

Governance Evidence

Common Control Weaknesses

Good Alert Disposition

Unusual vs. Suspicious

Exam trap: An alert is not the same as suspicion. Alerts require investigation and disposition.

Investigation Workflow

    flowchart TD
	    A[Alert, referral, subpoena, adverse media, or law enforcement request] --> B[Gather customer profile and expected activity]
	    B --> C[Review transaction details and counterparties]
	    C --> D[Compare activity to customer risk and known typologies]
	    D --> E{Reasonable explanation?}
	    E -->|Yes| F[Document rationale and close or monitor]
	    E -->|No or unresolved| G[Escalate to AML compliance / investigations]
	    G --> H{Suspicion threshold met under policy/law?}
	    H -->|Yes| I[File required report and maintain confidentiality]
	    H -->|No| J[Document no-file rationale and consider ongoing monitoring]
	    I --> K[Consider account restrictions, exit, or enhanced monitoring]
	    J --> K

Common Suspicious Activity Red Flags

Suspicious Activity Reporting Principles

Jurisdiction-specific requirements vary, but the exam commonly tests these principles:

• Escalate internally according to policy.
• Do not tip off the customer.
• File required reports when the applicable suspicion threshold is met.
• Document the facts, analysis, and decision.
• Keep reports and related information confidential.
• Continue monitoring if the relationship remains open.
• Consider whether account restrictions, exit, or enhanced controls are appropriate.
• Cooperate with competent authorities through approved legal and internal channels.

Exam Decision Rules

Use these practical rules when answering scenario questions.

If the Scenario Shows a Red Flag

Do not jump straight to “file a report” unless the facts meet the suspicious reporting threshold in the scenario. The usual best answer is often:

1. Investigate.
2. Gather context.
3. Compare to customer profile.
4. Escalate internally if unresolved.
5. File/report if suspicion is established under policy and law.
6. Document the rationale.

If the Customer Is High Risk

High risk usually means apply EDD and monitoring, not automatic rejection. Exit or decline may be appropriate if:

• Identity or beneficial ownership cannot be verified.
• Activity lacks a lawful or reasonable purpose.
• Sanctions or prohibited exposure exists.
• Required information is refused.
• Risk exceeds the institution’s risk appetite.
• The institution cannot manage the risk.

If the Question Mentions Tipping Off

The safe principle is confidentiality. Staff should not tell the customer that a suspicious activity report has been or will be filed. Customer contact, if needed, should be handled carefully and according to policy.

If the Question Mentions Senior Management

Senior management and the board are responsible for oversight, risk appetite, resources, and culture. They do not usually perform day-to-day alert investigations, but they must ensure the program is effective.

If the Question Mentions Audit

Independent audit/testing evaluates the AML program. It should be independent from the activity being tested and should report findings for remediation.

If the Question Mentions “Best Next Step”

Look for the answer that is:

• Risk-based.
• Documented.
• Escalated through proper channels.
• Consistent with policy and law.
• Protective of confidentiality.
• Focused on facts rather than assumptions.

Rapid Final Review Checklist

Before practice questions, make sure you can explain:

• The difference between placement, layering, and integration.
• Why terrorist financing can involve legitimate funds.
• How inherent risk, controls, and residual risk relate.
• The main components of a risk-based AML program.
• What CDD is designed to establish.
• When EDD is appropriate.
• How beneficial ownership differs from legal ownership.
• Why PEP status is a risk factor, not an accusation.
• The difference between unusual and suspicious activity.
• Why tipping off is prohibited or restricted.
• How sanctions screening differs from transaction monitoring.
• What makes correspondent banking higher risk.
• How trade-based money laundering manipulates value.
• How virtual assets can be used to layer funds.
• What good investigation documentation includes.
• How independent testing supports program effectiveness.

High-Yield CAMS Review Map

Common CAMS Candidate Mistakes

Exam point: Placement is often easiest to detect because cash enters regulated channels. Layering is often the most complex. Integration gives criminal proceeds an appearance of legitimacy.

Terrorist Financing vs. Money Laundering

Trap: Terrorist financing can involve clean money moving for an illicit purpose. Do not focus only on criminal source.

Proliferation Financing

Proliferation financing involves providing funds or financial services connected to weapons proliferation, restricted goods, sanctioned actors, or prohibited procurement networks. High-yield clues include:

• Dual-use goods.
• Complex shipping routes.
• Front companies.
• Sanctioned jurisdictions or entities.
• Unusual trade documentation.
• Transshipment through high-risk locations.
• Payments inconsistent with the stated business.

Beneficial Ownership

Beneficial ownership focuses on the natural persons who ultimately own, control, or benefit from a legal entity or arrangement.

High-yield points:

• Legal ownership and beneficial ownership may differ.
• A nominee, trustee, or corporate director may not be the true controller.
• Complex structures can be legitimate but require understanding.
• Control may exist through ownership, voting rights, management authority, contractual control, or other influence.
• If ownership is opaque, the risk is higher and may require escalation.

Enhanced Due Diligence Triggers

EDD is commonly associated with:

• PEPs and close associates or family members.
• High-risk jurisdictions.
• Complex or opaque ownership.
• Unusual source of wealth or source of funds.
• High-risk products such as private banking, correspondent banking, trade finance, or virtual assets.
• Adverse media or criminal allegations.
• Activity inconsistent with the customer profile.
• Sanctions proximity or heightened geopolitical risk.

EDD may include:

• Senior management approval where required by policy or regulation.
• More detailed source of funds and source of wealth analysis.
• Additional identity, ownership, and control documentation.
• More frequent reviews.
• Lower thresholds for alerting.
• Review of public records, adverse media, litigation, or regulatory history.
• Clear documentation of rationale.

Source of Funds vs. Source of Wealth

Trap: A bank statement may support source of funds, but it may not explain source of wealth.

High-Risk Customer Types

Other Commonly Tested Concepts

Virtual Asset Red Flags

• Exposure to darknet markets, ransomware wallets, scams, or sanctioned wallets.
• Use of mixers or privacy-enhancing services without clear rationale.
• Rapid conversion from fiat to crypto and out again.
• Multiple wallets controlled by the same customer without business purpose.
• Activity inconsistent with customer age, occupation, or wealth.
• IP addresses, device data, or geolocation inconsistent with profile.
• Structuring deposits to buy virtual assets.
• Use of high-risk exchanges or weakly controlled platforms.