Free CAMS Full-Length Practice Exam: 120 Questions

This free full-length CAMS practice exam includes 120 original Finance Prep questions across the exam domains.

The questions are original Finance Prep practice questions aligned to the exam outline. They are not official exam questions and are not copied from any exam sponsor.

Practice count note: exam sponsors can describe total questions, scored questions, task-based simulations, duration, or unscored/pretest-item rules differently. Always confirm current exam-day rules with the sponsor.

Before you start, skim the ACAMS CAMS Cheat Sheet if you want a compact review of AML typologies, customer due diligence, sanctions screening, suspicious activity, compliance-program controls, and common traps.

Exam snapshot

Full-length exam mix

Practice questions

Questions 1-25

Question 1

Topic: Tools and Technologies to Fight Financial Crime

A bank’s financial-crime investigations unit has a growing alert backlog. Each alert already has a risk score, but investigators spend much of their time logging into KYC, payments, screening, and adverse-media systems and manually copying evidence into case notes. Management wants to speed triage while retaining investigator judgment for escalation and reporting. What is the BEST action?

• A. Implement case-management and workflow automation that gathers relevant data into the case file, prioritizes alert queues using configured rules, and preserves an audit trail for investigator decisions.
• B. Require relationship managers to contact customers for explanations before investigators review the alert evidence.
• C. Automatically close all alerts below a fixed transaction amount so investigators can focus only on high-value activity.
• D. Replace the investigation process with a network-analysis tool that blocks all parties connected to an alerted customer.

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Automation can improve investigation efficiency without replacing the investigator’s responsibility to assess facts, document reasoning, and escalate or report where appropriate. In this scenario, the bottleneck is manual evidence collection and case administration, not the absence of human judgment. A case-management or workflow automation solution can pull KYC, transaction, screening, and adverse-media information into one workspace, prioritize or route alerts based on defined criteria, track tasks, and maintain an audit trail. That supports faster and more consistent triage while keeping final investigative decisions under appropriate human oversight.

• Closing low-value alerts by a fixed amount ignores customer, jurisdiction, behavior, and typology risk.
• Having relationship managers contact customers too early may compromise the investigation and create tipping-off concerns.
• Network analysis may help identify relationships, but automatically blocking all connected parties is overbroad and does not solve the case workflow problem.

This automation directly supports triage, data gathering, case organization, workflow routing, and documented human review.

Question 2

Topic: Understanding the Risks and Methods of Financial Crime

After an AFC compliance breach, a financial institution receives a formal supervisory finding, a monetary penalty, a mandated remediation plan, and restrictions on opening certain high-risk accounts until deficiencies are corrected. Which institutional impact is primarily illustrated?

• A. Social impact
• B. Regulatory impact
• C. Operational impact
• D. Reputational impact

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: AFC violations can affect an institution in several ways, but the impact type is identified by the facts given. Regulatory impact involves consequences from supervisory or enforcement authorities, such as findings, fines, remediation orders, license conditions, or restrictions on activities. In this scenario, the decisive facts are the formal supervisory finding, monetary penalty, mandated remediation plan, and restrictions on opening certain accounts. Those are regulatory consequences, even though they may also create operational burdens later.

• Operational impact would focus on disrupted processes, increased staffing, system changes, or control failures inside the institution.
• Reputational impact would focus on negative publicity, loss of customer confidence, or market reaction.
• Social impact would focus on harm to communities or society from enabling financial crime.

Formal supervisory findings, penalties, mandated remediation, and business restrictions are consequences imposed by regulators.

Question 3

Topic: Understanding the Risks and Methods of Financial Crime

A VASP receives an inbound transfer from a self-hosted wallet for a newly onboarded customer. Blockchain analytics shows the wallet’s transaction history and no direct sanctions exposure, but the wallet has not been linked to the customer and the customer gives only a vague explanation that the funds came from “trading profits,” inconsistent with the customer’s stated profile. What is the BEST action?

• A. Reject all self-hosted wallet transfers because wallet ownership cannot be proven through the blockchain alone.
• B. File a suspicious activity report immediately without seeking additional information because the customer’s explanation is vague.
• C. Verify customer control of the wallet and obtain risk-based source-of-funds information before accepting the activity, escalating if concerns remain unresolved.
• D. Accept the transfer because blockchain records provide full transparency and no direct sanctions exposure was identified.

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Blockchain transparency means transactions may be visible and traceable on-chain, but it does not automatically identify who controls a wallet or whether the customer’s source of funds is legitimate. In this scenario, the lack of a sanctions hit reduces one risk but does not resolve the ownership and source-of-funds concerns. The best action is a risk-based due diligence step: verify control of the wallet, request appropriate source-of-funds information, document the review, and escalate if the explanation remains inconsistent or unsupported.

• Accepting the transfer over-relies on on-chain visibility and ignores customer transparency gaps.
• Rejecting all self-hosted wallet transfers is blanket de-risking rather than a risk-based response.
• Filing immediately may be premature if reasonable additional due diligence can clarify the activity, though escalation or reporting may be needed if concerns remain.

Public blockchain data can show transaction flows, but it does not by itself establish the customer’s ownership of the wallet or legitimate source of funds.

Question 4

Topic: Building an Anti-Financial Crime Compliance Program

A bank is investigating unusual cross-border wires and has prepared a customer RFI. Before sending it, the bank receives a court order from law enforcement requiring production of records and instructing the bank not to alert the customer. The investigator pauses the RFI, preserves relevant records, and routes the matter to legal and AFC compliance for controlled handling. Which concept best matches this response?

• A. Routine periodic KYC refresh
• B. Automated transaction-monitoring tuning
• C. Customer risk-rating recalibration
• D. Compulsory law-enforcement request handling

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: When a law-enforcement request, subpoena, or court order is received, the institution should not treat the matter as an ordinary customer outreach task. The response may require legal review, confidentiality controls, record preservation, and careful coordination with AFC compliance to avoid tipping off the customer or interfering with an investigation. In this scenario, the planned RFI is paused because the court order specifically requires production of records and instructs the bank not to alert the customer. That fact changes response handling from routine investigation workflow to controlled law-enforcement request handling.

• Routine periodic KYC refresh involves updating customer information, not responding to a court order.
• Customer risk-rating recalibration may occur later, but it does not explain pausing the RFI and routing to legal.
• Automated transaction-monitoring tuning concerns scenario performance, not compulsory legal process handling.

A court order or similar compulsory request can override ordinary RFI handling and requires controlled escalation, confidentiality, and record preservation.

Question 5

Topic: Global AFC Frameworks, Governance, and Regulations

A bank is reviewing correspondent relationships with small remittance firms serving migrant workers. Rather than exiting the entire sector after elevated AML/CFT risk is identified, the AFC committee recommends customer-by-customer risk assessment, proportionate enhanced due diligence, and monitoring so legitimate users are not unnecessarily excluded from financial services. Which concept is best illustrated?

• A. Treating consumer protection issues as outside AFC governance
• B. Managing de-risking through a risk-based approach that considers financial inclusion
• C. Using public-private information sharing to replace customer due diligence
• D. Applying sanctions blocking controls to all higher-risk customer segments

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: AFC decisions can create broader conduct, ethics, and financial inclusion consequences. A blanket exit from an entire sector may reduce the institution’s exposure, but it can also push legitimate customers toward less transparent channels and undermine access to regulated financial services. A risk-based approach supports proportionate controls: assess each customer’s actual risk, apply EDD where needed, monitor activity, and document the rationale. This does not require keeping every relationship, but it does require avoiding automatic de-risking when targeted controls can manage the risk.

• Sanctions blocking is a legal control for specific sanctions exposure, not a general response to sector-level AML/CFT risk.
• Public-private information sharing can support AFC work, but it does not replace CDD or ongoing monitoring.
• Consumer protection and financial inclusion considerations can be relevant to AFC governance because control decisions may affect legitimate access to financial services.

The decision balances AFC risk controls with the potential exclusionary impact of blanket account closures.

Question 6

Topic: Building an Anti-Financial Crime Compliance Program

A bank plans to outsource first-level transaction-monitoring alert review to a new third-party vendor. The vendor’s analysts will access customer KYC files and recommend alert closures, and the vendor’s ownership information is incomplete. Procurement asks AFC to approve the vendor based only on price and a standard information-security questionnaire. What is the best action before approval?

• A. Allow a limited pilot and complete vendor due diligence after the first quality-assurance review.
• B. Treat the vendor as low risk because it will not open accounts or transact directly with customers.
• C. Require risk-based third-party due diligence on the vendor, including ownership, key personnel, AFC controls, and contractual oversight before access is granted.
• D. Approve the vendor if information security confirms that customer data will be encrypted.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Third-party due diligence should match the financial-crime risk created by the relationship. A vendor that can access KYC files and recommend alert closures may affect detection, escalation, confidentiality, and insider-threat controls. Incomplete ownership information also increases risk because the institution cannot fully understand who controls or benefits from the vendor relationship. Before approval, AFC should require risk-based due diligence covering ownership and key personnel screening, competence and control environment, conflicts or insider-threat risks, contractual rights, auditability, and ongoing oversight. Cybersecurity review is important, but it is not a substitute for AFC vendor due diligence.

• Encryption addresses data-protection risk but not ownership opacity, alert-handling quality, or AFC control accountability.
• A pilot before due diligence gives the vendor access and operational influence before key risks are assessed.
• Lack of direct customer contact does not make the vendor low risk when it can affect monitoring outcomes and access sensitive KYC data.

A vendor with customer-data access and alert-review authority requires AFC-focused due diligence and governance before approval.

Question 7

Topic: Understanding the Risks and Methods of Financial Crime

A private wealth client is introduced by a law firm. The ownership chart shows a discretionary trust owning a holding company, which owns several non-operating companies. Nominee directors sign documents, and the trust deed gives an undisclosed settlor power to replace trustees. Which beneficial ownership concern does this best illustrate?

• A. Simple corporate ownership where the registered directors are the beneficial owners
• B. Routine delegation of administrative duties to a regulated professional adviser
• C. Obscured ultimate ownership or control through a trust, layered entities, and nominees
• D. Product risk arising mainly from high transaction volume in an operating business

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Trusts, shell companies, nominee directors, and layered legal entities can be legitimate, but they are also commonly used to obscure who ultimately owns or controls assets. In this scenario, the concern is not merely that a law firm introduced the client or that directors sign documents. The key issue is that a discretionary trust, non-operating companies, nominee directors, and an undisclosed settlor with control powers make it difficult to identify the natural person exercising ultimate control. This is a beneficial ownership red flag requiring careful CDD or EDD focused on ownership, control, source of wealth, and purpose of the structure.

• Professional adviser involvement may be relevant, but it does not remove the institution’s responsibility to understand beneficial ownership.
• Registered directors are not necessarily beneficial owners, especially when they are nominees.
• High transaction volume may indicate product or activity risk, but the facts point to ownership and control opacity.

The structure creates uncertainty about the natural person who ultimately controls the assets or decisions.

Question 8

Topic: Building an Anti-Financial Crime Compliance Program

A corporate customer was onboarded as medium risk. Six months later, it adds an offshore beneficial owner, begins sending funds to a higher-risk jurisdiction, and is linked in adverse media to possible corruption. Which due-diligence response best matches this change?

• A. Automatically exit the relationship before collecting updated customer information.
• B. Treat the change only as a transaction-monitoring alert tuning issue.
• C. Wait until the next scheduled periodic review because onboarding CDD was already completed.
• D. Conduct a trigger-based CDD refresh, apply EDD as appropriate, and reassess the customer risk rating.

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Customer due diligence is not a one-time onboarding activity. When material risk factors increase after onboarding—such as new beneficial ownership, exposure to higher-risk jurisdictions, or credible adverse media—the firm should perform an event- or trigger-based refresh. That refresh updates KYC/CDD information, assesses whether enhanced due diligence is needed, and recalibrates the customer risk rating and controls. The activity may also support investigation or suspicious activity reporting if facts indicate suspicion, but the due-diligence response is to reassess and update the customer profile rather than wait for a scheduled review or automatically terminate the relationship.

• Waiting for the scheduled review ignores a material trigger event that may change the customer’s risk profile.
• Treating the issue only as monitoring tuning misses the need to update KYC/CDD and beneficial ownership information.
• Automatic exit is not the first due-diligence response; risk-based review and escalation should occur before any offboarding decision.

Material post-onboarding risk changes should trigger updated due diligence, possible EDD, and a revised risk assessment.

Question 9

Topic: Tools and Technologies to Fight Financial Crime

A regional bank’s transaction monitoring program relies on broad rules-based thresholds that generate a large backlog of low-quality alerts. The bank has several years of alert dispositions, suspicious activity filings, and customer-risk data, but some source-system fields are inconsistent. Management wants to use AI or machine learning to improve efficiency when moving beyond the current rules. What is the best action?

• A. Pilot a governed machine-learning alert-scoring layer using cleansed historical data, compare results with current rules, and keep investigator review before wider deployment.
• B. Replace the existing rules immediately with a model that automatically closes low-scoring alerts without investigator review.
• C. Add more fixed threshold rules to capture every unusual transaction type before considering machine learning.
• D. Use machine learning only to reduce investigation staffing, without changing alert logic or measuring detection outcomes.

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: AI and machine-learning tools can improve AFC efficiency by ranking alerts, identifying complex patterns, and reducing false positives that broad rules often produce. A sound transition should not simply switch off existing controls. The bank should first address data quality, pilot the model, compare outcomes against current rules, document performance, and retain human review for investigation and reporting decisions. This approach improves effectiveness while managing model risk, explainability, governance, and regulatory expectations. The available historical dispositions and filing data are useful for supervised learning, but inconsistent fields make data cleansing and validation essential before broad deployment.

• Immediate replacement and auto-closure overrely on the model and weaken investigation governance.
• Adding more fixed thresholds may increase noise rather than improve risk-based prioritization.
• Reducing staff without measuring detection quality treats AI as cost cutting, not an effectiveness control.

This uses AI/ML to prioritize and improve alert quality while controlling data, validation, and human-review risks during transition.

Question 10

Topic: Global AFC Frameworks, Governance, and Regulations

An AFC analyst is mapping global AML/CFT governance actors. The description reads: “A regional organization of member jurisdictions promotes FATF Recommendations in its region, conducts peer mutual evaluations, monitors follow-up, and shares regional typologies.” Which concept does this description match?

• A. Egmont Group
• B. FATF-style regional body (FSRB)
• C. FATF Recommendations
• D. Financial intelligence unit (FIU)

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: FATF-style regional bodies extend the global FATF framework into specific regions. They help jurisdictions understand and implement FATF standards, conduct or participate in mutual evaluations, monitor progress on deficiencies, and develop regional typologies. Their role is not to receive suspicious transaction reports or investigate cases; it is to support consistent implementation and assessment of AML/CFT and related financial-crime standards across member jurisdictions. The stem’s references to a regional membership structure, peer mutual evaluations, follow-up monitoring, and regional typologies point directly to an FSRB.

• A financial intelligence unit receives and analyzes suspicious activity or transaction reports; it is not a regional peer-assessment body.
• The Egmont Group supports cooperation among FIUs, but it does not conduct regional mutual evaluations of FATF implementation.
• The FATF Recommendations are the standards being implemented and assessed, not the regional body performing that work.

FSRBs support regional implementation of FATF standards through peer assessment, follow-up, cooperation, and typologies work.

Question 11

Topic: Global AFC Frameworks, Governance, and Regulations

A regional bank is refreshing its AML scenarios and staff training. The team wants an external source that describes emerging financial-crime trends, common methods, and practical indicators observed across cases, rather than a source focused on one institution’s deficiencies or a country’s technical compliance. Which report source best matches this goal?

• A. Regulatory enforcement action against a single financial institution
• B. Public typologies report issued by an FIU, FATF, or FATF-style regional body
• C. FATF mutual evaluation report on one country’s AML/CFT framework
• D. Internal suspicious activity report filed on one customer relationship

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: When the goal is trend identification, typology awareness, or improving monitoring and training controls, typologies reports are usually the most relevant source. FIUs, FATF, and FATF-style regional bodies publish typologies to explain how financial crime is being conducted, what red flags have been observed, and how institutions can adapt controls. These reports are broader than a single case and more operational than a country-level compliance assessment. Enforcement actions and internal reports can provide useful lessons, but they are narrower and often focused on specific failures or customers rather than broader patterns.

• Enforcement actions can highlight control weaknesses, but they usually focus on one institution’s misconduct or deficiencies.
• Mutual evaluation reports assess a country’s AML/CFT framework and effectiveness, not primarily operational typologies.
• Internal suspicious activity reports are case-specific and generally not the best external source for broad trend awareness.

Typologies reports are designed to summarize trends, methods, indicators, and lessons that can inform controls and awareness.

Question 12

Topic: Tools and Technologies to Fight Financial Crime

A digital bank wants low-risk applicants to complete onboarding with minimal friction, while applicants with higher AFC indicators—such as adverse media, PEP exposure, or inconsistent identity data—must provide additional evidence or receive manual review before account opening. Which onboarding control best matches this approach?

• A. Periodic KYC refresh after account opening
• B. Post-onboarding transaction monitoring as the only control
• C. Mandatory enhanced due diligence for every applicant
• D. Risk-based step-up verification and due diligence

Best answer: D

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: A risk-based digital onboarding control uses initial data, screening, identity checks, and risk scoring to decide how much friction is appropriate before opening the account. Low-risk applicants can proceed through streamlined checks, improving customer experience. Applicants with higher AFC indicators are routed to stronger controls, such as additional document verification, liveness checks, enhanced due diligence, or manual review. This balances customer experience with financial-crime risk because the control intensity is proportionate to the risk presented at onboarding, rather than applying the same burden to all customers or deferring key checks until after account opening.

• Mandatory enhanced due diligence for every applicant over-controls low-risk customers and creates unnecessary friction.
• Post-onboarding transaction monitoring is important but does not replace risk-based controls before account opening.
• Periodic KYC refresh is an ongoing lifecycle control, not the primary onboarding control described.

Step-up controls add friction only when the applicant’s risk indicators justify stronger verification or review.

Question 13

Topic: Tools and Technologies to Fight Financial Crime

A bank’s real-time payment-screening tool flags an outgoing wire before release. The beneficiary name is a close fuzzy match to an alias on a UN sanctions list, and the beneficiary address includes the same city and country as the listed party. Operations notes that similar names have often been false positives and asks to release the payment to meet the cutoff. What is the BEST action?

• A. Ask the customer to confirm whether the beneficiary is the sanctioned party, then release the payment if the customer denies it.
• B. Release the payment and document that the alert will be reviewed after processing.
• C. Keep the payment pending and escalate the alert with the match evidence to the sanctions compliance team before release.
• D. Close the alert as a false positive because fuzzy-name matches often generate noise.

Best answer: C

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: When screening identifies a potential sanctions or prohibited-party concern before a transaction is released, the safest risk-based action is to prevent completion until the alert is reviewed by the appropriate sanctions escalation function. Here, the fuzzy name match is strengthened by an address connection, so operations should not override the alert for processing convenience. The compliance team should assess identifiers, list data, transaction context, and internal policy to decide whether the hit is a false positive, a true match, or requires further action. Customer confirmation alone is not reliable, and post-transaction review may allow a prohibited payment to occur.

• Releasing first and reviewing later defeats interdiction controls for a pre-release sanctions alert.
• Closing the alert based only on historical false positives ignores the additional address similarity.
• Asking the customer to self-clear the match is not an adequate sanctions disposition control.

A potential sanctions match with supporting identifiers should be held and escalated for sanctions review before the transaction is processed.

Question 14

Topic: Building an Anti-Financial Crime Compliance Program

A bank is considering a new payment processor that will provide same-day cross-border payouts for online gaming merchants. The processor operates through agents in several higher-risk jurisdictions, has a layered offshore ownership structure, and wants activation before providing agent due diligence files. What is the BEST control response?

• A. File a suspicious transaction report immediately based only on the high-risk profile and requested activation speed.
• B. Onboard the processor under standard CDD and review agent due diligence during the first periodic KYC refresh.
• C. Pause activation and perform enhanced due diligence on ownership, licensing, agent controls, and merchant risk before senior approval and enhanced monitoring.
• D. Decline the relationship automatically because online gaming and higher-risk jurisdictions are involved.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: High-risk scenarios should trigger proportionate controls before exposure is accepted. Here, the customer combines several elevated risks: a payment processor, online gaming merchants, same-day cross-border payouts, agents in higher-risk jurisdictions, incomplete third-party due diligence, and opaque ownership. The best response is not automatic rejection or ordinary onboarding, but enhanced due diligence and governance before activation. The institution should understand beneficial ownership and control, licensing or regulatory status, agent oversight, merchant onboarding standards, expected activity, and monitoring needs. Senior management or designated governance approval may be appropriate if the relationship remains within risk appetite. Suspicious activity reporting generally requires a suspicion based on facts and analysis, not merely the presence of a high-risk profile.

• Standard CDD is insufficient because key agent, ownership, and control information is missing before the high-risk service begins.
• Automatic decline may be appropriate only if the risk is outside risk appetite; the stem does not state that.
• Immediate suspicious reporting is premature because high-risk characteristics alone do not establish suspicious activity.

The facts require a risk-based control response before enabling a high-risk product, channel, sector, and jurisdiction exposure.

Question 15

Topic: Building an Anti-Financial Crime Compliance Program

A retail bank requires manual enhanced due diligence for every new digital account applicant after several mule-account cases. The cases shared specific indicators: synthetic-identity concerns, disposable email domains, and immediate third-party transfer activity. The blanket rule has increased onboarding abandonment among salaried domestic customers whose identity and source-of-funds checks are otherwise complete, with no meaningful increase in confirmed suspicious findings. What is the BEST action?

• A. Remove manual onboarding reviews for all digital applicants to reduce abandonment and rely only on post-opening transaction monitoring.
• B. File suspicious activity reports for all applicants who abandon onboarding after being asked for additional information.
• C. Replace the blanket review with risk-based triggers targeting the mule-account indicators, and monitor outcomes against risk and customer-impact metrics.
• D. Keep the blanket manual review because any mule-account exposure justifies the highest level of onboarding control for all applicants.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: A risk-based AFC program should apply stronger controls where risk indicators support them, not impose the same friction on all customers when evidence shows the risk is concentrated. Here, the blanket EDD rule creates measurable customer impact for lower-risk applicants and does not improve suspicious-finding rates. The better action is to redesign the control around the actual mule-account indicators, such as synthetic-identity concerns, disposable email domains, and immediate third-party transfer activity. The bank should also track effectiveness metrics, such as detection quality, false positives, abandonment, and residual risk, to confirm the control remains proportionate.

• Keeping blanket EDD ignores proportionality and the evidence that low-risk applicants are not producing meaningful additional findings.
• Removing all manual review overcorrects and fails to address the specific mule-account indicators.
• Treating abandonment alone as reportable suspicion confuses customer friction with evidence of suspicious activity.

This aligns control intensity to demonstrated risk while testing whether the revised control remains effective.

Question 16

Topic: Understanding the Risks and Methods of Financial Crime

A bank analyst reviews an existing corporate customer. Public records allege the company’s director won government contracts by paying bribes. Soon after contract payments arrive, the account sends large “consulting fee” transfers to an offshore shell company with no clear services, then funds a property purchase held by the director’s relative. Which interpretation and action is BEST?

• A. Do not escalate until law enforcement proves the director committed bribery, because laundering cannot be suspected before a conviction.
• B. Treat the bribe payments themselves as the laundering activity and close the case unless the offshore shell company is on a sanctions list.
• C. Classify the matter only as procurement fraud because property purchases are not relevant once contract payments have entered the account.
• D. Escalate the case as suspected laundering of potential bribery proceeds, distinguishing the alleged bribery as the predicate crime and the transfers/property purchase as concealment activity.

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: A predicate crime is the underlying offense that generates illicit proceeds, such as bribery, fraud, tax evasion, or trafficking. Money laundering is the later conduct used to place, layer, conceal, or integrate those proceeds so they appear legitimate or are harder to trace. In this scenario, the alleged bribery explains why the contract proceeds may be criminal property. The offshore shell-company “consulting” payments and related-party property purchase are separate indicators of laundering because they may disguise ownership, purpose, or source of funds. The best action is to document the distinction and escalate based on suspicion; a criminal conviction is not required for internal escalation or suspicious activity consideration.

• Waiting for a conviction sets too high a standard for AFC escalation; suspicion may arise from credible facts and transaction patterns.
• Treating sanctions screening as the deciding issue misses the bribery and laundering indicators.
• Limiting the case to procurement fraud ignores the later movement and asset purchase used to conceal or integrate proceeds.

The alleged bribery is the possible source offense, while the shell-company transfers and related-party property purchase may disguise or integrate its proceeds.

Question 17

Topic: Global AFC Frameworks, Governance, and Regulations

A national authority receives suspicious transaction reports and other disclosures from reporting entities, analyzes them with other available information, and disseminates financial intelligence to competent domestic authorities or foreign counterparts when appropriate. Which concept does this description match?

• A. Financial intelligence unit (FIU)
• B. Prosecutorial authority
• C. Prudential supervisor
• D. UN sanctions committee

Best answer: A

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: A financial intelligence unit is the national center for handling financial intelligence. Reporting entities submit suspicious activity or transaction reports and other required disclosures to the FIU. The FIU analyzes those reports, often combining them with additional data, and disseminates intelligence to law enforcement, supervisors, tax authorities, or foreign FIUs when appropriate. This differs from a sanctions body, which designates or oversees sanctions measures; a prudential supervisor, which focuses on safety, soundness, and compliance oversight; and prosecutors, who pursue criminal cases after investigative development.

• A UN sanctions committee is linked to sanctions designations and implementation oversight, not routine receipt and analysis of suspicious reports.
• A prudential supervisor may examine institutions’ AFC controls, but it is not the central hub for financial intelligence dissemination.
• A prosecutorial authority may use FIU intelligence in a case, but it does not perform the FIU’s central intake and analysis function.

An FIU is the central authority for receiving, analyzing, and disseminating financial intelligence related to suspected financial crime.

Question 18

Topic: Understanding the Risks and Methods of Financial Crime

A bank is reviewing an ecommerce marketplace that is applying for payment services. The marketplace will be the named merchant, but its payment diagram shows customer funds moving through unrelated third-party wallets and pooled PSP settlement accounts before reaching the marketplace. The applicant says it cannot provide underlying payer or wallet-owner details because the PSPs control that data. What is the BEST action for the bank’s customer risk assessment?

• A. Automatically reject the customer because any pooled third-party settlement flow is prohibited.
• B. Keep the customer at standard risk because the marketplace is the named merchant and receives the final settlement.
• C. Treat the activity as lower risk because PSPs usually perform their own onboarding and transaction monitoring.
• D. Increase the customer’s risk assessment and perform enhanced due diligence on the third-party payment flow, PSP relationships, settlement accounts, and available transparency controls.

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Third-party payment flows can create opacity when the financial institution cannot clearly identify who initiated payments, who controls intermediary wallets, or how funds move through pooled settlement accounts. In an ecommerce and PSP context, that opacity can weaken source-of-funds understanding, customer risk assessment, transaction monitoring, sanctions screening, and investigation capabilities. The best response is not to assume the flow is acceptable or prohibited solely because a PSP is involved. A risk-based approach requires updating the risk assessment and obtaining enhanced information about the payment chain, PSP roles, settlement accounts, data access, and compensating controls before deciding whether the relationship fits the institution’s risk appetite.

• Relying only on the named merchant ignores the opaque third-party payment path.
• Assuming PSP controls are sufficient fails because the bank lacks evidence of visibility into underlying parties.
• Automatically rejecting the customer is not the best risk-based action unless due diligence shows the risk cannot be managed.

Third-party wallets and pooled settlement accounts obscure the origin of funds and parties involved, so the opacity should affect risk scoring and due diligence.

Question 19

Topic: Building an Anti-Financial Crime Compliance Program

A multinational bank’s horizon-scanning team identifies two developments: a binding local rule requiring documented source-of-wealth checks for certain high-risk legal entity customers, and a regulator guidance paper encouraging stronger risk-based adverse media screening. The global AFC policy owner is updating the CDD policy and related onboarding procedures. Which action is BEST?

• A. Treat the binding rule as a local operations matter and address only the adverse media guidance in the global policy.
• B. Perform an impact assessment, update the policy to reflect mandatory obligations and risk-based guidance, and revise procedures to specify local steps, evidence, and ownership.
• C. Keep the policy unchanged until an examination finding confirms that the current CDD standard is inadequate.
• D. Copy both documents into the global policy so all countries follow the same wording and controls.

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Regulatory horizon scanning should feed a controlled policy and procedure update process. Binding legal or regulatory obligations must be mapped to affected products, customers, jurisdictions, and processes, then reflected in policy standards and detailed procedures. Regulatory guidance may not be legally binding in the same way, but it should still be assessed against the institution’s risk profile and used to improve controls where appropriate. A sound response distinguishes mandatory requirements from supervisory expectations, obtains appropriate governance approval, and gives staff clear procedural instructions on steps, evidence, roles, and escalation.

• Copying regulatory text into a global policy may create unclear or excessive requirements and fails to tailor procedures to local applicability.
• Waiting for an examination finding is reactive and inconsistent with effective horizon scanning and change management.
• Treating the binding rule only as a local operations issue misses the need for policy governance and documented implementation of mandatory obligations.

This approach distinguishes binding requirements from guidance and translates both into governed, risk-based policy and procedure changes.

Question 20

Topic: Global AFC Frameworks, Governance, and Regulations

A multinational bank is reviewing a payment for a customer booked in one country, processed through a correspondent in another, and involving a counterparty in a third. The applicable rules overlap: one regime may require sanctions blocking, while another limits cross-border sharing of customer data. Which response is most appropriate?

• A. Follow only the requirements of the country where the customer account is booked.
• B. Map the applicable obligations, escalate the conflict to compliance and legal, and apply the most restrictive lawful control or approved local workaround.
• C. Apply the least restrictive requirement unless a suspicious transaction report threshold is met.
• D. File reports in every jurisdiction involved before completing the sanctions review.

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: When a customer or transaction touches multiple jurisdictions, an AFC team should not assume that one location’s rules control the entire case. The appropriate response is to identify all applicable AML/CFT, sanctions, privacy, and reporting obligations; document the analysis; and escalate true conflicts to compliance, legal, or a governance forum. Institutions generally seek to apply the stricter applicable control where lawful, while using approved local workarounds when one obligation, such as data localization or tipping-off restrictions, limits how another control can be performed. This is different from regulatory arbitrage, blanket de-risking, or automatic multi-jurisdictional reporting.

• Limiting the review to the booking country ignores correspondent, counterparty, sanctions, and extraterritorial obligations that may also apply.
• Applying the least restrictive rule is regulatory arbitrage and can leave the institution exposed to enforcement risk.
• Filing everywhere confuses reporting obligations with sanctions and privacy analysis; reports should be made only where legally required and supported.

Overlapping regimes require a documented jurisdictional analysis and escalation so the institution can meet the strictest lawful obligation without violating another applicable law.

Question 21

Topic: Tools and Technologies to Fight Financial Crime

A bank’s transaction-monitoring system is designed to alert on high-risk cross-border wire patterns. After a core banking migration, a quality review finds that many customer residence fields are blank, related accounts are no longer linked under the same customer ID, and alert volumes have dropped despite stable wire activity. What is the BEST action?

• A. Correct the source-to-monitoring data mapping, validate customer and account linkage, and reprocess the affected activity.
• B. Replace the rules-based monitoring system with a machine-learning model using the same migrated data.
• C. Close the low-volume alert batches as expected migration noise and continue normal monitoring.
• D. Lower the monitoring thresholds until alert volumes return to pre-migration levels.

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: When poor data quality weakens an AFC technology control, the priority is to remediate the data problem at its source and validate that the control is working as intended. Blank residence fields and broken customer-account linkage directly affect segmentation, aggregation, and risk scoring, so the reduced alert volume may reflect missed detection rather than lower risk. The best action is to correct the feed or mapping issue, test completeness and linkage, and reprocess the impacted period so potentially missed activity is assessed. Tuning thresholds or changing tools before fixing the data can mask the defect and create unreliable alerts.

• Lowering thresholds treats the symptom, not the missing and mislinked data driving unreliable detection.
• Closing the alert batches assumes the control is reliable despite evidence that key monitoring inputs are defective.
• Replacing the system does not solve the problem if the new model receives the same poor-quality migrated data.

Fixing and validating the underlying data restores the control’s reliability before alert results are relied upon.

Question 22

Topic: Tools and Technologies to Fight Financial Crime

A bank’s digital onboarding workflow is screening a new corporate customer. The company registry API confirms the entity is active, but the directors field is unavailable due to a data-source error. A commercial ownership database lists a 70% owner as “A. Petrova,” while an adverse-media feed returns a low-confidence match to a similarly named person linked to sanctions-evasion procurement. The workflow proposes standard-risk approval because there is no exact list match. What is the BEST action?

• A. Allow onboarding but schedule the missing director and adverse-media checks for the next periodic review cycle.
• B. Route the case for manual review to reconcile the missing director data and assess the possible adverse-media match before approval.
• C. Approve onboarding as standard risk because the registry confirms the entity is active and no exact list match was found.
• D. Reject the customer automatically because any adverse-media name similarity creates unacceptable sanctions risk.

Best answer: B

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Automated external data can improve screening, but it should not replace judgment when key data is incomplete or conflicting. Here, the directors field is missing, the ownership source identifies a majority owner, and adverse media produces a possible match involving sanctions-evasion procurement. Even though there is no exact list match, these facts affect the customer’s risk profile and the reliability of the automated standard-risk decision. The appropriate control is to pause or route the case for manual review, validate identifiers, reconcile sources, and document the risk-based decision before approval. Automatic approval would rely on incomplete evidence, while automatic rejection would overstate an unresolved low-confidence match.

• Approving based only on active registry status ignores missing director data and unresolved adverse media.
• Automatic rejection treats a low-confidence similarity as confirmed evidence without review.
• Deferring review until periodic refresh allows onboarding before material risk indicators are assessed.

Conflicting and incomplete external data affecting ownership and adverse-media risk should be manually reviewed before making the onboarding decision.

Question 23

Topic: Building an Anti-Financial Crime Compliance Program

A bank’s senior leaders from compliance, legal, operations, risk, and customer-facing businesses meet monthly to review AFC KRIs, significant investigation trends, high-risk customer escalations, policy exceptions, and resource gaps. The group can direct remediation, escalate unresolved issues to executive management or the board, and align actions with the bank’s AFC risk appetite. Which concept best matches this description?

• A. AFC governance committee
• B. Independent testing function
• C. First-line customer relationship team
• D. Financial intelligence unit

Best answer: A

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Governing committees in an AFC program provide structured oversight and decision-making across functions. They review management information such as KRIs, investigation trends, exceptions, and remediation status; help resolve cross-functional issues; and escalate material concerns to senior management or the board when needed. They are not a substitute for day-to-day control execution, investigations, or independent testing. In this scenario, the group’s senior, cross-functional membership and authority to direct remediation and escalate unresolved issues make it an AFC governance committee or financial crime risk committee.

• A financial intelligence unit receives and analyzes suspicious activity reports or intelligence, but it is not the bank’s internal cross-functional governance forum.
• A first-line customer relationship team owns customer interactions and some front-line controls, but it does not provide enterprise AFC oversight.
• An independent testing function assesses control design and effectiveness, but it does not make ongoing AFC governance decisions.

An AFC governance committee provides cross-functional oversight, decision support, and escalation for material financial-crime compliance matters.

Question 24

Topic: Tools and Technologies to Fight Financial Crime

An AFC team uses an automated customer-risk tool to refresh KYC ratings. A corporate customer is scored low risk, but the source-system feed omitted beneficial-owner nationality and country-of-operation fields, and the customer recently added cross-border payment activity. What is the BEST action for the analyst before relying on the tool output?

• A. Accept the low-risk score because the tool is approved for periodic KYC refreshes.
• B. File a suspicious activity or transaction report solely because the missing fields affect the tool output.
• C. Route the case for data-quality remediation and manual review before confirming the risk rating.
• D. Permanently reclassify the customer as high risk because any missing KYC field invalidates automated scoring.

Best answer: C

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Automated AFC tools are only as reliable as the data used to generate their outputs. Missing beneficial-owner and country-of-operation information can materially affect customer risk scoring, especially when the customer has added cross-border payment activity. The best action is not to ignore the tool, but to treat the result as requiring review: remediate or obtain the missing information, assess whether the new activity changes the risk profile, and document the decision. Tool approval does not eliminate the need for human review when known data limitations may affect the outcome.

• Accepting the score overlooks a known data-quality limitation that may directly affect the rating.
• Filing a report solely due to incomplete data confuses data remediation with a suspicion-based reporting decision.
• Permanently assigning high risk is too rigid; the rating should be reassessed after missing information and activity context are reviewed.

The low-risk output may be unreliable because material customer and activity data needed for the model are missing or outdated.

Question 25

Topic: Building an Anti-Financial Crime Compliance Program

An AFC investigator concludes that a customer’s wire activity is inconsistent with its stated business purpose and recommends escalation for possible suspicious transaction reporting. Which documentation best supports the investigation conclusion and escalation decision?

• A. A policy excerpt stating that suspicious activity must be escalated to the reporting team
• B. A quality assurance checklist showing that sampled closed alerts are reviewed periodically
• C. A case narrative that links KYC information, transaction analysis, external research, evidence reviewed, and the rationale for escalation
• D. A transaction monitoring rule description explaining why the original alert was generated

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Investigation documentation should allow an independent reviewer to understand what was reviewed, how the facts were analyzed, and why the investigator reached a conclusion. For an escalation or possible suspicious activity report, the strongest support is a case narrative with relevant KYC facts, transaction details, external information, evidence considered, and a clear rationale. Rule descriptions, policies, and quality assurance materials may support the broader compliance program, but they do not by themselves substantiate the case-specific conclusion.

• A monitoring rule description explains alert generation, not whether the activity is suspicious after investigation.
• A policy excerpt establishes the escalation requirement, but it does not document the facts and reasoning in this case.
• A quality assurance checklist tests process oversight, not the evidentiary basis for this escalation.

A well-supported case narrative connects the facts and analysis to the investigator’s conclusion and escalation recommendation.

Questions 26-50

Question 26

Topic: Tools and Technologies to Fight Financial Crime

A bank’s mobile app uses document OCR, selfie liveness, and sanctions screening for straight-through retail onboarding. A new applicant passes those automated checks, but the stated residential address cannot be validated against reference data, and the device/IP location is in a different high-risk jurisdiction from the claimed residence. What is the best action before account opening?

• A. Pause straight-through approval and route the case for manual review using reliable external data to resolve the discrepancies.
• B. Approve the customer because the identity document, liveness, and sanctions checks were successful.
• C. Reject the application solely because the device/IP location differs from the claimed residence.
• D. Ask the applicant to resubmit the same document and selfie through the mobile app.

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Digital onboarding can support efficient customer identification, but it should not be treated as conclusive when important data points conflict. A passed document, liveness, and sanctions check confirms only part of the onboarding risk picture. An address that cannot be validated and a device/IP location in a different high-risk jurisdiction create unresolved risk that warrants additional controls before account opening. The risk-based response is to pause straight-through processing and use manual review, independent databases, reliable external sources, or additional verification to determine whether the discrepancy is explainable or suspicious.

• Automated approval ignores unresolved address and jurisdiction-risk indicators.
• Immediate rejection may be disproportionate because the discrepancy may have a legitimate explanation.
• Resubmitting the same document and selfie does not address the address-validation or geolocation conflict.

Conflicting location and unvalidated address are risk signals that automated checks alone have not resolved.

Question 27

Topic: Building an Anti-Financial Crime Compliance Program

A corporate customer was onboarded as low risk. Ongoing monitoring now shows a rapid shift to large third-party payments involving a higher-risk jurisdiction, and updated registry information shows a new beneficial owner who is a foreign politically exposed person. The next scheduled periodic review is 18 months away, and no transaction has yet been confirmed as suspicious. What is the best action?

• A. Wait until the scheduled periodic review because no suspicious transaction has been confirmed.
• B. Trigger an event-driven review, update the customer risk rating, and perform enhanced due diligence appropriate to the new risk factors.
• C. File a suspicious transaction report solely because the new beneficial owner is a foreign PEP.
• D. Immediately exit the relationship because payments involve a higher-risk jurisdiction.

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: When customer risk factors increase after onboarding, the institution should not rely only on the original risk rating or wait for the next periodic review. A material change—such as new beneficial ownership by a foreign PEP and activity involving a higher-risk jurisdiction—should trigger an event-driven CDD refresh. The due-diligence response should be risk based and may include updating beneficial ownership information, understanding the purpose and expected activity, assessing source of funds or wealth where appropriate, obtaining required approvals, and adjusting ongoing monitoring. A suspicious activity report may be needed if investigation identifies suspicion, but increased risk alone does not automatically mean suspicious activity. Automatic exit is also not the best first response unless the risks cannot be understood or controlled within the institution’s risk appetite.

• Waiting for the periodic review ignores material changes discovered through ongoing monitoring.
• Filing solely because of PEP status confuses elevated risk with established suspicion.
• Immediate exit may be appropriate in some cases, but only after a risk-based assessment shows the relationship cannot be managed.

Material post-onboarding changes require refreshed CDD and risk-based EDD rather than waiting for the next scheduled review.

Question 28

Topic: Understanding the Risks and Methods of Financial Crime

A private bank is onboarding a customer who is not a public official. KYC shows she is the adult daughter of a country’s minister of energy, is the beneficial owner of a newly formed commodities trading company, and expects a $3 million incoming transfer from an offshore consulting firm while giving only vague explanations of her wealth. What is the BEST action?

• A. Screen the customer against sanctions lists and onboard her if no exact list match is found.
• B. Escalate the relationship as PEP-related high risk and perform EDD on source of wealth, source of funds, and senior approval before onboarding.
• C. Reject the customer automatically because all relatives of public officials must be prohibited.
• D. Proceed with standard CDD because the customer does not personally hold public office.

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: PEP risk is not limited to someone who personally holds public office. Family members and close associates of a person entrusted with a prominent public function can present heightened bribery, corruption, and money-laundering risk, especially where the customer’s business, wealth, or funds are difficult to explain. The bank should not rely only on the absence of a sanctions hit or the fact that the customer is not herself an official. The best action is to treat the relationship as PEP-related high risk, escalate according to policy, obtain enhanced information on source of wealth and source of funds, and secure appropriate senior management approval before deciding whether to onboard.

• Standard CDD misses the PEP-related risk created by the immediate family connection and source-of-wealth concerns.
• Automatic rejection is an inappropriate blanket response; a risk-based assessment and EDD should come first.
• Sanctions screening alone does not address corruption exposure, beneficial ownership, or unexplained offshore funding.

The family relationship to a prominent public official plus unclear wealth and offshore funding warrants PEP-related EDD and governance approval.

Question 29

Topic: Global AFC Frameworks, Governance, and Regulations

A financial institution joins a formally governed forum with law enforcement, the financial intelligence unit, regulators, and peer institutions. Within legal limits, participants exchange typologies, threat indicators, and feedback on cases so firms can refine monitoring and detect emerging financial-crime patterns earlier. Which concept is described?

• A. Enhanced due diligence on correspondent banking relationships
• B. Mutual legal assistance between governments
• C. Public-private partnership for financial-crime intelligence sharing
• D. Suspicious activity or transaction reporting to the FIU

Best answer: C

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Public-private partnerships bring together public authorities and private-sector participants to share financial-crime intelligence, typologies, threat indicators, and feedback in a controlled and lawful way. Their purpose is to improve the quality of detection, investigations, and risk understanding across the financial system. They do not replace a firm’s own customer due diligence, monitoring, escalation, or suspicious activity reporting obligations. Instead, they help institutions identify emerging typologies, tune monitoring controls, prioritize higher-risk activity, and understand law-enforcement priorities while respecting confidentiality, data protection, and legal gateways.

• Mutual legal assistance is primarily a formal government-to-government process for obtaining evidence or cooperation across borders.
• Suspicious activity or transaction reporting is a reporting obligation from a firm to an FIU, not a collaborative intelligence-sharing forum.
• Enhanced due diligence on correspondent banking is a customer-risk control, not a public-private mechanism for sharing financial-crime intelligence.

Public-private partnerships enable lawful intelligence sharing between public authorities and private firms to improve detection of financial crime.

Question 30

Topic: Tools and Technologies to Fight Financial Crime

An AFC team is integrating two KYC systems into a monitoring platform. Both systems provide a field named onboarding date, but one uses the first account-opening date and the other uses the latest KYC refresh date. The monitoring rules produce inconsistent periodic-review triggers because the same field name has different meanings. Which issue is primarily illustrated?

• A. Data definitions issue
• B. Data access issue
• C. Taxonomy issue
• D. Data integrity issue

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: A data definitions issue arises when a field, attribute, or data element is not consistently defined across systems or business units. Here, the AFC tool receives an onboarding date from both KYC systems, but the field represents two different events. That creates inconsistent monitoring results even if the data is otherwise available and accurately transmitted. Data access would concern whether the tool or users can retrieve the needed data. Data integrity would focus on whether the data is accurate, complete, and unaltered. Taxonomy would concern classification structures, such as customer types, product categories, or alert reason codes.

• Data access is not the main issue because the platform receives the field from both systems.
• Data integrity is tempting, but the stem points to inconsistent meaning rather than missing, corrupted, or inaccurate records.
• Taxonomy would involve inconsistent classification categories or hierarchies, not the definition of a specific date field.

The problem is that the same data field is defined differently across source systems, causing the AFC tool to interpret it inconsistently.

Question 31

Topic: Global AFC Frameworks, Governance, and Regulations

An international bank’s AFC team reviews a special report from a non-governmental research organization describing emerging laundering typologies linked to environmental crime. The report was not issued by a regulator, FIU, or legislature. The team uses it to refine its enterprise risk assessment and monitoring scenarios while separately checking applicable laws and supervisory expectations. Which concept best matches this use of the report?

• A. Suspicious activity reporting standard set by an FIU
• B. Non-binding typology-based risk intelligence
• C. Binding regulatory requirement requiring immediate policy adoption
• D. Regulatory examination finding requiring a remediation plan

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Reports and typologies from non-government bodies, research institutes, industry groups, or civil society can be valuable AFC risk intelligence. They may highlight emerging methods, sectors, red flags, or geographic exposure that a firm should consider under a risk-based approach. However, unless incorporated into law, regulation, supervisory guidance, or contractual obligations, they are not direct legal requirements. In the scenario, the bank appropriately uses the report to reassess risk and consider monitoring changes, while separately validating what binding obligations apply.

• Treating the report as a binding regulatory requirement overstates the authority of a non-government source.
• A regulatory examination finding would come from a supervisor or examiner, not from an external research report.
• An FIU reporting standard concerns official suspicious activity or transaction reporting expectations, not general typology intelligence from a non-government body.

A non-government special report can inform risk understanding and control calibration without itself creating direct legal obligations.

Question 32

Topic: Global AFC Frameworks, Governance, and Regulations

A national risk assessment published by the bank’s primary regulator identifies increased money laundering risk in cross-border trade finance involving free-trade zones and opaque beneficial ownership. A sectoral assessment for banks notes weak CDD and transaction monitoring controls in this area. Your institution offers trade-finance services to import/export customers, but its enterprise risk assessment still rates the product as moderate risk using a three-year-old methodology. What is the BEST action?

• A. Update the enterprise and product risk assessments to reflect the national and sectoral findings, then adjust due diligence and monitoring controls for exposed customers.
• B. Exit all trade-finance customers connected to free-trade zones to eliminate the identified exposure.
• C. File suspicious activity or transaction reports for all customers using cross-border trade finance until the risk decreases.
• D. Keep the current rating until internal alerts, losses, or regulator findings confirm the external assessment applies to the institution.

Best answer: A

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: National and sectoral risk assessments are important external inputs to an institution’s risk-based approach. They do not automatically determine the outcome for every customer, but they should prompt the institution to reassess whether its own inherent risk ratings, customer risk factors, due diligence standards, and monitoring scenarios remain appropriate. Here, the institution has direct product exposure to the risk highlighted by both assessments, and its methodology is dated. The best action is to update the enterprise and product risk assessments and apply proportionate controls, such as enhanced beneficial ownership review, trade-document scrutiny, or targeted monitoring for exposed customers.

• Filing reports for all trade-finance customers confuses elevated risk with case-specific suspicion.
• Blanket exit from free-trade-zone exposure is de-risking, not a risk-based control response.
• Waiting for internal losses or findings ignores credible external risk information relevant to the institution’s products.

National and sectoral risk assessments should inform the institution’s own risk-based assessment and proportionate control design.

Question 33

Topic: Understanding the Risks and Methods of Financial Crime

A bank reviews a small local restaurant’s business checking account. KYC states the account purpose is to deposit local daily sales and pay suppliers in the same city. Over two months, unidentified individuals make frequent cash deposits at branches in several distant border towns, and the funds are quickly transferred to accounts in a neighboring high-risk jurisdiction. Which banking-segment risk indicator best matches this activity?

• A. Correspondent banking payable-through account use by a foreign bank’s customers
• B. Funnel account activity using geographically dispersed deposits and rapid fund movement
• C. Trade-based money laundering through mispriced import or export invoices
• D. Private banking concentration risk involving a high-net-worth politically exposed person

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Funnel account activity often involves funds being placed through deposits in multiple locations and then quickly moved to another location or jurisdiction. The key indicators here are the mismatch between the customer’s stated local business purpose and the actual transaction pattern, deposits by unidentified third parties at distant branches, and transfers to a neighboring high-risk jurisdiction. A cash-intensive restaurant may legitimately make cash deposits, but the geography and rapid onward movement are inconsistent with normal local operating activity and should prompt further review or escalation under a risk-based monitoring process.

• Trade-based money laundering would involve trade documents, invoices, shipment details, or import/export activity, none of which appears here.
• Private banking PEP risk relates to wealth management and politically exposed persons, not a small local restaurant account.
• Payable-through account risk involves foreign bank customers accessing a correspondent account, not third-party cash deposits into a domestic business account.

The activity is inconsistent with a local restaurant’s stated purpose and shows dispersed cash deposits followed by rapid movement to a higher-risk geography.

Question 34

Topic: Global AFC Frameworks, Governance, and Regulations

A multinational bank’s compliance committee proposes updating CDD and transaction monitoring standards to reflect FATF risk-based guidance. Legal notes that FATF itself does not directly enforce obligations against the bank; enforceable duties come from local AML/CFT law and regulators. Which concept best explains why the FATF guidance can still influence the bank’s controls?

• A. FATF is a global standard setter whose guidance shapes national rules and supervisory expectations.
• B. FATF guidance automatically overrides inconsistent local AML/CFT laws.
• C. FATF directly licenses and disciplines banks operating across borders.
• D. FATF is the financial intelligence unit that receives suspicious activity reports from the bank.

Best answer: A

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: FATF Recommendations and guidance are not usually direct legal obligations for a financial institution. Their influence comes from FATF’s role as the global AML/CFT standard setter. Countries are assessed against FATF standards through mutual evaluations and are expected to implement those standards through domestic laws, regulations, and supervisory practices. As a result, an institution may adjust policies, CDD, monitoring, training, and governance to align with FATF guidance because local regulators and examiners may treat that guidance as an important benchmark for an effective risk-based AFC program. The enforceable obligation remains local law, but FATF helps shape what local frameworks and supervisory expectations become.

• Treating FATF as an FIU confuses standard setting with operational suspicious activity reporting.
• Saying FATF guidance overrides local law overstates its legal force.
• Saying FATF licenses and disciplines banks confuses FATF with national supervisors or regulators.

FATF guidance influences controls because countries and supervisors often use it as the benchmark for local AML/CFT frameworks and examinations.

Question 35

Topic: Tools and Technologies to Fight Financial Crime

An AFC platform refreshes external sanctions lists and an internal prohibited-party list, standardizes aliases and transliterations, and compares the updated lists overnight against all existing customers. Possible name matches above a similarity threshold are queued for analyst review. Which technology function is being described?

• A. Network link analysis
• B. Scenario-based transaction monitoring
• C. Customer batch sanctions screening with fuzzy matching
• D. Real-time payment interdiction

Best answer: C

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Customer or batch sanctions screening compares a firm’s customer records, often on a scheduled basis, against external lists such as sanctions lists and internal lists such as prohibited or exited parties. Fuzzy matching helps identify potential matches despite spelling differences, aliases, transliteration issues, or incomplete data. List management supports this process by ensuring that the lists used for screening are current, authorized, and properly configured. In the scenario, the key features are list refresh, customer population comparison, approximate name matching, and analyst review of possible hits, which together point to customer batch sanctions screening rather than transaction monitoring or payment filtering.

• Scenario-based transaction monitoring looks for unusual activity patterns, not customer names matched against watch lists.
• Real-time payment interdiction screens individual payments before or during processing, not the full existing customer base overnight.
• Network link analysis identifies relationships among parties or accounts, rather than matching customers to sanctions lists.

This function periodically compares the customer population against sanctions or other watch lists using approximate matching to identify potential hits.

Question 36

Topic: Understanding the Risks and Methods of Financial Crime

A financial institution is onboarding a newly formed private investment vehicle. KYC shows it is owned through two offshore holding companies, uses a nominee director, has no clear operating history, and intends to make high-value cross-border transfers for a PEP-linked beneficial owner. No sanctions match is found. Which concept best matches the appropriate AML risk interpretation?

• A. Routine due diligence because no sanctions match was identified
• B. Risk-based enhanced due diligence driven by cumulative high-risk features
• C. Automatic suspicious transaction reporting based only on offshore ownership
• D. Customer risk reduction because the vehicle is newly formed

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Under a risk-based approach, due-diligence intensity should increase when several risk factors combine. A complex offshore ownership chain, nominee director, limited operating history, high-value cross-border activity, and PEP-linked beneficial ownership each may raise concern. Together, they create a higher-risk profile that warrants enhanced due diligence, such as deeper beneficial ownership verification, source of wealth/source of funds inquiries, senior management approval where required by policy, and closer ongoing monitoring. The absence of a sanctions match does not make the customer low risk, and the facts do not by themselves require an immediate suspicious transaction report without further assessment.

• Treating the file as routine because sanctions screening is clear confuses sanctions screening with broader AML/CFT risk assessment.
• Filing automatically based only on offshore ownership overstates one risk factor without assessing suspicion from the full facts.
• Viewing new formation as risk-reducing ignores the lack of operating history and the other high-risk structural indicators.

Multiple high-risk features in the customer structure and profile should increase due-diligence intensity even without a sanctions match.

Question 37

Topic: Tools and Technologies to Fight Financial Crime

A bank’s payment screening tool stops an outgoing cross-border payment because the beneficiary name and location partially match a current prohibited-party list entry. The operations analyst cannot determine from available identifiers that the alert is a false positive. Which action best matches the appropriate escalation?

• A. Move the alert to periodic KYC review because screening concerns are addressed during customer refresh.
• B. Keep the payment stopped and escalate the alert to the sanctions review function for documented disposition before processing.
• C. Release the payment if the customer has a long-standing relationship and no prior adverse monitoring alerts.
• D. File a suspicious activity or transaction report immediately without completing sanctions match review.

Best answer: B

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Sanctions and prohibited-party screening is a preventive control: when a possible match cannot be safely discounted as a false positive, the transaction should not proceed until an authorized sanctions or AFC function reviews and documents the disposition. The escalation should focus on confirming or discounting the match using available identifiers, list data, payment information, and any approved procedures. A good customer history does not override a potential list match, and periodic KYC is not a substitute for real-time payment-screening escalation. Suspicious activity reporting may become relevant depending on the facts and jurisdiction, but it does not replace the immediate need to stop and resolve the potential sanctions concern before processing.

• Relationship history may inform risk context, but it cannot justify releasing an unresolved potential prohibited-party match.
• A suspicious activity or transaction report may be considered later, but the first control action is sanctions review and disposition.
• Periodic KYC refresh is an ongoing due-diligence control, not the proper handling path for a live payment-screening alert.

A potential sanctions or prohibited-party match that cannot be cleared should be held and escalated for specialized review before any release.

Question 38

Topic: Understanding the Risks and Methods of Financial Crime

A bank is onboarding a commodity trading company incorporated in a country the bank rates as low risk. KYC shows that most sales are arranged through agents in a conflict-affected neighboring country subject to targeted sanctions, and payments often pass through banks in jurisdictions publicly identified as having weak AML/CFT controls. Which is the BEST action?

• A. Reject the customer automatically because any activity linked to a conflict-affected country is prohibited.
• B. Proceed if the customer name does not match a sanctions list, because jurisdiction risk is addressed through screening only.
• C. Treat the relationship as elevated jurisdiction risk and perform enhanced due diligence on counterparties, agents, sanctions exposure, and payment corridors before approval.
• D. Approve the customer as low risk because its place of incorporation is in a low-risk country.

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Jurisdiction risk is not limited to where a customer is incorporated. A customer can present elevated geographic risk through agents, counterparties, revenue sources, payment routes, and exposure to sanctioned or conflict-affected locations. Here, the low-risk incorporation country is outweighed by business activity tied to targeted sanctions, conflict exposure, and payment flows through weak-control jurisdictions. The best action is not automatic exit or simple name screening; it is a risk-based escalation and enhanced due diligence to understand the purpose of the relationship, involved parties, sanctions nexus, source of funds, and control expectations before approval.

• Relying only on incorporation misses the customer’s actual geographic exposure through agents, sales, and payment corridors.
• Automatic rejection is not the best global risk-based response unless the activity is prohibited or risk cannot be managed.
• Name screening alone does not address broader jurisdiction risk, such as weak controls, corruption exposure, conflict links, or indirect sanctions risk.

The customer’s geographic links create corruption, sanctions, conflict, and weak-control exposure that should drive risk-based enhanced due diligence.

Question 39

Topic: Building an Anti-Financial Crime Compliance Program

A financial institution decides to terminate all accounts for nonprofit organizations operating in conflict-affected regions without reviewing each customer’s purpose, activity, controls, or available risk mitigants. Which concept does this most closely describe?

• A. De-risking
• B. Enhanced due diligence
• C. Risk-based approach
• D. Residual risk management

Best answer: A

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: A risk-based approach evaluates the specific risks presented by a customer, product, geography, channel, and activity, then applies controls proportionate to those risks. It does not require serving every customer, but decisions should be based on documented, case-specific analysis and the institution’s ability to manage the risk. De-risking occurs when an institution broadly exits or refuses whole customer groups, sectors, or regions without individualized assessment. In the scenario, the institution does not review the nonprofits’ purposes, transactions, controls, or mitigants, so the practice is best characterized as de-risking rather than risk-based control design.

• A risk-based approach would assess individual customer risk and apply proportionate controls, not automatically exit a whole segment.
• Enhanced due diligence involves deeper review of higher-risk customers; it is not a blanket termination decision.
• Residual risk management considers risk remaining after controls, which the institution did not evaluate here.

This is de-risking because the institution exits an entire customer category without case-specific risk assessment or mitigation analysis.

Question 40

Topic: Global AFC Frameworks, Governance, and Regulations

A multinational financial institution plans to centralize transaction-monitoring alerts from multiple countries so its group AFC team can detect cross-border terrorist-financing patterns. Legal advises that some customer data cannot be moved or reused unless the bank documents a permitted basis, limits the data to the AML/CFT purpose, and applies cross-border transfer safeguards. Which concept does this description best illustrate?

• A. Sanctions list matching and false-positive disposition
• B. Data privacy constraints on AML/CFT information sharing and monitoring
• C. Beneficial ownership transparency requirements
• D. Tipping-off controls for customer communications

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Data privacy and data-protection rules can directly affect AML/CFT collaboration and monitoring. They do not necessarily prohibit information sharing or centralized monitoring, but they may require a lawful or permitted basis, restrict secondary use, limit data to what is necessary, require retention controls, or impose safeguards for cross-border transfers. In this scenario, the key issue is not whether the activity is useful for detecting terrorist financing; it is that customer data movement and reuse must comply with privacy obligations while supporting AML/CFT objectives.

• Tipping-off controls relate to avoiding improper disclosure to a customer or third party about a report or investigation, not legal limits on data transfers.
• Sanctions list matching concerns screening names or transactions against watch lists and resolving potential matches.
• Beneficial ownership transparency concerns identifying and verifying ownership or control, not privacy conditions on group data sharing.

Privacy rules may permit AML/CFT activity but condition it through lawful basis, proportionality, data minimization, and transfer controls.

Question 41

Topic: Tools and Technologies to Fight Financial Crime

A fintech’s digital onboarding workflow confirms a new applicant’s passport authenticity and biometric liveness. The applicant is opening an account for a newly formed company with layered foreign ownership, expects frequent cross-border transfers, and has not explained the source of funds or business purpose. Which is the BEST action before account activation?

• A. Complete risk-based CDD or EDD on beneficial ownership, source of funds, business purpose, and expected activity.
• B. Activate the account because the digital identity check verified the applicant’s passport and liveness.
• C. Activate the account but rely on transaction monitoring to determine the company’s ownership and source of funds later.
• D. Reject the application solely because remote onboarding and foreign ownership are always unacceptable.

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Digital onboarding tools often support identity proofing, document authentication, biometric matching, and screening. Those controls help establish that a person is who they claim to be, but they do not by themselves answer broader CDD questions. For a business customer, the institution still needs a risk-based understanding of beneficial ownership and control, source of funds, purpose of the relationship, and expected account activity. The layered ownership, cross-border activity, and missing source-of-funds explanation make it inappropriate to treat the identity check as sufficient. The best action is to complete appropriate CDD or EDD before activating the account, rather than deferring core onboarding questions to later monitoring or applying blanket de-risking.

• Treating passport and liveness verification as sufficient confuses identity verification with broader customer due diligence.
• Relying only on future transaction monitoring fails because ownership, purpose, and source-of-funds questions are onboarding controls.
• Rejecting solely due to remote onboarding and foreign ownership is not a risk-based decision unless a specific prohibition or policy applies.

Identity verification confirms who the applicant is, but the unresolved ownership, funding, purpose, and activity facts require broader due diligence before activation.

Question 42

Topic: Building an Anti-Financial Crime Compliance Program

An AFC compliance team’s horizon-scanning log notes that a regulator has issued final guidance expecting firms to assess instant-payment fraud and mule-account indicators. Industry information-sharing forums report a sharp increase in the same typology, and the bank’s current financial-crime policy addresses only traditional wire transfers. What is the BEST action for the compliance officer?

• A. Initiate a targeted policy review to assess the new guidance and typology, update the risk assessment, and determine needed control changes.
• B. Suspend all instant-payment services for higher-risk customers until regulators publish enforcement cases.
• C. Wait until the next scheduled annual policy review because the typology has not yet caused a confirmed loss at the bank.
• D. Add the typology to analyst training materials but leave the policy unchanged until suspicious activity is identified.

Best answer: A

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Horizon scanning is used to identify external changes—such as new regulatory expectations, typology shifts, enforcement trends, and industry intelligence—that may require changes to an AFC program. Here, the regulator’s final guidance and peer-reported rise in mule-account activity directly reveal a gap: the bank’s policy covers traditional wires but not instant payments. The best response is not an automatic service ban or a passive wait for losses. Compliance should trigger a targeted review, update the risk assessment, and determine whether policy, procedures, monitoring, ownership, training, or reporting need changes under a risk-based approach.

• Waiting for confirmed internal losses ignores external regulatory and typology signals that are valid policy-review triggers.
• Training alone may help awareness, but it does not address the documented policy gap or control ownership.
• Suspending all higher-risk customer use is an overbroad de-risking response without first assessing risk and control options.

Horizon scanning should trigger policy review when external regulatory expectations and emerging typologies expose a gap in the current AFC framework.

Question 43

Topic: Tools and Technologies to Fight Financial Crime

An AFC operations manager wants to reduce a transaction-monitoring alert backlog while preserving control effectiveness. The proposal keeps existing typology coverage, uses alert outputs and customer-risk factors to rank work, routes higher-risk alerts to experienced investigators first, and applies quality assurance to lower-risk closures. Which technology-enabled efficiency improvement is being described?

• A. Unreviewed straight-through alert closure
• B. Risk-based alert prioritization and case triage
• C. Uniform alert-threshold increases
• D. Scheduled periodic KYC refresh automation

Best answer: B

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: A sound efficiency improvement in AFC technology should reduce operational burden without creating blind spots or abandoning the risk-based approach. Risk-based alert prioritization and case triage uses available risk indicators—such as customer risk, transaction pattern, scenario output, and prior activity—to rank alerts and route them appropriately. This helps investigators focus first on alerts most likely to indicate suspicious activity, while lower-risk alerts can follow standardized review and quality assurance. The key distinction is that the control remains active and risk-sensitive; the institution is not simply suppressing alerts or removing human oversight where it is still needed.

• Uniform threshold increases may reduce volume but can weaken typology coverage if not justified by testing and risk assessment.
• Unreviewed straight-through closure creates efficiency at the expense of control effectiveness and auditability.
• Periodic KYC refresh automation can improve customer lifecycle efficiency, but it does not describe alert backlog triage.

This improves efficiency by focusing review effort on higher-risk alerts while retaining control coverage and QA oversight.

Question 44

Topic: Understanding the Risks and Methods of Financial Crime

A trust and company service provider presents a new corporate customer. KYC notes show nominee shareholders and directors, a discretionary trust, and holding companies in multiple jurisdictions; no clear natural person can be identified as exercising ultimate control. Which concept best describes the key financial-crime risk?

• A. Cash-intensive business risk from unexplained currency deposits
• B. Correspondent banking risk from nested respondent relationships
• C. Opaque beneficial ownership risk from nominee arrangements and complex ownership chains
• D. Trade-based money laundering risk from false invoicing and overvaluation

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Trust and company service providers can be misused as gatekeepers when they create or administer entities, trusts, nominee directors, or nominee shareholders that obscure who really owns or controls assets. The concern is not simply that the customer has multiple legal entities, but that the structure prevents identification of the ultimate beneficial owner or controlling person. This is a classic opaque ownership and control risk, often requiring enhanced due diligence, verification of beneficial ownership, and scrutiny of the purpose of the structure.

• Trade-based laundering involves manipulation of goods, invoices, or trade documents, which is not described here.
• Nested correspondent banking concerns indirect access through banking relationships, not company formation or nominee control.
• Cash-intensive business risk focuses on physical currency activity, not opaque legal ownership structures.

The facts point to a TCSP-enabled structure that can conceal the natural persons who ultimately own or control the customer.

Question 45

Topic: Global AFC Frameworks, Governance, and Regulations

A bank files a suspicious transaction report after identifying payments that appear structured to evade a UN sanctions measure. The FIU acknowledges receipt and states that the information may be shared with competent authorities. Senior management asks what role law enforcement would play if the matter proceeds. What is the best explanation?

• A. Law enforcement would replace the bank’s sanctions controls and decide whether the customer should remain onboarded.
• B. Law enforcement would issue UN sanctions designations and supervise the bank’s compliance program.
• C. Law enforcement would act as the FIU by receiving, analyzing, and disseminating all suspicious transaction reports.
• D. Law enforcement would investigate the suspected criminal activity, use lawful powers to gather evidence, and work toward criminal outcomes such as arrest, prosecution support, or asset restraint.

Best answer: D

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: In a global AFC framework, law enforcement is responsible for investigating suspected criminal activity and helping pursue criminal outcomes. After an FIU receives and analyzes suspicious reporting, it may disseminate intelligence to law enforcement or other competent authorities. Law enforcement can then use legal powers—such as interviews, production orders, searches, arrests, or asset restraint where authorized—to build an evidentiary case and work with prosecutors. The bank’s role remains to maintain controls, preserve records, comply with reporting and sanctions obligations, and respond appropriately to lawful requests without tipping off the customer.

• Replacing the bank’s controls confuses law enforcement’s investigative role with the institution’s compliance responsibilities.
• Receiving and analyzing STRs is generally the FIU’s role, not law enforcement’s primary role.
• Issuing UN sanctions designations and supervising compliance programs are functions of sanctions authorities and regulators, not criminal investigators.

Law enforcement’s core role is to investigate suspected crimes and support the pursuit of criminal outcomes through lawful investigative powers.

Question 46

Topic: Building an Anti-Financial Crime Compliance Program

A bank’s monitoring team identifies repeated payments by a long-standing trade-finance customer to shell-company counterparties in jurisdictions with elevated sanctions and corruption risk. AFC investigators recommend exiting the relationship, but the business line asks to retain the customer because it is strategically important. The AFC policy requires committee review for disputed high-risk exits and material risk-appetite exceptions. What is the best action?

• A. Allow the business line to retain the customer if it agrees to increase relationship monitoring.
• B. Have the investigator close the relationship immediately because shell-company payments were identified.
• C. Escalate the case to the AFC governing committee with the investigation findings, risk assessment, and competing recommendations for a documented decision.
• D. Defer the decision until the next scheduled periodic KYC review to avoid disrupting the customer relationship.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: AFC governing committees are used to oversee significant financial-crime risk decisions, especially where there is disagreement between compliance and the business or where a decision may exceed normal risk appetite. The committee should receive enough information to make or endorse a documented decision, such as investigation findings, risk assessment, proposed controls, customer impact, and exit or retention recommendation. This does not remove the need for any required suspicious activity reporting or operational controls, but it ensures that material escalation, accountability, and oversight occur at the appropriate governance level. In this scenario, the policy specifically requires committee review, so bypassing that forum would weaken governance.

• Business-line retention alone fails because a material AFC risk decision should not be resolved by the revenue owner.
• Immediate closure by the investigator may ignore the required governance process for disputed high-risk exits.
• Waiting for periodic KYC review is inappropriate because the issue is already escalated and potentially outside risk appetite.

The committee’s role is to provide oversight, resolve material AFC risk decisions, and document escalation outcomes within risk appetite.

Question 47

Topic: Building an Anti-Financial Crime Compliance Program

A bank requires the same manual enhanced questionnaire and senior approval for every customer opening a basic low-value account, including low-risk domestic retail customers. The process increases abandonment and delays but does not improve detection of financial-crime risk. Which concept best matches this situation?

• A. Perpetual KYC monitoring
• B. A disproportionate blanket control
• C. Risk-based enhanced due diligence
• D. Residual risk acceptance

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: A risk-based AFC program should align control intensity with the customer, product, channel, and jurisdiction risks presented. A blanket control may be appropriate in limited circumstances, but applying the same high-friction requirement to all customers regardless of risk can be inefficient and may weaken the customer experience without improving risk outcomes. In this scenario, low-risk customers are subjected to enhanced steps that do not produce better detection or mitigation. That indicates a disproportionate blanket control rather than a calibrated risk-based control.

• Risk-based enhanced due diligence would target higher-risk customers or activity, not all basic low-risk accounts.
• Residual risk acceptance means management knowingly accepts remaining risk after controls, not that it imposes unnecessary controls.
• Perpetual KYC monitoring involves ongoing refresh based on triggers or data changes, not a uniform onboarding burden.

The control applies uniformly without risk differentiation, creating excessive friction without a proportionate risk-management benefit.

Question 48

Topic: Global AFC Frameworks, Governance, and Regulations

A bank in Country A investigates a corporate customer whose incoming payments appear linked to online fraud victims in Country B and are quickly transferred to virtual-asset accounts at a VASP in Country C. The bank has account and transaction records, but victim evidence, beneficiary wallet information, and company registry data sit in other jurisdictions. Local law restricts direct disclosure of customer data to foreign private parties. What is the BEST action for the AFC team?

• A. Wait until authorities in Countries B and C prove the predicate offense before escalating or filing any suspicious activity report.
• B. Send the full customer file directly to the foreign victims and the VASP to help them complete their own investigations quickly.
• C. Escalate and report under Country A requirements, then use authorized FIU, regulator, or law-enforcement cooperation channels to share or request cross-border information.
• D. Treat the matter as a domestic case because the bank account is in Country A and the bank holds the key transaction records.

Best answer: C

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Cross-border financial crime often involves customers, victims, transactions, records, assets, and predicate offenses spread across multiple jurisdictions. No single institution or authority is likely to have the full picture or legal power to obtain all relevant information. The best response is to meet the institution’s local reporting and escalation obligations while using authorized channels—such as FIU-to-FIU cooperation, regulator-to-regulator cooperation, law-enforcement requests, or other permitted mechanisms—to exchange information lawfully. This approach supports evidence gathering, asset tracing, and coordinated disruption while respecting confidentiality, data protection, and tipping-off restrictions.

• Directly sending customer files to victims or a foreign VASP may breach confidentiality, privacy, or legal-disclosure limits.
• Treating the case as purely domestic ignores that victims, assets, and records are in other jurisdictions.
• Waiting for foreign proof sets too high a bar; suspicious activity reporting is based on suspicion, not completed prosecution evidence.

This recognizes that cross-border cases require lawful coordination because relevant evidence and authority are divided across jurisdictions.

Question 49

Topic: Building an Anti-Financial Crime Compliance Program

An AFC investigator at a cross-border bank reviews an alert involving a newly onboarded trading company. The customer receives wires from several unrelated entities and quickly sends most funds to a virtual asset service provider in a high-risk jurisdiction. The invoices provided are generic, and the customer cannot explain the commercial purpose. The relationship manager asks the investigator to close the alert because there is no sanctions match and the client is “strategic.” What is the BEST action?

• A. Escalate the documented case to the designated reporting officer for a suspicious activity or transaction reporting decision and raise the relationship manager pressure through compliance governance.
• B. Close the alert because the absence of a sanctions match removes the need for further AFC escalation.
• C. Immediately offboard the customer and reject all pending activity before any internal reporting decision is made.
• D. Ask the relationship manager to warn the customer that a report may be filed unless better invoices are provided.

Best answer: A

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: When investigation facts indicate possible layering, lack of economic purpose, weak supporting documents, and an unexplained high-risk virtual asset destination, the case should be escalated through the institution’s suspicious activity or transaction reporting process. The investigator should document the facts and refer the matter to the designated reporting officer, MLRO, or equivalent role that determines whether to file with the FIU. The relationship manager’s request to close the alert for business reasons is not merely a customer-service issue; it may indicate pressure to override AFC controls and should be escalated through compliance governance according to policy. A sanctions screen result does not resolve AML/CFT concerns, and customer communications must avoid tipping-off risk.

• Treating the lack of a sanctions match as dispositive ignores AML/CFT red flags and investigation evidence.
• Warning the customer about possible reporting risks tipping off and compromises the investigation.
• Immediate offboarding may be considered later, but it should not bypass the internal reporting decision and governance escalation.

The facts support a suspicious reporting escalation, and the attempted business override creates a separate governance concern.

Question 50

Topic: Building an Anti-Financial Crime Compliance Program

A bank is onboarding a newly formed import-export company. The customer expects frequent high-value cross-border wires involving higher-risk jurisdictions, has a layered ownership structure with a trust as an intermediate owner, and identifies a beneficial owner who is a close associate of a foreign PEP. Sanctions screening has no confirmed matches. What is the BEST action for the bank?

• A. Proceed with standard CDD because there is no confirmed sanctions match.
• B. File a suspicious activity report immediately based only on the initial risk rating.
• C. Reject the customer solely because cross-border activity involves higher-risk jurisdictions.
• D. Apply EDD before approval, including beneficial ownership verification, source-of-funds review, and enhanced ongoing monitoring.

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: A risk-based AFC program increases control intensity when customer, ownership, geography, product, or activity risks exceed ordinary baseline expectations. Here, the absence of a confirmed sanctions match does not eliminate AML, corruption, or concealment risk. The customer has several higher-risk indicators: expected high-value cross-border wires, higher-risk jurisdictions, a layered ownership structure, and a PEP-related beneficial owner. The best response is not automatic rejection or immediate reporting based only on risk rating; it is enhanced due diligence and enhanced monitoring before approving or continuing the relationship, with escalation according to policy.

• Standard CDD is insufficient because screening clearance does not address ownership opacity, PEP exposure, or expected activity risk.
• Blanket rejection based only on geography is not the best risk-based response unless policy or sanctions requirements require it.
• Suspicious activity reporting generally requires a suspicion supported by facts or investigation, not merely an elevated onboarding risk score.

The combined jurisdiction, ownership, and PEP-related risk factors exceed baseline CDD and justify enhanced controls.

Questions 51-75

Question 51

Topic: Understanding the Risks and Methods of Financial Crime

A PSP monitors a newly onboarded ecommerce merchant that sells digital vouchers. The merchant’s application said it would serve local retail customers, but its first weekend activity shows 1,200 purchases of USD 10–USD 20 using hundreds of unrelated payment cards, with many transactions tied to the same two device fingerprints and IP locations in jurisdictions the PSP rates as high risk. What is the best action?

• A. Wait for a customer complaint before taking action because no single transaction is large.
• B. Escalate the merchant for fraud/AFC review and consider payout controls while the pattern is investigated.
• C. Approve a higher processing limit because the merchant exceeded its expected volume quickly.
• D. Treat the activity as normal because digital voucher merchants commonly process low-value transactions.

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: PSPs and ecommerce platforms should look beyond individual transaction size. In this scenario, several facts combine into a meaningful risk indicator: digital vouchers are easily monetized, the activity is unusually concentrated soon after onboarding, many unrelated cards are linked to the same devices, and IP locations conflict with the merchant’s stated local customer base. These facts may indicate card testing, fraud proceeds movement, mule activity, or laundering through merchant processing. The best response is to escalate for fraud/AFC investigation and consider risk-based controls, such as payout holds or additional merchant due diligence, while evidence is reviewed.

• Low-value digital voucher sales can be legitimate, but that fact does not overcome the shared-device, high-risk-jurisdiction, and unrelated-card pattern.
• Increasing limits rewards unvalidated volume and could increase exposure before the merchant’s activity is understood.
• Waiting for complaints ignores proactive monitoring responsibilities and the fact that suspicious patterns may appear before victims report losses.

The combination of digital goods, many low-value payments from unrelated cards, shared devices, and high-risk IP locations is a PSP/ecommerce risk indicator requiring escalation.

Question 52

Topic: Understanding the Risks and Methods of Financial Crime

A PSP reviews ecommerce activity for a merchant selling digital vouchers. In a 30-minute period, 42 low-value purchases are made with different cardholder names and card numbers, but all originate from the same device fingerprint and IP address. Which PSP/ecommerce risk indicator does this best represent?

• A. Customer-behavior indicator: many unrelated customers or cards using the same device or IP address
• B. Merchant indicator: the merchant’s stated business model is inconsistent with its goods or services
• C. Transaction indicator: excessive refunds or chargebacks are being used to move value
• D. Jurisdiction indicator: payment activity is concentrated in sanctioned or high-risk countries

Best answer: A

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: For PSPs and ecommerce platforms, risk indicators may arise from the merchant, jurisdictions, transaction pattern, or customer behavior. Here, the decisive fact is that many different cardholders are transacting from the same device fingerprint and IP address in a short period. That points to suspicious customer behavior, such as card testing, account takeover, mule coordination, or synthetic identity misuse. The stem does not state that the merchant’s business model is inconsistent, that countries involved are high risk, or that refunds and chargebacks are being used to move value.

• An inconsistent merchant business model would require facts about the merchant’s stated activity not matching observed products or sales.
• A jurisdiction indicator would require facts tying the merchant, customers, or payments to high-risk or sanctioned locations.
• Refund or chargeback abuse would require refund, return, dispute, or chargeback activity, which is not described.

The shared device and IP across many different cardholders indicates coordinated or suspicious customer behavior rather than a merchant or jurisdiction issue.

Question 53

Topic: Tools and Technologies to Fight Financial Crime

A bank is tuning a traditional rules-based transaction monitoring scenario for outgoing international wires. The current scenario uses one threshold for all business customers and has produced many false positives for import/export companies, while a small charity with low KYC-declared international activity sent repeated wires just below the same threshold. KYC records include customer type, geography, and expected monthly wire activity. Which action is BEST?

• A. Raise the single threshold for all business customers to reduce false positives from import/export companies.
• B. Segment business customers using KYC and risk attributes, then calibrate and test scenario thresholds against expected wire activity for each segment.
• C. Lower the single threshold for all business customers to capture the charity’s activity.
• D. Disable the outgoing-wire scenario until a machine-learning model can replace rules-based monitoring.

Best answer: B

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Traditional transaction monitoring commonly relies on rules and scenarios with thresholds, but those thresholds should be calibrated to meaningful customer segments and expected activity. In this scenario, one generic business threshold is not working: it over-alerts customers whose wire activity may be expected, while potentially missing unusual activity for a customer with much lower expected international activity. The best action is to use available KYC and risk attributes, such as customer type, geography, and expected monthly wires, to define segments and tune/test thresholds for each segment. This improves alert relevance without removing monitoring coverage or treating all business customers as having the same risk profile.

• Raising the same threshold may reduce false positives but could further miss unusual activity by lower-activity customers.
• Lowering the same threshold may capture the charity’s activity but would likely increase false positives for higher-activity segments.
• Disabling the scenario creates a monitoring gap; model replacement is not required to improve a rules-based scenario.

Traditional transaction monitoring should use relevant segmentation and expected activity to make rule thresholds more risk-based and effective.

Question 54

Topic: Building an Anti-Financial Crime Compliance Program

A financial institution assigns a team that is separate from day-to-day AFC operations to test whether onboarding, screening, monitoring, and escalation controls are working as designed. The team reports findings and remediation status to senior management. Which core pillar of an effective AFC compliance program does this best describe?

• A. Written policies, procedures, and controls
• B. Ongoing employee training
• C. Customer due diligence
• D. Independent testing or audit

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: A core pillar of an effective AFC compliance program is independent testing or audit. This pillar provides objective assurance that program controls are functioning as intended, identifies gaps, and tracks management’s corrective actions. The key clues are that the team is separate from day-to-day operations, tests multiple controls, and reports findings and remediation to senior management. Written policies and procedures define what should happen, training helps staff understand and perform their duties, and customer due diligence collects and updates customer risk information. None of those functions primarily describes independent assurance over control effectiveness.

• Written policies, procedures, and controls set program requirements but do not independently test whether they work.
• Ongoing employee training builds awareness and role-specific competence but is not an assurance function.
• Customer due diligence supports customer risk assessment and monitoring, not independent program evaluation.

Independent testing verifies whether AFC controls are designed and operating effectively and reports issues outside daily operations.

Question 55

Topic: Understanding the Risks and Methods of Financial Crime

An AFC risk assessment gives a higher inherent risk score to relationships involving countries with significant corruption, active sanctions, weak AML/CFT supervision, armed conflict, or elevated organized-crime exposure. Which cross-cutting risk factor best matches this description?

• A. Product and service risk
• B. Delivery channel risk
• C. Customer type risk
• D. Jurisdiction risk

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Jurisdiction risk, sometimes called geographic risk, arises when the location of a customer, counterparty, transaction, ownership link, or business activity increases exposure to financial crime. Countries or territories associated with sanctions, corruption, weak AML/CFT controls, conflict, terrorism financing, tax evasion, or organized crime can increase inherent risk and may require enhanced due diligence, closer monitoring, or restrictions under the institution’s risk appetite. The stem is not focused on what product is used, how the customer accesses the institution, or the customer’s occupation or entity type; it is focused on geography and country-level exposure.

• Product and service risk concerns features such as anonymity, complexity, liquidity, or cross-border capability of a product.
• Delivery channel risk concerns how the relationship is established or serviced, such as non-face-to-face onboarding.
• Customer type risk concerns the nature of the customer, such as a PEP, cash-intensive business, NPO, or complex legal entity.

Jurisdiction risk focuses on how a country or territory’s sanctions, corruption, control environment, conflict, or criminal exposure affects financial-crime risk.

Question 56

Topic: Building an Anti-Financial Crime Compliance Program

During an AML investigation, an analyst links several alerts to a customer whose transactions are inconsistent with the stated business, involve rapid movement through unrelated accounts, and are not explained by documentation obtained. The investigator concludes there is a reasonable basis to suspect money laundering under the institution’s policy. Which escalation path best matches these facts? Select ONE.

• A. Escalate to the MLRO, nominated officer, or equivalent for a suspicious activity or transaction reporting decision and FIU filing process.
• B. Refer the case to model governance for transaction monitoring scenario tuning only.
• C. Send the case to the front office for routine customer relationship management follow-up.
• D. Defer the case to the next periodic KYC refresh without a reporting escalation.

Best answer: A

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: When an investigation establishes a reasonable basis to suspect money laundering, the appropriate escalation is through the institution’s designated suspicious activity or transaction reporting process. In many frameworks, that means escalation to the MLRO, nominated officer, or equivalent function to make or approve the reporting decision and proceed with FIU filing according to local requirements. Governance review may be appropriate for control weaknesses or trends, but it does not replace the reporting escalation when suspicion is supported. Routine relationship management or periodic KYC refresh is also insufficient once the investigation has reached a suspicion threshold.

• Model governance may address monitoring performance, but it does not resolve a case where suspicion has been formed.
• Front-office follow-up can create tipping-off concerns and is not the correct reporting escalation.
• Periodic KYC refresh is a lifecycle control, not a substitute for SAR/STR escalation when facts support suspicion.

When investigation facts support suspicion, the case should move through the institution’s formal SAR/STR escalation and reporting process.

Question 57

Topic: Global AFC Frameworks, Governance, and Regulations

A cross-border payments firm is refreshing its group AFC standards for AML, CFT, and proliferation-financing controls. Senior management asks how FATF requirements should be applied because local implementation details differ across countries and FATF has not issued any directive to the firm. What is the best action?

• A. Replace local legal requirements with the FATF Recommendations wherever the FATF standard appears stricter.
• B. Apply FATF materials only when a local FIU repeats them in a suspicious activity reporting notice.
• C. Ask FATF to approve the firm’s policies before implementing them in each country.
• D. Use the FATF Recommendations and guidance as international benchmarks, then map them to applicable local laws, supervisory expectations, and the firm’s risk-based controls.

Best answer: D

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: FATF’s core role is to set international standards for combating money laundering, terrorist financing, proliferation financing, and related financial-crime measures. Its Recommendations, guidance, and mutual evaluation process influence national laws, supervisory expectations, and institutional AFC programs. However, FATF is not normally the direct regulator of individual firms and does not approve a firm’s policies. A financial institution should use FATF standards as a global benchmark, assess how each jurisdiction has implemented them, and design risk-based controls that comply with local requirements while supporting group-wide consistency.

• Requesting FATF policy approval misstates FATF’s role; supervision and enforcement generally occur through national or regional authorities.
• Waiting for an FIU notice is too narrow because FATF standards inform the broader AFC framework, not only suspicious activity reporting.
• Replacing local law with FATF text is inappropriate because jurisdictions implement FATF standards through their own legal and regulatory regimes.

FATF sets global AML/CFT and proliferation-financing standards and evaluates implementation by jurisdictions, while national authorities implement and enforce requirements.

Question 58

Topic: Building an Anti-Financial Crime Compliance Program

A regional bank’s AFC program review finds that business units decide whether repeated transaction monitoring exceptions are escalated, alert-closure standards differ by region, and the governance committee receives only alert-volume metrics. What is the BEST program improvement?

• A. Suspend onboarding for all high-risk customers until regional alert backlogs are cleared.
• B. Require internal audit to approve escalations before monitoring cases can be closed.
• C. Assign formal control owners, standardize alert disposition and escalation criteria, and report exceptions to the AFC governance committee.
• D. Lower monitoring thresholds across all regions so more alerts are generated for compliance review.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: An effective AFC program needs clear ownership, documented controls, and reliable escalation to governance. The facts show a control design and governance weakness: business units are making inconsistent escalation decisions, regional standards are not aligned, and the committee lacks meaningful information about exceptions. The best improvement is to assign accountable control owners, standardize procedures for disposition and escalation, and provide governance reporting on exceptions and overdue escalations. This strengthens program effectiveness without creating unnecessary blanket restrictions or shifting management responsibilities to internal audit.

• Lowering thresholds may create more alerts but does not correct unclear ownership or inconsistent escalation.
• Internal audit should provide independent assurance, not operate or approve day-to-day AFC controls.
• Suspending all high-risk onboarding is a blanket response that does not address the identified control and governance failures.

This directly fixes weak ownership, inconsistent controls, and poor escalation with governance oversight.

Question 59

Topic: Tools and Technologies to Fight Financial Crime

A multinational bank wants to improve AFC monitoring for mule-account networks across subsidiaries in several jurisdictions. Privacy counsel says raw customer identifiers and transaction narratives cannot be moved into a central analytics hub except where local law permits. Investigators still need to detect linked customers, devices, and counterparties across entities and generate explainable alerts. What is the best action?

• A. Centralize all raw KYC and transaction data because AFC monitoring should override privacy restrictions.
• B. Limit reporting to anonymized aggregate trend dashboards so no personal data is processed for AFC purposes.
• C. Require each customer to give broad consent before any cross-border AFC monitoring is performed.
• D. Use privacy-preserving entity resolution and federated analytics with tokenized identifiers and controlled local data processing.

Best answer: D

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Privacy-enhancing technologies can allow AFC teams to detect risk patterns without unnecessarily moving or exposing raw personal data. Privacy-preserving entity resolution, tokenization, secure matching, and federated analytics can help identify links across subsidiaries while keeping sensitive data controlled locally where required. This approach should be paired with governance, legal review, access controls, auditability, and explainable alert outputs. Fully centralizing raw data may breach privacy or localization rules. Purely anonymized aggregate dashboards may be useful for management reporting but usually cannot support case-level investigations. Relying only on customer consent is not a robust AFC control and may not satisfy legal, operational, or investigative needs.

• Centralizing all raw data ignores the stated privacy and localization constraint.
• Aggregate dashboards reduce privacy risk but do not provide case-level linkage for investigations.
• Customer consent alone is not a practical substitute for lawful, risk-based AFC monitoring controls.

This supports cross-entity AFC detection while reducing exposure of raw personal data and respecting local privacy constraints.

Question 60

Topic: Global AFC Frameworks, Governance, and Regulations

An international bank’s AFC team is conducting quarterly horizon scanning. It notes an FIU advisory and a FATF typologies paper describing increased use of shell importers, altered invoices, and rapid repayments in trade finance to move value through electronics shipments. The bank has recently expanded trade-finance services for small electronics importers in the same corridors, and its last institutional risk assessment predates that expansion. Which action is BEST?

• A. Exit all small electronics importers in the named corridors until the typology is no longer referenced in public reports.
• B. File suspicious transaction reports for all recent electronics trade-finance customers because the external reports identify the sector as higher risk.
• C. Wait for a local regulator to issue a binding rule before changing the risk assessment or monitoring approach.
• D. Assess the bank’s exposure to the reported typology and update the institutional risk assessment and related controls where gaps are identified.

Best answer: D

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: External typology reports, FIU advisories, national risk assessments, and similar publications are key inputs to horizon scanning. They do not automatically prove customer suspicion, but they can identify emerging threats that should be compared with the institution’s own exposure. Here, the reports describe a typology that matches the bank’s recently expanded trade-finance activity, customer segment, and corridors. The best action is to review exposure, determine whether inherent risk has changed, identify control gaps, and update the institutional risk assessment and monitoring or due diligence controls as needed. This is a risk-based use of external intelligence rather than a blanket response.

• Filing reports for all customers confuses typology intelligence with case-specific suspicion.
• Exiting an entire customer segment is blanket de-risking, not a risk-based assessment.
• Waiting for a binding local rule ignores the purpose of horizon scanning and emerging-risk management.

External reports should be mapped to the institution’s actual products, customers, channels, and geographies to determine whether risk assessment and controls need updating.

Question 61

Topic: Understanding the Risks and Methods of Financial Crime

A VASP monitoring alert shows that a new corporate customer onboarded as a software consultancy received several cryptoasset deposits from addresses tagged by blockchain analytics as linked to ransomware payments and a sanctioned wallet cluster. The customer immediately converted the funds to a stablecoin and requested withdrawal to another VASP in a high-risk jurisdiction. What is the BEST action?

• A. Escalate for sanctions and ransomware-related investigation before processing the withdrawal.
• B. Process the withdrawal because the customer is a registered company and is not itself listed on a sanctions list.
• C. Treat the matter only as a tax-evasion risk because the customer converted cryptoassets into a stablecoin.
• D. Close the account immediately without documenting the blockchain indicators or considering reporting obligations.

Best answer: A

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Cryptoasset activity can create sanctions and ransomware exposure even when the customer is not directly named on a sanctions list. Blockchain analytics tags, links to ransomware payment flows, rapid conversion, and withdrawal to a higher-risk VASP are red flags that should be reviewed by the appropriate AFC or sanctions investigation team before funds are released. The investigation should document the source of funds, wallet exposure, customer explanation, and any reporting or asset-control obligations under applicable law and policy. A risk-based response is stronger than either ignoring the alert or taking an undocumented exit action.

• Customer registration does not resolve wallet-level sanctions or ransomware exposure.
• Stablecoin conversion may be part of layering; it does not make this only a tax issue.
• Immediate closure without documenting indicators may harm investigation quality and reporting decisions.

The wallet links, rapid conversion, and high-risk outbound transfer create potential sanctions and ransomware exposure requiring escalation before release.

Question 62

Topic: Building an Anti-Financial Crime Compliance Program

During routine client contact, a relationship manager at a bank notices that a long-standing import business suddenly asks to route payments through an unrelated personal account and becomes evasive when asked about counterparties. Which concept best matches the relationship manager’s AFC role in this situation?

• A. Internal audit testing of AFC control design and operation
• B. Independent compliance oversight of AFC policy effectiveness
• C. FIU analysis after receiving a suspicious transaction report
• D. First-line detection through customer interaction and transaction awareness

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Front-office staff such as relationship managers, tellers, and customer service teams contribute to AFC detection because they interact directly with customers and see transaction behavior in context. They are not expected to make final legal determinations, but they should recognize unusual requests, evasive explanations, or activity inconsistent with the customer profile and escalate according to internal procedures. In this scenario, the relationship manager’s awareness of the customer’s normal business and the unusual request to use an unrelated personal account are first-line detection inputs that can support further review by compliance or investigations.

• Independent compliance oversight describes second-line responsibilities, not the front-office role during customer contact.
• Internal audit testing is a third-line assurance function, not real-time detection from customer interaction.
• FIU analysis occurs after reporting by institutions and is not the relationship manager’s internal role.

Front-office staff are the first line and can identify unusual behavior or transaction requests during normal customer dealings.

Question 63

Topic: Building an Anti-Financial Crime Compliance Program

A financial institution is conducting its enterprise AFC risk assessment. The team rates exposure from customer types, products, delivery channels, and jurisdictions before evaluating KYC, sanctions screening, transaction monitoring, or other mitigating controls. Which risk assessment concept is being identified?

• A. Residual risk
• B. Control effectiveness
• C. Inherent risk
• D. Risk appetite

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: In an enterprise AFC risk assessment, inherent risk is the level of financial crime exposure arising from the institution’s business model, customers, products, services, channels, and geographies before controls are applied. It answers the question: “How risky is this activity if no mitigating controls are considered?” After the institution evaluates controls such as CDD, EDD, screening, monitoring, training, and escalation processes, it can assess the remaining or residual risk. The stem specifically states that the team is rating exposure before evaluating mitigating controls, so the matching concept is inherent risk.

• Residual risk is the risk remaining after mitigating controls are considered.
• Control effectiveness assesses how well controls reduce or manage identified risks.
• Risk appetite defines the level and type of risk the institution is willing to accept, not the pre-control exposure level.

Inherent risk is the exposure that exists before considering the effect of mitigating controls.

Question 64

Topic: Tools and Technologies to Fight Financial Crime

A bank onboarded an exporter last month and screened its KYC profile with no sanctions match. Today, before release of an outgoing cross-border payment, the sanctions filter flags the beneficiary name and intermediary bank contained in the payment message. What is the BEST action?

• A. Add the alert to the next periodic customer screening review cycle.
• B. Process the payment and investigate it later through transaction monitoring.
• C. Clear the alert because the customer passed sanctions screening during onboarding.
• D. Escalate the alert as payment screening and review the payment-message parties before releasing the transaction.

Best answer: D

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Customer screening and transaction or payment screening use different timing and data. Customer screening is applied to customer records, beneficial owners, controllers, and related KYC data at onboarding, periodic review, or trigger events. Payment screening is applied to transaction instructions before execution or release and uses payment-message details such as originator, beneficiary, intermediary bank, vessel, address, or narrative fields. In this scenario, the customer’s onboarding screen was not the decisive event. The new alert came from beneficiary and intermediary-bank information in a pending payment, so the bank should investigate the payment-screening hit before allowing the transaction to proceed.

• Passing onboarding screening does not resolve a later hit on payment-message data.
• Waiting for periodic customer review misses the real-time nature of payment screening.
• Post-transaction monitoring is not a substitute for sanctions/payment screening before release.

The hit arises before payment release from transaction-message fields, so it should be handled through payment screening.

Question 65

Topic: Global AFC Frameworks, Governance, and Regulations

A public authority receives a referral about possible sanctions evasion and money laundering. It uses investigative powers to gather evidence, identify suspects, coordinate with prosecutors, and support criminal outcomes such as seizure, arrest, or prosecution. Which public authority role is described?

• A. AML/CFT supervisory authority
• B. Financial intelligence unit
• C. UN sanctions committee
• D. Law enforcement agency

Best answer: D

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: In the global AFC framework, law enforcement agencies are responsible for investigating suspected criminal conduct and helping pursue criminal outcomes. They may use powers such as interviews, search or production orders, surveillance, asset tracing, restraint, seizure, and arrest, depending on local law. They commonly receive intelligence from FIUs, regulators, or foreign partners, but they convert intelligence into evidence suitable for criminal proceedings. FIUs analyze and disseminate financial intelligence; supervisors test compliance programs and impose regulatory consequences; UN sanctions bodies establish or oversee sanctions regimes. The described role centers on criminal investigation and enforcement, so it maps to law enforcement.

• A financial intelligence unit analyzes and disseminates intelligence, but generally does not prosecute criminal cases.
• An AML/CFT supervisor examines and enforces compliance obligations, not criminal guilt.
• A UN sanctions committee administers sanctions designations and oversight, not domestic criminal investigations.

Law enforcement investigates suspected criminal activity and develops evidence for criminal actions with prosecutors and courts.

Question 66

Topic: Understanding the Risks and Methods of Financial Crime

A bank provides a correspondent account to a foreign respondent bank. During review, the AML team finds that payment activity includes transactions for several smaller third-country banks that access the account through the respondent, and the respondent cannot clearly describe those banks’ AML controls. Which concept best matches this risk?

• A. Credit concentration risk
• B. Trade-based money laundering risk
• C. Private banking client confidentiality risk
• D. Nested correspondent banking risk

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Correspondent banking allows one financial institution to provide services to another, often supporting cross-border payments. A key AML/CFT risk arises when the respondent bank gives other financial institutions indirect access to the correspondent account. This is commonly described as nested correspondent banking. The correspondent bank may have limited visibility into the downstream banks, their customers, jurisdictions, and AML controls. That lack of transparency can make it harder to identify sanctions exposure, suspicious cross-border flows, or weak respondent-bank oversight. In the scenario, the decisive facts are the third-country banks using the account through the respondent and the respondent’s inability to explain their AML controls.

• Trade-based money laundering risk would center on misuse of invoices, goods, shipping, or trade finance documents, not indirect bank access through a respondent.
• Private banking client confidentiality risk involves higher-net-worth individual relationships and secrecy concerns, not downstream respondent-bank relationships.
• Credit concentration risk concerns exposure to borrowers or counterparties, not AML visibility over nested cross-border payment activity.

The risk arises because other banks are indirectly accessing the correspondent account through the respondent without clear visibility into their controls.

Question 67

Topic: Building an Anti-Financial Crime Compliance Program

A bank provides an operating account to a payment processor that uses an outsourced vendor to onboard small merchants. During periodic review, the processor states that merchant KYC files are retained by the vendor and the bank can receive only aggregate transaction summaries. Recent monitoring shows rapid growth in cross-border payments from newly onboarded merchants in higher-risk jurisdictions. What is the best action for the bank to take?

• A. Rely on aggregate transaction monitoring until the next annual review because the merchants are not direct bank customers.
• B. Require enhanced third-party oversight, including timely access to merchant KYC data and testing of the vendor’s onboarding and monitoring controls before allowing further expansion.
• C. Continue the relationship if the processor certifies that the vendor follows its local onboarding laws.
• D. File a suspicious activity or transaction report solely because the processor uses an outsourced onboarding vendor.

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: When a customer’s third-party or vendor arrangement limits visibility into underlying parties, the institution should strengthen controls rather than accept reduced transparency. Here, the processor’s vendor controls merchant KYC files, while transaction activity is growing quickly in higher-risk jurisdictions. A risk-based response is to require access to relevant underlying customer information, assess and test the vendor’s controls, and condition further growth on adequate oversight. This addresses both customer transparency and operational risk. Certification alone is not enough when the bank cannot verify the control environment or understand the activity it is processing.

• A vendor certification may be useful, but it does not replace access, verification, and oversight where transparency is impaired.
• Filing solely due to outsourcing confuses a risk factor with evidence of suspicious activity.
• Waiting for an annual review ignores the current growth and higher-risk jurisdiction indicators.

The facts show reduced customer transparency and increased operational risk, so the bank should apply enhanced oversight and data-access controls tied to the third-party arrangement.

Question 68

Topic: Building an Anti-Financial Crime Compliance Program

A retail customer’s KYC profile shows a monthly salary deposit of $4,000, local bill payments, and no expected international activity. Over 10 days, the account receives five third-party wires totaling $85,000 from unrelated overseas companies and quickly sends most of the funds to newly added beneficiaries. Which concept should transaction monitoring identify?

• A. A sanctions-screening alert for a potential list match
• B. A periodic KYC refresh due to expired customer documents
• C. An alert for activity inconsistent with the customer’s expected behavior
• D. An onboarding identity-verification control failure

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Transaction monitoring compares actual account activity with expected customer behavior established through KYC/CDD and ongoing knowledge of the relationship. A retail customer expected to receive salary deposits and make local payments is now receiving large third-party international wires and rapidly transferring funds onward. That mismatch is a core trigger for an unusual-activity alert and may warrant investigation to determine whether suspicious activity reporting is appropriate. The issue is not simply that the customer is foreign-facing; it is that the activity is inconsistent with the stated profile, source of funds, and expected transaction pattern.

• Sanctions screening focuses on potential matches to restricted parties or jurisdictions, not primarily on behavioral deviation.
• Periodic KYC refresh updates customer information but does not itself describe the monitoring alert created by this pattern.
• Onboarding identity verification concerns proving who the customer is at account opening, not detecting unexpected transaction behavior later.

The transaction pattern materially deviates from the customer’s known profile and should be reviewed as unusual or potentially suspicious activity.

Question 69

Topic: Building an Anti-Financial Crime Compliance Program

A regional bank’s AFC steering committee and product risk committee both review proposals to onboard virtual asset service providers. Recent minutes show conflicting decisions on the same proposal, and neither committee’s terms of reference states which committee owns AFC risk acceptance or escalation to the board risk committee. Which is the best action to strengthen governance?

• A. Allow the product risk committee to approve onboarding and notify the AFC steering committee only when issues arise.
• B. Keep both committee mandates unchanged and ask the AFC head to reconcile conflicting decisions after meetings.
• C. Move all high-risk product decisions directly to the board risk committee and remove management committee review.
• D. Revise the terms of reference so each committee’s mandate, decision rights, membership, escalation path, and reporting obligations are explicit.

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Committee structure supports AFC governance when each committee has a documented purpose, authority, membership, reporting line, and escalation trigger. Terms of reference help prevent duplicated reviews, unclear ownership, and inconsistent decisions by defining who recommends, who approves, who challenges, and when matters go to senior management or the board. In this scenario, the problem is not simply the VASP risk; it is overlapping committee authority with no documented owner for AFC risk acceptance. Revising the terms of reference is the best action because it clarifies responsibilities while preserving appropriate management oversight and board escalation.

• Reconciling conflicts after meetings treats the symptom but leaves unclear authority in place.
• Sending all high-risk product decisions directly to the board bypasses management governance rather than defining it.
• Letting the product risk committee act first weakens AFC oversight when the issue requires clear ownership and escalation.

Clear terms of reference assign ownership and escalation responsibilities, reducing overlap and inconsistent risk decisions.

Question 70

Topic: Building an Anti-Financial Crime Compliance Program

A bank is refreshing its enterprise AFC risk assessment. Since the prior assessment, it launched remote onboarding for non-resident import/export SMEs, expanded virtual account services, and saw higher transaction volumes with jurisdictions rated higher-risk in the bank’s country-risk methodology. The FIU also issued a typology alert on trade-based money laundering using shell importers. What is the best action for the risk assessment team?

• A. Treat the FIU typology alert as relevant only after the bank identifies a confirmed trade-based money laundering case.
• B. Defer the update until internal audit confirms control weaknesses in remote onboarding and virtual accounts.
• C. Map these customer, product/service, channel, jurisdiction, and typology changes into the inherent risk assessment before evaluating related controls.
• D. Limit the update to customers that already generated suspicious activity reports during the current review period.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: An enterprise AFC risk assessment should consider changes in the institution’s risk profile across products and services, customer types, delivery channels, jurisdictions, and known financial-crime typologies. The facts in the scenario are all relevant inputs: non-resident import/export SMEs affect customer risk, virtual accounts affect product/service risk, remote onboarding affects channel risk, higher-risk corridors affect jurisdiction risk, and the FIU alert affects typology risk. The team should first reflect these inputs in the inherent risk assessment and then evaluate whether controls reduce the risk to an acceptable residual level.

• Using only customers with prior suspicious activity reports is too narrow because an enterprise assessment must also consider emerging and inherent risks.
• Waiting for internal audit would confuse risk assessment with assurance testing and could delay necessary risk recognition.
• Ignoring a typology alert until a confirmed case occurs would miss external intelligence that should inform current risk exposure.

These are core enterprise risk assessment inputs and should inform inherent risk before residual risk is assessed.

Question 71

Topic: Building an Anti-Financial Crime Compliance Program

An AML investigator reviews a corporate customer whose account normally pays local suppliers, but recent activity shows large incoming wires from unrelated foreign companies followed by same-day outgoing payments to a virtual asset service provider. Which information would best help determine whether the activity has a legitimate explanation?

• A. The transaction monitoring system’s false-positive rate for all wire-transfer alerts
• B. Counterparty relationships, source and intended use of funds, and invoices or contracts supporting the payments
• C. The institution’s enterprise-wide residual risk rating and board-approved risk appetite statement
• D. The training records of analysts who previously reviewed the customer’s alerts

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Investigating unusual activity requires gathering facts that explain the transaction pattern and allow comparison with the customer’s known profile. Key information includes who the counterparties are, their relationship to the customer, the source of funds, the intended use of funds, and documentary support such as invoices, contracts, shipping records, or service agreements. These details help the investigator decide whether the activity is merely unusual or potentially suspicious. Governance documents, model metrics, and staff records may be relevant to program oversight, but they do not directly explain the customer’s specific transactions.

• Enterprise risk appetite helps guide program design, but it does not explain the customer’s specific wires.
• System false-positive rates help assess monitoring effectiveness, not the legitimacy of a transaction pattern.
• Analyst training records may matter for quality assurance, but they do not provide evidence about the customer’s counterparties or business purpose.

These facts directly address the purpose, parties, and economic rationale for the unusual transactions.

Question 72

Topic: Building an Anti-Financial Crime Compliance Program

An AFC committee is beginning the annual enterprise risk assessment. Since the last assessment, the institution launched instant cross-border payments, expanded onboarding of nonresident money services businesses, and experienced a 40% increase in transaction-monitoring alerts. A business head proposes satisfying the exercise by reviewing the largest open alerts and changing the risk ratings of those customers. Which action is BEST?

• A. Complete alert investigations for the largest open cases and treat the results as the enterprise risk assessment.
• B. Increase the risk rating of every customer that generated a transaction-monitoring alert during the period.
• C. Limit the review to nonresident money services businesses because they represent the newly expanded customer segment.
• D. Assess enterprise-level inherent risks and control effectiveness across products, customers, geographies, and channels, using alert and customer-rating data as inputs.

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: An enterprise risk assessment is a broad, periodic evaluation of the institution’s financial-crime risk profile. It considers inherent risk across products, services, customer types, geographies, delivery channels, and business changes, then evaluates controls to determine residual risk and resource needs. Customer risk ratings operate at the customer level and support CDD, EDD, and monitoring intensity. Transaction-monitoring alert reviews assess specific activity to decide whether it is explainable, suspicious, or reportable. In this scenario, the new payment product, expanded high-risk customer segment, and increased alert volumes should inform the enterprise assessment, but they do not replace it.

• Reviewing only the largest alerts confuses case investigation with enterprise-wide risk assessment.
• Automatically increasing ratings for all customers with alerts ignores case context and may misclassify customers.
• Focusing only on nonresident money services businesses misses product, geography, channel, and control dimensions.

An enterprise risk assessment evaluates institution-wide risk and control effectiveness, while alerts and customer ratings are inputs rather than substitutes.

Question 73

Topic: Understanding the Risks and Methods of Financial Crime

A private bank is reviewing an online onboarding request for a discretionary investment account in the name of a private foundation. The stated settlor is the spouse of a senior public official from a jurisdiction with high corruption risk. The foundation is controlled through nominee directors and two offshore holding companies, and the opening funds will come from a law firm client account in another jurisdiction. What is the best interpretation of the most relevant financial-crime exposure?

• A. Cash-intensive placement through repeated physical branch deposits.
• B. Concealment of beneficial ownership and source of wealth to launder possible corruption proceeds.
• C. Trade-based money laundering through false shipping documents and invoice manipulation.
• D. Terrorist financing through a nonprofit donation and aid-distribution channel.

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: The most relevant exposure is the combined risk presented by the customer structure and related facts. A private foundation, nominee directors, offshore holding companies, and funding through a law firm client account can make it difficult to identify who ultimately owns or controls the assets and where the wealth came from. The spouse of a senior public official from a high-corruption-risk jurisdiction adds a politically exposed person risk, making potential bribery or corruption proceeds a key concern. The investment account may be legitimate, but the layered structure should drive enhanced scrutiny of beneficial ownership, control, source of wealth, and source of funds.

• Trade-based money laundering is not the best fit because there are no goods, invoices, shipping documents, or import/export facts.
• Cash-intensive placement is not supported because the funds are coming through a law firm client account, not branch cash deposits.
• Terrorist financing through a nonprofit channel is not the primary exposure because the facts describe a private wealth structure, not charitable fundraising or aid flows.

The PEP connection, high-corruption jurisdiction, nominee control, offshore layering, and third-party funding point most directly to obscured ownership and corruption-related laundering risk.

Question 74

Topic: Global AFC Frameworks, Governance, and Regulations

A sectoral risk assessment issued by a national authority newly identifies online gaming payment flows as higher money-laundering risk because of rapid cross-border movement of funds and weak source-of-funds controls. A bank provides accounts and payment services to several online gaming merchants that are currently rated medium risk in its institutional risk assessment. Which update best reflects the new finding?

• A. Remove online gaming merchants from the customer base regardless of individual risk profiles.
• B. Update only sanctions-screening lists for online gaming merchant names.
• C. File suspicious activity reports on all existing online gaming merchants.
• D. Increase the inherent risk rating for the affected sector exposure and reassess related controls and residual risk.

Best answer: D

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: National and sectoral risk assessments are external inputs to an institution’s own risk assessment. When a new finding identifies a sector as higher risk, the institution should determine where it has exposure to that sector, adjust inherent risk ratings as appropriate, and evaluate whether existing controls—such as CDD, EDD, transaction monitoring, and governance reporting—remain adequate. The result may change residual risk ratings, control priorities, or monitoring coverage. The finding does not automatically make every customer suspicious, require blanket exit, or limit the response to sanctions screening unless those specific risks are identified.

• Filing reports on all merchants confuses sector risk with customer-specific suspicion supported by facts.
• Blanket exit is not a risk-based assessment update and may create inappropriate de-risking.
• Updating only sanctions screening is too narrow because the finding concerns broader money-laundering risk in a sector.

A new national or sectoral risk finding should be mapped into the institution’s risk assessment for relevant exposures, then compared with controls and residual risk.

Question 75

Topic: Understanding the Risks and Methods of Financial Crime

A retail bank onboards a customer as a salaried employee earning about $3,000 per month who says the account will be used for payroll deposits and household expenses. Within two months, the account receives frequent cash deposits totaling far above stated income and sends payments to several unrelated third parties. Which red flag is best illustrated?

• A. Sanctions screening false-positive risk from similar customer names
• B. Product risk from a cash-intensive business relationship
• C. Activity inconsistent with the customer profile and expected account purpose
• D. Correspondent banking risk from nested foreign bank activity

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: A core retail-banking AML red flag is customer activity that does not match the profile established through KYC/CDD, including stated occupation, income, source of funds, account purpose, and expected behavior. Here, a salaried retail customer expected to receive payroll and pay household expenses is instead receiving cash volumes far above stated income and making payments to unrelated third parties. That mismatch should prompt review and possible escalation because it may indicate misuse of the account, layering, mule activity, or undisclosed business activity.

• Sanctions screening false-positive risk concerns name or identifier matching against lists, not transaction behavior versus profile.
• Cash-intensive business risk would fit a disclosed business relationship, but the customer is onboarded as a salaried retail customer.
• Correspondent banking risk involves relationships between financial institutions, not an individual retail account pattern.

The observed deposits and payments do not align with the customer’s stated income, occupation, or intended retail account use.

Questions 76-100

Question 76

Topic: Tools and Technologies to Fight Financial Crime

An AFC manager is reviewing the first 90 days of a new transaction monitoring tool. Most alerts come from low-risk domestic account activity with very low escalation rates, while a smaller high-risk cross-border scenario has produced several well-supported suspicious activity reports. Analyst backlog has doubled, causing delayed review of higher-risk alerts. What is the BEST action to assess and improve operational effectiveness?

• A. Add analysts so all alerts can continue to be reviewed in chronological order without changing the tool settings.
• B. Lower thresholds across all scenarios to reduce the chance that suspicious activity is missed.
• C. Perform targeted tuning using alert volume, escalation quality, risk coverage, and analyst capacity, then adjust thresholds and prioritization with documented governance approval.
• D. Disable the low-yield domestic scenario immediately and rely on front-line staff to identify unusual customer activity.

Best answer: C

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Operational effectiveness is not measured only by the number of alerts generated. A monitoring tool should support the institution’s risk-based priorities, produce useful investigative outcomes, and use analyst resources efficiently. In this scenario, low-risk activity is consuming capacity while higher-risk alerts are delayed, which weakens control effectiveness. The best response is a governed tuning review that evaluates alert volumes, escalation and reporting quality, typology coverage, and workload impact. Adjustments should improve prioritization without creating unmanaged gaps in risk coverage.

• Adding analysts may address backlog temporarily, but it does not test whether the tool is producing risk-relevant alerts.
• Disabling a scenario without analysis and approval could create a control gap.
• Lowering all thresholds would likely increase false positives and further delay high-risk reviews.

This links tool performance to risk-based outcomes and resource use while preserving governance over tuning decisions.

Question 77

Topic: Building an Anti-Financial Crime Compliance Program

A fast-growing payments firm is formalizing its groupwide AFC program. It already performs basic customer onboarding and transaction monitoring, but it has no named AFC compliance owner, no structured employee training, and no independent review of control effectiveness. What is the best action to address the program gap?

• A. Increase transaction-monitoring alert thresholds until staffing is available to review the current alert volume.
• B. Outsource all AFC operations to a vendor so the firm no longer needs internal program governance.
• C. Appoint a qualified AFC compliance lead with authority and resources, implement role-based training, and arrange independent testing of the program.
• D. Decline all higher-risk customers until the firm has operated its current controls for a full review cycle.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: An effective AFC compliance program is built on core pillars such as risk-based policies, procedures and controls; designated compliance accountability with sufficient authority and resources; ongoing employee training; and independent testing or audit. The firm already has some operational controls, but the facts identify missing governance, training, and independent effectiveness review. The best action is therefore to strengthen those missing pillars rather than merely adjust monitoring, outsource responsibility, or apply blanket de-risking. Vendors can support execution, and customer restrictions may be appropriate in specific cases, but the institution remains responsible for maintaining an effective program.

• Raising alert thresholds addresses workload, not the missing governance, training, or independent testing pillars.
• Outsourcing operations does not remove the firm’s accountability for AFC program oversight and effectiveness.
• Blanket rejection of higher-risk customers is not a substitute for a risk-based compliance program.

These actions address core program pillars: accountable oversight, training, and independent testing to support effective controls.

Question 78

Topic: Building an Anti-Financial Crime Compliance Program

A global bank uses a three-lines model. The front office owns the customer relationship and initial KYC collection, while the financial-crime compliance team is the second line. A relationship manager submits a high-risk onboarding file with complex ownership, adverse media, and missing beneficial-owner verification, then asks compliance to approve it so the account can open before quarter-end. What is the best action for the financial-crime compliance team?

• A. Challenge the onboarding, require the missing risk-based due diligence and escalation under policy before approval, and document the decision rationale.
• B. Refer the file to internal audit to decide whether the account may be opened.
• C. Approve the account because the front office owns the customer relationship and therefore accepts all financial-crime risk.
• D. Take over the customer relationship and collect all KYC information directly from the customer going forward.

Best answer: A

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: In a three-lines model, the first line owns the business relationship and performs operational controls such as collecting KYC information. The financial-crime compliance team usually operates as the second line: it designs or interprets policy, provides advice, reviews higher-risk matters, challenges incomplete or weak controls, and escalates issues when risk is outside policy or appetite. Here, the file has clear high-risk features and missing beneficial-owner verification, so the second line should not approve opening merely for a business deadline. The appropriate action is to require completion of risk-based due diligence and any required escalation before approval, with the decision documented.

• Approving because the front office owns the relationship confuses first-line ownership with unchecked authority to bypass controls.
• Taking over the customer relationship would blur first- and second-line responsibilities.
• Sending the decision to internal audit misuses the third line, which provides independent assurance rather than day-to-day onboarding approval.

A second-line financial-crime team typically sets standards, advises, challenges, reviews high-risk cases, and ensures proper escalation rather than rubber-stamping incomplete files.

Question 79

Topic: Understanding the Risks and Methods of Financial Crime

A retail bank’s monitoring system alerts on a long-standing restaurant customer. In one month, the customer made frequent cash deposits at multiple branches just below the bank’s internal review trigger, then sent same-day wires to unrelated overseas consulting companies. When asked for support, the customer provided only generic email invoices. What is the best AFC action?

• A. Clear the alert because restaurants are expected to generate frequent cash deposits.
• B. Exit the customer immediately without further review because overseas wires are present.
• C. Treat the issue primarily as credit risk because the customer may have weak financial controls.
• D. Escalate for AML investigation of potential structuring and layering through deposits and wires, and assess suspicious reporting obligations.

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Banking-product risk depends on how the product is being used. Cash deposits can be misused to place illicit funds into the financial system, especially when deposits are split across branches or kept just below internal review points. Same-day outgoing wires to unrelated overseas parties can then indicate layering, particularly when the customer cannot provide credible commercial support. The best action is not automatic clearance or immediate exit; it is escalation to AML investigations, documentation of the facts, and assessment of whether suspicious activity or transaction reporting is required under the institution’s process.

• Cash-intensive activity may explain some deposits, but it does not explain branch splitting, timing, unrelated wire beneficiaries, or weak invoices.
• Credit risk is not the main issue because the concern is potential movement and concealment of illicit funds.
• Immediate exit without investigation may undermine documentation, reporting assessment, and risk-based governance.

The pattern combines cash-deposit structuring indicators, rapid movement by wire, unrelated beneficiaries, and weak support.

Question 80

Topic: Tools and Technologies to Fight Financial Crime

A bank plans to launch a mobile-only account for small import/export businesses that will send cross-border payments to jurisdictions the bank rates as higher risk. Current AFC tools verify identity and screen customers at onboarding, but transaction monitoring is tuned for domestic consumer activity only. Which action is BEST to align lifecycle tool coverage with the risk profile? Select ONE.

• A. Keep the current tools because identity verification and sanctions screening at onboarding cover the main AFC risks.
• B. Block all payments involving higher-risk jurisdictions to avoid adding technology coverage for the new product.
• C. Perform a risk-based coverage gap assessment and tune lifecycle tools for mobile onboarding signals, cross-border payment screening, and SME transaction monitoring by jurisdiction corridor.
• D. Apply the domestic consumer monitoring scenarios to the new accounts and rely on analysts to escalate any false positives.

Best answer: C

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Lifecycle tool coverage should follow the risk assessment for the customer type, product, delivery channel, and jurisdictions involved. Here, the new offering changes several risk drivers: SME import/export customers, cross-border payments, mobile-only onboarding, and higher-risk corridors. Existing onboarding checks are necessary but insufficient because risks may emerge after account opening through payment behavior, device or channel indicators, sanctions exposure, and transaction patterns. The best action is to identify tool coverage gaps and tune or add controls across onboarding, screening, and ongoing monitoring before relying on the product launch controls.

• Current onboarding tools miss ongoing transaction and corridor-specific risks.
• Domestic consumer scenarios are unlikely to detect SME cross-border typologies effectively.
• Blanket blocking of higher-risk jurisdictions is not a risk-based technology coverage strategy.

This aligns controls across the customer lifecycle with the specific customer, product, channel, and jurisdiction risks in the launch.

Question 81

Topic: Understanding the Risks and Methods of Financial Crime

A customer has already deposited illicit cash into a bank account. Over the next week, the funds are split among multiple shell-company accounts in different countries and moved through several rapid wire transfers with no clear business purpose to make the audit trail difficult to follow. Which money-laundering stage is best illustrated?

• A. Integration
• B. Structuring
• C. Layering
• D. Placement

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: The scenario best illustrates layering, the stage in which illicit proceeds already placed into the financial system are moved, divided, converted, or transferred to disguise their origin and ownership. The use of shell-company accounts, cross-border wires, rapid movement, and no clear business purpose are classic indicators of attempts to obscure the audit trail. Placement would focus on first introducing illicit cash into the financial system. Integration would involve returning the funds to the criminal as apparently legitimate wealth, such as through investments, business revenue, or asset purchases. Structuring can be a placement technique, but the key behavior here is complex movement after deposit.

• Placement is not the best match because the cash has already entered the bank account.
• Integration is premature because the facts do not show funds being reintroduced as apparently legitimate assets or income.
• Structuring may involve breaking transactions into smaller amounts, but the stem emphasizes obscuring the trail through shell accounts and wires.

Layering involves moving funds through complex transactions to obscure their illicit origin after the funds have entered the financial system.

Question 82

Topic: Building an Anti-Financial Crime Compliance Program

A bank has already collected and verified customer information. It then combines factors such as customer type, beneficial ownership complexity, jurisdictions, products, channels, and expected activity to assign a rating that determines the level and frequency of ongoing controls. Which concept is being described?

• A. Transaction monitoring
• B. Customer risk assessment
• C. Enhanced due diligence
• D. Customer due diligence

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Customer risk assessment is the process of evaluating customer-specific risk factors and assigning a risk rating, such as low, medium, or high. That rating helps determine how much due diligence is needed, how often the file should be refreshed, and how closely activity should be monitored. KYC and CDD provide key inputs by identifying the customer and understanding the relationship. EDD is applied when the risk assessment or other facts indicate higher risk. Transaction monitoring is a separate ongoing control that reviews actual activity against expected behavior and typologies.

• Customer due diligence gathers and evaluates information to understand the customer, but the description focuses on assigning a risk rating from multiple factors.
• Enhanced due diligence adds deeper review for higher-risk customers; it is not the rating process itself.
• Transaction monitoring reviews actual transactions for unusual or suspicious activity after the relationship is active.

A customer risk assessment rates a customer by combining risk factors to drive the level and frequency of controls.

Question 83

Topic: Global AFC Frameworks, Governance, and Regulations

Funds from an online fraud are layered through accounts at banks in three countries, held by companies incorporated in a fourth country, and linked to suspects resident in a fifth. Records, beneficial ownership data, freezing powers, and prosecutorial authority sit with different public bodies. Which concept best matches why this case cannot be handled effectively by one authority acting alone?

• A. Domestic transaction monitoring scenario tuning by one bank
• B. Cross-border cooperation among FIUs, regulators, and law enforcement
• C. Periodic customer due diligence refresh for high-risk customers
• D. Enterprise-wide customer risk assessment by the reporting institution

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Cross-border financial crime often exploits gaps between legal systems, supervisory powers, and information sources. Money, customers, beneficial owners, victims, and suspects may be located in different jurisdictions, so no single FIU, regulator, or law-enforcement agency can obtain all records, compel all witnesses, freeze all assets, or prosecute all conduct by itself. Coordination allows authorities to exchange intelligence, align investigative steps, preserve evidence, and support asset restraint or recovery without duplicating effort or missing key links. In this scenario, the relevant data and powers are fragmented across several countries, so cross-border cooperation is the matching concept.

• An enterprise-wide risk assessment helps a firm understand its own risk exposure, but it does not give one authority foreign investigative powers.
• Periodic CDD refresh updates customer information, but it is not the mechanism for coordinating public authorities across borders.
• Transaction monitoring tuning may detect unusual activity at one bank, but it does not resolve multi-jurisdiction evidence and enforcement issues.

The facts show that evidence, authority, and enforcement powers are split across jurisdictions, requiring coordinated information sharing and action.

Question 84

Topic: Global AFC Frameworks, Governance, and Regulations

A bank’s AFC team reviews a recent NGO report describing how illicit logging proceeds are laundered through trade invoices and front companies in several high-risk corridors. The report includes public case studies and red-flag indicators, but it was not issued by a regulator or FIU. The bank has timber import/export customers operating in some of the corridors. What is the BEST action?

• A. Treat every customer matching the NGO indicators as automatically suspicious and file reports immediately.
• B. Provide customer transaction data to the NGO so it can expand its public research.
• C. Ignore the report unless the same information is later issued by a regulator or FIU.
• D. Use the report as nonbinding external intelligence to assess exposure and refine relevant risk indicators, due diligence, and monitoring.

Best answer: D

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: NGOs do not usually create binding legal obligations for financial institutions, but they often contribute important research, typologies, case studies, and awareness about emerging financial-crime risks. A risk-based AFC program can use credible NGO material as external intelligence, especially where the bank has relevant sector, product, customer, or jurisdiction exposure. The best action is to evaluate the report’s relevance, corroborate it where appropriate, and incorporate useful red flags into the bank’s risk assessment, customer due diligence, enhanced due diligence, and monitoring logic. The NGO report alone should not trigger automatic suspicious activity reporting, nor should it be dismissed simply because it is not official regulatory guidance.

• Automatic reporting overstates the effect of NGO indicators; suspicion still requires analysis of customer facts and activity.
• Ignoring NGO research misses a legitimate source of financial-crime typologies and awareness.
• Sharing customer transaction data with an NGO would raise confidentiality, privacy, and legal concerns.

NGO research can be valuable typology and awareness input, but the bank should validate and apply it through its risk-based AFC controls.

Question 85

Topic: Building an Anti-Financial Crime Compliance Program

A bank refreshes the customer risk assessment for a corporate client. The client is now rated high risk because it added offshore beneficial owners and began sending frequent payments to higher-risk jurisdictions. No suspicious activity has yet been concluded, but the current transaction-monitoring profile uses standard domestic corporate thresholds. What is the BEST action for the AFC team?

• A. Keep the existing monitoring profile until a transaction-monitoring alert proves suspicious activity.
• B. File a suspicious activity or transaction report immediately based only on the customer’s high-risk rating.
• C. Exit the relationship because high-risk customers cannot be managed through monitoring controls.
• D. Update the customer profile and apply enhanced, risk-relevant monitoring scenarios and thresholds for the new ownership and cross-border activity.

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: A customer risk assessment is not just a static rating exercise; it informs the design and intensity of ongoing monitoring. When a customer’s risk increases due to ownership changes and higher-risk cross-border activity, the AFC team should update the KYC profile and adjust monitoring to reflect the new risk drivers. This may include more targeted scenarios, lower or more sensitive thresholds, enhanced review, or more frequent customer reviews. A high-risk rating alone does not prove suspicious activity, but it does justify stronger, risk-based controls. The best action is therefore to make monitoring proportionate to the assessed risk rather than either ignoring the change or automatically filing or exiting without supporting evidence.

• Filing solely because of a high-risk rating confuses risk classification with a suspicion determination.
• Waiting for proof from existing alerts fails to use the risk assessment to strengthen controls proactively.
• Exiting all high-risk customers is blanket de-risking and ignores the role of risk-based monitoring.

The customer risk assessment should drive proportionate monitoring intensity and controls tailored to the customer’s changed risk profile.

Question 86

Topic: Understanding the Risks and Methods of Financial Crime

A business client is owned through several companies before the natural-person owners are identified. The account is expected to have frequent cash deposits and incoming payments from many unrelated parties. Which concept best matches why this relationship may carry elevated financial-crime risk?

• A. Business banking risk from opaque ownership and activity flows
• B. Trade finance risk from manipulated invoices or shipments
• C. Correspondent banking risk from nested financial institutions
• D. Private banking risk from high-net-worth advisory services

Best answer: A

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Business banking can present elevated AML/CFT risk because legal entities may have layered or complex ownership, making it harder to identify who ultimately owns or controls the customer. Business accounts may also process cash and payments from many counterparties, which can obscure the true source of funds or allow third-party funds to be commingled with legitimate business revenue. These features do not automatically mean the customer is suspicious, but they are key reasons banks apply risk-based CDD, beneficial ownership checks, and ongoing monitoring to business relationships.

• Correspondent banking involves one financial institution providing services to another, which is not shown here.
• Private banking focuses on wealthy individual clients and tailored services, not ordinary business operating accounts.
• Trade finance risk centers on invoices, shipping documents, and goods movement, none of which are described in the stem.

The legal-entity layers, cash activity, and third-party inflows can make beneficial ownership and source of funds harder to understand.

Question 87

Topic: Global AFC Frameworks, Governance, and Regulations

An FIU typology report describes import-export businesses that justify large cross-border transfers using invoices that overstate or understate the value of goods, with payments routed through unrelated third parties. Which criminal method is the report describing?

• A. Account takeover fraud
• B. Trade-based money laundering
• C. Cuckoo smurfing
• D. Cash-intensive business laundering

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Authority and FIU typology reports often describe criminal methods by showing how a sector, product, or channel is misused. In this scenario, the key indicators are import-export activity, false or manipulated invoices, misstatement of goods values, and third-party payment routing. Those features point to trade-based money laundering, where criminals exploit legitimate trade processes to transfer value and obscure the origin or destination of funds. The concept is distinct from cash placement methods, fraud against an account holder, or informal value-transfer techniques that do not depend on falsified trade documentation.

• Cuckoo smurfing involves inserting illicit funds into legitimate remittance flows, not primarily manipulating invoices and goods values.
• Cash-intensive business laundering relies on commingling illicit cash with business receipts, not import-export documentation.
• Account takeover fraud involves unauthorized control of a customer account, not disguising value through trade transactions.

The use of manipulated trade documents and goods values to move and disguise value is characteristic of trade-based money laundering.

Question 88

Topic: Tools and Technologies to Fight Financial Crime

A bank’s onboarding platform compares a new customer’s name, aliases, date of birth, and identification details against sanctions lists, terrorist-financing lists, fraud databases, and the bank’s internal watch list. Potential matches are routed to analysts for disposition before the account is approved. Which concept does this description best match?

• A. Network link analysis
• B. Transaction monitoring scenario tuning
• C. Customer or name screening
• D. Customer risk-rating calibration

Best answer: C

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Customer or name screening is an AFC control used at onboarding and throughout the customer lifecycle to compare customer identifying information against external and internal lists. These lists may include sanctions, terrorist-financing, fraud, law-enforcement, politically exposed person, adverse-media, or institution-specific watch lists. The purpose is to identify potential matches that require review, escalation, blocking, rejection, enhanced due diligence, or other action depending on the list type and jurisdictional obligations. In the stem, the control is driven by customer identity attributes and watch-list comparison before account approval, which makes customer or name screening the best match.

• Transaction monitoring scenario tuning concerns rules or thresholds for detecting unusual account activity, not comparing identity data to watch lists.
• Customer risk-rating calibration adjusts how risk scores are assigned, but it is not itself the watch-list matching process.
• Network link analysis identifies relationships among parties, accounts, or transactions, rather than screening a customer name against lists.

Customer or name screening compares customer identity data with watch lists to identify potential prohibited or high-risk relationships.

Question 89

Topic: Building an Anti-Financial Crime Compliance Program

A bank’s quarterly horizon-scanning review identifies a new FIU typology report on mule accounts using instant payments. The bank’s enterprise AFC risk assessment already rates retail instant payments as elevated, and recent monitoring reviews found inconsistent escalation of suspected mule activity. The current procedures are silent on interim updates between annual policy reviews. What is the BEST action for the AFC compliance manager?

• A. Wait until the annual policy review because the FIU typology report does not by itself create a new legal obligation.
• B. Document an impact assessment, update the relevant procedures with risk-based escalation steps, and route the changes through approved governance and training.
• C. Suspend all retail instant-payment services until every customer has completed enhanced due diligence.
• D. Forward the typology report to investigators and make no procedural change unless a regulator issues a formal finding.

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Horizon scanning should not be a passive news-gathering exercise. When new typologies, regulatory expectations, or enforcement themes are relevant to the institution’s risk profile, best practice is to perform and document an impact assessment, identify affected policies and procedures, and implement risk-based changes through the organization’s normal governance process. Here, the typology is directly relevant because instant payments are already elevated risk and existing reviews show inconsistent escalation. Updating procedures with clear escalation criteria, approvals, communication, and training aligns the control framework with both organizational risk and obligations without overreacting or bypassing governance.

• Waiting for the annual review ignores a relevant risk signal and an identified procedural gap.
• Suspending all services is a blanket response that is not proportionate or risk-based.
• Forwarding the report only to investigators shares information but fails to address the procedure weakness and governance requirement.

This converts horizon-scanning intelligence into a risk-aligned procedural improvement with documented governance, control ownership, and implementation.

Question 90

Topic: Understanding the Risks and Methods of Financial Crime

A retail banking customer whose KYC profile lists only salaried employment makes repeated cash deposits and labels them as “family gifts.” Relationship notes indicate the cash comes from an unregistered rental business, and the customer asks to transfer the funds to an account in a cousin’s name to buy property for the customer’s use. Which financial-crime indicator best matches this description?

• A. Potential tax evasion using undeclared income, misleading transaction purpose, and a nominee
• B. Potential procurement fraud using inflated invoices to divert corporate funds
• C. Potential trade-based money laundering using false import or export values
• D. Potential sanctions evasion using a third party to disguise a prohibited counterparty

Best answer: A

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Tax-evasion indicators include funds that appear inconsistent with the customer’s declared source of wealth or income, efforts to disguise the purpose of transactions, and use of nominees or relatives to hold assets. In this scenario, the customer’s cash appears to come from an undeclared business rather than the stated “family gifts.” The request to move funds to a cousin’s account to buy property for the customer’s use adds a hidden-asset and nominee element. These facts most directly map to potential tax evasion, even though other financial-crime risks could be considered during investigation.

• Sanctions evasion would require facts suggesting a sanctioned person, jurisdiction, or prohibited transaction, which are not present.
• Procurement fraud would involve misuse of a purchasing process, invoices, or vendor payments, not personal cash deposits and hidden beneficial use.
• Trade-based money laundering would involve trade documents, import/export activity, or price manipulation, none of which appear in the description.

The facts point to income being concealed, the stated purpose being misleading, and a relative being used to hold assets for the customer’s benefit.

Question 91

Topic: Understanding the Risks and Methods of Financial Crime

A customer buys a cash-value life insurance policy, funds it with an unusually large initial premium, and after a short period asks to surrender the policy despite fees so the insurer will return the policy value by bank transfer. Which insurance financial-crime risk does this best illustrate?

• A. Reinsurance concentration risk from catastrophe exposure
• B. Early surrender of a cash-value policy to move or legitimize funds
• C. Inflated claim submission under property insurance
• D. Underpricing of mortality risk in term life insurance

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Cash-value life insurance can create AML risk because it allows value to accumulate and later be withdrawn, borrowed against, assigned, or surrendered. A rapid surrender after a large premium payment is a classic red flag because the customer may be less concerned with economic loss than with converting funds into a payment from a reputable insurer. The product feature that matters is the accessible cash value, and the behavior that heightens concern is the short holding period and willingness to incur surrender charges. This is different from ordinary underwriting, claims, or reinsurance risk because the concern is potential placement, layering, or integration through the insurance product.

• Mortality underpricing concerns insurance underwriting economics, not suspicious movement of funds through a cash-value policy.
• Inflated property claims involve claims fraud, while the stem centers on premium funding and surrender.
• Reinsurance concentration relates to risk transfer and accumulation exposure, not customer misuse of policy cash value.

The key red flag is using a cash-value product and rapid surrender despite cost to receive funds back from the insurer.

Question 92

Topic: Understanding the Risks and Methods of Financial Crime

A payment service provider processes payments for a large online marketplace. The payment records show the marketplace as the merchant of record and include only generic order IDs, with no visibility into the individual sellers, buyers, goods sold, or transaction purpose. Which risk concept does this best describe?

• A. Chargeback fraud risk
• B. Ecommerce marketplace opacity risk
• C. Correspondent banking nesting risk
• D. Cash-intensive business risk

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Ecommerce marketplaces can create financial-crime risk when the platform or marketplace appears as the visible merchant while underlying sellers, buyers, goods, and transaction purposes are hidden from the PSP or financial institution. This opacity can weaken customer due diligence, sanctions screening, transaction monitoring, and detection of prohibited or illicit goods. The key concept is not simply that payments are digital, but that marketplace aggregation limits transparency into who is transacting and why. A risk-based control response may include stronger platform due diligence, seller controls, data-sharing expectations, and monitoring for unusual marketplace patterns.

• Cash-intensive business risk involves heavy physical cash handling, which is not the issue in this digital marketplace scenario.
• Correspondent banking nesting risk involves one financial institution accessing another through an intermediary bank relationship, not marketplace seller-buyer opacity.
• Chargeback fraud risk concerns disputed or unauthorized card transactions, not the lack of visibility into underlying marketplace participants and goods.

The marketplace structure obscures the true parties, goods, and purpose behind the payment activity.

Question 93

Topic: Tools and Technologies to Fight Financial Crime

A payments firm is onboarding a private company through a non-face-to-face channel. The customer provided a self-certified ownership chart showing a foreign holding company as majority owner, and the initial internal name screen found no sanctions hit. Which is the BEST action to complete KYC and screening?

• A. Corroborate the file using external ownership registers, identity-verification checks, adverse-media searches, and lawful criminal-record sources.
• B. Accept the self-certified ownership chart because the initial sanctions screen found no match.
• C. Use only a PEP database because ownership and identity were already declared by the customer.
• D. Wait until transaction monitoring produces activity before checking external data sources.

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: External data sources help validate customer-provided information and identify risks that may not appear in an internal or sanctions-only screen. For a non-face-to-face corporate onboarding involving a foreign holding company, the firm should use independent sources such as company or beneficial ownership registers, electronic identity and document checks, adverse media, and criminal-record data where legally available. These sources support KYC, beneficial ownership understanding, and screening decisions before account approval. A clean initial sanctions result does not confirm ownership, identity, reputation, or criminal-risk issues.

• Accepting the ownership chart relies too heavily on customer-provided information and ignores independent verification.
• Waiting for transaction monitoring delays onboarding controls that should occur before or during customer acceptance.
• Using only a PEP database is too narrow and does not validate ownership, identity, adverse media, or criminal-record concerns.

These sources independently validate ownership, identity, and negative information relevant to KYC and screening.

Question 94

Topic: Understanding the Risks and Methods of Financial Crime

An AFC analyst reviews onboarding for a small accounting firm. The firm requests a pooled client account to receive funds from several nonresident companies and make investments on their behalf. The accountant will be the sole authorized signer and says client confidentiality prevents disclosing the companies’ beneficial owners or the purpose of specific transfers. What is the BEST action?

• A. Open the account because the accounting firm is the bank’s direct customer and the accountant is a professional gatekeeper.
• B. Escalate for enhanced due diligence on the underlying clients, beneficial owners, source of funds, and transaction purpose before opening the account.
• C. Open the account with standard CDD and rely on transaction monitoring to identify any suspicious activity later.
• D. Decline all accounting-firm relationships because pooled client accounts are inherently prohibited.

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Accountants and other professional gatekeepers may legitimately manage client funds, companies, and investments, but those same services can conceal beneficial ownership, assets, income, source of funds, or transaction purpose. In this scenario, the pooled account, nonresident companies, sole accountant control, and refusal to disclose underlying-client information create elevated financial-crime risk. The best response is not automatic onboarding or blanket rejection; it is risk-based escalation and enhanced due diligence. The institution should seek enough information to understand who ultimately owns or benefits from the funds, why transactions are occurring, and whether the activity fits the stated professional-service relationship before deciding whether to onboard or report concerns.

• Treating only the accounting firm as the relevant customer misses the risk that the account is being used for undisclosed clients.
• Relying on later monitoring is weak because the key onboarding risk is lack of transparency over ownership and purpose.
• Blanket refusal of all accounting-firm relationships is not risk-based; the issue is the specific concealment risk and information refusal.

Professional-services relationships can be used to obscure ownership and transaction purpose, so refusal to provide underlying-client information requires EDD and escalation before onboarding.

Question 95

Topic: Understanding the Risks and Methods of Financial Crime

A life insurer is reviewing an application for a single-premium cash-value policy. The proposed policy owner is a recently formed holding company, the premium will be paid by an unrelated offshore company, and the named beneficiary is an individual with no documented relationship to the insured. What is the best action?

• A. Accept the premium if the offshore company signs a third-party payment authorization.
• B. Escalate for enhanced due diligence on ownership, premium source, and beneficiary rationale before issuing the policy.
• C. Record the beneficiary designation as an estate-planning preference and review it at the next periodic update.
• D. Issue the policy if the holding company provides incorporation documents and the premium clears.

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Cash-value insurance can be misused to place illicit funds into a financial product and later access value through surrender, loans, assignment, or beneficiary arrangements. In this scenario, several facts point in the same direction: a newly formed policy owner may obscure control, an unrelated offshore payer raises source-of-funds concerns, and an unexplained beneficiary may indicate a nominee or value-transfer arrangement. The best response is not automatic issuance or routine deferral; it is escalation for enhanced due diligence before accepting the risk. EDD should clarify beneficial ownership and control, source of funds and wealth, the relationship among payer, owner, insured, and beneficiary, and whether the arrangement has a legitimate purpose.

• Incorporation documents alone do not resolve who controls the policy or why an unrelated party is funding it.
• A third-party payment authorization may document consent, but it does not establish lawful source of funds or a legitimate relationship.
• Treating the beneficiary as routine estate planning ignores the absence of a documented relationship and the other red flags.

The combination of opaque ownership, third-party premium funding, and an unexplained beneficiary creates insurance-related money-laundering red flags that require escalation and EDD.

Question 96

Topic: Building an Anti-Financial Crime Compliance Program

A regional bank is updating its AFC training plan. Recent quality reviews found that relationship managers accepted vague invoice descriptions for new import/export customers, analysts closed alerts without comparing activity to the customer profile, and RFI responses often lacked supporting KYC documents. Which training content is the best priority?

• A. A sanctions-only refresher on exact-name screening and list update procedures
• B. Customer-service training on reducing follow-up questions to improve response times
• C. A general annual ethics reminder for all employees focused on personal conflicts of interest
• D. Role-based training on trade-related red flags, customer-profile comparison, and evidence standards for RFI responses

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Training should be risk-based and responsive to the organization’s actual control gaps and financial-crime exposure. The reviews show three linked issues: staff are missing trade-related warning signs, analysts are not testing activity against the customer’s expected profile, and RFI responses are not supported by adequate KYC evidence. The best training priority is therefore role-based content for the teams involved, with practical examples and documentation expectations. Generic or unrelated training may still be useful, but it would not address the observed AFC weaknesses. Training that reduces follow-up questions would be especially inappropriate because it could weaken due diligence and investigation quality.

• A general ethics reminder does not target the specific AML/CFT control failures observed.
• A sanctions-only refresher ignores the trade, monitoring, and RFI documentation issues in the scenario.
• Reducing follow-up questions conflicts with the need to obtain and document sufficient information for RFIs and alert reviews.

This content directly addresses the observed weaknesses in risk recognition, alert handling, and RFI support.

Question 97

Topic: Building an Anti-Financial Crime Compliance Program

Quality testing finds that client-facing employees sometimes tell customers their recent wires are “under suspicious-activity review” and suggest changing transaction patterns while compliance decides whether to file a report. Which staff awareness topic best matches this observed risk?

• A. Completing periodic KYC refreshes for low-risk customers
• B. Tuning transaction-monitoring scenarios to reduce false positives
• C. Handling customer RFIs without tipping off during investigations
• D. Validating sanctions-screening fuzzy-match thresholds

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Training should be targeted to the financial-crime risks and control weaknesses observed in the organization. Here, employees are revealing that activity is under suspicious-activity review and advising customers how to alter behavior. That creates tipping-off risk and can compromise an investigation or future reporting. The best-matched awareness content is how to handle customer requests for information, customer due diligence questions, and investigation-related communications without disclosing internal suspicion, escalation, or reporting decisions. The issue is not model tuning, routine KYC refresh, or sanctions matching; it is front-line communication during potential suspicious-activity handling.

• Transaction-monitoring tuning addresses alert quality, not what staff may say to customers during an investigation.
• Periodic KYC refresh training does not address disclosure of suspicious-activity reviews.
• Sanctions fuzzy-match validation concerns screening performance, not tipping-off risk in customer communications.

The observed behavior risks disclosing a suspicious-activity review, so training should focus on controlled customer communications and tipping-off prevention.

Question 98

Topic: Tools and Technologies to Fight Financial Crime

A bank’s AFC analytics team is tuning a cash-structuring transaction monitoring scenario. The current threshold produces 4,500 alerts per month, investigators close 92% as false positives, and a 20-day backlog has developed. A recent validation also found several suspicious activity reports involved repeated deposits just below the current threshold by higher-risk business customers. What is the best action?

• A. Raise the threshold for all customers to reduce the backlog and improve investigator productivity.
• B. Lower the threshold for all customers to capture more below-threshold deposits by any customer type.
• C. Keep the threshold unchanged and add investigators until all existing alerts are reviewed on time.
• D. Perform risk-segmented threshold testing using historical alerts, reported cases, missed-event analysis, and investigation capacity before changing production settings.

Best answer: D

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Transaction monitoring thresholds directly affect both alert volume and detection effectiveness. A threshold that is too low may create excessive false positives and backlogs, reducing timely review. A threshold that is too high may miss suspicious patterns, especially activity designed to stay below review levels. The best response is not a blanket increase or decrease, but controlled tuning: analyze historical alerts, filed reports, missed-event patterns, customer risk segments, and operational capacity. This supports a documented, risk-based threshold decision and helps determine whether different thresholds, segmentation, or scenario logic are needed for higher-risk business customers.

• Raising the threshold for all customers may reduce volume but could worsen the identified detection gap.
• Lowering the threshold for all customers may increase detection but would likely worsen false positives and backlog.
• Adding investigators addresses capacity but does not correct weak or poorly calibrated scenario design.

Thresholds should be tuned as a risk-based control design choice that balances detection effectiveness with manageable alert volume.

Question 99

Topic: Understanding the Risks and Methods of Financial Crime

A payments processor reviews a logistics company seeking to win government port contracts. The company pays a “market access fee” to an overseas agent who has no clear services contract and is a close relative of a port official. Internal emails say the payment should help “make approvals happen.” Which financial-crime concept best matches this description?

• A. Trade-based money laundering through mispriced goods
• B. Cyber-enabled account takeover fraud
• C. Bribery and corruption through a third-party intermediary
• D. Sanctions evasion through hidden beneficial ownership

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Bribery and corruption risk arises when something of value is offered, paid, or promised to improperly influence a public or private decision-maker. The risk can be indirect: payments routed through consultants, agents, distributors, or relatives may still be corrupt if the purpose is to influence an official action. Here, the unclear services, relationship to a port official, and email language about making approvals happen point to an improper influence scheme, not merely a commercial fee.

• Mispriced goods would involve trade documents, invoices, or shipment values being manipulated, which is not described here.
• Hidden beneficial ownership is a sanctions-evasion concern when ownership or control is concealed to avoid restrictions; the key issue here is influence over an official.
• Account takeover fraud involves unauthorized access to an account, which is unrelated to the payment and intermediary facts.

The agent, vague fee, official relationship, and intent to influence approvals indicate improper influence through an intermediary.

Question 100

Topic: Tools and Technologies to Fight Financial Crime

A financial institution sees a sharp increase in transaction monitoring alerts after migrating core banking data. Investigation shows that customer risk ratings, country codes, and expected-activity fields are blank or inconsistently formatted in the monitoring feed, causing scenarios to segment customers incorrectly. Which remediation action best matches the problem?

• A. Raise alert thresholds for the affected scenarios until alert volumes return to pre-migration levels.
• B. Assign a larger investigation team to review the additional alerts using existing case procedures.
• C. Cleanse and standardize the source data, fix feed mappings, add field validation, and retest alert outputs.
• D. Treat all alerts from the affected scenarios as confirmed suspicious activity.

Best answer: C

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: When unreliable alerts are caused by missing, inconsistent, or incorrectly mapped data, the remediation should address the data defect before relying on tuning or operational workarounds. In this case, the monitoring scenarios are segmenting customers incorrectly because key fields in the feed are incomplete or inconsistent. The appropriate response is to cleanse and standardize the data, correct source-to-monitoring mappings, add validation controls to prevent recurrence, and retest the alert outputs. This preserves the integrity of the AFC control and creates evidence that the control is functioning as intended after remediation.

• Raising thresholds may reduce volume but can mask suspicious activity and does not fix the faulty input data.
• Adding investigators treats the symptom of excess alerts, not the control weakness causing unreliable results.
• Treating all affected alerts as suspicious overstates the conclusion; alerts require review and cannot be confirmed solely because a data feed failed.

This addresses the root data-quality weakness and verifies that the monitoring control produces reliable alerts.

Questions 101-120

Question 101

Topic: Building an Anti-Financial Crime Compliance Program

A customer was onboarded as a local clothing wholesaler expected to receive domestic payments from retailers and make payments to listed suppliers, with monthly activity around USD 80,000. Transaction monitoring detects five inbound wires from unrelated individuals in different countries over one week, followed within 24 hours by transfers to a virtual asset service provider. The customer has no prior virtual-asset activity in 18 months. What is the BEST action for the monitoring team?

• A. Wait until the next periodic KYC review because the customer has an established account history.
• B. Suppress the activity because there is no sanctions match or adverse media hit.
• C. Escalate a transaction monitoring alert for investigation against the customer’s CDD profile and expected activity.
• D. Automatically file a suspicious activity or transaction report and exit the relationship without further review.

Best answer: C

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: Transaction monitoring should identify activity that is inconsistent with the customer’s known profile, products, counterparties, geography, and expected transaction behavior. Here, the customer’s expected activity involves domestic retailer payments and supplier payments, but the detected pattern involves unrelated foreign individuals and rapid transfers to a virtual asset service provider. That mismatch makes the activity unusual and requires escalation for investigation, possible customer inquiry, documentation, and further review. The facts may ultimately support suspicious activity reporting, but that decision should be based on the investigation and applicable escalation process, not an automatic response.

• Lack of a sanctions or adverse-media hit does not make activity consistent with the customer profile.
• Periodic KYC is not a substitute for ongoing monitoring when new activity deviates from expected behavior.
• Filing a report or exiting the relationship may be appropriate later, but automatic action without investigation skips required analysis and documentation.

The pattern materially deviates from the customer’s expected behavior and should be investigated before deciding whether it is suspicious.

Question 102

Topic: Understanding the Risks and Methods of Financial Crime

A trust and company service provider introduces a newly formed holding company seeking a private banking relationship. The customer is owned through three corporate layers in different secrecy-oriented jurisdictions, all directors are nominees supplied by the service provider, and the service provider will not identify the natural persons who ultimately control the structure. What is the best action?

• A. Treat the nominee directors as the beneficial owners because they are listed in corporate documents.
• B. Immediately file a suspicious transaction report solely because a TCSP is involved.
• C. Pause onboarding and escalate for enhanced due diligence to identify and verify beneficial owners and controllers before accepting the relationship.
• D. Accept the relationship if the service provider confirms it is licensed in its home jurisdiction.

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Trust and company service providers can be legitimate gatekeepers, but they also present elevated financial-crime risk when they create or administer structures that obscure ownership or control. In this scenario, the decisive facts are the complex cross-jurisdictional ownership chain, nominee directors, and refusal to identify the natural persons exercising ultimate ownership or control. A risk-based response is to pause onboarding, escalate the case, and perform enhanced due diligence focused on beneficial ownership, control, purpose, and source of wealth or funds before accepting the customer. The facts raise concern, but they do not automatically prove reportable suspicious activity without further assessment under the institution’s procedures.

• Licensing of the service provider does not remove the institution’s obligation to understand beneficial ownership and control.
• Nominee directors may appear on documents, but they may not be the natural persons who ultimately own or control the customer.
• TCSP involvement alone is not automatically suspicious; the opacity and refusal to provide control information drive the escalation.

Nominee directors, layered ownership, and refusal to identify natural controllers are core TCSP opacity risks requiring escalation and EDD before onboarding.

Question 103

Topic: Understanding the Risks and Methods of Financial Crime

A bank services the client trust account of a law firm that normally handles residential property closings. Most transactions match closing statements. A new matter involves a large wire from an offshore company that is not named in the purchase contract, followed by instructions to send most of the funds the next day to an unrelated foreign investment company. What is the bank’s BEST action?

• A. Treat the activity as confidential legal work and avoid asking for supporting information.
• B. Request additional information on the client, beneficial owner, source of funds, and legal purpose before allowing the transfers to proceed.
• C. Process the transfers because client trust accounts commonly receive and disburse third-party funds.
• D. Close all law firm trust accounts because professional-service firms are inherently high risk.

Best answer: B

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Professional-service activity can be legitimate, including lawyers holding funds in trust for property closings or other client matters. The issue is whether the activity is consistent with the stated service and supported by a clear economic or legal purpose. Here, the usual pattern is property-closing activity supported by settlement documents, but the new transaction includes an offshore third party not named in the contract and rapid onward movement to an unrelated foreign investment company. Those facts suggest possible misuse of a gatekeeper account to move or layer funds. The best response is risk-based inquiry and escalation as needed, not automatic processing or blanket de-risking.

• Processing the transfers overlooks that the transaction is not consistent with the stated property-closing purpose.
• Closing all law firm trust accounts is blanket de-risking rather than a risk-based response.
• Avoiding inquiry due to legal confidentiality confuses professional privilege with the bank’s AML/CFT due diligence obligations.

The unusual third-party funding and rapid onward transfer outside the stated legal matter are risk indicators that require additional inquiry.

Question 104

Topic: Understanding the Risks and Methods of Financial Crime

A currency exchange with an affiliated remittance desk notices that several unrelated walk-in customers repeatedly convert cash amounts just below the firm’s enhanced review trigger and then send the funds to the same overseas beneficiary. Which financial-crime risk is best illustrated?

• A. Sanctions screening false positive management
• B. Legitimate foreign exchange risk hedging
• C. Smurfing or structuring through money services business transactions
• D. Trade-based money laundering using mispriced invoices

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Money services businesses, remittance providers, and currency exchanges are vulnerable to cash-intensive placement and layering because they can move value quickly, sometimes across borders, and may involve non-account-based walk-in activity. A common red flag is splitting activity into smaller amounts to avoid identification, reporting, or enhanced review controls. When several apparent third parties use similar behavior and direct funds to the same beneficiary, the risk may include structuring, smurfing, mule activity, or use of a remittance corridor to obscure the true source or controller of funds.

• Trade-based money laundering would involve goods, invoices, shipping, or pricing manipulation, none of which appear here.
• Sanctions false positive management concerns resolving name-screening matches, not repeated cash splitting.
• Foreign exchange hedging is a legitimate risk-management activity and would not typically involve unrelated walk-ins sending structured remittances to one beneficiary.

The pattern shows multiple small transactions arranged to avoid review while moving value through currency exchange and remittance channels.

Question 105

Topic: Global AFC Frameworks, Governance, and Regulations

A payments institution headquartered in one country is opening a licensed branch in another jurisdiction. The branch will onboard local customers and process cross-border transfers. Compliance learns the host jurisdiction has AML/CFT reporting rules and a national sanctions list that are not included in the group’s current policy. What is the best action before launch?

• A. Launch with existing controls and remediate only if a local regulator raises an issue.
• B. Refuse all customers from the host jurisdiction to avoid conflicts between regimes.
• C. Map the host-jurisdiction AML/CFT and sanctions obligations, update local controls and screening, and obtain governance approval before go-live.
• D. Apply only the headquarters AML/CFT policy because the branch is part of the same legal group.

Best answer: C

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Institutions need awareness of the AML, CFT, and sanctions regimes in each jurisdiction where they operate, not only where they are headquartered. A branch onboarding local customers and processing cross-border transfers may be subject to host-country reporting, due diligence, recordkeeping, and sanctions-screening expectations. The best action is to identify the applicable obligations, assess gaps against group standards, update procedures and systems, and secure appropriate governance approval before launch. This supports a risk-based, compliant operating model and reduces the risk of missed sanctions hits or reporting failures.

• Relying only on headquarters policy ignores host-jurisdiction obligations that apply to the branch.
• Launching first and waiting for regulator feedback treats compliance as reactive rather than embedded in the business change.
• Refusing all customers is blanket de-risking and does not address the need to understand and manage applicable regimes.

A licensed branch must understand and operationalize applicable local AML/CFT and sanctions requirements where it conducts business.

Question 106

Topic: Global AFC Frameworks, Governance, and Regulations

A national agency has statutory authority to issue AML/CFT rules for regulated financial institutions, conduct examinations, require remediation, and impose penalties for noncompliance. Which type of body is being described?

• A. Voluntary public-private information-sharing forum
• B. Industry association
• C. Public supervisory authority
• D. Non-governmental advocacy organization

Best answer: C

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: In AFC governance, a public authority acts under legal or regulatory mandate. Examples include financial supervisors, regulators, law-enforcement agencies, customs authorities, and FIUs, depending on the function. The decisive facts in the stem are statutory authority, enforceable rules, examinations, remediation requirements, and penalties. Industry associations and NGOs can publish guidance, share typologies, advocate policy positions, or support training, but they generally do not have legal power to compel compliance or impose sanctions. Public-private forums can improve collaboration and information sharing, but participation and outputs do not replace binding regulatory obligations.

• Industry associations may issue best-practice guidance, but they do not usually examine firms or impose legal penalties.
• Non-governmental advocacy organizations can influence policy or publish research, but they lack statutory supervisory powers.
• Public-private information-sharing forums support collaboration, but they are not the source of enforceable AML/CFT rules in this scenario.

A public supervisory authority derives powers from law and can set enforceable requirements, examine institutions, and sanction noncompliance.

Question 107

Topic: Understanding the Risks and Methods of Financial Crime

A bank reviews a retail customer whose profile shows salaried employment and modest expected discretionary spending. Over two months, the customer sends frequent high-value transfers to an online gambling operator, receives near-matching withdrawals shortly afterward, and provides no explanation for the funds used. Which concept best matches this activity?

• A. Ordinary entertainment spending consistent with a customer’s discretionary lifestyle
• B. Card-not-present fraud involving disputed online merchant purchases
• C. Real estate integration risk using gambling winnings to purchase property
• D. Gambling-sector money laundering risk involving value movement and source-of-funds concerns

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Gambling activity is not automatically suspicious; many customers spend money on entertainment. The distinction turns on whether the activity is consistent with the customer profile and whether it appears to move value rather than pay for leisure. Frequent high-value transfers to a gambling operator, near-matching withdrawals, and unexplained funds are indicators that the gambling channel may be used for placement or layering, or to create an apparent source of funds. This is different from occasional betting or entertainment spending that fits the customer’s known income and expected behavior.

• Ordinary entertainment spending fails because the activity is high-value, repetitive, and inconsistent with the customer profile.
• Card-not-present fraud focuses on unauthorized or disputed purchases, which is not the issue described.
• Real estate integration is not supported because there is no property purchase or use of gambling proceeds to acquire assets.

Frequent high-value gambling transfers followed by near-matching withdrawals can indicate movement or layering of value and should prompt source-of-funds scrutiny.

Question 108

Topic: Understanding the Risks and Methods of Financial Crime

A private company seeking onboarding is owned by two corporate shareholders in different jurisdictions. Its listed director is a professional nominee for many companies, and the relationship manager cannot identify any natural person who ultimately directs the company’s activities. Which risk concern does this most directly indicate?

• A. Trade-based money laundering risk from manipulated invoices
• B. Cash-intensive business risk from unrecorded physical currency flows
• C. Nonprofit diversion risk from charitable disbursements
• D. Opaque beneficial ownership and control in a layered legal-entity structure

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Legal entities and arrangements can present heightened financial-crime risk when their ownership or control is difficult to determine. Layered corporate shareholders across jurisdictions and nominee directors may be legitimate, but they can also obscure who ultimately owns, benefits from, or controls the customer. That lack of transparency weakens CDD and can prevent the institution from understanding the true risk of the relationship. In this scenario, the decisive concern is not the movement of cash, trade goods, or charitable funds; it is the weakened visibility into beneficial ownership and control created by the structure.

• Cash-intensive business risk would involve large or unexplained physical cash activity, which is not described.
• Trade-based money laundering would involve trade documents, invoices, goods, or pricing manipulation, none of which appears here.
• Nonprofit diversion risk would involve charitable purposes or funds being misused, but the customer is a private company.

The layered entities and nominee director weaken transparency over the natural persons who own or control the customer.

Question 109

Topic: Tools and Technologies to Fight Financial Crime

An AFC team reviews a digital onboarding platform and finds that identity verification is strong for all customers, but sanctions screening, adverse media checks, transaction monitoring, and periodic review are not adjusted for high-risk products, non-face-to-face channels, or higher-risk jurisdictions. The team recommends mapping tool capabilities across onboarding and ongoing monitoring to those risk drivers. Which concept best matches this recommendation?

• A. Enterprise data retention schedule
• B. Alert case management workflow
• C. Standalone model validation
• D. Risk-based lifecycle tool coverage

Best answer: D

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Lifecycle AFC tools should be deployed and calibrated according to the institution’s risk profile, not applied uniformly without regard to risk drivers. Customer risk, product features, delivery channel, and jurisdiction exposure should influence which tools are used and how intensively they operate across onboarding, screening, transaction monitoring, periodic review, and investigations. In the scenario, the gap is not simply whether one tool works; it is whether the overall tool coverage matches the risks presented by products, channels, and jurisdictions throughout the customer lifecycle.

• Standalone model validation focuses on testing a model’s performance, not mapping end-to-end tool coverage to risk drivers.
• Alert case management workflow addresses investigation handling after alerts are generated, not whether lifecycle controls cover the right risks.
• Enterprise data retention schedule concerns how long records are kept, not risk-based deployment of AFC tools.

This concept aligns AFC tools across the customer lifecycle with customer, product, channel, and jurisdiction risks.

Question 110

Topic: Understanding the Risks and Methods of Financial Crime

A financial institution is publicly linked to laundering proceeds through its accounts. Customers and correspondent banks begin to question the institution’s controls, and media coverage suggests the broader financial sector may be vulnerable to criminal abuse. Which impact of money laundering is best described?

• A. A sanctions-screening match requiring list-based escalation
• B. A customer due diligence control used at onboarding
• C. A predicate offense that generates illicit proceeds
• D. Erosion of institutional reputation and public trust in financial-system integrity

Best answer: D

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Money laundering harms more than the individual institution that processed illicit funds. When a regulated firm is used to move or disguise criminal proceeds, customers, counterparties, and the public may question whether the firm’s controls are reliable and whether the financial system can prevent criminal abuse. This weakens institutional reputation and can reduce confidence in financial-system integrity. Predicate offenses, sanctions screening, and due diligence controls are related AFC concepts, but they do not describe the broader damage caused when laundering undermines trust.

• A predicate offense is the underlying crime that produces illicit proceeds, not the reputational or trust impact of laundering.
• A sanctions-screening match is a control escalation issue tied to restricted parties or transactions.
• Customer due diligence is a preventive control, not the resulting loss of confidence described in the scenario.

Money laundering can make an institution and the wider financial system appear unsafe or complicit, damaging reputation and confidence.

Question 111

Topic: Understanding the Risks and Methods of Financial Crime

A VASP analyst reviews a new retail customer who converted $85,000 from fiat to Bitcoin two days after onboarding. Within 30 minutes, the customer sent the funds to multiple new external wallets, after which blockchain analytics show consolidation through a mixer and swaps into a privacy coin. The customer’s stated purpose is only “personal investing,” and there is no sanctions match. What is the BEST next action?

• A. Escalate for AML investigation and enhanced due diligence to assess potential layering and suspicious activity reporting.
• B. Treat the activity as routine virtual-asset investing because the initial funds came from fiat.
• C. Close the alert because the customer passed onboarding checks and has no sanctions match.
• D. Contact the customer and explain that the transactions appear to involve money laundering typologies.

Best answer: A

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: The pattern combines several virtual-asset typology indicators: rapid movement shortly after onboarding, splitting funds across new wallets, use of a mixer, and conversion into a privacy-enhancing asset. A lack of sanctions match does not resolve AML concerns, and a legitimate fiat source does not explain subsequent obfuscation. The best action is to escalate for investigation, apply enhanced due diligence as appropriate, review blockchain analytics and customer rationale, and determine whether suspicious activity reporting is required under the institution’s procedures.

• Passing onboarding checks does not eliminate the need to investigate later high-risk transactional behavior.
• A fiat entry point does not make subsequent mixer use and privacy-coin conversion low risk.
• Telling the customer the activity resembles money laundering can create tipping-off risk and compromise the investigation.

Rapid movement through new wallets, a mixer, and a privacy coin are typology indicators that warrant escalation beyond routine monitoring.

Question 112

Topic: Tools and Technologies to Fight Financial Crime

A bank’s AFC team wants to improve detection of mule-account networks using patterns from several affiliates, but data protection rules limit the transfer or disclosure of raw personal data between jurisdictions. Which technology concept best matches this need?

• A. Privacy-enhancing technologies
• B. Network visualization
• C. Adverse media screening
• D. Robotic process automation

Best answer: A

What this tests: Tools and Technologies to Fight Financial Crime

Explanation: Privacy-enhancing technologies (PETs) help institutions use data for AFC purposes while managing privacy and data protection constraints. Examples may include federated learning, secure multiparty computation, homomorphic encryption, tokenization, and differential privacy. These methods can support model training, typology sharing, or collaborative analytics without broadly moving or exposing raw personal data. They do not eliminate legal, governance, or model-risk obligations, but they can make AFC controls more compatible with privacy principles such as data minimization and controlled access.

• Robotic process automation automates repetitive tasks but does not inherently protect personal data during cross-border analytics.
• Adverse media screening identifies negative public information about customers or counterparties, not privacy-preserving data use.
• Network visualization helps investigators see relationships but does not by itself solve data transfer or disclosure limits.

Privacy-enhancing technologies allow AFC analysis or collaboration while reducing exposure of identifiable customer data.

Question 113

Topic: Global AFC Frameworks, Governance, and Regulations

An FIU in Country A has provided intelligence to national prosecutors about suspected laundering of corruption proceeds through accounts in Country B. Prosecutors now need certified bank records from Country B that can be used in a criminal trial, and the foreign bank will not produce them without legal compulsion. Both countries have a formal mutual legal-assistance channel. What is the BEST action?

• A. Request the records through a regulator-to-regulator supervisory memorandum of understanding.
• B. Submit a mutual legal assistance request through the designated central authorities for compelled production of the records.
• C. Have the correspondent banking relationship manager ask the foreign bank to send the records directly.
• D. Ask Country A’s FIU to obtain the records from Country B’s FIU through the Egmont Secure Web.

Best answer: B

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Cross-border cooperation channels should match the purpose of the request. FIU-to-FIU channels, including Egmont mechanisms, are valuable for rapid intelligence exchange, but they generally are not the best route for compelled evidence intended for use in court. When prosecutors need certified bank records, legal compulsion, and admissibility in a criminal proceeding, the formal mutual legal assistance process is the best fit. It uses designated authorities and preserves the legal basis for obtaining and transmitting evidence. Supervisory cooperation and private bank-to-bank outreach may support oversight or due diligence, but they do not replace a formal evidence-gathering channel for criminal prosecution.

• FIU-to-FIU exchange is better suited to intelligence, not compelled trial evidence.
• Supervisory memoranda support regulator cooperation, not criminal evidence production for prosecutors.
• Direct bank outreach lacks legal compulsion and may not produce admissible records.

Formal mutual legal assistance is the appropriate cross-border channel when prosecutors need legally compelled, court-usable evidence.

Question 114

Topic: Building an Anti-Financial Crime Compliance Program

An AFC committee is redesigning its board dashboard. The current dashboard lists all metrics as “risk indicators”: 97% of transaction-monitoring alerts closed within the target timeframe, 99.9% sanctions-screening system uptime, 94% staff training completion, and a 32% quarterly increase in newly onboarded customers using complex offshore ownership from higher-risk jurisdictions. The committee wants reporting that separates control performance from changes in financial-crime exposure. What is the best action?

• A. Classify all four metrics as risk indicators because each can affect the institution’s AFC risk profile.
• B. Classify only missed targets as risk indicators and report metrics that meet targets as performance indicators.
• C. Remove exposure metrics from board reporting until suspicious activity is confirmed by an investigation.
• D. Classify the offshore-ownership and higher-risk-jurisdiction growth as a risk indicator, and report alert closure, screening uptime, and training completion as performance indicators.

Best answer: D

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: AFC management reporting should separate indicators of control performance from indicators of risk exposure. Performance indicators, often KPIs, show whether processes and controls are operating as intended, such as alert closure timeliness, sanctions-screening availability, and training completion. Risk indicators, often KRIs, point to changes in inherent or residual financial-crime risk, such as growth in higher-risk customers, geographies, ownership structures, products, or typologies. In this scenario, the increase in customers with complex offshore ownership from higher-risk jurisdictions is a risk indicator because it changes the institution’s exposure. The other measures are performance indicators, although poor performance against them could still require escalation.

• Treating every metric as a risk indicator blurs the distinction between exposure and control performance.
• Using target achievement as the dividing line is flawed; KPIs can miss targets, and KRIs can improve or deteriorate.
• Waiting for confirmed suspicious activity is too late because KRIs should help identify emerging risk before cases are proven.

The customer growth metric signals changing financial-crime exposure, while the other metrics measure how well AFC controls and processes are operating.

Question 115

Topic: Understanding the Risks and Methods of Financial Crime

A bank is onboarding a privately held electronics wholesaler. The customer is newly incorporated, was introduced through a non-face-to-face channel, has beneficial owners in two different jurisdictions, and expects regular cross-border payments to multiple counterparties. The bank’s policy rates each factor as moderate when viewed alone. Which action best reflects a risk-based assessment?

• A. File a suspicious activity or transaction report immediately based only on the onboarding risk profile.
• B. Decline the customer automatically because combined moderate factors always exceed risk appetite.
• C. Aggregate the factors, treat the relationship as higher overall exposure, and apply proportionate enhanced due diligence and monitoring.
• D. Proceed with standard due diligence because no single factor is classified as high risk.

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: A risk-based approach considers the combined effect of customer, product, channel, jurisdiction, and transaction factors. Moderate risks do not remain moderate simply because they are assessed one at a time. Here, a new company, remote onboarding, cross-border ownership, and expected international payments create a more complex profile and may increase exposure to money laundering, sanctions evasion, or fraud typologies. The best response is not automatic rejection or immediate suspicious reporting; rather, the institution should aggregate the risks, determine whether the overall rating should be elevated, and apply controls such as enhanced due diligence, clearer expected activity, ownership verification, and tailored ongoing monitoring.

• Standard due diligence ignores the compounding effect of several moderate indicators.
• Automatic decline is too rigid; risk-based controls may manage the exposure if within appetite.
• Immediate suspicious reporting requires suspicion supported by activity or information, not risk factors alone.

Multiple moderate factors can compound into elevated overall risk even when no single factor is rated high.

Question 116

Topic: Understanding the Risks and Methods of Financial Crime

A trade-finance analyst reviews a payment for a small textile importer. The invoice names a long-standing supplier, but the incoming funds are from a newly formed consulting company in a different country. The customer says the consulting company is “helping with settlement” but cannot explain its role or provide an agency agreement. Which is the best next action?

• A. Escalate the activity for enhanced review and obtain documentation explaining the intermediary and third-party payment relationship before proceeding.
• B. Process the payment after updating the customer profile to include consulting companies as expected counterparties.
• C. Reject all future payments involving third parties without further review because they are always prohibited.
• D. Clear the activity because the customer has a legitimate import business and the invoice names a known supplier.

Best answer: A

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Unusual intermediaries and unexplained third-party payments are important financial-crime risk indicators, especially when they do not match the stated business purpose of a transaction. Here, the payer is not the supplier named on the invoice and the customer cannot explain why a newly formed consulting company in another country is involved. The best action is not to rely solely on the invoice or automatically exit the relationship; it is to escalate for enhanced review, seek supporting documentation, and assess whether the arrangement has a legitimate business rationale or suggests layering, trade-based money laundering, or concealment of beneficial parties.

• Clearing the activity overweights the existence of an invoice and ignores the mismatch between payer, supplier, and business rationale.
• Updating expected counterparties without evidence would normalize unexplained behavior rather than resolving the risk.
• Rejecting all third-party payments is not risk-based; some may be legitimate if properly documented and understood.

The unexplained intermediary and third-party payment are inconsistent with the stated trade rationale and warrant EDD/escalation.

Question 117

Topic: Building an Anti-Financial Crime Compliance Program

A bank applies ordinary CDD to most customers. A new corporate customer has a complex cross-border ownership chain, adverse media alleging corruption, and expected high-volume payments to higher-risk jurisdictions. Compliance recommends additional ownership verification, senior management approval, and more frequent monitoring before onboarding. Which concept best matches this response?

• A. Standard customer due diligence
• B. Enhanced due diligence
• C. Independent audit testing
• D. Simplified due diligence

Best answer: B

What this tests: Building an Anti-Financial Crime Compliance Program

Explanation: A risk-based AFC program scales controls to the level of financial-crime risk. When multiple risk factors exceed the ordinary baseline—such as complex ownership, adverse media, higher-risk jurisdictions, or unusual expected activity—the institution should apply enhanced due diligence or other enhanced controls. These may include deeper source-of-wealth or ownership checks, senior management approval, tighter onboarding conditions, and more frequent ongoing monitoring. The goal is not to reject every higher-risk customer automatically, but to determine whether the risk can be understood, mitigated, and accepted within the institution’s risk appetite.

• Simplified due diligence is used for demonstrably lower-risk relationships, not for complex or higher-risk profiles.
• Standard customer due diligence is the baseline control set and does not address the elevated factors described.
• Independent audit testing assesses program effectiveness; it is not the customer-level control response to an elevated onboarding risk.

EDD applies additional controls when customer, product, geographic, or activity risk exceeds the institution’s baseline risk tolerance.

Question 118

Topic: Global AFC Frameworks, Governance, and Regulations

A country’s latest national risk assessment states that cross-border remittance providers serving conflict-affected corridors present elevated terrorism-financing risk. A bank has a licensed remittance customer in that sector. The latest review shows activity consistent with the customer’s profile, no sanctions matches, and no adverse media. The relationship manager asks whether the assessment requires an immediate suspicious activity report. What is the best action?

• A. Make no changes unless the transaction-monitoring system generates an internal alert on the customer.
• B. File a suspicious activity report because the national risk assessment identifies the customer’s sector as high risk.
• C. Use the national risk assessment as an external risk input to reassess the customer’s risk rating and controls, and escalate only if customer or transaction evidence supports suspicion.
• D. Exit the relationship because continuing to bank a sector named in the assessment would be inconsistent with a risk-based approach.

Best answer: C

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: National and sector risk assessments provide external insight into typologies, vulnerable sectors, jurisdictions, and products. They should feed the institution’s enterprise risk assessment, customer risk scoring, due diligence depth, monitoring scenarios, and management reporting. However, an external assessment does not by itself prove that a particular customer is suspicious. In this scenario, the customer is licensed, activity is consistent with its profile, and there are no sanctions or adverse-media concerns. The best action is to incorporate the external risk signal into the bank’s risk-based controls while continuing to look for customer- or transaction-specific evidence before escalating for suspicious activity reporting.

• Filing solely because the sector is high risk confuses external risk insight with specific suspicion.
• Exiting the relationship solely on sector exposure is blanket de-risking, not risk-based management.
• Waiting for an automated alert ignores the need to incorporate national risk assessment findings into risk assessment and control design.

External risk assessments inform risk-based controls, but suspicious reporting generally requires customer- or transaction-specific grounds for suspicion.

Question 119

Topic: Understanding the Risks and Methods of Financial Crime

A VASP reviews an alert showing that a customer’s wallet received cryptoassets from addresses identified by blockchain intelligence as recent victim payment wallets in malware-extortion incidents. The customer then routed the funds through a mixer and requested withdrawal. Which exposure is most directly indicated?

• A. Sanctions exposure from direct dealings with a listed wallet
• B. Terrorist-financing exposure from ideological fundraising
• C. Ransomware-related proceeds exposure
• D. Tax-evasion exposure from undeclared crypto gains

Best answer: C

What this tests: Understanding the Risks and Methods of Financial Crime

Explanation: Cryptoasset activity can create different financial-crime exposures depending on the source, destination, and behavior of funds. Payments traced from victim wallets associated with malware-extortion incidents are a classic indicator of ransomware-related proceeds. The use of a mixer and rapid withdrawal request may strengthen the laundering concern, but the decisive concept is the connection to ransomware victim payments. Other crypto risks may involve sanctioned wallet exposure, terrorist fundraising, or concealment of taxable gains, but those require different indicators than the facts provided.

• Ideological fundraising would require indicators such as extremist fundraising links, conflict-zone support, or known terrorist-financing networks.
• Undeclared gains concern concealment of taxable income or capital gains, not ransom payments from victims.
• Sanctions exposure would be most direct if the counterparty or wallet were sanctioned or linked to a sanctioned jurisdiction or entity.

Victim payment wallets tied to malware extortion point most directly to ransomware proceeds being laundered.

Question 120

Topic: Global AFC Frameworks, Governance, and Regulations

An AFC analyst is updating a sector risk assessment for correspondent banking. The analyst needs nonbinding, non-government guidance that reflects practices and typology insights from major global financial institutions rather than an official regulator or FIU. Which source is the best match?

• A. National risk assessment
• B. FIU suspicious transaction reporting form
• C. FATF mutual evaluation report
• D. Wolfsberg Group principles or guidance

Best answer: D

What this tests: Global AFC Frameworks, Governance, and Regulations

Explanation: Non-government sources can help compliance teams understand emerging typologies, sector-specific risks, and good practices without replacing legal or regulatory obligations. The Wolfsberg Group is a private-sector body made up of major global banks and is known for publishing nonbinding AML/CFT principles, statements, and guidance. These materials are useful for benchmarking controls and understanding financial-institution perspectives on risks such as correspondent banking, customer due diligence, and transaction monitoring. Official reports from FATF, national authorities, or FIUs are also important, but they are governmental or intergovernmental sources rather than the non-government guidance requested in the stem.

• FATF mutual evaluation reports assess jurisdictions against FATF standards and are intergovernmental, not private-sector guidance.
• National risk assessments are official country-level assessments, not non-government sector guidance.
• FIU suspicious transaction reporting forms support reporting obligations, but they are not typology or sector-risk guidance from a private body.

The Wolfsberg Group is a private-sector association that publishes nonbinding AML/CFT guidance and typology-relevant materials for financial institutions.

Continue with full practice

Use the CAMS Practice Test page for the full Finance Prep practice bank, mixed-topic practice, timed mock exams, and explanations.

Focused topic pages

• CAMS: Understanding the Risks and Methods of Financial Crime
• CAMS: Global AFC Frameworks, Governance, and Regulations
• CAMS: Building an Anti-Financial Crime Compliance Program
• CAMS: Tools and Technologies to Fight Financial Crime

Free review resource

Use the full Finance Prep practice page above for the latest review links and practice page.