CAMS asks you to connect a transaction or customer fact pattern to the risk it creates, the control that addresses it, and the decision an investigator should document. This guide develops that reasoning across four areas: how financial crime works, how global standards and local rules shape obligations, how an anti-financial crime program operates, and how data and technology support its controls. You will follow funds through different products and sectors, distinguish suspicion from proof, assess risk throughout a customer relationship, and test whether a control actually works. Examples use stated assumptions where a numerical rule would depend on jurisdiction or current law. The aim is to make each decision explainable from the available facts.
Understanding the Risks and Methods of Financial Crime
1. Predicate crime and the movement of proceeds
A predicate crime is the underlying offense that produces value, such as fraud, theft or corruption. Laundering concerns later handling of that value in ways that may conceal its origin, ownership or movement. Keep the two questions separate: what generated the funds, and what happened after they were obtained? Trace the earliest identifiable payment, the account holder, each subsequent recipient and any stated commercial purpose. An invoice may explain why a bank transfer occurred without proving that the invoiced work existed. Likewise, an onward transfer may be ordinary supplier payment even when the incoming funds are suspicious. Compare contracts, delivery evidence, account activity and relationships between parties before describing the suspected conduct. A financial crime study guide can help you compare predicate offenses, but each case still needs its own transaction trail.
Worked example: A company receives 80,000 hypothetical units for an invoice covering work that records suggest was never performed. It sends 50,000 to an affiliate and 30,000 to a newly opened account, exhausting the receipt. The suspected invoice fraud is the possible source of proceeds. The two transfers are later conduct to investigate: obtain payment purposes, ownership links and evidence of any genuine services.
Watch the distinction: A suspicious incoming payment does not make every later transfer proven laundering. Establish the suspected source, trace the value and examine the purpose of each transfer separately.
Reference: [1]
2. Placement, layering and integration
Placement, layering and integration are a useful description of how criminal value can enter, move through and emerge from financial channels. Placement introduces proceeds into a financial or commercial system. Layering adds transactions or entities that make tracing harder. Integration makes value appear available for ordinary use, perhaps as property or business income. These labels describe functions, not legal findings or required steps. A transfer can serve more than one function, and some schemes begin with electronic fraud proceeds already inside the banking system. Work backward from the asset as well as forward from the suspected offense. Record who controlled each account, whether value changed form, and whether supporting documents explain the movement. An apparently elaborate chain matters only if the transactions actually obscure source or control.
Worked example: Hypothetical criminal cash is deposited into an account, transferred through Company A and Company B, then used to buy property. The deposit resembles placement, the company transfers layering, and the purchase integration. Check ownership and commercial purpose at each step. If the person buys the property directly with criminal proceeds, the case may show placement and integration without an apparent layering chain.
Watch the distinction: Do not force every transaction into one stage or assume three stages must occur in order. The model helps organize facts; the actual fund flow controls the analysis.
Reference: [1]
3. Commingling through a cash business
A cash business can mix legitimate receipts with injected proceeds because cash sales are harder to connect to individual payers. The practical test is whether reported revenue fits observable operations. Compare transactions with opening hours, seats, staffing, stock purchases, point-of-sale records, tax records and seasonal patterns. Convert revenue into implied customer counts where average ticket data permits, then test whether capacity could support those counts. A mismatch is a lead, not a finding that every unsupported sale is illicit. Missing records, promotions, inaccurate estimates or another sales channel can also explain it. Look for repeated discrepancies, particularly days when banked cash rises without matching inventory use or documented sales. The strongest inference comes from independent records that should move together but do not.
Worked example: A café's till, stock and staffing records support about 120 sales per quiet weekday, yet its books report 300 cash sales. The gap is 300 minus 120, or 180 sales per day. Review receipts, average ticket, delivery orders, inventory depletion and bank deposits across comparable days. Without those checks, the gap identifies unexplained revenue rather than 180 proven fabricated sales.
Watch the distinction: High cash deposits alone do not show commingling. First test whether real customers, sales channels and stock movements can account for the reported turnover.
Reference: [1]
4. Transaction splitting and coordinated activity
Splitting divides a larger flow among transactions, people, accounts or dates. The diagnostic question is whether those parts behave like one coordinated activity. Link deposits by timing, locations, common devices, shared contact details, instructions and ultimate beneficiary. A sequence of modest payments may be more informative than one large payment if the money converges rapidly and participants lack independent reasons to pay. Conversely, similar amounts can reflect wages, family support or routine business collections. Do not infer intent from a round number or from proximity to an assumed threshold. Map both the sources and the destination, then ask each participant's relationship to the recipient and source of funds. Where accounts were used as conduits, compare how long funds remained and whether the account holders retained any economic benefit.
Worked example: Five people deposit 9,000 hypothetical units each and promptly send all proceeds to one recipient. The total is 5 × 9,000 = 45,000 units. Their synchronized deposits and common beneficiary suggest a coordinated flow worth reviewing. Test employment, family or business ties, instructions, funding sources and prior behavior; no individual 9,000-unit deposit proves an attempt to evade a rule.
Watch the distinction: Treating each deposit as isolated misses the shared destination. Treating any repeated amount as deliberate evasion also goes too far without evidence of coordination or purpose.
Reference: [1]
5. Trade-based laundering
Trade can move value through the apparent price, quantity or nature of goods. Compare the invoice with purchase orders, customs descriptions, transport documents, insurance, payment records and credible prices for comparable goods. Overpricing may transfer excess value to a seller; underpricing may shift value to a buyer. False shipments or duplicate invoices can create a payment story without equivalent goods. Price differences alone are weak evidence because specifications, scarcity, freight, insurance, taxes and contract timing can change a fair comparison. Ask whether the payer, seller, shipper and consignee fit the commercial chain and whether payment terms match the trade. Reconcile documents by goods, dates and units rather than comparing headline totals alone. The key inference is unexplained value movement supported by inconsistent commercial evidence.
Worked example: An importer pays 240,000 hypothetical units for goods independently valued at 150,000 on apparently comparable terms. The apparent excess is 240,000 minus 150,000 = 90,000 units, or 60% of the comparison value. Check grade, quantity, currency, freight and insurance before calling it overpricing. If those do not explain the gap, trace the seller's ownership and subsequent use of the excess.
Watch the distinction: A price above a reference quote is not automatically trade-based laundering. Confirm that the goods and contract terms are comparable, then examine whether the unexplained difference moved value.
Reference: [1]
6. Correspondent banking exposure
A correspondent bank provides payment or account services to another institution, the respondent. It may not have a direct relationship with the respondent's customers, yet their transactions pass through its systems. Risk increases when downstream institutions gain access through the respondent or when payment messages omit meaningful originator or beneficiary information. Assess the respondent's ownership, business model, supervision, customer base, markets served and controls for identifying its own customers. Determine whether other banks can use the relationship and how that access is governed. At transaction level, inspect available party data and seek clarification when a payment's purpose or parties remain obscure. A correspondent cannot simply substitute the respondent's assurance for all analysis; it needs enough visibility to understand the relationship and investigate unusual flows under applicable requirements.
Worked example: Bank C processes payments for respondent R, which also serves smaller banks. Several messages show R but omit usable information about the underlying originators. Bank C should establish which downstream institution and customer initiated each payment, ask why fields are missing, and assess R's controls over nested access. The visibility gap affects both relationship risk and the review of those specific payments.
Watch the distinction: The respondent's name is not necessarily the true economic originator. Nested access can place other institutions' customers behind it, making payment information and relationship oversight essential.
Reference: [1]
7. Opaque legal entities
A registry usually identifies a legal shareholder, while beneficial ownership analysis seeks the natural person who ultimately owns or controls an entity. Follow every ownership layer and examine voting rights, appointment powers, shareholder agreements, trusts and nominee arrangements. A person with a small economic stake may control decisions through contractual rights; a large registered stake held by another company does not identify the human controller. Draw the chain, state what each document proves, and mark gaps rather than filling them with assumptions. Verify claimed owners and controllers using reliable evidence appropriate to the risk and the applicable jurisdiction's rules. Payment behavior can then test the structure: transfers to an undisclosed controller or related company may contradict the onboarding account of who benefits from the business.
Worked example: Company A's register names Company B as its owner. A separate agreement gives Mira the right to direct B's votes on A's key decisions. The register establishes B's legal stake, while the agreement points to Mira's possible ultimate control. Obtain B's ownership records and the current agreement, then identify any other people with ownership or control rights before concluding who controls A.
Watch the distinction: Stopping at the first registered corporate shareholder leaves the human controller unidentified. Ownership percentages and voting or appointment rights can point to different people.
Reference: [1]
8. Real estate as a store of value
Property can retain value, convert funds into an asset and later produce sale proceeds with an apparently ordinary explanation. Assess who supplied the purchase money, who legally and effectively owned the property, how the price compared with independent valuations, and who received sale proceeds. Rapid resale at a loss deserves inquiry when the buyer and seller are connected or a third party absorbs the difference. It can also reflect market changes, defects, urgent liquidity needs or transaction costs. Trace loans, gifts and company funding rather than treating the named buyer as the only funder. Examine whether the same people control both sides of a transaction and whether renovations or changed conditions justify the prices. A property transaction is a value flow whose documents need to reconcile with its economic story.
Worked example: An entity buys a property for 1.2 million hypothetical units and soon sells it for 900,000. The stated price loss is 300,000 units, equal to 25% of the purchase price, before costs. Compare independent valuations and property condition, then identify both parties' controllers and the source and destination of funds. A deliberate loss could transfer value, but market evidence may explain it.
Watch the distinction: A cash purchase or quick resale is a cue, not a conclusion. Price, ownership, funding and the reason for any loss determine what the pattern may mean.
Reference: [1]
9. Securities and investment products
Investment products can turn a subscription into later redemption proceeds that appear to come from a regulated investment account. Investigate the complete cycle: who funded the subscription, who controlled the investment, whether ownership or units transferred, and where redemption proceeds went. A third-party payment may be legitimate, but it can obscure the true source of money if the payer has no clear relationship to the customer. Immediate redemption, indifference to returns or instructions to pay an unrelated account may indicate that moving funds mattered more than investing. Compare the activity with the customer's stated purpose and expected holding period. Review fees or losses the customer accepted, because willingness to incur cost can be informative when a product is used mainly to change the apparent origin of funds.
Worked example: A customer subscribes to a fund using money from an unrelated company, gives no investment instructions, then asks for redemption to a newly named account. Establish the payer's relationship and source of funds, who controlled the units, the holding period and the payout account's owner. A genuine investment may explain the sequence, but the funding and redemption endpoints currently lack a coherent account.
Watch the distinction: A redemption statement proves that an investment paid out; it does not prove the original subscription was legitimate or that the person receiving redemption is the proper beneficiary.
Reference: [1]
10. Insurance product misuse
Some insurance products accept substantial upfront value and permit surrender or changes to beneficiaries. Misuse can occur when someone funds a policy, quickly exits and presents the insurer's payout as the source of funds. Assess the product's normal purpose, premium payer, insured person, owner, beneficiaries, timing of changes and destination of proceeds. A surrender loss can be commercially rational for someone paying a cost to move or re-label value, but legitimate policyholders also surrender because needs change. Compare the customer's original stated purpose with subsequent actions. Identify whether the person accepting the loss also benefits from the payout; a mismatch may reveal a transfer to another party. Product features and local requirements vary, so evaluate the actual contract and transaction trail rather than assuming all policies work alike.
Worked example: A customer pays a hypothetical 100,000-unit single premium and soon surrenders the policy for 92%, receiving 92,000 units. The loss is 100,000 minus 92,000 = 8,000 units. Ask why the policy was bought, who paid the premium and who received the surrender proceeds. The accepted loss may be a cost of moving value, or an explained change in circumstances.
Watch the distinction: Early surrender is not proof of misuse, and the payout is not automatically clean because an insurer issued it. Trace the premium payer and ultimate recipient.
Reference: [1]
11. Money services and remittance networks
A remittance network may show only fragments of a wider pattern if transfers are reviewed by sender or agent alone. Aggregate activity by recipient, destination, time window, device, contact details and funding source, while checking for legitimate shared households or community collections. A common recipient can be a family member, supplier or organizer, so the relationship matters. Examine whether senders appear independent, whether agents are geographically unusual, and whether money is quickly withdrawn or passed onward. Agent behavior also matters: repeated incomplete records or unusual concentration at one location may weaken visibility. Review corridor risk alongside the specific parties and purposes rather than relying on destination country alone. The central question is whether several apparently separate transfers are economically one flow, and what evidence supports that conclusion.
Worked example: Three senders use different agents to remit a combined 27,000 hypothetical units to one recipient over two days. Aggregation reveals a common endpoint that three separate reviews might miss. Compare sender relationships, stated purposes, funding sources and instructions. Family support or a shared supplier payment may explain the pattern; rapid coordination without a clear relationship warrants closer inquiry.
Watch the distinction: Different agents do not make transfers unrelated, while one shared recipient does not make them illicit. Link the flows and test the senders' economic reasons.
Reference: [1]
12. Virtual asset movement
A public blockchain can show transfers between addresses, amounts and timing, but an address is not by itself a verified person. Trace the visible path, noting where funds enter or leave hosted services, and distinguish a direct transfer from a probabilistic link through a cluster. Exchanges may hold identity, funding and withdrawal records that connect an account to a customer, subject to lawful access and data quality. Self-hosted wallets, intermediaries and pooled service addresses can interrupt confident attribution. Ask whether the customer controls a wallet, merely paid it, or received funds from it. Compare on-chain timing with exchange ledger entries and the customer's stated purpose. Treat analytics labels as leads requiring corroboration, especially when funds pass through services that combine many users' transactions.
Worked example: Funds leave Exchange A, pass through three visible wallets and arrive at an account at Exchange B. The ledger establishes the recorded path between addresses, assuming the traced transfers are correctly linked. It does not identify every wallet controller. Customer records at both exchanges may identify account holders and withdrawal instructions; further evidence is needed before attributing the intervening wallets to either customer.
Watch the distinction: A wallet address is an identifier for transactions, not a verified legal identity. Attribution becomes stronger when exchange records, control evidence and timing corroborate the ledger.
Reference: [1]
13. Cyber-enabled fraud proceeds
Cyber-enabled fraud often produces rapid incoming payments followed by dispersal through an account used as a conduit. The victims' losses arise from the underlying deception; the account holder's role depends on what they knew, controlled and did with the funds. Review account age, normal activity, payer relationships, login or device changes, withdrawal methods and the time funds remained. A near-immediate transfer of most receipts can indicate instructions to move money before recovery attempts, but a legitimate payment processor may have a similar velocity. Seek invoices, platform records or other independent evidence of the claimed business activity. Also consider account takeover: the named customer may not have initiated the transfers. Separate observed account behavior from conclusions about the holder's intent, and act on time-sensitive risk through the firm's escalation process.
Worked example: A new account receives four unrelated payments totaling 40,000 hypothetical units, then forwards 95% within an hour. The outgoing amount is 0.95 × 40,000 = 38,000 units, leaving 2,000 before fees or other activity. Ask who the payers are, why they paid and who instructed the outgoing transfer. Check device and access records before assigning the account holder a knowing mule role.
Watch the distinction: Fast movement after a fraud report supports urgent inquiry, but it does not establish whether the named customer participated willingly or lost control of the account.
Reference: [1]
14. Sanctions evasion patterns
Sanctions evasion may involve hidden beneficiaries, altered routes, misleading goods descriptions or intermediaries inserted to obscure a restricted connection. Compare successive versions of invoices, transport records, payment instructions and end-user statements. Changes made after a screening question are particularly informative because they may show an attempt to remove the very detail under review. Verify identities using more than a name, check current applicable lists and ownership or control information, and determine which jurisdiction's rules govern the firm and transaction. A geographic connection alone does not establish a prohibition; the applicable measure, covered parties, goods and conduct matter. Where the facts remain unresolved, preserve the payment and documentary trail for escalation before processing. The sanctions specialist guide provides related study context.
Worked example: A shipment originally names an end user. After a screening query, revised documents add an intermediary and leave the end-user field blank. Compare document versions and ask who requested each change, who will receive the goods and who pays. Screen verified parties against current applicable lists and examine any relevant ownership or goods restrictions before deciding whether the transaction can proceed.
Watch the distinction: A route through a higher-risk location is not itself a sanctions breach. Identify the applicable restriction and the true parties, goods and destination.
Reference: [1]
15. Bribery and corruption proceeds
Corrupt proceeds can be disguised as consulting fees, commissions or other business payments after a public decision. The risk lies in a possible exchange of value for improper influence, not merely in the existence of a government contract. Build a timeline of tender decisions, consultant engagement, invoices and payments. Test whether the consultant performed identifiable work, whether the fee matches a documented service or formula, and whether the consultant is connected to decision makers or their relatives. Review the source and destination of payments, including onward transfers through companies. A late fee may be a legitimate success fee if agreed and supported, so avoid using timing alone. Conversely, polished contracts cannot resolve a case if there is no evidence of work and the payee is linked to the official who influenced the award.
Worked example: A contractor wins a public tender and pays a consultant soon afterward. The invoice says only “advice,” and no deliverables appear in the project file. Obtain the original engagement, fee calculation, communications and beneficial ownership records. Compare the consultant's work with the procurement timeline and check links to officials. The sequence supports inquiry, while the evidence determines whether the fee had a genuine purpose.
Watch the distinction: A payment after a contract award is not automatically a bribe. The service, fee basis, relationships and decision timeline must support the inference.
Reference: [1]
16. Terrorist financing
Terrorist financing analysis focuses on whether funds support a prohibited purpose, organization or person. The money can come from donations, wages or other lawful activity, so a clean source does not settle the destination question. Trace collection methods, organizers, beneficiaries, intermediaries and the stated use of funds. Compare the stated charitable purpose with recipient records and credible information about control or links to violent activity. Small transfers can matter when repeated or coordinated; size alone is a poor filter. At the same time, association by name or geography can be unreliable. Verify identity, distinguish humanitarian activity from unsupported allegations, and apply the reporting and sanctions rules of the relevant jurisdiction. Document both corroborating and contrary evidence so that escalation rests on a reasoned account of the intended use.
Worked example: A registered fundraiser collects legitimate donations and sends several small transfers to a recipient credibly linked to a violent group. The donations' lawful source does not answer who controls the recipient or how the money will be used. Verify the recipient, trace any intermediary and examine the stated project. Escalate the supported destination concern under applicable local rules.
Watch the distinction: “The donations were legitimate” addresses where the money came from, not where it went. Terrorist financing risk can arise from intended use.
Reference: [1]
17. Proliferation financing
Proliferation financing concerns funds or financial services that may support prohibited weapons programs or related procurement. Dual-use goods require careful analysis because they have legitimate civilian applications. Examine technical specifications, buyer capability, declared end use, destination, shipping route, intermediaries and payment source. Changes to the final destination after ordering may undermine the original end-use explanation, particularly if an unrelated trading firm appears in the payment chain. Verify what the goods actually are before drawing conclusions from a broad product label. Compare documentation across purchase order, license or authorization where applicable, freight records and payment instructions. Screening and trade controls depend on current law in the relevant jurisdiction. Escalation should identify the specific unresolved end-use or party concern, enabling a legally grounded decision about processing.
Worked example: A buyer orders dual-use components for a stated civilian plant, pays through an unrelated trading company and later changes the destination. Verify the plant, the trading firm's role, the components' specifications and the final consignee. Compare revised shipping and payment documents with the initial order. Escalate the discrepancies for current sanctions and trade-control review before completing the transaction.
Watch the distinction: Dual-use status alone does not establish prohibited procurement. The end user, end use, route and applicable restrictions determine the significance of the transaction.
Reference: [1]
18. Typology signals and alternative explanations
A typology is a recognizable pattern, not a diagnosis. Combine indicators that arise from different evidence sources: payment amounts and timing, customer profile, counterparties, invoices and shipping records. Independent agreement between sources strengthens an inference; several alerts generated from the same data field may add little. Form competing explanations and identify what each predicts. Seasonal trade, for example, should have contracts, goods movement and customer demand that broadly align with payment peaks. If records reconcile, isolate the remaining anomaly instead of treating the whole relationship as suspicious. Conversely, a plausible business story weakens if counterparties are unrelated to documented shipments or money moves onward without commercial reason. State what new evidence would change the assessment. This discipline improves both escalation decisions and concise case narratives.
Worked example: An exporter receives many round payments during its peak season. Contracts and shipping records match the volume, supporting a legitimate seasonal explanation. One payer, however, is absent from the contracts and pays for no identifiable shipment. Review that payer's relationship, invoices and any onward transfer. The unresolved payer discrepancy merits inquiry; the round amounts alone do not justify treating all receipts alike.
Watch the distinction: Counting red flags without testing explanations can overstate risk. Ask which independent records corroborate the concern and which facts would make an ordinary explanation credible.
Reference: [1]
Global AFC Frameworks, Governance, and Regulations
19. FATF Recommendations and domestic law
The FATF Recommendations set international standards that countries use when designing anti-money-laundering and counter-terrorist-financing systems. A firm's enforceable duties come from the statutes, regulations and binding directions applicable to its activities and locations. Start with the legal entity, branch, product and transaction jurisdictions. Identify the local rule governing the specific action, such as customer due diligence or suspicious activity reporting, then compare the firm's controls with that duty. FATF material can explain the policy rationale and help assess gaps, but citing a Recommendation alone does not identify a filing destination, deadline or legal threshold for a firm. Cross-border groups may need a common control framework with local adjustments. The CAMS candidate handbook identifies global frameworks as a study domain; legal application still requires jurisdiction-specific analysis.
Worked example: A policy says, “Report this transaction because FATF requires it.” For a hypothetical firm operating in Jurisdiction J, first identify J's governing reporting law and the firm type it covers. Apply J's suspicion standard and internal escalation route, then determine the required report, recipient and timing under J's rules. FATF supplies international context, not the firm's complete legal instruction.
Watch the distinction: A FATF Recommendation is not automatically a directly enforceable statute. Identify the applicable jurisdiction and its implementing law before stating a firm's legal duty.
Reference: [1]
20. The risk-based approach
A risk-based approach directs greater attention to customers and activity with greater exposure, while preserving baseline duties that local law requires. Assess customer type, ownership, product, geography, channel and expected behavior together. Then select controls that address the particular risk: clearer ownership evidence for a complex company, stronger source-of-funds evidence for unusual funding, or closer monitoring where transaction paths are difficult to see. Record why the measures are proportionate and revisit them when facts change. Lower risk can support simpler measures where permitted, but it never means accepting an unidentified customer or ignoring unexplained activity. Evaluate control effectiveness as well as design: a rule that exists on paper does little if a payment feed is missing. Practice applying these distinctions with CAMS practice questions.
Worked example: Select all that apply. A local payroll customer has stable employer payments; a cross-border corporate customer has layered ownership and several payment corridors. Appropriate choices are: A, verify both customers under applicable baseline rules; B, resolve the company's controllers; and C, examine its expected counterparties and flows more closely. D, waive all review of the payroll customer, is incorrect: lower assessed risk does not erase baseline duties.
Watch the distinction: Risk-based does not mean discretionary compliance. Mandatory duties remain, while the depth and frequency of additional measures respond to documented exposure and observed behavior.
Reference: [1]
21. Mutual evaluations and national risk assessments
A mutual evaluation assesses how a jurisdiction has set up and applied anti-financial-crime measures. A national risk assessment identifies major threats and vulnerabilities within that jurisdiction. Both help you ask sharper questions about a customer, but neither gives every customer the same risk rating. Separate country conditions from the customer's business model, ownership, products, payment routes and actual transactions. Then ask whether the firm's controls address the exposure that remains. A weakness in beneficial ownership information, for example, makes independent ownership checks more valuable for a company with a complex structure. It has less bearing on a customer whose identity and simple activity are well evidenced. Record which country finding is relevant, how it could affect this relationship and what customer-specific evidence supports the resulting rating. The CAMS handbook identifies global governance as a core domain.
Worked example: A mutual evaluation notes weak company ownership records in Country A. A resident customer receives wages from one identifiable employer and pays ordinary household bills. The country finding prompts a check that identity evidence is reliable, but the activity offers no company ownership chain to investigate. The analyst records that limited relevance and assesses the customer's actual products, counterparties and behavior before assigning a risk rating.
Watch the distinction: A weak country evaluation does not make every resident customer high risk. Identify the weakness and test whether it creates exposure in this particular relationship.
22. Financial intelligence units
A financial intelligence unit, or FIU, receives reports under its jurisdiction's reporting system and analyzes them with other available intelligence. The firm's task comes earlier: detect concerning activity, investigate enough to explain its basis for suspicion and make a reporting decision under applicable local law. It need not prove a predicate offense or solve the entire network before reporting when the legal test is met. An investigator should preserve the transaction sequence, parties, amounts, dates, customer explanations and unresolved contradictions. The designated reporting function then decides whether and how to submit the report through the local channel, observing confidentiality rules. The FIU may connect reports from several institutions or use information the firm cannot access. That division explains why a well supported report can be useful even when the firm cannot identify the ultimate crime.
Worked example: A payments firm finds that a new business receives funds from unrelated people and promptly forwards them to one foreign recipient. The customer cannot explain the relationships. The investigator records the flows and failed inquiries, then escalates to the firm's reporting function. If the jurisdiction's suspicion test is met, that function reports to its FIU. The FIU may link those senders to reports from other firms.
Watch the distinction: A firm does not wait for the FIU to investigate before making its own reporting decision. Nor must its investigator identify a specific offense in every suspicious case.
Reference: [1]
23. UN sanctions and local implementation
A UN sanctions decision establishes an international obligation for states, while a transaction is governed by the sanctions measures implemented and enforced in the relevant jurisdiction. Start by identifying where the institution, payment, parties and assets fall under applicable law. Then determine whether the local measure covers the listed person or entity and what it requires, such as holding assets, prohibiting a transaction or reporting a match. Screening produces possible matches, not established identities. Compare names with corroborating identifiers, ownership and control information, and current authoritative lists. Keep an unresolved payment from being released while the match is investigated under the applicable process. A match decision must record its evidence and legal basis; a geographic or name resemblance alone cannot establish a prohibition. The global sanctions specialist guide offers related practice on match analysis.
Worked example: A bank sees a payment beneficiary whose name resembles a UN-listed company. It identifies the jurisdictions governing its payment and checks the current locally implemented measure. Analysts compare registration number, address and ownership records. If the identifiers establish a covered party, the bank takes the action that local law requires and records any required notification. If evidence excludes the match, it documents why the payment may proceed.
Watch the distinction: A UN listing does not replace analysis of applicable local law or prove that a similar name belongs to the listed party. Verify both legal coverage and identity.
24. The United States BSA framework
For a US financial institution, the Bank Secrecy Act framework joins customer due diligence, relevant recordkeeping, monitoring and suspicious activity reporting. The precise rules depend on institution type and the applicable US requirements. Customer information establishes who is using the account and its expected purpose; transaction records let reviewers reconstruct what actually happened. When activity departs from that picture, investigators gather facts, test explanations and escalate through the institution's reporting process. A suspicious activity report goes to FinCEN when the applicable legal criteria are met, and the institution must protect its confidentiality. Supervisory expectations also focus on whether controls work in practice, so a written procedure without complete data or timely review is insufficient. Do not substitute a remembered dollar amount for the applicable rule: assess the conduct, institution type and current reporting requirements together.
Worked example: A US bank's business customer receives payments from unrelated individuals, then sends funds to a newly added company. Its stated business is local equipment repair. The investigator obtains account history, customer records, beneficiary details and the customer's explanation. If the evidence supports suspicion under the bank's applicable US reporting rule, the designated function files with FinCEN and retains the supporting record. The dollar values alone do not settle the decision.
Watch the distinction: The BSA framework is more than a reporting form. Customer information, reliable records, investigation and applicable reporting duties must operate together; no universal filing threshold should be assumed.
Reference: [1]
25. European Union rulemaking and supervision
An EU firm's financial-crime duties may come from EU regulations, EU directives implemented through national law and rules issued or enforced by competent authorities. These sources work differently: a regulation can apply directly according to its operative provisions, while a directive requires national implementation. Scope, commencement dates, supervisory arrangements and local procedures therefore matter. For a group operating in several member states, identify common requirements and build shared controls where the same risk is addressed. Then map each legal entity to its applicable national rules, supervisor, reporting channel and privacy limits. A common customer-risk method can improve consistency, but it must allow any legally required local variation. When a rule is changing, verify which provisions are already operative for the entity and activity in question rather than treating an announced reform as an immediately enforceable duty.
Worked example: A payments group has entities in Member States A and B. Both use a shared customer profile, ownership checks and monitoring platform. Legal teams separately map each entity's operative identification rules, supervisory expectations, FIU reporting channel and restrictions on sharing case details. The group sets a common control objective, then configures local reporting and data access where the applicable rules differ. Reviewers test that neither entity falls through the shared design.
Watch the distinction: A single EU policy does not prove that every national procedure is identical. Check each entity's operative law, supervisor and reporting route before applying the group standard.
Reference: [1]
26. Basel and Wolfsberg guidance
Basel banking guidance and Wolfsberg industry materials help institutions design practical controls, especially for complex banking relationships. They can frame questions about a respondent bank's ownership, supervision, customer base, payment products and access by other institutions. Their value lies in making an inquiry systematic and comparable, not in turning a questionnaire into a legal safe harbor. First identify binding duties in the jurisdictions involved. Next use guidance to determine what evidence would show the respondent understands and controls its risks. Verify material answers with available documents, transaction behavior and independent information, then decide whether gaps require restrictions, further review or refusal. A completed form may still conceal outdated answers or weak downstream controls. Conversely, a useful control may be appropriate even when guidance describes it more fully than the legal text.
Worked example: A correspondent receives a respondent's completed industry questionnaire stating that no other banks use its account. Payment data later shows repeated transactions for another institution. The bank investigates that downstream access, obtains updated ownership and control information, and reassesses monitoring and contractual limits. The questionnaire organized the inquiry, but the observed activity controls the risk judgment and the bank still checks its binding legal obligations.
Watch the distinction: Completing an industry questionnaire does not certify legal compliance. Treat answers as claims to test, and distinguish supervisory or industry guidance from enforceable requirements.
Reference: [1]
27. Cross-border conflicts and group standards
A group standard can require broad access to customer information, while a branch's local privacy law may limit transfer of that information. Resolve the tension by naming the exact purpose: which risk decision requires which fields, and who needs them? Identify the branch's financial-crime duties, secrecy and privacy restrictions, any permitted sharing basis, and conditions such as safeguards or approvals. Legal and compliance specialists should document the interpretation; operational teams then design access that meets it. Possible measures include sharing a risk conclusion or selected fields, keeping detailed evidence locally, or providing controlled access where permitted. These choices cannot be assumed lawful everywhere. Record the unresolved risk if restrictions prevent adequate group oversight and escalate it to accountable management. A parent policy cannot by itself override a branch's local legal duties.
Worked example: A parent bank requests complete files for every customer of an overseas branch to review sanctions exposure. The branch identifies that the parent needs verified names, ownership links and match findings, while local rules restrict bulk file transfer. Legal and compliance teams test a lawful basis for the necessary fields and controls on access. If adequate review remains impossible, management receives the documented gap and decides how to limit the activity.
Watch the distinction: Neither the parent standard nor a privacy objection ends the analysis. Define the information needed, check lawful transfer options and escalate any risk that remains unresolved.
Reference: [1]
28. Board and senior management accountability
The board oversees the institution's financial-crime risk appetite and whether the program has enough authority, resources and credible information. Senior management turns that direction into staffing, systems, priorities and corrective action. Operational owners run controls and resolve individual work items. This separation matters when a problem persists: a backlog is not just a count but a sign that cases may age while risks continue. Management reporting should show volume, age, severity, causes, capacity, missed deadlines where applicable and the effect of proposed remedies. The board should challenge whether the plan matches the risk and whether interim controls are adequate, then track independent evidence of progress. It should not adjudicate routine alerts. Clear owners, due dates and measures of effectiveness make oversight more than a periodic presentation.
Worked example: A monitoring backlog grows for three quarters. Management reports that a new payment channel added alerts faster than analysts could review them, with the oldest high-risk cases identified. It assigns operations to clear and prioritize cases, technology to repair unnecessary alert volume, and compliance to challenge triage criteria. The board asks for funded capacity, interim protection, deadlines and evidence that overdue high-risk cases are falling.
Watch the distinction: Board oversight does not mean the board investigates alerts. It challenges exposure, resources and remediation; management and control owners execute and demonstrate that the fix works.
Reference: [1]
29. Three lines of responsibility
The first line consists of business and operational teams that create and manage risk in their activities. They collect information, follow onboarding and transaction controls, and correct failures. The second line, often compliance and risk specialists, sets or interprets standards, advises, challenges and monitors whether the first line meets them. Independent audit provides the third line by testing the design and operation of controls and reporting assurance to governance bodies. These roles interact, but a compliance review does not transfer ownership of an incomplete customer file away from the business. Nor should audit design the very procedure it later claims to assess independently. For a failed control, identify who performed it, who challenged it, who tests it and who approves remediation. This makes accountability visible and prevents repeated handoffs without resolution.
Worked example: A relationship manager accepts a company's file although the person controlling board appointments is undocumented. As first line, the manager must obtain or escalate the missing evidence and pause the decision as required. Compliance challenges the ownership assessment and advises on the control route. Later, internal audit samples comparable files to test whether the process consistently captures control arrangements, reporting any systemic weakness independently.
Watch the distinction: Compliance is not the owner of every customer control because it raised a concern. The business corrects its decision, compliance challenges, and audit independently tests the system.
Reference: [1]
30. Supervisory findings and information sharing
A supervisory finding should lead to a traceable repair, not just a revised procedure. Define the defective control and its cause, identify affected periods and transactions, assess whether past cases need review, assign owners and dates, and validate the repair with evidence. Missing originator data, for example, may reflect source capture, message mapping, interface loss or a weak exception queue. Each cause requires a different fix. Information sharing can help a group spot linked activity, but permission depends on the relevant laws, confidentiality obligations, purpose and access safeguards. Separate the operational need to share facts from a general wish to copy case files. Before sending customer or report-related information to an overseas affiliate, determine what may lawfully be disclosed and through which approved channel. Retain the decision and test whether the remedial control now works.
Worked example: A supervisor finds originator fields missing from cross-border payments. The bank traces omissions to an interface mapping change, identifies affected payments, reviews whether incomplete records impaired screening or investigations, repairs the mapping and tests new samples. An affiliate requests the full case set. The bank first checks local privacy and reporting confidentiality rules, then shares only information permitted and necessary for the defined review.
Watch the distinction: Closing a finding with a procedure update alone leaves past harm and technical causes untested. Sharing a regulator's findings also does not grant unrestricted access to customer files.
Reference: [1]
Building an Anti-Financial Crime Compliance Program
31. Enterprise risk assessment
An enterprise risk assessment starts with the institution's actual exposure: customer types, products, geographies, delivery channels and transaction patterns. It asks how financial crime could enter or move through each combination, how large the exposure is and which controls address it. A channel change can alter risk even when the product name stays the same. Remote onboarding, for example, may increase impersonation or document-verification challenges; cross-border customers can add ownership, sanctions and payment-route complexity. Compare those exposures with existing controls, including their observed performance, and document the remaining gaps. Use the result to direct due diligence, monitoring scenarios, staff capacity and testing. Reassess when the business changes materially, then check whether the controls cover the new activity in data as well as in policy.
Worked example: A bank previously opened local company accounts in branches and now accepts remote applications from cross-border firms. It maps the new customers' ownership and payment routes, tests remote identity and document checks, confirms sanctions-screening fields reach the system, and adds relevant monitoring coverage. The prior branch risk rating cannot simply be copied: both customer mix and channel changed, so the control assessment changes too.
Watch the distinction: A risk assessment is not a list of generic risks scored once a year. It must reflect actual customers, channels and flows, then drive specific control decisions.
32. Inherent and residual risk
Inherent risk describes exposure arising from an activity before considering its controls. Residual risk describes what remains after controls are considered, including whether they operate effectively. Keep the sequence explicit: define the scenario, assess its inherent exposure, identify controls, test their design and performance, then judge the remaining risk. Two products can have similar inherent exposure because both support cross-border third-party payments. Their residual risks may differ if one captures complete party data and reviews alerts promptly while the other drops beneficiary identifiers. A control should lower assessed risk only to the extent evidence shows it addresses the scenario. A nominal policy, or a technology system with incomplete input, does not earn the same credit as a working control. Avoid treating a risk score as a precise mathematical measurement unless its method and assumptions justify that precision.
Worked example: Product A and Product B both permit cross-border payments for comparable customers, so their inherent exposure is similar. A captures originator and beneficiary identifiers, screens them and reconciles payment feeds. B lacks complete beneficiary data. Even if both have a written screening rule, B cannot screen every relevant party reliably. Its residual risk is therefore higher until the data gap is repaired and effectiveness is demonstrated.
Watch the distinction: Do not call an activity low risk merely because a control is listed. Residual risk depends on whether that control covers the exposure and actually works.
Reference: [1]
33. Customer identification and verification
Identification is the collection of claims about who a customer is; verification tests those claims against reliable, independent evidence. For an individual, that may involve identity attributes and suitable documentary or electronic evidence. For a legal entity, it also requires understanding its existence, representatives and relevant ownership or control under applicable rules. Matching two fields on the same application proves internal consistency, not independent verification. Look for discrepancies across documents, registries, authorized signers and the stated business. Resolve material inconsistencies before relying on the identity information for onboarding or risk decisions. If evidence is unavailable or unreliable, follow the applicable requirement for whether the relationship can be opened or continued, and document any escalation. Good records show which claim was checked, against which source, when, and what remained uncertain.
Worked example: A company applicant enters a name and address matching its application form. Its incorporation document uses a different registration number from the public registry, and the named signer is absent from the authorization record. The form establishes the applicant's claims, not their verification. The analyst seeks independent registry evidence and authority for the signer, resolves the discrepancy, and withholds the onboarding decision until the required checks can be completed.
Watch the distinction: A name and address repeated consistently across customer-supplied forms are still customer claims. Verification requires suitable independent evidence and resolution of material conflicts.
Reference: [1]
34. Beneficial ownership and control
Beneficial ownership asks which natural persons ultimately own or control a legal customer. Direct shareholdings are only the first layer. Trace ownership through intermediate entities and examine voting rights, board appointment powers, agreements and other means of influence. A registered shareholder may be another company, while a person with few shares may direct key decisions through a contract. Apply the definitions and any required ownership tests in the relevant jurisdiction, but do not ignore control merely because it does not fit a simple percentage calculation. Gather evidence that connects each layer and explain any unresolved chain. The result should identify the people whose interests or authority create exposure for due diligence and screening. Recheck the analysis after ownership changes, because a once accurate chart can quickly become misleading.
Worked example: Person A directly owns 40% of Company X. Person B owns fewer shares but has an agreement allowing B to appoint most directors. The analyst documents A's ownership route and obtains the agreement and governance records supporting B's control route. Both are assessed under the applicable beneficial ownership rules. Listing only A would miss a person who may direct X despite a smaller economic stake.
Watch the distinction: The largest shareholder is not necessarily the only relevant natural person. Contractual voting or appointment rights can create control that a shareholding table misses.
Reference: [1]
35. Purpose and expected activity
A useful customer profile links the stated business purpose to expected money flows. Record what the customer sells or does, who normally pays it, where funds originate, which counterparties receive payments, the products used and the expected timing or range of activity. These details give monitoring a basis for comparison. The aim is to detect material departures, not to freeze the customer's business in place: legitimate growth, seasonal sales or a new contract can explain changes when supported by evidence. When observed activity differs, ask which assumption failed. Unrelated consumer deposits into an importer may challenge the asserted source of funds or reveal an undisclosed service. Check invoices, contracts, counterparties and payment descriptions, then update the profile if the new activity is genuine. An explanation that cannot be reconciled with independent records should drive further investigation.
Worked example: A new importer says it will make monthly payments to two overseas suppliers, funded by its corporate customers. Instead, its account receives many small deposits from unrelated consumers in its first week. The analyst asks what goods or service those consumers bought, checks sales records and payment references, and compares them with supplier invoices. Without support, the deposits remain a profile discrepancy requiring escalation rather than an automatic finding of crime.
Watch the distinction: Expected activity is not merely a transaction amount. The source, counterparties, purpose and timing make a profile useful for detecting a meaningful change.
Reference: [1]
36. Enhanced due diligence
Enhanced due diligence adds measures that answer a defined higher-risk question. Start with the risk driver: complex ownership, unexplained wealth, unusual payment routes or exposure to corruption may each require different evidence. For ownership, obtain documents that connect legal entities to natural persons and reveal control rights. For source of wealth, assess how the person accumulated assets over time; for source of funds, establish where money for this transaction comes from. Expected-flow evidence might include contracts, customer segments, locations and typical counterparties. Evaluate the credibility and consistency of each item rather than counting documents. Where required, obtain appropriate senior approval and set monitoring or review intensity that matches the risk. If key questions remain unresolved, record the limits and make a reasoned acceptance, restriction or rejection decision under applicable requirements.
Worked example: A private company has owners in several countries and proposes large payments to unrelated trading firms. The analyst gets a verified ownership chart and control agreements to identify people, business and financial records to assess accumulated wealth, and contracts plus bank evidence for the proposed funding and counterparties. Senior approval considers remaining uncertainty. If invoices and flows do not match, additional documents alone do not justify acceptance.
Watch the distinction: Enhanced due diligence is not a thicker file. Each added check should address a stated risk, and the evidence must support the decision it is used to make.
Reference: [1]
37. Politically exposed persons
A politically exposed person, or PEP, is relevant because a prominent public role can create opportunities for misuse of influence or public resources. Applicable definitions may also cover family members and close associates. The classification is a risk indicator, not evidence that anyone has acted improperly. Establish the exact public role, jurisdiction, relationship to the customer, time period and potential connection to the funds or business. Then assess source of wealth and source of funds, transaction purpose, relevant counterparties and any required approvals or monitoring. A close relative's public office may be important when the relative provides funding or benefits from the account; it may be less connected to other, well evidenced activity. Record why the relationship changes the risk assessment and what evidence would reduce or increase concern, while applying the jurisdiction's PEP requirements.
Worked example: A company executive opens an investment account funded by a close relative who holds senior public office. The analyst confirms the relationship and role, asks how the relative accumulated the assets, traces the transfer into the account and checks whether the company has dealings linked to that office. Required approval and monitoring follow the local rules. The inquiry addresses corruption exposure without alleging that the relative took a bribe.
Watch the distinction: PEP status is neither a conviction nor an automatic reason to refuse a customer. It calls for the applicable controls and a fact-based assessment of exposure.
Reference: [1]
38. Ongoing customer review
Ongoing review checks whether a customer's identity, ownership, purpose and risk rating still match reality. Scheduled reviews create a routine opportunity to refresh evidence, while event triggers call for attention sooner. Triggers can include a new owner, product, geography, payment pattern or adverse information. Start by identifying what changed and which original assumptions it affects. Refresh only the evidence needed to understand the new exposure, then reconsider due diligence, screening, monitoring and any approval decision. A new business line may introduce customers or payment routes that the previous profile never covered. Record the revised profile and make sure downstream systems receive the change; a risk rating updated only in a case note cannot improve monitoring. The review should also test whether earlier unexplained activity becomes more concerning in light of the new facts.
Worked example: A domestic retailer acquires an overseas payments business six months before its scheduled review. The acquisition adds different customers, jurisdictions and transaction channels immediately. The team obtains ownership and business details, assesses the payments activity and updates expected flows, screening and monitoring coverage. It also revisits recent transactions for signs of the new activity. Waiting for the calendar date would leave the changed exposure assessed under an obsolete profile.
Watch the distinction: A scheduled review date is not permission to ignore material change. Event-driven review keeps the risk profile aligned with the customer's current activity.
Reference: [1]
39. Sanctions screening operations
Sanctions screening compares relevant customers, owners, counterparties and transaction details with lists that apply to the institution and activity. A system alert is a candidate match; an analyst must decide whether the records describe the same party. Compare names and aliases alongside stronger identifiers such as birth details, registration numbers, addresses and ownership links. Account for spelling and transliteration differences, but explain why conflicting identifiers matter. If identity remains unresolved, escalate and control the transaction according to applicable law and procedure until a decision is made. If evidence excludes the match, record the list entry, compared fields, sources, reasoning and reviewer. Controls must also handle list updates and changes in customer information, so a prior false match decision should be revisited if material identifiers change. A true identity match still requires analysis of the applicable legal prohibition.
Worked example: A payment beneficiary's name resembles a listed person. The customer record has a verified birth date and residence that differ from reliable details for the listed person, with no matching alias or ownership link. The analyst records the compared sources and closes the alert as a false match under the bank's process. If the birth date were unverified or the list entry sparse, the payment would remain unresolved and require escalation.
Watch the distinction: A high name similarity score is not proof of a sanctions breach. Equally, a quick name dismissal is unsafe when corroborating identifiers are missing or uncertain.
Reference: [1]
40. Transaction monitoring coverage
Transaction monitoring works only when scenarios cover the relevant products and the underlying activity reaches the system. Map each risk scenario to the customer types, payment channels, source fields and time windows it needs. Then reconcile input counts and key fields from source systems to monitoring, including new channels and changed interfaces. A well tuned wire rule cannot detect instant payments if that feed never arrives. When a gap appears, determine its start date, affected population and whether missed activity needs retrospective review. Use a controlled interim method to identify urgent cases while engineers repair the feed, then validate that complete and accurate records flow through the durable control. Document any detection limits and the decisions made for affected customers. CAMS practice questions can help rehearse these coverage decisions.
Worked example: A bank launches instant payments, but its monitoring rule still receives only wire transfers. Analysts compare source and monitoring inventories and confirm every instant payment is absent. They identify the launch date and affected customers, apply a temporary review for relevant high-risk patterns, and backtest the missing activity. Engineers add the feed and reconciliation checks; independent validation confirms the rule receives complete instant-payment fields before the gap is closed.
Watch the distinction: An alert rule can be logically sound yet ineffective when its data feed omits a channel. Test coverage from source transactions through alert output.
41. Alert triage and prioritization
Triage determines which alert needs attention first; it does not decide whether the activity is suspicious. Start with the potential harm and urgency: a possible sanctions connection, rapid onward movement, or an imminent payment may require prompt review. Then assess customer risk, transaction pattern, counterparty information, and the strength of the evidence. A familiar pattern can lower priority when its explanation remains supported by current records. It should not receive a permanent exemption merely because earlier alerts were closed. Set a review route and reasonable timing for every priority tier, record why an alert entered that tier, and watch for aging cases. Reprioritize when new information arrives. Analysts should be able to explain both the urgent case they reviewed first and the evidence supporting a later review of the other case.
Worked example: Alert A concerns an unexplained payment through an intermediary whose ownership is unclear; the funds are due to move onward today. Alert B repeats a monthly payroll pattern supported by the employer's payroll file and past account activity. Review A first because its purpose, intermediary, and timing create greater unresolved risk. Queue B for documented review, checking that the current payment still matches the payroll evidence.
Watch the distinction: A low-priority alert is not a cleared alert. Priority sets review order; closure requires an assessment of the actual activity and an explanation supported by evidence.
Reference: [1]
42. Investigative reconstruction
Reconstruct a case before judging the customer's story. Put receipts, transfers, withdrawals, and attempted transactions in time order, with dates, amounts, currencies, account holders, and counterparties. Trace where value came from and where it went; a transfer description alone does not establish its economic purpose. Compare the sequence with the customer's profile and obtain independent records such as invoices, contracts, shipping documents, or account statements. Look for timing that a legitimate explanation should predict: a genuine supplier settlement should connect a payable to the supplier receiving funds. Identify gaps explicitly, including missing beneficial-owner information or transactions at another institution that you cannot observe. A useful reconstruction separates observed facts, customer claims, and analyst inferences. That separation makes later escalation and review more reliable.
Worked example: On Monday, Companies A, B, and C send 20,000, 15,000, and 25,000 hypothetical units to a customer's account. On Tuesday, 60,000 goes to one offshore recipient. The receipts total 60,000, matching the outgoing amount. To test a claimed supplier settlement, obtain the purchase agreement, invoices, delivery evidence, and each payer's relationship to the customer. Matching totals alone do not explain why three companies funded one supplier.
Watch the distinction: A balanced inflow and outflow is not proof of a legitimate pass-through. The economic roles of the senders and recipient still need a coherent, evidenced explanation.
Reference: [1]
43. Suspicion and reporting decisions
A red flag identifies activity worth examining; suspicion is a reasoned judgment after considering the facts, explanations, and unresolved contradictions. No single unusual transaction automatically establishes a crime. Ask whether the customer's account of the activity fits its timing, counterparties, and available documents. Record what was verified, what remains unknown, and why an alternative explanation does or does not hold. Escalate through the firm's reporting process when the applicable jurisdiction's standard may be met; the designated decision maker applies local law and filing requirements. Investigators generally need not prove a predicate offense before making that decision. Avoid telling the customer about a contemplated report where local confidentiality rules restrict disclosure. The broader financial crime study guide can help connect suspected proceeds to related offenses, but the case decision rests on its own evidence.
Worked example: A customer calls two large transfers loan repayments. No loan agreement, repayment schedule, or earlier loan receipt appears in the records. When asked who lent the money, the customer names a different lender. Document both versions, the transaction trail, and the missing support. These contradictions justify escalation for a reporting decision under the firm's jurisdictional rules; they do not establish that the customer committed a specific offense.
Watch the distinction: Suspicion does not require courtroom proof. Equally, an unexplained amount alone is a thin basis for a decision when readily available records could test an ordinary explanation.
Reference: [1]
44. Useful report narratives and confidentiality
A useful report narrative lets a reader reconstruct the activity without access to the firm's internal shorthand. Identify the customer and relevant counterparties, give the transaction sequence with dates, amounts, currencies, and channels, and state what prompted review. Describe the customer's explanation accurately, then show which records support or contradict it. Separate established facts from concern: write that an invoice was not supplied, for example, rather than asserting that no invoice exists anywhere. Explain the suspected pattern and why it matters, including related transactions that show its scale. Preserve source records and the internal decision trail. Reporting confidentiality depends on the jurisdiction, so access, customer contact, and onward disclosure should follow its rules. A narrative should convey the case without speculative labels or unsupported allegations.
Worked example: Replace “unusual wires” with: “On 3 and 4 May, the customer received 30,000 and 25,000 hypothetical units from unrelated firms, then wired 55,000 to Company Z on 5 May. The customer called the payment a supplier settlement but supplied no invoice; account records show no earlier dealings with Z.” Add verified identifiers and the reason the combined sequence warrants concern.
Watch the distinction: A report packed with suspicion words is not necessarily informative. Readers need the transaction trail, the attempted explanation, and the specific gap or contradiction that remains.
Reference: [1]
45. Records and audit trails
An audit trail should permit another reviewer to reproduce the decision from retained evidence. Keep the identity information used at onboarding, relevant customer-profile versions, source transactions, alert inputs, analyst searches, customer responses, and escalation decisions. Record who acted, when, and under which information available at the time. Versioning matters: a later corrected customer record should not erase the details that generated an earlier alert. Link case notes to source records so that a transaction can be found without relying on a screenshot or a vague summary. Access controls protect sensitive material, while indexing and export procedures make it retrievable for authorized reviews. Retention periods and disclosure duties vary by jurisdiction and record type; apply the governing rule rather than assuming one universal period.
Worked example: A case system displays “closed, no concern,” but the underlying transfers and reviewer rationale are absent. A second analyst cannot test whether the alert involved one known supplier or several unrelated recipients. Recover the source transactions, preserve the profile and rule version used, and require a reasoned closure note. Until that evidence is restored, the closure is difficult to validate.
Watch the distinction: A final case status is not an audit trail. It records an outcome but cannot show whether the analyst examined the right transactions or reached a defensible conclusion.
Reference: [1]
46. Correspondent relationship controls
A correspondent provides banking services to another financial institution, the respondent. Its exposure includes activity initiated by the respondent's customers, whom the correspondent may not know directly. Assess the respondent's ownership, licenses or supervision, business model, customer base, geographic reach, control program, and expected payment flows before opening the relationship. Understand whether other banks can transact through the respondent's account: that downstream access introduces another layer between the correspondent and the original customer. Payment messages must contain usable originator and beneficiary information under applicable requirements. Monitor whether observed flows match the understood business, and reassess material changes. Due diligence on a respondent is a continuing judgment about access and controls, not a one-time questionnaire. Restrictions or exit may follow if essential visibility cannot be obtained.
Worked example: A respondent originally used its account for its own customers but now routes payments for three other banks. The correspondent has gained indirect exposure to those banks' customers without assessing that use. Review the respondent's agreements, downstream-bank identities, controls, and payment fields; compare new volumes and destinations with expectations. Decide whether revised terms, stronger monitoring, or restricted access can address the gap.
Watch the distinction: Treating every correspondent payment as the respondent's own transaction hides downstream risk. The person or business behind a payment may sit several institutions away.
Reference: [1]
47. Third-party and outsourced controls
Outsourcing changes who performs a control, but it does not remove the firm's responsibility for the result. Define the vendor's task precisely: which customers and transactions it covers, how often lists update, what data it receives, what counts as an exception, and who decides unresolved cases. Contracts should support access to performance evidence, incident notice, correction, and appropriate oversight. Reconcile populations and list versions rather than accepting a vendor's statement that screening ran. When a failure occurs, identify the affected period and records, contain continuing exposure, rerun affected screening, and investigate any potential matches. Keep evidence of the vendor's correction and test it independently. Distinguish a missed update from a missed match caused by poor input data; each requires a different fix.
Worked example: A screening vendor missed list updates from Monday through Thursday. Identify every customer and payment screened against an older list during that interval, pause or control pending items as applicable, and rerun that population against the correct versions. Escalate under the contract, investigate resulting matches under local sanctions rules, then independently confirm that updates and alerts now flow on schedule.
Watch the distinction: A service-level report showing that jobs completed cannot prove they used current lists. Oversight must check the list version, screened population, exceptions, and resulting decisions.
Reference: [1]
48. Training, testing and remediation
Training should teach the decision a role actually makes. Relationship staff may need to recognize ownership changes and obtain evidence; investigators need to interpret the change in light of transactions; managers need to understand overdue cases and control failures. Independent testing asks whether these controls work in real files, not whether staff attended a course. When testing finds repeated failures, determine whether the cause is unclear guidance, a system that fails to route updates, weak review, or a knowledge gap. Repair the workflow and any affected accounts, assign an owner and completion evidence, then retest fresh cases. Measure both process operation and outcome, such as whether changed owners were identified and screened. A completed training module is useful evidence of instruction, but it does not validate the repaired control.
Worked example: Testing finds that eight of 30 sampled ownership changes were not escalated. That is 8 ÷ 30, or about 26.7% of the sample, not necessarily the whole population. Teach staff the trigger and required evidence, configure the change event to create a review task, and examine affected accounts. An independent retest should check new changes and documented screening outcomes.
Watch the distinction: Retraining alone will not fix a system that never sends ownership changes to reviewers. Identify the failure point, repair it, and test actual cases afterward.
Reference: [1]
Tools and Technologies to Fight Financial Crime
49. Customer lifecycle systems
Customer controls work as a lifecycle when information can move between stages. Onboarding establishes identity, ownership, purpose, and expected activity. Screening checks relevant parties; monitoring compares transactions with that profile; investigations add findings that may change risk or prompt further action. A change event should update the authoritative customer record and trigger dependent processes, rather than waiting for the next scheduled review. Track which systems received the update and whether each completed its task. Changes to owners, products, jurisdictions, or behavior may alter screening scope, review timing, and monitoring scenarios. Exit decisions also need a controlled record of the reason and any continuing legal duties. The CAMS practice questions can help you rehearse these linked decisions across the program and technology domains.
Worked example: A corporate customer replaces its controlling owner, and the new owner increases the assessed risk. Update the verified ownership record, screen the new person and relevant connected parties, bring forward the customer review, and reassess monitoring against the new profile. Confirm that each system received the change and retain the results; a changed risk score alone does not prove the downstream tasks occurred.
Watch the distinction: A customer-risk update confined to one database leaves stale screening and monitoring decisions elsewhere. A lifecycle control needs event delivery, task completion, and evidence of both.
50. Identity data and entity resolution
Entity resolution decides whether records refer to the same real person or organization. Standardize harmless variations such as spacing, script, and name order, then compare stronger identifiers: date of birth, registration number, address history, documents, and known aliases. Treat shared attributes differently according to how distinctive they are. A common name is weak evidence; a verified registration number may be strong evidence within its issuing jurisdiction. Conflicting dates of birth may indicate separate people, but first check whether one field contains a data-entry error. Maintain a link with its evidence and confidence, and allow a reviewer to undo a bad merge. False merges can transfer another person's risk or screening result to an innocent customer; missed links can split a single party's activity across accounts.
Worked example: Records A and B say “Mina Chen” but show different verified birth dates. Keep them separate unless other evidence resolves that conflict. Record C uses “Meena Chen,” with a documented alias matching A's identity document and birth date. Link C to A with the alias evidence. Do not attach B merely because all three names resemble one another.
Watch the distinction: Name similarity is a candidate link, not identity proof. Merging two people can corrupt investigations as seriously as failing to link a documented alias.
Reference: [1]
51. Screening match logic
Screening produces possible matches for human or governed automated assessment. Exact matching finds identical text but can miss aliases, transliterations, swapped word order, or spelling variation. Fuzzy methods improve recall by returning similar strings, at the cost of more false matches. A match score describes text similarity under a particular method; it is not the probability that the parties are identical. Compare corroborating identifiers such as registration number, birth date, address, nationality, and associated persons. Check whether an apparent mismatch is genuinely independent and reliable: two jurisdictions may issue the same number format, and old list data may be incomplete. Record the list entry, input record, rule version, evidence, and decision. Escalate unresolved identity before taking the action required by applicable sanctions law.
Worked example: A company name transliterates closely to a listed entity, giving a high text score. Its verified incorporation number differs from the listed company's number in the same registry, while address and directors also differ. Those independent mismatches support a documented false match. If the number came only from unverified customer text or the list lacks reliable identifiers, keep the case open for further evidence.
Watch the distinction: A high fuzzy score is not a sanctions determination. Conversely, a low score does not settle an alias case when reliable identifiers or control relationships point to the listed party.
Reference: [1]
52. Data lineage and completeness
Data lineage shows how a field moves from its source to a control decision. Map the source table or message, extraction time, transformations, joins, filters, monitoring input, rule calculation, and resulting alert. At each handoff, reconcile record counts and key totals, then examine rejects and duplicates. Count differences can come from an intended exclusion, a timing mismatch, or a broken feed; the explanation must be documented and tested. Field-level checks matter too: all payments may arrive while a beneficiary identifier is silently truncated. Compare timestamps to detect stale data and keep transformation versions so that an old alert can be reproduced. When a gap is found, determine the affected period and whether retrospective screening or monitoring is needed. Complete data is a prerequisite for meaningful detection performance.
Worked example: The payment source contains 10,000 transactions for a closed processing day; monitoring receives 9,700 for that same scope. The gap is 10,000 − 9,700 = 300 transactions, or 300 ÷ 10,000 = 3%. Compare counts after extraction, validation, and loading, then inspect rejected record IDs. If extraction has 10,000 and the validation output has 9,700, investigate that handoff first.
Watch the distinction: A 3% count gap does not show which transactions were missed or whether exclusions were intended. Reconcile record IDs and transformations before assigning a cause.
Reference: [1]
53. Data quality checks
Data quality has several dimensions. Completeness asks whether a field exists; validity asks whether it fits its format and allowed values; accuracy asks whether it reflects the real party or transaction; consistency asks whether related systems agree. A beneficiary field filled with “unknown” may be technically present but unusable. Measure defects by field, product, source, and time period, because an overall average can hide a severe problem in one channel. Trace defects back to capture and transformation points. Then assess their control effect: missing identifiers weaken counterparty aggregation, screening, and transaction tracing. Set a correction route, monitor recurrence, and distinguish records that can be repaired from those needing immediate case review. A sample defect rate estimates prevalence only within the sampled population and method.
Worked example: In a hypothetical sample of 500 transfers, 35 have no usable beneficiary identifier. The defect rate is 35 ÷ 500 = 0.07, or 7% of that sample. Those transfers are harder to aggregate by recipient or trace during an investigation. Break the 35 down by channel and source system; a cluster in one feed would guide the repair.
Watch the distinction: A populated field is not necessarily useful data. Placeholders, truncated names, and identifiers assigned to the wrong party can defeat screening and investigation despite passing a nonblank check.
Reference: [1]
54. Rule calibration
Calibration adjusts a detection rule so it finds meaningful activity at a manageable investigation cost. Define the behavior the rule is intended to detect, then test thresholds, time windows, aggregation keys, and exclusions against labeled historical cases and current activity. Compare alert volume, useful-case yield, missed known cases, and concentration across customer groups. A higher threshold may reduce workload while losing the very behavior the rule was built to find. Backtest on data outside the tuning sample where possible, document assumptions, and watch for changes after deployment. Investigative capacity is relevant, but it should prompt prioritization or resourcing decisions when risk remains, rather than silently suppressing alerts. Revisit rules after products, customer mix, or payment channels change.
Worked example: In hypothetical comparable periods, Rule A generates 1,000 alerts and 20 useful cases: 20 ÷ 1,000 = 2% yield. Rule B generates 400 alerts and 16 useful cases: 16 ÷ 400 = 4% yield. B improves yield but loses four useful cases, a 20% decrease from 20. Examine those four cases before accepting the revision.
Watch the distinction: Fewer alerts and a higher yield do not prove better detection. A rule can become more efficient on reviewed alerts while missing consequential activity.
Reference: [1]
55. Detection performance measures
Precision answers: among flagged cases, how many were true positives? Recall answers: among all true positives in the evaluated set, how many were flagged? False positives are flagged cases later classified negative; false negatives are positive cases the system missed. Coverage is different again: it asks whether relevant products, customers, and transaction feeds were included at all. These measures depend on trustworthy labels and a defined population. If only flagged alerts receive investigation, apparent recall can be misleading because missed cases remain unseen. Use independent sampling, retrospective findings, and scenario testing to improve the estimate. Compare performance by segment, since a good overall figure may mask weak detection in a new channel. Decide which trade-off is acceptable in light of risk and investigation capacity.
Worked example: In a hypothetical labeled sample, a model flags 30 cases. Eighteen are true positives, so precision is 18 ÷ 30 = 60%; the other 12 are false positives. It misses 12 additional true positives, making 30 positives in total. Recall is 18 ÷ (18 + 12) = 60%. These results apply to the labeled sample, not automatically to all live transactions.
Watch the distinction: Precision and recall share a numerator but answer different questions. A system can achieve high precision by flagging very little while missing many positive cases.
Reference: [1]
56. Anomaly models and human review
An anomaly model compares current behavior with an expected pattern. That expectation may come from the customer's own history, a peer group, or learned relationships among transaction features. A high score means the behavior is unusual under that model; it does not identify the cause or establish suspicion. Examine the features driving the score, the quality of the input data, and relevant context such as seasonality, acquisitions, or new products. Compare counterparties and payment purposes with credible business records. Human review should record why the anomaly is explained or why unresolved facts merit escalation. Monitor whether the model starts flagging routine behavior after market or customer changes, and whether important cases escape it. Explainability matters most where analysts must defend individual decisions.
Worked example: A merchant's weekly volume rises from 100,000 to 300,000 hypothetical units during a holiday period, a threefold level. Prior holiday weeks show similar increases, and sales records match customer receipts. Review counterparties and refund patterns as well. If they remain consistent, document the seasonal explanation; if funds instead come from unrelated firms and leave rapidly, investigate further.
Watch the distinction: An anomaly score is a ranking signal, not a finding of crime. Familiar seasonal activity can be unusual statistically, while a harmful pattern can look ordinary to a model.
Reference: [1]
57. Network analytics
Network analysis represents parties, accounts, devices, addresses, and transactions as nodes and links. It can reveal several accounts feeding one recipient, shared control indicators, or circular fund flows that are hard to see account by account. Interpret each link by its meaning and rarity. A shared beneficiary may indicate coordinated value transfer; a shared public payment processor may connect thousands of unrelated customers. Combine network structure with timing, amounts, ownership, device evidence, and transaction purpose. Check direction: money flowing to a party means something different from money received from it. Preserve the underlying records so an analyst can verify the graph. A dense cluster is a lead for investigation, not proof that everyone in it has the same intent.
Worked example: Six accounts send similar amounts to one beneficiary within two days. All also use the same payment processor. The beneficiary link deserves review because it joins the value flows; compare senders, funding sources, and purposes. The processor link may be routine if it serves many customers. Do not treat that common infrastructure alone as evidence of coordination.
Watch the distinction: Every shared node does not carry equal weight. A graph can make a widely used service provider look like a central suspect unless the analyst examines what the link represents.
Reference: [1]
58. Virtual asset analytics
A public blockchain can show transfers between addresses, amounts in the native asset, and transaction timing. Analytics may cluster addresses using observable patterns, but a wallet address is not automatically a verified person. Trace funds through transaction paths and identify touchpoints such as exchanges where account records may connect on-chain activity to a customer. State uncertainty when assets pass through pooled services, cross-chain mechanisms, or addresses controlled by an unknown party. Also distinguish a direct transfer from an inferred association several steps away. For an investigation, preserve transaction hashes, asset and chain, relevant addresses, timestamps, and the reasoning behind any cluster attribution. Combine ledger evidence with exchange records and customer information before drawing an identity or purpose conclusion.
Worked example: Wallet W receives transfers from three addresses and then sends the combined balance to an address attributed to a regulated exchange. The ledger establishes the visible path and timing, subject to correct address attribution. Exchange deposit records could identify the credited account and its verified holder. They would not, by themselves, prove who controlled each of the three sending addresses.
Watch the distinction: Tracing value to an exchange does not identify every earlier wallet owner. Address clustering and service attribution need supporting evidence and clear limits.
Reference: [1]
59. Case management and evidence
Case management should preserve a reproducible chain from detection to disposition. Store the alert trigger, source data, customer profile version, analyst actions, searches, communications, supporting documents, decision, approvals, and escalation dates. Use structured fields for comparison, but retain a narrative explaining why evidence mattered. Time stamps reveal delays and whether a decision preceded later information. Similar outcomes should follow similar criteria, with differences explained by case facts. Quality review can compare closed cases with the evidence available at the time and identify inconsistent guidance, missing data, or weak analysis. Restrict access according to role while allowing authorized reviewers to retrieve the complete history. A case tool is useful only if it records both what the analyst saw and how the conclusion was reached.
Worked example: Two analysts close similar alerts differently. Compare transaction timelines, customer profiles, supporting records, rule versions, and reasons written at closure. If one case includes a verified supplier invoice and the other does not, different outcomes may be justified. If facts match but one analyst overlooked the same risk indicator, correct the review and clarify guidance or training.
Watch the distinction: Different outcomes do not automatically show inconsistency. First compare the evidence each analyst had and the decision rule each applied.
Reference: [1]
60. Model governance and privacy
Model governance begins with a clear intended use, defined inputs, validation against relevant cases, and documented limits. Monitor performance after deployment because customer behavior, channels, data definitions, and crime methods change. A fall in useful-case yield might reflect more false positives, a changed case mix, or labeling delays; examine these before retuning. Check missed cases and coverage as well as alert volume. Proposed new personal data should have a lawful basis and a demonstrated purpose, with access, retention, and transfer controls suited to the applicable jurisdiction. Test whether less intrusive existing features answer the same question. Record model changes, approvals, and results so decisions can be reproduced. CAMS programme information identifies the certification; the operational judgment here is to balance detection value, reliability, and lawful data use.
Worked example: After remote onboarding launches, a model's useful-case rate falls from 10 of 100 alerts to 5 of 100, or from 10% to 5% in these hypothetical samples. Compare input distributions and labeled cases from the new channel, including missed cases. Before adding device-location history, test whether existing channel and transaction fields resolve the drift, then assess the proposed data under applicable privacy rules.
Watch the distinction: A lower useful-case rate alone does not prove model drift or justify collecting more personal data. Check labels, case mix, inputs, missed cases, and lawful necessity first.
Official references and further reading
- Current indexed English CAMS candidate handbook excerpts
- Current English CAMS programme excerpt
- Current enhanced CAMS programme and elective boundary excerpt