Financial crime rarely fits one label. A false invoice may conceal a bribe, move laundering proceeds, distort financial statements, and create a tax problem. For CFCS preparation, practice following the money and testing each explanation against documents, behavior, and control records. Begin with the underlying activity, then identify who controls the assets, how value moves, which records should exist, and what the available evidence actually supports. The guide connects money laundering, fraud, corruption, trafficking, tax evasion, cybersecurity, asset recovery, customer due diligence, and program controls. Its examples use stated facts and hypothetical figures so you can work through classification, calculations, escalation, and investigative choices without assuming that one jurisdiction’s legal rule applies everywhere.
Money laundering
1. Proceeds and laundering stages
Criminal proceeds arise from an underlying offense; laundering concerns later handling that disguises their origin, ownership, movement, or use. Placement, layering, and integration are useful ways to describe activity, but they are not required steps or a fixed chronology. A transfer to a mule account may separate funds from the victim, while transfers through companies may make the trail appear commercial. Buying an asset can convert a bank balance into property that looks easier to explain or retain. Trace each transaction by date, amount, account holder, controller, and stated purpose. Then compare the stated purpose with contracts, invoices, and evidence of goods or services. A case can move directly from theft to an asset purchase, so do not force every fact into three stages. The CFCS exam preparation page confirms money laundering as a covered subject.
Worked example: A victim loses $80,000 through theft. The $80,000 sent to a mule account is suspected proceeds of that theft. Transfers through two companies may obscure who controls the money or create a false commercial explanation. If the funds then buy a vehicle, the vehicle may represent converted proceeds. Obtain the account trail, company records, purchase documents, and vehicle title to test that connection.
Watch the distinction: A common error is treating placement, layering, and integration as elements that must all be proved. They are descriptive patterns; the transaction trail and applicable law determine the assessment.
2. Structuring and cash patterns
Structuring is the deliberate division of activity to avoid a reporting, identification, or review requirement under the applicable jurisdiction's rules. Repeated deposits just below a familiar amount may raise a question, but deposit size alone does not establish intent. Compare the pattern with the customer's usual sales, cash handling, deposit locations, timing, and explanations for any change. A cash-intensive shop might reasonably make larger deposits after a seasonal event; flat sales alongside a sharp rise in cash deposits calls for more work. Look for linked accounts, branches, depositors, and transfers after deposit. Avoid assuming one universal cash threshold because duties vary by jurisdiction and institution. The broader anti-money laundering study guide can help reinforce how transaction patterns and customer activity fit together.
Worked example: A shop usually deposits $2,000 a week. It makes eight deposits of $9,000 in ten days, totaling 8 × $9,000 = $72,000, while recorded sales stay flat. The unusual volume and timing merit inquiry. Reconcile cash sales, opening cash, refunds, loans, and deposit records; the repeated $9,000 amounts are a cue, not proof that the shop sought to evade a rule.
Watch the distinction: Do not label every deposit of a particular size as structuring. The relevant question is whether the combined pattern and surrounding evidence support deliberate avoidance of an applicable requirement.
3. Trade-based laundering
Trade can move value through an apparently ordinary purchase or sale. An inflated invoice may shift extra funds to an exporter; an understated invoice can leave value with an importer. False quantities, quality descriptions, duplicate invoices, or shipments that never occurred can serve similar purposes. Compare the contract, invoice, customs documents, shipping records, payment instructions, and independently supported prices. A price difference is only a starting point: freight, insurance, specialized specifications, scarce supply, and payment terms can explain it. Also ask whether the payer, shipper, consignee, and beneficiary have coherent roles. Prices must be compared for the same unit, currency, delivery terms, and date. The investigation should identify what value moved and why the documents might misstate it, while keeping commercial explanations open until tested.
Worked example: An importer pays $150,000 for goods independently valued at $90,000 on comparable terms. The apparent excess is $150,000 − $90,000 = $60,000. Check whether freight, insurance, superior quality, a larger delivered quantity, or unusual payment terms account for that $60,000. If none does, the excess may represent value transferred through the trade payment, but the price comparison alone does not prove laundering.
Watch the distinction: The highest invoice price is not automatically the correct benchmark for a trade case. Match goods and delivery terms before interpreting a difference as concealed value.
4. Layering through legal entities
Companies can conceal control when the named shareholders differ from the people directing payments. Build two maps: one for legal ownership and one for practical control, including signatories, directors, shared devices, instructions, and beneficiaries. Nominees may hold shares or titles for someone else, so a registry search alone may leave the controlling person unidentified. Circular payments can create many entries without bringing new money into the group. Count each transfer to understand movement, but reconcile the opening and closing balances to avoid treating turnover as revenue or new funds. Shared addresses, officers, and payment narratives are useful links, though legitimate groups can share services. Test whether each transfer corresponds to real goods, a loan, or another commercial obligation, and identify who approved each leg.
Worked example: Company A sends $200,000 to B, B sends $200,000 to C, and C returns $200,000 to A. The ledgers show $600,000 of gross transfers across three legs, assuming no fees or other flows. A finishes with the same $200,000 it started with, so its net receipt is zero. Shared ownership and the absence of services would strengthen concern about fabricated activity.
Watch the distinction: Do not add circular transfers and call the total new proceeds. Gross transaction volume measures movement; net balances and the source of the original funds answer different questions.
5. Correspondent and payment chains
A cross-border payment can involve an originating customer, the customer's bank, one or more correspondent or intermediary banks, a beneficiary bank, and a final recipient. Each participant may see only part of the chain. The originating bank can verify information it holds about its customer and payment instruction; an intermediary may chiefly verify the message and its own processing records; the beneficiary bank can compare the named recipient with its account holder. These are different evidentiary views, not interchangeable assurances. Reconstruct the chain using message fields, transaction references, account records, settlement entries, and any amendments. Check whether a stated commercial purpose explains both the sender and the final beneficiary. A mismatch can arise from an agent or assignment of payment rights, but that relationship needs documents and confirmation.
Worked example: A trading firm instructs a payment through two intermediary banks to a consultant. The sender's bank can check the firm's instruction and account history; each intermediary can trace its own receipt and onward transmission; the beneficiary bank can verify the consultant's account. Request the consultancy agreement or documented payment assignment to explain why a trade payment ends with this unrelated recipient.
Watch the distinction: An intermediary's processing record does not verify the underlying trade or the beneficiary's business role. Assign each claim to the institution and records capable of supporting it.
6. Virtual asset tracing
A public blockchain can show transfers between addresses, transaction identifiers, amounts, and times. It does not by itself establish who controls an address or whether the original asset came from lawful activity. An exchange account adds another evidence layer: customer records, deposit credits, trades, withdrawal requests, fees, and destination addresses. First reconcile asset units, then account for trading conversions, network fees, exchange charges, or assets left on the platform. A small unexplained difference should remain unexplained until records resolve it. Address clustering can suggest common control, but shared services and custodial wallets complicate attribution. Follow the chain to the point where reliable identity or transaction records exist, and state the limits of any inference beyond that point. Keep custody evidence separate from conclusions about beneficial ownership.
Worked example: A customer deposits 4 units of an asset at an exchange and later withdraws 3.7 units to several addresses. The difference is 4 − 3.7 = 0.3 unit. Obtain the exchange ledger: 0.3 unit might be fees, trading loss, a balance still held, or another transfer. The withdrawal addresses show destinations, but their controllers require separate evidence.
Watch the distinction: A visible address trail is not an identity trail. Treating every outgoing address as the customer's personal wallet can misattribute funds held by exchanges or other custodians.
7. Laundering case assessment
A defensible assessment joins the money trail to a plausible economic story. Establish what was received, what moved out, what remained, and who controlled each step. Then test the claimed transaction using independent evidence, such as shipping records, customer correspondence, customs data, inventory, and proof of delivery. A contract records an agreement or claim; it does not prove that goods moved. Consider contrary facts too: advance payments, delayed shipment, or an authorized agent could explain rapid onward transfer. The case note should distinguish confirmed facts from explanations and unresolved issues. Suspicion can arise from the combination of unusual timing, weak trade evidence, and inconsistent customer activity without proof of the underlying crime. Escalation and any external reporting depend on the institution's jurisdiction and the facts established.
Worked example: A new exporter receives $300,000 and quickly sends $295,000 abroad, retaining $300,000 − $295,000 = $5,000. It supplies a sales contract but no shipping record. The small retained amount and rapid transfer prompt questions about its role and margin. Seek shipment, inventory, buyer, and counterparty evidence before accepting the contract as proof of a completed export.
Watch the distinction: A signed contract is not equivalent to completed performance. Conversely, missing shipping documents at first review do not prove a sham trade; establish the delivery timeline and available records.
Fraud, including internal and financial-reporting fraud
8. Fraud mechanism and loss
A fraud case should separate the false representation, the decision it influenced, the transfer of value, and any recovery. For an invoice scheme, ask who created the invoice, what work it claimed, who approved it, and whether the payer relied on it. The paid amount is the initial cash outflow. Confirmed recoveries reduce current exposure, but they do not erase the original transaction or establish that no further losses exist. Also distinguish attempted payments, cleared payments, pending recalls, and recoveries actually credited. Trace the recipient account and any onward transfers while preserving invoice and approval evidence. The CFCS study manual description expressly includes internal fraud and updated financial-reporting fraud, which make reliable loss and transaction records especially useful across investigations.
Worked example: A fabricated supplier invoice induces a $40,000 payment. The bank successfully recalls $12,000 and credits it back. The payer sent $40,000, recovered $12,000, and has $40,000 − $12,000 = $28,000 of remaining cash exposure. Record all three figures. A requested but uncompleted recall would not yet reduce the $40,000 exposure.
Watch the distinction: Do not describe the $28,000 balance as the amount originally stolen. It is the remaining exposure after a confirmed recovery; the initial payment was $40,000.
9. Internal fraud and access
Employee access creates opportunity, but attribution needs evidence of use and benefit. Map who could create vendors, change bank details, approve invoices, and release payments. Compare assigned permissions with actual login records, approval logs, device data, and exception reports. Use of another employee's credentials is a control breach, although the login alone may not prove who typed the action. Independently verify the vendor's existence, ownership, bank account, and delivered work. Segregating vendor creation from payment approval reduces the chance that one person can invent and pay a supplier; monitoring should still detect shared credentials or override paths. Preserve timestamps and original records before interviewing involved staff. The strongest conclusion ties an unauthorized action to a person and a financial benefit, while addressing credible alternatives.
Worked example: A clerk creates a vendor and approves an $18,000 invoice using a colleague's credentials. The dual-role activity and borrowed credentials breach the intended approval separation. A matching bank address is a lead, not ownership proof. Confirm the receiving account's holder, access history, invoice work, and any link to the clerk before attributing the $18,000 payment.
Watch the distinction: Shared credentials do not automatically identify the person who used them. Combine login, device, timing, witness, and benefit evidence before concluding that a particular employee diverted funds.
10. Procurement fraud patterns
Procurement fraud can affect supplier selection, pricing, and delivery. Compare bids for shared formatting, identical errors, metadata, contact details, and submission timing to test whether bidders acted independently. Then separately compare purchase orders, delivery records, inspection results, and invoices to determine whether paid work arrived. A coordinated bid process and an inflated invoice can coexist, but proof of one does not prove the other. Quantify physical discrepancies in units first, then value them using the applicable unit price and contract terms. Account for partial deliveries, returns, substitutions, and timing differences. The fraud examiner study guide offers related practice in separating a suspicious pattern from the evidence needed to support a fraud conclusion.
Worked example: Three bids repeat the same unusual spelling error, suggesting a common drafter or shared source. The winner invoices 120 units, while receiving records show 90, a difference of 120 − 90 = 30 units. Verify whether 30 units arrived later or were legitimately substituted. Investigate bid independence separately through submission records, bidder ownership, and communications.
Watch the distinction: An identical error in bids raises a coordination question; it does not establish that goods were missing. Likewise, a delivery shortfall does not alone prove the bidding was rigged.
11. Revenue recognition fraud
Revenue recognition depends on the substance of the customer contract and when the seller satisfies the relevant performance obligation under the applicable accounting framework. An invoice or sales entry alone does not show that the customer obtained control of goods or accepted services. Compare dispatch and delivery records, warehouse custody, customer acceptance, cancellation rights, returns, and side agreements. Goods still held by the seller may qualify under particular arrangements, but that requires evidence of the contractual conditions and why the goods are identified for the customer. Cutoff testing focuses on transactions around the reporting date because a premature entry can inflate both revenue and receivables. Confirm apparent support for the remainder as well; delivery evidence may still be contradicted by return rights or disputes.
Worked example: A company books $500,000 of December sales. Orders worth $140,000 are cancellable, and the goods remain in its warehouse. The other $500,000 − $140,000 = $360,000 has apparent delivery support, subject to contract and acceptance checks. Review the $140,000 for control transfer and cancellation terms before deciding whether any of it belongs in December revenue.
Watch the distinction: A purchase order is not proof of earned revenue. Its cancellation and delivery terms may leave the seller with the goods and the customer with no binding obligation.
12. Expense and asset misstatement
Capitalization records a cost as an asset and spreads or recognizes its expense according to the applicable accounting rules. A routine repair that merely maintains an asset's existing condition generally belongs in current expense; an improvement that creates additional future benefit may merit different treatment. Examine the work order, invoices, asset condition, and any added capacity or useful life. Misclassifying an ordinary cost as an asset raises current profit because the expense is omitted, and raises reported assets because the unsupported amount remains on the balance sheet. Later depreciation can shift the timing of the misstatement, so specify the reporting period and assumptions. Intent is a separate question: a wrong entry may result from error or deliberate manipulation. Approval trails and repeated end-period adjustments help assess that distinction.
Worked example: A firm pays $60,000 for a routine repair that restores existing performance and records it as an asset. Assuming the full repair should have been expensed and no depreciation, tax, or other adjustment has occurred, current expense is understated by $60,000. Current profit and assets are each overstated by $60,000. Reclassifying the entry corrects those two amounts for this period.
Watch the distinction: Not every payment involving equipment creates an asset. Determine whether the work adds future economic benefit or simply maintains existing performance before accepting capitalization.
13. Account takeover versus authorized scam
Account takeover and customer-authorized scams can produce similar outgoing payments but differ in who initiated them. In takeover, an intruder gains account access and submits instructions without the customer's consent. In an authorized-payment scam, the customer operates the account but is deceived about the reason or recipient. Review login events, device enrollment, authentication challenges, session actions, customer communications, and payee changes. A successful authentication event shows a control was passed; it does not by itself prove the legitimate customer acted. Conversely, a customer's own payment instruction does not show that the underlying story was true. The classification guides evidence gathering, containment, and recovery steps, while liability and reporting outcomes depend on the governing jurisdiction and product terms. Preserve both technical and human interaction evidence.
Worked example: One transfer follows a new-device login, payee creation, and no known customer contact. That sequence suggests account takeover; check device and authentication records. A second transfer follows a call in which a fraudster persuades the customer to send money personally. That suggests an authorized-payment scam; preserve the call details and the customer's account of the deception.
Watch the distinction: A payment made through the customer's normal app is not necessarily free from fraud. The customer may have been deceived, while a logged-in intruder may have passed authentication controls.
14. Fraud evidence and competing explanations
An investigation gains strength by placing events in order and testing explanations that could clear as well as implicate someone. Start with the original supplier record, the change request, who approved it, when the payment was sent, and which account received it. Obtain confirmation through a trusted supplier contact already on file, not a phone number in the change request. Compare that confirmation with bank-account ownership, prior correspondence, and any documented migration notice. Preserve the change log even if the change proves legitimate: it establishes who acted and helps evaluate whether the control operated. A corroborated innocent explanation should reduce the allegation's weight, though any separate control failure may still need correction. Record what each source directly establishes and what remains inferred.
Worked example: An employee changes a supplier's bank account one day before payment, an initially suspicious sequence. A trusted, preexisting supplier contact independently confirms a planned bank migration, and bank documentation matches the new account. Those facts support a legitimate change. Retain the change log and approval record to show the chronology and check whether the required verification occurred.
Watch the distinction: Timing alone is not proof of misconduct. A late account change can be genuine; test it independently while preserving the original records and any control exceptions.
Anti-corruption
15. Bribery elements and intermediaries
A possible bribe carried through an intermediary requires more than an unusual fee. Identify the thing of value, who ultimately received or benefited from it, the business decision at issue, and evidence that the transfer sought improper influence. A consultant may perform genuine services and still pass part of a payment onward. Examine the engagement terms, deliverables, invoices, bank transfers, messages, and relationships between the consultant, decision-maker, and relatives. Timing near an award is a diagnostic cue, especially when services are vague or compensation is disproportionate. It is not, by itself, evidence of intent. Keep the consultant's retained fee distinct from the onward transfer. Legal elements, public-official definitions, and corporate liability depend on the applicable jurisdictions, so describe observed conduct before assigning a legal conclusion.
Worked example: A consultant receives $75,000 shortly before a contract award and sends $50,000 to an official's relative, retaining $75,000 − $50,000 = $25,000. Trace the relative's account and seek communications, service records, and evidence of the official's role in the award. The transfer and timing raise concern; proof of its purpose needs more than arithmetic.
Watch the distinction: A payment to an official's relative is not automatically a proved bribe. Establish the relative's benefit, the official's connection to the decision, and the payment's intended purpose.
16. Gifts and hospitality risk
Hospitality risk turns on context: value, timing, recipient authority, frequency, who chose the benefit, and whether it has a real business purpose. A legitimate conference can include useful meetings while vendor-funded travel gives a decision-maker a personal benefit. Ask who paid for transport, lodging, companions, and leisure activities; whether the recipient could affect an active tender; and whether comparable opportunities were offered consistently. A documented agenda supports the business rationale but does not settle the influence question. Distinguish modest working hospitality from expenses that relieve the recipient of substantial personal costs, without assuming one universal monetary limit. Record approvals, disclosures, tender decisions, and communications before and after the event. The relevant employer rules and governing anti-corruption law determine permitted conduct and consequences.
Worked example: A vendor pays for a procurement officer's travel during an active tender. The conference agenda shows a legitimate subject for attendance, but the officer can influence the pending award. Check the full travel cost, who approved it, whether the officer participated in evaluation, and related communications. The agenda explains the trip's topic; it does not resolve the potential benefit or influence.
Watch the distinction: Calling travel a business event does not remove corruption risk. The decision-maker's authority and the vendor's pending interest remain relevant even when the meetings themselves are real.
17. Conflicts of interest
A conflict exists when a person's private interest could affect, or appear to affect, a duty to make an impartial decision. Ownership in a bidder creates a financial interest even if the person promises to be fair. Disclosure makes the relationship visible; managing it requires limiting the person's influence over specifications, evaluations, negotiations, and approval. Review when the interest arose, whether it was declared, and what actions the person took before recusal. Meeting minutes, scoring sheets, access logs, and communications show whether a formal removal actually worked. The winning bid may still be commercially sound, so assess the procurement outcome separately from the governance failure. Jurisdiction and organization rules govern formal duties, but the stable control principle is to keep someone who benefits from an award out of that decision.
Worked example: A selection-panel manager owns 20% of a bidding company. That stake gives the manager a financial interest in the outcome. Disclosure records the interest, but the manager should also be removed from scoring and award decisions. Review earlier work on the tender specifications and the panel record to determine whether the conflict already affected the process.
Watch the distinction: Disclosure alone does not neutralize a decision conflict. A person can reveal an interest and still shape criteria, access competing bids, or vote on the award.
18. Books, records, and false descriptions
Books and records should describe what a payment purchased and who benefited. A vague or false invoice can conceal an improper transfer even when the accounting entry is arithmetically correct. Test the description against work orders, reports, meeting notes, vendor capability, and payment flows. Separate two questions: whether the records accurately reflect the transaction, and whether the transaction was intended to influence a decision-maker. The first may be supported by missing deliverables or a description contradicted by other records; the second calls for evidence of recipient relationships, communications, timing, and decision authority. An associate's involvement is a lead rather than conclusive proof that an official benefited. Preserve the original invoice, approvals, and downstream bank records so later explanations can be checked against contemporaneous evidence.
Worked example: A $30,000 invoice says 'market research,' but the vendor produced no report and sent the money to an official's associate. The missing work challenges the invoice description. Obtain the engagement scope, drafts, messages, and bank records to test whether research occurred. Separately investigate whether the associate passed value to the official or acted to influence a specific decision.
Watch the distinction: An unsupported service description and a proved bribe are different conclusions. The first concerns record accuracy; the second requires evidence connecting value to improper influence.
19. Third-party corruption due diligence
An intermediary can create corruption exposure because it acts near decision-makers while being paid by the company seeking business. Before engagement, identify its owners and controllers, relevant experience, services, government connections, payment destination, and basis for compensation. A commission far above comparable arrangements needs an economic explanation, such as unusually demanding work or a different risk allocation. During the engagement, match invoices to actual introductions, advice, or other deliverables, and review changes in ownership or payment instructions. A written contract is useful but does not prove performance. Relative comparisons should use the same contract value and service scope. Unexplained excess compensation, vague work, and proximity to an award together can justify deeper review, while no single factor proves bribery under the applicable law.
Worked example: An inexperienced agent requests 15% of a hypothetical $400,000 contract: 0.15 × $400,000 = $60,000. Comparable agents receive 5%, or 0.05 × $400,000 = $20,000. The difference is $40,000. Compare service scope, qualifications, ownership, and intended recipients of the fee before deciding whether the premium has a legitimate basis.
Watch the distinction: An above-market fee is a risk signal, not a bribe calculation. The $40,000 difference shows what needs explanation; it does not identify an improper recipient.
20. Public and private corruption
Improper influence can affect both public purchasing and private commercial decisions. Identify who requested or received a benefit, what duty that person owed, and which award or decision they could influence. A private purchasing manager may betray an employer's interests by demanding a side payment; a municipal buyer may misuse public authority through similar conduct. Both cases call for independent bidding, recorded approvals, conflict checks, and a reliable trail of supplier payments. The legal label differs with the jurisdiction: statutes may define public officials, private bribery, fraud, or breach of trust differently. Do not assume a public-sector rule automatically covers a private employee, or that private-sector conduct is harmless. Describe the benefit, decision, and evidence first, then apply the governing law to the relevant person's role.
Worked example: A private-company purchasing manager demands money from a bidder in exchange for an award. A municipal buyer makes the same demand on another tender. In both cases, preserve the request, payment trail, bid record, and decision history. The control failure is a decision-maker seeking personal value. Legal classification depends on each buyer's role and the law of the relevant jurisdiction.
Watch the distinction: Corruption is not limited to public officials. Private decision-makers can seek improper benefits too, although the applicable offenses and required legal elements may differ.
21. Corruption and laundering links
A corruption case can also produce a laundering question when money from an improper award moves through a purported service provider and becomes an asset used by the decision-maker. Build the sequence in three parts: the tender decision, the contractor’s disbursement, and the eventual owner or user of the asset. Compare bid scores and communications with the adviser’s contract, actual work, invoices, bank transfers, and property records. A payment to an adviser does not itself establish a bribe; an asset used by an official’s family does not by itself establish who paid for it. The money laundering study guide can help you revisit how ownership and transaction trails connect. Assess each possible offense under the law of the jurisdiction involved, and keep alternative explanations visible.
Worked example: A contractor wins a tender and pays a shell adviser $90,000. Obtain the bid file and decision records to test influence, then compare the adviser’s invoice with evidence of services and the $90,000 bank trail. Property purchase records, funding documents, occupancy records, and beneficial ownership evidence can test whether those funds financed a home for an official’s family. The sequence supports investigation; none of its three links is proved by timing alone.
Watch the distinction: Calling the $90,000 a proven bribe and the property proven laundering skips purpose, source, and ownership evidence. Trace each link and apply the relevant jurisdiction’s legal tests.
Reference: [1]
Human trafficking
22. Trafficking versus smuggling
Trafficking centers on exploitation through control of a person; smuggling generally concerns arranging unauthorized border movement for a benefit. The categories can overlap, but crossing a border is unnecessary for trafficking. In a financial-crime review, focus on recruitment promises, who holds identity documents, whether a person can leave work, control of wages, threats, and debts that cannot realistically be cleared. A worker’s initial agreement to travel or take a job does not settle whether later coercion developed. Conversely, a paid border crossing alone does not establish forced labor. Preserve what each witness or record actually shows rather than assigning a legal conclusion from one indicator. The current CFCS study manual description expressly includes human trafficking; the applicable jurisdiction’s law governs the case classification.
Worked example: Workers are recruited and employed within one country. The employer keeps their passports and says they cannot leave until they repay an invented debt. There is no border movement to classify as smuggling. Recruitment records, passport access, wage deductions, debt ledgers, and private worker accounts can test whether the employer is using debt and document control to compel labor. Domestic travel does not remove the trafficking concern.
Watch the distinction: Assuming trafficking requires international transport overlooks exploitation within one country. Treat movement as one possible fact, then examine whether control, threats, or debt are compelling the work.
23. Coercion and control indicators
Coercion is best assessed as a pattern of restricted choices. Debt may become a control device when its origin or balance is opaque, charges rise unpredictably, or leaving work triggers threats. Retained documents can limit movement, but safekeeping requested freely by a worker has a different meaning. Compare the written employment terms with actual deductions, access to wages, ability to retrieve identification, housing rules, and communications about leaving. Look for independent evidence of who controls each condition and whether workers can refuse it without penalty. Financial records can quantify pressure but cannot alone prove a worker’s experience. When speaking with a potentially controlled person, arrange a safe channel that does not expose their account to the employer. Legal classification depends on the jurisdiction and the full facts.
Worked example: A worker earns $900 monthly and loses $700 to an employer-controlled debt, leaving $900 − $700 = $200 before food and housing. Obtain the debt agreement, original recruitment charge, payment history, and any added fees. Check whether the worker can access identification and leave without threats. The 77.8% deduction share is a serious cue, but the coercion assessment depends on how the debt and restrictions operate.
Watch the distinction: A large deduction alone does not prove forced labor, and a signed debt agreement does not settle consent. Test whether the worker could understand, challenge, repay, and leave safely.
24. Trafficking-related payment flows
Payroll flows can reveal who benefits from labor even when wages appear to reach individual accounts. Compare employer payroll files, beneficiary details, account opening records, withdrawal timing, cards, devices, and cash locations. Repeated same-day withdrawals by one person across worker accounts may indicate common control, but a legitimate payroll administrator or voluntary arrangement is possible. Trace whether workers can independently access their accounts, keep the wages, and explain transfers without a supervisor present. Separate the amount paid by the employer from the amount workers ultimately retain. Cluster analysis helps prioritize inquiry; it does not identify victims or perpetrators by itself. Preserve account-level timelines so a case reviewer can distinguish coordinated exploitation from shared local banking habits or a documented group payment arrangement.
Worked example: Ten workers receive $12,000 in total wages. One person withdraws $10,800 from their accounts within a day, so $10,800 ÷ $12,000 = 90% of wages; $1,200 remains. Review card possession, withdrawal video where available, account mandates, and private worker accounts. The common collector and 90% share warrant inquiry, while consent and actual control remain unresolved.
Watch the distinction: Treating a shared cash withdrawal pattern as proof that every worker was exploited ignores consent and account access. Establish who directed withdrawals and who ultimately kept the money.
25. Recruitment-fee debt
Recruitment debt can bind a worker when fees are charged before employment, recovered through wages, and enlarged through interest, housing charges, or penalties. Start with the promised and actual job terms. Reconstruct the original charge, each deduction, new fee, payment recipient, and remaining balance. A simple payoff calculation provides a baseline; it is rarely the whole story if wages are withheld or records are controlled by the recruiter. Examine whether the worker could decline the fee, change employer, dispute charges, or leave without threats. Payments to recruiters, agents, and employers may identify financial beneficiaries, but a fee by itself does not establish trafficking. Compare worker accounts with contracts, payroll, bank statements, and recruitment messages, while avoiding interviews in the presence of a possible controller.
Worked example: A worker owes a hypothetical $3,000 fee and pays $150 monthly, with no interest or new charges. The baseline payoff is $3,000 ÷ $150 = 20 months. If $50 in new monthly charges is added, only $100 reduces principal, extending payoff to 30 months. That arithmetic shows how fees can prolong dependence; records must establish whether those charges exist and how they are enforced.
Watch the distinction: Dividing the initial fee by a monthly deduction can understate the debt period. Check added charges, missed wages, interest, and whether payments actually reduce the recorded balance.
26. Victim-sensitive investigation
A companion who answers for a customer and holds their documents may be exercising control, or may be providing ordinary assistance. Staff should record observable facts precisely: who spoke, who held the documents, whether the customer could answer privately, and any signs of distress. Keep the account and identity records intact, and route the concern through a private safeguarding or investigation channel. A direct challenge in front of the companion can increase risk if the customer is being controlled. Plan any follow-up so the customer can speak without pressure and so the institution avoids promising secrecy it cannot legally provide. Separate immediate safety concerns from transaction questions; each may need a different team and response. Reporting and information-sharing duties depend on the local jurisdiction.
Worked example: A customer arrives with a companion who supplies every answer and holds the customer’s passport. Staff note the exact statements, document custody, time, and account activity, then escalate privately. A trained team considers a safe opportunity to verify identity and ask the customer about account control without the companion present. The observation supports concern but does not yet establish exploitation.
Watch the distinction: Confronting the companion or asking the customer to deny coercion in front of them may expose the customer to harm. Record facts and arrange a safe, private assessment.
27. Labor and commercial exploitation
Labor exploitation inquiries should connect actual workers, contractual work, and the money paid for it. Reconcile an agency’s invoice with factory rosters, time sheets, access logs, payroll entries, subcontractor agreements, and worker accounts. A gap may reflect subcontracting, timing, fictitious workers, unpaid wages, or an agency retaining pay that belongs to workers. Identify who received the factory payment and who had authority over wages, identity documents, housing, and work assignments. Industry alone is a weak cue; the same labor arrangement can be lawful or abusive depending on its terms and operation. Keep the suspected financial gain distinct from the evidence of coercion. If workers may be controlled, obtain their accounts safely and independently, with attention to the governing jurisdiction’s protections and reporting rules.
Worked example: An agency invoices a factory for 40 workers, but factory payroll lists 26. The difference is 40 − 26 = 14 workers. Match all 40 names to site access and time records, then check whether a documented subcontractor paid the other 14. Follow the agency’s receipts and wage disbursements. An unexplained gap raises billing and exploitation questions; it does not identify 14 trafficking victims.
Watch the distinction: Calling every unmatched worker a trafficking victim confuses a payroll discrepancy with coercion. Resolve subcontracting and attendance first, then examine wage control and working conditions.
28. Trafficking case convergence
One case may present several financial-crime hypotheses, each with different proof. False worker identities call for enrollment files, identity checks, payroll instructions, and evidence of who submitted the data. Suspected wage capture requires bank records, card access, withdrawal patterns, and worker accounts obtained safely. A payment to an inspector’s relative raises a possible corruption question that depends on the relationship, services, timing, and inspector’s decisions. If money from these activities moves through other entities, trace its source and control before advancing a laundering theory. Build one chronology, but mark each inference and its contrary evidence separately. The fraud investigation guide is useful for thinking through false records and attribution. Any legal labels and external reporting duties depend on the jurisdictions involved.
Worked example: An agency submits false worker identities, receives wage payments, and pays an inspector’s relative. Compare identity documents with real worker and enrollment records to test fabrication. Match wages to bank accounts, access devices, and worker testimony to test control. Examine the relative’s contract, services, payment trail, and the inspector’s actions to test improper influence. These are linked leads, but proof of one does not establish the others.
Watch the distinction: A payment to an inspector’s relative does not prove bribery, and false identities do not prove wage coercion. Keep separate evidence lists for each hypothesis.
Tax evasion
29. Tax evasion versus lawful planning
Tax planning uses a treatment permitted by the applicable jurisdiction on true facts. Evasion involves a false representation, concealment, or other prohibited conduct affecting a tax obligation. The same deduction category can therefore be proper for one taxpayer and suspect for another. Start with the actual transaction: who supplied goods or services, what was paid, when, and for whose benefit. Compare invoices against contracts, delivery records, bank flows, and counterparties. Next determine whether the expense qualifies under the jurisdiction’s rules and period, then assess evidence of knowledge or intent separately. A questionable claim does not automatically prove criminal intent, and an unusual structure is not automatically unlawful. Tax specialists can compute any adjustment; financial-crime investigators should preserve the factual trail and avoid substituting a bank transfer for proof of economic substance.
Worked example: Two owners claim a deduction allowed for genuine equipment repairs. One has a real contractor invoice, work order, and payment; the other fabricates an invoice for work that never occurred. The deduction category is the same, but the second claim rests on a false transaction. Examine payment flows and records, then apply the relevant tax law to determine the adjustment and any culpability.
Watch the distinction: Calling every tax-saving deduction evasion ignores lawful eligibility. Conversely, a permitted deduction category does not rescue a fabricated invoice or work that never occurred.
Reference: [2]
30. Unreported income
A difference between sales records and reported revenue is an investigative starting point, not a tax loss figure. Reconcile gross sales to returns, discounts, sales taxes collected for government, deferred revenue, and timing differences before comparing with the tax return. Trace bank deposits separately, because loans, capital contributions, and transfers may increase deposits without being sales, while cash sales may never reach a bank. Match each adjustment to dated source documents and the reporting period. The question is whether the return omits income under the jurisdiction’s accounting and tax rules, and whether any omission was knowing. A clean reconciliation shows the reviewer which amounts are explained, which remain open, and what records would decide the issue. Do not apply a tax rate until the taxable base is established.
Worked example: Documented sales are $500,000; the business reports $420,000. Verified refunds of $30,000 reduce the comparable sales figure to $470,000. The apparent gap is $470,000 − $420,000 = $50,000. Check credit notes, payment dates, deferred items, and reporting periods before treating that $50,000 as omitted taxable income. A later tax calculation would use the applicable jurisdiction’s rules.
Watch the distinction: Subtracting declared revenue from gross receipts and calling the result tax evasion ignores refunds and timing. Reconcile the tax basis and examine intent before drawing that conclusion.
Reference: [2]
31. False deductions and expenses
An expense claim has at least two factual tests: whether the payment or liability occurred and whether it related to the business as claimed. An invoice alone can be fabricated, inflated, or issued by a related party for no meaningful work. Compare the engagement terms with deliverables, correspondence, staff interviews, approval records, and the path of funds. If money returns to an owner, determine whether it is a refund, loan, distribution, or concealed personal benefit. Keep unsupported amounts separate from proven false amounts: missing work records may reflect poor documentation, while a false description suggests a different conclusion. The allowable tax treatment depends on the jurisdiction and accounting period. Investigators should establish what happened before estimating any deduction adjustment, tax loss, or intent.
Worked example: A company claims $25,000 in consulting costs. Work files and invoices support $10,000; $15,000 reaches an owner’s personal account without an identified service. The claim divides into $10,000 with apparent work support and $15,000 needing explanation. Trace the latter transfer, seek contract changes or refunds, and determine whether it was a business cost, owner payment, or false expense under local rules.
Watch the distinction: Treating the unexplained $15,000 as automatically fraudulent skips the payment’s purpose. Equally, accepting the full $25,000 because an invoice exists skips evidence of actual services.
Reference: [2]
32. Payroll and withholding concealment
Hidden compensation can appear when labor records and reported payroll describe different populations or amounts. Reconcile names, hours, rates, payment files, bank transfers, cash withdrawals, contractor invoices, and corrected returns for the same period. Hours multiplied by a rate gives an expected wage amount only if the hours were payable at that rate; unpaid breaks, overtime, and different worker categories may alter it. Next identify who received the money and how payments were classified. In a withholding inquiry, gross compensation, reportable wages, amounts withheld, and amounts remitted are distinct figures. The legal duty and resulting tax calculation depend on the jurisdiction and worker classification. A gap merits investigation, but payroll errors or timing differences can explain it without deliberate concealment.
Worked example: Time records show 2,000 paid hours at a hypothetical $20 per hour, implying 2,000 × $20 = $40,000 in wages. Payroll reports $30,000, a $10,000 gap for the same period. Match the hours and payments to workers, then check contractor records, corrections, and any differing rates. The gap is potential unreported compensation, not a calculated withholding loss.
Watch the distinction: Calling a $10,000 wage reconciliation gap a $10,000 tax loss confuses compensation with tax. Establish reportable wages and apply the jurisdiction’s withholding rules separately.
Reference: [2]
33. Cross-border tax information
A foreign account or company is a location and ownership fact, not proof of concealed income. Determine the individual’s tax residence under the relevant jurisdiction, who legally and beneficially owns the entity, where business activity occurs, and how receipts are classified. Then compare bank statements, company accounts, distributions, and the taxpayer’s return and disclosures. The same $200,000 receipt may be company revenue, a loan, capital, or an amount attributable to an individual under specific rules. Avoid adding all offshore inflows to personal income without tracing the economic event. Look for inconsistencies such as undisclosed control, omitted distributions, or false residence claims, while considering legitimate disclosure and timing. Separate any information-reporting question from the question of tax payable; the applicable law determines each duty.
Worked example: A tax resident owns a foreign company that receives $200,000. Both the company accounts and the resident’s filings disclose the company and receipt. That disclosure weakens a concealment hypothesis, though classification and tax treatment still need checking. Obtain ownership documents, contracts, bank records, residence evidence, and any distributions before deciding whether the $200,000 affects the resident’s taxable income under local law.
Watch the distinction: An offshore address does not make $200,000 concealed personal income. First identify the taxpayer, owner, transaction type, disclosure, and jurisdiction’s treatment of company earnings.
Reference: [2]
34. Invoice and transfer-pricing abuse
Related companies can set prices that move profit between tax jurisdictions. To assess the price, map the transaction and compare each entity’s functions, assets, and risks: manufacturing, intellectual property, marketing, inventory, credit exposure, and warranty obligations. Then examine contracts, actual conduct, costs, and reasonably comparable independent transactions. A resale spread is gross; it must cover the reseller’s costs and reward its genuine activities before anyone can interpret profit allocation. An implausible invoice may also raise fraud or laundering questions, but those require their own evidence. Transfer-pricing rules and accepted methods vary by jurisdiction, so the analysis should identify where each company is taxed and which law applies. Do not infer abuse solely because a related party earns a margin or because one jurisdiction has lower tax.
Worked example: A manufacturer sells one unit to an affiliate for $50; the affiliate resells it for $100. The $50 spread is gross revenue less purchase price, not necessarily profit. If the affiliate incurs a hypothetical $35 in distribution and warranty costs, its remaining amount is $15 before other expenses. Compare its real functions, risks, and independent margins before judging the $50 transfer price.
Watch the distinction: Calling the entire $50 resale spread shifted profit ignores the affiliate’s costs and work. Test actual functions and comparables under the relevant jurisdiction’s rules.
Reference: [2]
35. Tax evidence and predicate links
A tax case and a laundering case can share transactions but require different calculations and proof. First establish the omitted taxable amount from records and the jurisdiction’s tax rules. Then calculate any tax shortfall after allowable expenses, losses, credits, and rates. Separately trace transfers to a nominee and determine whose money moved, why, and who retained control. The amount of potential criminal proceeds for laundering purposes may depend on the jurisdiction’s law and the precise tax offense; it should not be assumed to equal gross receipts or the tax shortfall. Evidence of false filing may support intent in the tax inquiry, while nominee control and transaction design may bear on concealment. Keep a chronology that distinguishes source, tax calculation, transfer, and beneficial use.
Worked example: A false return omits a hypothetical $100,000 of taxable receipts, then funds move to a nominee. The $100,000 is the omitted receipts, not automatically the tax loss. Compute any shortfall using the applicable tax rules, then trace the amount transferred and its source. Nominee agreements, account access, and spending records test continued control. Any laundering allegation requires the jurisdiction’s separate legal and evidentiary analysis.
Watch the distinction: Equating omitted receipts, unpaid tax, and laundering proceeds produces a false single figure. Calculate each amount independently and document the legal basis for connecting them.
Reference: [2]
Cybersecurity
36. Phishing and credential compromise
Phishing can connect a deceptive message to stolen credentials, a new session, and payment changes. Reconstruct the sequence using the original message, link destination, browser or proxy records, authentication logs, device enrollment, payee creation, and transaction approval events. Timestamps should be normalized to one time zone. A close sequence supports a hypothesis, but credentials entered at a lookalike site do not prove that the later login was unauthorized. Check whether multifactor authentication was completed, bypassed, intercepted, or approved by the user under deception. Distinguish the device identifier from the person operating it. Containment may require ending sessions and securing credentials while preserving logs and the fraudulent page evidence. Any reporting or customer notice assessment follows the institution’s jurisdiction and incident facts.
Worked example: A user enters credentials on a lookalike site at 09:10. A new device logs in and adds a payee at 09:14, four minutes later. Preserve the message, page URL, login logs, device enrollment, multifactor event, and payee audit trail. The short interval makes compromise plausible. A valid multifactor approval still needs interpretation: it may have been coerced or mistakenly approved.
Watch the distinction: A successful login is not proof that the account holder intended the payee change. Examine how authentication was satisfied and who controlled the new session.
Reference: [2]
37. Business email compromise
Business email compromise often succeeds by changing payment details while leaving familiar commercial facts intact. Compare the new instruction with prior invoices, contracts, message headers, sender domains, and the supplier’s known account history. A similar-looking domain may indicate impersonation; a genuine supplier mailbox may also be compromised, so domain matching alone is insufficient. Verify the account change through contact details established before the disputed message, with a person authorized by the supplier. Record the callback route, respondent, and confirmed details. If payment has already left, trace the beneficiary promptly and coordinate with fraud and recovery teams. Separate the underlying debt, which may be genuine, from the destination account, which may be fraudulent. The evidentiary question is who authorized the change, not whether the invoice amount looks normal.
Worked example: A supplier invoice keeps its usual amount, but a reply from a similar-looking domain changes the bank account. Staff compare the reply’s domain and headers with prior correspondence, then call the supplier using a number already held in vendor records. The supplier says its account has not changed. The invoice may still be payable, but the replacement bank details should not be used.
Watch the distinction: Assuming an unchanged invoice amount proves a payment instruction is authentic overlooks the attacker’s goal. Verify changed bank details through a trusted, previously established contact route.
Reference: [2]
38. Ransomware payment investigation
Ransomware creates several linked but distinct decisions. Technical teams determine whether systems can be restored and whether the intruder retained access. Investigators determine what data was accessed or taken, who issued the demand, and where any payment would go. A blockchain address can support payment tracing but does not by itself identify the controller. Legal and sanctions specialists assess the proposed transfer under the relevant jurisdictions before any payment decision. Restoring from backups may reduce the need to buy a decryption key, yet it says little about data exposure or a threat to publish information. Preserve the demand, wallet details, malware and access logs, communications, and restoration timeline. Record each conclusion with its evidence and uncertainty so the incident response does not collapse into one yes-or-no payment question.
Worked example: Attackers demand 6 units of a virtual asset. Backups restore most systems, so the decryption need is lower, but the team still checks access logs and exfiltration evidence. It preserves the demand and wallet address, seeks to identify the recipient, and obtains jurisdiction-specific legal review before any transfer. No currency value or data-loss conclusion follows from the six-unit demand alone.
Watch the distinction: Successful restoration does not prove that data was safe or that payment is lawful. Treat recovery, exposure, recipient identity, and legal review as separate findings.
Reference: [2]
39. Logs and digital evidence
A digital chronology is only as reliable as its clocks and sources. Preserve original log files, their time zones, system clock settings, collection method, and integrity information such as a calculated hash. Convert timestamps to a common reference while retaining originals, and note daylight-saving rules where they apply. Correlate events across independent sources: application logs, identity provider records, payment messages, device records, and employee reports. An employee’s report time records when they noticed or reported an event, not necessarily when the event occurred. A two-minute interval can matter, but clock drift or delayed log delivery may change its meaning. Keep a clear chain of custody so a reviewer can reproduce the conversion and see whether records were altered after collection.
Worked example: The payment platform records an event at 10:03 UTC. Hong Kong is UTC+8, so 10:03 + 8 hours = 18:03 Hong Kong time on the same day. An employee reports it at 18:05 Hong Kong time, two minutes later. Preserve both original timestamps and check clock accuracy before inferring how quickly the employee noticed the event.
Watch the distinction: Comparing 10:03 and 18:05 as if they share a time zone creates a false eight-hour gap. Normalize clocks and preserve the original values.
Reference: [2]
40. Device and session anomalies
A network address identifies a connection point, not necessarily an individual. Public Wi-Fi, shared offices, mobile networks, and address translation can put unrelated users behind one address. Rank sessions by a combination of evidence: device history, enrollment event, authentication method, location consistency, payee changes, transaction speed, and the customer’s normal behavior. A newly enrolled device followed by rapid balance depletion carries more weight than a shared address alone. Even then, logs may show a device identifier without proving who held it. Compare session tokens, multifactor events, customer contact, and destination accounts to test control. Preserve both suspicious and ordinary sessions for comparison. If activity is ongoing, contain account access and trace transfers while documenting which facts support compromise and which remain uncertain.
Worked example: Two accounts log in from the same public Wi-Fi address. One uses a familiar device and makes routine payments; the other enrolls a new device and immediately empties its balance. The second session has the stronger anomaly because device change and rapid cash-out align. Review enrollment, authentication, beneficiary, and customer-contact records before attributing the session to an attacker.
Watch the distinction: Treating a shared IP address as proof that one person accessed both accounts ignores public network use. Combine device, authentication, behavior, and payment evidence.
Reference: [2]
41. Cyber incident containment
When an active service account is misused, first stop its ability to make further changes: disable the account or revoke its sessions and tokens, then rotate credentials and inspect related privileges. Coordinate that action with incident responders so volatile evidence is captured where feasible. Preserve authentication logs, payment instructions, device records, alerts, and system time settings in their original form; record who collected each item and when. Next, identify affected systems and transactions, trace payments, and restore from a known clean state after checking how access was gained. Recovery does not establish that data remained private or that funds are safe. Legal and compliance teams should assess notification and reporting duties under the jurisdictions governing the affected people, systems, and institution. The Certified Financial Crime Specialist scope includes cybersecurity, making the link between technical containment and financial investigation relevant.
Worked example: A service account is still active after initiating two unauthorized transfers. Responders revoke its sessions and disable it, while preserving available access and payment logs with timestamps and custody records. The payments team contacts the receiving institutions and traces onward movement. Security checks for other sessions and the entry point before restoring service. Legal and compliance staff assess any applicable notices in the relevant jurisdictions.
Watch the distinction: Waiting to finish a full investigation before disabling active access can permit more transfers. Preserve what evidence is feasible promptly, but contain the account while tracing and legal review continue.
Reference: [2]
42. Cyber and financial crime convergence
An intrusion can produce several distinct financial roles: the person who gained access, the person who controlled a receiving account, and the person who collected withdrawn funds. They may be the same person, but a payment trail alone does not prove that. Join authentication records to transaction identifiers, beneficiary details, device changes, withdrawal records, and any communications directing the transfers. Match timestamps across systems and note time zones. Test whether recipients are knowing participants, deceived intermediaries, or account holders whose accounts were also compromised. Map each split and subsequent cash-out so the remaining recoverable balance is visible. Where authorized, seek prompt preservation through the relevant institution while investigators develop identity evidence. A fraud investigation guide can complement the cyber trail by separating deception, loss, and attribution.
Worked example: A hacked account sends $60,000 in three $20,000 transfers. Each recipient then withdraws $18,000, so $54,000 leaves as cash and $6,000 remains across the accounts, assuming no other activity. Preserve login and transfer logs, obtain recipient account and withdrawal records through proper channels, and examine camera or device evidence. The cash withdrawals identify cash-out points, not necessarily the original attacker.
Watch the distinction: Calling every receiving account holder the hacker collapses separate evidentiary questions. Receipt of funds establishes a payment destination; knowing participation and control of the intrusion require additional proof.
Reference: [2]
Asset recovery
43. Follow the asset trail
Start with the earliest evidenced receipt and create a dated ledger of every subsequent movement. Record the amount, currency, sender, recipient, account, transaction reference, and documentary source for each entry. Splits, conversions, fees, refunds, and pooled accounts can change the form or location of value, so reconcile inflows against outflows at each step. Then connect payments to current assets using purchase contracts, title records, invoices, and evidence of who possesses or benefits from the asset. Separate a traced payment from a legal claim over the whole asset; liens, co-owners, and the governing recovery rules may limit what can be restrained or recovered. A chronology also exposes gaps: if an apparent purchase predates the suspected receipt, that receipt could not have funded it without another link.
Worked example: A fraud payment of $120,000 reaches an account. Records show $80,000 sent as a property deposit, $25,000 paid for a vehicle, and $15,000 left: $80,000 + $25,000 + $15,000 = $120,000. Check the property and vehicle records against those payments, then seek lawful preservation where available. The arithmetic reconciles the receipt, but ownership and any competing claims still need proof.
Watch the distinction: Finding an asset worth roughly the fraud loss does not trace the money into it. Build the payment chain and check timing, ownership, and competing interests before assigning recoverable value.
Reference: [2]
44. Tracing commingled funds
When legitimate and suspected money enters one account, the ledger records a combined balance, not a physical separation of funds. Reconstruct balances immediately before and after each credit, debit, and transfer, including transactions outside the initial review period that affect the opening balance. Identify the legal tracing approach applicable in the relevant jurisdiction before allocating a later purchase between sources. Possible approaches can yield different outcomes, especially when intermediate withdrawals reduce the balance or new legitimate funds arrive later. Bank records may establish a path into an asset, but a simple percentage based on one snapshot may not establish the legally attributable share. Document both the factual ledger and the chosen legal assumption so another reviewer can reproduce the result and see where attribution remains uncertain.
Worked example: An account starts with $20,000 of documented legitimate funds, receives $30,000 in suspected proceeds, and then pays $40,000 for an asset. The prepayment balance is $50,000 and the remaining balance is $10,000. Although suspected funds were 60% of the prepayment balance, neither 60% nor 75% can automatically be assigned to the asset. Obtain the full ledger and apply the governing tracing rule.
Watch the distinction: Dividing suspected receipts by an asset’s purchase price creates a convenient ratio, not a tracing conclusion. The order of transactions and the jurisdiction’s treatment of mixed funds matter.
Reference: [2]
45. Preservation versus confiscation
Preservation protects the possibility of recovery while ownership and liability are still being examined. Depending on the jurisdiction and authority, it may restrict sale, transfer, withdrawal, or disposal of an asset without deciding who ultimately owns it. The investigator should identify the specific asset, the evidence connecting it to suspected conduct, the risk of dissipation, and the proper authority to seek restraint. Accurate identifiers matter: a vehicle registration, account number, or parcel record prevents action against the wrong property. Confiscation or forfeiture is a later legal determination under the applicable process, with opportunities to examine proof and third-party rights. Keep the operational sequence clear: locate and document, assess lawful preservation, then support the final proceeding. A temporary restraint is neither compensation already delivered to victims nor proof that every asset interest is tainted.
Worked example: Investigators find a vehicle bought after suspected fraud proceeds entered the owner’s account. They preserve payment, title, and possession records and ask the competent authority whether a restraint is available to prevent sale. Title remains with the owner during that temporary step. Final confiscation would require the separate legal process and consideration of any lender or other valid claimant.
Watch the distinction: A frozen asset has not automatically become the state’s or victims’ property. Restraint protects it while the governing process decides whether confiscation is justified and whose interests survive.
Reference: [2]
46. Third-party interests
An asset can have several interests at once: registered title, beneficial ownership, a lender’s security, a spouse’s contribution, or a purchaser’s claim. Build an interest map before estimating recoverable value. Compare title documents with funding records, loan agreements, repayment history, purchase dates, and evidence of possession or use. A nominal owner may hold an asset for a suspect, while a genuine third party may have paid value without knowledge of the suspected conduct. Those are factual and legal questions, not conclusions from a name on the register alone. Calculate each documented contribution as a useful lead, then examine whether that contribution actually establishes an ownership share under local law. The relevant authority or court determines which interests can be restrained, excluded, compensated, or defeated in the recovery proceeding.
Worked example: A jointly titled property has a hypothetical value of $400,000. One owner documents $160,000 toward its purchase, which is $160,000 ÷ $400,000 = 40% of that value. Investigators should verify the other funding, later mortgage payments, and any agreement between the owners. The 40% calculation describes a contribution; it does not settle legal ownership or the amount recoverable.
Watch the distinction: Treating jointly titled property as wholly available because one owner is suspected can erase genuine interests. Verify funding and control, then apply the jurisdiction’s rules for third-party claims.
Reference: [2]
47. Cross-border recovery
Cross-border recovery requires two maps: the movement of value and the authorities able to act where evidence or assets are located. Reconcile outgoing and incoming bank records using dates, currencies, exchange rates, references, and correspondent details. For property, obtain title, purchase, financing, and beneficial-use records in the location where it sits. An investigator in one country cannot assume a domestic order restrains a foreign bank account or parcel. The competent authorities may need local preservation measures and formal cooperation requests that meet the receiving jurisdiction’s evidentiary and procedural requirements. Coordinate early because assets can move while requests travel. Screen relevant parties and transfers for restrictions under applicable regimes; the sanctions specialist guide provides a related lens, while sanctions status remains a separate question from tracing ownership.
Worked example: Fraud proceeds leave Country A through a bank transfer to an account in Country B, then fund property in Country C. Investigators in A preserve the original transfer records, seek the B account ledger and recipient identity through appropriate channels, and obtain C’s title and purchase records. Authorities in B and C assess local preservation powers. The three-country chain needs matching transaction evidence before linking the property to the fraud.
Watch the distinction: A transfer into a foreign account does not prove the later property purchase used those funds. Match intervening debits, credits, currency conversions, and dates, then seek action from the jurisdiction controlling the asset.
Reference: [2]
48. Recovery value and victim claims
Gross sale price is only the starting point for estimating what a recovery process may distribute. Confirm the asset’s realized value, then identify valid secured claims, sale and administration costs, taxes or other charges recognized by the governing process, and any superior ownership interests. Subtracting these items gives a provisional net pool, not a guaranteed victim payment. Multiple victims may have different claims, and the applicable order of distribution can alter allocations. Keep the fraud loss figure separate from asset proceeds: a $500,000 loss does not turn a $200,000 net recovery into full compensation. Check whether sale costs were already deducted from the reported proceeds to avoid double subtraction. Record assumptions and supporting documents so decision-makers can distinguish an estimated value from funds actually available after legal determinations.
Worked example: An asset sells for a hypothetical $300,000. A valid secured claim is $80,000 and sale costs are $20,000, with no other assumed deductions. The provisional amount available is $300,000 − $80,000 − $20,000 = $200,000. Victims may share that pool only as the governing process permits; the figure is neither gross recovery nor a promised payment to any one claimant.
Watch the distinction: Quoting the asset’s sale price as victim recovery ignores prior claims and costs. Calculate the net amount once, then distinguish that pool from each victim’s proven claim and distribution rights.
Reference: [2]
Customer due diligence
49. Customer identity and verification
Collecting a customer’s name, address, and identifying details creates a claim about identity. Verification tests that claim against reliable, independent evidence appropriate to the customer and product. Compare the supplied details with a valid document, trusted registry, or other permitted independent source; inspect inconsistencies and whether the evidence belongs to the applicant. A screenshot can be altered and may show neither its origin nor current validity. Record what was verified, by which source, when, and what remains unresolved. A transaction history may show how an account behaves, but it cannot establish who originally opened it. If verification fails or information conflicts, pause the decision that depends on identity and escalate through the institution’s applicable due diligence process. The current CFCS study manual description identifies customer due diligence as an updated subject.
Worked example: A new customer provides a name and address and uploads a cropped screenshot labeled as proof of address. Staff can record the supplied details, but the image’s issuer, date, and connection to the applicant are unverified. They seek an acceptable independent source and compare it with the application. A small initial deposit would show account activity, not resolve the identity gap.
Watch the distinction: Possessing customer details is not the same as verifying them. An untraceable image or a successful payment may support an inquiry but cannot independently establish the applicant’s identity.
Reference: [3]
50. Beneficial ownership and control
Trace ownership through each legal entity rather than stopping at the immediate shareholder. For a straightforward chain, multiply the ownership percentages to estimate an indirect economic interest, while checking share classes and agreements that may change the calculation. Control is a separate inquiry. Someone can direct decisions through voting rights, board appointments, veto powers, financing conditions, or informal arrangements even with a small economic stake. Verify the chain with current registries, constitutional documents, shareholder records, and credible explanations of nominee arrangements. Record both the people who receive economic benefit and those able to direct activity. The anti money laundering study guide offers related practice in following ownership, but the actual due diligence decision depends on reliable evidence and the institution’s governing requirements.
Worked example: A person owns 60% of Company A; A owns 50% of Company B. Assuming ordinary shares with proportional economic rights, the person’s indirect economic interest in B is 0.60 × 0.50 = 0.30, or 30%. Review B’s voting agreements and appointment rights separately. A different person might control B’s board despite having a smaller economic interest.
Watch the distinction: Multiplying share percentages answers only a simplified economic ownership question. It can miss special voting shares, nominees, and appointment powers that place effective control elsewhere.
Reference: [3]
51. Purpose and expected activity
A useful expected-activity profile describes the customer’s business model in testable terms: products sold, usual counterparties, payment channels, geographies, approximate volumes, and seasonal changes. Capture the basis for each expectation, such as invoices, contracts, operating history, or a reasonable forecast. Monitoring then compares observed activity with that profile and asks which facts explain a material difference. A mismatch is an inquiry trigger, not a finding of crime. Examine whether the business expanded, changed suppliers, opened a new market, or began processing payments for others. Verify explanations against underlying trade or service records and update the baseline when a real change is supported. Where the explanation fails, review counterparties, ownership, and fund destinations, then document the unresolved risk and appropriate escalation.
Worked example: A domestic retailer expects $20,000 per month in card sales but starts receiving $200,000 per month in wires from unrelated foreign companies. The new monthly value is $200,000 ÷ $20,000 = 10 times the stated baseline, though the channels also differ. Staff request contracts, invoices, and delivery records, then test whether the retailer’s business genuinely changed before updating its profile.
Watch the distinction: A tenfold increase alone does not prove laundering. The stronger cue is a change in value, channel, and counterparties that the stated business model does not yet explain.
Reference: [3]
52. Risk-based due diligence
Assess risk by asking how a customer could be exposed to misuse, then how well existing controls address that exposure. Consider the customer’s activities and ownership, the product’s ability to move value, the jurisdictions involved, and whether relationships are remote or intermediated. Do not assign risk from a label such as charity alone. Look for specific routes by which money enters and leaves, who can authorize payments, and how beneficiaries are checked. A new activity can raise risk even when identity information is sound. Enhanced inquiry should target the changed route: obtain the partner’s identity, role, location, agreement, and evidence of intended use of funds. Reassess after those facts are tested, recording both mitigating and adverse evidence. Risk ratings should guide monitoring and resources, not substitute for a factual investigation.
Worked example: A local charity has identified trustees and receives remote donations. It then begins transferring funds to an unfamiliar overseas partner. The new exposure is the cross-border beneficiary and the charity’s ability to oversee how funds are used. Review the partner’s identity, project agreement, payment destination, and reporting records. The charity’s legal form does not itself make the transfer suspicious.
Watch the distinction: Treating every charity or foreign transfer as inherently suspect wastes attention and obscures the actual exposure. Identify the payment route, controller, partner, and evidence of intended use.
Reference: [3]
53. Enhanced review and source of wealth
Source of funds asks where the money for a particular transaction came from immediately and through the relevant chain. Source of wealth asks how the customer accumulated their overall assets. The first may be supported by a bank statement showing a transfer from an account in the customer’s name, but that statement does not explain how the account was funded. The second may require sale documents, business ownership records, investment history, or inheritance evidence, depending on the claimed origin. Test whether dates and amounts form a coherent chain, including any intermediate entities or unusual third-party payments. Scale the depth of review to the risk and the transaction, and document what each record proves. A plausible narrative is useful for directing requests; independent records strengthen or contradict it.
Worked example: A customer wires $500,000 from an account bearing their name into an investment and says they built their wealth by selling a business. The transfer record helps identify the immediate source of funds. A sale agreement, closing statement, receipt of proceeds, and earlier ownership records test the source-of-wealth claim. If the sale yielded only $200,000, the remaining $300,000 needs another explanation.
Watch the distinction: A payment from the customer’s own bank account does not establish how the customer became wealthy. It identifies a recent source, while the accumulated wealth claim needs its own evidence.
Reference: [3]
54. Ongoing due diligence
Due diligence continues after onboarding because the facts used to judge a customer can change. Review triggers include a new owner or controller, a different business purpose, unfamiliar counterparties, new geographies, and activity materially outside the recorded baseline. For ownership changes, rebuild the chain to the relevant individuals and verify the documents supporting the transfer of control. For activity changes, compare transaction types, amounts, and counterparties with the earlier profile, then obtain evidence for the new purpose. Keep a dated record of what was previously understood, what changed, and how the risk assessment was revised. A change may be legitimate, but an outdated profile makes monitoring less useful because alerts are judged against the wrong expectations. Coordinate account, fraud, and compliance records so each team evaluates the same current customer.
Worked example: A company changes ownership in January. In February, its account shifts from recurring payroll to high-volume transfers for unrelated parties. Review January’s ownership documents to identify current controllers and February’s payment instructions, contracts, and beneficiaries to understand the new activity. The two changes may be connected, but timing alone does not prove that; update both the control map and expected-activity profile.
Watch the distinction: Completing identity checks at onboarding does not make the customer profile permanent. New controllers and a new payment pattern can invalidate the assumptions used to monitor the account.
Reference: [3]
Financial-crime detection, prevention and compliance
55. Enterprise risk assessment
Inherent risk is the exposure created by an activity before considering its controls. Residual risk is what remains after assessing whether controls actually reduce that exposure. A remittance product may inherently permit rapid movement across borders and through unfamiliar beneficiaries. Its residual risk depends on the quality of customer information, beneficiary data, screening, monitoring coverage, escalation, and evidence that those controls operate. Do not infer strong control from a low alert count. Missing data, excluded channels, or poorly tuned rules can suppress alerts while exposure stays high. Use transaction volumes, geographic patterns, known incidents, testing results, and control failures to challenge the rating. Then direct resources toward material gaps: improve data capture, test detection, strengthen review, or limit an activity where appropriate. Reassess when the product, customer mix, or threat pattern changes.
Worked example: A remittance product sends many cross-border payments, but beneficiary fields are often incomplete. It generates few alerts. The inherent exposure is high because funds can move quickly to diverse recipients; weak beneficiary checks leave substantial residual risk. Sample payments, measure data completeness, and test known suspicious patterns before interpreting the alert count. Low volume of alerts alone gives no assurance.
Watch the distinction: Equating few alerts with low risk assumes the monitoring system sees and evaluates every relevant transaction. Test channel coverage and data quality before using alert statistics in a risk rating.
Reference: [4]
56. Control design and testing
Control design asks whether a procedure could prevent or detect the identified risk if followed. Operating effectiveness asks whether it actually worked for transactions in scope. Define the rule precisely: which payments qualify, what counts as independent approval, when approval must occur, and what evidence the system retains. Select transactions from the relevant population and compare their records with that rule. Count exceptions without assuming the sample rate equals the population rate. When failures appear, distinguish a bypassed sound design from a workflow that never required the second approver, allowed self-approval, or lost approval data. Trace exceptions to cause and potential impact, then test the corrected process on later transactions. Written policy, system configuration, and transaction evidence answer different questions and should be examined together.
Worked example: A hypothetical policy requires two approvals for each payment above $25,000. Five sampled payments of $30,000 each show only one approval each, so all five are operating exceptions in that sample. Inspect system settings and audit logs to determine whether a second approval was bypassed, unavailable, or never configured. The sample establishes five failures; it does not establish a population-wide failure rate.
Watch the distinction: A policy statement proves intended control design, not operation. Conversely, five sample exceptions do not by themselves show every payment failed; investigate the underlying workflow and full population.
Reference: [4]
57. Monitoring alert quality
Assess monitoring rules on several dimensions. Referral yield measures the share of alerts that lead to useful investigation, while missed-case testing asks whether known suspicious behavior would have been seen. Data completeness and channel coverage determine whether the rule even receives the transactions and fields it needs. A high alert count can consume investigators without improving detection; a low count can hide blind spots. Review true positives, false alerts, known misses, and sampled unalerted activity. Segment results by product, channel, customer type, and time period so one strong segment does not mask a weak one. When tuning, document the proposed change, test it on historical and recent cases, and check whether detection improves without an unmanageable review burden. Yield is a diagnostic measure, not a complete measure of rule quality.
Worked example: A rule generates 1,000 alerts and 20 useful referrals, giving 20 ÷ 1,000 = 0.02, or a 2% referral yield. A known suspicious pattern used an excluded payment channel, so the rule could never flag it. Add that channel to coverage testing and examine data fields before changing thresholds. The 2% figure describes reviewed alerts, not the rule’s missed-case rate.
Watch the distinction: Tuning solely to raise referral yield can remove noisy alerts while also losing real cases. Check missed patterns and transaction coverage before deciding a rule has improved.
Reference: [4]
58. Investigation and escalation
An alert is a prompt to test a hypothesis, not a conclusion. Build a chronology of the transactions and identify the customer, counterparties, stated purpose, and movement of funds. Compare the activity with the customer profile and gather primary support such as invoices, delivery records, contracts, and payment instructions. Check whether documents align on dates, amounts, parties, and services; a document’s existence does not prove the underlying activity occurred. Record plausible explanations, contradictory evidence, and unresolved questions. Separate supported portions of a flow from those still unexplained, while considering whether the whole pattern remains unusual. Escalate through the appropriate internal route when the evidence warrants further review, preserving records and limiting access to those with a case need. The resulting decision should be reproducible from the evidence, including why alternatives were accepted or rejected.
Worked example: An alert identifies $45,000 moving rapidly through a customer account. Invoices and delivery records coherently support $30,000, leaving $45,000 − $30,000 = $15,000 without a clear purpose. Investigators check the remaining payer, recipient, and instructions, then escalate the unresolved activity with the supporting and contrary evidence. The $30,000 support does not automatically explain the full $45,000 flow.
Watch the distinction: Closing an alert because some invoices exist overlooks unsupported funds and document quality. Reconcile the entire amount and test whether the documents describe transactions that actually occurred.
Reference: [4]
59. Reporting and confidentiality
Internal escalation brings evidence to the institution’s authorized decision-makers; external reporting is a separate duty assessed under the law that applies to the institution and activity. In a U.S. institution, investigators should document the basis for suspicion and route it to the designated team for any Bank Secrecy Act suspicious activity report assessment. The responsible team evaluates the legal criteria, records its decision, and handles submission when required. Keep case information on a need-to-know basis. U.S. suspicious activity report confidentiality rules make unauthorized disclosure of a report or its existence especially sensitive; warning a customer could also undermine an investigation or prompt funds to move. Ordinary customer communication about a transaction requires care so it does not reveal protected case information. Preserve the evidence and decision record whether or not an external report follows.
Worked example: A U.S. investigator documents a pattern of unexplained transfers and escalates the case to the institution’s reporting team. A relationship manager proposes telling the customer that a suspicious activity report is being considered. The manager should not make that disclosure. The reporting team assesses the applicable duty, while authorized staff continue factual review and handle any permissible customer contact without exposing protected information.
Watch the distinction: An internal suspicion does not automatically mean an external report has been filed. It requires an authorized assessment under applicable law, and case details must be protected during that process.
Reference: [4]
60. Cross-disciplinary case coordination
A redirected supplier payment may involve several linked questions. Fraud staff verify the genuine supplier’s invoice and whether anyone approved a changed beneficiary. Cyber responders preserve the spoofed message, headers, login records, and any mailbox changes to identify the intrusion or impersonation route. Due diligence staff examine the new beneficiary’s identity, ownership, account history, and onward recipients. Payments and recovery teams reconcile the full flow and promptly seek lawful preservation of funds still reachable. Use one shared chronology with transaction references, timestamps, evidence sources, and unresolved questions, while assigning each team a distinct task. The account receiving money may belong to a mule rather than the person who sent the spoofed message; avoid premature attribution. Coordinate any external reporting and legal requests under the relevant jurisdictions after the facts are assembled.
Worked example: A spoofed supplier email diverts $100,000 to a new beneficiary. That account sends $70,000 onward and retains $30,000, so $70,000 + $30,000 = $100,000. Fraud staff confirm the supplier’s real instructions; cyber staff preserve message and access evidence; due diligence staff identify the beneficiary; recovery staff seek lawful preservation of the $30,000 and trace the $70,000.
Watch the distinction: Freezing the remaining balance alone does not resolve the case. The onward $70,000, false payment instruction, account controller, and possible reporting duty each require evidence and coordinated action.
Reference: [4]
Official references and further reading
- CFCS Exam Preparation - Certification Financial Crime Specialist Exam Prep Courses
- CFCS Certification | Handbook and Application
- CFCS Certification | Study Manual Sample
- FAQ