CFCS (Other exams) cheat sheet

Three stages of money laundering: placement (introducing illicit cash into the financial system), layering (obscuring the audit trail through transactions), and integration (reintroducing funds as apparently legitimate assets).

Placement is most common in cash-intensive businesses; layering dominates in correspondent banking and trade; integration is hardest to detect because funds appear lawful.

Customer Due Diligence requires identifying the customer, verifying identity using reliable independent sources, identifying the beneficial owner, and understanding the purpose and intended nature of the relationship.

Enhanced Due Diligence applies to higher-risk relationships: politically exposed persons, correspondent relationships, and customers in higher-risk jurisdictions; it requires source of funds and source of wealth analysis.

A suspicious transaction report is filed when there is knowledge, suspicion, or reasonable grounds to suspect that funds are proceeds of crime; the tipping-off prohibition bars disclosing the report to the subject.

Record retention: most regimes require keeping CDD records and transaction records for at least five years after the relationship ends or the transaction is completed.

Red flags include structuring below reporting thresholds, unusual transaction patterns inconsistent with the customer profile, rapid movement of funds through multiple accounts, and reluctance to provide identification.

Risk-based approach: allocate compliance resources proportionate to assessed risk across customer, product, channel, geography, and delivery dimensions.

Fraud triangle: pressure (incentive), opportunity, and rationalization; opportunity is the element most directly reduced by internal controls.

Card-not-present fraud indicators: mismatched billing and shipping addresses, multiple orders from one IP, unusually large first orders, and repeated declined-then-approved attempts.

Account takeover indicators: sudden password or contact-detail changes, new device or geolocation, impossible-travel logins, and immediate high-value transfers after credential changes.

Data analytics rules for detection: velocity checks (transactions per unit time), threshold clustering just below approval limits, duplicate invoice numbers, and Benford's Law deviation analysis.

Segregation of duties prevents single-actor fraud: the person who authorizes a payment should not be the person who reconciles the account or maintains the vendor master file.

First-party fraud involves the account holder misrepresenting identity or intent; third-party fraud involves stolen or synthetic identities used by another actor.

Recovery levers after detected fraud: immediate account freeze, recall or indemnity claims through the payment network, and preservation of logs for investigation.

Synthetic identity fraud combines real and fabricated data elements; it often surfaces only when the fabricated identity defaults after building credit.

Risk assessment formula in practice: inherent risk (likelihood x impact) adjusted by control effectiveness yields residual risk; controls should target the highest residual exposures first.

Three lines of defense: business units own risk, compliance and risk functions provide oversight and framework, internal audit provides independent assurance.

Compliance program pillars: written policies, designated compliance officer, ongoing training, independent testing, and customer due diligence.

Key risk indicators include alert volumes, alert-to-case conversion rates, average case aging, number of overdue reviews, and training completion rates.

Control testing distinguishes design effectiveness (is the control capable of mitigating the risk) from operating effectiveness (did it actually operate as designed).

Governance requires escalation paths with defined thresholds, board or senior management reporting cadence, and documented risk acceptance for residual exposures.

Risk appetite statements translate into quantitative tolerances, such as maximum unresolved high-risk customer count or maximum alert backlog age.

Training must be role-tailored: front-line staff on identification and escalation, compliance staff on investigation technique, and management on governance obligations.

Screening matches fall into categories: exact match, name variation (fuzzy), false positive, and true match; fuzzy matching generates false positives and requires adjudication.

Strict liability regimes penalize prohibited dealings regardless of intent or knowledge, so screening must occur before onboarding and before each transaction.

Common ownership rule: an entity is subject to sanctions if a sanctioned person owns, directly or indirectly, 50 percent or more of it, even if the entity itself is not listed.

Screening lists must be refreshed when designations change; re-screening frequency should be tied to risk and list-update cadence.

Embargoes restrict trade with a country or territory and typically require end-use and end-user checks in addition to party screening.

Sectoral sanctions restrict specific transaction types (for example, new debt or equity) with named parties rather than a full asset freeze.

Screening should cover customers, beneficial owners, directors, counterparties, vessels, and payment message fields including remitter and beneficiary free text.

Escalation of a potential true match requires freezing or blocking of assets where mandated, reporting to the competent authority, and no tip-off to the designated party.

Investigation planning sequence: define the allegation, gather documentary evidence before interviews, identify subjects and witnesses, then interview in order from peripheral to central figures.

Evidence types: documentary, testimonial, physical, electronic; electronic evidence requires documented chain of custody from seizure to presentation.

Interview structure: establish rapport, obtain the subject's account in free narrative, then probe with open questions, then close with clarification and confirmation.

Cognitive interviewing improves recall by reinstating context, recalling in reverse order, and changing perspectives; it reduces leading-question contamination.

Indicators of deception are unreliable in isolation; clusters of verbal and non-verbal cues combined with inconsistencies against documentary evidence carry weight.

Records of interview should be contemporaneous, signed by the interviewee where possible, and include time, date, location, attendees, and any cautions administered.

Legal privilege and data protection obligations constrain what may be obtained and used; legal counsel should review scope before compelled disclosure.

Case file discipline: chronological log, indexed exhibits, investigator notes, and a summary memo that links each finding to its supporting evidence.

Confiscation is value-based (a monetary amount the offender must pay); forfeiture is property-based (specific assets are transferred to the state).

Criminal forfeiture follows conviction and requires proving the property is proceeds or instrumentalities of crime; civil forfeiture proceeds in rem against the property and generally uses a lower standard of proof.

Restraint or freezing orders preserve assets during proceedings and prevent dissipation; they are usually time-limited and require periodic court review.

Tracing follows proceeds through accounts and assets; commingling rules determine how much of a mixed balance is tainted, often using first-in-first-out or proportionate methods depending on jurisdiction.

Unexplained wealth orders require a person to explain the origin of assets disproportionate to known income; failure to explain can support a presumption that assets are proceeds of crime.

International cooperation instruments: mutual legal assistance for evidence and restraint, and asset-sharing agreements that split recovered proceeds between jurisdictions.

Non-conviction-based recovery is used where the offender is dead, fled, or immune, and targets the property itself rather than the person.

Value-based recovery can reach substitute assets when original proceeds are dissipated, provided the jurisdiction permits substitution.

Digital evidence principles: preserve the original, work from a forensic copy, verify integrity with a cryptographic hash (for example, SHA-256), and document every transfer.

Order of volatility: capture memory and network state before disk, and disk before removable media or remote logs, because volatile data is lost on shutdown.

Chain of custody must record who handled the exhibit, when, where, and what was done; a break in the chain weakens admissibility.

Common attack patterns: phishing and business email compromise (invoice redirection), credential stuffing, ransomware with double extortion, and account takeover via session token theft.

Indicators of compromise include anomalous login geolocation, impossible travel, unusual data egress volume, new privileged accounts, and disabled logging.

Business email compromise response: preserve mail headers and logs, contact the receiving bank for recall, and check mailbox rules for attacker-created forwarding or deletion rules.

Attribution requires correlating infrastructure (IPs, domains, certificates), malware artifacts, and timing; single indicators are weak and should be corroborated.

Data protection law governs collection and transfer of personal data obtained from devices; scope should be limited to what is relevant to the investigation.

Terrorist financing differs from money laundering in direction: funds may originate legitimately and flow toward the actor, so the emphasis is on destination and purpose rather than source.

Amounts are often small; detection relies on link analysis to designated persons and organizations rather than on transaction size thresholds.

Funding channels include self-funding from salary or savings, charitable diversion, cash couriers, hawala and other informal value transfer systems, and crowdfunding.

Charitable sector risk controls: verify the recipient and end use, screen trustees and beneficiaries, and monitor for diversion to prohibited areas or persons.

Hawala and informal value transfer systems leave limited audit trails; indicators include frequent small transfers to high-risk regions with no apparent economic purpose.

Foreign terrorist fighter indicators include travel bookings to conflict zones, sudden changes in behavior or appearance, and purchases of tactical equipment.

Screening for terrorist financing uses designated terrorist lists in addition to sanctions lists; freezing obligations may apply without a criminal conviction.

Crowdfunding and virtual asset channels raise risk where funds can be pooled and moved quickly; donor and wallet screening plus blockchain analytics support detection.

Core principles: integrity, objectivity, confidentiality, professional competence and due care, and professional behavior.

Conflicts of interest must be identified, disclosed, and managed; where management is not possible, the engagement or relationship should be declined or terminated.

Confidentiality obligation persists after the relationship ends; permitted disclosures include those required by law, such as a suspicious transaction report to the financial intelligence unit.

Whistleblowing protections generally require that the concern be raised through defined internal or regulatory channels and be made in good faith.

Independence in fact and appearance applies to assurance work; financial or personal interests in a client compromise objectivity.

Accepting gifts or hospitality creates a self-interest threat; thresholds and pre-approval requirements should be documented and applied consistently.

Documenting a professional judgment should record the facts known, the options considered, the rationale, and the date, so the decision can be defended later.

Tipping off a subject about a suspicious transaction report breaches both law and professional ethics, even where the motive is to help the client.

The Financial Action Task Force sets 40 Recommendations covering AML/CFT, proliferation financing, and transparency; jurisdictions are assessed through mutual evaluations and may be placed on the grey or black list.

Key international conventions: the Vienna Convention (drug trafficking), the Palermo Convention (transnational organized crime), and the Terrorist Financing Convention.

The Wolfsberg Principles are private-sector guidance for correspondent banking, private banking, and trade finance due diligence.

The Egmont Group links financial intelligence units and governs information sharing between them.

Mutual legal assistance treaties provide formal channels for obtaining evidence and enforcing restraint orders across borders.

Extraterritorial reach: some regimes assert jurisdiction over foreign conduct touching their currency or financial system, so compliance must consider more than local law.

Data protection and banking secrecy laws limit cross-border sharing; permitted gateways usually include FIU-to-FIU exchange and consent from the data subject.

Record-keeping and reporting duties are typically enforced through administrative penalties, criminal liability for individuals, and, in some regimes, deferred prosecution agreements.