CFCS (Other exams) common mistakes
CFCS · Understand the traps and how to avoid them.
Treating 'suspicious' as a synonym for 'proven illegal' and answering that a report should be filed only once illegality is established, rather than when reasonable grounds to suspect exist.
Candidates carry over a criminal-law mindset ('beyond reasonable doubt') and confuse the low reporting threshold with an evidentiary standard, so they hesitate to say a SAR/STR is due.
What to do instead
Memorise the reporting trigger as 'knows, suspects, or has reasonable grounds to suspect' and drill scenario questions by asking only 'would a reasonable compliance professional suspect?' - not 'can I prove a crime?'.
Confusing placement, layering, and integration when asked to classify a described transaction, e.g. labelling the initial deposit of illicit cash into a bank as layering.
Candidates memorise the three stage names but never anchor them to concrete cash-flow examples, and real schemes blur stages so they guess by keyword.
What to do instead
Build a personal one-line example for each stage (placement = entry of illicit value into the system; layering = obscuring origin through movement/conversion; integration = reintroduction as apparently legitimate) and classify by asking 'where is the money relative to the legitimate economy?'
Missing red flags embedded in a narrative (structuring just under thresholds, rapid pass-through of funds, mismatched activity versus stated business, reluctance to provide KYC) and concluding 'no action needed' because no single fact is conclusive.
Candidates look for one 'smoking gun' rather than weighing the accumulation of indicators, and they under-weight behavioural cues in favour of documentary cues.
What to do instead
Practise 'cluster analysis': list every indicator in the stem, count them, and answer based on the pattern. Train on threshold-avoidance arithmetic and expected-versus-actual activity comparisons until they surface automatically.
Applying the wrong risk-based response - e.g. recommending exit/de-risking for a low-risk customer, or recommending 'enhanced due diligence' for every scenario regardless of the actual risk tier.
Candidates default to the most severe or the most familiar control instead of calibrating to the facts, often because they have not internalised that risk-based means proportionate, not maximal.
What to do instead
For each scenario, first assign a risk tier explicitly, then select the control that matches that tier (standard CDD, simplified, EDD, or exit). Write one sentence justifying proportionality before choosing the answer.
Confusing sanctions screening concepts: treating a 'potential match' as a confirmed hit requiring immediate blocking, or assuming a name match alone justifies freezing without further verification.
Candidates conflate screening alerts with legal determinations and do not distinguish between the compliance obligation to investigate an alert and the legal obligation to freeze once a true match is confirmed.
What to do instead
Learn the alert-handling sequence (alert → false-positive analysis using identifiers → escalation → confirm/clear → freeze/report if confirmed) and practise distinguishing 'possible match', 'confirmed match', and 'no match' in scenario stems.
Ignoring ownership and control when assessing whether a sanctioned or PEP-linked party is involved - stopping at the direct customer and not looking through corporate layers or at beneficial owners.
Candidates assess the named counterparty only, forgetting that sanctions and PEP rules attach to beneficial ownership and control (including indirect ownership thresholds and control by other means).
What to do instead
Always run the 'who ultimately owns or controls this?' check on any entity in a stem, and practise ownership-chain questions until tracing through layers becomes reflexive.
Answering interview questions with leading, closed, or accusatory phrasing, or choosing to confront the subject with all evidence at the outset.
Candidates optimise for 'getting a confession' rather than eliciting reliable information, and they confuse assertive questioning with effective questioning.
What to do instead
Apply the open/closed funnel: start with open, non-leading questions, use cognitive techniques to establish the baseline, and reserve disclosure of evidence for planned points. Reject any option that is leading or hostile on its face.
Confusing the standards and purposes of asset freezing, restraint, confiscation, and civil recovery, and answering that an asset can be seized merely because it is suspected to be criminal proceeds.
The terminology overlaps across jurisdictions and the candidate has not separated interim measures (freeze/restrain) from final measures (confiscation/forfeiture) or criminal from civil tracks.
What to do instead
Build a comparison table: measure, legal basis, standard of proof, who authorises it, and purpose. Answer by identifying which measure the stem's authority and stage permit.
Assuming digital evidence is admissible or reliable without addressing chain of custody, integrity/hashing, or lawful acquisition, and treating a screenshot or metadata as self-authenticating.
Candidates focus on what the data shows and skip how it was obtained and preserved, which is where most digital-evidence questions are actually testing.
What to do instead
For any digital-evidence item, run the four checks: lawful acquisition, preservation/integrity (hash, write-blocking), documented chain of custody, and authentication. If any is absent in the stem, that is the answer.
Failing to distinguish terrorist financing from money laundering in scenario answers - e.g. requiring that funds be 'dirty' or that a profit motive exist, or dismissing small-value transfers as irrelevant.
Candidates apply the AML template (proceeds of crime, placement) to TF, which can involve clean money, small amounts, and charitable or informal channels.
What to do instead
Memorise the key contrast: TF needs no predicate offence or profit and can use legitimate funds; small amounts and NPO/remittance channels matter. Answer TF questions by asking 'does this fund or support terrorist activity?', not 'where did the money come from?'
Choosing the answer that maximises the business outcome or client relationship when an ethical or reporting duty conflicts, or failing to escalate a conflict of interest involving a senior colleague.
Candidates reason as an employee rather than as a compliance professional and underestimate the duty to escalate internally and, where required, to the regulator.
What to do instead
Apply a fixed hierarchy: law and regulation > professional/ethical duty > employer instruction > commercial interest. When a stem involves pressure from a superior, the correct answer almost always includes escalation and documentation.
Misapplying the FATF Recommendations' binding versus non-binding status, or assuming a national law applies extraterritorially without checking the stem's stated jurisdiction.
Candidates blur soft law (FATF standards, guidance) with hard law (national statutes, regulations) and ignore the jurisdictional facts given.
What to do instead
Before answering, identify the source of the obligation named in the stem (FATF recommendation vs. national statute vs. regulator guidance) and its stated scope. Answer only within the jurisdiction and instrument the stem specifies.