ANFI common mistakes
ANFI · Understand the traps and how to avoid them.
Treating customer due diligence as a one-time event completed at account opening, and not re-running it when a trigger occurs (change in beneficial ownership, unusual transaction pattern, adverse media).
Onboarding checklists create a mental model of KYC as a gate to pass once, so candidates default to 'we verified them at onboarding' rather than recognising ongoing monitoring obligations.
What to do instead
For every scenario question, ask 'what has changed and does that trigger a refresh?' Map the specific trigger (ownership change, PEP status, sanctions hit, risk-rating change) to the required action before choosing an answer.
Choosing 'file a suspicious transaction report and continue the relationship as normal' as the complete answer, omitting the prohibition on tipping off the customer.
Candidates focus on the reporting obligation they memorised and forget the separate confidentiality duty that attaches the moment a report is made or contemplated.
What to do instead
When a scenario involves an STR/SAR, run a two-part check: (1) report to the FIU, (2) do not disclose to the customer or third parties. Eliminate any option that includes informing the client why the account is restricted.
Confusing the risk-based approach with a rule that all high-risk customers must be refused, and rejecting customers who should instead receive enhanced due diligence.
Candidates conflate 'high risk' with 'prohibited', because both sound like red flags in study material.
What to do instead
Sort customers into three buckets before answering: prohibited (sanctioned, unable to verify identity), high risk requiring EDD (PEPs, correspondent relationships, high-risk jurisdictions), and standard risk. Only the first bucket justifies refusal on risk grounds alone.
Identifying the beneficial owner by looking only at the direct account holder and not tracing through layered corporate structures to the natural persons who ultimately own or control the entity.
The question presents an entity name and candidates stop at the first corporate layer, missing the ownership-percentage and control tests.
What to do instead
Always draw the ownership chain in the margin of your scratch work, applying the ownership threshold and the separate control test, and state the natural person(s) before selecting an answer.
Reporting a sanctions match as an AML suspicion without first applying the screening escalation and freeze/report-to-authority process specific to sanctions.
Sanctions and AML are taught together, so candidates collapse them into one workflow and pick the AML answer for a sanctions scenario.
What to do instead
Ask which regime the question invokes. Sanctions hits go to the sanctions/asset-freeze process and the relevant authority; money-laundering suspicion goes to the FIU. Do not substitute one for the other.
Selecting an answer that resolves a conflict of interest by simply disclosing it, when the conflict is so material that disclosure alone is insufficient and the firm must decline or withdraw.
Disclosure is the most familiar control, so it becomes a default answer even where the facts show the conflict cannot be managed.
What to do instead
Test the proposed control: can the conflict be managed so the client is not disadvantaged? If the option is 'disclose and proceed' but the facts show the firm's own interest dominates, look for decline/withdraw or independent advice instead.
Treating recordkeeping retention as starting from the end of the calendar year or from the transaction date for all records, rather than applying the correct trigger for each record type.
Multiple retention clocks (account closure, transaction completion, end of relationship, report filing) blur together in memory.
What to do instead
Build a small table of record type to retention trigger and period, and for each question identify which record type is at issue before answering.
Assuming a product is low risk because it is simple or familiar, without assessing the risk from the customer, channel, geography, and transaction profile.
Candidates anchor on the product label ('savings account', 'insurance policy') and ignore that the same product can be high risk depending on delivery channel and customer.
What to do instead
Score the four risk dimensions separately for each scenario (customer, product/service, channel, geography) and let the highest dimension drive the answer rather than the product name.
Answering an ethics question with the commercially convenient option, or with 'report to my manager' when the manager is the person implicated in the scenario.
Candidates read for what a reasonable employee would do operationally and miss the escalation-design detail that the scenario deliberately plants.
What to do instead
Before choosing an escalation path, check who is compromised. If the line manager, colleague, or the firm itself is implicated, escalate to compliance, internal audit, or the regulator as the facts require.
Mixing up the roles of the regulator, the FIU, and the firm's own compliance function when asked who receives a report, who authorises an action, or who supervises a conduct breach.
All three appear in reporting scenarios, and candidates pick the body whose name appears most often in study material rather than matching the function.
What to do instead
Memorise a one-line function for each body (supervision and rulemaking, intelligence receipt and analysis, internal control and escalation) and match the verb in the question to the function before selecting.