BR-ANAC-PLH common mistakes
BR-ANAC-PLH · Understand the traps and how to avoid them.
Treating the exam's regulatory framework as a single statute and answering questions from general anti-money-laundering memory, rather than distinguishing which authority (statute, regulator rule, or guidance) governs the scenario presented.
Candidates often prepare from broad AML training decks that blend sources; when a question hinges on whether a requirement is binding law, supervisory expectation, or non-binding guidance, they default to the strictest-sounding option instead of the source actually described.
What to do instead
Before answering framework questions, identify the actor (legislator, regulator, supervisor, standard-setter) and the instrument type named in the stem. Build a one-page source map listing each instrument, its issuer, and whether it is binding, and practise classifying 20 short scenarios by source before judging compliance.
Applying a risk-based approach as a slogan: assigning every customer or product the same risk rating, or rating everything high 'to be safe', instead of calibrating controls to identified, documented risk factors.
Risk-based questions reward proportionality, but candidates fear under-controlling and so pick maximum-diligence answers; they also confuse 'risk-based' with 'rule-based' and expect a single prescribed threshold.
What to do instead
Learn the mechanics: identify inherent risk factors (customer, geography, product, channel), apply mitigating controls, then derive residual risk and match due-diligence intensity to it. Practise writing a three-line rationale for why a low-risk case gets simplified measures and a high-risk case gets enhanced measures.
Confusing policies with procedures and controls: answering that a policy document alone satisfies a requirement, or citing a control as if it were a governance-approved policy.
In practice these artefacts blur together, and candidates memorise document names without mapping each to its function (policy sets principle and appetite, procedure sets steps, control executes and evidences).
What to do instead
Memorise a three-tier model and test yourself by sorting requirements into tiers: which need board-approved principle, which need an operational step-by-step, which need a testable control with an owner, frequency, and evidence trail. For each practice question, state which tier the stem is really asking about.
Designing training answers around completion rates and annual delivery only, ignoring role-specific content, escalation paths, and evidence that learning changed behaviour.
Compliance training is often measured by attendance in real organisations, so candidates reproduce that metric; exam stems that describe a failed control frequently trace back to generic training that never covered the specific risk.
What to do instead
When a stem describes a training weakness, answer with tailoring to role and risk, reinforcement cadence, testing of comprehension, and tracking of downstream indicators (for example, quality of escalations). Distinguish awareness from competence and pick the option that measures application, not attendance.
Treating monitoring, auditing, and testing as interchangeable, and choosing 'conduct an audit' when the scenario calls for continuous transaction monitoring or a first-line control test.
The three disciplines overlap in vocabulary and all sound rigorous; candidates pick the most impressive-sounding activity rather than the one that fits the described purpose, independence level, and timing.
What to do instead
Anchor each: monitoring is ongoing, system- or rule-driven surveillance of activity; testing is independent check of control design and operation on a sample; audit is periodic, risk-based, independent assurance with formal reporting. For each stem, note who performs it and whether the need is detection, verification, or assurance, then select accordingly.
Jumping from a red flag straight to filing a report or exiting the relationship, skipping the internal escalation, documentation, and decision-making steps the scenario is testing.
Candidates know reporting is the headline obligation and want to show decisiveness; they overlook that the question often asks what the analyst should do first or next within the institution.
What to do instead
Adopt a fixed sequence for reporting questions: detect, document, escalate internally to the designated function, allow the compliance decision-maker to assess, then file or exit as decided, with records retained. Read the stem for sequencing words ('first', 'next', 'immediately') and answer only that step.
Mixing up the triggers, thresholds, and consequences of enforcement and sanctions scenarios, such as conflating a supervisory remediation order with a criminal penalty or assuming a sanction always ends the matter.
Enforcement vocabulary is dense and jurisdictions differ; candidates rely on vague impressions of 'fines and penalties' and miss distinctions between administrative, civil, and criminal tracks and between the institution's and individuals' liability.
What to do instead
Build a comparison table of enforcement types by issuer, trigger, typical remedy, and who bears liability. For sanctions questions, separate the designation, the prohibition, the reporting duty, and the remediation obligation, and check which one the stem actually asks about.
Answering ethics and professional-conduct questions with the commercially convenient option, or deferring to a supervisor's instruction even when the scenario signals a conflict of interest or pressure to suppress a concern.
Workplace norms and hierarchy bias candidates toward 'escalate to my manager and follow instructions'; exam scenarios deliberately place the manager inside the conflict to test independence and personal accountability.
What to do instead
Apply a fixed test: identify the conflict, ask whether the action withstands public disclosure, then choose the path that preserves independence, including escalation above the conflicted party or to a designated ethics or whistleblowing channel. Practise spotting stems where the supervisor is the source of pressure.
Treating record retention and confidentiality as one rule: applying a single retention period to all records, or disclosing information to a parent company, auditor, or foreign authority without checking the permitted-disclosure basis.
Candidates generalise from one familiar retention figure and assume group-wide sharing is always allowed; they miss that retention periods vary by record type and jurisdiction, and that information sharing has legal gateways and prohibitions.
What to do instead
Learn retention as a matrix (record category, minimum period, trigger for the clock, legal hold) and disclosure as a gateway analysis (who is asking, under what authority, what is permitted, what must be logged). For each scenario, name the record type and the requester before choosing.
Ignoring the stem's qualifiers, such as 'the institution's own policy requires' versus 'the law requires', or 'best practice' versus 'minimum standard', and selecting the answer that is generally desirable but not what was asked.
Under time pressure candidates pattern-match keywords to familiar answers; distractors are written to be true statements that do not answer the specific question, and the qualifier is the only thing separating them.
What to do instead
Before reading the options, underline the qualifier and restate the question in your own words. Eliminate any option that is accurate but answers a different question, and reserve a final review pass solely for re-checking qualifiers on flagged items.