OBB common mistakes
OBB · Understand the traps and how to avoid them.
Treating the supervisory regime as a single regulator's rulebook and answering questions from memory of one authority's guidance, without first identifying which body's rules the scenario invokes.
Candidates study one familiar rule set in depth and then pattern-match every question to it, ignoring that the scenario names a different authority, regime, or instrument with its own definitions and thresholds.
What to do instead
Before answering, extract the named regulator, jurisdiction, and instrument from the stem, then recall that body's specific definitions and escalation paths. Build a one-page comparison table of the regimes tested and drill it until the distinctions are automatic.
Confusing licence categories, permitted activities, and the conditions attached to authorisation, so that a scenario describing a firm exceeding its permissions is answered as a capital or disclosure problem.
Permission limits and prudential requirements are studied together and blur into one 'compliance' concept, so candidates mislabel the nature of the breach.
What to do instead
Practise classifying each scenario by the type of requirement breached before choosing an answer. Keep a checklist separating permitted activities, authorisation conditions, and prudential standards, and test yourself on which consequence follows each.
Assigning responsibility for a control failure to the compliance function by default rather than to the governing body or senior management where the scenario places the decision.
Day-to-day compliance work feels like the natural home for control questions, and candidates conflate execution of controls with ownership and accountability for them.
What to do instead
Map each governance topic to its accountable party: board, board committee, senior manager, control function, or business line. For every practice scenario, state aloud who owns the outcome and why before selecting an option.
Treating the three lines model as a rigid departmental chart, concluding that an independent review must be performed by internal audit even where the scenario describes a risk function assurance activity.
The model is learned as an org chart rather than as a set of assurance roles, so candidates force every oversight question into the audit line.
What to do instead
Learn the model by function and independence characteristics, not by department names. For each assurance scenario, ask who is independent of the activity, who reports to whom, and which line's remit covers it.
Selecting the strongest-sounding control, such as a full prohibition, when the question asks for the control proportionate to the identified risk under a risk-based approach.
Exam pressure rewards decisive, absolute answers, and candidates equate severity with correctness rather than matching the response to the assessed likelihood and impact.
What to do instead
Practise ranking controls by proportionality and articulating the risk assessment that justifies each. When two options seem plausible, choose the one whose intensity matches the stated risk rating and note why the stronger option is disproportionate.
Confusing inherent risk, residual risk, and control effectiveness, so that a question asking what remains after controls is answered with the gross exposure.
The terms appear in similar sentences and candidates read the scenario's risk description without tracking whether controls have already been applied.
What to do instead
Annotate every scenario with three labels: exposure before controls, controls in place, exposure after controls. Answer only from the labelled figure the question asks about, and drill questions that deliberately vary which of the three is requested.
Applying customer due diligence as a one-off onboarding step and missing ongoing monitoring, trigger events, or enhanced measures for higher-risk relationships.
Onboarding is the most memorable part of the lifecycle, and candidates overlook that the obligation is continuous and risk-sensitive.
What to do instead
Study the customer lifecycle as a timeline and attach the required action to each stage: identification, verification, risk rating, ongoing monitoring, trigger review, and exit. Practise spotting the stage named in the stem before choosing an answer.
Answering vulnerability, complaints, or fair-treatment questions with the firm's commercial interest rather than the required customer outcome, particularly where the profitable option is also plausible.
Candidates reason as employees solving a business problem instead of applying the conduct standard, and the commercially sensible option reads as realistic.
What to do instead
Adopt an explicit decision rule: identify the required customer outcome first, then test each option against it. Review scenarios where good conduct costs the firm money and confirm you would still choose the compliant path.
Treating a product's label or marketing description as determining its regulatory treatment, instead of analysing its actual features, risks, and payoff structure.
Product names and categories are familiar and reassuring, so candidates classify by name and miss that the substance of the terms drives the classification and the rules that follow.
What to do instead
For every product scenario, list the underlying exposure, payoff profile, and who bears the risk before classifying it. Practise with products deliberately mislabelled in the stem to train substance-over-label reasoning.
Analysing suitability and appropriateness as the same test, or applying either without first establishing the client's objectives, knowledge, and capacity to bear loss.
The two assessments are described in similar language and candidates skip the fact-finding step that determines which assessment applies.
What to do instead
Learn the distinct triggers and evidence requirements for each assessment, then practise scenarios that turn on whether advice was given. Always identify the client facts recorded before deciding which test the firm owed.
Resolving conflicts of interest by disclosure alone, even where the scenario shows disclosure is insufficient to manage the conflict.
Disclosure is the most frequently cited remedy, so candidates treat it as a universal solution and stop analysing once it appears as an option.
What to do instead
Rank conflict responses in order: avoid, control with barriers or restrictions, then disclose as a last resort where the conflict cannot otherwise be managed. Practise identifying which level the scenario's facts actually permit.
Judging market conduct scenarios by whether a profit was made or a loss avoided, rather than by the integrity of the information and the fairness of the behaviour.
Outcome-based intuition is strong, and candidates assume a beneficial result implies acceptable conduct or, conversely, that a loss implies misconduct.
What to do instead
Evaluate conduct against the standard itself: accuracy of information, timing of disclosure, and treatment of counterparties. Practise scenarios where the conduct is improper despite a neutral or negative financial result.
Treating recordkeeping as an administrative afterthought and missing that retention periods, format requirements, and retrievability are substantive obligations with specific triggers.
Records feel like back-office housekeeping, so candidates skim retention rules and cannot distinguish which records must be kept, for how long, and in what form.
What to do instead
Build a retention matrix by record type with the trigger that starts the clock and the required format. Test yourself on scenarios where the retention period is measured from a specific event rather than from creation.
Assuming a disclosure made once at the point of sale satisfies ongoing obligations, ignoring periodic, event-driven, and ad hoc reporting triggers.
Point-of-sale disclosure is the most visible requirement, and candidates generalise it to all reporting duties without checking the trigger and audience for each.
What to do instead
Catalogue reporting obligations by trigger: scheduled periodic, event-driven, and on-request. For each scenario, identify the trigger, the recipient, and the deadline before selecting an answer, and drill questions where timing rather than content is decisive.