BICA Qualification cheat sheet

Six core ethical principles: integrity, objectivity, competence, confidentiality, professionalism, diligence; a conflict between principle and employer instruction is resolved in favour of the principle.

Fiduciary duty comprises loyalty (avoid or disclose conflicts), care (suitability and prudence), and good faith; it exceeds the mere suitability standard owed to non-advised clients.

Conflicts of interest are managed by a hierarchy: avoid, then disclose and obtain consent, then mitigate with controls; disclosure alone does not cure an unmanageable conflict.

Personal account dealing rules typically require pre-clearance, minimum holding periods, and prohibition of trading ahead of client orders (front-running) or on material non-public information.

Material non-public information (MNPI) creates a dealing and tipping prohibition; information is material if a reasonable investor would consider it important, and non-public until broadly disseminated.

Regulatory reporting obligations usually include prompt notification of material breaches, client complaints registers, suspicious transaction reports, and changes in control or senior personnel.

Record-retention and marketing rules: communications must be fair, clear, and not misleading; past performance must carry prescribed warnings and cannot be presented selectively.

Independence is compromised by gifts, hospitality, or referral fees beyond de minimis thresholds; such benefits must be logged in a gifts and entertainment register.

KYC triad: identify the client, verify identity using independent reliable sources, and understand the purpose and intended nature of the relationship.

Customer due diligence tiers: simplified (low risk, but never for suspected ML/TF), standard, and enhanced (PEPs, high-risk jurisdictions, complex structures, correspondent relationships).

A politically exposed person is an individual entrusted with prominent public functions, plus family members and close associates; enhanced measures apply for at least 12 months after leaving office.

Beneficial ownership threshold is commonly 25% of shares or voting rights, or control by other means; if no natural person is identified, the senior managing official is recorded and the risk noted.

Onboarding file components: identity evidence, proof of address, source of funds and source of wealth, mandate and authority documents, tax residency self-certification, and risk rating rationale.

Source of funds explains the origin of the money for a specific transaction; source of wealth explains how total net worth was accumulated - both are required for higher-risk clients.

Ongoing monitoring is risk-based: periodic review cycles (e.g. annual for high risk, triennial for low risk), event-driven triggers such as adverse media, and transaction-pattern surveillance.

Sanctions screening differs from PEP screening: sanctions require freezing and reporting with no risk-based exemption, while PEP status triggers enhanced due diligence rather than automatic refusal.

Risk-return ordering (low to high, typically): cash and money market, government bonds, investment-grade corporate bonds, high-yield bonds, developed equities, emerging equities, commodities, private equity.

Bond price and yield move inversely; approximate price change equals modified duration times the yield change, with convexity correcting the estimate for larger moves.

Equity total return = capital appreciation + dividends; valuation approaches are discounted cash flow, relative multiples (P/E, EV/EBITDA), and asset-based methods.

Collective investment schemes: open-ended funds price at NAV and settle at forward price; closed-ended funds trade on exchange at a premium or discount to NAV.

Derivatives: futures and forwards create symmetric obligations; options give the buyer a right and the writer an obligation, with maximum loss for the buyer limited to the premium.

Diversification reduces unsystematic (specific) risk but not systematic (market) risk; beta measures sensitivity to market movements and is the priced risk in CAPM.

Real return approximates nominal return minus inflation (Fisher: (1+nominal)/(1+inflation) − 1); compounding frequency raises the effective annual rate above the nominal rate.

Market structure basics: primary market raises new capital, secondary market transfers existing securities; settlement cycles and counterparty arrangements determine operational risk.

Suitability assessment inputs: investment objectives, time horizon, risk tolerance, financial capacity to bear loss, knowledge and experience, and any constraints such as liquidity or ethical preferences.

Risk tolerance (willingness) and risk capacity (ability) are distinct; where they conflict, the lower of the two governs the recommended portfolio risk.

Asset allocation is the primary driver of portfolio return variability; strategic allocation sets long-run weights, tactical allocation makes short-term deviations within policy limits.

Mean-variance optimisation maximises expected return for a given variance; its outputs are sensitive to input estimates, so constraints and rebalancing rules are applied.

Rebalancing to target weights controls drift; calendar-based and threshold-based (e.g. ±5% band) approaches are the common triggers.

A written investment policy statement records objectives, constraints, permitted assets, benchmarks, and review frequency, and is the reference for evaluating deviations.

Performance evaluation separates return into benchmark return, asset allocation effect, and selection effect; risk-adjusted measures include Sharpe, Treynor, and information ratio.

Behavioural biases to identify in clients include loss aversion, recency bias, anchoring, overconfidence, and herd behaviour; advice should counter the bias, not exploit it.

Trade lifecycle: order capture, pre-trade checks, execution, confirmation, clearing, settlement, reconciliation, and accounting; each stage carries a control point.

Segregation of duties separates execution, settlement, and reconciliation functions so no single person can initiate and conceal an error or fraud.

Client money rules: client assets are held in designated segregated accounts, reconciled daily or at prescribed frequency, and never used to fund firm operations.

Records to retain typically include orders, confirmations, statements, KYC evidence, complaints, and communications, for the statutory period measured from the later of transaction or relationship end.

Reconciliation compares internal ledgers with custodian and counterparty statements; unresolved breaks must be investigated, escalated, and logged with an ageing report.

Settlement failures and corporate actions (dividends, splits, mergers) require defined processing and entitlement checks; late claims can extinguish client entitlements.

Best execution requires taking all sufficient steps to obtain the best result for clients considering price, cost, speed, likelihood of execution and settlement, size, and nature of the order.

Business continuity and outsourcing controls require documented recovery objectives, tested backups, and due diligence plus ongoing oversight of critical service providers.

Risk treatment options: avoid, reduce (mitigate with controls), transfer (insurance, hedging), and accept; residual risk is inherent risk less the effect of controls.

Risk register entries record description, likelihood, impact, inherent and residual rating, owner, controls, and review date; heat maps display the aggregate profile.

Three lines model: business units own risk, a risk and compliance function provides oversight, and internal audit provides independent assurance.

Operational risk categories include people, process, systems, and external events; fraud is a subset driven by intent to obtain dishonest gain.

Fraud red flags: unusual urgency, third-party payment requests, mismatched identity documents, structuring of transactions below thresholds, and changes of bank details by email.

Data protection principles: lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

Data subject rights typically include access, rectification, erasure, restriction, portability, and objection; a personal data breach must be notified to the regulator within prescribed short deadlines where risk is likely.

Cyber and access controls: multi-factor authentication, least-privilege access, encryption at rest and in transit, logging and monitoring, phishing awareness, and tested incident response plans.