Risk Management, Fraud Prevention, and Data Protection
Firm risk and client risk
Candidates must understand the risk management cycle: identify, assess, control, monitor, and report. Know the main categories: credit, market, liquidity, operational, conduct, reputational, and information security risk. Understand the three lines of defence: business units own risk, compliance and risk functions oversee, internal audit provides independent assurance.
Fraud and financial crime
Know the typologies: identity fraud, account takeover, authorised push payment fraud, phishing and social engineering, investment scams, and internal fraud. Controls include customer authentication, call-back verification on payment changes, transaction monitoring, staff screening, and a speak-up culture. For data protection, understand lawful processing, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, and security, plus breach notification and subject access rights.
Traps that appear in questions
- Treating a client's urgent instruction as authority to bypass call-back verification.
- Assuming fraud prevention ends at onboarding; monitoring is continuous.
- Confusing a data breach with a reportable personal data breach; reportability depends on risk to individuals.
- Overlooking that staff are a control, not just a cost.
- Believing insurance removes operational risk rather than transferring part of it.
- Ignoring the client's own vulnerability when assessing fraud risk.
Rule of thumb
Urgency is a red flag, not a reason to skip controls. Verify through an independent channel before moving money or changing bank details.
Worked example
A client emails asking to change bank details and pay an outstanding invoice immediately. Correct handling: treat as high risk, verify by calling a previously known number, require written confirmation, apply dual authorisation, and record the verification steps taken.