CAFCA cheat sheet

Three stages of laundering: placement (illicit cash enters the financial system), layering (transactions obscure the audit trail), and integration (funds return to the economy as apparently legitimate assets).

The FATF 40 Recommendations are the global standard; compliance is assessed through mutual evaluation against 11 immediate outcomes rated for effectiveness.

US currency transaction reports are required for cash transactions above USD 10,000 in one business day; same-day transactions by or for the same person are aggregated.

EU customer due diligence is triggered for occasional transactions at EUR 15,000, with a lower EUR 10,000 threshold for cash payments in trade in goods.

Beneficial ownership is commonly defined as more than 25% ownership or control by a natural person; the US CDD rule uses an ownership prong and a separate control prong.

Wire transfers must carry originator and beneficiary information (the travel rule); the EU and US monetary threshold is EUR/USD 1,000.

Record retention: CDD and transaction records must be kept for at least five years after the end of the business relationship or the transaction.

Risk-based approach: enhanced due diligence applies to PEPs, high-risk jurisdictions and correspondent relationships; simplified measures only where lower risk is documented and justified.

Shell banks and anonymous accounts are prohibited, and no correspondent relationship may be established with a shell bank.

Fraud triangle = pressure or incentive + opportunity + rationalisation; the fraud diamond adds capability as a fourth element.

ACFE occupational fraud tree: asset misappropriation (most common, lowest median loss), corruption, and financial statement fraud (least common, highest median loss).

Three lines model: business operations own and run controls, risk and compliance functions monitor them, internal audit provides independent assurance.

Card-not-present controls include velocity limits, AVS and CVV verification, device fingerprinting, geo-velocity checks and 3-D Secure step-up authentication.

Liability shift: EMV chip and strong customer authentication such as 3-D Secure move card fraud losses to the party with the weaker authentication.

Synthetic identity fraud pairs a real identifier (e.g., a national ID number) with fabricated name and date of birth, then ages the account over months to build credit before busting out.

Account takeover red flags: credential reset, new device or IP address, newly added payee, changed contact details, immediately followed by a high-value transfer.

Authorised push payment fraud has no chargeback right because the customer authorised the payment; controls are confirmation of payee, behavioural analytics and scam warnings.

Key fraud metrics: loss rate per 1,000 transactions, detection rate, false-positive ratio, recovery rate and mean time to detect.

OFAC 50% rule: an entity owned 50% or more, directly or indirectly, by one or more blocked persons is itself blocked even if it does not appear on any list.

Sanctions liability is generally strict: intent or knowledge is not required for a violation, and penalties may be both civil and criminal.

Comprehensive programmes prohibit nearly all dealings with a country or regime; sectoral programmes prohibit only specified activity such as particular debt or equity transactions.

Secondary sanctions reach non-US persons for defined conduct even where there is no US person, US dollar or other US nexus.

Screening scope: customers, beneficial owners, directors, counterparties, free-text payment fields, vessels and transport documents.

OFAC blocking reports are due within 10 business days of the blocking action; the annual report of blocked property is due by 30 September.

General licences authorise a defined class of activity under stated conditions; specific licences are issued case by case with scope, conditions and expiry.

Fuzzy matching scores name similarity using algorithms such as Levenshtein or Jaro-Winkler; thresholds are tuned to balance false-positive volume against false-negative risk.

UN Security Council designations bind all member states; the EU consolidated list merges UN, EU autonomous and member-state listings.

Case lifecycle: intake and triage, scoping, evidence collection, analysis, reporting, closure and remediation.

Chain of custody records who handled evidence, when, and how it was stored or transferred, supporting integrity and admissibility.

US SAR deadline: file within 30 calendar days of detecting suspicious activity, extended to 60 calendar days if no suspect is identified.

Tipping off - disclosing a report or referral to the subject or a third party - is a criminal offence in most jurisdictions.

Reports must answer who, what, when, where, why and how, and cite the supporting evidence for each finding.

Interview sequence: free recall first, then open questions, then closed and specific questions; record contemporaneous notes and have the interviewee confirm them.

Common escalation triggers: confirmed sanctions match, senior-management involvement, losses above a set threshold, and law-enforcement interest in the case.

SAR quality indicators: specific narrative, documented suspicion rationale, links to prior alerts and identifiable parties, with no boilerplate text.

FATF requires investigation records and filed reports to be retained for at least five years.