CAFCA common mistakes
CAFCA · Understand the traps and how to avoid them.
Choosing 'no CDD required' because the customer is labelled low risk, even when the stem contains a mandatory trigger such as a cash threshold, PEP connection, or suspicious activity.
Candidates treat the risk-based approach as permission to waive mandatory requirements, so they let a risk rating override fixed legal triggers.
What to do instead
Memorise the events that force CDD or EDD regardless of risk rating, and scan every stem for those triggers before applying any risk score.
Answering EDD and PEP questions by describing where a specific payment came from when the question asks how the customer accumulated total wealth, or vice versa.
Source of funds and source of wealth sound interchangeable, so candidates default to transaction origin.
What to do instead
Define source of funds as the origin of the specific funds in the relationship or transaction, and source of wealth as how the customer's total wealth was built; match the answer to the object named in the question.
Waiting for proof or a completed investigation before treating a situation as reportable suspicion.
Candidates apply an investigative or evidential standard instead of the lower suspicion threshold used in AML reporting.
What to do instead
Treat suspicion as a lower threshold than proof; anchor the reporting decision to the point suspicion arises, not to case closure, and practise incomplete-fact stems.
Recommending generic anti-fraud controls such as 'segregation of duties' or 'training' without linking each control to the specific fraud scheme described.
Candidates rely on memorised control lists instead of analysing the scheme's opportunity, pressure, and rationalisation.
What to do instead
Name the scheme first, such as billing, payroll, asset misappropriation, or corruption, then map each control to the opportunity or concealment step in that scheme.
Treating a high false-positive rate as proof that a fraud detection analytic is ineffective, or mixing prevention metrics with detection metrics.
Candidates reason intuitively that more false positives means worse performance and do not separate alert precision from detection coverage.
What to do instead
Define each metric before answering; a high false-positive rate may be acceptable when detection coverage is strong, so answer based on what the metric actually measures.
Screening sanctions by name only, ignoring aliases, dates of birth, nationalities, ownership, and control.
Candidates default to familiar name-matching workflow and forget that ownership or control can create a sanctions exposure even without a name match.
What to do instead
Apply an identifier hierarchy and ownership/control aggregation; if a designated person owns or controls an entity, treat that entity as blocked even when its name does not match the list.
Closing a sanctions alert solely because the fuzzy-match score is low, or escalating solely because it is high, without documenting a disposition rationale.
Candidates treat the match score as the decision rather than as a triage indicator.
What to do instead
Use the score only to prioritise review; require secondary identifiers and a written true-match or false-positive rationale before closing or escalating.
Saying a transaction is not a sanctions issue because it is small, or analysing sanctions questions with AML monetary thresholds.
Candidates carry over threshold thinking from AML transaction monitoring.
What to do instead
Treat sanctions as status-based, not amount-based; any dealing with a designated person or controlled entity is prohibited regardless of value.
Writing investigative conclusions and legal characterisations such as 'the subject committed fraud' in a report or SAR narrative instead of a factual chronology.
Candidates believe the report must prove the offence, so they state conclusions rather than facts.
What to do instead
Record who, what, when, where, how, amounts, accounts, and document identifiers; label conclusions clearly if required, and avoid legal terms unless the question asks for them.
Disclosing or discussing a SAR with the customer or subject because the candidate wants to provide good customer service.
Candidates apply a service instinct and forget that SAR confidentiality and tipping-off prohibitions override customer communication.
What to do instead
Treat SAR confidentiality as strict: do not disclose to the subject; answer questions by identifying which disclosures are legally permitted and to whom.