CAFP cheat sheet

FATF Recommendations: 40 Recommendations cover AML/CFT; the 9 Special Recommendations on terrorist financing were merged into the 40 in 2012, and Recommendation 15 was revised in 2019 to cover virtual assets and VASPs.

Three FATF categories of measures: preventive measures (CDD, recordkeeping, reporting), transparency measures (beneficial ownership, legal persons/arrangements), and international cooperation.

The FATF 2013 Methodology grades compliance with each Recommendation and effectiveness under 11 Immediate Outcomes; a country can be technically compliant yet rated low on effectiveness.

Wolfsberg Principles are private-sector guidance issued by the Wolfsberg Group (founded 2000 with major banks); they set expectations for CDD, correspondent banking, PEPs, and payment transparency, and are not legally binding.

Basel Committee guidance (1988 Statement on prevention of criminal use of the banking system; 2001 CDD for banks; 2004 consolidated KYC risk management) establishes the four KYC elements: customer acceptance, identification, ongoing monitoring, and risk management.

Three-stage money laundering model: placement (cash enters the financial system), layering (obscuring the audit trail through transfers, shells, trades), integration (funds re-enter as apparently legitimate assets).

Risk-based approach: resources are allocated proportionate to assessed risk; enhanced measures apply to higher-risk relationships, simplified measures are permitted only for demonstrably lower-risk situations.

Predicate offence: the underlying crime generating proceeds; the 1988 Vienna Convention covered drug trafficking, the 2000 Palermo Convention added serious crime, and the 1999 UN Terrorist Financing Convention addresses TF.

FATF mutual evaluations follow a peer-review cycle with follow-up reporting; jurisdictions on the grey list are subject to increased monitoring, while the black list triggers counter-measures.

Bank Secrecy Act (1970) is codified at 31 U.S.C. 5311 et seq.; implementing regulations sit in 31 CFR Chapter X, with FinCEN as administrator and the federal banking agencies examining for compliance.

USA PATRIOT Act Section 326 requires a written Customer Identification Program: collect name, date of birth, address, and identification number, verify within a reasonable time, and retain records.

Section 319(b) requires foreign banks with US correspondent accounts to maintain records and produce them within 120 hours of a request; Section 319(a) permits asset forfeiture of funds in interbank accounts.

Section 311 authorizes special measures against jurisdictions, institutions, or transaction classes of primary money laundering concern; Section 312 mandates enhanced due diligence for foreign correspondent and private banking accounts.

Section 314(a) enables law enforcement to reach financial institutions through FinCEN; Section 314(b) allows institutions to share information with each other under a safe harbor after notice to FinCEN.

Section 313 prohibits US banks from maintaining correspondent accounts for foreign shell banks; Section 319(b) requires identification of the foreign bank's owners and agent for service of process.

EU AML framework: the 5th Anti-Money Laundering Directive (2018/843) extended scope to virtual asset service providers and expanded beneficial ownership registers; the 6th Directive (2018/1673) harmonized criminal liability.

Cross-border obligations include the FATF travel rule for wire transfers (Recommendation 16), the Common Reporting Standard for tax information exchange, and FATCA intergovernmental agreements.

CDD minimum elements: identify and verify the customer's identity, identify the beneficial owner and verify where risk warrants, understand purpose and intended nature of the relationship, and conduct ongoing monitoring.

Beneficial owner under the US CDD Rule (31 CFR 1010.230): each individual with 25% or more direct or indirect ownership, plus one individual with significant managerial control.

FATF defines beneficial owner as the natural person who ultimately owns or controls the customer or the person on whose behalf a transaction is conducted; it includes those exercising ultimate effective control.

Ownership calculation through layers: multiply ownership percentages along the chain; a 50% owner of an entity that holds 50% of another equals 25% indirect ownership, meeting the US threshold.

Enhanced due diligence triggers: PEPs, high-risk jurisdictions, complex offshore structures, correspondent relationships, private banking, cash-intensive businesses, and non-face-to-face onboarding.

PEP definition: an individual entrusted with prominent public functions, plus family members and close associates; risk continues after leaving office (FATF recommends at least 12 months of continued risk treatment, often longer).

Simplified due diligence may not be applied where there is a suspicion of money laundering, and is never permitted for high-risk categories identified in the institution's risk assessment.

Recordkeeping: the US requires CDD records for 5 years after the account closes and transaction records for 5 years after the transaction; FATF recommends at least 5 years for both.

Reliance on third parties for CDD requires the third party to be subject to equivalent supervision; the institution retains ultimate responsibility for the CDD outcome.

US SAR thresholds: $5,000 or more where a suspect is identified or a pattern suggests structuring or evasion; $25,000 or more for transactions with no identified suspect; no threshold for insider abuse.

SAR filing deadline: 30 calendar days after initial detection, extendable to 60 calendar days if no suspect is identified; continuing activity requires a follow-up report within 120 days.

SAR confidentiality: filing is prohibited from disclosure to the subject; tipping off is a criminal offence; the safe harbor under 31 U.S.C. 5318(g)(3) protects good-faith filings.

Structuring: transactions below the $10,000 CTR threshold deliberately arranged to evade reporting; intent to evade is the offence, so structuring is reportable even when the funds are legitimate.

CTR: filed for currency transactions exceeding $10,000 in a single business day by or for one person; multiple transactions are aggregated; exemptions exist for certain established customers.

Monitoring design: rules or models use thresholds, velocity, peer-group deviation, and scenario logic; tuning balances false positives against detection coverage, and alert closure must be documented and reviewed.

Red flags include rapid movement of funds inconsistent with the profile, round-dollar or just-below-threshold amounts, unexplained third-party activity, and mismatches between stated and observed activity.

Cross-border reporting: EU member states require suspicious transaction reports to the national FIU; the FIU may suspend a transaction (typically up to 48 hours in many regimes) before onward dissemination.

Detection is not solely automated: front-line staff observations, law enforcement inquiries, and adverse media all feed the suspicious activity escalation process.

OFAC administers US sanctions under IEEPA and the Trading with the Enemy Act; SDN list assets are blocked and US persons are prohibited from dealing with them; the 50% Rule extends blocking to entities owned 50% or more in aggregate by blocked persons.

Strict liability: OFAC civil penalties do not require knowledge or intent; the base penalty matrix considers egregious versus non-egregious conduct and voluntary self-disclosure as a mitigating factor.

Sectoral sanctions (SSI list) restrict specific transactions such as new debt or equity rather than blocking all dealings; the CAPTA and MENU lists identify prohibited debt and equity.

UN Security Council resolutions under Chapter VII are binding on all member states; consolidated lists are implemented through regional instruments such as EU Council Decisions and Regulations.

EU sanctions are adopted by unanimous Council decision and implemented by regulation; they bind EU persons and can apply extraterritorially to EU nationals and entities.

Screening mechanics: name matching uses fuzzy algorithms with thresholds; false positives require documented adjudication, and list updates must be loaded promptly (OFAC expects screening against current lists).

Secondary sanctions target non-US persons for specified dealings with designated sectors or persons, notably Iran and Russia-related measures; they are distinct from primary prohibitions on US persons.

Ownership and control screening must look through layered structures; an entity not itself listed can be blocked by aggregation of blocked ownership.

Embargoes can be comprehensive (broad country-wide prohibitions) or targeted; humanitarian carve-outs and general or specific licences define permitted exceptions.

UK Bribery Act 2010: Section 1 offences of bribing, Section 2 receiving, Section 6 bribing a foreign public official, and Section 7 corporate failure to prevent bribery, with an adequate procedures defence.

FCPA: anti-bribery provisions apply to US issuers, domestic concerns, and persons acting in US territory; the accounting provisions require accurate books and internal controls.

FATF Recommendation 35 requires criminalization of bribery of domestic and foreign public officials; the OECD Anti-Bribery Convention requires parties to criminalize foreign official bribery.

Tax evasion predicates: FATF added tax crimes to the designated categories of serious offences in 2012; the US lists tax evasion as a specified unlawful activity for money laundering.

Fraud typologies: account takeover, authorized push payment fraud, business email compromise, cheque and card fraud, and investment or pension scams; proceeds are then laundered through mules and crypto.

Trade-based money laundering: manipulation of invoices, over- or under-shipment, and mispriced goods move value across borders; red flags include mismatched goods descriptions and abnormal shipping routes.

Correspondent banking risk: nested accounts and payable-through accounts obscure the underlying customer; Wolfsberg and FATF guidance require understanding the respondent's AML programme and customer base.

Human trafficking and modern slavery generate proceeds typically moved through cash-intensive front businesses, hospitality, construction, and agricultural shell entities.

Terrorist financing differs from money laundering: funds may be small and legitimately sourced; the objective is the destination and use, so detection focuses on links to designated persons and conflict zones.

US five pillars: internal controls, customer due diligence (added by the 2018 CDD Rule, formerly the four pillars), designated compliance officer, ongoing training, and independent testing.

Enterprise-wide risk assessment methodology: rate inherent risk by customer, product, channel, geography, and transaction type; apply control effectiveness to derive residual risk, then allocate resources accordingly.

The BSA officer must have authority, resources, and access to the board; the board approves policy and receives regular reporting on risk and compliance metrics.

Independent testing should be performed by internal audit or an external party not involved in the AML programme; scope, sample sizes, and findings must be documented and tracked to remediation.

Training requirements: role-specific content for front-line, operations, and management; completion tracking; refresher frequency set by risk; board-level training on oversight responsibilities.

Policies must be approved, version-controlled, and aligned with the risk assessment; changes in regulation or business model trigger review.

FinCEN enforcement considers the programme's design and whether failures were systemic; the 2024 proposed rule would formalize programme requirements across more institution types.

Metrics and KRIs include alert volumes, SAR conversion rates, CDD timeliness, screening hit ratios, training completion, and audit issue closure rates.

Financial Intelligence Units: the Egmont Group coordinates over 170 FIUs; models include administrative (FinCEN, UK NCA), law enforcement, judicial, and hybrid.

FinCEN disseminates 314(a) requests approximately every two weeks; institutions must search records and report matches, and may not disclose the request to the customer.

314(b) sharing requires registration with FinCEN and applies to sharing among financial institutions for identifying and reporting suspected money laundering or terrorist activity.

FATF Recommendation 29 requires supervisors and FIUs to have powers to cooperate and exchange information domestically and internationally; Recommendation 40 covers other competent authorities.

Suspicious activity report analysis supports strategic intelligence products such as FinCEN advisories and typology reports; the SAR database is not public and access is restricted.

Investigations use link analysis, open-source and adverse media research, corporate registry checks, and transaction tracing across accounts and institutions.

Public-private partnerships (for example FinCEN Exchange and joint money laundering task forces) allow operational information sharing within legal limits.

Cross-border FIU exchange typically occurs through secure channels such as the Egmont Secure Web, subject to reciprocity and confidentiality conditions.

FATF Recommendation 15 (as revised 2019) requires virtual asset service providers to be licensed or registered, subject to AML/CFT supervision, and to apply the full preventive measures including CDD and recordkeeping.

Travel rule for virtual assets: originating and beneficiary VASPs must exchange originator and beneficiary information for transfers; the threshold and data fields mirror the wire transfer rule.

VASP definition covers exchange between virtual assets and fiat or other virtual assets, transfer of virtual assets, safekeeping or administration, and participation in offering or sale of virtual assets.

DeFi and peer-to-peer arrangements create identification gaps; FATF notes that owners or operators with control or sufficient influence may fall within the VASP definition.

Stablecoins are treated as virtual assets for AML purposes; the issuer and the reserve custodian may be VASPs or financial institutions subject to separate obligations.

Digital identity: non-face-to-face onboarding requires liveness detection, document authentication, and ongoing biometric or behavioural monitoring to mitigate impersonation and synthetic identity risk.

Synthetic identity fraud combines real and fabricated data; it is a leading driver of account takeover and credit losses, and often evades matching against credit bureau records.

Fintech risks include rapid onboarding, API-based open banking data exposure, and third-party reliance; outsourcing does not transfer regulatory responsibility.

Central bank digital currencies and tokenized deposits raise design questions on privacy, traceability, and whether intermediaries fall within existing AML obligations.