CAFP common mistakes
CAFP · Understand the traps and how to avoid them.
Treating the FATF Recommendations as a fixed checklist of 40 equally weighted rules and citing 'Recommendation 10' or 'Recommendation 20' without being able to state what the requirement actually obliges an institution to do (e.g., CDD timing, ongoing monitoring, tipping-off prohibition).
Candidates memorize recommendation numbers and headlines from summary tables rather than reading the interpretive text, so they can name a number but cannot apply the underlying obligation to a scenario or distinguish an 'R' from an 'Interpretive Note' requirement.
What to do instead
For each core Recommendation in scope (R.1 risk-based approach, R.10 CDD, R.11 record keeping, R.12-16 PEPs/correspondent/new tech/wire transfers, R.20 STR reporting, R.21 tipping-off and confidentiality, R.22-23 DNFBPs), write a one-sentence statement of the obligation in your own words plus one concrete institutional action it requires. Test yourself by reading only a fact pattern and naming which Recommendation's obligation is engaged and why.
Conflating the Basel Committee's guidance with binding law, or asserting that Basel 'requires' specific CDD outcomes, when Basel sets supervisory expectations for banks (customer acceptance, KYC, ongoing monitoring, and the consolidated KYC risk management principles) rather than a treaty obligation.
The three frameworks (FATF, Wolfsberg, Basel) are taught together and candidates blur their legal status, audience, and enforceability, then pick whichever sounds stricter in a multiple-choice option.
What to do instead
Build a three-column comparison: FATF (intergovernmental standard-setter, assessed through mutual evaluations, implemented via national law), Wolfsberg (private-sector principles drafted by banks, contractual/adoption-based), Basel (BCBS supervisory guidance for banking supervisors and banks, implemented through national supervisory rules). For any statement in a practice question, first ask 'who issued this and to whom does it bind?' before judging it true or false.
Applying a single global rule to BSA/AML questions, e.g., stating that a SAR must be filed within 30 days in all cases, that the CTR threshold applies to all customers, or that the USA PATRIOT Act Section 314(b) safe harbor permits sharing with any third party.
Candidates study the concepts generically and do not anchor the specific US statutory and regulatory mechanics (31 CFR Chapter X, FinCEN guidance, SAR timing with the 30-day trigger and 120-day extension for no-identified-subject cases, CTR aggregation and exemptions, 314(a) vs 314(b) distinctions).
What to do instead
Maintain a one-page 'US mechanics' sheet with the exact numbers and conditions: SAR filing deadline and extension, CTR threshold and aggregation rules, the four pillars plus CDD rule, 314(a) compelled request vs 314(b) voluntary sharing with the safe harbor's conditions (US financial institution, registered with FinCEN, sharing for identifying ML/terrorist financing). Drill the exceptions and conditions, not just the headline number.
Treating beneficial ownership as 'who owns more than 25%' and stopping there, failing to apply the control prong, the ownership-percentage calculation through layered entities, or the difference between the CDD rule's ownership/control prongs and a jurisdiction's registry definition.
The 25% threshold is the most memorable number in CDD training, so candidates anchor on it and forget that control (senior managing official, trustee, nominee arrangements) and complex ownership chains are equally examinable, and that thresholds differ by jurisdiction.
What to do instead
Practice ownership-chain exercises: given a described structure, compute effective ownership by multiplying percentages down the chain, identify whether any natural person crosses the threshold, then separately ask who exercises control. Memorize the two-prong structure (ownership + control), the treatment of trusts and nominees, and the requirement to identify a senior managing official when no beneficial owner can be found.
Equating enhanced due diligence with 'collect more documents' and failing to differentiate EDD from standard CDD or to specify EDD triggers (PEPs, high-risk jurisdictions, correspondent relationships, higher-risk products) and the additional measures required (source of funds/wealth, senior management approval, enhanced ongoing monitoring).
Candidates learn EDD as an intensity slider rather than a defined set of additional obligations, so they choose 'obtain additional identification documents' when the correct answer is a specific measure such as establishing source of wealth or escalating approval.
What to do instead
Write an EDD checklist keyed to triggers: for each trigger, list the specific additional measures (identify source of funds and source of wealth, obtain senior management approval, conduct enhanced ongoing monitoring, consider whether the relationship should be declined). Practice distinguishing 'what is CDD' from 'what is only EDD' so you can reject options that are standard CDD mislabeled as enhanced.
Treating sanctions screening and AML transaction monitoring as the same control, or assuming a sanctions hit is handled by filing a SAR rather than by blocking/rejecting and reporting to the relevant authority (e.g., OFAC blocking and annual reporting, or the applicable EU/UN mechanism).
Both are 'screening' activities in the candidate's mental model, but sanctions are strict-liability, list-driven, and prohibit dealings, whereas AML monitoring is risk-based and produces SARs/STRs. Candidates import AML logic into sanctions questions.
What to do instead
Memorize the sanctions decision tree separately: match → verify (name, DOB, address, identifiers) → if true match, block or reject the property and do not deal → report to the authority within the required timeframe → consider whether an AML report is also needed. Contrast with AML: no list required, risk-based thresholds, SAR/STR to the FIU. Also learn the difference between OFAC's 50% rule, UN Security Council lists, and EU consolidated lists.
Defaulting to 'file a SAR/STR' for every red flag, without first assessing whether the activity is suspicious after context, whether a threshold or reporting obligation is actually triggered, and whether the correct escalation is internal (enhanced monitoring, relationship exit) rather than external reporting.
SAR/STR filing is the most salient exam concept, so candidates over-apply it. They also confuse 'unusual' with 'suspicious' and ignore that the obligation is to report suspicion based on all facts, not to report every transaction that deviates from a profile.
What to do instead
Practice the sequence explicitly: alert → investigate and gather context (expected activity, customer profile, source of funds) → determine whether a suspicion exists → if yes, escalate and file within the deadline and do not tip off → if no, document the rationale and close, adjusting the customer risk profile if needed. Learn the definition of suspicion and the tipping-off prohibition, and be able to reject 'file a SAR' options where the facts show an explained, legitimate pattern.
Confusing the typologies of distinct predicate offences, e.g., describing bribery as 'money laundering' or treating tax evasion, fraud, and corruption as interchangeable, and failing to identify the placement/layering/integration stage or the specific red flags of each predicate.
All financial crimes are taught under one heading and share overlapping indicators (shell companies, offshore structures, cash), so candidates pattern-match on the shared indicator rather than on the offence-specific mechanics and reporting obligations.
What to do instead
Create a typology matrix: predicate offence → typical scheme mechanics → distinctive red flags → which reporting obligation applies. For example, bribery often involves intermediaries, consultants, and government officials (link to PEP screening); tax evasion involves offshore accounts and false invoicing; fraud involves misrepresentation and asset misappropriation. For each, be able to place the scheme in the ML stages and name two red flags unique to it.
Treating the risk assessment as a document to be produced for the regulator rather than a methodology, and failing to connect the enterprise-wide risk assessment to customer risk rating, monitoring thresholds, and audit scope; similarly, treating training and audit as box-ticking rather than as controls with defined frequency, independence, and remediation follow-up.
Governance questions look soft, so candidates memorize 'the three lines of defense' and 'the board approves the policy' without learning how the risk assessment drives calibration or what makes an audit independent and risk-based.
What to do instead
Learn the causal chain: business-wide risk assessment (products, customers, geographies, channels, delivery) → customer risk rating methodology → monitoring scenarios and thresholds calibrated to risk → training content targeted to role and risk → independent audit testing design and effectiveness with findings tracked to remediation → board/senior management oversight and MI. Be able to state what makes audit independent (not performed by the function being tested) and what the compliance officer's role does and does not include (advising and monitoring, not owning business risk).
Analyzing virtual assets and fintech with legacy banking assumptions, e.g., assuming a counterparty is always identifiable, that 'the blockchain is anonymous', or that a crypto exchange is automatically outside AML scope; and failing to distinguish custodial from non-custodial arrangements, the travel rule, and the role of digital identity verification.
Emerging-risk content changes quickly and candidates rely on outdated or headline-level understanding (for example, confusing pseudonymity with anonymity, or missing that FATF treats VASPs as obliged entities subject to the same core obligations).
What to do instead
Study the FATF virtual asset and VASP guidance as an application of existing obligations: VASPs are obliged entities, the travel rule requires originator and beneficiary information for transfers, and blockchain analytics supports but does not replace CDD. Learn the pseudonymity distinction, custodial vs non-custodial wallet risk, and how digital identity (liveness detection, document authentication, synthetic identity fraud) affects CDD quality. Practice applying the same risk-based framework to a fintech onboarding scenario rather than inventing new rules.