CAFP study plan

Map all 40 FATF Recommendations into the four thematic pillars (AML/CFT policies and coordination, money laundering and confiscation, terrorist financing and proliferation financing, transparency and beneficial ownership) and explain the purpose of each pillar in writing.

Summarize the three Wolfsberg Principles documents (private banking, correspondent banking, and AML/CFT) and identify two operational controls each document requires that are not explicitly stated in the FATF Recommendations.

Explain how the Basel Committee's guidance on customer due diligence, the Wolfsberg Principles, and FATF Recommendations interact, and describe one scenario where a bank's internal policy must satisfy all three simultaneously.

Define 25 core AML/CFT terms (e.g., placement, layering, integration, predicate offense, beneficial owner, PEP, STR, FIU, mutual evaluation, de-risking) and produce a one-sentence definition for each from memory.

Outline the five pillars of the BSA/AML compliance program (internal controls, customer due diligence, suspicious activity reporting, training, and independent testing) and match each pillar to its regulatory citation (31 CFR Chapter X, FFIEC manual, or FinCEN guidance).

Trace the USA PATRIOT Act Section 314(a) and 314(b) information-sharing provisions, and explain the legal conditions, safe harbor, and recordkeeping obligations that apply to each.

Compare the customer due diligence and enhanced due diligence requirements under the CDD Rule (beneficial ownership), the USA PATRIOT Act Section 312 (correspondent and private banking accounts), and Section 326 (customer identification program), listing at least three differences in scope and timing.

Describe how a US institution's cross-border obligations interact with host-country AML directives (e.g., EU AMLD, UK MLRs) when the host standard is stricter, and identify the policy decision point for compliance.

Design a customer risk-rating model with at least five weighted factors (customer type, geography, product/service, delivery channel, and ownership structure) and document the scoring thresholds for low, medium, and high risk.

Apply the beneficial ownership identification process to three hypothetical entity structures (a shell company with nominee directors, a layered trust, and a private investment fund) and determine the ultimate beneficial owner(s) in each case.

Build a transaction monitoring scenario for structuring and one for rapid movement of funds, specifying the data fields, thresholds, and alert logic for each.

Draft a suspicious activity report narrative for a structuring case that includes the who, what, when, where, why, and how, and satisfies the completeness standard for a FinCEN SAR filing.

Explain the SAR/STR filing decision process, including the 30-calendar-day filing deadline (with a 60-day extension for complex cases), continuing activity review obligations, and confidentiality restrictions.

Differentiate the scope and legal basis of OFAC, UN Security Council, EU, and UK sanctions regimes, and identify at least two practical differences in listing criteria or delisting procedures.

Design a screening workflow for onboarding and ongoing monitoring that covers name screening, fuzzy matching thresholds, false-positive disposition, and escalation to the compliance officer.

Analyze a sanctions evasion typology (e.g., use of intermediaries, trade-based value transfer, or virtual assets) and list the red flags a transaction monitoring analyst should escalate.

Compare the typologies and red flags of fraud (e.g., account takeover, check fraud, authorized push payment fraud), bribery and corruption, and tax evasion, and identify at least one control that detects each typology.

Explain the elements of an effective AML compliance program under the FFIEC examination manual and the role of the compliance officer, including independence, authority, and reporting lines.

Conduct a simplified enterprise-wide risk assessment using a 5x5 likelihood-and-impact matrix for at least six risk categories, and document the residual risk rating for each.

Draft a training plan outline for three audiences (front-line staff, operations, and senior management) that specifies content, frequency, and assessment method for each.

Describe the independent testing (audit) process for an AML program, including scope, sampling methodology, reporting lines, and remediation tracking, and list five elements an examiner would expect to see in the audit report.

Explain the role of financial intelligence units (FIUs), the Egmont Group, and the mechanisms for domestic and international information sharing (e.g., 314(a), 314(b), and FIU-to-FIU exchanges).

Differentiate strategic, tactical, and operational intelligence products and identify which product type supports each of the following: policy change, case escalation, and suspicious activity reporting.

Evaluate a case study where an institution failed to escalate and share information internally, and identify at least three control failures that allowed the activity to continue.

Explain the FATF Recommendations as applied to virtual assets and virtual asset service providers (VASP), including the travel rule, and identify the recordkeeping and counterparty information requirements.

Compare at least three digital identity verification methods (document verification, biometric liveness, and database or credit-bureau checks) on accuracy, privacy risk, and suitability for high-risk customers.

Identify emerging fintech risks (e.g., decentralized finance, non-fungible tokens, embedded payments, and synthetic identity fraud) and match each to a FATF or Wolfsberg typology.

Revisit the FATF mutual evaluation process and explain how a country's effectiveness rating is determined, including the difference between technical compliance and effectiveness.

Complete a 100-question timed practice exam covering all nine domains, and score at least 75% overall and at least 60% in every domain.

Review every missed question and write a one-sentence correction for each, citing the underlying rule or guidance.

Re-derive the five-pillar BSA/AML program, the three stages of money laundering, the SAR filing timeline, and the sanctions screening workflow from memory in under 10 minutes.

Build a personal weak-area list of no more than 10 items and schedule two 45-minute review sessions before exam day.