CAMS-FCI cheat sheet

Investigation lifecycle: intake → triage → planning → evidence gathering → analysis → findings → disposition → closure and remediation.

Predication is the threshold: an investigation must rest on articulable facts (an alert, a tip, a referral, a self-identified issue), not on speculation or personal suspicion alone.

Standard of proof tiers: suspicion < reasonable grounds < balance of probabilities (civil) < beyond reasonable doubt (criminal); the investigator's report should state which tier the evidence supports.

Two investigation modes: reactive (triggered by alert, tip, subpoena, or law enforcement inquiry) and proactive (typology-driven, network-driven, or thematic review of a portfolio).

Hypothesis-driven investigation: state the hypothesis (e.g., 'funds are being layered through shell accounts'), define what evidence would confirm or refute it, and test both directions.

Chain of reasoning must be documented: each finding links to specific evidence items; conclusions without a cited evidence reference are unsupported assertions.

Investigations differ from audits: audits test control design and operation across a population; investigations test specific conduct, intent, and individual transactions.

Closure categories: substantiated, unsubstantiated, inconclusive, and referred (to law enforcement, another institution, or another internal function) - each with distinct documentation needs.

Three-lines model: business (1st line) owns risk; Financial Crime Compliance/investigations (2nd line) sets framework and investigates; Internal Audit (3rd line) provides independent assurance.

Independence rule: investigators must not investigate matters in which they participated in the underlying business decision, onboarding, or approval.

Escalation path: investigator → investigations lead/manager → MLRO or BSA officer → board or board committee; documented escalation SLAs and thresholds apply.

Mandate boundaries: investigators gather and analyze; decisions to exit relationships, file SARs, or freeze activity rest with designated authority (MLRO, BSA officer, committee).

Terms of reference should specify scope, authority to obtain records, access to systems, confidentiality obligations, reporting lines, and quality assurance review.

Record retention follows the strictest applicable rule (e.g., five years after account closure or after the SAR filing, whichever is later) and litigation-hold obligations override routine deletion.

Conflict-of-interest register and annual attestation support investigator independence and impartiality.

Performance metrics should reward quality and timeliness (case cycle time, QA pass rate, SAR quality) rather than raw alert-closure volume, which incentivizes premature closure.

Inherent risk = f(customer type, product/service, geography, channel, transaction volume/value); residual risk = inherent risk × control effectiveness.

Customer risk rating drivers: PEP status, high-risk jurisdiction nexus, cash-intensive business, complex ownership, adverse media, sanctions exposure, product risk.

Prioritization score commonly weights severity of alleged conduct, amount at risk, customer risk rating, regulatory exposure, time sensitivity (ongoing activity), and law-enforcement interest.

Tipping rule: activity that is ongoing and moving value out is prioritized over historical, closed-account matters of similar size.

Risk-based thresholds for investigation are set in policy; investigators must not silently override thresholds without documented rationale and approval.

Portfolio-level risk assessment (institution-wide or business-line) uses the same factors aggregated, informing staffing and typology focus.

Reassess risk when new information arrives: adverse media hit, law-enforcement inquiry, sanctions match, or a change in ownership or business model.

Documented rationale for deprioritization protects the institution if the matter later proves significant; 'closed as low risk' without reasoning is a finding in itself.

Triage decision options: close (false positive), close with monitoring, escalate to case, or refer to another function; each requires a documented reason code.

Triage evidence minimum: alert parameters, underlying transaction data, customer profile and risk rating, KYC/CDD documents, prior alert history, and known relationships.

False-positive documentation should explain why the activity is consistent with the customer's known profile, not merely that it was expected.

Case intake captures source, date received, subject(s), alleged conduct, amount, accounts, jurisdictions, and any deadlines or legal process attached.

Investigation plan elements: scope, hypothesis, information needed, sources and systems, sequencing, resource estimate, target completion date, and escalation triggers.

Scope creep control: new subjects or accounts discovered mid-investigation are logged and either added with documented rationale or spun into a separate case.

Time-boxing: set review checkpoints; cases exceeding the target cycle time are escalated to the investigations lead with a status note.

Deduplication: check for existing cases on the same subject or network before opening a new case to avoid fragmented analysis.

Baseline first: establish expected activity from the customer profile (income, business revenue, stated purpose), then measure deviation in volume, velocity, value, and counterparty mix.

Layering indicators: rapid pass-through, near-identical in/out amounts, use of multiple accounts or entities, structuring below reporting thresholds, round-dollar transfers, and circular flows.

Tracing method: build a funds-flow diagram with dated nodes (accounts, entities, jurisdictions) and directed edges (transfers) annotated with amount, currency, and channel.

First-in/first-out tracing and lowest-intermediate-balance methods are used to estimate how much of a specific deposit remains in an account at a later date.

Structuring detection: multiple deposits just under the reporting threshold, aggregated over days or weeks, or deposits split across branches, tellers, or accounts of related parties.

Trade-based indicators: over/under-invoicing, mismatched goods descriptions, phantom shipments, and repeated use of related-party trading companies in high-risk jurisdictions.

Watch for value going out that has no economic source: transfers funded by third-party deposits, loans immediately withdrawn, or incoming funds with no stated origin.

Reconcile to source documents (statements, SWIFT fields, payment messages) and record the exact field and value used; analysis must be reproducible by another investigator.

Evidence types: documentary (statements, contracts), digital (system logs, emails, screenshots with metadata), testimonial (interview notes), and analytical (flow diagrams, spreadsheets).

Capture standard: record source system, query or report name, extraction date/time, extracting user, and record identifiers so the data can be regenerated.

Contemporaneous notes: date every note, identify author, and record facts separately from opinion; corrections are struck through and initialed, never erased.

Case file structure: index, summary, subject profiles, transaction analysis, evidence log with unique IDs, correspondence, legal process, and final report.

Access control: need-to-know permissions, audit trail of who viewed or exported the file, and secure storage for sensitive personal data.

Legal process (subpoena, production order, MLAT request) is logged with service date, scope, and response deadline; responses are reviewed for completeness before sending.

Preservation: suspend routine deletion for relevant records once an investigation or legal hold begins; document the hold scope and recipients.

Quality assurance: a second reviewer checks that every finding in the report maps to an evidence item and that no evidence item is mischaracterized.

Money laundering stages: placement (cash into system), layering (obscuring origin), integration (re-entry as legitimate funds); red flags differ by stage.

Terrorist financing: small-value transfers, charity/NPO misuse, funnel accounts in conflict zones, and funds movement inconsistent with stated purpose - amounts may be small and lawful in origin.

Sanctions evasion: use of intermediaries, re-documentation of goods, transshipment through third countries, and opaque ownership to hide a designated party.

Fraud: mule accounts (rapid in/out, many small deposits from unrelated parties), authorized-push-payment scams, and business email compromise (new payee details, urgency).

Bribery and corruption: payments to intermediaries or consultants in high-risk jurisdictions, government-official nexus, and lavish gifts or travel for public officials.

Tax evasion: offshore structures with no economic substance, unreported accounts, and transactions inconsistent with declared income.

Trade and shell-company red flags: newly formed entities with large flows, nominal directors shared across many companies, and no apparent business rationale for the transaction.

Human trafficking and wildlife crime: cash-intensive front businesses, frequent small payments, and logistics patterns (transport, hospitality) inconsistent with the stated trade.

Interview types: witness (fact gathering), subject (potential misconduct), and third party (context); each carries different cautions and documentation needs.

Before any subject interview, confirm legal authority and whether counsel must be present; internal employment interviews differ from compelled or law-enforcement interviews.

Open questions first, then funnel to closed and clarifying questions; avoid leading questions that suggest the desired answer.

Record the setting, date, time, participants, and whether the interview was recorded; the interviewee reviews and signs a written summary where policy requires.

Do not disclose SAR filing or its contents to the subject; tipping-off restrictions apply in most jurisdictions.

Information sharing with law enforcement: respond to lawful requests within the stated scope, log what was shared and to whom, and avoid volunteering unrelated customer data.

Cross-border sharing may require a mutual legal assistance treaty, a data-protection adequacy assessment, or a regulator's approval; document the legal basis.

Collaboration with peers (other institutions) is limited by confidentiality and antitrust rules; sharing must go through approved channels such as a financial intelligence unit or a formal information-sharing partnership.

SAR/STR content: who (subject identifiers), what (conduct and typology), when (dates), where (accounts, jurisdictions), how (transaction pattern), and why it is suspicious relative to the profile.

Narrative quality: specific amounts, dates, counterparties, and the reasoning linking facts to suspicion; boilerplate language weakens the filing.

Filing timelines are jurisdiction-specific; internal escalation to the MLRO/BSA officer must occur promptly and before the regulatory deadline.

Continuing activity after a SAR is filed may require a supplemental or follow-up report; track the filing reference in the case file.

Confidentiality: SARs and their existence are not disclosed to the subject or to third parties except as permitted by law.

Remediation outcomes: exit/de-risk, enhanced monitoring, CDD refresh, control fix, training, or referral; each is documented with owner and due date.

Root-cause analysis asks whether the activity was detectable earlier and whether alert logic, thresholds, or onboarding controls failed.

Lessons learned feed back into typologies, scenario coverage, and risk assessment; close the loop with the business and with audit.

Confidentiality: case information is shared on a need-to-know basis; unauthorized disclosure can breach data-protection law, employment law, and tipping-off rules.

Privilege: communications with in-house or external counsel may be privileged; mark them appropriately and do not waive privilege by careless distribution.

Data protection: collect the minimum personal data necessary, retain only as long as required, and honor subject-access rules unless a legal exemption applies.

Fairness: the subject is presumed not culpable; findings should state facts and reasoning, avoid conclusory labels, and give the subject an opportunity to respond where policy allows.

Conflicts of interest: disclose and recuse where a personal or financial relationship with the subject exists.

Whistleblower protections: retaliation against a good-faith reporter is prohibited; handle reporter identity with heightened confidentiality.

Evidence handling ethics: do not alter, delete, or selectively present records; preserve exculpatory material as well as inculpatory material.

Legal escalation: when in doubt about subpoena scope, compelled disclosure, or cross-border transfer, escalate to legal before responding.