CAMS-FCI common mistakes
CAMS-FCI · Understand the traps and how to avoid them.
Treating the investigation as a search for confirmation of the initial suspicion: once an alert names a customer, the candidate only collects facts that support filing and never tests the alternative explanation (legitimate source of funds, mislabeled counterparty, data error).
Alert queues reward closure speed, and exam vignettes are written to look incriminating at first read, so the candidate anchors on the first hypothesis and skips hypothesis testing.
What to do instead
Before concluding, write down at least two competing explanations and name the specific evidence that would distinguish them (e.g., salary credits matching an employer's payroll pattern vs. round-amount cash deposits). State in the case file which alternative was tested and why it was rejected. The exam rewards demonstrated disconfirmation, not a fast verdict.
Confusing the investigator's role with the compliance programme owner's role: recommending control redesign, changing the risk appetite, or directing that a customer relationship be exited as if the investigator held those mandates, rather than escalating with a documented recommendation.
Investigators often do see the root-cause control gap, and candidates over-correct by claiming decision authority, blurring the three-lines-of-defence boundary the exam tests.
What to do instead
Frame outputs as findings plus recommendations routed to the accountable owner (e.g., 'recommend the onboarding team re-verify beneficial ownership for this entity type'), and keep the investigator's own deliverable as an evidence-based case conclusion. Know who owns remediation versus who evidences it.
Applying a single enterprise-wide risk rating to prioritisation instead of scoring the specific activity: ranking a case by the customer's static high-risk category while ignoring the actual transaction pattern, amounts, velocity, and counterparty jurisdictions in front of them.
Customer risk ratings are the most visible number in the file, so candidates substitute the pre-computed label for case-level analysis.
What to do instead
Build a case-level priority from explicit factors: typology severity, value at risk, velocity/recency, cross-border exposure, whether the activity is ongoing, and any statutory deadline. Show the scoring rationale so a reviewer can see why case A outranks case B even if B's customer is rated higher.
Closing an alert as a false positive without documenting the analytic steps taken: the disposition note says 'activity consistent with profile' with no reference to the data reviewed, the period examined, or the specific red flags considered and cleared.
High alert volumes and the perception that only escalations need narrative detail lead to thin closures; candidates underestimate that closures are also auditable decisions.
What to do instead
Write every closure to a standard: what was alerted, what was reviewed (systems, periods, counterparties), what explained the activity, and what residual risk remains. If a red flag could not be cleared, escalate rather than close. Treat the closure note as evidence a regulator or auditor will read cold.
Tracing only the first hop of funds: identifying the originating account and the immediate recipient, then stopping, without following onward transfers, intermediary banks, nested correspondents, or crypto conversion points to the ultimate beneficiary.
The first transaction layer is easiest to retrieve and candidates treat the payment detail as the end of the trail rather than the start of the flow.
What to do instead
Map the full path as a flow with dates, amounts, currencies, fees deducted, and each institution in the chain; note where the trail breaks and why (foreign bank, privacy law, closed account). Distinguish gross from net amounts and flag any hop where value is split, commingled, or converted.
Producing a case file that is a pile of raw artefacts: screenshots without timestamps or source system, statements with no page/account identification, and no index linking each exhibit to the assertion it supports.
Candidates equate thoroughness with volume and assume the reader shares their context; they also collect evidence before defining what must be proven.
What to do instead
Maintain an exhibit index: exhibit number, description, source system, date/time obtained, custodian, and the specific finding it supports. Record chain of custody for anything non-system-generated, and note the retention/legal-hold status. If an exhibit does not support a stated finding, it does not belong in the file.
Mislabeling a typology: calling any rapid pass-through activity 'structuring', describing trade-based laundering as 'smurfing', or treating a single large cash deposit as structuring without the pattern of amounts deliberately kept under a reporting threshold.
Typology names are learned as vocabulary lists rather than as behavioural definitions, and several share surface features (cash, multiple accounts, third parties).
What to do instead
For each typology, memorise the defining mechanism and the minimum elements: structuring requires intent to evade a threshold evidenced by amount patterns and behaviour; pass-through requires minimal dwell time and no economic purpose; TBML requires a mismatch between goods described and value or shipping. Match the observed facts to the elements, and say which elements are present and which are not.
Treating the investigative interview as an interrogation to obtain a confession: leading with accusations, revealing the full evidence file, or arguing when the subject gives an innocuous explanation, instead of gathering information and testing accounts against records.
Dramatised enforcement interviews shape expectations, and candidates assume an admission is the goal of the investigative stage.
What to do instead
Prepare objectives and open questions, let the subject give a free account first, then probe inconsistencies with documents rather than assertions. Record who was present, the capacity in which the subject was interviewed, and whether counsel was involved. Treat admissions as one data point to be corroborated, not the case's conclusion.
Sharing case information too freely: discussing a live case with a relationship manager, sending subject details over unapproved channels, or tipping off the customer while verifying a transaction, without checking need-to-know, the legal basis, and any permitted-disclosure gateway.
Investigators rely on business colleagues for context and want to resolve questions quickly, so informal sharing feels efficient and helpful.
What to do instead
Apply a need-to-know test before each disclosure, use approved channels, and log what was shared, with whom, when, and under what authority. For law enforcement requests, verify the requester and the legal instrument; for external sharing, confirm the gateway (e.g., a permitted defence or a safe-harbour provision) and escalate to legal/MLRO when unsure. Never disclose a SAR's existence to the subject.
Treating the SAR as the end of the investigation: filing and closing the case with no documented post-filing decision on the relationship, no feedback loop to the control that failed, and no reassessment of the customer risk rating or ongoing monitoring parameters.
The report is the most visible deliverable, so candidates equate filing with completion and overlook the remediation and escalation outcomes the exam also tests.
What to do instead
After filing, document the disposition decision (continue with enhanced monitoring, restrict, exit, or no action, with rationale), the risk-rating impact, any control or training gap identified, and who owns each follow-up with a date. Where tipping-off risk constrains action, record that constraint explicitly. Close the case only when these decisions are evidenced.