CAMS-FCI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Predication

The articulable facts - an alert, tip, referral, or self-identified issue - that justify opening an investigation. It distinguishes a documented investigation from speculation or personal suspicion.

Standard of proof tiers

Ascending thresholds from suspicion to reasonable grounds, balance of probabilities, and beyond reasonable doubt. The investigator states which tier the collected evidence supports in the report.

Hypothesis-driven investigation

Stating a testable proposition about the conduct, defining in advance what evidence would confirm or refute it, and testing both directions rather than only seeking confirmation.

Three-lines model

The business owns risk in the first line; compliance and investigations provide framework and oversight in the second; internal audit gives independent assurance in the third.

Investigator independence

Investigators must not examine matters in which they approved onboarding, the business decision, or the transaction under review. Conflicts are disclosed and recused.

Mandate boundaries

Investigators gather and analyze evidence; decisions to exit a relationship, file a SAR, or freeze activity rest with designated authority such as the MLRO or BSA officer.

Residual risk

The risk remaining after controls are applied. It is derived from inherent risk and control effectiveness, and it drives prioritization and monitoring intensity.

Tipping rule for prioritization

Ongoing activity that is still moving value out of the institution outranks closed historical matters of similar size because intervention can still prevent loss.

Deprioritization rationale

Documented reasoning for ranking a matter low, including the factors considered and approver. Undocumented low-risk closure is itself an audit finding.

Triage decision options

Close as false positive, close with enhanced monitoring, escalate to a full case, or refer to another function. Each option requires a documented reason code.

False-positive documentation

An explanation of why the alerted activity is consistent with the customer's known profile, income, and business, rather than a bare statement that the activity was expected.

Investigation plan elements

Scope, hypothesis, information needed, sources and systems, sequencing, resource estimate, target completion date, and escalation triggers, agreed before substantive evidence gathering begins.

Case deduplication

Checking for existing cases on the same subject, account, or network before opening a new case, so analysis is not fragmented across parallel files.

Customer baseline

Expected activity derived from the customer profile - income, business revenue, stated purpose, and history - against which deviations in volume, velocity, value, and counterparties are measured.

Layering indicators

Rapid pass-through, near-identical in and out amounts, multiple accounts or entities, structuring below thresholds, round-dollar transfers, and circular fund flows that obscure origin.

Lowest intermediate balance

A tracing method that estimates how much of a specific deposit remains in an account at a later date, accounting for withdrawals that may have consumed earlier funds.

Structuring red flags

Multiple deposits just under the reporting threshold, aggregated across days or weeks, or split across branches, tellers, or accounts of related parties to avoid reporting.

Trade-based money laundering indicators

Over- or under-invoicing, mismatched goods descriptions, phantom shipments, and repeated use of related-party trading companies in high-risk jurisdictions.

Evidence capture standard

Recording source system, query or report name, extraction date and time, extracting user, and record identifiers so that another investigator can regenerate the same data.

Contemporaneous notes

Notes made at the time of the work, dated and attributed, separating fact from opinion. Corrections are struck through and initialed rather than erased.

Legal hold

A directive suspending routine deletion of records relevant to an investigation or legal process, with documented scope, recipients, and effective date.

Money laundering stages

Placement of cash into the financial system, layering to obscure origin, and integration of funds back into the economy as apparently legitimate. Red flags differ by stage.

Terrorist financing red flags

Small-value transfers, misuse of charities or nonprofits, funnel accounts near conflict zones, and fund movement inconsistent with the stated purpose, often lawful in origin.

Sanctions evasion indicators

Use of intermediaries, re-documentation of goods, transshipment through third countries, and opaque ownership structures designed to conceal a designated party's involvement.

Mule account indicators

Rapid in and out movement, many small deposits from unrelated parties, and account activity inconsistent with the holder's profile, typical of fraud proceeds movement.

Interview question funnel

Starting with open questions, then narrowing to closed and clarifying questions while avoiding leading questions that suggest the answer the investigator wants.

Tipping-off prohibition

The rule that a subject must not be told a SAR has been filed or that an investigation exists, because disclosure could prejudice the investigation or alert other parties.

Cross-border information sharing

Sharing customer or case information across jurisdictions may require a mutual legal assistance treaty, a data-protection adequacy assessment, or regulator approval, with the legal basis documented.

SAR narrative elements

Who, what, when, where, how, and why: subject identifiers, conduct and typology, dates, accounts and jurisdictions, transaction pattern, and reasoning linking facts to suspicion.

Continuing activity reporting

When suspicious activity persists after an initial SAR, a supplemental or follow-up filing may be required, with the filing reference tracked in the case file.

Remediation outcomes

Documented actions following an investigation - exit, enhanced monitoring, CDD refresh, control fix, training, or referral - each with an owner and due date.

Legal privilege in investigations

Communications with counsel may be privileged. They are marked, distributed narrowly, and handled so that privilege is not inadvertently waived.