CAMS-FCI key terms

The principle that the investigator's judgment and findings must not be directed or softened by the business lines, relationship managers, or revenue owners whose activity is under examination, preserving objectivity and credibility.

A personal, financial, or reporting-line interest that could bias an investigator's decisions, requiring disclosure and reassignment or independent review before conclusions are reached.

A documented, unbroken record of who handled each item of evidence, when, and how it was stored or transferred, so its authenticity can be defended later in court or regulatory review.

The assurance that collected data and documents remain complete, unaltered, and attributable to their source, supported by hashing, access controls, and contemporaneous documentation.

A formal instruction to retain records, communications, or system logs that may be relevant to an investigation, issued before routine deletion cycles destroy them.

A directive suspending normal destruction of documents and data for identified custodians or systems while litigation, regulatory inquiry, or investigation is pending.

A periodic evaluation of how the institution's products, customers, geographies, channels, and controls expose it to financial crime, used to direct investigative resources and control enhancements.

The level and type of financial crime risk the institution's leadership is willing to accept, expressed in statements and tolerances that shape escalation thresholds and remediation decisions.

The process of ranking alerts and cases by potential severity, exposure, customer risk, and time sensitivity so limited investigative capacity addresses the greatest harm first.

The first-stage review that decides whether a system-generated alert warrants investigation, closure with documented rationale, or referral, using data checks and disposition criteria.

An alert that automated monitoring raised but that review shows is not indicative of suspicious activity, requiring a documented, defensible reason for closure.

The recorded outcome decision on an alert or case, such as closure, escalation, or filing, together with the rationale that supports the decision for audit and quality review.

The structured step of receiving an escalation, capturing core facts, assigning ownership, and setting scope and deadlines before substantive investigation begins.

A written outline of scope, hypotheses, data sources, steps, timelines, and responsible parties that guides the inquiry and can be revised as facts develop.

Defining the boundaries of an investigation, including accounts, entities, dates, and jurisdictions covered, so effort stays proportionate and gaps are identified.

The formal referral of an alert, finding, or case to a higher authority or specialist function when severity, legal exposure, or policy thresholds require it.

Following the movement of money through accounts, intermediaries, and jurisdictions to establish source, destination, ownership, and links between parties.

Structuring transactions through multiple accounts, entities, or jurisdictions to obscure the origin of funds and break the audit trail between source and beneficiary.

Splitting transactions into amounts below reporting or monitoring thresholds to avoid scrutiny, often revealed by patterns across related accounts or linked parties.

Using multiple individuals or accounts, sometimes unwitting, to conduct small transactions that together move significant funds while avoiding threshold-based detection.

The origin of the specific money used in a transaction or relationship, distinguished from source of wealth, and central to judging whether activity is consistent with the customer profile.

The origin of a customer's total accumulated assets, such as business ownership, inheritance, or salary history, used to test whether account activity is plausible.

The documented assessment of a customer's risk based on occupation, business, geography, products used, and expected activity, which anchors anomaly detection.

A fact, pattern, or indicator that raises suspicion of financial crime and prompts further inquiry, though it is not by itself proof of wrongdoing.

A recognized pattern of criminal behavior and its financial footprint, used to design monitoring scenarios and to interpret observed transaction behavior during investigations.

Manipulating invoices, prices, quantities, or shipping documents in international trade to move value across borders and justify payments that lack commercial logic.

Acquiring property through layered entities, third-party nominees, or split payments to conceal the true buyer and the criminal origin of the purchase money.

A person or entity that holds assets or accounts on behalf of another, often used to conceal the real beneficial owner from institutions and investigators.

Identification of the natural persons who ultimately own or control an entity or account, which investigators must establish to see past corporate layers.

Negative news coverage about a customer or counterparty, screened and assessed for relevance and reliability as part of due diligence and investigation.

A structured conversation with a witness, employee, or subject to gather facts, conducted with planning, open questions, and accurate documentation of what was said.

A statement by a person acknowledging facts relevant to the investigation, which must be recorded precisely and weighed against documentary evidence.

A signed or formally recorded account of what a person observed or knows, prepared accurately and reviewed with the witness for correctness.

A confidential filing to the financial intelligence unit describing unusual transactions and the reasons they are suspicious, protected from disclosure to the customer.

The written account within a suspicious activity report explaining who, what, when, where, and why the activity is unusual, in clear chronological order.

Unlawfully revealing to a customer or third party that a suspicious activity report has been or may be filed, which can obstruct detection and carries legal penalties.

The duty to limit access to investigation details and filings to those with a legitimate need to know, protecting the inquiry and complying with legal restrictions.

The organized record of an investigation containing alerts, analysis, evidence references, decisions, and correspondence, sufficient for another reviewer to reconstruct the work.

Corrective action taken after an investigation, such as exiting a relationship, filing reports, recovering funds, or strengthening controls, tracked through to completion.