I85PREP
⌘ K
CAMS-FCI study materials
CAMS-FCI study resources

CAMS-FCI practice questions

One question at a time. Build your CAMS-FCI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Investigations fundamentals, governance and the role of the financial crime investigator

A financial crime investigator at a bank receives an internal escalation about unusual account activity. Which action best reflects the investigator's primary role at this stage?

  1. Refer the matter to law enforcement and close the internal case
  2. Gather and analyse the available facts to determine whether suspicion is substantiated Correct answer.
  3. Immediately file a suspicious activity report before reviewing any transaction data
  4. Notify the account holder so they can explain the activity

Explanation

The investigator's core function is to assess and analyse information objectively before deciding on escalation or reporting. Filing before review, handing off prematurely, or tipping off the customer all undermine that analytical gatekeeping role.

Question 2Investigations fundamentals, governance and the role of the financial crime investigator

Which statement best describes the concept of 'triage' in a financial crime investigations unit?

  1. Assigning every alert equally so each receives identical effort
  2. Closing all alerts that lack an immediate law enforcement request
  3. Prioritising and scoping incoming alerts so resources focus on the highest-risk matters Correct answer.
  4. Escalating every alert directly to the regulator without review

Explanation

Triage is the structured process of assessing incoming alerts to rank them by risk and allocate investigative resources accordingly. It is not about equal treatment, blanket closure, or automatic external escalation.

Question 3Investigations fundamentals, governance and the role of the financial crime investigator

Under a typical anti-money laundering framework, which of the following is the clearest example of a 'red flag' that would prompt an investigator to open a case?

  1. A customer requesting a standard account statement
  2. A business paying its suppliers by scheduled bank transfer
  3. Structuring of cash deposits just below the reporting threshold across several branches Correct answer.
  4. A long-standing customer making routine salary deposits each month

Explanation

Structuring to avoid reporting thresholds is a recognised indicator of possible money laundering and justifies investigation. Routine salary deposits, statement requests, and scheduled supplier payments are ordinary activity with no inherent suspicion.

Question 4Investigations fundamentals, governance and the role of the financial crime investigator

What is the primary purpose of maintaining an investigation case file with a documented audit trail?

  1. To replace the need for analyst judgement in future cases
  2. To increase the volume of documentation submitted to the board
  3. To satisfy marketing requirements for transparency
  4. To provide a defensible record of decisions, evidence, and reasoning that can withstand supervisory or judicial scrutiny Correct answer.

Explanation

A well-maintained case file demonstrates that decisions were reasoned and evidence-based, which is essential for regulatory examinations and court proceedings. Documentation supports, but does not replace, analyst judgement, and it is not a marketing tool.

Question 5Investigations fundamentals, governance and the role of the financial crime investigator

Which governance body is typically responsible for approving a financial institution's financial crime risk appetite and overseeing the effectiveness of its AML programme?

  1. The board of directors or a delegated board committee Correct answer.
  2. The external auditor
  3. The internal audit function alone
  4. The front-line sales team

Explanation

Ultimate accountability for risk appetite and programme oversight rests with the board or a committee to which it delegates. Front-line staff execute controls, internal audit provides independent assurance, and external auditors provide an opinion, but none sets risk appetite.

Question 6Investigations fundamentals, governance and the role of the financial crime investigator

An investigator identifies a potential conflict of interest because the subject of an investigation is a close relative of a team member. What is the most appropriate action?

  1. Allow the team member to lead the case since they know the subject best
  2. Proceed without disclosure to avoid delaying the case
  3. Disclose the conflict and recuse the affected team member from the investigation Correct answer.
  4. Destroy the case notes to avoid any appearance of bias

Explanation

Conflicts of interest must be disclosed and managed, typically through recusal, to preserve the integrity and objectivity of the investigation. Concealment, inappropriate involvement, or destruction of records would compromise the process.

Question 7Investigations fundamentals, governance and the role of the financial crime investigator

Which of the following best describes the investigator's obligation when a suspicious transaction report has been filed and a tipping-off prohibition applies?

  1. Share the report with all colleagues to raise awareness
  2. Publish the report internally on a shared drive
  3. Inform the customer so they can prepare a defence
  4. Avoid disclosing the report or its contents to the customer or unauthorised parties Correct answer.

Explanation

Tipping-off rules prohibit disclosing that a report has been made, or information likely to prejudice an investigation, to the subject or unauthorised persons. Informing the customer, broad internal sharing, or publishing the report would breach confidentiality.

Question 8Investigations fundamentals, governance and the role of the financial crime investigator

An investigator is reviewing an alert on a corporate client whose transaction volumes have tripled in two months with payments routed through several new jurisdictions. Which analytical approach is most appropriate first step?

  1. Report the client to law enforcement without internal review
  2. Request the client's marketing materials as the sole evidence
  3. Compare current activity against the client's established profile and expected business rationale Correct answer.
  4. Immediately close the alert because the client is corporate

Explanation

Risk-based investigation begins by testing observed activity against the customer's known profile, expected turnover, and stated business purpose. Closing without review, external reporting without assessment, or relying on marketing material alone would not constitute sound analysis.

Question 9Investigations fundamentals, governance and the role of the financial crime investigator

During an investigation, an analyst finds that a colleague's earlier review concluded the activity was legitimate, but new evidence contradicts that conclusion. What is the most appropriate course of action?

  1. Ignore the new evidence because the case was already closed
  2. Reassess the case objectively and document the new evidence and revised conclusion Correct answer.
  3. Defer to the earlier conclusion to preserve consistency
  4. Escalate only if the colleague agrees to change the conclusion

Explanation

Investigators must follow the evidence and document any change in conclusion with supporting rationale. Deferring to a prior decision, ignoring new evidence, or making escalation contingent on a colleague's approval undermines independence and accuracy.

Question 10Investigations fundamentals, governance and the role of the financial crime investigator

Which of the following best illustrates the principle of 'proportionality' in a financial crime investigation?

  1. Applying identical scrutiny to every customer regardless of risk
  2. Maximising the number of reports filed regardless of merit
  3. Deferring all decisions to senior management
  4. Applying investigative resources and controls in proportion to the assessed risk of the matter Correct answer.

Explanation

Proportionality means calibrating effort, controls, and response to the level of risk identified. Uniform scrutiny, report volume for its own sake, and blanket deferral all disregard the risk-based principle.

Question 11Investigations fundamentals, governance and the role of the financial crime investigator

A financial crime investigator is asked by a relationship manager to delay an internal escalation so a valuable client is not inconvenienced. How should the investigator respond?

  1. Cancel the escalation and delete the related notes
  2. Proceed with the escalation on its merits and document the request and the rationale Correct answer.
  3. Ask the client whether they object to being investigated
  4. Delay the escalation as requested to protect the relationship

Explanation

Investigations must be free from commercial pressure; the investigator should escalate based on the merits and record the attempted influence. Delaying, cancelling, or involving the client would compromise independence and confidentiality.

Question 12Investigations fundamentals, governance and the role of the financial crime investigator

What is the principal difference between an internal suspicious activity report escalation and an external report to the financial intelligence unit?

  1. The internal escalation is legally required and the external report is optional
  2. There is no meaningful difference between the two
  3. The external report stays confidential while the internal escalation is public
  4. The internal escalation informs the institution's decision-making, while the external report fulfils the statutory reporting obligation Correct answer.

Explanation

Internal escalation allows the institution to assess and decide, and it precedes the statutory external report to the financial intelligence unit where suspicion is confirmed. The external report is a legal obligation, not optional, and both are confidential.

Question 13Investigations fundamentals, governance and the role of the financial crime investigator

An investigator's case assessment relies on a transaction monitoring rule that is known to generate high false positives. What is the most defensible approach?

  1. Assess the alert against other evidence and document why the rule triggered and whether suspicion remains Correct answer.
  2. Disable the rule without any governance approval
  3. Close every alert from that rule without review
  4. Assume every alert from the rule is a true positive

Explanation

High false-positive rules still require review; the investigator should corroborate with other evidence and document the reasoning. Blanket closure, unauthorised rule changes, or automatic acceptance of alerts all undermine the control environment.

Question 14Investigations fundamentals, governance and the role of the financial crime investigator

Which of the following best describes the investigator's duty regarding record retention after a case is closed?

  1. Transfer all records to the customer on request
  2. Destroy records immediately to protect customer privacy
  3. Retain records for the period required by law and internal policy, preserving them for potential regulatory or legal review Correct answer.
  4. Retain only records that support a guilty finding

Explanation

Records must be retained for the legally and internally mandated period so they remain available for regulators, auditors, and courts. Immediate destruction, selective retention, or handing records to the customer would defeat that purpose.

Question 15Investigations fundamentals, governance and the role of the financial crime investigator

A junior investigator is unsure whether a set of transactions meets the threshold for suspicion. What is the most appropriate action consistent with governance expectations?

  1. Ask the customer directly whether the transactions are suspicious
  2. Decide alone and close the case to avoid burdening colleagues
  3. Wait until the customer complains before acting
  4. Escalate the uncertainty to a senior investigator or designated MLRO for a decision Correct answer.

Explanation

Where uncertainty exists, the matter should be escalated to a senior investigator or the money laundering reporting officer for a documented decision. Acting alone to close, waiting passively, or consulting the customer are all inappropriate.

Question 16Investigations fundamentals, governance and the role of the financial crime investigator

Which of the following scenarios best demonstrates the governance principle of 'three lines of defence' as applied to financial crime?

  1. The business, compliance, and audit all report to the same front-line manager
  2. The business owns controls, compliance provides oversight, and internal audit gives independent assurance Correct answer.
  3. Only internal audit is responsible for financial crime controls
  4. External counsel performs all monitoring and investigation

Explanation

The three lines model separates control ownership in the business, independent oversight by compliance, and independent assurance by audit. Concentrating all functions under one manager, assigning responsibility solely to audit, or outsourcing everything to counsel defeats the separation.

Question 17Investigations fundamentals, governance and the role of the financial crime investigator

An investigator discovers that a colleague has been accessing customer records without a business need. What is the most appropriate first action?

  1. Ignore the matter because it is outside the investigator's remit
  2. Delete the access logs to protect the colleague
  3. Confront the colleague publicly and demand an explanation
  4. Report the matter through the appropriate internal channel and preserve relevant evidence Correct answer.

Explanation

Unauthorised access is a potential insider risk and must be reported through established channels with evidence preserved. Public confrontation, ignoring the issue, or deleting logs would obstruct detection and accountability.

Question 18Investigations fundamentals, governance and the role of the financial crime investigator

Which of the following best explains why an investigator should distinguish between 'suspicion' and 'proof' when deciding whether to report?

  1. Reporting obligations are typically triggered by reasonable suspicion, which is a lower threshold than proof of wrongdoing Correct answer.
  2. Suspicion is irrelevant once a customer provides an explanation
  3. Proof and suspicion are legally identical thresholds
  4. Proof is required before any internal escalation can occur

Explanation

Most AML regimes require reporting on reasonable suspicion, which does not require proof of criminal conduct. Demanding proof, discounting suspicion after an explanation, or conflating the two thresholds would misstate the legal standard.

Question 19Investigations fundamentals, governance and the role of the financial crime investigator

An investigator receives a request from a foreign counterpart for information about a customer under investigation. Which principle should guide the response?

  1. Send the information directly to the customer for consent first
  2. Share only through authorised channels and in accordance with legal and confidentiality requirements Correct answer.
  3. Provide all case files immediately as a professional courtesy
  4. Refuse all cross-border cooperation categorically

Explanation

Cross-border information sharing must follow legal gateways, confidentiality rules, and authorised channels. Uncontrolled disclosure, blanket refusal, or seeking customer consent first would be inappropriate.

Question 20Investigations fundamentals, governance and the role of the financial crime investigator

Which of the following best describes the role of the money laundering reporting officer (MLRO) in the investigation lifecycle?

  1. Approves marketing campaigns for the compliance function
  2. Replaces the board in setting risk appetite
  3. Acts as the central decision-maker on escalation and external reporting and maintains oversight of the reporting process Correct answer.
  4. Personally conducts every investigation from alert to closure

Explanation

The MLRO is the designated decision point for whether suspicion is escalated externally and oversees the reporting process. The MLRO does not personally conduct every case, manage marketing, or assume the board's risk appetite role.

Question 21Investigations fundamentals, governance and the role of the financial crime investigator

An investigator is analysing a complex case involving multiple entities and jurisdictions. Which approach best supports a sound conclusion?

  1. Defer the conclusion indefinitely to avoid error
  2. Build a structured evidence map linking entities, transactions, and documented reasoning to the conclusion Correct answer.
  3. Conclude based on the size of the transactions alone
  4. Rely on a single witness statement as the sole basis

Explanation

Complex cases require structured analysis that connects entities, flows, and evidence to a documented conclusion. Single-source reliance, size-based conclusions, and indefinite deferral are not sound investigative practice.

Question 22Investigations fundamentals, governance and the role of the financial crime investigator

An investigator must decide whether to escalate a case where the evidence is ambiguous but the potential harm is severe. Which reasoning best reflects a risk-based governance approach?

  1. Escalate where the combination of likelihood and impact justifies action, documenting the rationale for the decision Correct answer.
  2. Always escalate every ambiguous case to law enforcement
  3. Base the decision solely on the customer's seniority
  4. Always wait for conclusive evidence regardless of potential impact

Explanation

Risk-based governance weighs likelihood and impact; where potential harm is severe, escalation may be justified even on ambiguous evidence, provided the rationale is documented. Waiting for certainty, blanket external escalation, or deference to seniority would be unsound.

Question 23Investigations fundamentals, governance and the role of the financial crime investigator

A regulator criticises an institution because investigators routinely close alerts without recording their reasoning. Which governance weakness does this most directly reflect?

  1. Failure to market compliance services
  2. Inadequate documentation and challenge of investigative decisions, undermining accountability Correct answer.
  3. Excessive reliance on transaction monitoring technology
  4. Overstaffing of the investigations function

Explanation

Closing alerts without recorded reasoning reflects weak documentation and challenge, which undermines accountability and defensibility. The criticism is not about technology reliance, staffing levels, or marketing.

Question 24Investigations fundamentals, governance and the role of the financial crime investigator

An investigator learns that a senior executive is the subject of an ongoing review and that the executive has asked to see the case file. What is the most appropriate response?

  1. Provide the full file because of the executive's seniority
  2. Decline access, escalate the request through governance channels, and document the interaction Correct answer.
  3. Delete the file to remove any conflict
  4. Summarise the file verbally to the executive to avoid a paper trail

Explanation

Case files are confidential and access must follow governance protocols, particularly where a senior person is the subject. Providing access, giving verbal summaries, or destroying the file would breach confidentiality and integrity.

Question 25Risk assessment and investigation prioritization

An AML investigator is triaging alerts from a transaction monitoring system. Which factor most directly determines whether an alert should be escalated to a full investigation rather than closed after initial review?

  1. Whether the customer has been with the institution for more than five years
  2. Whether the activity is explainable by documented customer profile and expected behavior Correct answer.
  3. Whether the alert volume for the analyst's queue exceeds the daily target
  4. Whether the alert was generated by a rules-based scenario or a machine-learning model

Explanation

Prioritization and escalation hinge on whether the observed activity is consistent with the customer's known profile, expected transaction patterns, and documented source of funds. Alerts that cannot be reasonably explained by the profile warrant escalation. Queue volume and model type affect workflow but do not determine the underlying risk decision.

Question 26Risk assessment and investigation prioritization

Which concept best describes the risk that remains after an institution has applied its AML controls, such as customer due diligence, monitoring, and screening?

  1. Inherent risk
  2. Residual risk Correct answer.
  3. Risk appetite
  4. Control testing

Explanation

Residual risk is the exposure that persists after controls are applied to inherent risk. Inherent risk is the raw risk before controls, risk appetite is the level of risk the institution is willing to accept, and control testing evaluates whether controls operate as designed.

Question 27Risk assessment and investigation prioritization

A compliance team is building a risk-scoring model to rank customers for enhanced due diligence. Which combination of attributes is most consistent with a risk-based approach?

  1. Account balance alone, since higher balances always indicate higher risk
  2. Customer age, account tenure, and number of products held
  3. Country of residence, occupation, and product type only
  4. Geographic risk, customer occupation or business activity, delivery channel, and expected transaction volume Correct answer.

Explanation

A risk-based scoring model weighs multiple factors that reflect money laundering and terrorist financing exposure, including geography, customer type, channel, and expected activity. Single-factor proxies such as balance or tenure are inadequate on their own. Combining structural and behavioral attributes produces a more defensible ranking.

Question 28Risk assessment and investigation prioritization

During an investigation, an analyst finds that a customer's stated annual income is modest but the account received numerous structured cash deposits just below the reporting threshold. What is the most appropriate investigative priority?

  1. Close the case because each individual deposit was below the reporting threshold
  2. Refer the matter to the customer's relationship manager for a courtesy call
  3. Wait for the next periodic review cycle before taking any action
  4. Focus on whether the deposits form a pattern of structuring and identify the source of funds Correct answer.

Explanation

Deposits repeatedly placed just under a reporting threshold are a classic structuring indicator, and the investigator should assess the aggregate pattern and the source of funds. Individual transactions below a threshold do not eliminate suspicion when viewed collectively. Deferring action or treating the matter as a service issue ignores the potential predicate offense.

Question 29Risk assessment and investigation prioritization

Which statement best explains why an institution segments its customer base when calibrating transaction monitoring scenarios?

  1. Segmentation allows thresholds to reflect the expected behavior of comparable customers, reducing false positives Correct answer.
  2. Segmentation removes the need for periodic scenario tuning
  3. Segmentation is required only for high-risk customers
  4. Segmentation guarantees that no suspicious activity will be missed

Explanation

Segmentation groups customers with similar profiles so that scenario thresholds reflect what is normal for that group, which improves detection precision and reduces false positives. It does not eliminate risk of missed activity, nor does it replace ongoing tuning. Segmentation should apply across the customer base, not only to high-risk segments.

Question 30Risk assessment and investigation prioritization

An investigator is deciding whether to file a suspicious transaction report on a customer whose activity was unusual but later explained by a legitimate inheritance. What is the most appropriate outcome?

  1. Escalate to law enforcement directly without filing a report
  2. File the report only if the customer refuses to provide documentation
  3. File the report because the transaction was unusual
  4. Document the rationale for closure and retain supporting evidence Correct answer.

Explanation

When unusual activity is reasonably explained and supported by documentation, the investigator should document the analysis and evidence supporting closure. Filing is not required merely because activity was unusual. Direct escalation to law enforcement is generally not the investigator's role absent specific legal obligations.

Question 31Risk assessment and investigation prioritization

Which of the following best describes the purpose of a risk assessment at the enterprise level for an AML program?

  1. To identify and prioritize the money laundering and terrorist financing risks the institution faces and allocate controls accordingly Correct answer.
  2. To satisfy a one-time regulatory filing requirement
  3. To replace customer due diligence with a single risk score
  4. To calculate the exact number of suspicious transaction reports the institution will file

Explanation

An enterprise risk assessment identifies, evaluates, and prioritizes the institution's money laundering and terrorist financing risks so that controls and resources can be directed proportionately. It is not a prediction of report volume, nor a one-time exercise, and it does not replace customer-level due diligence.

Question 32Risk assessment and investigation prioritization

An analyst receives an alert involving a newly opened account that immediately received a large wire transfer from a jurisdiction with weak AML controls, followed by rapid outbound transfers. Which red flag combination is most relevant to prioritize this case?

  1. The branch where the account was opened
  2. The customer's preferred communication channel
  3. Account tenure, source geography, and rapid pass-through of funds Correct answer.
  4. The number of prior alerts on unrelated accounts

Explanation

New accounts, high-risk geography, and rapid movement of funds consistent with pass-through behavior are recognized red flags that warrant priority review. Communication preferences, branch location, and unrelated alert history are not material to the risk presented by this activity. Prioritization should focus on the specific indicators present.

Question 33Risk assessment and investigation prioritization

What is the primary reason an institution should document its rationale when closing an alert as a false positive?

  1. To satisfy customer requests for information about their accounts
  2. To reduce the number of alerts generated in future monitoring cycles
  3. To transfer responsibility for the decision to the customer
  4. To demonstrate that the alert was reviewed and the decision was reasoned, supporting auditability and consistent treatment Correct answer.

Explanation

Documenting closure rationale provides an audit trail showing the alert was reviewed and the decision was based on evidence. This supports regulatory examinations, internal audit, and consistency across analysts. It does not change future alert generation and does not shift responsibility to the customer.

Question 34Risk assessment and investigation prioritization

A risk assessment identifies a new product that allows cross-border transfers with minimal documentation. How should this finding most appropriately influence the institution's AML program?

  1. It should be noted in the next annual report without changing controls
  2. It should be excluded from the risk assessment because the product is new
  3. It should be handled only by the sales team responsible for the product
  4. It should trigger a review of the product's inherent risk and the adequacy of mitigating controls before or during launch Correct answer.

Explanation

A new product with elevated inherent risk should prompt an assessment of whether existing controls are proportionate, often before launch. Findings from the risk assessment are meant to drive control design and resource allocation. Excluding new products or deferring to sales undermines the risk-based approach.

Question 35Risk assessment and investigation prioritization

Which of the following is the strongest indicator that an investigation should be escalated to a higher-level review team?

  1. The alert involves a politically exposed person with complex offshore structures and unexplained wealth Correct answer.
  2. The customer has requested a change of address
  3. The investigator has limited experience with the customer's industry
  4. The account has a low average balance

Explanation

Complex structures, political exposure, and unexplained wealth raise both money laundering risk and the stakes of the decision, justifying escalation. Address changes and low balances are not inherently high-risk indicators. Analyst inexperience may warrant support but is not itself an escalation trigger.

Question 36Risk assessment and investigation prioritization

Which data quality issue most directly undermines the effectiveness of transaction monitoring and risk scoring?

  1. Use of multiple languages in customer communications
  2. Variation in analyst writing styles in case notes
  3. Occasional formatting differences in report templates
  4. Incomplete or inconsistent customer occupation and expected activity fields Correct answer.

Explanation

Monitoring scenarios and risk scores rely on accurate customer attributes such as occupation and expected activity. Missing or inconsistent data can cause misclassification and missed or spurious alerts. Template formatting, language, and note style affect presentation but not the underlying risk logic.

Question 37Risk assessment and investigation prioritization

An investigator discovers that a customer's transactions are consistent with their documented business but the customer operates in a cash-intensive industry in a high-risk region. What is the most appropriate analytical approach?

  1. File a suspicious transaction report solely because the industry is cash-intensive
  2. Refer the case to the customer's accountant for verification
  3. Assess whether the cash intensity and geography are adequately mitigated by due diligence and whether activity levels are plausible for the business Correct answer.
  4. Close the alert immediately because the activity matches the stated business

Explanation

Matching the stated business is necessary but not sufficient; the investigator must assess whether the level and nature of activity are plausible and whether enhanced due diligence mitigates the geographic and industry risk. Cash-intensive industries in high-risk regions warrant heightened scrutiny. Filing solely on industry type or outsourcing the judgment to the customer's accountant is inappropriate.

Question 38Risk assessment and investigation prioritization

What role does a customer risk rating play in investigation prioritization?

  1. It replaces the need to review individual transactions
  2. It permanently fixes the customer's risk level regardless of subsequent activity
  3. It helps determine the depth of due diligence and the urgency with which alerts are reviewed Correct answer.
  4. It is used only for regulatory reporting statistics

Explanation

A customer risk rating informs how much due diligence is appropriate and how urgently alerts should be handled. It is dynamic and should be updated as circumstances change. It does not substitute for transaction-level review or serve merely as a reporting statistic.

Question 39Risk assessment and investigation prioritization

An institution notices that a particular monitoring scenario generates a very high proportion of alerts that are consistently closed as false positives. What is the most appropriate response?

  1. Instruct analysts to close all alerts from that scenario without review
  2. Increase the threshold without documenting the rationale
  3. Review the scenario's logic and thresholds, document the analysis, and adjust through the change management process Correct answer.
  4. Disable the scenario permanently without further analysis

Explanation

A high false positive rate signals that the scenario may need recalibration, but changes should be made through documented review and change management to preserve detection coverage. Disabling without analysis or closing alerts unread risks missing genuine activity. Undocumented threshold changes undermine governance.

Question 40Risk assessment and investigation prioritization

Which of the following best characterizes the relationship between inherent risk and control effectiveness in determining residual risk?

  1. Residual risk increases as control effectiveness increases
  2. Residual risk is determined by inherent risk alone
  3. Residual risk reflects inherent risk reduced by the effectiveness of controls Correct answer.
  4. Residual risk is independent of both inherent risk and controls

Explanation

Residual risk is the product of inherent risk and the degree to which controls mitigate it. Stronger controls reduce residual risk for a given level of inherent risk. Inherent risk alone does not determine residual risk, and the two are clearly related.

Question 41Risk assessment and investigation prioritization

An investigator is reviewing a case where a customer received funds from multiple unrelated third parties and then withdrew them in cash within days. Which investigative step is most important to determine whether this is suspicious?

  1. Confirming the customer's preferred branch location
  2. Determining the identity and relationship of the third-party senders and whether the activity fits the customer's profile Correct answer.
  3. Checking whether the customer has a savings account
  4. Reviewing the customer's social media activity

Explanation

The key question is whether the third parties are known to the customer and whether the fund flows are consistent with the customer's profile and stated purpose. Acting as an intermediary for unrelated parties followed by cash withdrawal is a recognized layering indicator. Branch preference, account type, and social media are not central to this determination.

Question 42Risk assessment and investigation prioritization

Which of the following best explains why an institution should consider both quantitative and qualitative factors in its AML risk assessment?

  1. Qualitative factors are required only for smaller institutions
  2. Quantitative factors are irrelevant to risk assessment
  3. Qualitative judgment captures factors such as typology changes and control culture that data may not reflect Correct answer.
  4. Quantitative data alone always overstates risk

Explanation

Quantitative data such as volumes and values provide structure, but qualitative factors like emerging typologies, control culture, and expert judgment capture risks that numbers may miss. A balanced assessment uses both. Neither is universally sufficient or irrelevant, and the need does not depend on institution size.

Question 43Risk assessment and investigation prioritization

An analyst is prioritizing a backlog of alerts. Which approach is most consistent with a risk-based prioritization framework?

  1. Prioritizing alerts from the largest accounts only
  2. Reviewing alerts strictly in the order received regardless of risk
  3. Prioritizing alerts by the severity of indicators, customer risk rating, and potential exposure Correct answer.
  4. Assigning all alerts to the newest analysts to build experience

Explanation

Risk-based prioritization considers the severity of indicators, the customer's risk rating, and the potential exposure so that the highest-risk matters are addressed first. Strict chronological order or account size alone can allow high-risk cases to age. Assigning work by experience level is a staffing decision, not a prioritization method.

Question 44Risk assessment and investigation prioritization

What is the most appropriate action when an investigator identifies a potential link between a customer's activity and a known sanctions evasion network, but the link is not yet confirmed?

  1. Ignore the link until it is fully confirmed
  2. Escalate promptly through the appropriate channels while continuing to gather and document evidence Correct answer.
  3. Close the case because the link is unconfirmed
  4. Inform the customer of the suspected link to obtain clarification

Explanation

A potential link to sanctions evasion is a serious indicator that warrants prompt escalation while evidence is gathered and documented. Ignoring or closing the case because the link is unconfirmed risks missing a significant compliance event. Informing the customer could constitute tipping off.

Question 45Alert triage, case intake and investigation planning

An analyst receives an automated alert from the transaction monitoring system flagged as a possible structuring pattern. According to standard alert triage practice in AML investigations, what is the most appropriate first step before deciding whether to escalate the alert?

  1. Close the alert immediately because structuring alerts are typically false positives
  2. Open a formal suspicious activity report filing without further review
  3. Escalate directly to law enforcement to preserve the evidence
  4. Verify the alert's underlying data and review the customer's profile and transaction history Correct answer.

Explanation

Triage begins by validating that the alert reflects real, correctly aggregated data and then comparing it against the customer's known profile and expected activity. This context determines whether the pattern is genuinely unusual or explainable, which is the basis for any escalation decision. Filing or external referral before this validation skips required analysis.

Question 46Alert triage, case intake and investigation planning

Which document most directly establishes the criteria an analyst should use when deciding whether a transaction monitoring alert warrants escalation to a case investigation?

  1. The institution's alert triage and escalation procedures Correct answer.
  2. The customer's most recent account statement
  3. The vendor's marketing brochure for the monitoring system
  4. The regulator's public enforcement action archive

Explanation

Escalation criteria are codified in the institution's own written procedures, which translate regulatory expectations into operational thresholds and documentation requirements. Analysts are accountable to those procedures during triage. Statements, enforcement archives, and vendor materials inform context but do not define internal escalation rules.

Question 47Alert triage, case intake and investigation planning

During case intake, an analyst records the alert source, date, subject identifiers, and the preliminary reason the alert was escalated. Which principle does this documentation primarily support?

  1. Maximizing the number of alerts closed per analyst per day
  2. Maintaining an auditable chain of reasoning from alert to case Correct answer.
  3. Satisfying customer requests for transaction transparency
  4. Reducing the cost of the monitoring software license

Explanation

Case intake documentation creates a traceable record of why the matter was opened and what evidence existed at that point. This supports auditability, supervisory review, and defensible decision-making later in the investigation. Efficiency metrics and licensing costs are unrelated to the purpose of intake records.

Question 48Alert triage, case intake and investigation planning

An analyst is planning an investigation into a customer whose alert involves rapid movement of funds through multiple jurisdictions. Which action best reflects a risk-based investigation plan?

  1. Interview the customer before reviewing any transaction records
  2. Sequence the review to prioritize highest-value and highest-risk counterparties and jurisdictions first Correct answer.
  3. Request the full ten-year transaction history before examining any single transaction
  4. Defer all analysis until the customer's tax filings are obtained

Explanation

A risk-based plan allocates effort proportionate to risk, so the analyst should examine the largest exposures and highest-risk geographies and counterparties early. This surfaces material findings efficiently and informs whether broader data is needed. Front-loading interviews or exhaustive data pulls before any analysis is inefficient and can compromise the investigation.

Question 49Alert triage, case intake and investigation planning

A monitoring alert is triggered by a series of cash deposits just below the reporting threshold. The customer is a long-standing retail business with documented cash-intensive operations. What is the most defensible triage outcome?

  1. Refer the matter to law enforcement without further internal review
  2. Escalate automatically because any sub-threshold deposit pattern is inherently suspicious
  3. Document the business rationale and expected cash profile, then retain the alert as reviewed and closed with justification Correct answer.
  4. Close the alert as a false positive without documentation because the customer is long-standing

Explanation

A documented, plausible explanation for the pattern supports closure, but the reasoning and supporting evidence must be recorded for auditability. Longevity alone does not justify undocumented closure, and escalation should reflect an unresolved or genuinely suspicious pattern. The decision must be transparent and reviewable.

Question 50Alert triage, case intake and investigation planning

Which factor is most relevant when assigning a priority level to a newly opened AML case?

  1. The analyst's personal familiarity with the customer
  2. The number of pages in the customer's onboarding file
  3. The alphabetical order of the customer's surname
  4. The potential severity of the conduct and any imminent risk of asset dissipation Correct answer.

Explanation

Case prioritization should reflect the potential harm and urgency, including whether funds may move out or evidence may be lost. Severity and time sensitivity drive resource allocation. Administrative attributes and personal relationships are not legitimate prioritization criteria.