CAMS-RM cheat sheet

Three lines model: business units own risk (1st line), compliance/risk functions set frameworks and challenge (2nd line), internal audit provides independent assurance (3rd line).

Four pillars of an AML program: internal controls, designated compliance officer, ongoing training, independent testing.

Risk-based approach (RBA): controls must be proportionate to identified ML/TF risk; a flat, one-size-fits-all control set is itself a supervisory finding.

Board responsibilities: approve AML policy and risk appetite, receive MI on risk and control effectiveness, appoint a qualified AML compliance officer with authority and resources.

AML compliance officer duties: policy maintenance, suspicious activity escalation decisions, regulatory filings, staff training oversight, response to information requests.

Governance escalation requires documented decision rights: who may approve a high-risk relationship, who files a report, and who can exit a customer.

Recordkeeping baselines (FATF): CDD records and transaction records retained at least five years after the end of the relationship or the transaction.

Enterprise-wide risk assessment is the anchor document: it links inherent risk by segment to control design, residual risk, and the testing plan.

Training must be role-specific: front-line staff on identification and escalation, operations on monitoring alerts, board on risk appetite and typologies.

Residual risk = inherent risk after applying control effectiveness; a residual rating without a stated control-effectiveness basis is unsupported.

Inherent risk factors: customer type, geography, product/service, delivery channel, and transaction volume/value (customer, country, product, channel).

Risk appetite is expressed as qualitative statements plus quantitative tolerances (e.g., maximum share of high-risk customers, alert closure rates, overdue CDD counts).

Risk scoring models assign weights to factors; weights must be documented, periodically recalibrated, and validated against actual outcomes.

Segment-level risk assessment aggregates customer, product, channel, and geography risk to set monitoring thresholds and EDD triggers.

Control effectiveness is rated on design and operating effectiveness separately; strong design with weak operation yields a weak control rating.

Country risk ratings draw on FATF public statements, FATF-style regional body findings, sanctions lists, corruption indices, and typology reports.

Risk appetite breach handling requires defined escalation, remediation timelines, and board or committee notification thresholds.

Risk assessment outputs feed CDD depth, monitoring scenarios, training content, and audit scope; an unused risk assessment indicates a documentation-only exercise.

CDD elements: identify and verify the customer, identify the beneficial owner, understand purpose and intended nature of the relationship, and conduct ongoing monitoring.

Standard identification uses independent, reliable, source documents or data; a customer-provided self-declaration alone is not verification.

Timing rule: verification before establishing the relationship; limited deferral is permitted only with defined conditions, risk management, and prompt completion.

Simplified due diligence is permitted only where lower risk is documented; it never removes the obligation to identify the customer and beneficial owner.

Ongoing monitoring includes periodic CDD refresh triggered by risk rating, event-driven review (ownership change, adverse media), and transaction behavior review.

Reliance on third parties requires the intermediary to be regulated and supervised, with the obliged entity retaining ultimate responsibility for CDD adequacy.

Politically exposed persons require senior management approval, source-of-wealth and source-of-funds review, and enhanced ongoing monitoring.

Non-face-to-face onboarding needs compensating controls: liveness checks, document authentication, database cross-checks, and device or geolocation signals.

Record retention must capture what was verified, when, by whom, and the evidence relied on; undocumented CDD is treated as absent CDD.

Beneficial owner: the natural person who ultimately owns or controls the customer, or on whose behalf a transaction is conducted; ownership threshold commonly 25% of shares or voting rights.

Control-based test applies when no one meets the ownership threshold: identify the natural person exercising control by other means (senior managing official).

Ownership chains must be traced through each layer to natural persons; intermediate holding companies are documented, not accepted as endpoints.

Red flags for concealment: bearer shares, nominee directors, circular ownership, offshore layers with no business rationale, recently changed ownership before onboarding.

EDD triggers include high-risk jurisdictions, PEP status, complex or opaque structures, unusual channels, and adverse media on ownership or conduct.

EDD components: additional identity and ownership evidence, source-of-wealth and source-of-funds analysis, senior management approval, and more frequent review.

Source of wealth explains how total wealth was accumulated; source of funds explains the origin of the specific money in the transaction or relationship.

Legal arrangement customers (trusts, foundations) require identification of settlor, trustee, protector, beneficiaries, and any controller.

Inability to identify the beneficial owner is a mandatory refusal or termination trigger, not a reason to apply a higher risk rating alone.

Monitoring design flow: define risk-based scenarios, set thresholds and parameters, test against known bad and known good data, then deploy with tuning governance.

Rule types: threshold (value or count), velocity, structuring/smurfing detection, peer-group deviation, geography mismatch, and dormant-account reactivation.

Scenario thresholds are calibrated to the institution's own baseline; copied industry thresholds without validation are a model risk finding.

Alert triage separates false positives from true matches using data enrichment (KYC profile, expected activity, ownership, adverse media).

Case management requires documented disposition rationale, escalation decisions, and retention of the analysis supporting each closure.

Tuning is triggered by alert volume spikes, false-positive rate drift, new typologies, or regulatory change; tuning must be logged and approved.

Segmentation matters: retail, SME, correspondent, and private banking need distinct scenarios and thresholds reflecting their activity patterns.

Backtesting compares scenario output against known suspicious activity; missed cases reveal threshold or data gaps, not merely analyst error.

Monitoring coverage gaps arise from excluded products, channels, or entities; a coverage inventory should map every product to at least one scenario.

Screening types: sanctions and watchlist screening at onboarding and on list updates, PEP screening, adverse media screening, and internal negative lists.

Matching logic uses fuzzy algorithms (e.g., Jaro-Winkler, Levenshtein) with configurable thresholds; name normalization handles transliteration and name order.

Four-eyes disposition: alerts are cleared or escalated with documented rationale; a cleared hit must record which identifiers ruled out the match.

Screening must be event-driven: re-screen the full book when lists change, not only at periodic review.

Common false-positive drivers: common names, transliteration variants, partial date of birth, and missing secondary identifiers (nationality, address).

Sanctions screening must cover all parties: customer, beneficial owners, counterparties in payments, and vessel or aircraft identifiers where relevant.

Adverse media screening needs defined sources, relevance criteria (financial crime categories), and recency rules to avoid noise.

Detection scenarios for trade finance include dual-use goods, price or quantity anomalies, and mismatched shipping documents versus declared goods.

Sanctions lists are jurisdiction-specific (e.g., UN, OFAC SDN, EU consolidated, UK OFSI); an entity must apply the lists binding on it and any it voluntarily adopts.

Asset freeze obligations are immediate and strict-liability in many regimes; dealing with a designated person can be a breach even without intent.

50 percent rule (US OFAC): entities owned 50% or more, directly or indirectly, by one or more blocked persons are themselves treated as blocked.

Sectoral sanctions restrict specific transactions (e.g., debt or equity, certain services) rather than freezing all assets of the target.

PEP categories: foreign, domestic, and international organization PEPs; family members and close associates are treated as PEPs for risk purposes.

PEP status is time-limited in some regimes (commonly 12-18 months after leaving office) but risk-based monitoring may continue beyond that period.

Proliferation financing risk indicators: dual-use goods, front companies, unusual shipping routes, vague end-use documentation, and payments routed through unrelated third parties.

PF differs from ML and TF in objective (weapons of mass destruction proliferation) and is addressed through targeted financial sanctions and export-control awareness.

Sanctions risk assessment should cover customer, product, channel, geography, and the institution's exposure to high-risk trade and payment corridors.

Suspicious activity reporting is typically triggered by knowledge, suspicion, or reasonable grounds to suspect; the threshold is suspicion, not proof.

Internal escalation timelines are set in policy (e.g., analyst to AML officer within defined hours); delays are a documented control failure.

STR/SAR content should cover who, what, when, where, why suspicious, and the supporting transaction detail; conclusions must be traceable to evidence.

Tipping-off prohibitions bar disclosing a report or its contents to the customer or third parties except where law permits.

Defensive filing (reporting without genuine suspicion to avoid scrutiny) is a supervisory concern and undermines report quality.

Investigation files must document the alert, enrichment performed, decision, approver, and date; regulators assess the rationale, not just the outcome.

Law enforcement and regulator information requests require defined intake, verification of authority, and response tracking.

Cross-border reporting obligations may require filing in multiple jurisdictions; assess each regime's trigger separately.

Post-investigation feedback loops should update typologies, thresholds, and CDD triggers when a case reveals a control gap.

Control types: preventive (CDD, screening, limits), detective (monitoring, reconciliation), and corrective (escalation, exit, remediation).

Control testing distinguishes design effectiveness (is the control capable of mitigating the risk) from operating effectiveness (did it work over the period).

Sample-based testing requires documented population, sample size rationale, selection method, and exception rate thresholds.

Key risk indicators: overdue CDD percentage, alert backlog age, screening false-positive rate, training completion, and unresolved audit findings.

Independent testing (audit or external review) should cover all four pillars and report to the board or its committee.

Remediation plans need owners, due dates, and verification of closure; repeat findings signal governance weakness.

Customer exit and account restriction are mitigation tools but must follow documented policy, legal review, and recordkeeping.

Control mapping links each identified risk to at least one control; unmapped risks are gaps requiring treatment decisions.

Third-party and agent oversight requires due diligence, contractual AML obligations, and periodic monitoring of performance.

Model risk management lifecycle: inventory, development documentation, independent validation, ongoing monitoring, change control, and decommissioning.

Data lineage must show the source system, transformation, and consumption point for KYC, transaction, and screening data used in decisions.

Data quality dimensions for AML: completeness, accuracy, timeliness, consistency, and uniqueness of customer and transaction records.

Common data defects: missing nationality or date of birth, duplicate customer records, stale risk ratings, unmapped transaction codes, and truncated payment fields.

AI/ML monitoring models require explainability, bias and drift testing, and human review of dispositions; opaque outputs complicate regulatory defensibility.

Automated decisioning must retain the inputs and rule version used at the time of decision to support later reconstruction.

Screening and monitoring system changes require regression testing to confirm prior detection capability is preserved.

Payment message standards (e.g., ISO 20022) improve data granularity; missing or unstructured fields degrade screening and monitoring effectiveness.

Model performance metrics include alert precision, recall against known cases, false-positive rate, and coverage of the customer base.

Trade-based money laundering indicators: over- or under-invoicing, misdescribed goods, phantom shipments, and repeated round-value transactions.

Virtual assets: mixers and tumblers, privacy coins, unhosted wallets, and cross-chain bridges raise layering and anonymity risk; the travel rule requires originator and beneficiary information transfer.

Shell company and trust abuse: rapid ownership changes, nominal capital, no physical presence, and jurisdictions with limited ownership transparency.

Human trafficking and modern slavery typologies: multiple unrelated workers sharing addresses, wage payments routed to a single account, and unusual labor-recruitment payments.

Environmental crime and illegal wildlife trade generate proceeds moved through trade finance and shell entities in high-biodiversity jurisdictions.

Fraud-to-laundering chains: authorized push payment fraud, mule accounts, and rapid dispersal through layered accounts and crypto off-ramps.

Real estate and cash-intensive businesses remain high-risk for placement; look for third-party payments, rapid resale, and mismatched buyer profiles.

Correspondent banking and nested relationships create indirect exposure; de-risking without analysis can push activity to less supervised channels.

Typology awareness should be refreshed from FATF, FSRB, and national FIU publications and mapped to monitoring scenarios.

Risk-based approach: allocate the most resources to the highest residual risk; document the rationale for every risk-based decision.

Four pillars: internal controls, compliance officer, training, independent testing - each is testable as a governance question.

CDD is the foundation: identification, verification, beneficial ownership, purpose and intended nature, ongoing monitoring.

EDD adds depth, not just a higher rating: source of wealth, source of funds, senior approval, enhanced monitoring.

Suspicion, not proof, is the reporting threshold; tipping-off rules restrict disclosure.

Sanctions obligations are strict-liability in many regimes; screen all parties and re-screen on list updates.

Model and data risk: undocumented thresholds, stale data, and untested changes are recurring findings.

Typologies evolve: virtual assets, trade-based laundering, and shell structures are frequent exam themes.

Recordkeeping: retain CDD and transaction records at least five years after relationship end or transaction date.

PEP treatment: senior management approval, source of wealth, enhanced monitoring, and time-limited status in some regimes.

Beneficial ownership threshold is commonly 25%; control-based test applies when no one meets it.

Residual risk requires a documented control-effectiveness basis; ratings without evidence are unsupported.

Alert disposition requires documented rationale and retained analysis; closure without evidence is a control failure.

Independent testing covers all four pillars and reports to the board or its committee.

Risk appetite needs quantitative tolerances, not only qualitative statements.

Remediation plans require owners, due dates, and verified closure; repeat findings indicate governance weakness.

Trade finance red flags: dual-use goods, price or quantity anomalies, mismatched documents, and unusual shipping routes.

Virtual asset travel rule requires originator and beneficiary information transfer between institutions.

Correspondent banking creates indirect exposure through nested relationships; assess downstream respondents.

De-risking without analysis can push activity to less supervised channels; document the decision.

STR/SAR content should cover who, what, when, where, why suspicious, and supporting transaction detail.

Control testing distinguishes design effectiveness from operating effectiveness; both are required.

Key risk indicators include overdue CDD percentage, alert backlog age, and screening false-positive rate.

Training must be role-specific and refreshed; completion rates are a measurable indicator.

Screening matching uses fuzzy algorithms with configurable thresholds; document the identifiers used to clear a hit.

Event-driven re-screening is required when lists change, not only at periodic review.

Adverse media screening needs defined sources, relevance criteria, and recency rules.

Proliferation financing risk indicators include dual-use goods, front companies, and vague end-use documentation.

Sectoral sanctions restrict specific transactions rather than freezing all assets of the target.

The 50 percent rule treats entities owned 50% or more by blocked persons as blocked.

Model validation must be independent of development and documented before deployment.

Data lineage must show source, transformation, and consumption for KYC, transaction, and screening data.