CAMS-RM common mistakes
CAMS-RM · Understand the traps and how to avoid them.
Treating risk appetite as a single firm-wide number and answering scenario questions with 'the bank should not accept the risk', instead of applying the documented tiered appetite (risk appetite statements, thresholds, and escalation triggers) to the specific customer or transaction.
Candidates memorise the definition of risk appetite but never practise applying it. Exam scenarios are usually written so that the correct answer is 'this exceeds appetite for this segment, so escalate/decline/exit', and a blanket refusal looks principled but ignores the tiering the question is testing.
What to do instead
Before the exam, build a one-page map of a typical three-tier appetite structure (low/standard/high risk segments, each with tolerance statements and escalation triggers). For every practice scenario, state explicitly which tier applies and which trigger fires. In the exam, look for the segment and threshold cues in the stem before choosing an answer.
Confusing the three lines of defence roles in governance questions, for example saying internal audit owns the AML programme, or that compliance performs first-line customer onboarding, or that the board should approve individual high-risk customers.
The functions overlap in real job titles, and candidates answer from their own organisation's org chart rather than the model the exam uses. The business (first line) owns risk and controls; compliance (second line) sets framework, advises, and challenges; internal audit (third line) provides independent assurance.
What to do instead
Memorise a three-column table: first line owns and operates controls, second line designs framework and provides independent challenge, third line gives independent assurance to the board. For each governance question, first name the line, then the accountability. Board-level answers should be about approving the framework and appetite, not individual cases.
Answering beneficial ownership questions by stopping at the first corporate layer or at the 25% threshold, and missing that control via other means (nominee arrangements, shareholder agreements, senior managing official) also creates beneficial ownership.
Candidates learn the percentage threshold as a single rule and apply it mechanically. Many exam items deliberately include a shareholder below the threshold who nonetheless controls the entity, or a chain of entities where the top-layer owner must be traced through.
What to do instead
Practise ownership-chain exercises: draw the layers, compute indirect percentages multiplicatively, and separately ask 'who actually directs this entity?'. Remember the fallback order: identify natural persons at or above the threshold, then those exercising control by other means, then the senior managing official only when no beneficial owner can be identified, with the rationale recorded.
Treating a PEP determination as permanent and binary, and failing to distinguish a PEP from an RCA (relative or close associate) and from a family member, or failing to apply risk-based ongoing EDD after the person leaves public office.
Candidates conflate 'PEP' with 'high risk forever' and forget the source-of-funds and source-of-wealth elements that EDD requires. Exam items often test whether you continue enhanced measures after the PEP role ends, and whether associates and family are in scope.
What to do instead
Learn a three-part checklist: (1) is the person a PEP, family member, or close associate? (2) what EDD is required - senior management approval, source of wealth and source of funds, enhanced ongoing monitoring? (3) when does the status change, and what risk-based step-down is documented? For every PEP scenario, name the source-of-wealth evidence explicitly, not just 'conduct EDD'.
Confusing sanctions screening with AML transaction monitoring and answering sanctions questions with AML concepts such as suspicious activity reporting thresholds, or expecting fuzzy name matching to be resolved by simply clearing the alert.
Both are 'screening' in everyday language, but sanctions are strict-liability, list-driven, and require blocking or rejecting rather than reporting a suspicion. Candidates who default to SAR/STR language lose marks on sanctions items.
What to do instead
Build a comparison table: sanctions screening is against designated lists, strict liability, outcome is block/freeze/reject and report to the competent authority; AML monitoring is behaviour-based, risk-based, outcome is investigate and file a suspicious report if suspicion exists. For each scenario, first ask 'is there a designated party?', then apply the sanctions workflow, including false-positive resolution and escalation before any dealing.
Choosing 'file a suspicious transaction report immediately' for every alert, instead of following the investigation and escalation sequence: alert triage, gather and document information, assess whether suspicion is formed, escalate to the MLRO or nominated officer, who then decides on reporting.
Candidates equate 'something looks odd' with 'report it', skipping the documented investigation and the role of the nominated officer. Exam items test the decision point and who owns it, and whether tipping-off prohibitions apply.
What to do instead
Memorise the escalation ladder: detection, triage and discount false positives, investigation with documented rationale, escalation to the MLRO or nominated officer, decision to report or not, record the decision. In scenario questions, identify who forms the suspicion and who decides to report. Never choose an answer where a front-line employee files directly without escalation.
Applying a single fixed threshold or rule to every customer when tuning or evaluating transaction monitoring, rather than segmenting by customer type, product, channel, and expected behaviour, and failing to document the rationale for threshold changes.
Candidates treat monitoring scenarios as 'set the threshold lower to catch more', ignoring false-positive burden, model risk, and the need for documented, approved tuning. Exam items test whether you understand segmentation, back-testing, and governance of rule changes.
What to do instead
For tuning questions, use a four-step answer: segment the population by risk and behaviour, set thresholds per segment based on data (above-the-line and below-the-line testing), measure detection and false-positive rates, and obtain documented approval with rationale and review date. Reject answers that propose blanket threshold changes without data or governance.
Answering data and model risk questions by focusing only on model accuracy, and ignoring data lineage, completeness, model validation independence, and the distinction between model owners and model validators.
Candidates from operations backgrounds think of models as IT tools. AML model risk requires governance: documented purpose, independent validation, ongoing performance monitoring, change control, and data quality controls upstream of the model.
What to do instead
Learn the model lifecycle: definition and inventory, development with documented assumptions, independent validation, approval, implementation with change control, ongoing monitoring and back-testing, periodic revalidation and retirement. For each question, ask whether the issue is data quality (lineage, completeness, timeliness) or model governance (validation independence, documentation, monitoring), and answer in those terms.
Describing emerging typologies with generic phrases ('crypto is risky', 'trade-based laundering involves over-invoicing') instead of naming the specific red flags and the control that detects them, such as structuring through mule accounts, funnel accounts, invoice mispricing with related parties, or layering through convertible virtual currency and mixers.
Candidates skim typology lists and memorise headlines. Exam items ask which indicator would appear in the data and which control would catch it, so generic risk statements do not score.
What to do instead
For each typology in the syllabus, write three lines: the mechanism, two observable red flags, and the detection control. Cover trade-based laundering (over/under-invoicing, phantom shipments, related-party trade), mule and funnel accounts, virtual assets and mixers, and structuring. In the exam, match the red flag in the stem to the mechanism before choosing the control.
Treating CDD as a one-off onboarding exercise and missing trigger events for refresh - a material change in customer behaviour, a change in ownership or control, a periodic review falling due, or an adverse media hit - and failing to apply enhanced measures when risk increases.
Onboarding checklists dominate training, so candidates associate CDD with account opening. Exam items test ongoing CDD, trigger-based review, and the requirement to update the risk rating when circumstances change.
What to do instead
Memorise the CDD lifecycle: identify and verify, assess risk, approve at the right level, monitor, and refresh on trigger or schedule. For each scenario, ask 'what event should have triggered a review, and what should the review have done?'. Answer with the trigger, the required action, and the approval level, rather than just 'update KYC'.