I85PREP
⌘ K
CAMS-RM study materials
CAMS-RM study resources

CAMS-RM practice questions

One question at a time. Build your CAMS-RM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AML/CFT Risk Management Fundamentals and Governance

A CAMS-RM candidate is reviewing how an institution's AML/CFT programme is structured. Which statement best describes the relationship between risk management and governance under a risk-based approach?

  1. Governance is the responsibility of the compliance officer alone, while risk management sits with the business units
  2. Risk management is a back-office control function while governance is limited to the annual audit opinion
  3. Risk management and governance are separate disciplines that should not share information to preserve independence
  4. Risk management identifies and measures exposure while governance sets accountability, oversight and reporting lines for those risks Correct answer.

Explanation

A risk-based AML/CFT framework pairs the analytical work of identifying, assessing and mitigating risk with a governance layer that assigns ownership, oversight and escalation duties. Governance without risk measurement is hollow, and risk management without clear accountability fails in practice. The two must be integrated and driven from the top of the organisation.

Question 2AML/CFT Risk Management Fundamentals and Governance

Which element is the clearest example of the 'tone from the top' component of AML/CFT governance?

  1. The front office using an automated screening tool for onboarding
  2. The compliance team completing annual training modules before the deadline
  3. The board approving the AML/CFT policy and holding senior management accountable for its execution Correct answer.
  4. The internal audit function sampling a subset of customer files each quarter

Explanation

Tone from the top refers to the visible commitment of the board and senior management, expressed through approving policies, allocating resources and enforcing accountability. Operational activities such as training, audit sampling and screening are downstream controls that reflect that commitment. The governing body's own actions define the culture.

Question 3AML/CFT Risk Management Fundamentals and Governance

An institution's board delegates day-to-day AML/CFT oversight to a committee. Which arrangement best preserves effective governance?

  1. The committee reports to the board with defined authority, escalation thresholds and regular risk reporting Correct answer.
  2. The committee's decisions are ratified automatically by the board without review to save time
  3. The committee is chaired by the same person as the internal audit function to ensure independence
  4. The committee operates independently and informs the board only when a regulator requests information

Explanation

Delegation is acceptable when authority, reporting lines, escalation triggers and information flow back to the board are clearly defined. The board retains ultimate accountability and must receive sufficient risk information to exercise oversight. Automatic ratification or silence defeats the purpose of delegation.

Question 4AML/CFT Risk Management Fundamentals and Governance

Under a risk-based approach, which factor most directly justifies enhanced due diligence for a particular customer relationship?

  1. The customer requests paper statements rather than electronic delivery
  2. The relationship generates lower fee income than the branch average
  3. The customer has been with the institution for less than twelve months
  4. The customer's profile presents higher money laundering or terrorist financing risk based on assessed factors Correct answer.

Explanation

The risk-based approach requires measures proportionate to assessed risk, so enhanced due diligence is triggered by higher ML/TF risk arising from customer, product, geographic or delivery channel factors. Tenure, statement preference and fee income are not risk drivers in themselves. Proportionality is the organising principle.

Question 5AML/CFT Risk Management Fundamentals and Governance

An AML/CFT risk assessment identifies that a new product allows anonymous transfers across borders. What is the most appropriate governance response?

  1. Defer the decision to the branch staff who will sell the product
  2. Escalate the residual risk to the appropriate committee and decide whether to mitigate, restrict or reject the product Correct answer.
  3. Apply standard due diligence unchanged because the product is new to the market
  4. Proceed with launch because the product has already passed the technology review

Explanation

When a risk assessment reveals elevated residual risk that exceeds the institution's appetite, governance requires escalation to a body with authority to accept, mitigate, restrict or reject the activity. Technology review does not address ML/TF risk, and standard measures are not proportionate to an anonymous cross-border channel. Decisions on risk acceptance belong with accountable senior bodies.

Question 6AML/CFT Risk Management Fundamentals and Governance

Which statement correctly distinguishes inherent risk from residual risk in an AML/CFT risk assessment?

  1. Inherent risk applies only to customers, while residual risk applies only to products
  2. Inherent risk is measured after controls, while residual risk is measured before controls
  3. Inherent risk is set by the regulator, while residual risk is set by the board
  4. Inherent risk exists before controls, while residual risk remains after controls are applied Correct answer.

Explanation

Inherent risk is the level of risk exposure before any mitigating controls are considered, and residual risk is what remains once those controls operate. Comparing the two shows how effective the control environment is. Both concepts apply across customers, products, channels and geographies.

Question 7AML/CFT Risk Management Fundamentals and Governance

A compliance officer finds that a business line consistently overrides automated alerts without documented rationale. Which governance weakness does this most directly indicate?

  1. Inadequate alert disposition standards and weak quality assurance over first-line judgement Correct answer.
  2. Excessive reliance on manual review rather than automated monitoring
  3. An overly conservative customer risk rating methodology
  4. Insufficient transaction monitoring system coverage

Explanation

Undocumented overrides point to a breakdown in the standards and oversight governing how alerts are closed, and to weak quality assurance over that judgement. The monitoring system may be generating alerts correctly; the failure is in disposition governance. Documented rationale and independent testing are the expected controls.

Question 8AML/CFT Risk Management Fundamentals and Governance

Which body typically holds ultimate accountability for an institution's AML/CFT programme?

  1. The front-line relationship managers
  2. The board of directors Correct answer.
  3. The internal audit committee
  4. The external auditor

Explanation

Ultimate accountability for the AML/CFT programme rests with the board of directors, which approves policy, sets risk appetite and oversees senior management. Internal audit and external auditors provide independent assurance but do not own the programme. Front-line staff own risk within their activities but do not hold institutional accountability.

Question 9AML/CFT Risk Management Fundamentals and Governance

An institution's enterprise-wide ML/TF risk assessment is three years old and no refresh has been scheduled. Why does this represent a governance deficiency?

  1. Risk assessments only need refreshing when a regulator issues a formal enforcement action
  2. Risk assessments are refreshed only when the compliance officer changes role
  3. Risk assessments are valid indefinitely once approved by the board
  4. Risk assessments must be kept current so that changes in products, customers, geographies and threats are reflected in controls Correct answer.

Explanation

A risk assessment is a living document that must be updated as the business, customer base, geographies and threat environment change. A stale assessment means controls may no longer be proportionate to actual risk. Governance should set a review cycle and trigger-based refreshes.

Question 10AML/CFT Risk Management Fundamentals and Governance

Which of the following best reflects the three lines of defence model in AML/CFT governance?

  1. Regulators own risk, compliance monitors, and audit enforces
  2. Business units own and manage risk, compliance provides oversight and guidance, and internal audit provides independent assurance Correct answer.
  3. Compliance owns all risk, business units execute instructions, and audit approves policy
  4. Internal audit owns risk, compliance performs testing, and business units provide assurance

Explanation

In the three lines model the first line, the business, owns and manages risk; the second line, compliance, sets frameworks and provides oversight and challenge; the third line, internal audit, gives independent assurance to the board. This separation prevents both ownership vacuums and conflicts of interest. Regulators supervise but do not own institutional risk.

Question 11AML/CFT Risk Management Fundamentals and Governance

A country is added to a list of jurisdictions with strategic AML/CFT deficiencies. How should governance respond to this change?

  1. Immediately exit all relationships connected to the country without further analysis
  2. Update the geographic risk assessment and consider whether enhanced measures are warranted for affected relationships Correct answer.
  3. Take no action until the institution's own regulator issues a specific direction
  4. Apply the change only to new customers and leave existing relationships untouched

Explanation

Changes in the external threat environment should feed into the institution's risk assessment, prompting a review of geographic risk and proportionate enhanced measures. Automatic mass exit without analysis is neither required nor necessarily effective, and ignoring the change until directed is not risk-based. Existing relationships must also be reconsidered.

Question 12AML/CFT Risk Management Fundamentals and Governance

Which control is most characteristic of the second line of defence in an AML/CFT framework?

  1. Approving a high-risk customer relationship at the branch level
  2. Conducting the annual external audit of financial statements
  3. Onboarding a new customer and verifying identity documents
  4. Independent testing of first-line adherence to the AML/CFT policy by the compliance function Correct answer.

Explanation

The second line, typically compliance, provides oversight through monitoring and independent testing of whether the first line adheres to policy and procedures. Onboarding and branch-level approvals are first-line activities, and the external audit of financial statements is not an AML/CFT second-line control.

Question 13AML/CFT Risk Management Fundamentals and Governance

An institution's AML/CFT policy states that risk appetite is 'low' but provides no metrics or thresholds. What is the primary governance weakness?

  1. The policy is written in language that is too technical for staff to understand
  2. The risk appetite statement is not operationalised into measurable limits and escalation triggers Correct answer.
  3. The policy has been approved by the board rather than by the compliance officer
  4. The policy covers too many business lines at once

Explanation

A risk appetite statement only becomes meaningful when translated into metrics, thresholds and escalation triggers that allow the institution to detect when it is operating outside appetite. Without operationalisation it is aspirational language rather than a governance tool. Board approval is correct and desirable.

Question 14AML/CFT Risk Management Fundamentals and Governance

Which practice best demonstrates independent oversight of the AML/CFT programme?

  1. Senior management signing off on the policy without supporting analysis
  2. Internal audit reporting its findings directly to the board or its audit committee Correct answer.
  3. The business line approving its own risk assessment without challenge
  4. The compliance officer reviewing their own team's monitoring output

Explanation

Independence requires that assurance on the programme be performed by a function free from the activities it reviews and able to report to the board or audit committee. Self-review by compliance, self-approval by the business and sign-off without analysis all lack the necessary objectivity and challenge.

Question 15AML/CFT Risk Management Fundamentals and Governance

A senior manager wants to exempt a profitable client segment from standard monitoring to reduce costs. What governance principle should guide the decision?

  1. The senior manager may grant the exemption because of their profit responsibility
  2. Exemptions are acceptable provided the client segment is large enough
  3. Monitoring can be waived for any segment if the compliance budget is constrained
  4. Exemptions must be consistent with the approved risk appetite and documented with rationale and approval at the appropriate level Correct answer.

Explanation

Any departure from the standard control framework must be justified against the approved risk appetite, documented, and approved by a body with the authority to accept the resulting risk. Profit responsibility does not confer authority to waive AML/CFT controls, and cost pressure is not a valid basis for reducing monitoring.

Question 16AML/CFT Risk Management Fundamentals and Governance

Which statement about the role of the money laundering reporting officer (MLRO) is most accurate?

  1. The MLRO is responsible for the institution's financial performance
  2. The MLRO receives and evaluates internal suspicious activity reports and decides whether to submit to the authorities Correct answer.
  3. The MLRO approves the institution's annual financial statements
  4. The MLRO personally investigates every alert generated by the monitoring system

Explanation

The MLRO acts as the central point for receiving internal reports, evaluating them and determining whether an external report to the financial intelligence unit is required. This is a decision-making and oversight role, not personal investigation of every alert, and it is unrelated to financial performance or financial statement approval.

Question 17AML/CFT Risk Management Fundamentals and Governance

An institution's AML/CFT training programme consists of a single generic module completed at induction only. Which improvement is most aligned with risk-based governance?

  1. Tailor training to role-specific risks and refresh it periodically with testing of understanding Correct answer.
  2. Extend the induction module by an additional hour for all staff
  3. Restrict training to compliance staff only
  4. Replace training with a signed acknowledgement of the policy

Explanation

Effective training is proportionate to role and risk, delivered periodically, and includes assessment of whether staff understand their obligations. A longer generic module, a mere acknowledgement or training confined to compliance does not build the capability the risk-based approach requires. Governance should also track completion and effectiveness.

Question 18AML/CFT Risk Management Fundamentals and Governance

What is the primary purpose of an independent AML/CFT programme review?

  1. To prepare the institution's tax filings
  2. To replace the need for ongoing transaction monitoring
  3. To approve new customer relationships before onboarding
  4. To assess whether the programme as designed and operated is effective and compliant, and to report findings to governance Correct answer.

Explanation

An independent review tests the design and operating effectiveness of the AML/CFT programme and reports conclusions to the board or its committee so that remediation can be directed. It complements, but does not replace, ongoing monitoring, and it has no role in tax filing or individual onboarding decisions.

Question 19AML/CFT Risk Management Fundamentals and Governance

A board member argues that AML/CFT is purely a compliance cost with no strategic value. Which response best reflects current governance thinking?

  1. AML/CFT is a regulatory formality that can be delegated entirely to external counsel
  2. Effective AML/CFT governance protects the institution's reputation, licence to operate and access to the financial system Correct answer.
  3. AML/CFT value is limited to avoiding fines and has no other benefit
  4. AML/CFT only matters for banks and has no relevance to other financial institutions

Explanation

Sound AML/CFT governance protects the institution's reputation, regulatory standing and continued access to correspondent and payment networks, and it supports sound risk culture. It applies across financial sectors, cannot be outsourced wholesale, and its value extends well beyond fine avoidance. Framing it as purely a cost misreads its strategic role.

Question 20AML/CFT Risk Management Fundamentals and Governance

Which situation most clearly indicates a weak risk culture within an AML/CFT framework?

  1. Staff receive role-specific training and are tested on it
  2. Senior management regularly discusses AML/CFT risk at committee meetings
  3. Escalations are logged, tracked and reported to the board
  4. Staff are discouraged from escalating concerns and are told that compliance slows down business Correct answer.

Explanation

A risk culture that penalises escalation and frames compliance as an obstacle suppresses the reporting behaviour on which the framework depends. Visible senior discussion, effective training and tracked escalation with board reporting are all indicators of a healthy culture. The contrast is between suppression and encouragement of challenge.

Question 21AML/CFT Risk Management Fundamentals and Governance

An institution outsources its transaction monitoring to a third-party provider. Which governance responsibility remains with the institution?

  1. Transferring all AML/CFT accountability to the provider under the contract
  2. Reducing its own monitoring oversight because the provider is a specialist
  3. Relying on the provider's own regulatory registration as sufficient assurance
  4. Overseeing the provider's performance and retaining accountability for the effectiveness of the control Correct answer.

Explanation

Outsourcing a control does not outsource accountability; the institution must oversee provider performance, test effectiveness and retain responsibility to its regulator. Contractual transfer of accountability, reliance on the provider's registration or reduced oversight all leave the institution exposed. Governance must include due diligence and ongoing monitoring of the provider.

Question 22AML/CFT Risk Management Fundamentals and Governance

Which metric would be most useful to a board committee monitoring the effectiveness of the AML/CFT programme?

  1. The number of employees in the compliance department
  2. The total value of transactions processed each month
  3. The proportion of alerts closed within defined timeframes with documented rationale Correct answer.
  4. The number of branches opened during the year

Explanation

Effective governance reporting uses metrics that reflect control performance, such as timely alert disposition with documented rationale, quality assurance results and overdue remediation. Headcount, transaction volume and branch expansion are activity or business measures and do not by themselves indicate whether AML/CFT controls are working.

Question 23AML/CFT Risk Management Fundamentals and Governance

A risk assessment finds that a private banking product attracts politically exposed persons. What governance action is most appropriate?

  1. Treat the product as standard because PEPs are common in private banking
  2. Apply enhanced due diligence and senior management approval consistent with the assessed higher risk Correct answer.
  3. Rely on the customer's self-declaration of PEP status without verification
  4. Exclude the product from the enterprise risk assessment

Explanation

PEPs present higher ML/TF risk, so the risk-based approach requires enhanced due diligence and, where applicable, senior management approval of the relationship. Familiarity with a segment does not lower the required standard, self-declaration is not sufficient verification, and excluding a product from the risk assessment removes it from governance oversight.

Question 24AML/CFT Risk Management Fundamentals and Governance

Which statement best explains why an institution's AML/CFT governance framework should include defined escalation paths?

  1. Escalation paths replace the need for documented policies and procedures
  2. Escalation paths are required only when a regulator is on site
  3. Escalation paths ensure higher-risk matters reach decision-makers with authority to act within set timeframes Correct answer.
  4. Escalation paths exist mainly to document staff grievances about workload

Explanation

Defined escalation paths route higher-risk matters, such as unusual activity or risk appetite breaches, to decision-makers with the authority to act, within timeframes that limit exposure. They are not a grievance mechanism, are not limited to examinations, and complement rather than replace documented policies. Clear escalation is a core governance control.

Question 25AML/CFT Risk Management Fundamentals and Governance

An institution's risk assessment rates a jurisdiction as low risk, but subsequent typology reports show significant laundering activity there. What is the most appropriate governance response?

  1. Maintain the low rating because it was approved at the last annual review
  2. Increase monitoring only for customers who voluntarily disclose the connection
  3. Wait for the regulator to issue a formal country notice before acting
  4. Reassess the jurisdiction's rating using the new information and adjust controls accordingly Correct answer.

Explanation

Risk assessments must respond to new information such as typology reports; a rating is a judgement that can and should be revised when evidence changes. Maintaining a stale rating, limiting action to voluntary disclosure or waiting for a formal notice all leave the institution exposed to known risk. Governance should build in trigger-based reassessment.

Question 26AML/CFT Risk Management Fundamentals and Governance

Which element is the foundation of an AML/CFT governance framework because it defines the institution's tolerance for money laundering and terrorist financing exposure?

  1. The risk appetite statement approved by senior management Correct answer.
  2. The internal audit work plan
  3. The transaction monitoring system vendor contract
  4. The customer onboarding questionnaire

Explanation

A risk appetite statement articulates how much ML/TF risk the institution is willing to accept, which then drives policies, controls, and monitoring thresholds. Without it, controls lack a benchmark for calibrating resources and escalation. It is a governance instrument approved at senior level.

Question 27AML/CFT Risk Management Fundamentals and Governance

Under a risk-based approach, which factor most directly justifies enhanced due diligence for a new corporate customer?

  1. The customer has maintained the account for more than five years
  2. The customer prefers to receive statements by email
  3. The customer operates through a complex ownership structure spanning several jurisdictions Correct answer.
  4. The customer's account balance is below the institution's average

Explanation

Complex multi-jurisdictional ownership structures obscure beneficial ownership and raise ML/TF risk, which under a risk-based approach triggers enhanced due diligence. Duration of relationship, communication preferences, and low balances are not risk escalators in themselves. The risk-based approach requires measures proportionate to identified risk.

Question 28AML/CFT Risk Management Fundamentals and Governance

An institution's board delegates AML/CFT oversight to a compliance committee but retains no reporting line and sets no review cadence. Which governance weakness does this create?

  1. Second-line testing becomes legally prohibited
  2. The institution automatically breaches customer due diligence rules
  3. Accountability becomes diffuse and the board cannot exercise informed oversight Correct answer.
  4. The committee gains excessive authority over the MLRO

Explanation

Delegation without reporting lines or a review cadence leaves the board unable to assess whether the programme is effective, weakening accountability. Governance requires that delegated oversight remain visible and answerable to the board. Regulatory expectations place ultimate responsibility at the top even when execution is delegated.

Question 29AML/CFT Risk Management Fundamentals and Governance

A compliance function is asked to design the controls it will later test, and the same team performs both activities. Which governance principle does this arrangement most directly compromise?

  1. The need to obtain board approval for each new customer
  2. The prohibition on sharing data across business units
  3. The requirement to file suspicious transaction reports within 24 hours
  4. Segregation between control ownership and independent assurance Correct answer.

Explanation

Effective governance separates those who design and operate controls from those who independently assure them, so that testing is objective. Combining both roles in one team reduces the credibility of assurance. Independence is a core expectation in AML/CFT programme design.

Question 30AML/CFT Risk Management Fundamentals and Governance

A group operates in multiple jurisdictions with differing AML/CFT standards. Group policy applies the strictest applicable requirement worldwide, but a local subsidiary reports that host-country law prohibits sharing certain customer data with the parent. What is the most appropriate governance response?

  1. Assess the legal conflict formally, document the residual risk, and define alternative information-sharing or escalation arrangements Correct answer.
  2. Terminate all business in the affected jurisdiction immediately
  3. Instruct the subsidiary to ignore local law because group policy prevails
  4. Allow the subsidiary to apply only local standards with no further action

Explanation

Where group standards and local law conflict, governance requires a documented risk assessment and workable alternatives, such as localised monitoring or escalation to senior management. Simply overriding local law or silently accepting lower standards leaves unmanaged risk. The strictest-rule principle must be reconciled with legal constraints through structured decision-making.

Question 31Risk Identification, Assessment and Risk Appetite

A compliance officer is documenting the firm's risk appetite for money laundering risk. Which statement best expresses a risk appetite that is specific and actionable for the AML program?

  1. The firm aims to comply with applicable laws and regulations at all times.
  2. The firm prefers to avoid all risk wherever possible in its operations.
  3. The firm has a low tolerance for residual ML risk and will exit customers whose residual risk remains high after standard controls. Correct answer.
  4. The firm accepts moderate risk in most business lines subject to management discretion.

Explanation

A usable risk appetite statement names the risk type, the level of residual risk tolerated, and the consequence when that level is exceeded, such as exiting or declining the relationship. Generic statements about avoiding risk or complying with law do not set a measurable boundary that the AML program can operationalize.

Question 32Risk Identification, Assessment and Risk Appetite

Which element is essential when translating an enterprise-level risk appetite into AML risk assessment at the business-unit level?

  1. A roster of the firm's external auditors and their engagement history
  2. A schedule of when each policy document was last reviewed
  3. A mapping of inherent risk categories to the tolerance thresholds set by senior management Correct answer.
  4. A list of every regulation the firm is subject to in each jurisdiction

Explanation

Cascading appetite requires linking the categories used in the enterprise assessment to explicit tolerance thresholds so business units know when risk exceeds what is acceptable. Regulatory inventories, review schedules, and auditor rosters support governance but do not themselves translate appetite into assessment criteria.

Question 33Risk Identification, Assessment and Risk Appetite

During a customer risk assessment, a relationship manager wants to lower a customer's risk rating because the customer has been with the firm for many years. What is the most appropriate response under a sound risk-based approach?

  1. Escalate the request to the board risk committee for a final decision.
  2. Reassess the underlying risk factors and document any change with supporting evidence rather than adjusting the rating for tenure alone. Correct answer.
  3. Approve the downgrade because long tenure is a recognized mitigating factor in most methodologies.
  4. Reject any change to the rating once it has been assigned at onboarding.

Explanation

Risk ratings must reflect the actual risk factors, such as country, product, channel, and customer profile, supported by documented evidence. Tenure by itself is not a risk mitigant, but a reassessment is appropriate if the underlying factors have genuinely changed.

Question 34Risk Identification, Assessment and Risk Appetite

In an enterprise-wide ML risk assessment, which combination best represents inherent risk inputs?

  1. Customer base, products and services, delivery channels, and geographic exposure Correct answer.
  2. Staff training completion, code of conduct attestations, and turnover rates
  3. Board minutes, committee charters, and delegation of authority
  4. Control testing results, audit findings, and remediation status

Explanation

Inherent risk is assessed before controls and is driven by the nature of the business: who the customers are, what products are offered, how they are delivered, and where the firm operates. Control effectiveness, governance documents, and training metrics inform residual risk or control environment, not inherent risk.

Question 35Risk Identification, Assessment and Risk Appetite

A firm's residual risk exceeds its stated appetite in the correspondent banking unit. Which action is most consistent with a functioning risk appetite framework?

  1. Automatically terminate all correspondent banking relationships without analysis.
  2. Continue operations unchanged because the appetite statement is aspirational.
  3. Escalate to senior management with a remediation plan and defined timeline, or reduce the activity. Correct answer.
  4. Adjust the residual risk score downward so that it falls within appetite.

Explanation

When residual risk breaches appetite, the framework should trigger escalation, a documented remediation plan, or a decision to reduce or exit the activity. Ignoring the breach or manipulating the score defeats the purpose of the appetite statement, and indiscriminate termination is not risk-based.

Question 36Risk Identification, Assessment and Risk Appetite

Which statement accurately describes the relationship between the institutional ML risk assessment and individual customer risk assessments?

  1. The institutional assessment is performed only by internal audit, independent of customer data.
  2. The two assessments are interchangeable and one can substitute for the other.
  3. Customer assessments must be completed before the institutional assessment can begin.
  4. The institutional assessment identifies where ML risk concentrates across the business, while customer assessments rate individual relationships. Correct answer.

Explanation

The institutional risk assessment operates at the enterprise level to identify higher-risk segments and allocate resources, while customer risk assessments evaluate each relationship. They are complementary and feed each other, but neither replaces the other.

Question 37Risk Identification, Assessment and Risk Appetite

A new product allows customers to fund accounts through a third-party payment aggregator with limited transparency on the underlying payer. How should this be treated in the risk assessment?

  1. Assign the same rating as existing payment products without adjustment.
  2. Treat the product as low risk because the aggregator is a regulated entity.
  3. Identify the channel as a higher inherent risk factor and assess whether controls adequately mitigate the reduced transparency. Correct answer.
  4. Defer any assessment until the product has been live for a full year.

Explanation

Third-party payment channels with limited visibility into the underlying payer increase anonymity and are a recognized higher-risk channel. The assessment should raise inherent risk and then evaluate whether controls, such as payer transparency requirements, sufficiently mitigate it.

Question 38Risk Identification, Assessment and Risk Appetite

Which risk appetite metric is most meaningful for monitoring ML risk on an ongoing basis?

  1. Total number of customer complaints received in the quarter
  2. Percentage of high-risk customers whose periodic reviews are overdue Correct answer.
  3. Number of employees who completed annual AML training
  4. Average length of time a customer has banked with the firm

Explanation

An effective appetite metric is a leading indicator tied directly to ML risk exposure and control performance, such as overdue reviews for high-risk customers. Training completion, complaints, and tenure may inform governance but do not measure ML risk against appetite.

Question 39Risk Identification, Assessment and Risk Appetite

A jurisdiction is added to a list of countries with strategic AML deficiencies. How should this affect the firm's risk assessment for customers with ties to that jurisdiction?

  1. Apply enhanced due diligence only to customers who are nationals of that country.
  2. Reassess affected customers and consider enhanced measures or exit where residual risk exceeds appetite. Correct answer.
  3. Immediately close all accounts linked to the jurisdiction without individual review.
  4. Maintain existing ratings because the list is advisory and non-binding.

Explanation

A change in a jurisdiction's status is a trigger event that should prompt reassessment of affected relationships against the firm's appetite. Enhanced measures should be applied based on actual nexus to the jurisdiction, and exit decisions should follow individual risk assessment rather than blanket closure.

Question 40Risk Identification, Assessment and Risk Appetite

What is the primary purpose of a risk assessment methodology that scores inherent risk and control effectiveness separately?

  1. To distinguish the risk the business presents from the degree to which controls reduce it, enabling targeted remediation Correct answer.
  2. To reduce the number of customers requiring due diligence
  3. To ensure every customer receives an identical risk rating
  4. To eliminate the need for periodic review of customer files

Explanation

Separating inherent risk from control effectiveness shows whether a high residual rating stems from the business itself or from weak controls, which directs remediation appropriately. It does not homogenize ratings, reduce due diligence, or remove the need for ongoing review.

Question 41Risk Identification, Assessment and Risk Appetite

A private banking unit serves politically exposed persons and clients with complex offshore structures. Which assessment approach best reflects a risk-based methodology?

  1. Apply standard due diligence uniformly because all private banking clients are high net worth.
  2. Weight source of wealth, structure complexity, and PEP status as higher-risk factors and calibrate due diligence accordingly. Correct answer.
  3. Base the rating solely on the size of the client's assets under management.
  4. Rate all private banking clients as high risk regardless of individual characteristics.

Explanation

A risk-based approach identifies specific factors that raise risk, such as PEP status, opaque ownership structures, and unclear source of wealth, and calibrates controls to them. Uniform treatment or rating based only on asset size ignores meaningful differences among clients.

Question 42Risk Identification, Assessment and Risk Appetite

Which of the following best describes the concept of risk tolerance in the context of an AML program?

  1. The proportion of the compliance budget allocated to technology
  2. The maximum level of residual risk the firm is willing to accept in pursuit of its objectives Correct answer.
  3. The minimum number of alerts the monitoring system must generate each month
  4. The number of jurisdictions in which the firm is licensed to operate

Explanation

Risk tolerance defines the acceptable amount of residual risk after controls, expressed as a boundary for decision-making. Alert volumes, budget allocation, and licensing footprint are operational or structural facts, not statements of tolerated risk.

Question 43Risk Identification, Assessment and Risk Appetite

A firm identifies that its trade finance business carries elevated ML risk due to dual-use goods and complex documentary chains. What is the most appropriate next step in the risk assessment cycle?

  1. Quantify the exposure, evaluate the adequacy of existing controls, and determine whether residual risk is within appetite. Correct answer.
  2. Exclude trade finance from the institutional risk assessment because it is a niche business.
  3. Rely on the relationship manager's judgment alone to set the segment rating.
  4. Reduce monitoring for trade finance to free up resources for retail banking.

Explanation

Once a higher-risk segment is identified, the assessment should quantify exposure, test control adequacy, and compare residual risk with the stated appetite. Excluding the segment, relying on a single opinion, or reducing monitoring all undermine the assessment.

Question 44Risk Identification, Assessment and Risk Appetite

Which factor would most likely increase a customer's inherent risk score for money laundering?

  1. A mortgage with monthly payments from the same account
  2. Frequent cash deposits just below reporting thresholds Correct answer.
  3. A long-standing salary account with regular payroll credits
  4. A savings account with a stable balance and no activity

Explanation

Structured cash deposits below reporting thresholds are a classic indicator of layering and raise inherent risk. Salary accounts, mortgages, and dormant savings accounts show predictable, explainable activity that is generally lower risk.

Question 45Risk Identification, Assessment and Risk Appetite

A firm's risk appetite states zero tolerance for unverified beneficial ownership above a defined threshold. A business unit reports several exceptions. How should this be characterized?

  1. A matter for the marketing team to resolve with the affected customers
  2. A breach of a zero-tolerance appetite statement requiring immediate escalation and remediation Correct answer.
  3. A reason to raise the threshold so that the exceptions disappear
  4. An acceptable operational variance that can be addressed at the next annual review

Explanation

Zero-tolerance statements are absolute limits, and any exception is a breach requiring prompt escalation and remediation. Deferring to an annual review, assigning it to an unrelated function, or moving the threshold to mask exceptions all undermine the framework.

Question 46Risk Identification, Assessment and Risk Appetite

Which of the following best explains why an institution should document the rationale behind its risk assessment methodology?

  1. It demonstrates that ratings are derived from a consistent, defensible approach that supervisors and auditors can review. Correct answer.
  2. It guarantees that no customer will ever be misrated.
  3. It allows the firm to avoid filing suspicious activity reports.
  4. It removes the need to update the methodology when risks change.

Explanation

Documenting the methodology supports consistency, defensibility, and independent review by supervisors and auditors. It cannot guarantee perfect ratings, does not freeze the methodology, and has no bearing on reporting obligations.

Question 47Risk Identification, Assessment and Risk Appetite

A fintech acquires a portfolio of prepaid card customers. Which action best reflects integration of risk assessment during the acquisition?

  1. Assume the seller's risk ratings are accurate and adopt them without review.
  2. Apply the acquirer's ratings only to new customers onboarded after closing.
  3. Delay assessment until the first annual review cycle after closing.
  4. Assess the acquired portfolio's risk profile against the acquirer's appetite before and after closing. Correct answer.

Explanation

Acquired portfolios carry inherited ML risk, and the acquirer should assess that profile against its own appetite before and after closing. Relying on the seller's ratings, deferring assessment, or limiting review to new customers leaves inherited risk unmanaged.

Question 48Risk Identification, Assessment and Risk Appetite

Which statement about the use of quantitative and qualitative inputs in an ML risk assessment is most accurate?

  1. Quantitative data such as transaction volumes should be combined with qualitative judgments about control quality and typology exposure. Correct answer.
  2. Qualitative judgment should be discarded because it cannot be measured.
  3. Quantitative data alone is sufficient because numbers are objective.
  4. Neither input is reliable, so ratings should be based on examiner expectations.

Explanation

Sound assessments blend quantitative indicators with qualitative judgments about control design and emerging typologies. Discarding either input weakens the assessment, and basing ratings on perceived examiner expectations is not a risk-based method.

Question 49Risk Identification, Assessment and Risk Appetite

A board asks how the firm's ML risk appetite compares with its actual risk profile. Which report content best answers the question?

  1. Current residual risk by business line plotted against the approved appetite thresholds with breach status Correct answer.
  2. The number of suspicious activity reports filed in prior years without context
  3. A list of all AML policies with their effective dates
  4. A summary of the compliance department's organizational chart

Explanation

Comparing residual risk against approved thresholds with clear breach status directly answers whether the firm is operating within appetite. Policy lists, raw report counts, and org charts do not convey the risk position relative to tolerance.

Question 50Risk Identification, Assessment and Risk Appetite

Which scenario most clearly represents a control weakness that should raise residual risk in the assessment?

  1. The firm has adopted a written AML policy approved by the board.
  2. The firm conducts annual independent testing of its AML program.
  3. Customer due diligence files for high-risk clients are missing source of wealth documentation. Correct answer.
  4. The monitoring system generates alerts that analysts review daily.

Explanation

Missing source of wealth documentation for high-risk customers is a concrete control failure that increases residual risk. An approved policy, daily alert review, and independent testing are indicators of effective controls that would lower residual risk.