CAMS-RM study plan

Map the four pillars of an AML/CFT program (policies and procedures, designated compliance officer, training, independent testing) to the exam's governance objectives and write a one-page outline for each

Distinguish the roles of the board, senior management, the MLRO/compliance officer, and the first and second lines of defense, and draft a RACI matrix showing who owns each AML decision

Explain the risk-based approach in your own words, including how customer, product, channel, geographic, and delivery-channel factors combine into an institutional risk assessment

Summarize the FATF Recommendations that anchor governance expectations (notably Recommendations 1, 18, and 26-27) and note how they translate into supervisory expectations

Draft a 10-question self-check on governance concepts and score yourself, logging every miss with the correct concept

Build an institutional risk assessment from scratch for a hypothetical mid-sized bank, scoring each inherent risk category and justifying every score in one sentence

Differentiate inherent, residual, and control risk, and calculate residual risk for three sample scenarios by applying control effectiveness ratings

Draft a risk appetite statement with explicit quantitative thresholds (for example, tolerance limits on high-risk customers and on unresolved alerts) and qualitative statements

Distinguish risk assessment from risk appetite and explain how each feeds the other in a governance cycle

List the key risk indicators you would track monthly and state the trigger point for escalation for each

Apply the four-step customer due diligence process (identification, verification, understanding purpose and intended nature, ongoing monitoring) to five customer profiles of varying risk

Trace beneficial ownership through a three-layer corporate structure and identify the ultimate beneficial owner using both the ownership-percentage and control tests

Select between simplified, standard, and enhanced due diligence for each of ten scenarios and justify the choice in two sentences

Identify red flags that require enhanced due diligence, including unusual source of funds, complex structures with no apparent commercial purpose, and reluctance to provide identification

Explain when a customer relationship must be declined or exited and how to document that decision

Design a transaction monitoring rule set for a retail bank, specifying the scenario logic, data fields required, and threshold rationale for at least six rules

Distinguish rule-based, threshold-based, and behavior-based monitoring and explain the trade-offs in false positive rate and coverage

Walk through alert triage end to end: alert generation, initial review, escalation, investigation, and disposition, naming the decision criteria at each stage

Analyze five sample alert narratives and write a defensible disposition for each, including what additional information you would request

Explain the difference between transaction monitoring and name screening, and describe how sanctions and PEP screening fit into the detection workflow

Apply sanctions screening concepts to ten scenarios, deciding whether a potential match requires escalation and documenting the match-resolution logic

Distinguish targeted sanctions from comprehensive embargoes and explain how ownership-based (50 percent rule) and control-based designation extensions affect screening

Classify ten public figures as PEP, relative or close associate of a PEP, or not a PEP, using the definition of a politically exposed person and the source-of-wealth requirement

Explain proliferation financing risk, how it differs from terrorist financing, and which red flags (dual-use goods, trade-based discrepancies, front companies) signal it

Identify trade-based money laundering red flags in a set of invoice and shipping records and explain the discrepancy in each case

Draft a suspicious activity report narrative for a constructed case that states who, what, when, where, why, and how, without conclusory language, in under 400 words

Explain the reporting timeline, confidentiality obligations, and prohibition on tipping off the customer, and describe the consequences of each violation

Distinguish internal escalation from external reporting and map the decision path from alert to filed report with the approval gate at each step

Describe how to handle a law enforcement inquiry or subpoena, including documentation, scope limitation, and escalation to legal

Evaluate three weak SAR narratives and rewrite each to meet a defensible standard

Map the control environment across prevention, detection, and reporting layers and identify at least two controls per layer with the risk each mitigates

Design a testing plan for three key controls, specifying sample size logic, testing method, evidence to retain, and pass/fail criteria

Distinguish a control design deficiency from an operating effectiveness deficiency and write an issue with a remediation owner, action, and target date

Explain the independent audit or testing function's role and how testing results feed back into the institutional risk assessment

Draft a training program outline with audience tiers, frequency, content, and a method for measuring comprehension

Explain model risk in AML systems, including model validation, tuning, threshold calibration, and documentation of assumptions, and describe the consequences of an unvalidated model

Identify data quality risks in AML (incomplete customer records, fragmented sources, inconsistent screening lists) and describe controls that mitigate each

Summarize at least five emerging typologies, such as virtual assets and mixers, synthetic identity fraud, and misuse of fintech payment rails, with the red flag for each

Explain how new products, delivery channels, and technologies trigger a risk assessment update before launch

Complete a timed 60-question mixed-domain practice set and review every missed item against the source domain