CAMS common mistakes
CAMS · Understand the traps and how to avoid them.
On terrorist financing items, the candidate applies money-laundering logic - requiring that the funds be large, derived from a criminal predicate, or passed through placement/layering/integration - and rejects answer options built around small sums, legitimately earned income, or diversion of charitable/NPO funds.
Most study time goes to laundering typologies, and the three-stage model is so heavily reinforced that it becomes the default lens for every scenario. Terrorist financing does not require criminal proceeds and often involves low-value transfers that never trigger monetary thresholds, so the familiar cues are absent.
What to do instead
Build a side-by-side comparison sheet (source of funds, amount profile, purpose of funds, staging model, detection trigger) and, on every TF item, first ask: 'does the correct answer depend on where the money came from, or on where it is going and for what purpose?' Prefer the option describing intended use or destination over the option describing origin.
When an item asks which stage of laundering a described activity represents, the candidate labels below-threshold cash deposits, structuring/smurfing, or bulk cash smuggling as 'layering', and labels wire transfers through multiple offshore accounts as 'integration'.
Definitions are memorised as vocabulary rather than as questions about where the funds sit. Structuring feels sophisticated, so it is misread as a later stage, when in fact it is a technique for getting cash into the system.
What to do instead
Apply a single test to every stage item: 'is currency or its equivalent entering the financial system for the first time?' If yes, it is placement. Reserve layering for transactions whose only purpose is to obscure origin, and integration for funds that appear to have a legitimate origin and are being used or invested.
The candidate conflates inherent risk with residual risk and with control quality - for example, concluding a customer relationship is 'high risk' because the institution's monitoring system is weak, or 'low risk' because onboarding controls are strong.
Risk-assessment vocabulary (inherent, residual, control effectiveness, risk appetite) is used loosely in summaries, and the terms all appear in the same paragraphs, so they collapse into one idea under time pressure.
What to do instead
Write the two definitions at the top of the scratch sheet before starting: inherent risk exists before any control is applied and is a function of customer, product, geography and delivery channel; residual risk is what remains after controls operate. Then check which of the two the stem is actually describing before looking at the options.
On stems asking what the institution or compliance officer should do 'first' or 'next', the candidate selects the terminal action - exiting the relationship, filing the suspicious transaction report, or freezing the account - instead of the immediate preceding step such as escalation, internal review, or gathering supporting information.
Suspicious activity primes the memory for reporting, and the most decisive-sounding option feels like the strongest answer. Candidates also read 'should do' as 'must eventually do' rather than as a sequencing question.
What to do instead
Mark the sequencing word in the stem before reading options, then rank the options chronologically on paper. Eliminate any option that cannot occur until an investigation or decision has taken place; the correct answer is the earliest defensible action the institution controls.
The candidate treats simplified due diligence as an exemption - selecting options such as 'customer identification is not required' or 'beneficial ownership need not be determined' - and treats enhanced due diligence as automatically required for every PEP, including domestic ones, regardless of risk.
'Simplified' reads as 'waived', and 'PEP' is taught as a synonym for high risk, so both concepts get flattened into absolutes.
What to do instead
Anchor two rules: simplified measures reduce the depth, timing or frequency of measures but never remove identification, verification or beneficial-ownership determination; and foreign PEPs always require enhanced measures, while domestic PEPs and international-organisation PEPs call for risk-based measures with source-of-funds checks where risk is higher.
When asked how the AML programme's testing element should be performed, the candidate selects the compliance function reviewing its own alerts, the business line self-certifying, or the MLRO signing off on the monitoring output as satisfying independent testing.
The words 'testing', 'review', 'audit' and 'monitoring' overlap heavily, and in a small institution the same people appear in every description, so the independence requirement is easy to overlook.
What to do instead
Apply a single filter: the person or function performing the test must sit outside the AML/compliance function, report to a level that gives it standing (board or audit committee), and have no operational stake in the outcome. Reject any option where the tester is also the designer, owner or operator of the control being tested.
In scenarios involving a reportable transaction, the candidate chooses to contact the customer for an explanation while disclosing that a report has been or will be made, or selects the option stating the customer must be informed of the filing as a matter of fairness.
Customer-service instincts and general 'right to be informed' reasoning carry over from other compliance contexts, and the prohibition is stated once and then rarely revisited.
What to do instead
Treat tipping off as an absolute in every scenario: the filing is disclosed only to those with a need to know, and any customer contact must be capable of being made without revealing that a report exists or is contemplated. Any option containing the words 'inform', 'advise' or 'explain to the customer' in relation to a report is wrong.
On investigation items, the candidate selects an outcome-only answer - 'the analyst concluded there was no suspicion', 'the matter was discussed internally' - rather than an option that creates a contemporaneous written record of the analysis, the evidence reviewed, the reasoning and the final decision, including a decision not to report.
Attention is fixed on the decision (report or do not report) because that is what the scenario dramatises, so the evidential trail that supports it is treated as administrative detail.
What to do instead
For any investigation-process item, prefer the option that produces a retrievable, dated record attributable to a named reviewer, and remember that a no-report decision is itself a decision requiring documented rationale. If two options differ only in which one is written down, choose the written one.
The candidate answers questions about the FATF Recommendations as though they were directly binding law - selecting 'the institution must comply with Recommendation X' as a description of a legal obligation, and treating mutual evaluation as an enforcement action.
FATF is the most memorable standard-setter on the syllabus, and the language of 'must' and 'should' in the Recommendations blurs the distinction between an international standard and an implemented national rule.
What to do instead
Fix the hierarchy: FATF sets standards and assesses implementation through mutual evaluations and published follow-up; the binding obligation on an institution comes from its national legislation, regulator and its own policies. When a stem asks about a legal requirement, prefer the option grounded in national law or the institution's procedures.
The candidate imports one jurisdiction's specific numbers and mechanics into a general question - assuming a fixed currency reporting threshold, a fixed record-retention period, or a fixed report-filing window applies because it was learned from a domestic source.
Studying from domestic guidance is common, and concrete numbers are easier to recall than principles, so they get applied as universal facts.
What to do instead
Treat every figure as jurisdiction-specific unless the stem supplies it. Where a number is needed, select the option that ties the requirement to 'the applicable national requirement' or the institution's documented policy, and when a specific threshold is genuinely tested, answer only if the stem states the jurisdiction.