CFCI cheat sheet

Three-stage placement–layering–integration model: placement introduces illicit cash into the financial system, layering obscures the audit trail through transfers or trades, integration reintroduces funds as apparently legitimate assets.

Currency Transaction Report (US): financial institutions file for cash transactions exceeding $10,000 in a single business day; structuring below that threshold to evade filing is itself a federal offense.

Suspicious Activity Report (US): filing is triggered by transactions of $5,000 or more (bank threshold) involving suspected illegal activity or a pattern suggesting no lawful purpose; filings are confidential and safe-harbored.

Smurfing/structuring detection rule: flag clusters of deposits just under reporting thresholds across multiple branches, accounts, or days by related parties.

FATF 40 Recommendations: risk-based approach is core; customer due diligence tiers are standard, simplified, and enhanced, with enhanced DD required for PEPs and high-risk jurisdictions.

Three lines of defense in AML governance: business units own risk, compliance/AML functions monitor and advise, internal audit provides independent assurance.

Red flags of trade-based money laundering: over- or under-invoicing, misdescribed goods, double invoicing, and mismatches between shipping documents and payment amounts.

Benford's Law: in naturally occurring financial datasets, first digits follow a logarithmic distribution (1 appears about 30.1%); significant deviation can indicate fabrication or manipulation.

Phishing vs. spear phishing vs. whaling: mass deceptive email, targeted deceptive email using researched details, and targeting of senior executives respectively; vishing uses voice, smishing uses SMS.

Business email compromise (BEC): attacker impersonates an executive or vendor to redirect payments; indicators include changed bank details, urgency, and reply-to domains that differ from the display name.

Ransomware kill chain: initial access (phishing, exposed RDP/VPN), privilege escalation, lateral movement, data exfiltration, encryption, extortion; double extortion adds threatened data leak.

MITRE ATT&CK tactic order for mapping intrusions: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Card-not-present fraud indicators: mismatched billing and shipping addresses, multiple rapid order attempts, disposable email domains, and IP geolocation inconsistent with the card's issuing country.

Account takeover signals: credential-stuffing bursts from distributed IPs, impossible-travel logins, device fingerprint changes, and mass password-reset requests.

Botnet architecture: centralized (command-and-control server) versus peer-to-peer; takedowns target C2 infrastructure, domain sinkholing, and bulletproof hosting providers.

Cybercrime legal hooks commonly tested: unauthorized access statutes, computer fraud and abuse provisions, wire fraud for BEC, and identity theft where credentials or personal data are misused.

Order of volatility (RFC 3227): collect from most to least volatile - CPU registers and cache, RAM, network connections, running processes, disk, remote logs, archival media.

Chain of custody requires documented, unbroken transfer of evidence: collector identity, date/time, location, purpose, and signatures at each handoff; gaps can render evidence inadmissible.

Hashing for integrity: MD5 and SHA-1 are legacy; SHA-256 is standard. Hash the source before imaging and the image after acquisition; matching hashes demonstrate no alteration.

Write blockers prevent host writes to the source drive during acquisition; a forensic image is a bit-for-bit copy, verified by hash comparison.

File system timestamps: NTFS records $STANDARD_INFORMATION and $FILE_NAME timestamps (four each); $MFT entries can reveal timestomping when $FILE_NAME and $STANDARD_INFORMATION times conflict.

Deleted-file recovery: NTFS MFT entry marked unallocated retains metadata; FAT directory entries have the first character replaced by 0xE5; carving recovers files from unallocated space by signature.

Windows artifacts: registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT), event logs (Security, System, Application), prefetch, AmCache, ShimCache, and LNK files establish program execution and user activity.

Network forensics: PCAP analysis, NetFlow records, DNS query logs, and proxy logs establish exfiltration volume, timing, and destination; corroborate with host artifacts.

Fraud triangle: pressure/incentive, opportunity, and rationalization; the fraud diamond adds capability as a fourth element.

Occupational fraud categories: asset misappropriation (most frequent, least costly), corruption, and financial statement fraud (least frequent, most costly).

Red flags in financial statements: unusual journal entries near period end, growing revenue with declining cash flow, related-party transactions, and unexplained changes in accounting estimates.

Interview sequence: begin with peripheral, non-accusatory questions and progress toward the subject; confront with documented evidence only after establishing baseline behavior.

Evidence types: documentary, testimonial, physical, and demonstrative; documentary evidence should be originals where possible, with authenticated copies otherwise.

Net worth method: reconstruct income and expenditures over a period; unexplained increases in net worth relative to known income indicate unreported funds.

Data analytics tests: duplicate payments, round-dollar amounts, vendor address matching employee addresses, and payments just below approval thresholds.

Customer due diligence components: identify the customer, verify identity, identify beneficial owners (25% or more ownership is the common US threshold), and understand the purpose of the relationship.

Enhanced due diligence triggers: politically exposed persons, high-risk jurisdictions, complex ownership structures, and unusual transaction patterns.

Correspondent banking risk: nested accounts, payable-through accounts, and shell bank relationships are high-risk and often restricted.

Sanctions screening differs from AML monitoring: sanctions require strict matching against designated lists; AML uses risk-based thresholds and behavioral typologies.

Hawala and informal value transfer systems: settlement occurs without formal wires; indicators include frequent small transfers to unrelated parties and ledger-based records.

Recordkeeping: US rules generally require retention of CDD records for five years after account closure and transaction records for five years after the transaction.

Terrorist financing indicators often involve small sums, nonprofit fronts, and cross-border transfers inconsistent with the customer's stated purpose.

Incident response phases: preparation, identification, containment, eradication, recovery, and lessons learned.

Containment options during ransomware: isolate affected hosts at the network layer, disable compromised accounts, and preserve volatile memory before powering down.

Evidence preservation during incident response: capture memory and logs first, maintain a documented timeline, and avoid altering systems that may be needed for legal proceedings.

Payment fraud recovery: immediately contact the sending and receiving banks; wire recalls succeed only if funds remain in the receiving account.

Regulatory reporting clocks matter: many jurisdictions require prompt breach notification, and financial institutions have short SAR timelines (often 30 days) after detection.

Root cause analysis should distinguish initial access vector, detection gap, and response gap; each maps to a distinct remediation owner.

Metrics that matter: mean time to detect, mean time to contain, and percentage of incidents detected internally versus externally.

Public blockchains are pseudonymous, not anonymous; clustering heuristics link addresses by common-input ownership and change-address behavior.

Chain analysis tools assign risk scores to addresses based on proximity to sanctioned entities, mixers, and darknet marketplaces; scores are probabilistic, not dispositive.

Mixers and tumblers break the direct transaction graph; coinjoin and privacy coins complicate tracing but do not eliminate it.

Exchange subpoenas are the common de-anonymization point: KYC records link a real identity to deposit and withdrawal addresses.

Transaction tracing should record transaction hashes, block heights, timestamps, input/output addresses, and amounts for evidentiary completeness.

Stablecoin flows are traceable on-chain and increasingly used in fraud and ransomware payments because of liquidity and price stability.

US Bank Secrecy Act establishes AML program requirements: internal controls, designated compliance officer, ongoing training, and independent testing.

FATF mutual evaluations assess technical compliance and effectiveness; jurisdictions on the grey list are subject to increased monitoring.

The Wolfsberg Group publishes guidance on correspondent banking, CDD, and payment transparency used as industry benchmarks.

Compliance program testing should be risk-based, independent, and documented; findings require remediation tracking with owners and deadlines.

Whistleblower and retaliation protections are part of effective compliance culture; reporting channels must be accessible and confidential.

Cross-border data sharing is limited by privacy laws; information sharing often flows through formal channels such as FIUs and MLAT requests.