CFCI study plan

Define money laundering, terrorist financing, and sanctions evasion, and distinguish them with original examples

Identify the three stages of money laundering (placement, layering, integration) and map at least two red-flag indicators to each stage

Explain the core obligations of the Bank Secrecy Act (BSA) and the role of FinCEN in the U.S. AML regime

List the FATF 40 Recommendations by category and state the purpose of each category in one sentence

Differentiate customer due diligence (CDD), enhanced due diligence (EDD), and simplified due diligence, and state when each applies

Describe the components of a risk-based AML program: risk assessment, policies, training, monitoring, and independent testing

Explain how suspicious activity reports (SARs) and currency transaction reports (CTRs) are triggered, filed, and retained

Compare typologies for trade-based money laundering, shell companies, and virtual-asset laundering

Define cybercrime categories (e.g., computer intrusion, identity theft, phishing, ransomware) and match each to a common legal or regulatory framework

Explain the roles of key U.S. statutes and agencies in cybercrime investigation and prosecution (e.g., CFAA, FBI, Secret Service)

Describe the cyber kill chain and MITRE ATT&CK tactics at a high level, and use them to structure an incident timeline

Identify common indicators of compromise (IOCs) for phishing, malware, and business email compromise (BEC)

Explain how cybercrime intersects with financial crime, including card-not-present fraud, account takeover, and money-mule networks

Describe the dark web ecosystem and cryptocurrency mixing/tumbling services used to obscure proceeds

Outline the incident response lifecycle (preparation, detection, containment, eradication, recovery, lessons learned) and the role of forensics in each phase

Identify reporting obligations after a breach, such as state breach notification laws and sector-specific rules

Describe the forensic process: identification, preservation, acquisition, examination, analysis, and reporting

Explain chain of custody and the order of volatility, and apply both to a hypothetical seizure of devices

Compare forensic imaging formats (e.g., raw, E01) and validate an image using hash values

Identify sources of digital evidence in financial crime cases, including endpoints, servers, mobile devices, and cloud logs

Explain how to acquire and analyze volatile data (memory, network connections, running processes) and why it matters

Describe timeline analysis and artifact correlation using file system metadata, logs, and registry or browser artifacts

Outline mobile and cloud forensic challenges, including encryption, sync, and jurisdiction

Explain how forensic findings support or refute a financial crime hypothesis, such as proving data exfiltration before a fraudulent transfer

Integrate AML typologies with cyber indicators by mapping at least three cyber-enabled money laundering schemes to detection controls

Evaluate how digital forensics supports financial crime investigations from alert to case closure

Practice writing clear, defensible findings that distinguish fact, inference, and conclusion

Identify cross-domain gaps in a fictional compliance program and propose measurable remediation steps

Synthesize all three domains into a single investigation workflow from detection to reporting

Complete a timed 60-question practice exam and score at least 75% overall, with no domain below 65%

Review every missed question and write a one-sentence rule for each to prevent repeat errors

Build a personal quick-reference sheet of key terms, statutes, and forensic steps for final review