CFCS (Other exams) cheat sheet

Three lines of defense: business units own risk (first line), compliance and risk functions provide oversight (second line), and internal audit gives independent assurance (third line).

Risk-based approach: allocate controls and resources in proportion to assessed likelihood and impact, and document the methodology and risk appetite.

Inherent risk is the risk before controls; residual risk is the risk remaining after controls are applied and is compared with risk appetite.

Core AML program elements: a designated compliance officer, written policies and procedures, ongoing training, independent testing, and customer due diligence.

CDD triggers include a new business relationship, occasional transactions above the applicable threshold, suspicion of ML/TF, and doubts about previously obtained data.

Enhanced due diligence applies to higher-risk relationships such as PEPs, correspondent banking, high-risk jurisdictions, and complex ownership structures.

FATF standard: retain CDD and transaction records for at least five years after the relationship ends or the transaction is completed.

Independent testing should be risk-based, performed by persons outside the AML function, and reported to senior management and the board.

Three stages: placement introduces illicit funds into the financial system, layering obscures the trail, and integration reintroduces funds as apparently legitimate.

Structuring (smurfing) splits transactions below reporting thresholds to evade currency transaction reports; it is illegal even when the underlying funds are legitimate.

US currency transaction report threshold: cash transactions exceeding $10,000 in one business day by or for one person.

Trade-based money laundering moves value across borders through misinvoicing, over- or under-shipment, or false descriptions of goods and services.

Shell and front companies have no substantive operations and are used to hold accounts, commingle funds, or disguise beneficial ownership.

Money mule accounts receive and transfer third-party funds; red flags include activity inconsistent with the customer profile and rapid in-and-out movement.

Common red flags: round-dollar amounts, unexplained third-party funding, rapid pass-through activity, and unusual high-risk jurisdictions.

A predicate offense is the underlying crime that generates proceeds; money laundering liability generally requires knowledge or reasonable suspicion depending on jurisdiction.

Terrorist financing can involve legitimately sourced funds, and amounts are often small, so monetary reporting thresholds are less effective than suspicion-based reporting.

Core FATF obligations: criminalize terrorist financing, freeze terrorist assets without delay, report suspected TF, and implement targeted financial sanctions.

UNSCR 1373 requires states to freeze terrorist funds without delay; the UNSCR 1267 regime maintains the ISIL and Al-Qaida sanctions list.

Hawala and other informal value transfer systems settle obligations through trust and netting outside formal banking, producing limited records.

Charities and non-profit organizations are a higher-risk sector because legitimate fundraising can be diverted or used as cover for financing.

Common typologies include self-funding, small donations, crowdfunding, foreign terrorist fighters, and abuse of NPOs.

TF red flags: donations routed to conflict zones, charity accounts with unexplained cash withdrawals, and fundraising inconsistent with the organization's stated purpose.

Suspicious transaction reports for terrorist financing may be filed on suspicion alone; no minimum transaction amount is required.

Fraud triangle: pressure or incentive, opportunity, and rationalization are the three conditions commonly associated with occupational fraud.

Business email compromise: an attacker impersonates an executive or vendor to induce a wire transfer; verification via a callback to a known number is a key control.

Authorized push payment fraud: the victim is deceived into authorizing a payment; reimbursement depends on the jurisdiction's liability rules.

Card-not-present fraud indicators include mismatched address verification and CVV results, multiple rapid attempts, and unusual shipping destinations.

Ponzi scheme red flags: consistently high returns, unregistered products, no audited financial statements, and payouts funded by new investor money.

Synthetic identity fraud combines real and fabricated data, often built slowly to establish credit before a bust-out.

Insider fraud red flags include living beyond means, refusal to take leave, and exclusive control over vendor or payment records.

Check fraud includes altered, forged, and counterfeit checks; check kiting exploits the float between accounts before a deposited check clears.

Corruption includes bribery, extortion, embezzlement, and trading in influence; bribery is offering, promising, or accepting an undue advantage.

The FCPA has anti-bribery provisions and accounting provisions requiring accurate books and records and internal accounting controls.

The UK Bribery Act covers active and passive bribery, bribery of foreign public officials, and a commercial organization's failure to prevent bribery.

The OECD Anti-Bribery Convention requires parties to criminalize bribery of foreign public officials in international business transactions.

UNCAC is the only global legally binding anti-corruption instrument; Chapter V addresses asset recovery.

Facilitation payments are small payments to expedite routine government action; the FCPA has a narrow exception, while the UK Bribery Act has none.

PEPs are individuals entrusted with prominent public functions; relationships require enhanced due diligence and source-of-wealth review.

Corruption red flags: unusual gifts or hospitality, agents with vague fees, shell companies in secrecy jurisdictions, and inflated invoices.

OFAC SDN list: assets are blocked and US persons are prohibited from dealing; the 50 percent rule extends blocking to entities owned 50 percent or more by blocked persons.

Sectoral sanctions, such as the SSI list, restrict specific transactions rather than imposing full blocking.

Secondary sanctions can target non-US persons for certain conduct outside US jurisdiction.

Screening should cover customers, beneficial owners, directors, transactions, and payment messages, with escalation for potential matches.

Asset freezing under targeted financial sanctions must occur without delay and without prior notice, followed by reporting to the competent authority.

Confiscation permanently deprives a person of proceeds of crime; non-conviction-based forfeiture permits action without a criminal conviction.

Mutual legal assistance enables cross-border evidence gathering, freezing, and confiscation for foreign proceedings.

UNCAC Chapter V and the StAR initiative promote asset recovery and the return of stolen assets to countries of origin.