CFCS (Other exams) common mistakes
CFCS · Understand the traps and how to avoid them.
When a scenario is ambiguous, the candidate selects the most punitive option available - exit the relationship, freeze the account, or file a report - rather than the proportionate risk-based response, and rejects 'apply enhanced due diligence and document the rationale' as too soft.
Enforcement headlines and internal training condition candidates to equate visible action with correct action; 'enhanced monitoring' feels like doing nothing, so it reads as a wrong answer even when the scenario's risk level supports it.
What to do instead
Before choosing, identify (a) the residual risk after available controls and (b) who is authorised to make the risk decision. Under a risk-based approach, exit is required only where risk cannot be mitigated; EDD, senior-management sign-off, and documented acceptance are legitimate answers and are frequently the intended one.
Allocates functions to the wrong line of defence - assigning alert triage or SAR drafting to internal audit, or saying compliance 'owns' the customer relationship risk - when asked who performs a control or who reports to the audit committee.
The three-lines model is taught as a diagram rather than as a set of accountabilities, so candidates remember 'audit checks things' and map any testing or review activity to the third line.
What to do instead
Memorise the ownership rule rather than the activity label: first line (business) owns and executes the risk and its controls, including CDD collection; second line (compliance/risk) designs the framework, sets policy, and performs independent monitoring and testing; third line (internal audit) provides independent assurance to the board/audit committee and never owns or operates a control.
Labels any multi-account, multi-jurisdiction fact pattern as 'layering' - including cash deposits split across branches or multiple sub-threshold wire transfers out of an account that was just funded with cash.
Layering is the most distinctive and most frequently discussed stage, so it becomes the default label whenever transactions look complicated; candidates stop asking where the funds first entered the financial system.
What to do instead
Classify by function in the sequence, not by complexity: placement is the first entry of illicit funds into the financial system (including structuring of cash deposits), layering is any step whose purpose is to break the audit trail, integration is reintroduction of value as apparently legitimate (property, business revenue, investments). Write the stage label only after identifying the entry point.
Analyses each transaction in a scenario in isolation and concludes that nothing is reportable because no single transaction reached the currency reporting threshold, ignoring aggregation of same-day or same-person transactions and ignoring that structuring is an offence independent of the source of the funds.
Thresholds are memorised as a single number attached to a single transaction; aggregation rules and the structuring offence are learned as separate topics and are not retrieved when the question is framed as a balance or wire narrative.
What to do instead
Run two checks before answering: (1) aggregation - where the jurisdiction sets a currency threshold, connected transactions by or on behalf of the same person on the same business day are aggregated before the threshold test; (2) intent - deliberately keeping amounts below a threshold is structuring whether or not the underlying funds are legitimate, so 'the money came from a lawful business' does not defeat the finding.
Rejects a terrorist financing scenario as 'not TF' because the funds were legally earned, the amounts were small, or the sender appears to be a legitimate charity - reasoning that there is no predicate offence and no profit motive.
Money laundering training dominates the candidate's mental model, so proceeds-of-crime and profit logic gets transferred to TF, where neither is required.
What to do instead
Screen TF scenarios on three different axes: purpose (funds or resources intended for terrorist acts or organisations), destination/beneficiary (conflict zones, designated entities, diverted NPO funds, self-funding foreign fighters), and method (low-value remittances, informal value transfer, fundraising). Clean source and small value are neutral facts, not exculpatory ones.
Mislabels typologies when the account holder's identity is the pivot - calling a compromised existing account 'new account fraud', or calling a bust-out using the fraudster's own genuine identity 'identity theft'.
Typologies are memorised as loss scenarios rather than as answers to two questions (whose identity, and what was the intent at onboarding), so superficially similar cases are collapsed into one label.
What to do instead
Ask two questions in order. Whose identity is on the account - the holder's own, a stolen real identity, or a fabricated one? Was the intent fraudulent at onboarding or did it arise later? Own identity with no intent to perform = first-party fraud (application fraud, bust-out); stolen/fabricated identity = third-party identity fraud; genuine pre-existing account later compromised = account takeover.
States that facilitation payments are a lawful exception to the UK Bribery Act, or that the Act is limited to public officials, by importing FCPA rules into a UK-law question.
The FCPA's narrow facilitation-payment exception is heavily overlearned and is retrieved automatically whenever 'bribery' appears, regardless of which statute the question names.
What to do instead
Hold a two-column contrast. FCPA: foreign officials only, anti-bribery plus books-and-records/internal-controls provisions, narrow facilitation-payment exception, no general corporate failure-to-prevent offence. UK Bribery Act: domestic and foreign officials and commercial/private bribery, no facilitation-payment exception, strict-liability corporate offence of failing to prevent bribery with an 'adequate procedures' defence.
Concludes there is no corruption risk because the payment went to a consultant, agent, or distributor rather than directly to a government official, and fails to flag unusually high commissions or sub-agents in a high-risk jurisdiction.
Candidates look for the official as the payee; intermediaries are treated as commercial counterparties rather than as the standard conduit for concealed bribery.
What to do instead
Treat third-party intermediaries as the primary red-flag surface: success-based or unusually high commissions, sub-agents or offshore shell recipients, requests to route through a third country, related-party links between the agent and an official, and payments to a country unrelated to the services. Absence of a direct official payment is not absence of risk.
Treats a name appearing on a screening hit as a confirmed match and moves straight to block or exit, or alternatively clears an alert because date of birth and nationality differ without documenting the disposition basis.
Screening output and screening determination are conflated, and the strict-liability nature of sanctions makes candidates swing between over-caution and rationalising away alerts.
What to do instead
Use the alert-to-disposition workflow explicitly: alert → secondary identifiers (full name variants, DOB, place of birth, nationality, ID/document numbers, entity registration details, ownership) → false-positive rationale documented → true match escalated → block or reject and report per the applicable regime. Separately, remember civil sanctions liability is strict, so 'the customer did not know' and 'no intent' are not defences.
Uses freezing, seizure, confiscation/forfeiture, mutual legal assistance, and letters rogatory interchangeably, and describes a restraint order as if it already transferred ownership of the assets to the state.
The terms overlap in ordinary language and are often presented together as 'asset recovery measures', so candidates retain the theme but not the distinct legal effect or the channel through which each is obtained.
What to do instead
Attach each term to its legal effect and channel. Freezing/restraint: temporary prohibition on dealing, pending investigation, obtained administratively (sanctions) or from a court. Seizure: taking physical or legal custody of property. Confiscation/forfeiture: permanent deprivation, following conviction or via non-conviction-based proceedings. MLA: government-to-government request through the central authority. Letters rogatory: judicial request transmitted through courts and diplomatic channels.