CISI Global Financial Compliance common mistakes
CISI Global Financial Compliance · Understand the traps and how to avoid them.
Treating the compliance function as the owner of business risk and answering that compliance 'ensures' the firm complies, rather than describing it as an independent second line that advises, monitors and challenges while senior management owns the risk.
Candidates memorise the phrase 'compliance ensures compliance with rules' from introductory material and repeat it under time pressure, missing the three-lines-of-defence allocation of accountability that the syllabus tests.
What to do instead
Before answering any question on the compliance function, write down the line-of-defence position of each party named in the options (first line business, second line compliance/risk, third line internal audit, governing body). Eliminate any option that gives compliance executive ownership of business decisions or absolves senior management.
Answering questions on the extra-territorial reach of a regulator by assuming the regulator's rules stop at the national border, instead of applying the recognised tests such as conduct having a territorial connection, effects within the jurisdiction, or the regulator's ability to share information with overseas counterparts.
Candidates study their home regime in isolation and do not build a mental model of how jurisdictions assert reach, so they default to a literal geographic reading of the question.
What to do instead
Build a one-page comparison of how major regimes assert reach (for example activity-based, entity-based and effects-based triggers) and practise classifying short scenarios against each trigger. Where an option says the regulator has no interest because the firm is overseas, treat it as a distractor unless the scenario expressly lacks any territorial connection.
Classifying a scenario as market abuse purely because it looks unfair, without checking that the specific elements are present: inside information that is precise and not generally available, a dealing or disclosure behaviour, and the required mental element where the offence depends on intent.
The word 'unfair' in a scenario pulls candidates towards a market abuse answer, and the distinct offences of insider dealing, unlawful disclosure and market manipulation are often conflated into one undifferentiated category.
What to do instead
For every market abuse scenario, apply a three-step test in writing: is the information precise, non-public and price-sensitive; which behaviour is alleged (dealing, disclosure, manipulation); and does the offence require knowledge or intent. Then map the behaviour to the named offence rather than to a general sense of wrongdoing.
Confusing the anti-money-laundering stages of the customer due diligence process, for example treating enhanced due diligence as something required for every customer, or treating simplified measures as a way to skip identification and verification altogether.
The measures sit on a risk-based continuum, and candidates learn the labels without learning that simplified measures still require identification and that enhanced measures are triggered by defined higher-risk factors such as politically exposed persons or correspondent relationships.
What to do instead
Draw the CDD ladder: identification and verification always; ongoing monitoring always; simplification permitted only on documented lower risk; enhancement required on defined higher-risk triggers. For each practice question, name the trigger in the facts before choosing the measure.
Choosing an answer that treats a suspicious activity report as something to be filed only after internal investigation is complete and the suspicion is confirmed, rather than on suspicion, with the tipping-off prohibition and internal reporting route respected.
Candidates import an everyday 'evidence first' instinct into a regime built on early reporting, and they overlook that the internal reporting officer, not the individual, normally makes the external disclosure.
What to do instead
Memorise the sequence as suspicion, internal report to the nominated officer, nominated officer decides on external disclosure, no tipping off at any stage, no further dealing without consent where required. Reject any option that makes confirmation of the suspicion a precondition.
Answering suitability questions by confirming the transaction is suitable because the client asked for it, or because the product matches the client's stated objective, without addressing the client's knowledge, experience, financial situation and risk tolerance together with the appropriateness of the specific recommendation.
Client instruction and product fit feel like strong signals, so candidates stop there, and they do not separate the suitability assessment from the appropriateness assessment that applies where execution-only or non-advised services are used.
What to do instead
Run a fixed checklist on every advice scenario: client facts gathered, suitability report or record made, all four suitability dimensions addressed, appropriateness assessed separately where no advice is given, and costs and charges disclosed. Reject options that treat a client request as a substitute for the assessment.
Treating disclosure of a conflict of interest as sufficient to manage it, instead of following the hierarchy that requires avoidance or management first, with disclosure as a last resort when the conflict cannot be managed.
Disclosure is the most familiar and cheapest-sounding control, so it attracts candidates, and the hierarchy of controls is learned as a list without the ordering being internalised.
What to do instead
Learn the sequence as avoid, manage with controls such as information barriers, independent oversight or declining the business, and only then disclose. In questions, ask whether the option changes the firm's behaviour; if it only informs the client, it is the weakest option and usually wrong when a management step is available.
Describing the breach-handling process as starting with remediation, skipping the stages of identification, logging, assessment of significance, escalation to the governing body and notification to the regulator where required.
Candidates focus on fixing the problem because that is the visible outcome, and they under-weight record-keeping, root-cause analysis and the regulatory notification decision, which are the parts the exam tests.
What to do instead
Learn a fixed breach lifecycle: identify, record in the register, assess impact and whether it is reportable, escalate, remediate, notify the regulator if required, conduct root-cause analysis, and feed lessons into the risk framework. Practise ordering these stages and identifying which stage a scenario has reached.
Answering risk-assessment questions by choosing the most thorough-looking control, such as reviewing every transaction or applying the highest level of due diligence to all customers, instead of applying a proportionate, risk-based approach with documented rationale.
More control appears safer, and candidates do not appreciate that disproportionate controls are themselves a compliance weakness because they consume resources, generate false positives and are inconsistent with the risk-based standard.
What to do instead
For each option, ask whether it is proportionate to the risk described in the facts and whether it is documented and reviewable. Prefer answers that calibrate intensity of measures to assessed risk and include monitoring, review and record-keeping, over blanket maximum-intensity answers.
Confusing the roles of the regulator's rulebook, guidance and principles, for example treating guidance as a binding rule that creates an obligation, or treating high-level principles as unenforceable statements of aspiration.
The distinction is subtle and candidates learn the documents as a flat list, so they cannot answer questions that turn on which instrument imposes the enforceable obligation and which explains how to meet it.
What to do instead
For each source in your notes, record three things: who issues it, whether it is binding, and what it is used for. Remember that principles are enforceable and sit above detailed rules, rules create specific obligations, and guidance indicates expected practice and is relevant to enforcement but does not itself create the obligation.