CKYCA common mistakes
CKYCA · Understand the traps and how to avoid them.
Treating beneficial ownership as 'who owns the most shares' and defaulting to the largest shareholder without applying the control test or the 25% ownership threshold logic, and stopping at the first layer of a corporate structure.
Candidates memorize the 25% figure but skip the two-part definition (ownership interest plus control via other means such as voting agreements, nominee arrangements, or senior managing official fallback), and they forget that ownership must be traced through intermediate entities until natural persons are reached.
What to do instead
Drill the decision sequence: identify all natural persons with ownership interest at or above the threshold, then identify any person exercising control by other means, then apply the senior managing official fallback only when no beneficial owner can be identified after reasonable efforts. Practice tracing a three-tier structure and documenting each layer.
Confusing customer due diligence with enhanced due diligence and applying EDD to every customer, or conversely applying only standard CDD to a PEP, a correspondent banking relationship, or a customer in a jurisdiction flagged as high risk.
The exam tests risk-based calibration, and candidates either over-apply or under-apply EDD because they treat the measures as a checklist rather than a graduated response to assessed risk.
What to do instead
Build a mental table mapping triggers to measures: standard CDD for lower risk, simplified measures only where risk is demonstrably low and permitted, EDD for PEPs, high-risk jurisdictions, complex or opaque structures, and unusual transactions. Be able to name the additional EDD measures: source of funds and wealth, senior management approval, enhanced ongoing monitoring.
Treating a politically exposed person determination as permanent and binary, ignoring that PEP status applies to family members and close associates, and failing to apply the risk-based continuation of measures after the person leaves public office.
Candidates learn the PEP definition but not its scope, so they miss associated persons and the requirement that risk continues to be assessed after the public function ends rather than automatically terminating.
What to do instead
Memorize the three-part scope: the individual, family members, and close associates. Note that PEP status is a risk factor that triggers EDD and that exiting public office does not automatically remove risk; decisions to step down measures must be risk-based and documented. Also distinguish domestic from foreign and international organization PEPs where the framework does.
Relying on a single identity document and matching only the name, without verifying that the document is genuine, that the photograph matches, and that the address or date of birth is corroborated by an independent source.
Candidates equate 'we collected an ID copy' with 'we verified identity', collapsing identification, verification, and authentication into one step.
What to do instead
Separate the concepts explicitly: identification is obtaining customer details, verification is confirming them against reliable independent sources, and authentication is confirming the document itself is genuine. For each customer type, state which document is collected and which independent source corroborates it.
Assuming that once onboarding is complete and the file is approved, the customer relationship requires no further review, and treating periodic review as optional or as a fixed annual exercise regardless of risk.
Candidates study CDD as a front-end process and underestimate ongoing monitoring as a continuous obligation whose frequency and depth must be driven by the customer's risk rating and changes in circumstances.
What to do instead
Frame monitoring as a cycle: risk assessment sets the review frequency, trigger events (ownership change, adverse media, unusual activity, sanctions hit) force an out-of-cycle review, and the results feed back into the risk rating. Be ready to explain what a periodic review must re-verify rather than just re-file.
Evaluating transactions one at a time against fixed monetary thresholds and missing structuring, rapid movement of funds, activity inconsistent with the stated business profile, and round-amount patterns that individually fall below reporting thresholds.
Candidates reduce surveillance to threshold reporting and do not connect transaction behavior back to the customer's declared profile, purpose, and expected activity.
What to do instead
Practice reading a transaction narrative and asking three questions: is this consistent with the stated profile, does the pattern suggest an attempt to avoid thresholds, and does the counterparty or geography add risk. Learn the common typologies (structuring, layering through multiple accounts, pass-through activity) and how they appear in data rather than in single transactions.
Mixing up suspicious transaction reporting with threshold-based currency or cash transaction reporting, and describing tipping off as a reporting obligation rather than a prohibition.
Several distinct reporting streams exist with different triggers, recipients, and timing, and candidates blur them because they all involve reporting to an authority.
What to do instead
Create a comparison sheet for each report type: trigger, who files, to whom, within what timeframe, and what confidentiality applies. Explicitly note that tipping off the customer is prohibited and that internal escalation is separate from external filing. Know the difference between a suspicious activity report and a large cash or threshold report.
Describing record retention as 'keep everything forever' or 'five years from opening the account', without distinguishing the retention clock that runs from the end of the business relationship from the clock that runs from the transaction date.
Candidates memorize a single number without attaching it to the event that starts the clock or to the categories of records covered, and they overlook that local law may require longer periods.
What to do instead
Anchor each retention rule to its trigger event: records of identity verification and business correspondence are typically retained for a defined period after the relationship ends, while transaction records are retained from the date of the transaction. Note that the applicable period is set by local law and may exceed the baseline, and that records must be retrievable promptly for competent authorities.
Treating the compliance function as solely responsible for the KYC program and ignoring the roles of senior management, the board, front-line staff, and internal audit in a three-lines-of-defense structure.
Candidates focus on the analyst's tasks and do not study governance allocation, so questions about approval of the policy, risk appetite, independent testing, or escalation accountability are answered by defaulting to 'the compliance officer decides'.
What to do instead
Map each governance role: the board approves the framework and risk appetite, senior management implements it, the first line owns the customer relationship and initial risk assessment, compliance sets and monitors the framework, and internal audit provides independent testing. Know that the money laundering reporting officer has specific statutory duties such as receiving and evaluating internal reports.
Answering risk-based approach questions as if the approach permits skipping CDD when the customer seems trustworthy, rather than recognizing that lower risk allows proportionate measures within a mandatory minimum and that CDD cannot be waived at the institution's convenience.
The phrase 'risk-based' is misread as discretionary, and candidates also forget the situations in which CDD must be completed before establishing the relationship or where the relationship must be refused or terminated.
What to do instead
State the principle precisely: the risk-based approach determines the intensity of measures, not whether the core obligations apply. List the circumstances requiring CDD and the situations where the institution must not establish or must terminate a relationship, such as inability to complete verification or a suspicion that cannot be resolved. Then show how lower risk justifies reduced frequency or simplified measures only where the framework allows.