I85PREP
⌘ K
HKIB ECF-AML/CFT Core study materials
HKIB ECF-AML/CFT Core study resources

HKIB ECF-AML/CFT Core practice questions

One question at a time. Build your HKIB ECF-AML/CFT Core understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Under the risk-based approach promoted by the FATF, which statement best describes how a financial institution should allocate its AML/CFT resources?

  1. Concentrate resources on retail customers because they form the largest proportion of the client base
  2. Apply identical due diligence measures to every customer so that no client is treated differently
  3. Direct the greatest effort to the areas assessed as posing the highest money laundering and terrorist financing risk Correct answer.
  4. Delegate all risk decisions to the front-line staff who open the accounts

Explanation

The risk-based approach requires institutions to identify, assess and understand their ML/TF risks and then apply measures proportionate to those risks. Higher-risk situations therefore attract enhanced scrutiny, while lower-risk situations may justify simplified measures within permitted limits. Uniform treatment ignores risk and is not what the FATF recommends.

Question 2Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A customer asks a bank to open an account in the name of an offshore company. Which element is most central to identifying the beneficial owner?

  1. The name of the bank's relationship manager who introduced the client
  2. The date on which the company was incorporated overseas
  3. The identity of the natural person who ultimately owns or controls the company Correct answer.
  4. The name of the company's registered agent in the offshore jurisdiction

Explanation

A beneficial owner is the natural person who ultimately owns or controls a customer or the funds involved in a transaction. Because ownership may be layered through corporate structures, the institution must look through the legal entity to identify the real people behind it. Registered agents, incorporation dates and internal staff are not beneficial owners.

Question 3Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which activity is the clearest example of structuring (smurfing) in an AML context?

  1. A company making a single large payment that exceeds the reporting threshold
  2. An individual receiving a monthly salary credited by the same employer each month
  3. A customer splitting cash deposits into amounts just below the reporting threshold across several days Correct answer.
  4. A business converting its entire annual profit into a fixed deposit

Explanation

Structuring is the deliberate breaking up of transactions to stay below reporting or record-keeping thresholds and avoid scrutiny. Repeated deposits sized just under the threshold are the classic indicator. A single large payment, regular salary credits and a normal fixed deposit do not by themselves show an intent to evade thresholds.

Question 4Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

What is the primary purpose of customer due diligence at onboarding?

  1. To confirm that the customer will generate sufficient revenue for the institution
  2. To determine the credit rating that should be assigned to the customer
  3. To verify that the customer has no previous relationship with a competitor bank
  4. To establish the customer's identity and understand the expected nature of the relationship Correct answer.

Explanation

Customer due diligence requires identifying and verifying the customer's identity and understanding the purpose and intended nature of the business relationship. This baseline allows the institution to detect activity that is inconsistent with expectations. Revenue, competitor relationships and credit ratings are separate commercial or credit considerations.

Question 5Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which of the following is a recognised predicate offence for money laundering?

  1. Fraud Correct answer.
  2. Failure to renew a professional licence on time
  3. Late filing of a tax return without intent to deceive
  4. Breach of an employment contract

Explanation

Money laundering requires underlying criminal conduct, known as a predicate offence, that generates the proceeds to be laundered. Fraud is a classic predicate offence because it produces illicit financial gain. Administrative lapses such as late filing or licence renewal do not generate criminal proceeds in the same way.

Question 6Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A politically exposed person (PEP) is best described as someone who:

  1. Works in the compliance department of a regulated institution
  2. Has been convicted of a financial crime in any jurisdiction
  3. Holds or has held a prominent public function and therefore presents higher ML/TF risk Correct answer.
  4. Has requested a simplified due diligence process

Explanation

PEPs are individuals entrusted with prominent public functions, together with their family members and close associates. Their position and influence can expose an institution to heightened corruption and bribery risk, which is why enhanced measures apply. A criminal conviction or employment in compliance is not what defines PEP status.

Question 7Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which statement correctly describes the relationship between money laundering and terrorist financing?

  1. Terrorist financing can involve small amounts of legitimately sourced funds as well as criminal proceeds Correct answer.
  2. Money laundering and terrorist financing are treated as the same offence in every jurisdiction
  3. Terrorist financing always requires large sums of money to be laundered first
  4. Terrorist financing only occurs through the formal banking system

Explanation

Terrorist financing differs from classic money laundering in that the funds may be small in amount and may originate from lawful sources such as donations. The objective is to support terrorism rather than to conceal the origin of criminal proceeds. It can also move through informal channels, not only banks.

Question 8Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Why do AML/CFT regimes place importance on record-keeping?

  1. It guarantees that a customer will not be involved in laundering
  2. It enables reconstruction of transactions and supports investigations by competent authorities Correct answer.
  3. It removes the need to file suspicious transaction reports
  4. It allows the institution to sell customer data to marketing partners

Explanation

Record-keeping preserves the audit trail needed to reconstruct transactions and respond to lawful requests from authorities. It also supports the institution's own monitoring and defence. It does not replace reporting obligations or guarantee customer conduct.

Question 9Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution is onboarding a customer whose source of wealth is described only as "business activities" in a high-risk jurisdiction. What is the most appropriate action?

  1. Obtain additional, specific evidence of how the wealth was generated and verify it before proceeding Correct answer.
  2. Rely on the introducing bank's assurance without further checks
  3. Accept the explanation because the customer has provided a passport copy
  4. Open the account but restrict it to cash deposits

Explanation

A vague source of wealth statement in a high-risk situation calls for enhanced due diligence, including obtaining and verifying specific evidence of how the wealth was accumulated. Identity documents alone do not explain wealth. Deferring to an introducer does not discharge the institution's own responsibility.

Question 10Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

During monitoring, an analyst sees a dormant personal account suddenly receiving many small inbound transfers from unrelated third parties followed by immediate transfers abroad. Which typology does this most closely match?

  1. A fixed-term deposit rollover
  2. Salary account activity
  3. A standard mortgage repayment schedule
  4. Layering through a mule or funnel account Correct answer.

Explanation

A dormant account that suddenly collects funds from multiple unrelated parties and quickly forwards them overseas is consistent with layering through a funnel or mule account. The pattern separates the funds from their origin and obscures the audit trail. Salary credits, mortgage repayments and deposit rollovers have recognisable, consistent counterparties.

Question 11Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A relationship manager learns from a client that the client is under investigation for tax evasion and asks the manager not to report anything. What should the manager do?

  1. Close the account quietly and destroy the related records
  2. Respect the client's request because the information was shared in confidence
  3. Wait until the investigation becomes public before taking any action
  4. Report the suspicion through the institution's internal process without tipping off the client Correct answer.

Explanation

Suspicion of criminal conduct must be escalated internally so that a suspicious transaction report can be considered, regardless of the client's wishes. The manager must also avoid tipping off the client that a report has been or may be made. Confidentiality requests and quiet account closures do not override these obligations.

Question 12Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which customer scenario should generally be treated as higher risk and attract enhanced due diligence?

  1. A locally employed teacher with a stable salary credited monthly
  2. A long-standing retail customer with regular utility bill payments
  3. A shell company with nominee directors and no apparent business operations Correct answer.
  4. A pensioner receiving a government pension into a savings account

Explanation

Shell companies with nominee directors and no visible operations obscure ownership and purpose, which are recognised higher-risk indicators. Enhanced due diligence is appropriate to establish who really controls the entity and why it needs the service. The other scenarios show stable, explainable activity.

Question 13Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

What distinguishes a suspicious transaction report from a threshold-based report?

  1. A suspicious transaction report is triggered by suspicion of criminal conduct, whereas a threshold report is triggered by a defined transaction amount Correct answer.
  2. A threshold report requires no supporting documentation at all
  3. A suspicious transaction report can only be filed by the customer
  4. A suspicious transaction report is filed only when a crime has already been proven in court

Explanation

Suspicious transaction reporting is judgement-based and arises when there are grounds to suspect criminal property or terrorist financing. Threshold reporting is mechanical and depends on a defined monetary limit. Suspicion does not require proof in court, and reporting is the institution's duty, not the customer's.

Question 14Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution uses a correspondent bank in another country to process payments for its clients. Which measure best mitigates the ML/TF risk in this relationship?

  1. Conducting due diligence on the correspondent, including its AML/CFT controls and ownership Correct answer.
  2. Relying solely on the correspondent's marketing materials
  3. Limiting the relationship to wire transfers only
  4. Assuming the correspondent is regulated because it holds a banking licence

Explanation

Correspondent banking relationships carry risk because the respondent may provide services to customers the institution cannot see directly. Due diligence should assess the respondent's ownership, reputation, AML/CFT programme and supervisory status. Marketing materials and a licence alone do not demonstrate adequate controls.

Question 15Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Why is wire transfer information such as the originator's name and account number important for AML/CFT purposes?

  1. It removes the need for the beneficiary bank to conduct any checks
  2. It allows the transfer to bypass sanctions screening
  3. It allows the beneficiary bank to reconstruct the payment chain and screen the parties Correct answer.
  4. It guarantees that the transfer is legitimate

Explanation

Complete originator and beneficiary information allows receiving institutions to identify the parties, screen them against sanctions and watch lists, and reconstruct the payment chain if needed. It does not guarantee legitimacy or exempt any party from checks. Sanctions screening is still required.

Question 16Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An analyst is reviewing alerts and finds one that matches a customer's documented business of importing electronics, with invoices and customs records on file. What is the most appropriate disposition?

  1. Close the alert without any record to reduce the backlog
  2. File a suspicious transaction report regardless of the evidence
  3. Escalate immediately because any large payment is suspicious
  4. Document the review, explain why the activity is consistent with the customer profile, and close the alert Correct answer.

Explanation

Alert disposition must be evidence-based and documented so that the reasoning can be reviewed later. Where the activity is consistent with a verified customer profile and supported by documents, the alert can be closed with a clear rationale. Escalating or reporting without grounds, or closing silently, undermines the process.

Question 17Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A customer requests to conduct a one-off transaction through an intermediary who refuses to disclose on whose behalf the transaction is being made. How should the institution respond?

  1. Ask the intermediary to sign a declaration that the funds are legitimate
  2. Decline to act until the identity of the person on whose behalf the transaction is made is established Correct answer.
  3. Proceed because the intermediary has provided identification for themselves
  4. Proceed but record the intermediary's name only

Explanation

Where a person purports to act on behalf of another, the institution must establish the identity of both parties, including the person on whose behalf the transaction is made. If that information cannot be obtained, the transaction should not proceed. Identifying only the intermediary or taking a self-declaration is insufficient.

Question 18Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which of the following best explains why informal value transfer systems present particular AML/CFT challenges?

  1. They are subject to stricter supervision than licensed banks
  2. They are always illegal and therefore never documented
  3. They cannot be used for cross-border transfers
  4. They may settle obligations through netting and trust networks, leaving limited formal records Correct answer.

Explanation

Informal value transfer systems often rely on trust, netting and settlement between intermediaries, so formal transaction records may be sparse and the parties harder to identify. This limits visibility for monitoring and investigations. They are not inherently illegal, are not more strictly supervised, and can be used cross-border.

Question 19Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A private banking client wants to fund an account with a lump sum and gives a plausible but unverifiable explanation of the source. What is the most appropriate enhanced measure?

  1. Obtain independent corroboration of the source of funds and seek senior management approval for the relationship Correct answer.
  2. Allow the deposit but prohibit any withdrawals for one year
  3. Transfer the relationship to a junior officer to reduce attention
  4. Accept the explanation and set a higher monitoring threshold

Explanation

Enhanced due diligence for higher-risk clients requires corroborating the source of funds and obtaining senior management sign-off before the relationship proceeds. A plausible explanation without evidence is not sufficient. Raising thresholds or imposing arbitrary restrictions does not address the underlying information gap.

Question 20Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which statement about the role of the money laundering reporting officer (MLRO) is most accurate?

  1. The MLRO replaces the board in setting the institution's risk appetite
  2. The MLRO acts as the central point for receiving internal reports and deciding whether to make an external report Correct answer.
  3. The MLRO personally decides whether the institution is guilty of an offence
  4. The MLRO is responsible for marketing the institution's AML credentials to clients

Explanation

The MLRO typically receives internal suspicious activity reports, assesses them and determines whether an external report should be made to the authorities. The role is a control and decision-support function. Guilt is determined by courts, and the board retains responsibility for risk appetite.

Question 21Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A bank discovers that a customer provided a forged utility bill as proof of address during onboarding. The customer has since conducted only routine transactions. What is the most defensible course of action?

  1. Ignore the forgery because the transactions themselves appear routine
  2. Treat the forgery as a risk indicator, review the relationship and consider reporting the suspicion Correct answer.
  3. Simply update the address record and take no further action
  4. Refund all fees and close the account without any internal escalation

Explanation

Providing forged documents is itself a suspicious indicator, even if the transactions look ordinary, because it suggests an intent to deceive the institution. The relationship should be reviewed and the suspicion escalated for consideration of a report. Ignoring or quietly correcting the record fails to address the deception.

Question 22Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution applies simplified due diligence to a category of customers. Which condition must be satisfied for this to be acceptable?

  1. The institution's profit margin on the category is below a set limit
  2. The category has fewer than one hundred customers
  3. The customer has agreed in writing to accept simplified measures
  4. The institution has assessed the category as low risk and documented the basis for that conclusion Correct answer.

Explanation

Simplified measures are permitted only where the institution has assessed the particular category as low risk, with the assessment documented and subject to review. Customer consent, profitability or the size of the category are irrelevant to the risk determination. Simplified measures must still permit identification and monitoring.

Question 23Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A corporate customer's ownership structure includes a trust registered in a secrecy jurisdiction, and the trustee refuses to identify the settlor. How should the institution treat this?

  1. Proceed using the trustee's corporate name as the beneficial owner
  2. Treat the opacity as a significant risk factor and decline or escalate unless adequate ownership information is provided Correct answer.
  3. Ask the trust to confirm orally that the settlor is not a PEP
  4. Accept the trustee's refusal because trusts are confidential by nature

Explanation

Inability to identify the settlor or beneficiaries of a trust is a material ownership opacity that prevents proper beneficial ownership identification. The institution should treat this as high risk and decline or escalate unless adequate information is provided. Trust confidentiality and an oral assurance do not satisfy the requirement.

Question 24Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which situation best illustrates the placement stage of money laundering?

  1. A launderer sells a property purchased with illicit funds and spends the proceeds
  2. A launderer introduces cash proceeds of crime into the financial system through a retail business Correct answer.
  3. A launderer transfers funds between multiple offshore accounts to obscure the trail
  4. A launderer integrates funds by purchasing a legitimate business

Explanation

Placement is the first stage, where illicit cash first enters the financial system, for example by being mixed with the takings of a cash-intensive business. Layering then obscures the trail through transfers, and integration returns the funds to the economy as apparently legitimate. The other options describe layering or integration.

Question 25Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A compliance officer notes that a customer's transactions are individually unremarkable but collectively form a pattern of round-sum transfers to the same counterparties on the same dates each month, with no commercial rationale. What is the most appropriate analytical conclusion?

  1. The pattern should be ignored because it recurs regularly
  2. The collective pattern indicates possible layering and warrants escalation despite each transaction appearing small Correct answer.
  3. The pattern proves the customer is guilty of money laundering
  4. The pattern is benign because each individual transaction is below the reporting threshold

Explanation

Effective monitoring looks at patterns across transactions rather than at each transaction in isolation. Regular round-sum transfers to the same counterparties without commercial rationale can indicate layering, so escalation is warranted even when individual amounts are small. A pattern raises suspicion but does not by itself prove guilt.

Question 26Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Under the risk-based approach, which factor most directly determines the depth of customer due diligence an institution applies?

  1. The number of staff employed in the compliance function
  2. The assessed money laundering and terrorist financing risk of the relationship Correct answer.
  3. The currency in which the customer prefers to be billed
  4. The length of time the institution has held a banking licence

Explanation

The risk-based approach requires institutions to calibrate due diligence measures to the assessed ML/TF risk of each customer and relationship. Resources, billing preferences and licence history do not set the level of due diligence. Higher risk demands enhanced measures, while lower risk may permit simplified measures where conditions are met.

Question 27Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which activity is the clearest example of the layering stage of money laundering?

  1. Depositing cash from illegal gambling into a restaurant's daily takings
  2. Transferring funds through several shell companies in different jurisdictions to obscure their origin Correct answer.
  3. Purchasing a luxury car with laundered funds for personal use
  4. Placing drug proceeds into a casino's chip purchase window

Explanation

Layering involves a series of transactions designed to distance illicit funds from their source and break the audit trail, such as moving money through multiple entities and jurisdictions. Depositing cash into a business or buying casino chips are placement activities. Buying an asset for personal enjoyment represents integration.

Question 28Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

What is the primary purpose of a jurisdiction requiring financial institutions to freeze funds without delay when a terrorist designation is made?

  1. To ensure designated persons cannot access or move the funds while authorities act Correct answer.
  2. To generate revenue for the government through asset confiscation
  3. To compensate victims of the terrorist acts directly from the frozen accounts
  4. To punish the institution for inadequate screening of its customers

Explanation

Targeted financial sanctions require funds of designated persons and entities to be frozen immediately so they cannot be used or moved for terrorist purposes. Freezing is a preventive, prohibitory measure rather than a punitive or revenue measure. Institutions must also report the freeze to the competent authority.

Question 29Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution is designing its customer risk assessment model. Which combination of factors is most consistent with recognised risk indicators?

  1. Customer receives a monthly salary by transfer and holds a single deposit account
  2. Customer operates a cash-intensive business, is resident abroad in a higher-risk jurisdiction, and uses complex offshore structures Correct answer.
  3. Customer is a retired civil servant with a pension credited domestically
  4. Customer is a long-standing resident, products are simple savings accounts, and all transactions are domestic

Explanation

Cash-intensive activity, residence in a higher-risk jurisdiction and complex offshore structures are all established risk indicators that should raise the customer's risk rating. The other scenarios describe simple, transparent and domestically focused relationships. Risk factors should be assessed together rather than in isolation.

Question 30Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which statement best describes the function of customer due diligence at onboarding?

  1. It replaces the need for ongoing transaction monitoring once completed
  2. It establishes the customer's identity and the purpose of the relationship before activity begins Correct answer.
  3. It guarantees that the customer will never commit a financial crime
  4. It is only required for corporate customers, not individuals

Explanation

Customer due diligence identifies and verifies the customer, understands the intended nature of the relationship and identifies beneficial owners where relevant. It is a foundation for monitoring, not a substitute for it. Due diligence applies to individuals as well as corporate customers.

Question 31Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Why does the FATF Recommendations framework require countries to criminalise terrorist financing separately from money laundering?

  1. Because terrorist financing is handled exclusively by military authorities
  2. Because terrorist financing always involves the proceeds of crime
  3. Because money laundering offences only apply to corporate entities
  4. Because terrorist financing can involve legitimately sourced funds, so a proceeds-based offence alone would not capture it Correct answer.

Explanation

Terrorist financing can be funded from lawful sources such as salary or donations, so an offence built solely on dealing with criminal proceeds would not cover it. The FATF therefore requires a standalone terrorist financing offence. Money laundering offences apply to natural and legal persons alike.

Question 32Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which measure best supports an institution's obligation to conduct ongoing monitoring of a business relationship?

  1. Limiting monitoring to transactions above a fixed high threshold only
  2. Relying solely on the customer's self-declaration that nothing has changed
  3. Reviewing transactions against the customer's expected activity profile on a risk-sensitive basis Correct answer.
  4. Collecting the customer's signature specimen once at onboarding and never revisiting it

Explanation

Ongoing monitoring means scrutinising transactions against the customer's known profile and updating due diligence on a risk-sensitive basis. A one-off signature record does not monitor activity. Self-declaration and threshold-only screening leave gaps that risk-based monitoring is designed to close.

Question 33Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

What is the essential difference between a politically exposed person and an ordinary higher-risk customer?

  1. A PEP holds a prominent public function, which creates specific reputational and corruption risks requiring enhanced measures Correct answer.
  2. A PEP is exempt from customer due diligence
  3. A PEP is always a foreign national
  4. A PEP must be reported to the police on identification alone

Explanation

A PEP is entrusted with a prominent public function, and that position creates exposure to bribery and corruption risk, so enhanced due diligence and senior management approval are typically required. PEP status is not limited to foreign nationals. Identification of a PEP does not by itself require a police report.

Question 34Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An analyst reviews a client's account and finds regular round-sum transfers to the same overseas beneficiary just below the reporting threshold, with no apparent commercial purpose. Which action is most appropriate?

  1. Ignore the pattern because each transfer is individually small
  2. Document the analysis and escalate for a suspicious transaction report if suspicion is not dispelled Correct answer.
  3. Close the account immediately without further inquiry
  4. Ask the beneficiary's bank to confirm the client's identity before doing anything

Explanation

Structuring below thresholds with no apparent purpose is a recognised suspicion indicator, and the analyst should record the reasoning and escalate so the MLRO can consider reporting. Immediate closure without inquiry is disproportionate and may tip off the customer. Small individual amounts do not neutralise a suspicious pattern.

Question 35Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution relies on a third party to conduct customer due diligence. Which responsibility remains with the institution?

  1. None, because the third party assumes full legal responsibility
  2. Responsibility only if the third party is located in the same jurisdiction
  3. Responsibility only for corporate customers introduced by the third party
  4. Ultimate responsibility for compliance, including obtaining due diligence information without delay Correct answer.

Explanation

Where reliance on a third party is permitted, the institution remains responsible for meeting due diligence requirements and must be able to obtain the necessary information promptly. The third party does not absorb the institution's legal obligations. Jurisdiction of the introducer does not shift that responsibility.

Question 36Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A customer's declared occupation is a salaried teacher, but monthly credits to the account consistently exceed the declared salary by a large multiple, sourced from various unrelated companies. What is the most appropriate analytical conclusion?

  1. The credits should be ignored because they originate from companies
  2. The activity is inconsistent with the customer's profile and warrants escalation and possible reporting Correct answer.
  3. The account is low risk because the customer is employed
  4. The customer should be asked to close the account immediately

Explanation

Unexplained inflows far exceeding a declared salary, especially from multiple unrelated sources, are inconsistent with the customer's profile and are a recognised red flag. Employment status alone does not make an account low risk. The proper response is documented escalation and consideration of a suspicious transaction report.

Question 37Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which approach best reflects the risk-based principle when an institution considers whether to apply enhanced due diligence to a correspondent relationship in a higher-risk jurisdiction?

  1. Apply simplified due diligence because correspondent banking is a standard product
  2. Apply enhanced due diligence because the higher-risk jurisdiction elevates the relationship's risk Correct answer.
  3. Apply no due diligence because the correspondent is itself a regulated bank
  4. Apply due diligence only if the correspondent requests it

Explanation

Correspondent relationships, particularly with institutions in higher-risk jurisdictions, are inherently higher risk and call for enhanced due diligence such as understanding the respondent's business and controls. Being regulated does not remove the need for assessment. Simplified measures are inappropriate where risk is elevated.

Question 38Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

What is the principal purpose of a jurisdiction's suspicious transaction reporting regime?

  1. To replace the institution's own monitoring systems
  2. To provide the financial intelligence unit with information that can support investigation of possible financial crime Correct answer.
  3. To publicly name customers who are suspected of offences
  4. To recover funds directly for victims of fraud

Explanation

Suspicious transaction reports feed the financial intelligence unit with information that can be analysed and disseminated for investigation. Reporting is confidential and does not publicly name suspects. It complements rather than replaces internal monitoring.

Question 39Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution's customer is a trust whose settlor, trustee and beneficiaries are all located in different jurisdictions and the trustee declines to identify the beneficiaries. What is the most appropriate response?

  1. Proceed because the trustee is a professional and therefore trustworthy
  2. Treat the structure as higher risk, seek to identify beneficial owners, and consider declining or exiting if information is unavailable Correct answer.
  3. Apply simplified due diligence because trusts are common vehicles
  4. Accept the trustee's assurance without further inquiry

Explanation

Complex multi-jurisdictional trust structures with undisclosed beneficiaries present elevated risk, and institutions must identify beneficial owners. Where the required information cannot be obtained, the institution should consider not establishing or terminating the relationship. Professional status of the trustee does not remove the need for beneficial ownership information.

Question 40Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which circumstance most clearly justifies filing a suspicious transaction report based on attempted rather than completed activity?

  1. A customer requests a standard account statement
  2. A customer opens a savings account with a small deposit
  3. A customer asks about the institution's published fee schedule
  4. A customer asks detailed questions about how to structure transfers to avoid reporting and then leaves without transacting Correct answer.

Explanation

Suspicion can arise from attempted transactions, including enquiries aimed at evading reporting obligations, even where no transaction completes. Routine service requests and ordinary account opening do not by themselves create suspicion. Reporting attempted activity helps authorities identify emerging schemes.

Question 41Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

What does the term 'tipping off' refer to in the AML/CFT context?

  1. Sharing aggregated statistics with regulators
  2. Disclosing to a customer that a suspicious transaction report has been or may be made, where such disclosure is prohibited Correct answer.
  3. Informing a customer of changes to interest rates
  4. Reporting a suspicious transaction to the financial intelligence unit

Explanation

Tipping off is the prohibited disclosure of information that a report has been or may be made, which could prejudice an investigation. Legitimate reporting to the financial intelligence unit is not tipping off. Rate changes and statistical reporting are unrelated to the concept.

Question 42Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which statement correctly describes the relationship between an institution's AML/CFT programme and its senior management?

  1. Senior management may delegate all AML/CFT accountability to the MLRO and retain none
  2. Senior management is responsible for ensuring the programme is adequately resourced and that a compliance culture is set from the top Correct answer.
  3. Senior management's role is limited to signing the annual report
  4. Senior management is responsible only for customer-facing staff performance

Explanation

Senior management is accountable for the effectiveness of the AML/CFT programme, including resourcing, governance and tone from the top. Accountability cannot be fully delegated to the MLRO, who executes the programme. The role extends well beyond signing reports or managing front-line performance.

Question 43Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A customer with a declared business of importing electronics receives frequent cash deposits that are then immediately transferred to unrelated individuals abroad. Which conclusion is most defensible?

  1. The pattern is consistent with importing because importers handle cash
  2. The pattern requires no action because each deposit is small
  3. The pattern is low risk because the transfers are to individuals
  4. The pattern is inconsistent with the declared business and indicates possible layering, warranting escalation Correct answer.

Explanation

An importing business would ordinarily transact through commercial channels rather than depositing cash and wiring to unrelated individuals, so the activity is inconsistent with the profile and suggests layering. Immediate onward transfers to unrelated parties are a recognised red flag. Small individual amounts do not remove the concern.

Question 44Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which element is essential for an institution's AML/CFT training programme to be considered effective?

  1. Training tailored to staff roles and refreshed to reflect current risks and typologies Correct answer.
  2. Training limited to the compliance department
  3. Training delivered once at induction with no refresher
  4. Training consisting only of a signed acknowledgement form

Explanation

Effective training is role-appropriate, ongoing and updated to reflect evolving risks and methods. One-off induction training and pure form-signing do not build the awareness needed. Training should reach relevant staff across the institution, not only compliance.

Question 45Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution is considering applying simplified due diligence to a category of products. Which condition must be satisfied before it may do so?

  1. The institution must obtain approval from every customer in the category
  2. The products must be marketed online only
  3. The institution must have determined that the products present lower ML/TF risk, supported by adequate analysis Correct answer.
  4. The products must be sold only to corporate customers

Explanation

Simplified measures are permitted only where the institution has established that the risk is genuinely lower, based on adequate analysis of the product, customer and delivery factors. Customer type, channel or customer consent are not the governing conditions. Simplified measures still require identity identification and ongoing monitoring.

Question 46Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

A customer asks to make a large one-off deposit through an agent who declines to state on whose behalf the funds are provided. What is the most appropriate action?

  1. Proceed because the agent is physically present
  2. Accept the deposit and record the agent's name only
  3. Decline or suspend the transaction pending identification of the person on whose behalf it is made Correct answer.
  4. Refer the matter to the customer's own bank

Explanation

Where a person acts on behalf of another, the institution must identify that other person and verify the authority of the representative. An agent who refuses to disclose the principal prevents this and the transaction should not proceed. Physical presence and recording the agent's name do not satisfy the requirement.

Question 47Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

Which feature of informal value transfer systems most complicates AML/CFT supervision?

  1. Settlement often occurs through netting and trust rather than documented account transfers, leaving limited audit trails Correct answer.
  2. They are prohibited in every jurisdiction
  3. They always use the SWIFT network
  4. They require the same customer identification as licensed banks

Explanation

Informal value transfer systems often settle obligations through netting and trust relationships rather than traceable account movements, producing sparse records. This makes it difficult to reconstruct transactions and identify parties. They do not necessarily use SWIFT and are not uniformly prohibited; where formalised, registration requirements may apply.

Question 48Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution has a correspondent relationship and wishes to mitigate the risks it presents. Which measure is most directly relevant?

  1. Gathering information on the respondent institution's business, reputation and AML/CFT controls, and conducting periodic review Correct answer.
  2. Reviewing only the volume of payments processed
  3. Relying entirely on the respondent's home supervisor's assurances
  4. Limiting assessment to the respondent's financial statements

Explanation

Due diligence on a correspondent relationship includes understanding the respondent's business, reputation, ownership, controls and the quality of its supervision, followed by periodic review. Reliance on supervisory assurances alone or on financial statements is insufficient. Payment volume is an operational metric, not a risk assessment.

Question 49Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution discovers that a customer is a domestic PEP and that a family member holds a senior role in a state-owned enterprise. How should the institution treat the family member for due diligence purposes?

  1. As exempt because state-owned enterprises are public bodies
  2. As an associated person attracting PEP-level risk and enhanced measures Correct answer.
  3. As low risk because the role is domestic
  4. As an ordinary customer because only the PEP themselves is relevant

Explanation

PEP definitions extend to family members and close associates of PEPs, because those relationships carry similar corruption and influence risk. Domestic PEPs are covered in many regimes, and state-owned enterprise roles may themselves be PEP positions. Enhanced measures should apply to the associated person.

Question 50Anti-Money Laundering and Counter-Financing of Terrorism (Core Level)

An institution's monitoring system generates a high volume of alerts, most of which are false positives. Which response best preserves the risk-based approach?

  1. Disable the rules generating the most alerts to reduce workload
  2. Lower all thresholds so that every transaction generates an alert
  3. Instruct analysts to close alerts without review to clear the backlog
  4. Tune thresholds and rules using documented analysis while retaining coverage of material risks Correct answer.

Explanation

Alert tuning should be evidence-based, adjusting thresholds and rules to reduce noise without creating blind spots for material risks. Disabling rules or closing alerts unreviewed destroys the control. Lowering all thresholds increases noise without improving detection.