I85PREP
⌘ K
HKIB ECF-Compliance Core study materials
HKIB ECF-Compliance Core study resources

HKIB ECF-Compliance Core practice questions

One question at a time. Build your HKIB ECF-Compliance Core understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Compliance (Enhanced Competency Framework on Compliance – Core Level)

Under the HKMA's Enhanced Competency Framework, which body is responsible for issuing the Core Level certification to compliance practitioners in Hong Kong?

  1. The Securities and Futures Commission, under its licensing regime
  2. The Hong Kong Monetary Authority, issuing certificates directly to individuals
  3. The Independent Commission Against Corruption, through its training arm
  4. The Hong Kong Institute of Bankers, acting as the administering body for the ECF Correct answer.

Explanation

The ECF is a banking-sector competency framework sponsored by the HKMA, but certification at the Core Level is administered and issued through the Hong Kong Institute of Bankers, which operates the certification scheme and the associated training and assessment arrangements. The HKMA sets the framework and recognises the certification but does not issue individual certificates.

Question 2Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance function reports that a relationship manager has been executing transactions for a customer without completing the required periodic review. Which three-lines-of-defence role does the compliance function perform in this situation?

  1. Second line, providing independent oversight and challenge to the business Correct answer.
  2. External assurance provider engaged by the audit committee
  3. First line, owning and managing the risk in the customer relationship
  4. Third line, providing independent assurance to the board

Explanation

In the three-lines-of-defence model the business line is the first line and owns the risk, while compliance and risk functions form the second line, providing independent oversight, advice and challenge. Internal audit is the third line and gives independent assurance to the board.

Question 3Compliance (Enhanced Competency Framework on Compliance – Core Level)

Which of the following best describes the primary purpose of a bank's compliance risk assessment?

  1. To set the interest rate charged on residential mortgage loans
  2. To determine the creditworthiness of corporate borrowers
  3. To rank compliance risks by likelihood and impact so that resources and controls are prioritised Correct answer.
  4. To calculate the bank's regulatory capital requirement for operational risk

Explanation

A compliance risk assessment identifies the compliance risks the bank faces and evaluates them by factors such as likelihood and impact, producing a prioritisation that drives the allocation of compliance resources and the design of controls. It is not a capital calculation, a credit assessment or a pricing exercise.

Question 4Compliance (Enhanced Competency Framework on Compliance – Core Level)

A customer asks a bank to open an account for a company incorporated in a jurisdiction identified by the bank as higher risk. Under a risk-based approach, what is the most appropriate initial response?

  1. Decline the relationship automatically because of the jurisdiction alone
  2. Apply enhanced due diligence, including identifying the beneficial owners and understanding the source of funds Correct answer.
  3. Proceed with standard due diligence and defer beneficial ownership checks to the first anniversary
  4. Open the account using simplified due diligence to avoid delay

Explanation

A risk-based approach does not mandate automatic refusal based on jurisdiction, but higher-risk situations require enhanced due diligence, including establishing beneficial ownership and understanding the purpose and source of funds. Simplified measures are not available where the risk is assessed as higher.

Question 5Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer discovers that a colleague in the front office has been structuring cash deposits to stay below reporting thresholds. What is the most appropriate immediate action under the bank's anti-money-laundering obligations?

  1. Escalate internally and make a suspicious transaction report to the Joint Financial Intelligence Unit Correct answer.
  2. Report the matter only if the customer later confirms the deposits were unusual
  3. Wait for the next scheduled internal audit review to raise the issue
  4. Confront the colleague and ask for a written explanation before deciding whether to report

Explanation

Suspicion of structuring, which is a typology of money laundering, must be escalated internally and reported promptly to the Joint Financial Intelligence Unit; tipping off the subject is itself an offence. Internal escalation should not delay or replace the statutory reporting obligation.

Question 6Compliance (Enhanced Competency Framework on Compliance – Core Level)

Which statement correctly describes the treatment of politically exposed persons under a risk-based anti-money-laundering regime?

  1. Senior management approval is required before establishing or continuing a relationship with a PEP Correct answer.
  2. PEP screening is required only for individual customers, not for beneficial owners
  3. PEPs may only be onboarded using simplified due diligence because they are public officials
  4. PEP status ends automatically once the person leaves public office, so monitoring can stop

Explanation

Enhanced measures for PEPs include senior management approval before establishing or continuing the relationship, establishing source of wealth and source of funds, and ongoing enhanced monitoring. PEP status does not automatically lapse on leaving office, and screening extends to beneficial owners.

Question 7Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank is designing its compliance monitoring plan. Which characteristic most distinguishes ongoing monitoring from a point-in-time compliance review?

  1. Ongoing monitoring is performed only by internal audit at the year end
  2. Ongoing monitoring replaces the need for any periodic independent review
  3. Ongoing monitoring is limited to reviewing staff expense claims
  4. Ongoing monitoring uses automated or systematic routines applied continuously to detect exceptions Correct answer.

Explanation

Ongoing compliance monitoring is a systematic, usually automated, process that runs continuously or at frequent intervals to detect exceptions and control breakdowns. It complements, but does not replace, periodic independent reviews and internal audit assurance.

Question 8Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank discovers a breach of a supervisory requirement. Under the HKMA's supervisory approach, which action is most consistent with good compliance practice?

  1. Notify the HKMA promptly, assess the cause and impact, and remediate with a documented plan Correct answer.
  2. Refer the matter to the SFC because all breaches are securities-related
  3. Correct the issue quietly and disclose it only if the HKMA asks during its next examination
  4. Wait until the annual report is published so the breach can be disclosed to shareholders

Explanation

Banks are expected to self-identify, promptly notify the HKMA of material breaches or issues, conduct root-cause analysis and implement a documented remediation plan. Concealment or delay undermines the supervisory relationship and may itself be a breach.

Question 9Compliance (Enhanced Competency Framework on Compliance – Core Level)

What is the principal purpose of the fit and proper criteria applied to bank directors and senior management?

  1. To guarantee that senior staff hold a minimum number of professional qualifications
  2. To satisfy shareholder expectations about board diversity
  3. To determine the remuneration package appropriate for executive directors
  4. To ensure persons in key positions have the competence, integrity and financial soundness to discharge their responsibilities Correct answer.

Explanation

Fit and proper criteria focus on matters such as integrity, competence, experience and financial soundness, ensuring that individuals in key positions can discharge their duties properly. Qualifications are relevant evidence but the criteria are broader than any single credential.

Question 10Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance manager is asked to approve a new product that involves outsourcing a critical function to a third-party provider. Which consideration is most directly relevant to the compliance assessment?

  1. Whether the product will be marketed in English or Chinese
  2. Whether the provider offers the lowest fee among competing vendors
  3. Whether the outsourcing arrangement creates regulatory, data protection or operational risks that can be adequately controlled Correct answer.
  4. Whether the provider's office is located in the same district as the bank

Explanation

Outsourcing, particularly of critical functions, raises regulatory and operational risks including data protection, concentration and oversight, which must be assessed and controlled. Cost, location and marketing language are commercial or operational factors rather than the core compliance consideration.

Question 11Compliance (Enhanced Competency Framework on Compliance – Core Level)

Which of the following best describes the purpose of a bank's conflict of interest policy?

  1. To identify, manage and where necessary disclose situations where personal or firm interests may improperly influence decisions Correct answer.
  2. To prohibit staff from holding any personal bank account
  3. To prevent employees from taking annual leave during peak periods
  4. To ensure that all staff are paid the same bonus

Explanation

A conflict of interest policy requires the identification of situations where interests may conflict, and the management, avoidance or disclosure of those conflicts so that decisions are not improperly influenced. It does not address leave planning, uniform bonuses or personal banking in general.

Question 12Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance function wants to test whether staff understand the whistleblowing policy. Which approach best evaluates effectiveness rather than mere awareness?

  1. Ask staff to sign a declaration that they have read the policy
  2. Confirm that the policy document is available on the intranet
  3. Count how many staff attended the annual policy briefing
  4. Review actual whistleblowing cases and assess whether concerns were escalated and resolved in line with the policy Correct answer.

Explanation

Effectiveness testing examines outcomes, such as whether concerns were properly escalated, investigated and resolved, and whether staff felt able to raise them. Attendance, document availability and signed declarations demonstrate awareness or communication, not whether the policy works in practice.

Question 13Compliance (Enhanced Competency Framework on Compliance – Core Level)

Under Hong Kong's anti-money-laundering legislation, which of the following is a recognised predicate offence for money laundering?

  1. Dealing with property known or believed to represent proceeds of an indictable offence Correct answer.
  2. Breaching a commercial lease agreement
  3. Publishing inaccurate marketing material
  4. Failing to file a tax return on time

Explanation

Money laundering in Hong Kong covers dealing with property that represents proceeds of an indictable offence, which is the broad category of predicate offence. Civil wrongs such as lease breaches or late tax filing are not themselves the proceeds-generating offences contemplated by the money laundering provisions.

Question 14Compliance (Enhanced Competency Framework on Compliance – Core Level)

A relationship manager proposes to rely on a third-party introducer to conduct customer due diligence. What must the bank ensure before relying on that introducer?

  1. That the introducer is regulated and supervised, and that the bank obtains the necessary due diligence information without undue delay Correct answer.
  2. That the introducer agrees to keep all records confidential from the bank
  3. That the introducer charges the customer a fee for the referral
  4. That the introducer is located in the same building as the bank

Explanation

Where reliance on a third party is permitted, the bank remains responsible for customer due diligence and must ensure the introducer is subject to adequate regulation and supervision and that the required information and records are obtained promptly. The bank cannot outsource its ultimate responsibility.

Question 15Compliance (Enhanced Competency Framework on Compliance – Core Level)

Which of the following best explains why a bank should maintain a regulatory change management process?

  1. To reduce the number of regulators the bank must deal with
  2. To identify new and amended requirements, assess their impact and update policies and controls before the effective date Correct answer.
  3. To transfer responsibility for compliance to external counsel
  4. To eliminate the need for internal audit reviews

Explanation

A regulatory change management process tracks developments in rules and guidance, assesses their impact on the bank's policies, systems and controls, and implements changes before the effective date. It does not reduce the number of regulators or remove the need for independent assurance.

Question 16Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is reviewing a marketing email that promises guaranteed investment returns. Which regulatory concern is most directly engaged?

  1. The capital adequacy treatment of the advertised product
  2. The credit rating of the issuer's parent company
  3. The prohibition on misleading or false representations in marketing communications Correct answer.
  4. The bank's liquidity coverage ratio

Explanation

Marketing communications must be accurate, fair and not misleading, and promises of guaranteed returns are a classic misleading representation. Capital, liquidity and credit rating considerations are prudential or credit matters, not the primary concern raised by the advertising content.

Question 17Compliance (Enhanced Competency Framework on Compliance – Core Level)

Which statement best describes the role of the bank's compliance committee in governance?

  1. It sets the bank's dividend policy
  2. It conducts the external audit of financial statements
  3. It provides oversight of compliance risk and advises the board or its risk committee on compliance matters Correct answer.
  4. It approves individual customer credit limits

Explanation

A compliance committee oversees the management of compliance risk, reviews compliance issues and reports, and advises the board or its risk committee. Credit approvals, external audit and dividend policy sit with other functions and committees.

Question 18Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's internal audit team finds that compliance monitoring reports were not reviewed by senior management for six months. Which control weakness does this most directly indicate?

  1. Overstaffing of the compliance monitoring team
  2. Insufficient marketing budget allocation
  3. Excessive customer due diligence documentation
  4. Inadequate escalation and oversight of compliance monitoring results Correct answer.

Explanation

Monitoring is only effective if results are escalated and reviewed by senior management so that issues are addressed. A six-month gap in review indicates a breakdown in the escalation and oversight control, not a documentation or resourcing surplus.

Question 19Compliance (Enhanced Competency Framework on Compliance – Core Level)

A customer's transaction pattern changes abruptly to involve large transfers to jurisdictions with no apparent business connection. Under a risk-based approach, what should the bank do first?

  1. Immediately close the account without further review
  2. Refer the matter to the credit department for a limit review
  3. Reduce monitoring because the customer has been known to the bank for years
  4. Conduct enhanced scrutiny of the transactions and consider whether a suspicious transaction report is warranted Correct answer.

Explanation

An unexpected change in transaction behaviour, particularly involving higher-risk jurisdictions, should trigger enhanced scrutiny and an assessment of whether suspicion arises requiring a report. Immediate closure without review and reduced monitoring are both inconsistent with a risk-based approach.

Question 20Compliance (Enhanced Competency Framework on Compliance – Core Level)

Which of the following is the most accurate description of the treatment of customer data under Hong Kong's personal data protection regime as it applies to compliance records?

  1. Personal data may be freely shared with any third party without restriction
  2. Personal data must be collected for lawful purposes and used consistently with those purposes, with appropriate security safeguards Correct answer.
  3. Customers have no right to access personal data held about them
  4. Compliance records are exempt from all data protection requirements

Explanation

The Personal Data (Privacy) Ordinance requires personal data to be collected for lawful and relevant purposes, used consistently with those purposes, and protected by appropriate security measures. Exemptions exist but are limited, and data subjects generally have access and correction rights.

Question 21Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank is assessing whether to treat a new customer segment as higher risk. Which factor is least relevant to that assessment?

  1. The countries in which the customers are based
  2. The nature of the customers' business activities
  3. The delivery channel through which the customers are onboarded
  4. The colour scheme used in the segment's marketing materials Correct answer.

Explanation

Risk factors for customer segments include geography, business activity, delivery channel and product type. Marketing colour schemes have no bearing on money laundering or compliance risk and are therefore the least relevant factor.

Question 22Compliance (Enhanced Competency Framework on Compliance – Core Level)

Which statement best captures the compliance function's responsibility when the business proposes a transaction that appears to conflict with regulatory requirements?

  1. Compliance should report the business unit directly to the SFC without internal escalation
  2. Compliance should approve the transaction to avoid delaying the business
  3. Compliance should clearly document its advice and escalate the disagreement through the appropriate governance channel Correct answer.
  4. Compliance should remain silent so the business bears sole responsibility

Explanation

Compliance must provide clear, documented advice and, where the business disagrees, escalate the matter through governance channels such as the compliance committee or senior management. Approving a non-compliant transaction or staying silent undermines the second-line role, and external reporting without internal escalation is inappropriate.

Question 23Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank uses an automated screening system for sanctions. Which practice best supports the effectiveness of that system?

  1. Screening only at onboarding and never thereafter
  2. Relying solely on the vendor's default settings without periodic review
  3. Disabling alerts that generate high volumes of false positives
  4. Regularly tuning screening parameters and reviewing alerts to balance false positives against missed matches Correct answer.

Explanation

Sanctions screening requires ongoing calibration and alert review so that the system detects genuine matches without becoming overwhelmed by false positives. Disabling alerts, relying on defaults and screening only at onboarding all weaken the control.

Question 24Compliance (Enhanced Competency Framework on Compliance – Core Level)

What is the primary purpose of the HKMA's supervisory policy on treating customers fairly as it applies to compliance?

  1. To ensure fair treatment of customers across product design, marketing, sales and post-sales service Correct answer.
  2. To set maximum interest rates for all loans
  3. To regulate the bank's capital structure
  4. To determine the eligibility of staff for promotion

Explanation

Treating customers fairly requires fair outcomes throughout the product lifecycle, including design, marketing, sales and after-sales service. It is a conduct requirement, not a pricing cap, an HR matter or a capital regulation.

Question 25Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance team is reviewing an outsourcing arrangement where the provider subcontracts a critical activity to a fourth party. Which action is most appropriate?

  1. Assess and approve the subcontracting arrangement and ensure the bank retains adequate oversight and exit options Correct answer.
  2. Ignore the subcontracting because the bank contracted only with the primary provider
  3. Terminate the arrangement immediately without any assessment
  4. Transfer responsibility for compliance to the fourth party

Explanation

Subcontracting of critical activities can affect the bank's risk profile and its ability to oversee the service and exit the arrangement, so it must be assessed and approved, with oversight and exit provisions maintained. The bank cannot ignore the chain or transfer its regulatory responsibility.

Question 26Compliance (Enhanced Competency Framework on Compliance – Core Level)

Under the Enhanced Competency Framework on Compliance, which body is responsible for setting the core competency standards that authorised institutions in Hong Kong apply to their compliance staff?

  1. The Independent Commission Against Corruption, under the Prevention of Bribery Ordinance
  2. The Securities and Futures Commission, acting alone under the Securities and Futures Ordinance
  3. The Hong Kong Institute of Bankers, acting as the sole statutory regulator of banks
  4. The Hong Kong Monetary Authority, in consultation with the industry and professional bodies Correct answer.

Explanation

The ECF is a modular framework issued by the HKMA in consultation with the banking industry and relevant professional bodies, and authorised institutions adopt it when setting competency expectations for compliance staff. The HKMA is the banking regulator and drives the framework, so it is the correct answer. The other bodies have their own mandates but do not set the ECF standards.

Question 27Compliance (Enhanced Competency Framework on Compliance – Core Level)

An authorised institution applies the ECF competency framework to a newly appointed compliance officer. Which combination of elements best reflects what the framework expects the institution to assess?

  1. Academic qualifications, relevant experience, professional certification and continuing professional development Correct answer.
  2. Only the number of years the officer has worked in the banking industry
  3. Only the officer's performance rating in the previous annual appraisal
  4. Only the officer's completion of an online anti-money-laundering course

Explanation

The ECF approach to competency combines qualifications, relevant work experience, recognised professional certification and ongoing CPD, so that competence is demonstrated across several dimensions. Relying on a single indicator such as tenure, appraisal rating or one course does not satisfy a competency-based framework. The institution should map each officer's profile against the applicable competency standards.

Question 28Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance analyst is unsure whether a proposed activity falls within the scope of the ECF Core Level. Which statement best describes the intended coverage of the Core Level?

  1. It is reserved exclusively for the chief compliance officer and board-level executives
  2. It provides the foundational compliance knowledge expected of staff performing compliance-related functions across the banking sector Correct answer.
  3. It covers only anti-money-laundering topics and excludes other compliance subjects
  4. It applies only to staff of the HKMA's own supervision department

Explanation

The Core Level establishes a common baseline of compliance knowledge and conduct expectations for staff in compliance-related roles across authorised institutions. It is not limited to the most senior officers or to a single subject area. Specialised levels then build on this foundation for particular functions.

Question 29Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance department is preparing a training plan aligned to the ECF. Which principle should guide how learning hours are structured for compliance staff?

  1. CPD hours should be identical for every employee regardless of role or risk exposure
  2. CPD should be planned and recorded over a defined cycle, with activities relevant to the individual's role and responsibilities Correct answer.
  3. CPD should be counted only when delivered in a classroom by an external provider
  4. CPD should be optional for experienced staff because competence is presumed after several years

Explanation

Continuing professional development under a competency framework is planned, relevant to the individual's role and risk exposure, and properly recorded over a defined cycle. It is not restricted to one delivery mode and is not waived for experienced staff. A uniform hour count for all employees ignores differing roles and learning needs.

Question 30Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer identifies that a new regulatory circular affects the bank's customer onboarding process. Which immediate step best reflects sound regulatory change management?

  1. Assess the impact on affected policies and controls, assign ownership and track remediation to completion Correct answer.
  2. Delegate the matter to the front office and close the item once acknowledged
  3. Wait for the next external audit to confirm whether any change is needed
  4. File the circular without further action because it does not take effect immediately

Explanation

Regulatory change management requires the bank to interpret a new requirement, assess which policies, processes and controls are affected, and assign accountable owners with tracked remediation. Simply filing or acknowledging the circular leaves the bank exposed to non-compliance. Deferring the assessment to audit reverses the control sequence.

Question 31Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance manager is documenting the three lines of defence model for a board paper. Which description of the second line is most accurate?

  1. It owns and manages risk directly in day-to-day business transactions
  2. It provides independent oversight and challenge of risk-taking through compliance and risk functions Correct answer.
  3. It sets the bank's risk appetite without reference to the business lines
  4. It provides independent assurance to the board on the effectiveness of controls

Explanation

In the three lines model, the first line owns and manages risk, the second line provides independent oversight, policy and challenge through functions such as compliance and risk, and the third line is internal audit giving independent assurance. Describing the second line as the direct risk owner or as the assurance provider confuses the roles. The board approves risk appetite with input from management rather than the second line acting alone.

Question 32Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is asked to advise on the bank's obligations regarding suspicious transaction reporting. Which statement best describes the reporting expectation?

  1. Report only after internal investigation has conclusively proved criminal conduct
  2. Report to the police district office nearest to the customer's address
  3. Report suspicion to the Joint Financial Intelligence Unit promptly, and do not tip off the customer Correct answer.
  4. Report to the customer first so that the relationship can be preserved

Explanation

Suspicion-based reporting under Hong Kong's anti-money-laundering regime goes to the Joint Financial Intelligence Unit, and the tipping-off offence prohibits disclosing the report to the customer. The obligation is triggered by suspicion, not by proof of criminal conduct. Reports are not routed to local police district offices.

Question 33Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance function is reviewing its approach to politically exposed persons. Which control is most consistent with a risk-based framework?

  1. Rely solely on the customer's self-declaration of PEP status at onboarding
  2. Treat all PEPs as prohibited customers and decline every relationship
  3. Apply standard due diligence because PEP status alone does not affect risk
  4. Apply enhanced due diligence, including source of wealth and source of funds checks, with senior management approval Correct answer.

Explanation

A risk-based approach to PEPs requires enhanced due diligence, including establishing source of wealth and source of funds, together with senior management approval for the relationship. A blanket prohibition is not required and would be disproportionate. Standard due diligence and self-declaration alone are insufficient given the heightened corruption risk.

Question 34Compliance (Enhanced Competency Framework on Compliance – Core Level)

During onboarding, a customer provides a copy of an identity document that appears altered. What is the compliance officer's most appropriate course of action?

  1. Accept the document because the customer has signed a declaration of authenticity
  2. Proceed with onboarding but apply a lower transaction limit for six months
  3. Escalate the discrepancy through the suspicious transaction reporting process and consider whether to proceed with the relationship Correct answer.
  4. Ask the relationship manager to correct the document image before filing

Explanation

An apparently altered identity document is a red flag that should be escalated through the bank's suspicious transaction reporting and customer risk processes, with a decision on whether to continue the relationship. Accepting a declaration or editing the document would conceal the issue. Imposing a transaction limit does not address the underlying suspicion.

Question 35Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance analyst is mapping the bank's obligations under Hong Kong's personal data regime. Which statement best reflects the role of a data protection officer in a bank?

  1. To approve every marketing campaign before it is sent to customers
  2. To take over the compliance function's monitoring responsibilities
  3. To decide whether the bank should report a data breach to the police
  4. To advise on and monitor compliance with data protection requirements and act as a contact point for data subjects and the regulator Correct answer.

Explanation

A data protection officer advises on and monitors compliance with the personal data regime and serves as a contact point for data subjects and the Privacy Commissioner. Marketing approval and breach notification decisions remain with the bank's management and compliance processes, informed by the DPO's advice. The DPO does not replace the compliance function's monitoring role.

Question 36Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank is assessing the compliance risk of a proposed new product. Which factor is least relevant to that compliance risk assessment?

  1. The distribution channels and reliance on third parties
  2. The jurisdictions involved and any sanctions exposure
  3. The colour scheme used on the product's marketing brochure Correct answer.
  4. The target customer segment and its vulnerability to mis-selling

Explanation

Compliance risk assessment focuses on factors such as customer vulnerability, cross-border and sanctions exposure, distribution channels and third-party reliance. The visual design of marketing material is not itself a compliance risk driver, although the content of the material is. Selecting the colour scheme identifies the least relevant factor.

Question 37Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance function is designing a monitoring programme for a high-risk business line. Which characteristic best distinguishes targeted monitoring from routine control testing?

  1. It is performed only by internal audit on an annual basis
  2. It replaces the need for first-line quality assurance
  3. It focuses on emerging risks and specific conduct themes identified through risk assessment Correct answer.
  4. It is limited to checking whether staff completed mandatory training

Explanation

Targeted compliance monitoring is risk-driven, focusing on emerging risks and specific conduct themes identified through the bank's risk assessment. It is distinct from internal audit assurance and does not replace first-line quality assurance. Limiting monitoring to training completion would leave substantive conduct risks untested.

Question 38Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is reviewing a customer complaint alleging that a product was misrepresented. Which action best reflects a fair treatment of customers approach?

  1. Reject the complaint because the customer signed the product terms
  2. Investigate the substance of the complaint, consider redress where warranted, and identify any systemic cause Correct answer.
  3. Offer a small goodwill payment without investigating the allegation
  4. Refer the customer to the product provider and close the file

Explanation

Treating customers fairly requires the bank to investigate complaints on their merits, provide redress where the customer has suffered loss, and address any systemic cause so that similar issues are prevented. Relying on signed terms, making a goodwill payment without investigation, or deflecting the customer to a third party does not meet this expectation.

Question 39Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer learns that a colleague has been bypassing a mandatory approval control for several months. What is the most appropriate first response under the bank's whistleblowing and escalation arrangements?

  1. Confront the colleague publicly and demand an explanation in front of the team
  2. Ignore the matter because the colleague is more senior
  3. Raise the concern through the bank's protected reporting channels so that it can be investigated independently Correct answer.
  4. Discuss the matter only with the colleague's direct reports

Explanation

Suspected control circumvention should be raised through the bank's protected reporting channels so that an independent investigation can take place and the reporter is protected from retaliation. Public confrontation risks tipping off and retaliation, while ignoring the matter or discussing it with subordinates does not enable proper investigation.

Question 40Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance committee is reviewing its terms of reference. Which feature best supports effective governance of the committee?

  1. Minutes recorded informally and retained for one month
  2. Membership drawn only from the business lines that generate the most revenue
  3. A defined membership, clear mandate, quorum rules and a documented escalation path to the board Correct answer.
  4. Meetings held only when a material breach has already occurred

Explanation

Effective committee governance depends on a clear mandate, defined membership and quorum, and a documented escalation route to the board. Membership dominated by revenue-generating lines undermines independence, and meeting only after a breach is reactive. Minutes should be properly recorded and retained under the bank's records policy.

Question 41Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank is reviewing its conflict of interest arrangements for a research and corporate finance relationship. Which control is most effective in managing the conflict?

  1. Requiring the research team to report to the head of corporate finance
  2. Physical and information barriers between the teams, with disclosure where appropriate Correct answer.
  3. Allowing the research team to share draft reports with corporate finance for comment
  4. Relying on staff to self-identify conflicts without any register

Explanation

Conflicts between research and corporate finance are typically managed through information barriers and, where residual conflict remains, appropriate disclosure. Sharing draft research with corporate finance or placing research under corporate finance management would compromise independence. A self-identification process without a register lacks the structure needed to track and manage conflicts.

Question 42Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank is reviewing its sanctions screening controls. Which practice best supports the effectiveness of an automated screening system?

  1. Periodic tuning and threshold calibration, with documented review of alerts and false positives Correct answer.
  2. Reviewing alerts only when a regulator requests evidence
  3. Setting the matching threshold so loosely that no alert is ever suppressed
  4. Disabling alerts for customers who have been with the bank for many years

Explanation

Effective automated screening depends on periodic tuning and calibration of matching thresholds, together with documented alert review and disposition of false positives. A system that never suppresses alerts becomes unmanageable, while disabling alerts for long-standing customers or reviewing only on regulatory request leaves exposure unmanaged.

Question 43Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is asked to approve an arrangement where a service provider will store customer records on cloud infrastructure outside Hong Kong. Which consideration is most relevant to the compliance assessment?

  1. Whether the outsourcing and data protection requirements are met, including access, security and regulatory notification Correct answer.
  2. Whether the provider offers the lowest price among the tenders received
  3. Whether the provider has previously worked for a competitor
  4. Whether the provider's staff speak Cantonese

Explanation

Outsourcing customer records to cloud infrastructure, particularly offshore, requires assessment against the bank's outsourcing and personal data obligations, including security, access, audit rights and any regulatory notification. Price, language capability and prior work for a competitor are commercial or incidental considerations rather than the core compliance issues.

Question 44Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's internal audit report notes that compliance monitoring findings were not escalated to senior management. Which remediation best addresses the root cause?

  1. Wait for the next audit cycle to see whether the issue recurs
  2. Ask the compliance team to work longer hours to clear the backlog
  3. Reduce the scope of compliance monitoring so fewer findings arise
  4. Establish a documented escalation protocol with defined thresholds and management reporting deadlines Correct answer.

Explanation

The root cause is the absence of a clear escalation mechanism, so remediation should establish documented thresholds, reporting lines and deadlines for management response. Increasing workload, narrowing monitoring scope or waiting for the next audit does not fix the governance gap and may weaken the control environment.

Question 45Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is reviewing the bank's records of customer instructions taken by phone. Which practice best supports the evidential value of those records?

  1. Deleting recordings after one week to reduce storage costs
  2. Recording calls where required, retaining recordings for the defined period, and ensuring they can be retrieved for review Correct answer.
  3. Retaining only a handwritten note prepared by the relationship manager
  4. Retaining recordings only when the customer requests a copy

Explanation

Recordings of customer instructions should be made where required, retained for the defined retention period and retrievable for compliance review or dispute resolution. A handwritten note alone is weak evidence, and deleting recordings early or retaining them only on request undermines the bank's ability to evidence what was agreed.

Question 46Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank's compliance function is assessing the risk that staff may accept gifts from customers. Which control is most effective in managing this conduct risk?

  1. An instruction that staff should decide case by case without guidance
  2. A gifts and entertainment policy with monetary limits, pre-approval and a register of declared items Correct answer.
  3. A rule that staff may accept any gift valued below a very high threshold without declaration
  4. A requirement that gifts be reported only after an annual audit

Explanation

Gift and entertainment risk is best managed through a policy with defined limits, pre-approval requirements and a register that records declared items for oversight. A very high undeclared threshold, unstructured case-by-case discretion or reporting only after audit leaves the risk largely uncontrolled.

Question 47Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is reviewing the bank's approach to managing conduct risk across sales incentives. Which measure is most aligned with good conduct outcomes?

  1. Rewarding staff solely on volume of products sold each month
  2. Allowing managers to override conduct findings where revenue targets are at risk
  3. Balancing sales incentives with quality and conduct metrics so that inappropriate sales are not rewarded Correct answer.
  4. Removing all conduct metrics to simplify performance reviews

Explanation

Incentive structures that reward volume alone can drive mis-selling, so good practice balances sales measures with quality and conduct metrics. Removing conduct metrics or permitting managers to override conduct findings where revenue is at risk weakens the control environment and increases mis-selling risk.

Question 48Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is asked to advise on the bank's approach to managing bribery risk in its dealings with government officials. Which control is most directly relevant?

  1. Risk-based due diligence on intermediaries and clear rules on facilitation payments and gifts to officials Correct answer.
  2. Relying on the intermediary's assurance that it complies with local law
  3. Approving payments to officials without documentation to speed up processing
  4. A policy that permits small facilitation payments because they are customary

Explanation

Managing bribery risk involving public officials requires risk-based due diligence on intermediaries and clear prohibitions or controls on facilitation payments and gifts. Permitting facilitation payments, relying on an intermediary's assurance or approving undocumented payments all increase exposure to bribery offences and reputational harm.

Question 49Compliance (Enhanced Competency Framework on Compliance – Core Level)

A bank is designing its compliance risk assessment methodology. Which approach best reflects a sound methodology?

  1. Assess inherent risk and control effectiveness to derive residual risk, and refresh the assessment periodically Correct answer.
  2. Set residual risk equal to inherent risk for all business lines
  3. Conduct the assessment once at inception and never update it
  4. Assess only inherent risk because controls are assumed to operate as designed

Explanation

A sound compliance risk assessment considers inherent risk, evaluates the effectiveness of controls, and derives residual risk, with periodic refresh as the business and regulatory environment change. Assuming controls always operate, equating residual with inherent risk, or never updating the assessment produces misleading risk information.

Question 50Compliance (Enhanced Competency Framework on Compliance – Core Level)

A compliance officer is reviewing a proposed transaction that appears designed to avoid a regulatory threshold through a series of smaller linked transactions. Which response is most appropriate?

  1. Apply a fee surcharge and process the transactions as requested
  2. Treat the pattern as potential structuring, escalate it and consider a suspicious transaction report Correct answer.
  3. Approve the transactions because each one individually falls below the threshold
  4. Ask the customer to split the transactions over a longer period

Explanation

A series of smaller linked transactions that appears designed to avoid a threshold is a classic structuring indicator, which should be escalated and considered for suspicious transaction reporting. Approving each transaction on its individual size, spreading them over time or simply charging a fee fails to address the underlying suspicion.