IATI Diploma common mistakes
IATI Diploma · Understand the traps and how to avoid them.
Treating AML/CTF as a single control rather than a layered regime, so when asked what the primary purpose of AML controls is, the candidate picks 'detect fraud' or 'protect the bank's reputation' instead of protecting the integrity of the financial system from criminal abuse.
Candidates import assumptions from fraud or corporate-risk training and conflate predicate-offence detection with the distinct AML objective of preventing criminal proceeds entering the system.
What to do instead
Before answering, state to yourself the objective of each regime: AML targets proceeds of crime and system integrity; CTF targets terrorist financing regardless of whether funds are licit in origin; fraud controls target loss to the institution. Reject any option framed around institutional profit or reputation as the primary purpose.
Reciting FATF Recommendations by number and title but failing application questions that require identifying which Recommendation governs a scenario, e.g. mislabelling the risk-based approach as Recommendation 1 versus the customer due diligence requirements of Recommendation 10.
Rote memorisation of the Recommendation list without mapping each to its operational consequence; exam questions test function, not numbering.
What to do instead
Build a two-column table: control function (risk-based approach, CDD, record keeping, PEPs, correspondent banking, STRs, sanctions, wire transfers, DNFBPs) against the Recommendation(s) that mandate it. Practise scenario stems by asking 'which function is being described?' first, then recall the number.
Producing a risk assessment that is a list of risk categories with no scoring logic, no inherent-versus-residual distinction, and no link to the controls actually applied, then answering questions as though the assessment were complete once the categories are named.
Candidates confuse identifying risks with assessing them, and are unfamiliar with the inherent risk, control effectiveness, residual risk chain.
What to do instead
For any risk-assessment question, verify four elements are present: the risk identified, the inherent rating with stated drivers, the control(s) mitigating it, and the residual rating with justification. If an answer option stops at identification, it is incomplete.
Applying CDD as a documentary checklist, so when a question describes a customer who cannot produce conventional identification, the candidate answers that the relationship must be refused rather than considering reliable, independent alternative sources and non-face-to-face verification methods.
Training materials often present ID documents as the definition of CDD rather than one means of verification; candidates also conflate inability to produce a document with inability to verify identity.
What to do instead
Separate the four CDD components in every answer: identify the customer, verify identity using reliable independent sources, identify the beneficial owner, and understand purpose and intended nature. Ask which component is missing, not which document is missing.
Treating 'high risk' and 'PEP' as automatic refusal categories, or conversely treating enhanced due diligence as simply collecting more documents, rather than as additional measures proportionate to the risk such as source of funds and source of wealth analysis and senior management approval.
Candidates collapse risk classification into a binary decision and do not know the specific EDD measures required for PEPs, correspondent relationships, and higher-risk jurisdictions.
What to do instead
Memorise EDD as a defined set of additive measures: enhanced identity verification, source of funds and source of wealth, senior management sign-off, and enhanced ongoing monitoring. When a question asks what EDD requires, look for those substantive measures rather than volume of paperwork.
Confusing the reporting obligation with the investigation obligation, e.g. answering that the institution must establish that the activity is criminal before filing an STR, or that tipping off is permitted to a colleague in the same firm who is not part of the compliance function.
Candidates reason from a law-enforcement standard of proof rather than the AML standard of suspicion, and underestimate the breadth of the tipping-off prohibition.
What to do instead
Anchor on the trigger: suspicion or reasonable grounds to suspect, not proof. File the report; do not investigate to confirm. On tipping off, ask whether the disclosure could prejudice an investigation, and remember internal disclosure on a need-to-know basis within the reporting chain is the narrow exception, not a general licence.
Treating sanctions screening as identical to AML transaction monitoring, so the candidate answers that a sanctions match should be filed as an STR and the transaction allowed to proceed pending investigation, rather than recognising the obligation to freeze without delay and not to deal in the funds.
Both regimes use screening and alerting, and candidates miss the decisive differences: strict liability versus suspicion, no de minimis threshold, and an immediate prohibition on dealing rather than a reporting decision.
What to do instead
Contrast the two explicitly in revision: AML is suspicion-based, threshold-free but judgement-led, and results in a report; sanctions are list-based, strict liability, and result in a freeze and a report to the competent authority. For any sanctions question, the first question is 'can we deal at all?' not 'should we report?'
Answering governance questions by naming the compliance officer as the owner of AML risk, rather than the board and senior management, and describing the compliance function as having sole responsibility for the programme.
Candidates conflate operational execution of controls with accountability for them, and the phrase 'compliance officer' in a stem invites attribution of ownership.
What to do instead
Fix the accountability line: the board and senior management own the AML/CTF programme and the risk appetite; the compliance officer executes and advises but does not absorb the risk. Any option that places ultimate responsibility on the MLRO or compliance function alone is wrong.
Describing the three lines of defence in name only, so when asked where independent testing sits, the candidate places it in the business line or in internal audit interchangeably, or says the compliance function can audit its own controls.
The model is memorised as a slogan without the independence logic that determines which function may perform which role.
What to do instead
Attach one function to each line and test independence: first line owns and manages risk in the business; second line sets frameworks, advises and monitors compliance; third line is internal audit, independent of both and reports to the board or audit committee. Anything requiring independence of the control owner belongs to the third line.
Applying a one-size-fits-all monitoring threshold and treating every alert as either a false positive to be closed or a report to be filed, without documenting the rationale for closure or considering the customer's expected activity profile.
Candidates lack the link between CDD-derived expected behaviour and monitoring calibration, and see alert disposition as binary rather than as a documented judgement.
What to do instead
For monitoring questions, reason in three steps: what did CDD establish as expected activity, how does the alert deviate from it, and what is the documented disposition and rationale. Choose answers that show calibrated thresholds and recorded reasoning over answers that simply escalate or dismiss.