IIBF AML/KYC common mistakes
IIBF AML/KYC · Understand the traps and how to avoid them.
Treating KYC as a one-time account-opening formality and selecting 'verify identity at onboarding only' as the correct answer, ignoring ongoing due diligence and periodic re-KYC triggers.
Candidates study the account-opening checklist in isolation and miss that KYC is a continuing obligation; the exam tests event-driven and periodic review (change in profile, high-risk refresh cycles, PEP status changes) rather than a single point-in-time check.
What to do instead
Reframe KYC as a lifecycle: customer identification, verification, risk categorisation, ongoing monitoring, and periodic/event-triggered update. For every KYC question, ask 'at what stage does this control sit and what re-triggers it?' before choosing an option.
Selecting 'obtain a certified copy of the passport/utility bill' as sufficient proof of identity without considering independent verification, the risk-based approach, and the acceptability of documents for the specific customer type.
Candidates memorise document lists but do not apply the underlying principle that identification data must be verified through a reliable, independent source; they also conflate identification (who the customer is) with verification (proving it).
What to do instead
Drill the distinction: identification = collecting name, address, DOB, ID number; verification = confirming those details against an independent, reliable source. When a question asks about adequacy, test the option against 'independent, reliable, risk-appropriate' rather than 'commonly requested'.
Identifying only the immediate customer and omitting beneficial ownership, so answers stop at the nominee director or front company instead of tracing to the natural person who ultimately owns or controls the entity.
Beneficial ownership thresholds, control tests, and the treatment of layered corporate structures are the least intuitive part of KYC; candidates default to the person signing the form.
What to do instead
Practise ownership-chain questions: apply the ownership threshold, then the control test (senior managing official only as a last resort), and always ask 'who is the natural person at the top?'. Learn to distinguish legal owner, beneficial owner, and authorised signatory.
Classifying a customer as low risk by default when information is missing, rather than treating incomplete CDD as a reason to delay onboarding, restrict activity, or consider exiting the relationship.
Candidates assume 'no adverse information found' equals low risk, and forget that inability to complete CDD is itself a red flag that should block the relationship, not lower the risk score.
What to do instead
Memorise the CDD failure ladder: cannot complete CDD → do not establish/continue the relationship, consider SAR/STR, consider exit. When an option says 'proceed and monitor', check whether CDD was actually completed first.
Confusing the three AML stages and labelling placement, layering, and integration incorrectly, for example calling the use of shell companies to move funds 'placement'.
Textbook definitions blur in scenario questions where cash enters a business (placement), is moved through accounts (layering), and returns as apparently legitimate funds (integration); candidates answer by keyword rather than by the economic function of the step.
What to do instead
Anchor each stage to its purpose: placement = entering the financial system; layering = obscuring origin through transactions; integration = re-entering as legitimate. In scenarios, ask 'is value entering, being disguised, or being spent/invested?' before naming the stage.
Choosing the largest or most obvious transaction as the suspicious one in a scenario, missing structuring, smurfing, and threshold-avoidance patterns that are individually unremarkable.
Candidates look for big amounts and ignore behavioural indicators; they also forget that structuring is suspicious precisely because each transaction sits below the reporting threshold.
What to do instead
Build a red-flag checklist: just-below-threshold amounts, repeated round sums, rapid movement with no economic rationale, third-party funding, unusual channels, and mismatch with stated profile. In scenario questions, compare each pattern to the customer's declared business before deciding.
Treating suspicious transaction reporting as discretionary and selecting 'report only after internal investigation confirms the funds are criminal', or disclosing the report to the customer.
Candidates import a criminal-standard 'proof' mindset into a regime built on suspicion; they also underweight the tipping-off prohibition and the protection for good-faith reporting.
What to do instead
Memorise the reporting logic: reasonable suspicion, not proof; report promptly to the FIU through the nominated officer; never tip off the customer; good-faith reports attract legal protection. Reject any option that requires certainty or customer notification.
Mixing up the roles of the customer-facing staff, the principal/nominated officer, and senior management, for example assuming the front office decides whether to file an STR.
Candidates learn controls as a list without mapping each to an owner; exam questions test accountability for reporting, record keeping, and training.
What to do instead
Create a responsibility map: all staff detect and escalate; the nominated/principal officer assesses and files; senior management owns the AML programme and policy; the board approves it. Answer role questions by matching the action to the accountable function.
Applying normal CDD to a terrorist-financing scenario and waiting for a transaction to occur, instead of recognising that CFT focuses on associations, designated persons, and fund-raising intent even with small or dormant amounts.
Candidates carry over AML habits (follow the money, look for large sums) into CFT, where the key indicators are links to designated individuals or organisations, charitable diversion, and low-value fundraising that never looks like laundering.
What to do instead
Separate the two lenses: AML targets the proceeds of crime and concealment; CFT targets the destination and purpose of funds, including legitimate-source money intended for terrorism. Screen against designated lists, check association and geography, and treat small transfers to conflict zones as potentially high risk.
Assuming sanctions and terrorist-financing screening is a one-off check at onboarding, and missing the need for ongoing screening against updated lists, plus immediate freezing and reporting when a match occurs.
Candidates treat screening as a KYC document rather than a live control; they forget that designations change daily and that asset freezing is immediate and mandatory, distinct from an STR.
What to do instead
Learn the sequence for a confirmed match: freeze without delay, do not tip off, report to the competent authority, and review the relationship. Remember that screening is continuous and applies to existing customers, beneficial owners, and transactions, not just new accounts.