Korea AML Specialist (TPAC) common mistakes
Korea AML Specialist (TPAC) · Understand the traps and how to avoid them.
Treating the AML/CFT framework as a single statute and answering as if the Act on Reporting and Using Specified Financial Transaction Information (특정금융정보법, 'Special Act') alone governs every obligation, ignoring that customer identification duties also arise under sectoral laws such as the Banking Act, the Capital Markets Act, and the Act on the Protection of Financial Consumers, and that the Financial Services Commission (FSC) and Korea Financial Intelligence Unit (KoFIU) issue subordinate notices that fill in operational detail.
Candidates study the Special Act in isolation because it is the most visible AML statute, and they do not map which regulator owns which obligation. Exam items that describe a concrete scenario (e.g., opening an account, a securities firm onboarding a client, a consumer-protection disclosure) test whether the candidate can identify the correct legal basis, not just the AML concept.
What to do instead
Build a one-page matrix of legal instruments (Special Act, Enforcement Decree, KoFIU notices, sectoral acts, FSC/FSS regulations) against obligation types (CDD, STR, CTR, TFS, recordkeeping, governance). For each practice question, first name the legal instrument and the supervisory authority before choosing the answer, and drill scenarios drawn from banking, securities, insurance, and e-money sectors separately.
Applying FATF Recommendations as if they were directly binding Korean law, or conversely ignoring them entirely when a question concerns cross-border obligations; candidates also conflate the 40 Recommendations with the 11 Immediate Outcomes of the FATF Methodology or with the mutual evaluation process.
The exam tests both domestic law and international standards, and candidates often learn one without the other. FATF standards are implemented through domestic legislation, so a question can be answered correctly only if the candidate knows both the Recommendation and the Korean implementing provision. Confusion between Recommendations, Immediate Outcomes, and the assessment methodology is common because the source documents overlap in vocabulary.
What to do instead
For each FATF Recommendation relevant to the syllabus, write the Korean implementing instrument beside it (e.g., Recommendation 10 to Special Act CDD provisions and KoFIU notice; Recommendation 16 to the travel rule for virtual asset transfers; Recommendation 20 to STR duties). Separately memorise the structure of the Methodology: 11 Immediate Outcomes, the rating scale (C, LC, PC, NC), and the difference between technical compliance and effectiveness.
Treating CDD as a one-time onboarding checklist and failing to apply ongoing due diligence triggers, such as a change in beneficial ownership, a transaction inconsistent with the customer profile, or a periodic review falling due; candidates also answer that simplified due diligence can be applied to a PEP or to a high-risk jurisdiction customer.
Training material often emphasises the initial identification step, so candidates internalise CDD as a form to complete rather than a continuous process. Simplified due diligence is easy to over-apply because candidates remember that it exists but not the conditions that prohibit it.
What to do instead
Memorise CDD as four components (identification and verification, beneficial ownership identification, purpose and intended nature of the relationship, ongoing monitoring) and practise scenario questions that turn on a trigger event rather than an onboarding event. Drill the rule that simplified measures are unavailable for PEPs, high-risk third countries, and customers with suspicious indicators, and that enhanced measures are mandatory in those cases.
Stopping beneficial ownership analysis at the first corporate layer or at the 25% threshold, without tracing through intermediate holding companies, nominee arrangements, or trusts, and without recognising when control (not ownership percentage) makes a person a beneficial owner.
Candidates learn the numerical threshold and treat it as the whole test, forgetting that control-based beneficial ownership and the residual requirement to identify a senior managing official apply when no natural person meets the threshold. Complex structures are intimidating, so candidates take the first plausible answer.
What to do instead
Practise ownership-chain exercises with three or more layers, nominee shareholders, and trusts, calculating cumulative percentages at each layer. Memorise the decision order: natural person ownership threshold, then control via other means (voting agreements, nominee arrangements, power to appoint management), then senior managing official as a residual measure with enhanced scrutiny. Confirm the exact Korean threshold and definition against the current Special Act and Enforcement Decree rather than relying on memory.
Reporting a suspicious transaction only after internal investigation is complete, or waiting for proof of wrongdoing, and missing the timing requirement; candidates also fail to distinguish the STR filing obligation from the internal reporting escalation path and from the tipping-off prohibition.
Candidates conflate 'suspicion' with 'evidence' and assume the report must be well-substantiated. Real-world caution about customer relationships and fear of error also push toward delay. The distinction between the internal escalation deadline and the external KoFIU filing deadline is rarely practised.
What to do instead
Drill the standard: report based on reasonable suspicion, without requiring proof, within the statutory deadline measured from the point suspicion arises. Map the internal escalation chain (staff to AML officer to designated reporting officer) with its own internal deadlines, and separately memorise the tipping-off prohibition and its exceptions. Practise questions that give a timeline and ask whether the filing was timely.
Confusing the currency transaction report threshold and aggregation rules with STR obligations, or assuming that a CTR filing satisfies the STR obligation; candidates also misapply the rule on aggregating multiple cash transactions and on which cash-intensive products are in scope.
Both reports concern cash and are filed through the same KoFIU channel, so candidates merge them in memory. Aggregation rules (same customer, same day, linked transactions) are easy to state but hard to apply to a numerical scenario, and candidates do not practise the arithmetic.
What to do instead
Write a side-by-side comparison of CTR and STR: trigger, threshold, timing, aggregation, who files, and consequences of failure. Practise numerical scenarios with multiple same-day cash deposits, split transactions across branches, and transactions just below the threshold, and state explicitly that a CTR does not discharge the STR duty when suspicion exists.
Treating sanctions screening as a name-matching exercise only, ignoring ownership and control-based designation (the 50% rule), alias and transliteration issues for Korean and foreign names, and the distinction between targeted financial sanctions freezing obligations and ordinary AML risk management.
Screening tools return name hits, so candidates focus on false-positive handling and forget that a company owned or controlled by a designated person is itself subject to freezing. Korean names create genuine transliteration ambiguity, which candidates either over-handle (blocking every hit) or under-handle (dismissing without documented analysis).
What to do instead
Study the ownership and control test for designated persons and practise questions where the listed entity is not the customer but owns the customer. Build a false-positive workflow (identifier comparison, date of birth, nationality, address, documented disposition) and a separate escalation path for confirmed matches with immediate freezing and reporting to the competent authority. Review the Korean implementation of UN Security Council resolutions and the relevant TFS regime.
Assuming that a PEP determination is permanent and applies only to foreign officials, or conversely applying enhanced due diligence to every politically exposed person without distinguishing domestic PEPs, international organisation PEPs, and family members or close associates.
The PEP concept is taught with a few headline examples, so candidates generalise from them. The risk-based graduation of measures for different PEP categories, and the requirement to reassess PEP status after the person leaves office, are details that are easily skipped.
What to do instead
Memorise the PEP categories (foreign, domestic, international organisation, family members, close associates) and the measures attached to each, including senior management approval, source of wealth and source of funds checks, and enhanced ongoing monitoring. Drill the rule on when PEP status ends or is reassessed after leaving public office, and confirm the Korean statutory definition and any risk-based carve-outs in the current supervisory guidance.
Describing AML governance in generic terms (board oversight, a compliance officer, training, audit) without naming the specific Korean requirements: designation of an AML reporting officer (자금세탁방지담당임원) and reporting to KoFIU, the role of the compliance officer versus internal audit, the independence of testing, and the recordkeeping retention period.
Governance questions look like common sense, so candidates answer from general knowledge and miss the statutory designations and reporting relationships that the exam tests. Independent testing is often confused with internal audit or with regulatory examination.
What to do instead
Build an organisation chart of AML roles under the Special Act and supervisory regulations, with reporting lines, designation and notification duties, and qualifications. Separately define independent testing (scope, frequency, tester independence, reporting to the board or audit committee) and distinguish it from the compliance function's monitoring. Memorise the recordkeeping retention period and confirm current figures against the statute.
Applying bank-style CDD and STR reasoning unchanged to virtual asset service providers, and missing the travel rule for virtual asset transfers, the treatment of unhosted wallets, and the distinction between virtual assets and e-money or other new payment methods.
Candidates prepare with traditional financial institution examples and then face scenario questions about exchanges, wallet providers, and fintech payment services. The travel rule for virtual assets is recent and its Korean implementation has specific thresholds and data requirements that general AML study does not cover.
What to do instead
Study the Korean virtual asset regime separately: VASP registration and reporting duties, AML obligations imposed on VASPs, the travel rule threshold and required originator and beneficiary information, and the risk-based approach to unhosted wallets. Practise scenarios involving cross-border virtual asset transfers and fintech payment flows, and confirm current thresholds and effective dates against the Special Act and KoFIU guidance.