IBSL Diploma in Compliance Exam cheat sheet

Compliance is defined as conforming to rules set by law, regulator, or the firm itself; the compliance function's core duties are advising, monitoring, and educating, not profit generation.

Three-lines model: first line (business) owns risk; second line (risk and compliance) sets frameworks and challenges; third line (internal audit) gives independent assurance to the board.

Risk-based approach: allocate compliance resources in proportion to inherent risk multiplied by likelihood and impact; document the rationale so supervisors can test it.

Compliance risk assessment cycle: identify obligations, map to processes and controls, rate inherent risk, apply control effectiveness, derive residual risk, and record acceptance where residual exceeds appetite.

Risk appetite statement must state tolerance in measurable terms (for example maximum number of unresolved high-risk findings, or a threshold for reportable breaches) and be approved by the board.

Compliance programme elements: governance and tone at the top, policies and procedures, training, monitoring and testing, whistleblowing, remediation, and management information reporting.

Regulatory mapping: convert each obligation into a control and a named owner; an obligation with no mapped control is a gap and must appear on the compliance plan.

Key compliance indicators should be forward-looking (overdue remediation, training completion, control test failures) rather than only lagging breach counts.

Monitoring vs testing: monitoring is ongoing, first- or second-line surveillance of controls; independent testing samples controls to conclude on design and operating effectiveness.

Findings must be rated by severity, assigned an owner and a due date, and tracked to verified closure; repeat findings indicate a root-cause failure rather than a single control lapse.

Conflicts of interest are managed by avoid, control, or disclose (in that order of preference); disclosure alone does not neutralise a conflict that could harm clients.

Market conduct rules generally require fair treatment of customers, suitability of advice, clear disclosure of costs, and management of information asymmetry.

Personal account dealing and gifts/entertainment controls rely on pre-clearance, thresholds, registers, and independent review of exceptions.

Whistleblowing arrangements must offer confidential channels, protection from retaliation, and escalation independent of the line implicated in the concern.

Regulatory engagement: notify the supervisor within required timeframes for breaches, cooperate fully, and keep a record of all communications and commitments made.

Remediation is closed only when evidence shows the control now operates effectively; a policy rewrite without a tested control change is not remediation.

AML three-stage model: placement (introducing illicit funds), layering (obscuring origin through transactions), and integration (re-entering funds as apparently legitimate).

Customer due diligence: identify the customer and beneficial owner, verify identity using reliable independent sources, understand purpose and expected activity, and apply enhanced measures for higher-risk cases.

Risk factors for enhanced due diligence include politically exposed persons, high-risk jurisdictions, complex ownership structures, cash-intensive businesses, and unusual transaction patterns.

Sanctions screening compares names and entities against designated lists; matches require adjudication, and strict liability regimes mean intent is not required for a breach.

Suspicious activity reporting: file with the financial intelligence unit when suspicion is formed, do not tip off the customer, and retain the internal rationale for the decision.

Record retention periods for identification and transaction records are set by local law; the firm must apply the longest applicable period across jurisdictions it operates in.

Data protection principles: lawful basis, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability with documented decisions.

Outsourcing and third-party risk: the regulated firm remains responsible for outsourced activities, so due diligence, contractual audit rights, and exit plans are mandatory.