I85PREP
⌘ K
IBSL Diploma in Compliance Exam study materials
IBSL Diploma in Compliance Exam study resources

IBSL Diploma in Compliance Exam practice questions

One question at a time. Build your IBSL Diploma in Compliance Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Compliance

Under a risk-based compliance approach, which factor most directly determines how frequently a firm should review a high-risk customer relationship?

  1. The inherent risk rating combined with the effectiveness of mitigating controls Correct answer.
  2. The customer's stated preference for communication channel
  3. The length of time the customer has held an account with the firm
  4. The number of products the customer has purchased

Explanation

Risk-based monitoring allocates effort according to residual risk, which is the product of inherent risk and the strength of mitigating controls. A high inherent rating can be offset by strong controls, so both elements must be assessed together when setting review frequency.

Question 2Compliance

A compliance officer discovers that a colleague has been executing trades in a personal account at a brokerage where the firm holds a material position. Which action best reflects the core purpose of a personal account dealing policy?

  1. Wait until the annual compliance attestation to disclose the activity
  2. Ask the colleague to close the account quietly to avoid regulatory scrutiny
  3. Refer the matter to the colleague's line manager for an informal conversation only
  4. Report the matter through the firm's conflicts of interest and personal dealing escalation process Correct answer.

Explanation

Personal account dealing rules exist to detect and manage conflicts of interest, including misuse of inside information and front-running. Suspected breaches must be escalated through the formal compliance channel so they can be investigated and recorded, not resolved informally.

Question 3Compliance

Which statement best describes the role of the Financial Action Task Force (FATF) in the global anti-money laundering framework?

  1. It operates a global transaction clearing system for correspondent banks
  2. It directly supervises banks in member jurisdictions and issues banking licences
  3. It prosecutes money laundering cases before national criminal courts
  4. It sets international standards and evaluates jurisdictions through mutual evaluations Correct answer.

Explanation

The FATF is an intergovernmental body that issues Recommendations setting international AML/CFT standards and assesses implementation through peer mutual evaluations. It does not supervise individual institutions, prosecute crimes, or operate payment systems.

Question 4Compliance

During customer due diligence, a prospective client refuses to provide information about the beneficial owner of a corporate entity. What is the most appropriate compliance response?

  1. Decline to establish the business relationship and consider whether a suspicious activity report is warranted Correct answer.
  2. Onboard the client but restrict activity to low-value transactions
  3. Proceed with onboarding and request the information at the first periodic review
  4. Accept a written assurance from the client's accountant in place of ownership details

Explanation

Where beneficial ownership cannot be established, the firm cannot satisfy customer due diligence requirements and should not establish the relationship. The refusal may itself be a risk indicator that merits a suspicious activity report.

Question 5Compliance

Which of the following best defines 'insider dealing' in a market abuse context?

  1. Trading in large volumes that move the market price of a security
  2. Trading on price-sensitive information not yet publicly available that was obtained through an insider position Correct answer.
  3. Publishing research that recommends buying a listed company's shares
  4. Executing a client order ahead of a large proprietary trade

Explanation

Insider dealing involves dealing, or encouraging others to deal, on the basis of inside information that is not generally available and that the person holds by virtue of an insider position. The other behaviours describe different abuses or legitimate activity.

Question 6Compliance

A firm's compliance monitoring plan should primarily be designed to do which of the following?

  1. Set the firm's commercial strategy for new product launches
  2. Replace the need for external audit of the compliance function
  3. Document disciplinary action taken against employees
  4. Provide independent assurance that controls are operating as intended and identify emerging risks Correct answer.

Explanation

Compliance monitoring is a second-line activity that tests whether controls work and surfaces emerging risks for management action. It complements, rather than replaces, internal and external audit.

Question 7Compliance

Which of the following is the primary purpose of a whistleblowing (speak-up) policy in a regulated firm?

  1. To transfer legal liability for misconduct from the firm to the individual reporter
  2. To replace the firm's disciplinary procedures
  3. To guarantee anonymity to every person who raises a concern
  4. To encourage staff to report suspected wrongdoing internally so it can be investigated and remedied Correct answer.

Explanation

Speak-up policies create a safe channel for staff to report suspected misconduct so the firm can investigate and remediate it promptly. Confidentiality is protected where possible, but anonymity cannot be guaranteed in every case.

Question 8Compliance

A compliance professional is asked to approve a marketing email that promises 'guaranteed returns' on an investment product. What is the most appropriate basis for the decision?

  1. Reject it only if the regulator has previously objected to similar wording
  2. Approve it because marketing claims are the responsibility of the product team
  3. Approve it if the product has historically performed well
  4. Reject it because fair, clear and not misleading communication standards prohibit such guarantees Correct answer.

Explanation

Regulated firms must ensure financial promotions are fair, clear and not misleading; promising guaranteed returns on an investment that carries risk breaches this standard. Compliance should reject the wording regardless of historical performance.

Question 9Compliance

A firm applies enhanced due diligence to a politically exposed person (PEP). Which measure is most consistent with enhanced due diligence requirements?

  1. Obtaining senior management approval and establishing the source of wealth and funds Correct answer.
  2. Applying the same monitoring as for a low-risk domestic customer
  3. Reducing the frequency of periodic reviews to lower the administrative burden
  4. Relying solely on the customer's self-declaration of their position

Explanation

Enhanced due diligence for PEPs typically requires senior management approval, establishment of source of wealth and source of funds, and more intensive ongoing monitoring. Self-declaration or reduced monitoring falls short of the enhanced standard.

Question 10Compliance

Which of the following best explains the 'three lines of defence' model in a compliance context?

  1. Compliance risk is managed solely by the legal department
  2. Business units own risk, a compliance function oversees and advises, and internal audit provides independent assurance Correct answer.
  3. All compliance work is performed by the internal audit function to ensure independence
  4. The board, the regulator and external auditors jointly manage compliance risk

Explanation

The three lines model separates risk ownership in the business, independent oversight and challenge by compliance, and independent assurance by internal audit. This structure avoids conflicts and provides layered assurance.

Question 11Compliance

A compliance manager is assessing a transaction where a customer requests payment to an unrelated third party in a high-risk jurisdiction. Which combination of red flags most strongly warrants escalation?

  1. A payment scheduled on the customer's usual monthly cycle
  2. A routine payment to a supplier with a long-standing relationship
  3. A payment to an unrelated third party in a high-risk jurisdiction with no apparent commercial rationale Correct answer.
  4. A payment made in the customer's local currency

Explanation

Unexplained third-party payments combined with a high-risk jurisdiction are classic money laundering red flags because they obscure the true beneficiary and source of funds. Escalation allows the firm to seek explanation and consider a suspicious activity report.

Question 12Compliance

Which statement best describes the compliance function's responsibility regarding regulatory change management?

  1. It should delegate all interpretation of new rules to external counsel
  2. It should track regulatory developments, assess their impact on the firm, and coordinate implementation with the business Correct answer.
  3. It should wait for the regulator to issue enforcement action before updating policies
  4. It should implement new rules only when requested by the sales desk

Explanation

Effective change management requires the compliance function to monitor regulatory developments, assess their impact, and coordinate timely implementation across affected business areas. Waiting for enforcement or reacting only to business requests leaves the firm exposed.

Question 13Compliance

A firm discovers that a junior employee accepted a luxury holiday from a client whose account they manage. Which compliance principle is most directly engaged?

  1. Client money segregation rules
  2. Capital adequacy requirements
  3. Gifts and hospitality limits and the management of conflicts of interest Correct answer.
  4. Best execution of client orders

Explanation

Accepting significant gifts from a client creates a conflict of interest and may breach the firm's gifts and hospitality policy. Such policies set thresholds and require disclosure or approval to protect the employee's independence.

Question 14Compliance

Which of the following best describes the purpose of a suspicious activity report (SAR) submitted to the financial intelligence unit?

  1. To obtain the customer's consent before continuing a transaction
  2. To formally close the customer's account
  3. To transfer legal responsibility for the transaction to the regulator
  4. To notify the authorities of suspected money laundering or terrorist financing so it can be investigated Correct answer.

Explanation

A SAR informs the financial intelligence unit of knowledge or suspicion of money laundering or terrorist financing, enabling investigation by authorities. It is not a request for customer consent or a mechanism to shift responsibility.

Question 15Compliance

A compliance officer is reviewing a cross-border payment where the ordering institution cannot verify the originator's address. Under the wire transfer rules, what is the most appropriate action?

  1. Substitute the bank's own address for the missing originator address
  2. Reject or hold the transfer until complete originator information is obtained Correct answer.
  3. Process the payment and obtain the missing information at month end
  4. Ask the beneficiary bank to complete the missing field

Explanation

Wire transfer standards require complete and accurate originator and beneficiary information before a transfer is processed. Where required information is missing, the institution should not execute the transfer until it is obtained.

Question 16Compliance

Which of the following best illustrates 'layering' in the money laundering process?

  1. A customer withdraws cash to pay for a holiday
  2. Funds are moved through a series of offshore companies and investments to obscure their origin Correct answer.
  3. A launderer purchases a legitimate business to mix illicit funds with lawful revenue
  4. A criminal deposits cash into a bank account in small amounts

Explanation

Layering is the stage in which illicit funds are moved through complex transactions to distance them from their source and disguise the audit trail. Placement and integration describe the other stages.

Question 17Compliance

A firm's compliance risk assessment should be refreshed periodically. Which trigger most clearly requires an out-of-cycle update?

  1. The compliance manual was re-printed with corrected page numbers
  2. A routine staff training session was completed on schedule
  3. The firm enters a new product line in a jurisdiction where it has no prior presence Correct answer.
  4. A team member took annual leave

Explanation

Entering a new product line or jurisdiction materially changes the firm's risk profile and should prompt a reassessment. Administrative events such as training completion or document formatting do not alter underlying risk.

Question 18Compliance

Which of the following best describes the compliance function's role in relation to the firm's board and senior management?

  1. It reports only to external regulators and not to the board
  2. It sets the firm's risk appetite without board involvement
  3. It replaces the board's responsibility for governance
  4. It advises and reports on compliance risk so the board can provide effective oversight Correct answer.

Explanation

Compliance supports governance by advising the board and senior management on compliance risk and reporting on the control environment. The board retains ultimate responsibility for setting risk appetite and oversight.

Question 19Compliance

A firm's training programme is being evaluated. Which design feature best supports a demonstrable compliance culture?

  1. Training delivered only to new joiners at induction
  2. Training that focuses solely on the firm's commercial targets
  3. Annual generic slides sent to all staff with no completion tracking
  4. Role-specific training with completion monitoring and testing of understanding Correct answer.

Explanation

Effective training is tailored to role-specific risks, tracks completion, and tests understanding so the firm can evidence competence. Generic, untracked or induction-only training does not demonstrate a strong culture.

Question 20Compliance

Which of the following best describes the concept of 'tipping off' in an anti-money laundering context?

  1. Disclosing to a customer that a suspicious activity report has been or will be made, where this is prohibited Correct answer.
  2. Reporting a suspicious transaction to the financial intelligence unit
  3. Sharing aggregated statistics on SAR volumes with industry peers
  4. Informing the regulator of a completed internal investigation

Explanation

Tipping off occurs when a person discloses information that is likely to prejudice an investigation, such as telling a customer that a SAR has been filed. Legitimate reporting to authorities is not tipping off.

Question 21Compliance

A compliance team is reviewing an outsourcing arrangement with a cloud provider that will store customer records. Which consideration is most central to the compliance assessment?

  1. The number of employees the provider has in the firm's home country
  2. Whether the firm retains adequate oversight, data protection and access rights over the outsourced activity Correct answer.
  3. The provider's share price performance
  4. The provider's marketing reputation in the technology sector

Explanation

Outsourcing does not transfer regulatory responsibility, so the firm must ensure it can oversee the provider, protect customer data, and maintain access and audit rights. Commercial or reputational factors are secondary to these control requirements.

Question 22Compliance

A firm operates in several jurisdictions with differing data protection and AML retention requirements. Which approach best manages the resulting conflict of laws?

  1. Conduct a documented legal analysis and apply controls that satisfy the strictest applicable obligation where possible Correct answer.
  2. Delete all records after one year regardless of jurisdiction
  3. Ignore local requirements and follow only the home regulator's rules
  4. Apply the shortest retention period across all jurisdictions to minimise data held

Explanation

Where obligations conflict, the firm should perform a documented legal analysis and design controls that meet the most stringent applicable requirements, escalating genuine conflicts to regulators. Applying the shortest period or ignoring local rules creates breaches.

Question 23Compliance

A compliance officer suspects that a colleague in the front office is deliberately structuring trades to avoid reporting thresholds. Which action best reflects the officer's professional obligations?

  1. Confront the colleague directly and agree to keep the matter confidential
  2. Wait for the annual audit to raise the issue
  3. Escalate the suspicion through the firm's internal reporting channels so it can be investigated and, if appropriate, reported Correct answer.
  4. Discuss the suspicion informally with other front office staff to gather views

Explanation

Suspected deliberate structuring is potential market or financial crime and must be escalated through formal channels so the firm can investigate and make any required regulatory report. Direct confrontation or informal discussion risks tipping off and compromising the investigation.

Question 24Compliance

A regulator requests information about a client relationship during a thematic review. The firm believes some documents are legally privileged. What is the most appropriate compliance response?

  1. Provide the non-privileged material, clearly identify any withheld documents and the basis for withholding, and seek legal advice Correct answer.
  2. Destroy the privileged documents before responding
  3. Provide all documents including privileged material to avoid delay
  4. Refuse to respond until the regulator obtains a court order in every case

Explanation

Firms should cooperate with regulators by producing responsive non-privileged material promptly, while clearly identifying withheld documents and the legal basis for any privilege claim. Wholesale refusal, over-disclosure or destruction is inappropriate.

Question 25Compliance

A firm is designing its compliance risk appetite statement. Which formulation is most useful for operational decision-making?

  1. A commitment to maximise profits while remaining ethical
  2. A general aspiration to be a market leader in compliance
  3. A quantified tolerance for specific risk types, such as a maximum number of unresolved high-risk customer reviews, with escalation triggers Correct answer.
  4. A statement that the firm will comply with all applicable laws

Explanation

A risk appetite is most useful when it expresses measurable tolerances for defined risk types and sets escalation triggers, enabling the business to make consistent decisions. General statements of intent provide little operational guidance.

Question 26Compliance

Which of the following best describes the primary role of a compliance officer in a regulated financial firm?

  1. To manage the firm's investment portfolio and trading activities
  2. To represent the firm in legal disputes and litigation
  3. To maximize the firm's short-term profits by approving high-risk transactions
  4. To independently identify, assess, and advise on compliance risks and regulatory obligations Correct answer.

Explanation

A compliance officer's core function is to independently monitor and advise on regulatory compliance, ensuring the firm adheres to laws and internal policies. This role is distinct from profit generation, portfolio management, or legal representation, which are handled by other functions. Independence is essential to provide objective oversight and challenge business decisions when necessary.

Question 27Compliance

A compliance officer is reviewing a new product proposal. Which action best demonstrates the application of a risk-based approach?

  1. Delegating all compliance decisions to the front office to speed up approval
  2. Applying identical due diligence to all customers regardless of risk profile
  3. Rejecting all new products that involve any level of risk
  4. Focusing resources on high-risk customers and transactions while applying simplified measures to low-risk ones Correct answer.

Explanation

A risk-based approach means allocating compliance resources proportionally to the level of risk, so enhanced measures are applied where risk is higher and simplified measures where risk is lower. This allows efficient use of resources while managing risks effectively. Uniform due diligence or blanket rejection is not risk-based, and delegating decisions to the front office undermines independence.

Question 28Compliance

Which of the following is a key component of a robust anti-money laundering (AML) compliance programme?

  1. Regular employee training on AML procedures and red flags Correct answer.
  2. Outsourcing all AML responsibilities to a third-party vendor without oversight
  3. A policy of not reporting suspicious transactions to avoid customer dissatisfaction
  4. Limiting customer due diligence to only high-net-worth individuals

Explanation

Employee training is a fundamental element of an AML programme because staff must be able to recognize and report suspicious activity. Training ensures awareness of procedures and red flags. Not reporting suspicious transactions, outsourcing without oversight, or limiting due diligence to certain customers would violate AML requirements.

Question 29Compliance

A compliance manager is updating the firm's policies to reflect a new regulation. Which step is most important to ensure effective implementation?

  1. Applying the new rules only to new clients, not existing ones
  2. Delegating the interpretation of the regulation to the IT department
  3. Communicating the changes to all relevant staff and providing training Correct answer.
  4. Waiting until the next annual policy review cycle to make changes

Explanation

Effective implementation of regulatory changes requires timely communication and training so that staff understand and can comply with new requirements. Delaying changes, applying them selectively, or delegating interpretation to IT would risk non-compliance. Compliance must ensure that policies are operationalized across the firm.

Question 30Compliance

Which of the following best describes the purpose of customer due diligence (CDD) in a compliance framework?

  1. To verify the identity of customers and understand their business and risk profile Correct answer.
  2. To increase the firm's customer base by simplifying onboarding
  3. To allow customers to transact anonymously for privacy reasons
  4. To reduce the cost of compliance by limiting documentation

Explanation

CDD is a process to verify customer identity, understand the nature of their business, and assess their risk profile to prevent money laundering and terrorist financing. It is not about expanding customer base or reducing costs at the expense of compliance. Anonymous transactions are generally prohibited under AML rules.

Question 31Compliance

A compliance officer discovers that a senior manager has been bypassing compliance controls to expedite a client transaction. What is the most appropriate initial action?

  1. Approve the transaction to avoid conflict
  2. Report the matter to the board or appropriate governing body Correct answer.
  3. Confront the senior manager publicly to embarrass them
  4. Ignore the issue because the senior manager has authority

Explanation

Compliance officers must escalate breaches of controls to the board or a relevant governing body to ensure independence and proper oversight. Ignoring the issue, public confrontation, or approving the transaction would undermine compliance and could expose the firm to regulatory risk. Whistleblowing procedures should be followed.

Question 32Compliance

Which of the following is a red flag for potential money laundering that a compliance officer should monitor?

  1. A customer who asks for information about the firm's products and fees
  2. A customer who makes frequent small cash deposits just below the reporting threshold Correct answer.
  3. A customer who requests a standard account with regular monthly deposits
  4. A customer who provides complete and verifiable identification documents

Explanation

Structuring, or making frequent small cash deposits just below the reporting threshold, is a common money laundering red flag designed to evade reporting requirements. Complete identification, regular deposits, and product inquiries are normal customer behaviors. Compliance officers should monitor for such structuring patterns.

Question 33Compliance

A firm's compliance monitoring programme includes automated alerts for unusual transactions. Which of the following best describes the purpose of these alerts?

  1. To automatically block all transactions that trigger an alert
  2. To generate reports for marketing purposes
  3. To replace the need for manual review of transactions
  4. To flag potentially suspicious activity for further review by compliance staff Correct answer.

Explanation

Automated alerts are designed to identify potentially suspicious transactions and escalate them for human review. They do not automatically block transactions, nor do they replace manual review; rather, they enhance efficiency by focusing attention on higher-risk items. Alerts are not for marketing.

Question 34Compliance

Which of the following best describes the concept of 'conflicts of interest' in a compliance context?

  1. A regulatory requirement to maximize shareholder value
  2. A situation where an employee's personal interests could improperly influence their professional decisions Correct answer.
  3. A situation where a customer is unhappy with the firm's services
  4. A disagreement between two employees about work responsibilities

Explanation

A conflict of interest arises when personal interests (financial or otherwise) could compromise an individual's ability to act in the firm's or clients' best interests. It is not about interpersonal disagreements or customer dissatisfaction. Compliance programmes aim to identify and manage such conflicts.

Question 35Compliance

A compliance officer is asked to approve a transaction involving a jurisdiction known for weak AML controls. Which factor is most important in the risk assessment?

  1. The transaction amount is below the reporting threshold
  2. The country's AML regulations and the customer's source of funds Correct answer.
  3. The transaction will generate significant revenue for the firm
  4. The customer has a long-standing relationship with the firm

Explanation

When assessing risk in a transaction involving a high-risk jurisdiction, the compliance officer must consider the country's AML regime and the customer's source of funds to determine the level of risk. Transaction amount, relationship length, or revenue are not sufficient to mitigate the risk. Enhanced due diligence is likely required.

Question 36Compliance

Which of the following is a key responsibility of a compliance function in relation to regulatory reporting?

  1. Delegating report preparation to external auditors without review
  2. Submitting reports only when it is convenient for the business
  3. Ensuring reports are submitted accurately and on time to the regulator Correct answer.
  4. Avoiding reporting to reduce administrative burden

Explanation

The compliance function is responsible for ensuring that regulatory reports are accurate, complete, and submitted within required deadlines. Delegating without review, delaying, or avoiding reporting would breach regulatory obligations. Timely and accurate reporting is a core compliance duty.

Question 37Compliance

A compliance officer is reviewing the firm's training records and notices that senior management has not completed mandatory AML training. What is the most appropriate action?

  1. Report the non-compliance to the board and ensure training is completed Correct answer.
  2. Conduct the training only for junior staff
  3. Ignore the issue as training is not important for senior staff
  4. Excuse senior management from training because of their position

Explanation

Mandatory training applies to all employees, including senior management. Compliance should escalate the non-completion to the board and ensure that training is completed, as a strong compliance culture requires leadership to lead by example. Excusing or ignoring senior management undermines the programme.

Question 38Compliance

Which of the following best describes the purpose of a compliance risk assessment?

  1. To determine the firm's marketing strategy
  2. To assess employee performance for bonuses
  3. To identify and evaluate the firm's compliance risks to prioritize resources Correct answer.
  4. To calculate the firm's tax liabilities

Explanation

A compliance risk assessment is a systematic process to identify, assess, and prioritize compliance risks so that resources can be allocated effectively. It is not related to tax, performance evaluation, or marketing. The results inform the compliance programme and monitoring plan.

Question 39Compliance

A compliance officer is developing a monitoring plan. Which of the following is the best practice for setting the frequency of monitoring activities?

  1. Monitor only when a regulator requests it
  2. Monitor all areas with equal frequency regardless of risk
  3. Base frequency on the risk assessment, with higher-risk areas monitored more often Correct answer.
  4. Set frequency based on staff availability

Explanation

Best practice is to align monitoring frequency with the results of the compliance risk assessment, so that higher-risk areas receive more frequent monitoring. Equal frequency ignores risk differences, and monitoring only on request or based on staff availability is not proactive or risk-based. This ensures efficient use of resources.

Question 40Compliance

Which of the following is an example of a compliance control designed to prevent market abuse?

  1. A requirement to share confidential information with all staff
  2. A policy allowing employees to trade on inside information if it benefits the firm
  3. A procedure to ignore suspicious trading patterns
  4. A restricted list that prevents trading in certain securities by employees Correct answer.

Explanation

A restricted list is a control that prohibits employees from trading in securities of companies about which they may have inside information, thereby preventing market abuse. Allowing trading on inside information, sharing confidential information, or ignoring suspicious patterns would facilitate market abuse. Such controls are essential for compliance with market abuse regulations.

Question 41Compliance

A compliance officer is reviewing the firm's record-keeping practices. Which of the following is a key requirement for compliance records?

  1. Records should be stored in a manner that prevents retrieval
  2. Records should be easily accessible, accurate, and retained for the required period Correct answer.
  3. Records should be destroyed immediately after a transaction
  4. Records should be kept only for one year to save storage costs

Explanation

Compliance records must be accurate, readily accessible, and retained for the period required by regulation (often five to seven years). Destroying records prematurely or making them inaccessible would breach record-keeping obligations. Proper record-keeping supports audit and regulatory reviews.

Question 42Compliance

A compliance officer is assessing the effectiveness of the firm's whistleblowing policy. Which indicator suggests the policy is working well?

  1. Employees are afraid to report concerns due to fear of retaliation
  2. Reports are promptly investigated and the reporter is protected from retaliation Correct answer.
  3. No reports have been made in the past five years
  4. Reports are ignored unless they come from senior management

Explanation

An effective whistleblowing policy ensures that concerns are promptly investigated and that whistleblowers are protected from retaliation. Fear of retaliation, zero reports, or ignoring reports are signs of a weak policy. A healthy speak-up culture encourages reporting without fear.

Question 43Compliance

Which of the following best describes the role of the compliance function in product governance?

  1. To maximize product sales by approving all marketing materials
  2. To ensure that products are designed and distributed in compliance with regulatory requirements and customer interests Correct answer.
  3. To design product features without regard to regulatory constraints
  4. To set product prices to maximize profits

Explanation

Compliance in product governance ensures that products meet regulatory standards and are appropriate for the target market, protecting customer interests. Approving all marketing materials to maximize sales, ignoring regulations, or setting prices for profit are not compliance roles. Compliance provides oversight and challenge throughout the product lifecycle.

Question 44Compliance

A compliance officer is reviewing the firm's data protection practices. Which principle is most relevant to compliance?

  1. Data should be retained indefinitely regardless of purpose
  2. Data should be collected without informing the customer
  3. Data should be shared freely with third parties for marketing
  4. Data should be collected and processed lawfully and only for specified purposes Correct answer.

Explanation

A core principle of data protection is lawful, fair, and transparent processing for specified purposes. Sharing data freely, retaining indefinitely, or collecting without notice would violate data protection laws. Compliance must ensure that data handling aligns with these principles.

Question 45Compliance

A compliance manager is evaluating the firm's outsourcing arrangements. Which factor is most critical for compliance?

  1. The service provider's fee is the lowest available
  2. The firm retains ultimate responsibility for compliance and has oversight of the provider Correct answer.
  3. The provider is located in a different jurisdiction with weaker regulations
  4. The contract does not require any reporting from the provider

Explanation

When outsourcing, the firm remains responsible for compliance and must have appropriate oversight of the service provider. Choosing the lowest fee, using a provider in a weaker regulatory jurisdiction, or lacking reporting requirements would increase compliance risk. Effective oversight and contractual safeguards are essential.

Question 46Compliance

Which of the following is a key element of a compliance culture within a firm?

  1. A policy of ignoring minor breaches to maintain morale
  2. Discouraging employees from reporting concerns
  3. Tone from the top, where senior management demonstrates commitment to compliance Correct answer.
  4. Rewarding employees solely based on sales performance

Explanation

A strong compliance culture starts with tone from the top: senior management must visibly commit to compliance and ethical behavior. Ignoring breaches, rewarding only sales, or discouraging reporting undermines culture. Leadership example sets the standard for the entire organization.

Question 47Compliance

A compliance officer is assessing the risks of a new customer who is a politically exposed person (PEP). Which action is most appropriate?

  1. Apply enhanced due diligence, including establishing source of wealth and funds Correct answer.
  2. Reject the customer automatically without review
  3. Accept the customer without any additional checks
  4. Apply standard due diligence as for any other customer

Explanation

PEPs are considered higher risk for money laundering and corruption, so enhanced due diligence is required, including establishing source of wealth and source of funds. Standard due diligence is insufficient, automatic rejection is not required, and accepting without checks would violate AML rules. Enhanced measures help manage the elevated risk.

Question 48Compliance

Which of the following best describes the purpose of a compliance audit?

  1. To develop new financial products
  2. To replace the compliance function's daily activities
  3. To identify employees for promotion
  4. To provide an independent assessment of the effectiveness of the compliance programme Correct answer.

Explanation

A compliance audit independently evaluates whether the compliance programme is effective and identifies areas for improvement. It does not replace daily compliance activities, nor is it related to promotions or product development. Independence is key to the audit's credibility.

Question 49Compliance

A compliance officer is reviewing a transaction where the customer is a shell company with no apparent business activity. What is the most appropriate action?

  1. Report the customer to the regulator without further investigation
  2. Ignore the red flag because the transaction amount is small
  3. Proceed with the transaction as shell companies are common
  4. Conduct enhanced due diligence to understand the ownership and purpose of the company Correct answer.

Explanation

Shell companies with no apparent business activity are a money laundering red flag, and enhanced due diligence is needed to identify beneficial ownership and the purpose of the company. Proceeding without checks, ignoring the red flag, or reporting without investigation is not appropriate. EDD helps determine whether the activity is suspicious.

Question 50Compliance

Which of the following best describes the concept of 'regulatory expectations' in compliance?

  1. The firm's internal profit targets
  2. The personal opinions of compliance officers
  3. The marketing strategy of the firm
  4. The specific rules and principles that regulators expect firms to adhere to, even if not explicitly stated in law Correct answer.

Explanation

Regulatory expectations encompass the standards and principles that regulators expect firms to meet, which may go beyond explicit legal requirements and reflect the spirit of regulation. They are not internal profit targets, personal opinions, or marketing strategies. Understanding these expectations helps firms avoid regulatory criticism.