CNBV PLD/FT Certification common mistakes
CNBV PLD/FT Certification · Understand the traps and how to avoid them.
Treating the LFPIORPI thresholds as one universal figure and applying them uniformly to all 'actividades vulnerables', instead of identifying which specific activity (fideicomiso, fe pública, inmobiliaria, metales, etc.) and which currency/amount rule applies to the operation described.
Candidates memorize a single headline number (e.g., the frequently cited USD 7,500 figure) and pattern-match it to any scenario, because threshold tables are dense and the activity categories overlap in everyday phrasing.
What to do instead
Build a one-page matrix of activities vs. identification thresholds and the 'aviso' deadlines, and for every practice item first name the activity, then look up the row before reading the answer options.
Confusing the three 'aviso' types (relevantes, inusuales, internas) and swapping their reporting recipients, deadlines, or triggering criteria when a scenario describes an operation.
The categories share vocabulary and the deadlines differ, so under time pressure candidates default to the most familiar term ('operación sospechosa') and ignore the precise statutory category.
What to do instead
Memorize a three-column card: definition/trigger, who receives it, deadline; then in each item underline the trigger phrase (amount, no economic justification, internal detection) and select the category that matches that exact trigger.
Assuming the 'beneficiario controlador' is always the direct account holder or the largest shareholder, rather than tracing control through chains of ownership, trusts, or effective control criteria.
Everyday intuition equates ownership with control, and the multi-step control tests (percentages, control by other means, trust roles) are easy to collapse into a single step.
What to do instead
Practice reconstructing ownership chains from described facts and apply the control tests in order (direct/indirect ownership, control by other means, benefit); always state the criterion used to reach the answer.
Selecting 'report it' for every unusual-looking fact, instead of first deciding whether the entity must file an aviso, whether enhanced due diligence or a risk-based review is the correct next step, or whether the operation is merely outside the customer's profile.
Candidates over-learn 'when in doubt, report' and stop distinguishing detection, monitoring escalation, EDD, and formal reporting as separate stages.
What to do instead
Use a decision ladder for each scenario: identify signal → verify against profile → decide EDD/refusal/termination → decide report type and deadline; justify why each prior rung was or was not triggered.
Treating the risk-based approach as a fixed checklist (all customers get the same diligence) instead of assigning and adjusting a risk level that drives the intensity of due diligence and monitoring.
Checklists are easier to memorize than the logic that risk level determines measures, and candidates confuse 'risk-based' with 'risk classification only'.
What to do instead
For each case, explicitly write the customer/product/channel/geography risk factors, the resulting rating, and the specific measure that rating requires (simplified, standard, enhanced); check that the chosen measure is consistent with the rating.
Misremembering retention and confidentiality rules: how long records must be kept, what must be preserved, and what may or may not be disclosed to the customer or third parties when a report has been filed.
Retention periods are plain numbers easily confused with other regimes, and the prohibition on tipping off the customer conflicts with a general instinct toward transparency.
What to do instead
Memorize retention periods and the list of retained documents as discrete facts, and rehearse the rule that filing and its content are confidential; on any disclosure item, ask 'is the recipient an authority with legal competence?' before answering.
Confusing the compliance officer's ('oficial de cumplimiento') responsibilities with those of the audit function, the board, or the business lines, and misidentifying who approves the manual, who reports to the board, and who is independent.
Governance roles overlap in description and candidates map them onto generic corporate roles rather than the specific allocation in the applicable disposiciones.
What to do instead
Draw a responsibility matrix (board, compliance officer, internal audit, business units) with one line per obligation and test yourself by assigning each duty to exactly one role.
Answering sanction questions by choosing the most severe consequence, without distinguishing administrative sanctions, disciplinary/employment consequences, and criminal liability, or without checking who imposes them and on what grounds.
Severity bias and conflation of legal regimes make the harshest option feel safest.
What to do instead
Classify each consequence by regime (administrative, labor/disciplinary, criminal) and by authority; eliminate options that mix regimes or attribute authority to the wrong body.
Reading a typology scenario and picking the label from surface features (cash, foreign country, many transfers) instead of identifying the mechanism (structuring, smurfing, trade-based, shell company, terrorist financing) from the described pattern of conduct.
Typologies share indicators, and candidates rely on keyword matching rather than the defining structural features of each scheme.
What to do instead
For each typology, memorize its defining mechanism and two distinguishing indicators, then in practice items write the mechanism in one sentence before looking at the options.
Ignoring the distinction between 'señal de alerta' and proof of illicit activity, and answering as if a single indicator automatically requires termination of the relationship or a criminal conclusion.
Indicators are taught as red flags, which candidates interpret as conclusions rather than as inputs to analysis and escalation.
What to do instead
Treat each indicator as a prompt for documented analysis: state what additional information would confirm or dispel it, and choose the response (monitor, EDD, report) that matches the unresolved state.