Regulatory compliance, AML/CFT and financial crime audit
What the exam tests
This domain tests audit of compliance risk, AML/CFT controls and financial crime risk. Expect questions on customer due diligence, beneficial ownership, sanctions screening, suspicious transaction reporting and regulatory returns.
Core rules and concepts
- Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage from failure to comply. The compliance function must identify, advise, monitor and report.
- AML/CFT obligations under AMLA 2001 include CDD, enhanced due diligence for higher-risk customers and politically exposed persons, beneficial ownership identification, ongoing monitoring, sanctions screening and record keeping for at least six years.
- Suspicious transaction reports go to the financial intelligence unit; tipping off is prohibited. A STR is not proof of guilt and does not replace account-level controls.
- Transaction monitoring rules require tuning, alert investigation, disposition rationale and independent testing.
- Compliance audit tests whether regulatory changes are mapped to controls and whether statutory returns are complete and accurate.
Worked example
A sample of 30 high-risk customer files shows four PEPs without evidence of source of wealth or source of funds, and two sanctions alerts closed with no documented rationale. The auditor concludes the EDD and alert-disposition controls are not operating effectively. The auditor tests whether suspicious activity was considered for STR, reviews beneficial ownership records, and assesses the bank-level AML/CFT programme. The finding should state the population, the control failure, the financial crime risk and the remediation required.
Traps
- Treating CDD as an onboarding-only exercise.
- Ignoring beneficial ownership behind corporate customers.
- Testing alert closure volume rather than quality of disposition.
- Assuming a filed STR proves the control worked.