CVCLD common mistakes
CVCLD · Understand the traps and how to avoid them.
Treating 'virtual currency' as a single legal category and applying one regulatory regime (usually money transmission) to every fact pattern, instead of first classifying the activity-medium of exchange, security, commodity, or property-and then applying the regime that attaches to that classification.
Candidates study the domains as silos and memorize rules per domain, so under time pressure they reach for the most familiar regime rather than performing the threshold classification step that determines which regime even applies. The exam deliberately writes facts that fit more than one classification to test whether the candidate classifies before analyzing.
What to do instead
Adopt a fixed first-move checklist for every fact pattern: (1) What is the asset and how is it used? (2) Is there an investment contract or other security under the applicable test? (3) Is the activity money transmission, custody, exchange, or advisory? (4) Which regulator and which statute attach? Write the classification in one sentence before analyzing obligations, and practice by re-sorting old practice scenarios by classification rather than by domain.
Analyzing convertibility and 'acceptance and transmission' as if a convertible virtual currency is automatically money transmission, without separating the administrative/exemptive framework from the statutory definition and without checking the specific facts (who accepts it, from whom, and whether the person merely uses it to pay for goods or services).
The money transmission domain blends a statutory definition with a layered set of interpretive guidance and exemptions, and candidates memorize the conclusion ('convertible virtual currency is money transmission') without the reasoning chain. Exam items exploit the gap between a user, an exchanger, and an administrator.
What to do instead
Build a role table (user, exchanger, administrator, miner, custodian, payment processor) and, for each role, write the definitional test and the exemption that may apply. For every item, identify the actor's role first, then test acceptance-and-transmission element by element, and only then consider exemptions and state licensing consequences.
Applying the securities-law registration analysis to a token offering but stopping at 'is it a security?' without completing the downstream steps: exemption availability, whether a valid exemption was actually perfected, resale restrictions, and the separate broker-dealer, exchange, and investment-adviser questions raised by the platform itself.
The investment-contract analysis is the memorable part of the domain, so candidates over-invest there and run out of analytical budget. They also conflate the issuer's registration duty with the intermediary's registration duty, which the exam tests separately.
What to do instead
Use a three-layer template for every digital-asset securities item: asset layer (security or not, and why), transaction layer (registered or exempt, and were the exemption's conditions met), and intermediary layer (does the platform or person need to register as an exchange, broker-dealer, or adviser?). Answer all three layers even if the item seems to ask only one.
Treating commodity and derivatives regulation as irrelevant to digital assets, or assuming that because an asset is a commodity it is unregulated, rather than analyzing whether the transaction is a swap, future, or option subject to derivatives regulation and whether the venue must be registered.
Candidates associate 'commodity' with 'not a security' and stop, missing that the regulatory question shifts to the instrument and the venue rather than the underlying asset. The overlap between securities and commodities law is the least intuitive part of the domain.
What to do instead
Memorize the two-step framing: the underlying asset's classification and the instrument's classification are separate questions. For any item involving leverage, margin, future delivery, or an option on a digital asset, analyze it as a potential derivative and ask whether the venue is a designated contract market or otherwise registered.
Computing tax on a virtual currency sale using proceeds minus the amount originally invested in the whole position, rather than applying the correct basis rules per unit, including basis carryover, forks, and the distinction between capital and ordinary treatment depending on how the taxpayer acquired and held the asset.
Everyday intuition treats a crypto portfolio like a single stock position, so candidates aggregate instead of tracking lots. Examiners design items with multiple acquisitions at different prices precisely to catch this aggregation habit.
What to do instead
Work every tax item at the lot level: list each acquisition with date, amount, and basis; list each disposition with date, amount realized; compute gain or loss per lot; then classify holding period and character. Practice with a three-lot scenario until lot-level tracking is automatic, and always state the character conclusion explicitly.
Answering tax questions with a general principle ('it's taxable') without identifying the reporting obligation, the form or information return involved, and the recordkeeping duty, so the answer is directionally right but incomplete against an item that asks what the taxpayer or exchange must actually do.
Candidates prepare for tax by learning outcomes rather than mechanics, and the exam rewards mechanics. Reporting and information-return questions also feel administrative and get less study time than rate and character questions.
What to do instead
For each tax topic, build a three-column note: event, character and computation, and reporting/recordkeeping. Drill until you can state, for a given transaction, what the taxpayer reports, what a business must furnish, and what records must be retained, without looking at notes.
Handling AML/CTF items by listing program elements (policy, officer, training, monitoring) as a checklist without connecting each element to the specific risk the fact pattern presents, and without distinguishing the risk-based approach from a rules-based one.
Program elements are easy to memorize and easy to recite, so candidates reproduce the list and never apply it. Items that describe an unusual customer, product, or geography are testing whether the candidate can map risk to control, not whether they can name the five pillars.
What to do instead
Practice writing one-sentence risk-to-control mappings: 'Because the customer is in a high-risk jurisdiction, the program must apply enhanced due diligence, senior approval, and ongoing monitoring.' For every AML item, name the risk first, then the control, then the evidence that the control operated.
Conflating sanctions screening with AML transaction monitoring, or treating a sanctions hit as something to be resolved through a suspicious-activity report rather than through blocking, rejection, and reporting to the appropriate authority on the sanctions timeline.
Both regimes involve screening customers and transactions, so the workflows look similar on the surface. Candidates who learned AML first import AML instincts-investigate, then file-into sanctions questions where the duty is stricter and time-bound.
What to do instead
Build a side-by-side comparison of the two regimes covering legal basis, who is screened, what happens on a hit, timing, reporting destination, and recordkeeping. For any item mentioning a designated person or restricted jurisdiction, apply the sanctions workflow first and only then ask whether an AML filing is also required.
Ignoring the cross-border and export-control dimension of a fact pattern-assuming that because virtual currency moves on a public network, geography and jurisdiction are irrelevant, and failing to analyze whether providing a wallet, tool, or service to a restricted person or place implicates export controls or local licensing.
The technology's borderless framing invites the assumption that regulation is too, and candidates under-study the domain because it feels peripheral. Items that place a customer or a developer in a restricted jurisdiction are testing exactly this blind spot.
What to do instead
Add a standing geography question to every fact pattern: where is each party, where is the service provided from, and does any restricted-party or restricted-jurisdiction rule attach? Review the categories of controlled items and services and how they can apply to software and technical assistance, then practice flagging the cross-border issue even when the item's main question is elsewhere.
Answering governance and ethics items by describing the 'right' control in the abstract, without addressing escalation, independence, conflicts of interest, or who owns the decision-so the answer sounds compliant but does not resolve the accountability question the item poses.
Governance content reads as common sense, so candidates answer from intuition and skip the structural detail: reporting lines, board oversight, three-lines-of-defense roles, and conflict management. Ethics items are especially prone to being answered with a value statement rather than a decision procedure.
What to do instead
Prepare a governance map: for each function (compliance, risk, internal audit, business line), state its role, its reporting line, and its independence safeguards. For ethics scenarios, apply a fixed sequence-identify the conflict, identify who must be informed, identify who decides and who must not decide, and identify the record created-and write the answer in that order.