I85PREP
⌘ K
NZ AML/CFT Compliance Officer study materials
NZ AML/CFT Compliance Officer study resources

NZ AML/CFT Compliance Officer practice questions

One question at a time. Build your NZ AML/CFT Compliance Officer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AML/CFT regulatory framework and obligations in New Zealand

Which New Zealand statute is the primary legislation governing anti-money laundering and countering financing of terrorism obligations for reporting entities?

  1. The Financial Service Providers (Registration and Dispute Resolution) Act 2008
  2. The Crimes Act 1961
  3. The Anti-Money Laundering and Countering Financing of Terrorism Act 2009 Correct answer.
  4. The Financial Markets Conduct Act 2013

Explanation

The AML/CFT Act 2009 is the core statute imposing customer due diligence, reporting, and compliance obligations on reporting entities. The other statutes address different regulatory areas, though the Crimes Act defines some predicate offences.

Question 2AML/CFT regulatory framework and obligations in New Zealand

Which government agency is responsible for supervising AML/CFT compliance of reporting entities in the financial services sector such as banks, non-bank deposit takers and life insurers?

  1. The Department of Internal Affairs
  2. New Zealand Customs Service
  3. The Reserve Bank of New Zealand Correct answer.
  4. The Financial Markets Authority

Explanation

The Reserve Bank of New Zealand is the AML/CFT supervisor for banks, non-bank deposit takers, and life insurers. The Department of Internal Affairs and the Financial Markets Authority supervise other categories of reporting entities.

Question 3AML/CFT regulatory framework and obligations in New Zealand

Under the AML/CFT Act, what is the primary purpose of performing customer due diligence on a new customer?

  1. To assess the customer's creditworthiness before lending
  2. To verify the customer's eligibility for a financial product
  3. To determine the customer's tax residency for reporting to Inland Revenue
  4. To confirm the customer's identity and understand the nature and purpose of the relationship Correct answer.

Explanation

Customer due diligence is designed to verify identity and to understand the nature and purpose of the business relationship, which underpins risk assessment and ongoing monitoring. It is not a credit, tax, or product-eligibility process.

Question 4AML/CFT regulatory framework and obligations in New Zealand

Which of the following is a prescribed transaction that a reporting entity may be required to report to the Financial Intelligence Unit?

  1. A cash transaction of NZD 10,000 or more Correct answer.
  2. An international wire transfer of NZD 500
  3. A domestic electronic funds transfer of any amount
  4. A customer opening a savings account

Explanation

Cash transactions at or above the prescribed threshold (NZD 10,000) are prescribed transactions that must be reported. Ordinary domestic transfers and account openings are not prescribed transactions.

Question 5AML/CFT regulatory framework and obligations in New Zealand

What is a suspicious transaction report (STR) intended to convey to the Financial Intelligence Unit?

  1. That a transaction or activity may involve money laundering or terrorist financing Correct answer.
  2. That a customer has failed to provide a driver licence
  3. That the entity's internal systems have suffered an outage
  4. That a customer has requested a product the entity does not offer

Explanation

An STR reports activity the reporting entity suspects may involve money laundering or the financing of terrorism. It is a suspicion-based report, distinct from threshold-based prescribed transaction reports.

Question 6AML/CFT regulatory framework and obligations in New Zealand

What does the term 'reporting entity' refer to under the AML/CFT Act?

  1. A business that only files annual financial statements
  2. A charity registered with Charities Services
  3. An institution covered by the Act and therefore subject to its obligations Correct answer.
  4. Any company listed on the New Zealand stock exchange

Explanation

A reporting entity is an institution of a kind listed in the Act, which brings it within the AML/CFT obligations. Not every company or charity is automatically a reporting entity.

Question 7AML/CFT regulatory framework and obligations in New Zealand

Which of the following best describes the role of the Financial Intelligence Unit in New Zealand?

  1. It licenses banks to operate in New Zealand
  2. It prosecutes money laundering offences in the High Court
  3. It receives and analyses suspicious activity and prescribed transaction reports Correct answer.
  4. It sets accounting standards for reporting entities

Explanation

The FIU, located within the New Zealand Police, receives and analyses STRs and prescribed transaction reports and shares intelligence. It does not prosecute offences or license banks.

Question 8AML/CFT regulatory framework and obligations in New Zealand

A reporting entity must appoint a person responsible for administering and maintaining its AML/CFT programme. What is this role commonly called?

  1. The chief financial officer
  2. The external auditor
  3. The privacy officer
  4. The AML/CFT compliance officer Correct answer.

Explanation

The Act requires a designated person to administer and maintain the AML/CFT programme, commonly referred to as the AML/CFT compliance officer. The other roles carry different statutory responsibilities.

Question 9AML/CFT regulatory framework and obligations in New Zealand

Under the AML/CFT Act, a reporting entity is generally required to conduct ongoing customer due diligence and account monitoring for which customers?

  1. Only customers who are politically exposed persons
  2. All customers with whom it has a business relationship Correct answer.
  3. Only customers who are non-residents
  4. Only customers who conduct cash transactions

Explanation

Ongoing CDD and account monitoring apply to all business relationships, scaled to risk. PEPs, cash users and non-residents are risk factors but are not the sole trigger for ongoing CDD.

Question 10AML/CFT regulatory framework and obligations in New Zealand

A reporting entity wants to rely on a third party to conduct customer due diligence. Under the Act, what is the effect of such reliance?

  1. The supervisor must approve each reliance arrangement in advance
  2. The reporting entity is fully relieved of its CDD obligations
  3. The third party becomes the reporting entity for that customer
  4. The reporting entity remains responsible for ensuring CDD is properly conducted Correct answer.

Explanation

Reliance on a third party does not transfer responsibility; the reporting entity must still ensure CDD requirements are met and that it can obtain the relevant information. It cannot simply outsource its obligations.

Question 11AML/CFT regulatory framework and obligations in New Zealand

A customer is a politically exposed person. What additional step does the AML/CFT framework typically require of the reporting entity?

  1. Require the customer to close all existing accounts
  2. Obtain senior management approval to establish or continue the relationship Correct answer.
  3. Report the customer to the supervisor as a suspicious person
  4. Refuse to provide any service to the customer

Explanation

For PEPs, enhanced measures such as senior management approval and enhanced ongoing monitoring are expected. The Act does not prohibit dealing with PEPs or require automatic reporting or account closure.

Question 12AML/CFT regulatory framework and obligations in New Zealand

What is the purpose of enhanced customer due diligence?

  1. To replace the need for identity verification
  2. To apply additional measures where the risk of money laundering or terrorist financing is higher Correct answer.
  3. To reduce the reporting entity's record-keeping duties
  4. To speed up onboarding for low-value customers

Explanation

Enhanced CDD applies extra measures proportionate to higher risk, such as additional identity information, source of funds checks, and increased monitoring. It does not replace verification or reduce record-keeping.

Question 13AML/CFT regulatory framework and obligations in New Zealand

A reporting entity cannot complete the required customer due diligence for a prospective customer. What is the appropriate course of action?

  1. Proceed and note the gap in the file without further action
  2. Proceed if the customer is a long-standing referral
  3. Proceed and complete the CDD at the next annual review
  4. Decline to establish the business relationship or continue the transaction Correct answer.

Explanation

Where CDD cannot be completed, the reporting entity must not establish the business relationship or carry out the transaction, and should consider whether an STR is warranted. Proceeding without CDD is a breach.

Question 14AML/CFT regulatory framework and obligations in New Zealand

What is a 'suspicious activity report' required to be filed in relation to?

  1. Activity the reporting entity suspects may be relevant to the detection of money laundering or terrorist financing Correct answer.
  2. A customer who has an expired passport
  3. Any transaction the entity finds commercially unattractive
  4. A customer who has moved to a new address

Explanation

The obligation is to report activity that the reporting entity has reasonable grounds to suspect may be relevant to ML/TF detection. Administrative issues like expiry or address changes are CDD housekeeping matters.

Question 15AML/CFT regulatory framework and obligations in New Zealand

Which of the following is a key element a reporting entity's AML/CFT programme must include?

  1. A marketing plan for new financial products
  2. A schedule of employee annual leave
  3. Procedures for customer due diligence, reporting and record keeping Correct answer.
  4. A list of preferred legal counsel

Explanation

The AML/CFT programme must include procedures for CDD, reporting, record keeping, and risk assessment and management. Marketing, leave schedules and legal counsel lists are not programme requirements.

Question 16AML/CFT regulatory framework and obligations in New Zealand

A reporting entity must conduct an AML/CFT risk assessment. What is the primary purpose of this assessment?

  1. To calculate the entity's taxable income
  2. To benchmark the entity's share price against peers
  3. To identify and evaluate the ML/TF risks the entity faces so it can design proportionate controls Correct answer.
  4. To determine the number of staff needed in the compliance team

Explanation

The risk assessment identifies and evaluates ML/TF risks relevant to the entity's business, informing the design of proportionate controls in the programme. It is not a tax, market or staffing calculation.

Question 17AML/CFT regulatory framework and obligations in New Zealand

How long must a reporting entity generally retain customer due diligence records under the AML/CFT Act?

  1. At least five years after the business relationship ends or the transaction is completed Correct answer.
  2. Indefinitely in all cases
  3. Until the end of the current financial year
  4. At least one year after the relationship ends

Explanation

The Act requires CDD and related records to be kept for at least five years after the business relationship ends or the transaction is completed. Shorter retention or financial-year-only retention would not comply.

Question 18AML/CFT regulatory framework and obligations in New Zealand

A reporting entity discovers it has not filed a prescribed transaction report that was due. What should it do?

  1. Report the failure only if the supervisor asks
  2. Destroy the underlying records to avoid scrutiny
  3. File the report as soon as practicable and address the cause of the failure Correct answer.
  4. Wait until the next scheduled reporting cycle

Explanation

Late or missed reports should be filed promptly and the cause remediated, since failure to report is a breach of the Act. Waiting, destroying records, or only reacting on request would compound the breach.

Question 19AML/CFT regulatory framework and obligations in New Zealand

Under the AML/CFT Act, what is the role of the supervisor in relation to a reporting entity's compliance?

  1. To set the entity's product pricing
  2. To monitor and examine compliance and take enforcement action where needed Correct answer.
  3. To conduct the entity's customer due diligence on its behalf
  4. To approve each new customer relationship

Explanation

Supervisors monitor and examine reporting entities for compliance and can take enforcement action. They do not perform CDD, set pricing, or approve individual customers.

Question 20AML/CFT regulatory framework and obligations in New Zealand

A reporting entity is considering simplified customer due diligence for a low-risk customer. What principle governs this?

  1. Simplified measures allow the entity to skip identity verification entirely
  2. Simplified measures may be applied where the ML/TF risk is assessed as low, while still verifying identity Correct answer.
  3. Simplified measures are available to any customer who requests them
  4. Simplified measures apply automatically to all domestic customers

Explanation

Simplified measures are permitted only where risk is assessed as low, and identity must still be verified. They are not a blanket waiver, cannot be requested at will, and do not apply automatically by customer type.

Question 21AML/CFT regulatory framework and obligations in New Zealand

Which of the following best describes the relationship between the AML/CFT Act and the regulations and codes of practice made under it?

  1. The Act sets the framework, while regulations and codes provide detailed requirements and guidance Correct answer.
  2. The regulations override the Act wherever they conflict
  3. The Act applies only to banks, while regulations cover other entities
  4. The codes of practice are optional and have no legal effect

Explanation

The Act establishes the framework, and regulations and codes of practice provide detailed requirements and guidance to support compliance. Regulations cannot override the Act, and codes have a statutory basis in the framework.

Question 22AML/CFT regulatory framework and obligations in New Zealand

A reporting entity uses an agent to conduct customer due diligence on its behalf. How does the Act treat the entity's responsibility for that CDD?

  1. The agent alone bears any compliance failure
  2. The entity is excused if the agent is independent
  3. Responsibility transfers to the supervisor
  4. The entity remains accountable for the CDD performed by the agent Correct answer.

Explanation

Where an agent conducts CDD, the reporting entity remains accountable for compliance and must ensure the agent meets the requirements. Responsibility does not shift to the agent or the supervisor.

Question 23AML/CFT regulatory framework and obligations in New Zealand

What is the significance of New Zealand's mutual evaluation by the Financial Action Task Force for reporting entities?

  1. It directly licenses individual reporting entities
  2. It sets the interest rates banks may charge
  3. It replaces the need for domestic supervisors
  4. It assesses the country's AML/CFT framework and can drive changes to domestic obligations Correct answer.

Explanation

FATF mutual evaluations assess a country's implementation of the international standards and can lead to recommendations that shape domestic law and supervisory expectations. They do not license entities, replace supervisors, or set interest rates.

Question 24AML/CFT regulatory framework and obligations in New Zealand

A reporting entity's risk assessment identifies a higher-risk customer segment. What does the Act require in response?

  1. Report every customer in the segment as suspicious
  2. Exclude the segment from monitoring to save resources
  3. Apply the same controls as for all other customers
  4. Apply enhanced due diligence and monitoring proportionate to that risk Correct answer.

Explanation

Where risk is higher, the entity must apply enhanced measures proportionate to that risk, including enhanced monitoring. Uniform controls or reduced monitoring would not be risk-based, and suspicion reporting requires actual suspicion.

Question 25AML/CFT regulatory framework and obligations in New Zealand

Under the AML/CFT Act, which government body is responsible for supervising the compliance of reporting entities in the financial services sector such as banks and insurers?

  1. The Department of Internal Affairs
  2. The New Zealand Police
  3. The Reserve Bank of New Zealand Correct answer.
  4. The Financial Markets Authority

Explanation

The AML/CFT Act allocates supervisory responsibility across several agencies. Banks, non-bank deposit takers, life insurers and fund managers are supervised by the Reserve Bank of New Zealand. Other sectors such as gambling and non-financial businesses fall to the Department of Internal Affairs.

Question 26AML/CFT regulatory framework and obligations in New Zealand

What is the primary purpose of the Financial Action Task Force (FATF) in relation to New Zealand's AML/CFT framework?

  1. To set international standards that New Zealand implements through its domestic AML/CFT regime Correct answer.
  2. To prosecute reporting entities that fail to file suspicious transaction reports
  3. To directly investigate money laundering offences committed in New Zealand
  4. To supervise New Zealand banks for compliance with the AML/CFT Act

Explanation

The FATF is an intergovernmental body that develops international standards (the Recommendations) to combat money laundering and terrorist financing. New Zealand is a member and implements these standards through its domestic legislation and supervisory arrangements. The FATF itself does not investigate, supervise or prosecute within New Zealand.

Question 27AML/CFT regulatory framework and obligations in New Zealand

A reporting entity is reviewing its obligations regarding prescribed transaction reports. Which type of transaction generally triggers a prescribed transaction report to the Financial Intelligence Unit?

  1. Any transaction the entity considers unusual for that customer
  2. An international wire transfer above a specified threshold Correct answer.
  3. A transfer between two accounts held by the same customer
  4. Every cash deposit regardless of amount

Explanation

Prescribed transaction reports capture certain defined transactions, notably international wire transfers above a threshold value, as set out in the AML/CFT Act and regulations. They are distinct from suspicious activity reports, which turn on the entity's assessment of suspicion. Not all cash deposits or internal transfers are prescribed transactions.

Question 28AML/CFT regulatory framework and obligations in New Zealand

A reporting entity is designing its AML/CFT compliance programme. Which document sets out minimum standards and guidance that the entity should follow when establishing its programme?

  1. The Financial Markets Conduct Act disclosure requirements
  2. The relevant supervisor's AML/CFT guidelines and the identity verification code of practice Correct answer.
  3. The Privacy Act 2020 code of conduct
  4. The Companies Act reporting obligations

Explanation

Each supervisor publishes AML/CFT guidelines explaining how it expects reporting entities to meet their obligations, and there is an identity verification code of practice for customer due diligence. These are the reference documents for building a compliant programme. The other statutes address unrelated areas such as privacy, securities disclosure and company reporting.

Question 29AML/CFT regulatory framework and obligations in New Zealand

A reporting entity has a customer whose identity it has verified, but the customer later changes their name and address. How does the AML/CFT Act treat the entity's customer due diligence obligations in this situation?

  1. The entity need only update records if the customer volunteers the information
  2. The entity must close the account and require the customer to reapply
  3. The entity must conduct customer due diligence again when there are changes to the customer's relevant circumstances Correct answer.
  4. The entity has no further obligations because identity was verified at onboarding

Explanation

Customer due diligence is not a one-off step; the Act requires ongoing CDD and account monitoring, including conducting CDD again when there are changes to the customer's circumstances. Name and address changes are relevant circumstances that may require the entity to refresh its CDD. Closing the account is not a mandated response.

Question 30AML/CFT regulatory framework and obligations in New Zealand

A reporting entity is considering whether a particular customer relationship falls within the scope of the AML/CFT Act. Which factor is most relevant to determining whether the entity must carry out customer due diligence for that relationship?

  1. Whether the transaction amounts are paid in cash rather than by electronic transfer
  2. Whether the customer is a New Zealand resident or an overseas person
  3. Whether the entity is a reporting entity carrying out a captured activity and is in a business relationship with the customer Correct answer.
  4. Whether the customer has previously been a customer of another reporting entity

Explanation

The Act applies to reporting entities carrying out captured activities, and CDD obligations arise in relation to customers in a business relationship or occasional transactions of a specified kind. The key question is whether the entity is a reporting entity engaged in a captured activity with that customer. Prior relationships elsewhere, payment method and residency are not the determining factors.

Question 31Risk assessment and risk-based approach

Under a risk-based approach, the primary purpose of a customer risk assessment is to do which of the following?

  1. Replace the need for a firm-wide risk assessment entirely
  2. Guarantee that no customer will ever be used for money laundering
  3. Set a fixed monitoring standard that applies identically to every customer
  4. Determine the appropriate level of due diligence and ongoing monitoring for each customer relationship Correct answer.

Explanation

A risk-based approach requires firms to assess each customer's risk so that controls, due diligence and monitoring are proportionate to that risk. It does not eliminate risk or replace the institutional risk assessment.

Question 32Risk assessment and risk-based approach

Which of the following best describes the relationship between a firm's overall (institutional) risk assessment and its individual customer risk assessments?

  1. The overall assessment must be repeated for every customer
  2. The overall assessment informs policies and controls that shape how customer-level risks are identified and managed Correct answer.
  3. Customer assessments override the overall assessment in all cases
  4. Customer assessments are irrelevant to the overall assessment

Explanation

The institutional risk assessment identifies the firm's exposure across products, customers, delivery channels and geography, and this drives the design of controls applied at customer level. The two operate at different levels and are complementary.

Question 33Risk assessment and risk-based approach

A compliance officer is designing a risk-scoring model. Which combination of factors is most consistent with recognised risk-based guidance?

  1. Only whether the customer was born in New Zealand
  2. Only the customer's account balance at onboarding
  3. Customer type, product/service, delivery channel and geographic location Correct answer.
  4. Only the customer's stated occupation

Explanation

Risk-based frameworks commonly consider the customer, the product or service, the delivery channel and geography. A single factor is insufficient to capture the range of money laundering and terrorist financing risks.

Question 34Risk assessment and risk-based approach

What does 'risk appetite' mean in the context of an AML/CFT programme?

  1. The level of money laundering and terrorist financing risk the firm is willing to accept in pursuing its objectives Correct answer.
  2. The interest rate the firm charges on high-risk accounts
  3. The amount of cash a customer may deposit in a single day
  4. The maximum number of customers a firm may onboard per year

Explanation

Risk appetite articulates how much residual risk the firm is prepared to tolerate, guiding decisions on which customers, products and markets to accept. It is a governance statement, not a numeric operational limit.

Question 35Risk assessment and risk-based approach

Which of the following is generally treated as a higher-risk indicator in a customer risk assessment?

  1. A customer who promptly responds to all information requests
  2. A customer whose source of funds is complex and involves multiple offshore entities with unclear ownership Correct answer.
  3. A customer who provides complete identification documents at onboarding
  4. A customer with a long-standing domestic salary account

Explanation

Complex structures with unclear ownership and opaque source of funds are recognised higher-risk indicators because they can obscure beneficial ownership and the origin of funds. Transparency and cooperation generally reduce risk.

Question 36Risk assessment and risk-based approach

A firm applies enhanced due diligence to a customer because the customer is a politically exposed person. This is an example of which principle?

  1. Outsourcing of compliance responsibility
  2. Risk elimination
  3. Proportionate controls based on assessed risk Correct answer.
  4. Uniform treatment of all customers

Explanation

Applying enhanced measures to higher-risk customers demonstrates proportionality, a central tenet of the risk-based approach. Controls are scaled to the assessed risk rather than applied uniformly.

Question 37Risk assessment and risk-based approach

Which statement best describes a 'simplified due diligence' measure under a risk-based approach?

  1. Reduced verification measures applied only where the assessed risk is demonstrably low Correct answer.
  2. A permanent reduction that is never reviewed
  3. A measure available to any customer who requests it
  4. A complete exemption from customer identification

Explanation

Simplified measures are permissible only where risk is demonstrably low and must be justified by the assessment. They reduce, but do not remove, identification and verification obligations.

Question 38Risk assessment and risk-based approach

Why must a risk assessment be documented?

  1. To transfer legal responsibility to the customer
  2. To provide an auditable record that justifies the controls applied and supports supervisory review Correct answer.
  3. To increase the volume of paperwork for its own sake
  4. To replace the need for ongoing monitoring

Explanation

Documentation creates an audit trail showing that decisions were reasoned and proportionate, which is essential for internal governance and supervisory examination. It supports, rather than replaces, monitoring and accountability.

Question 39Risk assessment and risk-based approach

A customer's circumstances change materially, for example a previously salaried local customer begins receiving large regular transfers from multiple unrelated overseas parties. What is the most appropriate risk-based response?

  1. Take no action because the customer was originally rated low risk
  2. Reassess the customer's risk rating and adjust monitoring and due diligence accordingly Correct answer.
  3. Ignore the change unless a transaction exceeds a fixed reporting threshold
  4. Immediately close the account without any review

Explanation

Risk is dynamic, and material changes in activity or circumstances should trigger a reassessment that may raise the rating and intensify monitoring. Relying on the original rating or a single threshold ignores the risk-based principle.

Question 40Risk assessment and risk-based approach

A compliance officer is deciding how frequently to review customer files. Which approach best reflects a risk-based methodology?

  1. Review all customers on the same fixed annual cycle
  2. Set shorter review cycles for higher-risk customers and longer cycles for lower-risk customers Correct answer.
  3. Review files only when a regulator requests them
  4. Review only customers who complain

Explanation

Periodic review frequency should be proportionate to risk, with higher-risk relationships reviewed more often. A uniform cycle or reactive approach does not reflect differentiated risk.

Question 41Risk assessment and risk-based approach

A firm uses a numeric risk-scoring model. Which practice best supports the integrity of that model over time?

  1. Never changing the model once it is implemented
  2. Removing all documentation to keep the model confidential
  3. Periodically validating the model against actual outcomes and emerging risks Correct answer.
  4. Allowing each staff member to apply their own weightings

Explanation

Models should be validated and recalibrated as risks, typologies and the firm's business evolve. Inconsistent application and lack of documentation undermine reliability and defensibility.

Question 42Risk assessment and risk-based approach

Which factor would most appropriately increase a customer's geographic risk score?

  1. The customer uses online banking rather than a branch
  2. The customer's account is denominated in the local currency
  3. The customer's funds originate from a jurisdiction identified as having strategic AML/CFT deficiencies Correct answer.
  4. The customer lives in the same city as the firm's head office

Explanation

Geography risk rises where funds originate from or are linked to jurisdictions with weak AML/CFT regimes or identified deficiencies. Local residence, currency and channel preference are separate considerations.

Question 43Risk assessment and risk-based approach

A new customer is a shell company with nominee directors and no apparent business activity in the stated jurisdiction. What is the most appropriate risk-based action?

  1. Onboard immediately and gather ownership information only at the first periodic review
  2. Accept the customer as low risk because a company is a legitimate legal form
  3. Treat the customer as higher risk, identify beneficial owners and apply enhanced due diligence before proceeding Correct answer.
  4. Decline all companies as customers regardless of circumstances

Explanation

Shell-like structures with nominee arrangements and no evident activity are higher-risk because ownership and purpose may be obscured. Enhanced measures, including beneficial ownership identification, should precede onboarding.

Question 44Risk assessment and risk-based approach

Which of the following best illustrates the use of a risk-based approach when applying customer due diligence to a low-risk product with limited functionality?

  1. Refusing to offer the product to anyone
  2. Applying reduced verification steps justified by the limited product risk and documenting the rationale Correct answer.
  3. Skipping all identification because the product is low risk
  4. Applying the same enhanced measures used for high-risk customers

Explanation

Where product risk is genuinely low, proportionate reduction in some measures may be justified, but the decision must be documented. Identification obligations are not eliminated, and enhanced measures would be disproportionate.

Question 45Risk assessment and risk-based approach

A firm's overall risk assessment identifies that its new online onboarding channel has increased exposure to impersonation and synthetic identity fraud. What is the most appropriate follow-on action?

  1. Assume the channel risk is unchanged because the customer base is the same
  2. Remove the online channel from the overall assessment
  3. Strengthen identity verification controls for the online channel and reflect this in customer risk scoring Correct answer.
  4. Rely solely on the customer's self-declared information

Explanation

The institutional assessment should drive control enhancements where a channel raises risk, and those controls should feed into customer-level scoring. Ignoring channel risk or relying on self-declaration leaves the exposure unmanaged.

Question 46Risk assessment and risk-based approach

What role does senior management play in a risk-based AML/CFT framework?

  1. Delegating all AML/CFT decisions to front-line staff without oversight
  2. Limiting risk assessment to the compliance team's discretion
  3. Approving the risk assessment methodology and ensuring adequate resources and oversight Correct answer.
  4. Setting risk appetite only after a supervisory enforcement action

Explanation

Senior management is responsible for approving the risk framework, setting appetite and ensuring the programme is adequately resourced and overseen. AML/CFT governance cannot be delegated away entirely.

Question 47Risk assessment and risk-based approach

A customer rated medium risk is found to have a beneficial owner who is a foreign politically exposed person. How should the risk assessment respond?

  1. Escalate the rating and apply enhanced due diligence and senior management approval as appropriate Correct answer.
  2. Downgrade the rating because a PEP is a public official
  3. Close the account automatically without review
  4. Maintain the medium rating because the customer was already assessed

Explanation

A PEP beneficial owner is a recognised higher-risk factor that should escalate the rating and trigger enhanced measures, including senior approval where required. Ignoring or downgrading the factor would be inconsistent with a risk-based approach.

Question 48Risk assessment and risk-based approach

Which statement best captures the principle of 'risk-based' rather than 'rule-based' compliance?

  1. Controls are calibrated to the assessed level of risk rather than applied mechanically to every case Correct answer.
  2. Only transactions above a fixed amount are ever assessed
  3. Rules are ignored in favour of staff judgement alone
  4. Every customer must receive identical treatment regardless of risk

Explanation

A risk-based approach tailors controls to assessed risk, whereas a purely rule-based approach applies fixed requirements uniformly. It still operates within legal rules and requires documented judgement.

Question 49Risk assessment and risk-based approach

A firm is considering relying on a third party for elements of customer due diligence. What risk-based consideration is most important?

  1. Transferring all legal responsibility for the customer to the third party
  2. Assessing the third party's own AML/CFT standards and retaining ultimate responsibility for the customer Correct answer.
  3. Avoiding any documentation of the arrangement
  4. Assuming the third party's checks are always adequate

Explanation

Reliance on third parties requires assessing their controls and retaining responsibility for the customer relationship. Responsibility cannot be fully transferred, and the arrangement should be documented.

Question 50Risk assessment and risk-based approach

Which of the following is the best example of a mitigating factor that could lower a customer's assessed risk?

  1. The customer refuses to explain the purpose of the relationship
  2. The customer's ownership structure includes several layered offshore trusts
  3. The customer prefers to communicate only by encrypted messaging
  4. The customer's wealth is supported by independently verifiable documentation from a reputable source Correct answer.

Explanation

Independent, verifiable documentation of source of wealth is a strong mitigating factor because it provides transparency. Opaque structures, evasive behaviour and unusual communication preferences tend to increase risk.