NIBAF AML & CFT common mistakes
NIBAF AML & CFT · Understand the traps and how to avoid them.
Treating the FATF Recommendations as legally binding treaty obligations that directly create criminal offences in Pakistan, rather than as standards implemented through national law such as the AML Act 2010.
Candidates skim the FATF mandate and conflate 'international standard' with 'directly enforceable law'; exam questions often ask which instrument criminalises an act.
What to do instead
Memorise the implementation chain: FATF sets standards → Pakistan enacts the AML Act 2010 and SBP regulations → reporting entities apply them. Practise classifying each obligation by its source instrument.
Confusing a Suspicious Transaction Report (STR) with a Currency Transaction Report (CTR) and stating that a CTR requires suspicion or that an STR is triggered by a fixed cash threshold.
Both are reports to the Financial Monitoring Unit, so candidates merge their triggers; the threshold for CTRs is memorised without the 'no suspicion needed' qualifier.
What to do instead
Build a two-column comparison: trigger (suspicion vs. prescribed cash threshold), timing, who files, and confidentiality. Test yourself by writing one-line definitions from memory.
Applying simplified due diligence to a customer solely because they are low-risk by category (e.g., a salaried employee) without documenting the risk assessment or checking for red flags such as unusual cash activity.
Candidates memorise 'low risk = simplified CDD' as a shortcut and forget that simplified measures still require identification, verification and ongoing monitoring proportional to risk.
What to do instead
Learn the rule: simplified CDD is permitted only when lower risk is demonstrated and documented; it never removes the obligation to identify the customer and monitor the relationship. Use scenario questions to practise spotting when risk is actually higher than the category suggests.
Identifying only the immediate shareholder as the beneficial owner and stopping there, rather than tracing through layers of ownership to the natural person who ultimately owns or controls the customer.
Candidates equate 'shareholder' with 'beneficial owner' and are unfamiliar with the ownership-percentage and control tests used in Pakistan's CDD rules.
What to do instead
Memorise the definition of beneficial owner: the natural person who ultimately owns or controls, including through ownership thresholds or control by other means. Practise ownership-chain diagrams and note when senior managing official identification is the fallback.
Describing targeted financial sanctions as a general trade embargo or as something applied only to banks, and omitting the obligation to freeze without delay and without prior notice.
Candidates confuse sanctions screening with broader embargoes and do not read the TFS provisions closely, so they miss the 'without delay' and 'no prior notice' elements.
What to do instead
Study the TFS mechanism: designation by the UN Security Council or Pakistan's relevant authority, immediate asset freeze, prohibition on making funds available, and reporting to the regulator. Practise explaining the difference between TFS and general sanctions in two sentences.
Listing the elements of an effective AML/CFT compliance programme as a generic checklist without linking each element to a specific legal or regulatory requirement, such as board-approved policy, a designated compliance officer, independent audit and training.
Candidates rely on memory of a five-element list and cannot explain why each element exists or which regulator expects it.
What to do instead
For each programme element, write the corresponding SBP/regulatory expectation and one consequence of failure. Use exam-style questions that ask 'which requirement does this control satisfy?' rather than 'list the elements'.
Treating the national risk assessment as a one-time document rather than a process that must inform institutional risk assessments, and failing to distinguish inherent risk, control effectiveness and residual risk.
Candidates memorise 'NRA exists' without understanding how it feeds institutional risk assessment, and they use the three risk terms interchangeably.
What to do instead
Learn the risk-assessment chain: national risk assessment → sectoral guidance → institutional risk assessment → customer risk rating. Define inherent risk, controls and residual risk in your own words and apply them to a short scenario.
Stating that records must be kept 'for five years' without specifying the trigger point (from the end of the business relationship or from the date of the transaction) and without noting that records must be available to authorities on request.
Candidates memorise the number but not the starting event, and they overlook the requirement that records be retrievable and produced promptly.
What to do instead
Memorise the retention rule as a sentence: keep CDD and transaction records for at least five years after the relationship ends or the transaction is completed, and make them available to the FMU and regulators on request. Practise questions that vary the trigger date.
Assuming that filing an STR discharges the reporting entity's obligations, without recognising the continuing prohibitions on tipping off and on carrying out the transaction where a suspicion exists.
Candidates see the STR as the end of the process and forget the confidentiality and 'no tipping off' rules that continue after filing.
What to do instead
Study the post-filing obligations: do not disclose the report to the customer, do not proceed with a transaction you suspect is linked to unlawful activity unless instructed by the competent authority, and cooperate with the FMU. Answer scenario questions on what to say to a customer who asks why their account is frozen.
Confusing the Financial Monitoring Unit's role as Pakistan's financial intelligence unit with that of a law-enforcement agency, and misstating who investigates and prosecutes money laundering offences.
Candidates blur the functions of the FMU, the regulator (SBP) and investigative agencies because all appear in the AML Act 2010.
What to do instead
Map each body to its function: FMU receives and analyses STRs/CTRs and disseminates intelligence; SBP supervises reporting entities; investigative agencies and courts handle investigation and prosecution. Create a one-page organogram and test yourself on 'who does what'.