Question 600
After a risk-assessment update notes that a fraud team sees mule-account patterns that the AML team never incorporates into customer risk scores., which safeguard most closely responds to the root cause?
- Trigger targeted CDD refresh and transaction review for behavior changes
- Build controlled cross-risk referrals into scoring and investigations
- Obtain appropriate approvals and enhanced source-of-wealth review
- Run risk-based ongoing PEP screening and reassessment
Explanation
Correct Answer
B:Sharing validated indicators improves awareness without treating every fraud alert as proven laundering. The mechanism directly mitigates the stated exposure rather than a related but separate problem such as a customer profile lists salary income but transactions show unusually large commercial….
Incorrect Answers
A:Compared with the stated facts about a fraud team sees mule-account patterns that the AML team never incorporates into…, a linked process investigates anomalies rather than automatically treating them as crime. Its controls focus on a customer profile lists salary income but transactions show unusually large commercial receipts, which would leave the observed problem of a fraud team sees mule-account patterns that the AML team never incorporates into customer risk… unresolved.
C:When testing the contrasting pattern of a fraud team sees mule-account patterns that the AML team never incorporates into…, remember that governance should address both political influence and unexplained wealth accumulation. This safeguard targets a new customer is a PEP whose funds arrive from a closely held firm with undisclosed controllers; it does not directly remediate the process failure in a fraud team sees mule-account patterns that the AML team never incorporates into customer risk….
D:Monitoring should detect new roles and prompt enhanced measures when warranted; the observed record here instead involves a fraud team sees mule-account patterns that the AML team never incorporates into…. That measure could be appropriate where a bank screens PEPs only during initial account opening, but the described weakness is a fraud team sees mule-account patterns that the AML team never incorporates into customer risk….
Question 601
A risk committee asks for operating-effectiveness evidence regarding the following: A licensed firearms wholesaler ships dual-use components to newly created intermediaries with unclear end users. What would provide the strongest proof?
- Audit nominee files for documented control and escalation decisions
- Test collateral files for independent provenance and valuation proof
- Test that prohibited end-use scenarios trigger specialist holds
- Review discrepancies held versus released and their resolutions
Explanation
Correct Answer
C:The control should respond to product and beneficiary red flags even without list-name matches. Success on this scenario would be relevant to the original failure, whereas a high-risk client uses a nominee shareholder whose instructions come from an unidentified… tests a different exposure.
Incorrect Answers
A:The test focuses on who actually directs the entity, not just the shareholder register; the observed record here instead involves a licensed firearms wholesaler ships dual-use components to newly created…. This assurance method targets a high-risk client uses a nominee shareholder whose instructions come from an unidentified… rather than the reported process: a licensed firearms wholesaler ships dual-use components to newly created intermediaries with….
B:Against the reported situation in which a licensed firearms wholesaler ships dual-use components to newly created…, a complete trail should support ownership and explain the scale of the pledged wealth. Testing this would validate controls for a private-banking client pledges opaque offshore holdings as collateral for unusually large credit…, not the effectiveness of remediation for a licensed firearms wholesaler ships dual-use components to newly created intermediaries with….
D:Compared with the stated facts about a licensed firearms wholesaler ships dual-use components to newly created…, assurance tests whether exceptions are resolved with evidence before funds move. The test exercises an adjacent pathway, a trading company requests a letter of credit with documents inconsistent on port, cargo, and…, without directly challenging a licensed firearms wholesaler ships dual-use components to newly created intermediaries with….
Question 602
The AFC team needs to demonstrate sustained remediation for the following weakness: A payment app adds facial recognition to every minor account-profile change despite low observed fraud exposure. Which validation is appropriate?
- Compare fraud outcomes and failure rates before and after step-up triggers
- Run controlled presentation-attack tests and measure false rejection
- Challenge the flow with altered documents and independent issuer checks
- Replay known time-ordered payments through the normalized data pipeline
Explanation
Correct Answer
A:The test asks whether security improvements justify the added friction. The assessment probes the affected transactions and decisions, not just an adjacent risk such as a remote account applicant uses a high-quality printed face photograph to defeat a simple….
Incorrect Answers
B:Compared with the stated facts about a payment app adds facial recognition to every minor account-profile change despite…, assurance must test both spoof resistance and accessibility for legitimate users. Even a favorable result for a remote account applicant uses a high-quality printed face photograph to defeat a simple selfie… would not demonstrate the control works when a payment app adds facial recognition to every minor account-profile change despite low observed….
C:This is not the central mechanism when a payment app adds facial recognition to every minor account-profile change despite…; testing confirms whether manipulated documents are rejected or escalated. This assurance method targets an e-KYC provider verifies an image of an identity document but never validates its issuer or… rather than the reported process: a payment app adds facial recognition to every minor account-profile change despite low observed….
D:When testing the contrasting pattern of a payment app adds facial recognition to every minor account-profile change despite…, remember that tests should detect sequencing errors before alerts rely on corrupted timestamps. Testing this would validate controls for a monitoring engine receives transaction dates as free-form strings and misorders transfers across…, not the effectiveness of remediation for a payment app adds facial recognition to every minor account-profile change despite low observed….
Question 603
For this identified exposure, a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary shop sales. Choose TWO complementary steps: one targeted safeguard and one test of its operation.
- Test that prohibited end-use scenarios trigger specialist holds
- Consolidate branch deposits by merchant and common depositor identity
- Apply partner due diligence and proportionate grant monitoring
- Apply cash-intensive-business due diligence and tailored cash monitoring
- Sample respondent payments for originator and beneficiary visibility
- Back-test deposit alerts against verified sales and branch activity
Explanation
Correct Answers
D:For the supported action of apply cash-intensive-business due diligence and tailored cash monitoring in this effectiveness test review involving a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary…, expected turnover, seasonality, and cash volumes should define targeted triggers for deviations. It addresses the live exposure in a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary shop sales; corrective action is not a substitute for verifying its operation.
F:The review tests whether anomalous cash injections would be detected without treating every cash retailer alike. It produces control-performance evidence about a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary shop sales; a documented plan alone would not prove operation.
Incorrect Answers
A:Compared with the stated facts about a warehouse operator routes illicit cash proceeds into retail deposits while claiming…, the control should respond to product and beneficiary red flags even without list-name matches. The sample would be probative if a licensed firearms wholesaler ships dual-use components to newly created intermediaries with…; a different population and test are needed for a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary shop…. For the alternative option of test that prohibited end-use scenarios trigger specialist holds in this effectiveness test review involving a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary…, a two-part remediation plan for a warehouse operator routes illicit cash proceeds into retail deposits while… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
B:This is not the central mechanism when a warehouse operator routes illicit cash proceeds into retail deposits while claiming…; network-wide aggregation exposes behavior that individual branch limits would miss. It might establish facts where a regional bank sees sudden cash deposits at several branches by couriers working for one merchant, but those records would not test the observed pattern: a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary shop…. For the alternative option of consolidate branch deposits by merchant and common depositor identity in this effectiveness test review involving a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary…, a two-part remediation plan for a warehouse operator routes illicit cash proceeds into retail deposits while… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
C:When testing the contrasting pattern of a warehouse operator routes illicit cash proceeds into retail deposits while claiming…, remember that a risk-sensitive arrangement can preserve assistance while managing diversion and TF risk. Its controls focus on a relief organization routes grants to an unverified local partner in an active conflict area, which would leave the observed problem of a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary shop… unresolved. For the alternative option of apply partner due diligence and proportionate grant monitoring in this effectiveness test review involving a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary…, a two-part remediation plan for a warehouse operator routes illicit cash proceeds into retail deposits while… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
E:Against the reported situation in which a warehouse operator routes illicit cash proceeds into retail deposits while claiming…, an effectiveness test confirms whether downstream activity can be identified and escalated. Testing this would validate controls for a bank opens a payable-through correspondent arrangement but cannot identify the foreign bank's…, not the effectiveness of remediation for a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary shop…. For the alternative option of sample respondent payments for originator and beneficiary visibility in this effectiveness test review involving a warehouse operator routes illicit cash proceeds into retail deposits while claiming ordinary…, a two-part remediation plan for a warehouse operator routes illicit cash proceeds into retail deposits while… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
Question 604
A remediation is marked complete for this case: An employee reports a customer attempting to suppress questions about repeated third-party cash deposits. Which operational test would best challenge that claim?
- Sample filed reports for coherent subject, flow, and suspicion descriptions
- Sample exchanges for channel classification and retention evidence
- Audit staff referrals for preservation, timeliness, and case linkage
- Trace case-to-filing dates against documented legal triggers
Explanation
Correct Answer
C:The test checks whether frontline observations enter formal investigations. The assessment probes the affected transactions and decisions, not just an adjacent risk such as an AML team files a report that lists transaction values but fails to explain the suspected….
Incorrect Answers
A:When testing the contrasting pattern of an employee reports a customer attempting to suppress questions about repeated…, remember that the test assesses actionable content, not only whether a form was submitted. The sample would be probative if an AML team files a report that lists transaction values but fails to explain the suspected pattern…; a different population and test are needed for an employee reports a customer attempting to suppress questions about repeated third-party cash….
B:Testing ensures searches and disclosures follow the proper framework; the observed record here instead involves an employee reports a customer attempting to suppress questions about repeated…. The test exercises an adjacent pathway, a bank treats a voluntary interbank information request as an automatic section 314(a) government…, without directly challenging an employee reports a customer attempting to suppress questions about repeated third-party cash….
D:The relevant alternative mechanism is different from an employee reports a customer attempting to suppress questions about repeated…: Testing identifies delayed reports and weak deadline governance. This assurance method targets a transaction monitoring alert is escalated after the legal deadline because investigators dispute… rather than the reported process: an employee reports a customer attempting to suppress questions about repeated third-party cash….
Question 605
The AFC team needs to demonstrate sustained remediation for the following weakness: A luxury-car broker accepts repeated deposits from unrelated companies and resells vehicles almost immediately. Which validation is appropriate?
- Reconcile pooled balances to identifiable client-level subledgers
- Test fee samples for documented work and payment consistency
- Test related-entity flows against declared tax and trading activity
- Test vehicle transaction samples for source-to-sale continuity
Explanation
Correct Answer
D:Assurance should establish that funds and sale proceeds remain attributable to identified parties. The assessment probes the affected transactions and decisions, not just an adjacent risk such as a bookkeeping firm pools client receipts in its own account and remits them without….
Incorrect Answers
A:The relevant alternative mechanism is different from a luxury-car broker accepts repeated deposits from unrelated companies and resells…: Tests assess whether every movement can be traced to a legitimate account owner. Even a favorable result for a bookkeeping firm pools client receipts in its own account and remits them without customer-level… would not demonstrate the control works when a luxury-car broker accepts repeated deposits from unrelated companies and resells vehicles almost….
B:Compared with the stated facts about a luxury-car broker accepts repeated deposits from unrelated companies and resells…, assurance checks whether high-risk professional-service transactions have substantive evidence. This assurance method targets a professional service provider invoices an offshore entity for vague advisory work followed by… rather than the reported process: a luxury-car broker accepts repeated deposits from unrelated companies and resells vehicles almost….
C:This is not the central mechanism when a luxury-car broker accepts repeated deposits from unrelated companies and resells…; reconciliation exposes entities that cannot support their transactions commercially. Testing this would validate controls for a tax adviser creates repeated artificial loss-making entities whose transfers fund personal luxury…, not the effectiveness of remediation for a luxury-car broker accepts repeated deposits from unrelated companies and resells vehicles almost….
Question 606
A financial-crime team must corroborate the concern, implement a specific safeguard, and verify that safeguard after this event: An account receives payments from employers implicated in withholding migrant workers' wages and documents. Choose THREE steps that satisfy those three different needs.
- Escalate trafficking indicators and monitor linked payroll accounts
- Examine payroll, worker complaints, and business ownership links
- Test whether linked accounts and wage anomalies reach investigators
- Verify asset ownership, acquisition history, and independent valuations
- Enhance correspondent due diligence and contractual transparency
- Review discrepancies held versus released and their resolutions
Explanation
Correct Answers
A:For the supported action of escalate trafficking indicators and monitor linked payroll accounts in this effectiveness test review involving an account receives payments from employers implicated in withholding migrant workers' wages…, relationship-level analysis can connect suspicious revenue flows with abusive recruitment practices. It addresses the live exposure in an account receives payments from employers implicated in withholding migrant workers' wages and documents; corrective action is not a substitute for verifying its operation.
B:A coherent evidence trail distinguishes ordinary labor contracting from exploitation proceeds. It supplies corroborating evidence about an account receives payments from employers implicated in withholding migrant workers' wages and documents; investigation is distinct from implementing or testing a safeguard.
C:An effective control should identify related employers, beneficiaries, and implausible payroll patterns. It produces control-performance evidence about an account receives payments from employers implicated in withholding migrant workers' wages and documents; a documented plan alone would not prove operation.
Incorrect Answers
D:Against the reported situation in which an account receives payments from employers implicated in withholding migrant…, evidence of how the wealth was accumulated differs from tracing a single repayment source. That review would be useful if a private-banking client pledges opaque offshore holdings as collateral for unusually large credit…, but it would not resolve the central uncertainty in an account receives payments from employers implicated in withholding migrant workers' wages and…. For the alternative option of verify asset ownership, acquisition history, and independent valuations in this effectiveness test review involving an account receives payments from employers implicated in withholding migrant workers' wages…, for an account receives payments from employers implicated in withholding migrant…, corroboration, targeted correction, and assurance must all relate to the same failure.
E:The relevant alternative mechanism is different from an account receives payments from employers implicated in withholding migrant…: Understanding respondent customers and nested services informs risk appetite and monitoring. That measure could be appropriate where a bank opens a payable-through correspondent arrangement but cannot identify the foreign bank's…, but the described weakness is an account receives payments from employers implicated in withholding migrant workers' wages and…. For the alternative option of enhance correspondent due diligence and contractual transparency in this effectiveness test review involving an account receives payments from employers implicated in withholding migrant workers' wages…, for an account receives payments from employers implicated in withholding migrant…, corroboration, targeted correction, and assurance must all relate to the same failure.
F:Compared with the stated facts about an account receives payments from employers implicated in withholding migrant…, assurance tests whether exceptions are resolved with evidence before funds move. The test exercises an adjacent pathway, a trading company requests a letter of credit with documents inconsistent on port, cargo, and…, without directly challenging an account receives payments from employers implicated in withholding migrant workers' wages and…. For the alternative option of review discrepancies held versus released and their resolutions in this effectiveness test review involving an account receives payments from employers implicated in withholding migrant workers' wages…, for an account receives payments from employers implicated in withholding migrant…, corroboration, targeted correction, and assurance must all relate to the same failure.
Question 607
A risk committee asks for operating-effectiveness evidence regarding the following: A joint anti-fraud initiative shares broad typology reports but never provides feedback on actionable indicators. What would provide the strongest proof?
- Test cross-border data access against consent and legal bases where applicable
- Monitor high-risk-country outcomes for differentiated risk decisions
- Track indicator adoption, referrals, and feedback closure
- Test filing timeliness using each entity's actual legal triggers
Explanation
Correct Answer
C:Operational metrics show whether shared intelligence changed frontline decisions. For the supported action of track indicator adoption, referrals, and feedback closure in this effectiveness test review involving a joint anti-fraud initiative shares broad typology reports but never provides feedback on…, this test provides observable evidence about the affected process; a test focused on a bank centralizes all customer data in one country despite incompatible transfer… would not establish the same result.
Incorrect Answers
A:Audit logs reveal whether disclosures remain within authorized use; the observed record here instead involves a joint anti-fraud initiative shares broad typology reports but never provides…. Testing this would validate controls for a bank centralizes all customer data in one country despite incompatible transfer restrictions in…, not the effectiveness of remediation for a joint anti-fraud initiative shares broad typology reports but never provides feedback on….
B:Against the reported situation in which a joint anti-fraud initiative shares broad typology reports but never provides…, testing should identify blanket exclusions that lack documented individual assessment. The sample would be probative if an international bank rejects all payments from a high-risk country without assessing customer or…; a different population and test are needed for a joint anti-fraud initiative shares broad typology reports but never provides feedback on….
D:Compared with the stated facts about a joint anti-fraud initiative shares broad typology reports but never provides…, assurance detects both late and incorrectly routed reports. Even a favorable result for a local compliance team automatically applies US suspicious-activity deadlines to an EU subsidiary would not demonstrate the control works when a joint anti-fraud initiative shares broad typology reports but never provides feedback on….
Question 608
A risk committee asks for operating-effectiveness evidence regarding the following: Adverse media software flags a person because another individual with the same common name was arrested. What would provide the strongest proof?
- Run precision-recall tests and timed case-resolution exercises
- Sample common-name alerts for identity precision and documented closures
- Seed material customer events and verify timely profile refresh
- Audit risk-score changes against genuine event and entity matches
Explanation
Correct Answer
B:Testing measures whether the system avoids harmful mistaken attribution. Success on this scenario would be relevant to the original failure, whereas a fuzzy sanctions matcher produces overwhelming false hits and analysts cannot clear them… tests a different exposure.
Incorrect Answers
A:Assurance shows whether tuning improves quality and case timeliness simultaneously; the observed record here instead involves adverse media software flags a person because another individual with the same common…. The test exercises an adjacent pathway, a fuzzy sanctions matcher produces overwhelming false hits and analysts cannot clear them within…, without directly challenging adverse media software flags a person because another individual with the same common name was….
C:The relevant alternative mechanism is different from adverse media software flags a person because another individual with the same common…: Testing shows whether real-world changes initiate reassessment. This assurance method targets a bank performs KYC refresh only once every five years for high-risk businesses despite major… rather than the reported process: adverse media software flags a person because another individual with the same common name was….
D:Compared with the stated facts about adverse media software flags a person because another individual with the same common…, assurance checks automated escalation precision and traceability. Testing this would validate controls for an automated KYC tool increases a customer's risk score on every adverse-media mention without…, not the effectiveness of remediation for adverse media software flags a person because another individual with the same common name was….
Question 609
An institution has corrected a process after discovering this case: A compliance officer assumes a FATF public-listing announcement requires identical account termination everywhere. Which test best proves the relevant safeguard operates?
- Review notice-to-control change logs for jurisdictional accuracy
- Audit internal decisions and submission acknowledgments for timely completion
- Test screening lists against effective local and UN update timelines
- Test typographic and transliteration variants of listed names
Explanation
Correct Answer
A:Testing verifies that responses follow current statements and domestic instructions. Success on this scenario would be relevant to the original failure, whereas a bank asks its financial intelligence unit to approve every suspicious-activity decision… tests a different exposure.
Incorrect Answers
B:Against the reported situation in which a compliance officer assumes a FATF public-listing announcement requires identical…, testing distinguishes internal case decisions from the FIU's subsequent analytical role. The sample would be probative if a bank asks its financial intelligence unit to approve every suspicious-activity decision in advance; a different population and test are needed for a compliance officer assumes a FATF public-listing announcement requires identical account….
C:The relevant alternative mechanism is different from a compliance officer assumes a FATF public-listing announcement requires identical…: Assurance checks whether legally operative changes reach payment controls promptly. The test exercises an adjacent pathway, a payments team assumes every UN Security Council sanctions resolution becomes locally enforceable…, without directly challenging a compliance officer assumes a FATF public-listing announcement requires identical account….
D:Compared with the stated facts about a compliance officer assumes a FATF public-listing announcement requires identical…, scenario testing should determine whether reasonable spelling differences are still surfaced. Even a favorable result for a sanctions analyst releases a possible listed-person match because the customer name has different… would not demonstrate the control works when a compliance officer assumes a FATF public-listing announcement requires identical account….
Question 610
An institution has corrected a process after discovering this case: A virtual-asset provider screens wallet transfers against sanctions lists but never links addresses to identified service operators. Which test best proves the relevant safeguard operates?
- Seed newly designated controllers and test customer-level escalation
- Test newly linked sanctioned wallet clusters against detection rules
- Run precision-recall tests and timed case-resolution exercises
- Audit risk-score changes against genuine event and entity matches
Explanation
Correct Answer
B:The review evaluates updates and indirect wallet relationships rather than static addresses only. The proposed sample exercises the failure seen in a virtual-asset provider screens wallet transfers against sanctions lists but never links addresses to…, rather than the separate pathway represented by a daily sanctions batch screens active customers but excludes recently changed beneficial….
Incorrect Answers
A:The test catches indirect exposure missed by name-only rescreening; the observed record here instead involves a virtual-asset provider screens wallet transfers against sanctions lists but never…. Testing this would validate controls for a daily sanctions batch screens active customers but excludes recently changed beneficial owners, not the effectiveness of remediation for a virtual-asset provider screens wallet transfers against sanctions lists but never links addresses….
C:The relevant alternative mechanism is different from a virtual-asset provider screens wallet transfers against sanctions lists but never…: Assurance shows whether tuning improves quality and case timeliness simultaneously. The test exercises an adjacent pathway, a fuzzy sanctions matcher produces overwhelming false hits and analysts cannot clear them within…, without directly challenging a virtual-asset provider screens wallet transfers against sanctions lists but never links addresses….
D:Compared with the stated facts about a virtual-asset provider screens wallet transfers against sanctions lists but never…, assurance checks automated escalation precision and traceability. Even a favorable result for an automated KYC tool increases a customer's risk score on every adverse-media mention without… would not demonstrate the control works when a virtual-asset provider screens wallet transfers against sanctions lists but never links addresses….