Question 670
Quality assurance is reviewing a remediation plan for this situation: An FIU receives information suggesting an overseas account is connected to local predicate crime. Which sample or test is most useful?
- Sample high-impact screening configurations against primary sources
- Audit the national-assessment mapping to material business activities
- Back-test new scenarios against the report's key indicators
- Audit request and dissemination logs for authorized channels
Explanation
Correct Answer
D:Testing checks that cross-border intelligence was appropriately routed and safeguarded. For the supported action of audit request and dissemination logs for authorized channels in this effectiveness test review involving an FIU receives information suggesting an overseas account is connected to local predicate…, the assessment probes the affected transactions and decisions, not just an adjacent risk such as a trade team assumes a private sanctions-screening vendor's advisory is binding legal….
Incorrect Answers
A:When testing the contrasting pattern of an FIU receives information suggesting an overseas account is connected to local…, remember that assurance verifies that operative restrictions come from authorized legal interpretation. Even a favorable result for a trade team assumes a private sanctions-screening vendor's advisory is binding legal interpretation would not demonstrate the control works when an FIU receives information suggesting an overseas account is connected to local predicate crime.
B:The test confirms that threats were considered, even where some were discounted with evidence; the observed record here instead involves an FIU receives information suggesting an overseas account is connected to local…. This assurance method targets a bank ignores a national proliferation-financing threat assessment because it has little retail… rather than the reported process: an FIU receives information suggesting an overseas account is connected to local predicate crime.
C:Against the reported situation in which an FIU receives information suggesting an overseas account is connected to local…, validation checks that the warning is operationalized in trade surveillance. Testing this would validate controls for a regional FIU report identifies a new invoice-manipulation scheme involving the bank's trade…, not the effectiveness of remediation for an FIU receives information suggesting an overseas account is connected to local predicate crime.
Question 671
A firm wants measurable assurance for this identified exposure: A payments engine screens only the recipient name while ignoring originator and intermediary information in incoming messages. Which evaluation should be conducted?
- Test alerts for accurate dates and captured case dispositions
- Seed newly designated controllers and test customer-level escalation
- Seed list matches into different message fields and formats
- Run precision-recall tests and timed case-resolution exercises
Explanation
Correct Answer
C:Testing reveals blind spots caused by incomplete parsing. Success on this scenario would be relevant to the original failure, whereas a news-screening tool presents a decade-old allegation as breaking information about a… tests a different exposure.
Incorrect Answers
A:This is not the central mechanism when a payments engine screens only the recipient name while ignoring originator and…; assurance prevents old material from being treated as verified new misconduct. This assurance method targets a news-screening tool presents a decade-old allegation as breaking information about a current… rather than the reported process: a payments engine screens only the recipient name while ignoring originator and intermediary….
B:When testing the contrasting pattern of a payments engine screens only the recipient name while ignoring originator and…, remember that the test catches indirect exposure missed by name-only rescreening. Testing this would validate controls for a daily sanctions batch screens active customers but excludes recently changed beneficial owners, not the effectiveness of remediation for a payments engine screens only the recipient name while ignoring originator and intermediary….
D:Against the reported situation in which a payments engine screens only the recipient name while ignoring originator and…, assurance shows whether tuning improves quality and case timeliness simultaneously. The test exercises an adjacent pathway, a fuzzy sanctions matcher produces overwhelming false hits and analysts cannot clear them within…, without directly challenging a payments engine screens only the recipient name while ignoring originator and intermediary….
Question 672
The AFC team needs to demonstrate sustained remediation for the following weakness: A financial crime team has investigators but no ownership of data quality, training, or sanctions policy updates. Which validation is appropriate?
- Audit critical workflows for named owners and actual completion
- Review board challenge records and follow-up after training
- Audit deletion exceptions against valid holds and applicable schedules
- Sample accelerated onboarding for documentary and authorization completeness
Explanation
Correct Answer
A:Testing reveals control gaps hidden by broad department titles. For the supported action of audit critical workflows for named owners and actual completion in this effectiveness test review involving a financial crime team has investigators but no ownership of data quality, training, or…, this test provides observable evidence about the affected process; a test focused on a board receives annual compliance training identical to the material used for new… would not establish the same result.
Incorrect Answers
B:Compared with the stated facts about a financial crime team has investigators but no ownership of data quality, training,…, the outcome measure tests whether directors apply the instruction. The test exercises an adjacent pathway, a board receives annual compliance training identical to the material used for new customer-service…, without directly challenging a financial crime team has investigators but no ownership of data quality, training, or sanctions….
C:This is not the central mechanism when a financial crime team has investigators but no ownership of data quality, training,…; the test detects both missing evidence and unjustified retention. Even a favorable result for a privacy team deletes records under an automated schedule without considering mandatory AML… would not demonstrate the control works when a financial crime team has investigators but no ownership of data quality, training, or sanctions….
D:When testing the contrasting pattern of a financial crime team has investigators but no ownership of data quality, training,…, remember that assurance checks that speed targets do not override risk controls. This assurance method targets a relationship manager promises a high-risk client instant onboarding despite missing beneficial… rather than the reported process: a financial crime team has investigators but no ownership of data quality, training, or sanctions….
Question 673
The following risk prompted a control change: A retail customer receives a series of unrelated inbound transfers and sends almost all funds overseas immediately. How should the institution confirm the control detects or prevents it?
- Sample filed reports for coherent subject, flow, and suspicion descriptions
- Check linked-transfer alerts for consistent investigation and disposition
- Reperform closed cases to test whether rationales support conclusions
- Trace case-to-filing dates against documented legal triggers
Explanation
Correct Answer
B:Testing validates that connected inflows and outflows are analyzed together. This test provides observable evidence about the affected process; a test focused on an AML team files a report that lists transaction values but fails to explain the suspected… would not establish the same result.
Incorrect Answers
A:This is not the central mechanism when a retail customer receives a series of unrelated inbound transfers and sends almost…; the test assesses actionable content, not only whether a form was submitted. Even a favorable result for an AML team files a report that lists transaction values but fails to explain the suspected pattern… would not demonstrate the control works when a retail customer receives a series of unrelated inbound transfers and sends almost all funds….
C:Assurance checks reasoning quality instead of simple case completion rates; the observed record here instead involves a retail customer receives a series of unrelated inbound transfers and sends almost…. Testing this would validate controls for an investigator closes a case as not suspicious without recording why multiple cash transfers were…, not the effectiveness of remediation for a retail customer receives a series of unrelated inbound transfers and sends almost all funds….
D:Against the reported situation in which a retail customer receives a series of unrelated inbound transfers and sends almost…, testing identifies delayed reports and weak deadline governance. The sample would be probative if a transaction monitoring alert is escalated after the legal deadline because investigators dispute…; a different population and test are needed for a retail customer receives a series of unrelated inbound transfers and sends almost all funds….
Question 674
A risk committee asks for operating-effectiveness evidence regarding the following: A bank's reporting officer is excluded from material regulatory communication about suspicious transactions. What would provide the strongest proof?
- Test high-severity matters for timely designated-officer notification
- Test low- and high-risk cases for proportionate control application
- Test whether serious findings reached the board and caused remediation
- Audit product-launch approvals against risk reassessment records
- Challenge high-effectiveness ratings against unresolved audit findings
Explanation
Correct Answer
A:The review confirms that oversight is not bypassed by business hierarchy. This test provides observable evidence about the affected process; a test focused on a small nonprofit receives the same level of documentation demands as a complex offshore… would not establish the same result.
Incorrect Answers
B:Against the reported situation in which a bank's reporting officer is excluded from material regulatory communication about…, assurance identifies both excessive friction and insufficient enhanced scrutiny. The test exercises an adjacent pathway, a small nonprofit receives the same level of documentation demands as a complex offshore corporate…, without directly challenging a bank's reporting officer is excluded from material regulatory communication about suspicious….
C:The relevant alternative mechanism is different from a bank's reporting officer is excluded from material regulatory communication about…: Assurance should check implemented decisions rather than the existence of policy documents. Even a favorable result for an AML department has written procedures but no authority to challenge a revenue-generating… would not demonstrate the control works when a bank's reporting officer is excluded from material regulatory communication about suspicious….
D:Compared with the stated facts about a bank's reporting officer is excluded from material regulatory communication about…, assurance checks that expanding activities are evaluated before exposure grows unchecked. This assurance method targets a firm expands into a high-risk remittance corridor but leaves enterprise risk scores unchanged for… rather than the reported process: a bank's reporting officer is excluded from material regulatory communication about suspicious….
E:This is not the central mechanism when a bank's reporting officer is excluded from material regulatory communication about…; the review checks for credible evidence supporting risk reductions. Testing this would validate controls for a bank uses the number of written AML policies as proof that residual risk is low, not the effectiveness of remediation for a bank's reporting officer is excluded from material regulatory communication about suspicious….
Question 675
The following risk prompted a control change: Several esports betting accounts trade bets against each other and cash out through the same device network. How should the institution confirm the control detects or prevents it?
- Test known linked-account scenarios against anti-collusion alerts
- Test alerts for newly introduced high-risk external wallet addresses
- Reconcile token burns with verified fiat redemptions and approved payees
- Test claims for undocumented beneficiary changes and related parties
Explanation
Correct Answer
A:Assurance requires identifying coordinated groups, not just high stake amounts. Success on this scenario would be relevant to the original failure, whereas a trading platform repeatedly sends virtual assets to an unhosted address controlled by an… tests a different exposure.
Incorrect Answers
B:When testing the contrasting pattern of several esports betting accounts trade bets against each other and cash out through…, remember that validation should consider address changes and behavioral risk, not only known exchange labels. The sample would be probative if a trading platform repeatedly sends virtual assets to an unhosted address controlled by an…; a different population and test are needed for several esports betting accounts trade bets against each other and cash out through the same device….
C:Testing links on-chain events with actual fund recipients and settlement evidence; the observed record here instead involves several esports betting accounts trade bets against each other and cash out through…. The test exercises an adjacent pathway, a virtual-asset custodian processes large stablecoin redemptions through offshore issuers with weak…, without directly challenging several esports betting accounts trade bets against each other and cash out through the same device….
D:Against the reported situation in which several esports betting accounts trade bets against each other and cash out through…, reviewing actual disbursement files detects bypasses that approval-rate dashboards conceal. Even a favorable result for a motor-insurance intermediary sends claim payments to accounts not linked to insured persons or… would not demonstrate the control works when several esports betting accounts trade bets against each other and cash out through the same device….
Question 676
A risk committee asks for operating-effectiveness evidence regarding the following: A corporate client uses a trusted introducer but the bank has not verified its actual controlling persons. What would provide the strongest proof?
- Audit dual-use transactions for end-user and routing checks
- Audit vendor changes to screening logic and independent approvals
- Audit introduced relationships for required owner information and verification
- Test ownership events against refresh completion and risk rerating
Explanation
Correct Answer
C:Assurance checks that the bank has not relied blindly on intermediaries. Operating-effectiveness evidence must reach the specific control gap here; a trade client purchases dual-use machinery through several intermediary companies near a… would require a different test.
Incorrect Answers
A:Testing ensures specialist review is not reduced to a payment-name scan; the observed record here instead involves a corporate client uses a trusted introducer but the bank has not verified its actual…. Even a favorable result for a trade client purchases dual-use machinery through several intermediary companies near a conflict… would not demonstrate the control works when a corporate client uses a trusted introducer but the bank has not verified its actual controlling….
B:Against the reported situation in which a corporate client uses a trusted introducer but the bank has not verified its actual…, the test detects unauthorized alteration of financial-crime controls. This assurance method targets a technology supplier with access to screening rules also sells services to a… rather than the reported process: a corporate client uses a trusted introducer but the bank has not verified its actual controlling….
D:Compared with the stated facts about a corporate client uses a trusted introducer but the bank has not verified its actual…, the measure detects stale profiles that could mask altered control. The sample would be probative if a risk team updates KYC at account opening but not after a complex customer changes ownership; a different population and test are needed for a corporate client uses a trusted introducer but the bank has not verified its actual controlling….
Question 677
For this identified exposure, a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report was filed. Choose TWO complementary steps: one targeted safeguard and one test of its operation.
- Use legally approved neutral responses and restrict SAR access
- Sample accelerated onboarding for documentary and authorization completeness
- Sample recorded customer contacts for report-specific disclosures
- Deliver focused board training on controls, risk and accountability
- Measure post-training referral accuracy and case-handling improvement
- Match legal retention periods and holds to the data lifecycle configuration
Explanation
Correct Answers
A:Communications should address service questions without revealing protected reports. It addresses the live exposure in a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report was filed; corrective action is not a substitute for verifying its operation.
C:Assurance tests whether confidentiality rules are followed in practice. It produces control-performance evidence about a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report was filed; a documented plan alone would not prove operation.
Incorrect Answers
B:This is not the central mechanism when a customer asks why a transfer is held; an analyst says it is because a…; assurance checks that speed targets do not override risk controls. The test exercises an adjacent pathway, a relationship manager promises a high-risk client instant onboarding despite missing beneficial…, without directly challenging a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report…. For the alternative option of sample accelerated onboarding for documentary and authorization completeness in this effectiveness test review involving a customer asks why a transfer is held; an analyst says it is because a suspicious-activity…, a two-part remediation plan for a customer asks why a transfer is held; an analyst says it is because a… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
D:Appropriate education enables informed challenge and resourcing decisions; the observed record here instead involves a customer asks why a transfer is held; an analyst says it is because a…. That would be a coherent mitigation for a board receives annual compliance training identical to the material used for new customer-service…, whereas the immediate gap concerns a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report…. For the alternative option of deliver focused board training on controls, risk and accountability in this effectiveness test review involving a customer asks why a transfer is held; an analyst says it is because a suspicious-activity…, a two-part remediation plan for a customer asks why a transfer is held; an analyst says it is because a… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
E:Against the reported situation in which a customer asks why a transfer is held; an analyst says it is because a…, assurance checks applied competence rather than attendance certificates. Testing this would validate controls for tellers attend generic AML training but cannot identify an emerging local romance-scam mule pattern, not the effectiveness of remediation for a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report…. For the alternative option of measure post-training referral accuracy and case-handling improvement in this effectiveness test review involving a customer asks why a transfer is held; an analyst says it is because a suspicious-activity…, a two-part remediation plan for a customer asks why a transfer is held; an analyst says it is because a… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
F:The relevant alternative mechanism is different from a customer asks why a transfer is held; an analyst says it is because a…: The comparison identifies records at risk of premature destruction or unlawful retention. The inquiry is suited to a privacy team deletes records under an automated schedule without considering mandatory AML…; the requested evidence must instead address a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report…. For the alternative option of match legal retention periods and holds to the data lifecycle configuration in this effectiveness test review involving a customer asks why a transfer is held; an analyst says it is because a suspicious-activity…, a two-part remediation plan for a customer asks why a transfer is held; an analyst says it is because a… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
Question 678
A remediation is marked complete for this case: A buyer purchases apartments through a chain of companies and pays above market value with unexplained funds. Which operational test would best challenge that claim?
- Review gatekeeper files for natural-person controllers and exceptions
- Audit beneficial-ownership files against closing documents and payments
- Sample escrow ledgers against underlying client contracts and settlements
- Test fee samples for documented work and payment consistency
Explanation
Correct Answer
B:The review checks whether financial flows match the named purchaser and stated value. This test provides observable evidence about the affected process; a test focused on a legal adviser forms companies for a client while refusing to disclose the person… would not establish the same result.
Incorrect Answers
A:When testing the contrasting pattern of a buyer purchases apartments through a chain of companies and pays above market value…, remember that testing should verify that reliance on professional status has not displaced CDD. Even a favorable result for a legal adviser forms companies for a client while refusing to disclose the person providing… would not demonstrate the control works when a buyer purchases apartments through a chain of companies and pays above market value with….
C:Against the reported situation in which a buyer purchases apartments through a chain of companies and pays above market value…, end-to-end evidence establishes whether the professional account channels unsupported payments. Testing this would validate controls for a notary receives large third-party escrow deposits with no connection to the declared asset…, not the effectiveness of remediation for a buyer purchases apartments through a chain of companies and pays above market value with….
D:The relevant alternative mechanism is different from a buyer purchases apartments through a chain of companies and pays above market value…: Assurance checks whether high-risk professional-service transactions have substantive evidence. The sample would be probative if a professional service provider invoices an offshore entity for vague advisory work followed by…; a different population and test are needed for a buyer purchases apartments through a chain of companies and pays above market value with….
Question 679
Independent assurance must evaluate an issue originally found as follows: A growing bank moves AFC analysts into a sales reporting chain without clear conflict safeguards. What validation would most directly test effectiveness?
- Test material overrides for AFC review and management escalation
- Audit deletion exceptions against valid holds and applicable schedules
- Review board challenge records and follow-up after training
- Measure post-training referral accuracy and case-handling improvement
Explanation
Correct Answer
A:Assurance confirms that reporting lines do not impair compliance decisions. The proposed sample exercises the failure seen in a growing bank moves AFC analysts into a sales reporting chain without clear conflict safeguards, rather than the separate pathway represented by a privacy team deletes records under an automated schedule without considering mandatory….
Incorrect Answers
B:The relevant alternative mechanism is different from a growing bank moves AFC analysts into a sales reporting chain without clear conflict…: The test detects both missing evidence and unjustified retention. This assurance method targets a privacy team deletes records under an automated schedule without considering mandatory AML… rather than the reported process: a growing bank moves AFC analysts into a sales reporting chain without clear conflict safeguards.
C:Compared with the stated facts about a growing bank moves AFC analysts into a sales reporting chain without clear conflict…, the outcome measure tests whether directors apply the instruction. Testing this would validate controls for a board receives annual compliance training identical to the material used for new customer-service…, not the effectiveness of remediation for a growing bank moves AFC analysts into a sales reporting chain without clear conflict safeguards.
D:This is not the central mechanism when a growing bank moves AFC analysts into a sales reporting chain without clear conflict…; assurance checks applied competence rather than attendance certificates. The sample would be probative if tellers attend generic AML training but cannot identify an emerging local romance-scam mule pattern; a different population and test are needed for a growing bank moves AFC analysts into a sales reporting chain without clear conflict safeguards.
Question 680
The following risk prompted a control change: A monitoring engine receives transaction dates as free-form strings and misorders transfers across time zones. How should the institution confirm the control detects or prevents it?
- Test exit cases for case-status checks and retention preservation
- Test sample customers from onboarding through investigations and closure
- Replay known time-ordered payments through the normalized data pipeline
- Challenge the flow with altered documents and independent issuer checks
- Sample enrichment hits for correct person, source quality, and currency
Explanation
Correct Answer
C:Tests should detect sequencing errors before alerts rely on corrupted timestamps. This test provides observable evidence about the affected process; a test focused on an institution introduces an exit-control process that deletes customers before outstanding… would not establish the same result.
Incorrect Answers
A:This is not the central mechanism when a monitoring engine receives transaction dates as free-form strings and misorders…; assurance verifies that closure workflows do not erase unresolved compliance obligations. Testing this would validate controls for an institution introduces an exit-control process that deletes customers before outstanding…, not the effectiveness of remediation for a monitoring engine receives transaction dates as free-form strings and misorders transfers across….
B:When testing the contrasting pattern of a monitoring engine receives transaction dates as free-form strings and misorders…, remember that end-to-end validation exposes missing handoffs between distinct control stages. The sample would be probative if a fintech buys a transaction-monitoring platform without any process for verifying customers at…; a different population and test are needed for a monitoring engine receives transaction dates as free-form strings and misorders transfers across….
D:Against the reported situation in which a monitoring engine receives transaction dates as free-form strings and misorders…, testing confirms whether manipulated documents are rejected or escalated. Even a favorable result for an e-KYC provider verifies an image of an identity document but never validates its issuer or… would not demonstrate the control works when a monitoring engine receives transaction dates as free-form strings and misorders transfers across….
E:The relevant alternative mechanism is different from a monitoring engine receives transaction dates as free-form strings and misorders…: Assurance gauges mistaken identity and stale information separately. This assurance method targets a bank buys adverse-media data but cannot explain which persons its records actually match rather than the reported process: a monitoring engine receives transaction dates as free-form strings and misorders transfers across….