CAMS-FCI Sample Questions Answers

Weaker cybersecurity controls are a main vulnerability that has led to an increase in ransomware attacks on small businesses, as they make them easier targets for cybercriminals who can exploit their systems and demand payment for restoring access to their data. The other options are not relevant to the vulnerability, as they relate to the consequences or responses of the victims.

The red flags that would be an indicator that activity is connected to a corruption/bribery typology are large checks issued to various individuals with the memos noting “gift”, “thank you”, “favor” (A) and negative news found on the customer related to government-issued violations for safety (B). These red flags suggest that the customer is involved in paying or receiving bribes or kickbacks to or from government officials or other parties in exchange for favorable treatment or contracts. These red flags are consistent with some of the indicators of corruption/bribery identified by ACAMS1, such as:

• Payments made to or from third parties that are not directly related to the business
• Payments made to or from high-risk jurisdictions or sectors
• Payments made with vague or incomplete descriptions or justifications
• Negative news or reputation of the customer or its associates

The other options are not as relevant or indicative of corruption/bribery as options A and B. Checks issued to an unrelated entity referencing “rent” and “utilities” in the memos © could be a legitimate business expense or a sign of other types of fraud or money laundering, such as tax evasion or shell company schemes. Multiple daycare locations with no active business operations or related account activity (D) could also be a sign of other types of fraud or money laundering, such as embezzlement or front company schemes. The same beneficial owner owning several daycare centers in different locations (E) could be a normal or legitimate business practice, depending on the size, location, and profitability of the centers.

The best reason the EU bank should file a SAR/STR is that the events raise concerns that the payment represents proceeds from insider trading, which is a form of market abuse and a predicate offense for money laundering in many jurisdictions. The fact that the originator was indicted by U.S. law enforcement, arrested in Switzerland, and extradited for alleged insider trading indicates that there is a strong suspicion that the funds are derived from criminal activity. The other options are not sufficient reasons to file a SAR/STR, as they do not directly relate to the nature or source of the funds.

References: [Financial Action Task Force Report on Money Laundering and Terrorist Financing Risks and Vulnerabilities Associated with Gold], page 17 : [Leading Complex Investigations Certificate], page 12

The best reason for an investigator to continue an investigation is that the end-user is a military force. This is because supplying aviation parts to a military force may involve sanctions risk, export control risk, or human rights risk, depending on the nature and destination of the military force. The investigator should conduct further due diligence to determine if the customer is complying with the relevant laws and regulations, and if the bank is exposed to any reputational or legal risk by providing services to the customer.

References:

• Former Airline Employee and Aircraft Part Sellers Charged in Kickback …
• Former Airline Employee and Aircraft Part Sellers Charged in Kickback …
• Former airline employee and aircraft part sellers charged in kickback …

The step that the investigator should take next is to flag the nephew as a PEP by association (D). This is because the nephew is related to a general who is a senior military official and a customer of Bank A, which is a high-risk jurisdiction with strict capital controls. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should identify and flag any customers who are PEPs or have close associations with PEPs, such as family members or business partners” (p. 24). The FI should also conduct enhanced due diligence on these customers and monitor their transactions for any suspicious or unusual activity.

The other options are not correct. The investigator should not file a SAR/STR in relation to corruption involving the nephew and the general (A), as this could be premature or unnecessary, as there is no evidence of corruption or criminal activity between them. The investigator should not determine whether there is a business relationship between the nephew and the general (B), as this is not relevant or material to the investigation, as the nephew and the general are customers of different banks and are not involved in the same transaction. The investigator should not seek senior management approval to continue the relationship with the nephew ©, as this could be premature or disproportionate, as there is no indication that the nephew poses a high risk or requires termination.

References: 1: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, available at ACAMS

The fact that should not be included in the SAR/STR narrative is the request by law enforcement (D). This is because the request by law enforcement is confidential and should not be disclosed to the customer or anyone else who is not authorized to know it. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should not include any reference to the LE request in the SAR/STR narrative, as this could compromise the LE investigation or alert the customer of the suspicion” (p. 35). The FI should also not inform the customer of the LE request or delay filing the SAR/STR because of it.

The other facts should be included in the SAR/STR narrative, as they are relevant and indicative of human trafficking money laundering. The air travel and hotel expenses (A) show that the customer is involved in moving people across different locations, which could be a sign of human smuggling or trafficking. The time of the cash deposits (B) shows that the customer is receiving cash payments during unusual hours, which could be a sign of illicit activities or services. The sporting event © shows that the customer is exploiting a high-demand situation for their business, which could be a sign of opportunistic or organized crime.

The data points that the compliance team should include in its data analytics program to detect shell or front company red flags are entities whose principal place of business is a non-residential address and entities transacting with or having relation to tax haven or high-risk countries. These data points may indicate that the entities are not conducting legitimate business activities, but rather are used to conceal the identity or location of the true beneficiaries or owners, or to facilitate money laundering, tax evasion, or other illicit activities. Some of the sources that support these data points as red flags are4567:

• Entities whose principal place of business is a non-residential address may indicate that they have no physical presence, operations, assets, or employees. They may use addresses such as post office boxes, mail forwarding services, registered agents, or virtual offices to avoid detection or scrutiny.
• Entities transacting with or having relation to tax haven or high-risk countries may indicate that they are involved in offshore financial activities that are designed to evade taxes, regulations, or sanctions. They may also be exposed to higher risks of money laundering, terrorist financing, corruption, or fraud.

References:

• How to Identify a Shell Company and the Associated Red Flags
• Difference between Shell, Shelf & Front Company | Sigma Ratings
• Shell Companies and Money Laundering | ComplyAdvantage
• General Comments Incorporation of shell companies - Singapore Police Force

According to the Certified Anti-Money Laundering Specialist (CAMS) Manual [1], 6th edition, financial entities that violate Anti-Money Laundering (AML) laws can face several reputational risks such as loss of high-profile customers, seizure of assets, increased audit costs to monitor behavior, and monetary penalties. For example, the US Treasury's Financial Crimes Enforcement Network (FinCEN) imposes civil money penalties on "persons who willfully violate, attempt to violate, conspire to violate, or cause any violation of any provision of the Bank Secrecy Act or its implementing regulations." (CAMS Manual, 6th edition, page 26).

According to the Certified Anti-Money Laundering Specialist (CAMS) study guide, 6th edition, page 105, the correct answer is C. It can be difficult to determine if there is negative media associated with counterparties solely from the customer's account activity and KYC file.

The study guide explains that negative media can include news articles, government sanctions lists, and other sources of public information that may indicate that a counterparty is involved in illicit activities. However, this information may not be readily available in a customer's account activity or KYC file, and may require additional research or investigation.

The primary purposes of Financial Action Task Force (FATF)-Style Regional Bodies are to promote effective implementation of FATF recommendations and to provide expertise and input in FATF policy-making. (CAMS Manual, 6th Edition, Page 180)

The correct answer is C because reviewing the structure of the transactions to the three entities can help the investigator to identify any red flags or indicators of fraud, such as unusual amounts, frequency, destinations, or beneficiaries. The other options are not as relevant or effective in this scenario. Option A is not necessary because the investigator already knows the source of funds for the customer. Option B is not advisable because contacting the customer directly may alert them to the investigation and compromise its integrity. Option D is not helpful because inspecting electronic banking login records does not provide any information about the nature or purpose of the transactions.

References:

• Advanced CAMS-FCI Study Guide, page 281
• Financial Crime Typologies - Intermediate Certificate Course, Module 32

When writing or reviewing a SAR/STR, it is important to ensure that the narrative is kept to the point; easy to read; and addresses the who, what, when, where, why, and how. This is because the narrative is the most crucial part of the SAR/STR, as it provides a clear and concise summary of the suspicious activity or transaction that triggered the report. The narrative should include all the relevant information that would help law enforcement or regulators to understand the nature and context of the activity or transaction, such as123:

• The who: The names, addresses, account numbers, and other identifying information of the parties involved in the activity or transaction, such as customers, beneficiaries, intermediaries, or third parties.
• The what: The type, amount, frequency, and purpose of the activity or transaction, such as cash deposits, wire transfers, check payments, or purchases of goods or services.
• The when: The date, time, and duration of the activity or transaction, and whether it was a one-time occurrence or part of a pattern or trend.
• The where: The location or channel of the activity or transaction, such as branches, ATMs, online platforms, or mobile applications.
• The why: The reason or rationale for the activity or transaction, and why it was considered suspicious or unusual based on the customer’s profile, behavior, or expected activity.
• The how: The method or mechanism of the activity or transaction, such as cash, check, debit card, credit card, cryptocurrency, or prepaid card.

References:

• How to write the perfect “Suspicious Activity Reports” (SAR)? | i-AML
• Writing for Prosecution: Best Practices For Composing SAR Narratives That Assist Prosecutors | ACAMS
• SAR Writing Examples and Proper Formatting: Write for Your Reader - Alessa

If the investigator uncovers evidence that foreign nationals are involved in this activity, they should also note the possible presence of human smuggling (D). This is because human smuggling is the illegal movement of people across borders, often facilitated by criminal networks that exploit vulnerable migrants. According to the FATF and Egmont Group report on Financial Flows from Human Trafficking2, “human smuggling can be closely linked to human trafficking, as smuggled migrants may become victims of trafficking along their journey or at their destination” (p. 9). The report also states that some indicators of human smuggling are similar to those of human trafficking, such as:

• Frequent cash deposits or withdrawals in different locations
• Use of false or fraudulent identification documents
• Expenses related to travel and accommodation
• Involvement in online platforms that advertise sexual services

The other options are not as relevant or specific as option D. Tax fraud (A) is the evasion of taxes by individuals or businesses, which may or may not be related to human trafficking or smuggling. Black market peso exchange (B) is a money laundering scheme that involves exchanging illicit proceeds in one currency for another currency at a discounted rate, which is more commonly associated with drug trafficking or trade-based laundering. Trade-based laundering © is the manipulation of trade transactions to disguise the origin and ownership of illicit funds, which is also more likely to be linked to drug trafficking or other types of fraud.

References: 1: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, available at ACAMS 2: FATF and Egmont Group, Financial Flows from Human Trafficking, July 2018, available at FATF

The OFAC sanctions screening audit program should include the requirement that all clients with foreign identification are subject to enhanced due diligence, as this provides an extra layer of protection against potential violations of OFAC sanctions.

The correct answer is A because the expected account activities were 1 to 5 transactions per year and around 1 million per transaction amount, but the actual activity showed much more frequent and varied transactions in different currencies and amounts. This indicates a deviation from the customer’s profile and risk level.

References: Advanced CAMS-FCI Study Guide, page 16

The FI is required to ensure that the request includes an end date © when it receives a keep open letter from LE for the identified account. This is because the FI has to balance its legal obligations to cooperate with LE and to protect its customers’ privacy and rights. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should request a written confirmation from LE that includes a specific end date for the request, as well as a point of contact for any questions or concerns” (p. 35). The FI should also document the request and its compliance with it, and continue to monitor the account for any suspicious activity.

The other options are not correct. The FI should not contact the client for information relating to the account (A), as this could compromise the LE investigation or alert the client of the suspicion. The FI should not stop filing SAR/STR reports on the account and/or customer (B), as this could violate its regulatory obligations and expose it to legal risks. The FI should not notify LE immediately after new transactions (D), as this could also interfere with the LE investigation or tip off the client. The FI should follow the instructions of LE regarding when and how to share information.

The activity type that the FI should target for creating an automated alert for human trafficking money laundering is multiple deposits between midnight and 4:00 AM (B). This is because this pattern is consistent with the indicators of human trafficking identified by the Financial Action Task Force (FATF) and the Egmont Group1, which include:

• Frequent cash deposits, often in round amounts, outside of normal business hours
• Deposits made at different branches or ATMs in various locations
• Lack of information about the nature and purpose of the business
• Involvement in online platforms that advertise sexual services
• Expenses related to travel and accommodation
• The other options are not as relevant or specific as option B. Payments made to multiple hotels in the same city (A) could be a legitimate business expense or a sign of other types of money laundering, such as tax evasion or fraud. Deposits made within days of major sporting events © could also be explained by other factors, such as increased tourism or gambling. Payments made for virtual currency (D) are not directly related to human trafficking, although they could be used to facilitate money laundering in general.

References: 1: FATF and Egmont Group, Financial Flows from Human Trafficking, July 2018, available at FATF

The parties that should be trained on emerging trends and red flags are the financial crimes investigation unit (A) and the branch personnel ©. These parties are directly involved in detecting, investigating, and reporting suspicious activity related to check cashing or other types of fraud or money laundering. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should provide regular and relevant training to its staff on the AML program, policies, procedures, and systems, as well as on the latest typologies, indicators, and best practices for financial crimes investigations” (p. 36). The FI should also “ensure that the training is tailored to the specific roles and responsibilities of the staff, and that it is updated and evaluated periodically” (p. 36).

The other parties are not as relevant or appropriate as options A and C. The loan department (B) is not directly related to check cashing or other types of fraud or money laundering, although it may have some exposure to credit or identity fraud. The senior management (D) is responsible for overseeing and supporting the AML program, but not for conducting or supervising financial crimes investigations. The board of directors (E) is responsible for approving and reviewing the AML program, but not for implementing or monitoring it.

References: 1: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, available at ACAMS

The SAR/STR should include any information that is relevant to the suspicious activity, such as the customer information, the transaction details, and any other indicators of potential money laundering or criminal activity. The fact that one of the transactors occasionally smelled of marijuana smoke is an indicator that the customer may be involved in the illicit drug trade, which is a predicate offense for money laundering. Therefore, this information should be included in the SAR/STR. References: Advanced CAMS-FCI Study Guide, page 25.

The initial focus of the investigation should be to review the customer due diligence documents of each entity and examine the year of incorporation and onboarding channel, as this would help identify the beneficial owners, the source of funds, and the purpose of the business relationship. This would also help determine if the entities are shell companies or have any red flags that indicate potential misuse of legal persons. Using data analytics to extract and analyze the linkages between the different entities would be a subsequent step, not the initial one. Conducting a network link analysis on all customers of the bank would be too broad and time-consuming. Finding out whether customer A has relationships with other financial institutions would be relevant, but not the initial focus. References: [Advanced CAMS-FCI Study Guide], page 44-45; [FATF Guidance on Transparency and Beneficial Ownership], page 12-13.

One of the actions that is part of the enhanced due diligence process is collecting beneficial ownership details regarding the client’s account. This is important to identify the natural persons who ultimately own or control the client, and to assess the potential risks associated with them. According to the Financial Action Task Force (FATF), beneficial ownership information should include1:

• The name, nationality, and country of residence of each beneficial owner.
• The date of birth or incorporation of each beneficial owner.
• The nature and extent of the beneficial interest held by each beneficial owner.
• The means by which the beneficial ownership or control is exercised.

References:

FATF Guidance on Transparency and Beneficial Ownership

A SAR/STR does not require definitive proof or enough circumstantial evidence of suspicious activity, as these are high evidentiary thresholds that may be difficult or impossible to obtain by the FI. A SAR/STR should include a factual description of the suspicious activity, as this is essential for the FIU to analyze and disseminate the information. A low evidentiary threshold means that the FI has reasonable grounds to suspect that the activity is related to money laundering, terrorism financing, or other financial crimes, based on the available relevant factors. This is the main criterion for filing a SAR/STR.

References: Advanced CAMS-FCI Certification | ACAMS, Suspicious activity report - Wikipedia, Suspicious Transaction Report (STR) / Suspicious Activity Report (SAR …

The correct answer is A because a SAR/STR narrative should be concise, clear, and complete, addressing the who, what, when, where, why, and how of the suspicious activity. Option B is incorrect because providing too much information can make the narrative confusing and irrelevant. Option C is incorrect because the introduction should provide a summary of the suspicious activity, not the conclusion. Option D is incorrect because suspect names should be mentioned in the narrative to identify the parties involved in the suspicious activity.

References: Advanced CAMS-FCI Certification Handbook, page 17; Leading Complex Investigations Certificate, Module 3.

The next best course of action for the investigator is to file a SAR/STR on the account activity in relation to a potential funnel account. This is because a funnel account is a type of money laundering scheme that involves depositing funds from multiple sources into a single account, and then transferring them to another account, often in a different jurisdiction. A funnel account can be used to conceal the origin, ownership, and destination of illicit funds, and to evade currency transaction reporting requirements. The investigator should report the suspicious activity to the relevant authorities and document the findings and actions taken. The other options are incorrect because:

A. Completing the monthly review and noting the activity for next month’s review is not sufficient, as it delays the reporting of a possible money laundering scheme and exposes the financial institution to regulatory and reputational risks.

C. Recommending the account for exit due to frequent global transactions is not appropriate, as it does not address the underlying issue of potential money laundering and may alert the customer of the investigation.

D. No further action is required as the customer is already rated at high-risk and the monthly spending is within expectations is not acceptable, as it ignores the red flags of a funnel account and fails to comply with the anti-money laundering obligations of the financial institution.

References:

Advanced CAMS-FCI Certification | ACAMS, Section 2: Investigating Financial Crimes, page 9

Leading Complex Investigations Certificate | ACAMS, Module 2: Identifying Red Flags, page 5

A product of analysis is a conclusion or inference that is derived from facts or judgments, using analytical techniques or tools. Option B is a product of analysis because it implies that the investigator has used a tool or technique, such as a threshold analysis, to identify a pattern of structured cash deposits that may indicate an attempt to evade reporting requirements. The other options are facts or judgments that can be verified by evidence or observation.

References: Advanced CAMS-FCI Certification Handbook, page 23.

A more robust supervisory approach is needed by regulators when overseeing small- and medium-sized MSBs compared to larger MSBs for combatting TF because small- and medium-sized MSBs are more at risk of allowing transactions linked to TF due to the lack of skilled compliance resources. Small- and medium-sized MSBs may face challenges in implementing effective AML/CFT controls, such as conducting risk assessments, applying customer due diligence measures, monitoring transactions, detecting suspicious activities, and reporting to the authorities. They may also have limited access to training, guidance, and tools to enhance their compliance capabilities. Therefore, regulators need to provide more supervision and support to small- and medium-sized MSBs to ensure that they comply with the AML/CFT requirements and mitigate the TF risks.

References:

• Sustainable Growth for Small and Medium-Sized Enterprises … - MDPI
• Lessons on Resilience for Small and Midsize Businesses - HBR