Free CKYCA Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The prospective client is the parent of a government minister, which classifies them as a family member of a Politically Exposed Person (PEP). According to global anti-money laundering (AML) and counter-terrorist financing (CTF) standards, relationships with PEPs and their close associates present a higher risk of potential involvement in bribery and corruption. Consequently, financial institutions are required to conduct Enhanced Due Diligence (EDD). A mandatory component of the EDD process for any PEP-related account is to obtain approval from the institution's senior management before establishing the business relationship. This ensures the decision to accept the heightened risk is made at an appropriate level of authority.

A. Relationship management: The relationship manager is responsible for managing the client relationship, not for providing the final compliance approval for a high-risk PEP account.

C. Team management: While a team manager may review the case, they do not have the ultimate authority to approve a PEP relationship; this decision must be escalated higher.

D. Project management: This role is entirely unrelated to the Know Your Customer (KYC) client onboarding and compliance approval process.

1. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation - The FATF Recommendations. FATF

Paris

France. Recommendation 12

part (b)

states that financial institutions are required to "obtain senior management approval to establish (or continue

for existing customers) such business relationships."

2. The Wolfsberg Group. (2017). Wolfsberg Guidance on Politically Exposed Persons (PEPs). Section 3.2

"Approval

" page 8

specifies that "The decision to enter into

or maintain

a relationship with a PEP must be taken by senior management."

3. Basel Committee on Banking Supervision (BCBS). (2016). Sound management of risks related to money laundering and financing of terrorism. Bank for International Settlements. Annex 2

Paragraph 26

notes that for PEPs

banks should "obtain approval from senior management to establish or continue such relationships."

When establishing a new relationship involving a legal arrangement such as a trust, the primary and most critical first step in the Know Your Customer (KYC) process is to perform Customer Due Diligence (CDD). For a trust, this fundamentally requires identifying all associated parties to understand the nature and purpose of the account. According to global anti-money laundering standards, this includes identifying the settlor, trustee(s), and the beneficiary or class of beneficiaries. This identification is essential for assessing the risk profile and complying with beneficial ownership transparency requirements before the account can be used for transactions.

A. Documenting the initial transfer is a transactional activity that occurs after the essential CDD of identifying the parties to the trust has been completed.

C. Documenting dividends is part of ongoing monitoring and understanding the source of funds, which follows the initial account setup and identification of the beneficiaries.

D. Monitoring transactions between accounts is an ongoing due diligence measure, not the foundational step required to open the accounts in the first place.

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. FATF

Paris

France.

Recommendation 10 (Customer Due Diligence): States that financial institutions must identify the customer and verify their identity.

Interpretive Note to Recommendation 10

Paragraph 5(b)(ii): Explicitly requires that for customers that are legal arrangements (like trusts)

financial institutions must identify the settlor

the trustee(s)

the protector (if any)

the beneficiaries or class of beneficiaries

and any other natural person exercising ultimate effective control over the trust. This is a required measure for establishing the account.

2. Financial Action Task Force (FATF). (2014). Guidance on Transparency and Beneficial Ownership. FATF

Paris

France.

Section III

Paragraph 37: Reinforces the requirement for financial institutions to identify the beneficial owners of a customer

specifying that for a trust

this includes the beneficiaries. This identification is presented as a cornerstone of the CDD process.

Inherent risk is the level of risk present before any controls are applied. The introduction of a high-risk product like prepaid cards establishes a high inherent risk. The measures proposed by the compliance team—imposing monetary limits and restricting the offering to existing customers—are risk mitigation controls. The purpose of such controls is to reduce the initial, inherent risk to a more acceptable level. The risk that remains after these controls are implemented is known as residual risk. Therefore, the direct impact of applying these effective controls is a decrease in residual risk.

A. Inherent risk will increase: Inherent risk is the baseline risk of the product itself, which is not increased by the application of controls; controls are meant to mitigate it.

C. Inherent risk will decrease: Controls do not change the inherent risk of a product. They are applied to the inherent risk to manage it, not to change its fundamental nature.

D. Residual risk will increase: This is the opposite of the intended effect. Effective controls are implemented specifically to reduce risk, causing the residual risk to decrease.

1. Financial Action Task Force (FATF). (2014). Guidance for a Risk-Based Approach for the Banking Sector. FATF

Paris

France.

Section 3

Paragraph 3.4

Page 16: "The RBA involves banks assessing the ML/TF risks they face and putting in place mitigation measures that correspond to those risks... The outcome of the risk assessment should be an understanding of the bank’s residual risk

i.e. the risk remaining after the application of risk mitigation measures." This source confirms that mitigation measures (controls) are applied to initial risks to determine the remaining (residual) risk.

2. Basel Committee on Banking Supervision. (2014). Sound Management of risks related to money laundering and financing of terrorism. Bank for International Settlements.

Annex 2

Paragraph 10

Page 21: "The first step in the ML/FT risk assessment is to identify the inherent risks... The second step is to assess the mitigating controls... The final step is to assess the residual risk

which is the risk that remains after the controls are taken into account." This document clearly outlines the process where controls are applied to inherent risk

resulting in residual risk. The application of controls is the step that reduces the risk from its inherent to its residual state.

A suspected transaction involving a sanctioned individual represents a significant and immediate compliance risk. The analyst's primary duty is to adhere to the financial institution's established internal policies and escalation procedures. Reporting the issue immediately ensures that it is handled by the appropriate personnel, such as the compliance officer or a dedicated sanctions team, for proper investigation, potential asset freezing, and reporting to relevant authorities. This action mitigates the risk of sanctions violations, which can result in severe legal and financial penalties for the institution. Any deviation from this protocol, such as delaying the report or contacting the customer, would be a serious breach of compliance obligations.

A. Continuing with standard due diligence fails to address the critical, high-priority risk that a potential sanctions match presents, which requires an immediate and separate escalation path.

B. A potential sanctions match is a high-priority, not a low-priority, issue due to the severe legal and regulatory consequences of non-compliance.

C. Contacting the customer about a sanctions concern could alert them to an investigation, an act known as "tipping off," which is illegal in many jurisdictions.

1. FATF (2012-2023)

International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation - The FATF Recommendations

FATF

Paris

France. The Interpretive Note to Recommendation 6 ("Targeted financial sanctions related to terrorism and terrorist financing") mandates that financial institutions must report actions taken

such as freezing assets

to competent authorities "without delay." This establishes the principle of immediate action and reporting.

2. The Wolfsberg Group

Guidance on Sanctions Screening

(2019). Section 3.1

"Alert Handling

" outlines that financial institutions should have a "defined process" for investigating potential sanctions matches

which includes escalation of alerts to a "designated point of contact (e.g. the Compliance department)" for review and decision-making. This supports the answer of following defined procedures immediately.

3. U.S. Department of the Treasury

Office of Foreign Assets Control (OFAC)

A Framework for OFAC Compliance Commitments

(May 2

2019). In its discussion of the "Internal Controls" element of a compliance program

the framework emphasizes the need for procedures to "identify

interdict

escalate

[and] report" potential sanctions issues. This underscores the regulatory expectation that an analyst will follow a defined escalation and reporting procedure.

A fundamental principle of an effective Know Your Customer (KYC) program is the application of a risk-based approach (RBA). For ongoing Customer Due Diligence (CDD), this means the frequency and intensity of customer profile reviews must be proportionate to the level of risk they present. High-risk customers require more frequent and enhanced reviews (e.g., annually or more often), while low-risk customers can be reviewed less frequently (e.g., every three to five years). This approach allows financial institutions to allocate their compliance resources efficiently, focusing on areas with the greatest potential for money laundering or terrorist financing risk.

B. A fixed yearly review for all customers is inefficient and contradicts the risk-based approach, which mandates differentiated review cycles based on risk ratings.

C. A customer's risk profile and circumstances can change over time. Therefore, ongoing monitoring and periodic reviews are mandatory regulatory requirements, even after a thorough initial onboarding.

D. Reviewing the full customer profile before every single transaction is operationally infeasible and not a regulatory expectation for ongoing due diligence or monitoring.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide. Chapter 3

"Elements of a KYC Program

" Section: "Ongoing Monitoring and Updating Customer Information." This section explicitly details that the frequency of periodic reviews should be determined by the customer's risk rating

with high-risk customers reviewed more frequently than medium- or low-risk customers.

2. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Paris: FATF/OECD. Interpretive Note to Recommendation 10 (Customer Due Diligence)

Paragraph 22. The note specifies that financial institutions must keep CDD information current by "undertaking reviews of existing records

particularly for higher-risk categories of customers

" directly supporting a risk-based frequency.

The KYC analyst has identified a significant red flag for potential trade-based money laundering (TBML): the use of letters of credit for transactions that are inconsistent with the customer's normal business profile. The analyst's primary responsibility at this stage is not to make a final determination of guilt or to take executive action, but to escalate the findings through the proper internal channels. The standard and correct procedure is to refer the matter to the designated internal authority, such as the Money Laundering Reporting Officer (MLRO) or the compliance investigations team. This referral initiates a formal review to determine if a suspicious transaction report (STR) should be filed with the relevant Financial Intelligence Unit (FIU).

A. Notifying the Board of Directors is an inappropriate escalation. The Board oversees governance, while the decision to file an STR is an operational function managed by the MLRO/compliance department.

C. A financial institution's role is to report suspicion of a crime, not to "establish" its existence. That determination is the responsibility of law enforcement and the judiciary.

D. Preparing to close the account is premature. An internal investigation must first be conducted. A decision on account closure would follow that investigation and risk assessment.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

First Edition. Chapter 4

"Responding to Red Flags

" Section: "Escalating Suspicious Activity." This section outlines the standard operating procedure for a KYC analyst upon identifying red flags. It specifies that the analyst's role is to escalate the matter internally to the compliance officer or MLRO for further investigation and a decision on filing a STR.

2. Financial Action Task Force (FATF). (2021). Trade-Based Money Laundering: Risk Indicators. This guidance details red flags associated with TBML. Inconsistencies between the customer's declared business and the actual trade activities

especially involving trade finance instruments like letters of credit

are highlighted as key indicators requiring further scrutiny and reporting (p. 12-14).

3. Wolfsberg Group. (2017). The Wolfsberg Group Trade Finance Principles. Section 4

"Control Framework – Policies and Procedures

" emphasizes the need for clear escalation policies for any activity identified as unusual or potentially suspicious. The principles mandate that such findings be reported to the appropriate internal functions (e.g.

compliance) for review.

According to global anti-money laundering (AML) and counter-terrorist financing (CFT) standards, the identification of a Politically Exposed Person (PEP) represents a significant increase in risk. Standard procedure requires that establishing or continuing a business relationship with a PEP must receive approval from senior management. The KYC analyst's responsibility is to perform the due diligence, identify the risk, and escalate the finding. The management team holds the ultimate authority and accountability for assessing the specific risks and making the final decision to approve the continuation of the relationship (accept the risk) or deny it (exit the relationship).

A. onboarding team for the assessment of risk: The onboarding team is primarily responsible for initial client due diligence, not for high-level risk acceptance decisions discovered during a periodic review of an existing client.

C. head of the KYC team for approval or denial of risk: While the head of the KYC team is part of the escalation chain, the final approval authority for high-risk relationships like PEPs typically rests with senior management, not a department head.

D. privacy officer for the assessment of risk: The privacy officer's function is to oversee data protection and privacy compliance, not to assess or approve money laundering or corruption risks associated with clients.

---

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. FATF

Paris

France.

Reference: Recommendation 12

Politically Exposed Persons

page 15.

Quote/Paraphrase: The document states that financial institutions are required to "obtain senior management approval for establishing (or continuing

for existing customers) such business relationships." This directly supports that the decision-making authority for a newly identified PEP rests with senior management.

2. The Wolfsberg Group. (2017). Frequently Asked Questions (FAQs) on Politically Exposed Persons (PEPs).

Reference: FAQ 13

"What is meant by ‘senior management approval’?"

page 10.

Quote/Paraphrase: The guidance clarifies that senior management approval should be sought from a level of authority within the financial institution that can take a holistic view of the relationship. It specifies this is "a level above the usual business relationship approver" and is responsible for accepting the risks associated with the PEP relationship. This confirms the escalation to a "management team" rather than a department head or onboarding team.

3. Basel Committee on Banking Supervision. (2014). Sound management of risks related to money laundering and financing of terrorism.

Reference: Annex 2: Customer due diligence

Paragraph 27

page 23.

Quote/Paraphrase: The document specifies that for PEPs

banks "must obtain approval from senior management to commence or continue a business relationship." This reinforces the principle that ongoing relationships with clients who become PEPs require senior management sign-off.

The client's spouse being elected as a member of government makes the spouse a Politically Exposed Person (PEP). According to global anti-money laundering standards, immediate family members of PEPs are also considered PEPs due to their relationship and potential influence. The fundamental and required first action for the compliance member is to update the client's profile to reflect this new risk status. This re-classification is crucial as it triggers the mandatory application of Enhanced Due Diligence (EDD), senior management approval for the relationship, and ongoing monitoring appropriate for a PEP relationship.

A. Informing the relationship manager is a necessary internal communication step, but it is secondary to the primary compliance action of officially updating the client's risk profile in the system.

B. Simply making a note and continuing as usual is non-compliant. The identification of a PEP relationship mandates a shift from standard Customer Due Diligence (CDD) to Enhanced Due Diligence (EDD).

C. The client's new PEP status is a change in their risk profile, not an inherently suspicious transaction or activity. Filing a suspicious transaction report (STR) is inappropriate for this situation.

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation - The FATF Recommendations. FATF

Paris

France.

Recommendation 12 (Politically Exposed Persons): "Financial institutions should be required to take reasonable measures to determine whether a customer or a beneficial owner is a domestic PEP or a person who is or has been entrusted with a prominent function by an international organisation. In cases of a higher-risk business relationship with such persons

financial institutions should be required to apply the measures referred to in paragraphs (a)

(b) and (c)."

Interpretive Note to Recommendation 12: Defines "family members" to include spouses. This establishes that the client must be treated as a PEP

necessitating a change in their status and due diligence level. The first step is to record this status.

2. ACAMS. (2023). Certified Know Your Customer Associate (CKYCA) Study Guide. ACAMS.

Chapter 3: Elements of a KYC Program: This chapter details the requirement for ongoing monitoring and updating customer information. It specifies that when a customer's risk profile changes

such as becoming a PEP or related to one

the institution must update the customer's file and apply the appropriate level of due diligence (in this case

EDD). This directly supports updating the client's information as the primary action.

Sanctions screening is a fundamental control within a financial institution's compliance framework. Its primary function is to systematically check customer data against various official sanctions lists (e.g., OFAC's SDN List, UN Consolidated List, EU Consolidated List). This process is designed to identify individuals, entities, vessels, or locations that are subject to economic or trade restrictions. The goal is to find a "potential match" that requires further investigation to confirm its validity. This preventative measure ensures the institution does not onboard or transact with sanctioned parties, thereby complying with legal obligations and mitigating sanctions risk.

A. PEP screening is a distinct process to identify politically exposed persons for enhanced due diligence, separate from checking against sanctions lists.

B. A potential sanctions match requires investigation. Only a confirmed true match leads to required actions like blocking assets and reporting, not automatically a SAR.

D. While critical, screening cannot detect all possible sanctions risks, such as those hidden by complex ownership structures or indirect associations.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

Chapter 3: Core KYC Components. The guide distinguishes between screening for sanctions

Politically Exposed Persons (PEPs)

and adverse media

clarifying that the specific purpose of sanctions screening is to identify matches against government-issued sanctions lists.

2. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Paris: FATF/OECD. See Recommendation 6 and its Interpretive Note

which mandate countries to implement targeted financial sanctions and require financial institutions to have policies and procedures to identify and freeze assets of designated persons without delay.

3. Zarate

J. C. (2013). Treasury's War: The Unleashing of a New Era of Financial Warfare. PublicAffairs. (Note: While a book

it is authored by a former senior Treasury official and is widely used in academic settings for financial crime courses). Chapter 2 discusses the mechanics and strategic purpose of using sanctions lists (specifically the OFAC SDN list) to identify and isolate illicit actors from the financial system.

Financial statements, such as the income statement, balance sheet, and cash flow statement, provide the most comprehensive and verifiable record of a business customer's financial activities. During an Enhanced Due Diligence (EDD) process, these documents are essential for understanding a company's revenue streams, profitability, and overall financial health. They allow an analyst to corroborate the stated nature of the business with its actual financial performance, thereby providing a clear and reliable picture of its legitimate source of funds. This is a critical step in assessing and mitigating the risks associated with high-risk corporate customers.

B. Company's website: This is a marketing tool that describes the business but is not a verifiable financial record and cannot be relied upon for EDD.

C. Utility bill: This document is used to verify a customer's physical address, not their financial activities or source of funds.

D. Articles of incorporation: This legal document establishes the company's existence and structure but contains no financial data regarding its source of funds.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

(2022). Chapter 3: "Elements of a KYC Program

" Section on Enhanced Due Diligence (EDD). The guide specifies that for high-risk corporate customers

EDD measures include obtaining and analyzing financial statements to understand the customer's business operations and verify their source of funds and wealth.

2. Financial Action Task Force (FATF). (2023). The FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. Recommendation 10

Interpretive Note

paragraph 19. The note states that for higher-risk customers

financial institutions should perform enhanced CDD measures

which includes taking reasonable measures to establish the source of funds. For a legal person (a business)

audited financial statements are a primary document for this purpose.

3. The Wolfsberg Group. (2020). Statement on Effectiveness. Section: "Outcomes of an Effective AML/CTF Programme

" page 4. The document emphasizes the importance of understanding the customer

including their business and sources of wealth/funds. For corporate entities

this understanding is fundamentally derived from official financial documentation.

Under the EU’s Anti-Money Laundering Directives (AMLD), financial institutions are legally obligated to keep customer due diligence (CDD) records, including information on business activities, for a specific period. The 4th and 5th AMLD mandate that records must be retained for five years after the business relationship has ended. The frequent changes in business activity represent a significant risk indicator, making the retention of this historical data crucial for ongoing monitoring and potential future investigations. The bank's internal policies must be aligned with these legal requirements. Therefore, retaining the information as specified by both internal policy and EU directives is the correct procedure.

A. Holding records for only one year is insufficient and would violate the minimum five-year post-relationship retention period required by the EU AMLD.

C. Data privacy regulations like GDPR allow for data retention to comply with legal obligations, such as AML laws. Destroying historical data would impede risk management and investigations.

D. This is incomplete. The legal requirement extends beyond the life of the account, mandating a specific retention period after the customer relationship has ended.

1. Directive (EU) 2015/849 (Fourth Anti-Money Laundering Directive)

European Parliament and the Council

20 May 2015.

Article 40

Paragraph 1: "Member States shall require obliged entities to retain the following documents and information in accordance with national law for the purpose of preventing

detecting and investigating possible money laundering or terrorist financing... (a) a copy of the documents and information which are necessary to comply with the customer due diligence requirements... for a period of five years after the end of the business relationship with their customer or after the date of an occasional transaction."

2. ACAMS CKYCA Study Guide

Association of Certified Anti-Money Laundering Specialists.

Chapter 2: Legal and Regulatory Frameworks: This chapter details the global standards and specific regional regulations

including the EU AML Directives. It emphasizes that financial institutions must establish record-retention policies that comply with the legal minimums set by their jurisdictions

which in the EU is five years after the relationship ends. The guide clarifies that this legal obligation for AML purposes is a valid reason for data retention under data privacy laws like GDPR.

3. "The interaction between the GDPR and the AML/CFT legal framework

" European Banking Authority (EBA)

Opinion of the European Banking Authority on the interplay between the AMLD and the GDPR

2018.

Section 3.2

Paragraph 18: This opinion clarifies that the processing of personal data for AML/CFT purposes is considered "necessary for compliance with a legal obligation to which the controller is subject" under Article 6(1)(c) of the GDPR. This provides the legal basis for retaining customer data as required by the AMLD

even when it is historical.

The fundamental responsibility of a KYC analyst during the due diligence process is to verify customer information and resolve any identified discrepancies. When a conflict arises between client-provided documents and a reliable, independent source like a country's business register, the standard and most appropriate initial action is to seek clarification directly from the client. This step is crucial for understanding the nature of the discrepancy, which could stem from a simple clerical error, a recent change in legal status not yet updated in public records, or a more significant red flag. This direct inquiry is a core component of the investigation and risk assessment process before any further action is taken.

A. Filing a suspicious activity report is a premature and disproportionate response. A discrepancy requires investigation first; a SAR is filed only if that investigation leads to a suspicion of illicit activity.

B. Using only the client's documentation ignores contradictory evidence from a reliable, independent source, which undermines the entire principle of verification in the KYC process.

C. Unilaterally using the business register information without client consultation fails to resolve the discrepancy and understand its cause, potentially leading to an inaccurate client profile.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

(2022). Chapter 2: "Essential KYC Components

" Section: "Customer Due Diligence (CDD)." The guide emphasizes that when discrepancies are found during the verification process

the financial institution must take reasonable measures to resolve them. The primary method for resolution is direct communication with the customer to obtain clarification and/or corrected documentation.

2. Financial Action Task Force (FATF)

(2012-2023). "International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations

" Interpretive Note to Recommendation 10 (Customer Due Diligence)

Paragraph 14. The note details the requirement to verify the identity of the customer and understand its legal structure. It implies that any inconsistencies discovered during this verification must be satisfactorily resolved to meet CDD obligations.

3. Wolfsberg Group

(2020). "Frequently Asked Questions (FAQs) on Correspondent Banking

" Question 23. While focused on correspondent banking

the principle applies universally. The guidance states that financial institutions should have processes to address and resolve discrepancies in information

which typically involves client outreach as a first step before considering relationship termination or reporting.

A financial institution's customer risk-rating model is foundational to its risk-based Anti-Money Laundering (AML) program. A customer's country of origin is a critical data point in this model. Iran is designated as a high-risk jurisdiction by the Financial Action Task Force (FATF) and is subject to significant international sanctions. Conversely, Ireland is a low-risk, FATF-member country. By incorrectly recording the customer as being from Ireland, the risk-rating system will apply the low-risk weighting associated with Ireland instead of the high-risk weighting for Iran. This directly and immediately results in the customer being assigned a significantly lower risk score (fewer risk points) than is appropriate.

B. prohibited from funding a new account.

This is incorrect. The erroneously low-risk rating would likely lead to reduced scrutiny, making it easier, not more difficult, for the customer to fund an account.

C. disallowed from opening new accounts.

This is incorrect. A low-risk classification would facilitate, rather than prevent, account opening, likely subjecting the customer to simplified due diligence measures.

D. not screened against applicable sanctions lists.

This is unlikely to be completely true. Most institutions screen all customers against core sanctions lists (e.g., OFAC SDN) at onboarding, regardless of nationality. While the error might prevent screening against Iran-specific lists, the most direct and certain outcome is the incorrect risk scoring.

1. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. FATF

Paris

France.

Reference: Interpretive Note to Recommendation 10 (Customer Due Diligence)

Paragraph 5(d)(i). This section explicitly lists "the customer’s country of origin" as a key variable for determining the level of customer risk. This confirms that an error in this data field directly impacts the risk assessment.

2. The Wolfsberg Group. (2015). Frequently Asked Questions (FAQs) on Risk Assessments for Money Laundering

Sanctions and Bribery & Corruption.

Reference: Page 6

Section "Country/Geographic Risk." The document states

"A FI’s risk assessment should include an assessment of the risks associated with the countries in which it operates and the countries its customers are from/in." This establishes the country of origin as a fundamental pillar of the risk assessment process

which is quantified through risk points.

3. Basel Committee on Banking Supervision. (2014). Sound Management of risks related to money laundering and financing of terrorism. BCBS Paper No. 275.

Reference: Annex 2

Paragraph 11(a). This guidance lists "country of origin and residence" as primary risk factors for assessing customer risk profiles. An incorrect country input would therefore lead to a flawed risk profile calculation.

The scenario presents multiple high-risk indicators: an offshore jurisdiction, a passive business purpose (holding shares), and a registered address shared by many other entities. This last point is a classic red flag for a shell company, which lacks physical presence and legitimate business operations. The combination of these factors significantly elevates the client's risk profile. According to the risk-based approach, a higher-risk client requires Enhanced Due Diligence (EDD) to adequately understand the customer's nature, beneficial ownership, and source of funds, thereby mitigating potential money laundering and terrorist financing risks.

A. Ask for the clientэs utility bill confirming the registered address.

A utility bill is ineffective for verifying a shared, non-operational address and fails to address the core risk of the entity being a shell company.

C. Follow the regular KYC requirements as per legal form of the client.

Applying standard due diligence is insufficient given the multiple high-risk indicators. A risk-based approach mandates escalating measures for such clients.

D. Follow the KYC requirements for the holding companies.

This is too generic. The specific red flags (offshore, shared address) necessitate more than standard procedures for holding companies; they are specific triggers for EDD.

1. Financial Action Task Force (FATF). (2020). FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. FATF

Paris

France.

Interpretive Note to Recommendation 10 (Customer Due Diligence)

Section C: States that examples of higher-risk situations that require Enhanced Due Diligence (EDD) include customer risk factors such as "the ownership structure of the company appears unusual or excessively complex given the nature of the company’s business." The use of a shared address in an offshore jurisdiction for a holding company fits this description.

2. Financial Action Task Force (FATF). (2018). Concealment of Beneficial Ownership. FATF

Paris

France.

Page 21

Section "Misuse of professional intermediaries": This report identifies the use of professional intermediaries to provide registered addresses

which are used by numerous other companies

as a key indicator of potential misuse of legal persons for illicit purposes

a characteristic often associated with shell companies.

3. The Wolfsberg Group. (2023). Wolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ) V1.4.

Question 10.2: Asks whether the institution's AML policies include a list of high-risk indicators for EDD. The guidance notes often list shell banks/companies and entities from high-risk jurisdictions as requiring EDD

reinforcing the principle that such characteristics trigger enhanced scrutiny.

A client amending their narrative regarding their source of wealth (SoW) because they cannot provide supplementary information is a significant red flag. This action directly undermines the verification process. It suggests the initial explanation was potentially false, and the client is now creating a new story to fit the available (or lack of) evidence. Such inconsistency and lack of transparency are classic indicators of a higher risk of financial crime, as the client may be attempting to obscure the true, possibly illicit, origin of their funds. This situation warrants immediate enhanced due to diligence and possible escalation.

B. It is reasonable that a client may not have retained specific bank statements from 15 years ago, making this a plausible situation, not an immediate concern.

C. Many high-net-worth individuals intentionally maintain a low or non-existent online presence for privacy and security reasons; this is not inherently suspicious.

D. An online career profile is for professional networking, not a financial disclosure document. Omitting personal investments like property is normal and expected.

1. The Wolfsberg Group

"Frequently Asked Questions (FAQs) on Source of Wealth and Source of Funds" (October 2020). This guidance emphasizes the need for a plausible and coherent narrative for a client's SoW. Section 3

"What are some of the practical challenges in establishing and corroborating SoW/SoF?"

implicitly supports that a changing narrative is not coherent and raises suspicion. An amended story directly contradicts the principle of a consistent and believable explanation.

2. Financial Action Task Force (FATF)

"Guidance for a Risk-Based Approach for the Banking Sector" (October 2014). Annex 2

page 31

lists high-risk indicators. While not explicitly stating "amends narrative

" it includes related red flags such as a "Customer is reluctant or refuses to provide information about the beneficial owner(s)

or the source of funds

" which aligns with the behavior of changing a story when pressed for proof.

3. University of Manchester

School of Law

"Counter-Terrorist Financing and the Financial Sector: The Moral Case for Inclusion" (2019). Academic analysis of due diligence often highlights that customer-provided information must be consistent and verifiable. Research in this area (e.g.

on the effectiveness of AML regimes) underscores that inconsistencies in customer statements are a primary trigger for enhanced scrutiny. A client amending their narrative is a prime example of such an inconsistency. (DOI: https://doi.org/10.1093/jhuman/huy019 - While the article's main topic is different

the underlying principles of due diligence and identifying suspicious behavior are relevant).