An effective sanctions compliance program requires that screening be conducted against the most current version of all relevant sanctions lists. Sanctions lists are frequently updated by authorities (e.g., OFAC, UN, EU). Any delay in updating the institution's internal lists and executing the screening process creates a compliance gap, potentially resulting in a violation. Therefore, prompt updates and screening upon list availability are critical operational requirements.

A. Senior management approves the sanctions policy but does not create or issue the sanctions lists; these are provided by governmental and international bodies.

B. A registration or approval regime applies to the institution itself (e.g., an MSB), not to the operational process of sanctions screening.

D. While dispute resolution is part of a compliance program, it is not the primary factor for ensuring the prompt execution of the screening process itself.

1. ACAMS CAMS Risk Management Study Guide (2020), Chapter 3: "Sanctions Screening," emphasizes the critical importance of timely updates to sanctions lists, stating that "the lists used for screening must be current" and that processes must be in place to ensure new lists are implemented promptly.

2. Financial Action Task Force (FATF). (2019). Guidance on Proliferation Financing Risk Assessment and Mitigation. Section 67. This guidance highlights the need for "ongoing monitoring" which includes processes to screen against updated lists of designated persons and entities.

An effective AML/CFT risk assessment program evaluates the combination of risks an institution faces. The fundamental pillars or components that are combined to determine the overall risk profile are the types of customers (Client risk), the geographic locations where it operates or transacts (Country risk), and the services or instruments it offers (Product risk). By analyzing these three core areas together, a financial institution can develop a comprehensive understanding of its inherent money laundering and terrorist financing vulnerabilities and apply commensurate controls.

B. Policy risk is a component of the control environment that mitigates inherent risk, not a primary component of inherent combination risk itself.

C. Institution risk and government risk are too broad; the standard model breaks these down into more specific, measurable components like client, country, and product.

D. Institution risk is not a standard primary category in this combination model; it is the entity being assessed based on the other risk factors.

1. ACAMS. (2023). Certified Anti-Money Laundering Specialist - Risk Management (CAMS-RM) Study Guide. Chapter 2: Risk Assessment. The guide details the methodology for conducting an enterprise-wide AML risk assessment, identifying the core components as customers, geography, and products/services.

2. Financial Action Task Force (FATF). (2013). Guidance for a Risk-Based Approach: The Banking Sector. p. 12, para. 29. This guidance outlines that risk assessments should consider risk factors including customers, countries or geographic areas, and products, services, transactions or delivery channels.

When developing country risk ratings, a financial institution should refer to credible, public sources. The Financial Action Task Force (FATF) is the global standard-setter for AML/CFT. Its 40 Recommendations provide the framework for a country's AML/CFT regime, and its Mutual Evaluation Reports (MERs) provide detailed assessments of a country's compliance and effectiveness. These documents are primary sources for determining the level of AML/CFT risk associated with a specific jurisdiction.

A. FinCEN provides guidance primarily for US institutions and often references FATF, but FATF is the international source.

C. The "United Kingdom Union" is not a recognized entity; guidance would come from UK authorities like the FCA, but FATF is the global standard.

D. The "UN Assessment Council" is not the correct name; the UN Security Council issues sanctions, which is a factor, but FATF provides the comprehensive AML/CFT framework guidance.

1. ACAMS CAMS-RM Study Guide (2023). Chapter 3: The Risk Assessment, Section: "Geographic Risk," pp. 3-15 - 3-17. (Explicitly lists FATF statements, 40 Recommendations, and Mutual Evaluation Reports as key sources for assessing country risk).

2. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. (The entire document serves as the foundational guidance).

3. Financial Action Task Force (FATF). Consolidated assessment ratings. (This section of the FATF website provides direct access to the outcomes of Mutual Evaluation reports, a key tool for this purpose).

Modern terrorist financing typologies often involve the movement of funds directly to an individual operative who will carry out an attack or provide logistical support. This method, which can include self-funding or small transfers from various sources, is difficult to detect as it can resemble normal, low-value financial activity. The funds flow directly to the point of use, bypassing larger, more easily identifiable organizational accounts. This makes the direct funding of an individual operative a critical pattern for financial institutions to identify.

A. While funds can flow through an intermediary person, the direct flow to the final operative is a more specific and challenging typology to detect.

B. This describes a reverse flow of funds away from the terrorist organization, which is not a funding mechanism for an operation.

C. This is a plausible flow, but "to the individual operative" is a more encompassing description of the final funding stage for lone actors or cell members.

1. Financial Action Task Force (FATF). (2015). Emerging Terrorist Financing Risks. This report details the shift towards smaller-scale attacks by individuals and small cells, often self-funded or financed through small, direct transfers, making the funding flow to the individual operative a key risk indicator (See pages 10-12).

2. ACAMS CAMS Risk Management Study Guide (2020), Chapter 2: "AML/CFT Risk Factors," describes terrorist financing typologies, including the methods used by lone actors and small cells where funds are moved directly to the individuals involved to procure materials for an attack.

A strategic plan defines the institution’s desired future position and the path to reach it after considering operational, regulatory and market implications. It therefore establishes the organisation’s forward-looking direction, against which risk management and resource allocation are aligned.

A. Describes reporting lines, not future direction.

C. A function that supports, rather than sets, strategy.

D. A measurement of remaining risk, not a planning guideline.

1. COSO “Enterprise Risk Management – Integrating with Strategy and Performance” (2017), Ch. 3, pp. 19-20.

2. ACAMS Risk Management Study Guide (2020), Ch. 2, p. 28.