The prospective client is the parent of a government minister, which classifies them as a family member of a Politically Exposed Person (PEP). According to global anti-money laundering (AML) and counter-terrorist financing (CTF) standards, relationships with PEPs and their close associates present a higher risk of potential involvement in bribery and corruption. Consequently, financial institutions are required to conduct Enhanced Due Diligence (EDD). A mandatory component of the EDD process for any PEP-related account is to obtain approval from the institution's senior management before establishing the business relationship. This ensures the decision to accept the heightened risk is made at an appropriate level of authority.

A. Relationship management: The relationship manager is responsible for managing the client relationship, not for providing the final compliance approval for a high-risk PEP account.

C. Team management: While a team manager may review the case, they do not have the ultimate authority to approve a PEP relationship; this decision must be escalated higher.

D. Project management: This role is entirely unrelated to the Know Your Customer (KYC) client onboarding and compliance approval process.

1. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation - The FATF Recommendations. FATF

Paris

France. Recommendation 12

part (b)

states that financial institutions are required to "obtain senior management approval to establish (or continue

for existing customers) such business relationships."

2. The Wolfsberg Group. (2017). Wolfsberg Guidance on Politically Exposed Persons (PEPs). Section 3.2

"Approval

" page 8

specifies that "The decision to enter into

or maintain

a relationship with a PEP must be taken by senior management."

3. Basel Committee on Banking Supervision (BCBS). (2016). Sound management of risks related to money laundering and financing of terrorism. Bank for International Settlements. Annex 2

Paragraph 26

notes that for PEPs

banks should "obtain approval from senior management to establish or continue such relationships."

When establishing a new relationship involving a legal arrangement such as a trust, the primary and most critical first step in the Know Your Customer (KYC) process is to perform Customer Due Diligence (CDD). For a trust, this fundamentally requires identifying all associated parties to understand the nature and purpose of the account. According to global anti-money laundering standards, this includes identifying the settlor, trustee(s), and the beneficiary or class of beneficiaries. This identification is essential for assessing the risk profile and complying with beneficial ownership transparency requirements before the account can be used for transactions.

A. Documenting the initial transfer is a transactional activity that occurs after the essential CDD of identifying the parties to the trust has been completed.

C. Documenting dividends is part of ongoing monitoring and understanding the source of funds, which follows the initial account setup and identification of the beneficiaries.

D. Monitoring transactions between accounts is an ongoing due diligence measure, not the foundational step required to open the accounts in the first place.

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. FATF

Paris

France.

Recommendation 10 (Customer Due Diligence): States that financial institutions must identify the customer and verify their identity.

Interpretive Note to Recommendation 10

Paragraph 5(b)(ii): Explicitly requires that for customers that are legal arrangements (like trusts)

financial institutions must identify the settlor

the trustee(s)

the protector (if any)

the beneficiaries or class of beneficiaries

and any other natural person exercising ultimate effective control over the trust. This is a required measure for establishing the account.

2. Financial Action Task Force (FATF). (2014). Guidance on Transparency and Beneficial Ownership. FATF

Paris

France.

Section III

Paragraph 37: Reinforces the requirement for financial institutions to identify the beneficial owners of a customer

specifying that for a trust

this includes the beneficiaries. This identification is presented as a cornerstone of the CDD process.

Inherent risk is the level of risk present before any controls are applied. The introduction of a high-risk product like prepaid cards establishes a high inherent risk. The measures proposed by the compliance team—imposing monetary limits and restricting the offering to existing customers—are risk mitigation controls. The purpose of such controls is to reduce the initial, inherent risk to a more acceptable level. The risk that remains after these controls are implemented is known as residual risk. Therefore, the direct impact of applying these effective controls is a decrease in residual risk.

A. Inherent risk will increase: Inherent risk is the baseline risk of the product itself, which is not increased by the application of controls; controls are meant to mitigate it.

C. Inherent risk will decrease: Controls do not change the inherent risk of a product. They are applied to the inherent risk to manage it, not to change its fundamental nature.

D. Residual risk will increase: This is the opposite of the intended effect. Effective controls are implemented specifically to reduce risk, causing the residual risk to decrease.

1. Financial Action Task Force (FATF). (2014). Guidance for a Risk-Based Approach for the Banking Sector. FATF

Paris

France.

Section 3

Paragraph 3.4

Page 16: "The RBA involves banks assessing the ML/TF risks they face and putting in place mitigation measures that correspond to those risks... The outcome of the risk assessment should be an understanding of the bank’s residual risk

i.e. the risk remaining after the application of risk mitigation measures." This source confirms that mitigation measures (controls) are applied to initial risks to determine the remaining (residual) risk.

2. Basel Committee on Banking Supervision. (2014). Sound Management of risks related to money laundering and financing of terrorism. Bank for International Settlements.

Annex 2

Paragraph 10

Page 21: "The first step in the ML/FT risk assessment is to identify the inherent risks... The second step is to assess the mitigating controls... The final step is to assess the residual risk

which is the risk that remains after the controls are taken into account." This document clearly outlines the process where controls are applied to inherent risk

resulting in residual risk. The application of controls is the step that reduces the risk from its inherent to its residual state.

A suspected transaction involving a sanctioned individual represents a significant and immediate compliance risk. The analyst's primary duty is to adhere to the financial institution's established internal policies and escalation procedures. Reporting the issue immediately ensures that it is handled by the appropriate personnel, such as the compliance officer or a dedicated sanctions team, for proper investigation, potential asset freezing, and reporting to relevant authorities. This action mitigates the risk of sanctions violations, which can result in severe legal and financial penalties for the institution. Any deviation from this protocol, such as delaying the report or contacting the customer, would be a serious breach of compliance obligations.

A. Continuing with standard due diligence fails to address the critical, high-priority risk that a potential sanctions match presents, which requires an immediate and separate escalation path.

B. A potential sanctions match is a high-priority, not a low-priority, issue due to the severe legal and regulatory consequences of non-compliance.

C. Contacting the customer about a sanctions concern could alert them to an investigation, an act known as "tipping off," which is illegal in many jurisdictions.

1. FATF (2012-2023)

International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation - The FATF Recommendations

FATF

Paris

France. The Interpretive Note to Recommendation 6 ("Targeted financial sanctions related to terrorism and terrorist financing") mandates that financial institutions must report actions taken

such as freezing assets

to competent authorities "without delay." This establishes the principle of immediate action and reporting.

2. The Wolfsberg Group

Guidance on Sanctions Screening

(2019). Section 3.1

"Alert Handling

" outlines that financial institutions should have a "defined process" for investigating potential sanctions matches

which includes escalation of alerts to a "designated point of contact (e.g. the Compliance department)" for review and decision-making. This supports the answer of following defined procedures immediately.

3. U.S. Department of the Treasury

Office of Foreign Assets Control (OFAC)

A Framework for OFAC Compliance Commitments

(May 2

2019). In its discussion of the "Internal Controls" element of a compliance program

the framework emphasizes the need for procedures to "identify

interdict

escalate

[and] report" potential sanctions issues. This underscores the regulatory expectation that an analyst will follow a defined escalation and reporting procedure.

A fundamental principle of an effective Know Your Customer (KYC) program is the application of a risk-based approach (RBA). For ongoing Customer Due Diligence (CDD), this means the frequency and intensity of customer profile reviews must be proportionate to the level of risk they present. High-risk customers require more frequent and enhanced reviews (e.g., annually or more often), while low-risk customers can be reviewed less frequently (e.g., every three to five years). This approach allows financial institutions to allocate their compliance resources efficiently, focusing on areas with the greatest potential for money laundering or terrorist financing risk.

B. A fixed yearly review for all customers is inefficient and contradicts the risk-based approach, which mandates differentiated review cycles based on risk ratings.

C. A customer's risk profile and circumstances can change over time. Therefore, ongoing monitoring and periodic reviews are mandatory regulatory requirements, even after a thorough initial onboarding.

D. Reviewing the full customer profile before every single transaction is operationally infeasible and not a regulatory expectation for ongoing due diligence or monitoring.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide. Chapter 3

"Elements of a KYC Program

" Section: "Ongoing Monitoring and Updating Customer Information." This section explicitly details that the frequency of periodic reviews should be determined by the customer's risk rating

with high-risk customers reviewed more frequently than medium- or low-risk customers.

2. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Paris: FATF/OECD. Interpretive Note to Recommendation 10 (Customer Due Diligence)

Paragraph 22. The note specifies that financial institutions must keep CDD information current by "undertaking reviews of existing records

particularly for higher-risk categories of customers

" directly supporting a risk-based frequency.

The KYC analyst has identified a significant red flag for potential trade-based money laundering (TBML): the use of letters of credit for transactions that are inconsistent with the customer's normal business profile. The analyst's primary responsibility at this stage is not to make a final determination of guilt or to take executive action, but to escalate the findings through the proper internal channels. The standard and correct procedure is to refer the matter to the designated internal authority, such as the Money Laundering Reporting Officer (MLRO) or the compliance investigations team. This referral initiates a formal review to determine if a suspicious transaction report (STR) should be filed with the relevant Financial Intelligence Unit (FIU).

A. Notifying the Board of Directors is an inappropriate escalation. The Board oversees governance, while the decision to file an STR is an operational function managed by the MLRO/compliance department.

C. A financial institution's role is to report suspicion of a crime, not to "establish" its existence. That determination is the responsibility of law enforcement and the judiciary.

D. Preparing to close the account is premature. An internal investigation must first be conducted. A decision on account closure would follow that investigation and risk assessment.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

First Edition. Chapter 4

"Responding to Red Flags

" Section: "Escalating Suspicious Activity." This section outlines the standard operating procedure for a KYC analyst upon identifying red flags. It specifies that the analyst's role is to escalate the matter internally to the compliance officer or MLRO for further investigation and a decision on filing a STR.

2. Financial Action Task Force (FATF). (2021). Trade-Based Money Laundering: Risk Indicators. This guidance details red flags associated with TBML. Inconsistencies between the customer's declared business and the actual trade activities

especially involving trade finance instruments like letters of credit

are highlighted as key indicators requiring further scrutiny and reporting (p. 12-14).

3. Wolfsberg Group. (2017). The Wolfsberg Group Trade Finance Principles. Section 4

"Control Framework – Policies and Procedures

" emphasizes the need for clear escalation policies for any activity identified as unusual or potentially suspicious. The principles mandate that such findings be reported to the appropriate internal functions (e.g.

compliance) for review.

According to global anti-money laundering (AML) and counter-terrorist financing (CFT) standards, the identification of a Politically Exposed Person (PEP) represents a significant increase in risk. Standard procedure requires that establishing or continuing a business relationship with a PEP must receive approval from senior management. The KYC analyst's responsibility is to perform the due diligence, identify the risk, and escalate the finding. The management team holds the ultimate authority and accountability for assessing the specific risks and making the final decision to approve the continuation of the relationship (accept the risk) or deny it (exit the relationship).

A. onboarding team for the assessment of risk: The onboarding team is primarily responsible for initial client due diligence, not for high-level risk acceptance decisions discovered during a periodic review of an existing client.

C. head of the KYC team for approval or denial of risk: While the head of the KYC team is part of the escalation chain, the final approval authority for high-risk relationships like PEPs typically rests with senior management, not a department head.

D. privacy officer for the assessment of risk: The privacy officer's function is to oversee data protection and privacy compliance, not to assess or approve money laundering or corruption risks associated with clients.

---

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. FATF

Paris

France.

Reference: Recommendation 12

Politically Exposed Persons

page 15.

Quote/Paraphrase: The document states that financial institutions are required to "obtain senior management approval for establishing (or continuing

for existing customers) such business relationships." This directly supports that the decision-making authority for a newly identified PEP rests with senior management.

2. The Wolfsberg Group. (2017). Frequently Asked Questions (FAQs) on Politically Exposed Persons (PEPs).

Reference: FAQ 13

"What is meant by ‘senior management approval’?"

page 10.

Quote/Paraphrase: The guidance clarifies that senior management approval should be sought from a level of authority within the financial institution that can take a holistic view of the relationship. It specifies this is "a level above the usual business relationship approver" and is responsible for accepting the risks associated with the PEP relationship. This confirms the escalation to a "management team" rather than a department head or onboarding team.

3. Basel Committee on Banking Supervision. (2014). Sound management of risks related to money laundering and financing of terrorism.

Reference: Annex 2: Customer due diligence

Paragraph 27

page 23.

Quote/Paraphrase: The document specifies that for PEPs

banks "must obtain approval from senior management to commence or continue a business relationship." This reinforces the principle that ongoing relationships with clients who become PEPs require senior management sign-off.

The client's spouse being elected as a member of government makes the spouse a Politically Exposed Person (PEP). According to global anti-money laundering standards, immediate family members of PEPs are also considered PEPs due to their relationship and potential influence. The fundamental and required first action for the compliance member is to update the client's profile to reflect this new risk status. This re-classification is crucial as it triggers the mandatory application of Enhanced Due Diligence (EDD), senior management approval for the relationship, and ongoing monitoring appropriate for a PEP relationship.

A. Informing the relationship manager is a necessary internal communication step, but it is secondary to the primary compliance action of officially updating the client's risk profile in the system.

B. Simply making a note and continuing as usual is non-compliant. The identification of a PEP relationship mandates a shift from standard Customer Due Diligence (CDD) to Enhanced Due Diligence (EDD).

C. The client's new PEP status is a change in their risk profile, not an inherently suspicious transaction or activity. Filing a suspicious transaction report (STR) is inappropriate for this situation.

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation - The FATF Recommendations. FATF

Paris

France.

Recommendation 12 (Politically Exposed Persons): "Financial institutions should be required to take reasonable measures to determine whether a customer or a beneficial owner is a domestic PEP or a person who is or has been entrusted with a prominent function by an international organisation. In cases of a higher-risk business relationship with such persons

financial institutions should be required to apply the measures referred to in paragraphs (a)

(b) and (c)."

Interpretive Note to Recommendation 12: Defines "family members" to include spouses. This establishes that the client must be treated as a PEP

necessitating a change in their status and due diligence level. The first step is to record this status.

2. ACAMS. (2023). Certified Know Your Customer Associate (CKYCA) Study Guide. ACAMS.

Chapter 3: Elements of a KYC Program: This chapter details the requirement for ongoing monitoring and updating customer information. It specifies that when a customer's risk profile changes

such as becoming a PEP or related to one

the institution must update the customer's file and apply the appropriate level of due diligence (in this case

EDD). This directly supports updating the client's information as the primary action.

Sanctions screening is a fundamental control within a financial institution's compliance framework. Its primary function is to systematically check customer data against various official sanctions lists (e.g., OFAC's SDN List, UN Consolidated List, EU Consolidated List). This process is designed to identify individuals, entities, vessels, or locations that are subject to economic or trade restrictions. The goal is to find a "potential match" that requires further investigation to confirm its validity. This preventative measure ensures the institution does not onboard or transact with sanctioned parties, thereby complying with legal obligations and mitigating sanctions risk.

A. PEP screening is a distinct process to identify politically exposed persons for enhanced due diligence, separate from checking against sanctions lists.

B. A potential sanctions match requires investigation. Only a confirmed true match leads to required actions like blocking assets and reporting, not automatically a SAR.

D. While critical, screening cannot detect all possible sanctions risks, such as those hidden by complex ownership structures or indirect associations.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

Chapter 3: Core KYC Components. The guide distinguishes between screening for sanctions

Politically Exposed Persons (PEPs)

and adverse media

clarifying that the specific purpose of sanctions screening is to identify matches against government-issued sanctions lists.

2. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Paris: FATF/OECD. See Recommendation 6 and its Interpretive Note

which mandate countries to implement targeted financial sanctions and require financial institutions to have policies and procedures to identify and freeze assets of designated persons without delay.

3. Zarate

J. C. (2013). Treasury's War: The Unleashing of a New Era of Financial Warfare. PublicAffairs. (Note: While a book

it is authored by a former senior Treasury official and is widely used in academic settings for financial crime courses). Chapter 2 discusses the mechanics and strategic purpose of using sanctions lists (specifically the OFAC SDN list) to identify and isolate illicit actors from the financial system.

Financial statements, such as the income statement, balance sheet, and cash flow statement, provide the most comprehensive and verifiable record of a business customer's financial activities. During an Enhanced Due Diligence (EDD) process, these documents are essential for understanding a company's revenue streams, profitability, and overall financial health. They allow an analyst to corroborate the stated nature of the business with its actual financial performance, thereby providing a clear and reliable picture of its legitimate source of funds. This is a critical step in assessing and mitigating the risks associated with high-risk corporate customers.

B. Company's website: This is a marketing tool that describes the business but is not a verifiable financial record and cannot be relied upon for EDD.

C. Utility bill: This document is used to verify a customer's physical address, not their financial activities or source of funds.

D. Articles of incorporation: This legal document establishes the company's existence and structure but contains no financial data regarding its source of funds.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

(2022). Chapter 3: "Elements of a KYC Program

" Section on Enhanced Due Diligence (EDD). The guide specifies that for high-risk corporate customers

EDD measures include obtaining and analyzing financial statements to understand the customer's business operations and verify their source of funds and wealth.

2. Financial Action Task Force (FATF). (2023). The FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. Recommendation 10

Interpretive Note

paragraph 19. The note states that for higher-risk customers

financial institutions should perform enhanced CDD measures

which includes taking reasonable measures to establish the source of funds. For a legal person (a business)

audited financial statements are a primary document for this purpose.

3. The Wolfsberg Group. (2020). Statement on Effectiveness. Section: "Outcomes of an Effective AML/CTF Programme

" page 4. The document emphasizes the importance of understanding the customer

including their business and sources of wealth/funds. For corporate entities

this understanding is fundamentally derived from official financial documentation.