Under the EU’s Anti-Money Laundering Directives (AMLD), financial institutions are legally obligated to keep customer due diligence (CDD) records, including information on business activities, for a specific period. The 4th and 5th AMLD mandate that records must be retained for five years after the business relationship has ended. The frequent changes in business activity represent a significant risk indicator, making the retention of this historical data crucial for ongoing monitoring and potential future investigations. The bank's internal policies must be aligned with these legal requirements. Therefore, retaining the information as specified by both internal policy and EU directives is the correct procedure.

A. Holding records for only one year is insufficient and would violate the minimum five-year post-relationship retention period required by the EU AMLD.

C. Data privacy regulations like GDPR allow for data retention to comply with legal obligations, such as AML laws. Destroying historical data would impede risk management and investigations.

D. This is incomplete. The legal requirement extends beyond the life of the account, mandating a specific retention period after the customer relationship has ended.

1. Directive (EU) 2015/849 (Fourth Anti-Money Laundering Directive)

European Parliament and the Council

20 May 2015.

Article 40

Paragraph 1: "Member States shall require obliged entities to retain the following documents and information in accordance with national law for the purpose of preventing

detecting and investigating possible money laundering or terrorist financing... (a) a copy of the documents and information which are necessary to comply with the customer due diligence requirements... for a period of five years after the end of the business relationship with their customer or after the date of an occasional transaction."

2. ACAMS CKYCA Study Guide

Association of Certified Anti-Money Laundering Specialists.

Chapter 2: Legal and Regulatory Frameworks: This chapter details the global standards and specific regional regulations

including the EU AML Directives. It emphasizes that financial institutions must establish record-retention policies that comply with the legal minimums set by their jurisdictions

which in the EU is five years after the relationship ends. The guide clarifies that this legal obligation for AML purposes is a valid reason for data retention under data privacy laws like GDPR.

3. "The interaction between the GDPR and the AML/CFT legal framework

" European Banking Authority (EBA)

Opinion of the European Banking Authority on the interplay between the AMLD and the GDPR

2018.

Section 3.2

Paragraph 18: This opinion clarifies that the processing of personal data for AML/CFT purposes is considered "necessary for compliance with a legal obligation to which the controller is subject" under Article 6(1)(c) of the GDPR. This provides the legal basis for retaining customer data as required by the AMLD

even when it is historical.

The fundamental responsibility of a KYC analyst during the due diligence process is to verify customer information and resolve any identified discrepancies. When a conflict arises between client-provided documents and a reliable, independent source like a country's business register, the standard and most appropriate initial action is to seek clarification directly from the client. This step is crucial for understanding the nature of the discrepancy, which could stem from a simple clerical error, a recent change in legal status not yet updated in public records, or a more significant red flag. This direct inquiry is a core component of the investigation and risk assessment process before any further action is taken.

A. Filing a suspicious activity report is a premature and disproportionate response. A discrepancy requires investigation first; a SAR is filed only if that investigation leads to a suspicion of illicit activity.

B. Using only the client's documentation ignores contradictory evidence from a reliable, independent source, which undermines the entire principle of verification in the KYC process.

C. Unilaterally using the business register information without client consultation fails to resolve the discrepancy and understand its cause, potentially leading to an inaccurate client profile.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide

(2022). Chapter 2: "Essential KYC Components

" Section: "Customer Due Diligence (CDD)." The guide emphasizes that when discrepancies are found during the verification process

the financial institution must take reasonable measures to resolve them. The primary method for resolution is direct communication with the customer to obtain clarification and/or corrected documentation.

2. Financial Action Task Force (FATF)

(2012-2023). "International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations

" Interpretive Note to Recommendation 10 (Customer Due Diligence)

Paragraph 14. The note details the requirement to verify the identity of the customer and understand its legal structure. It implies that any inconsistencies discovered during this verification must be satisfactorily resolved to meet CDD obligations.

3. Wolfsberg Group

(2020). "Frequently Asked Questions (FAQs) on Correspondent Banking

" Question 23. While focused on correspondent banking

the principle applies universally. The guidance states that financial institutions should have processes to address and resolve discrepancies in information

which typically involves client outreach as a first step before considering relationship termination or reporting.

A financial institution's customer risk-rating model is foundational to its risk-based Anti-Money Laundering (AML) program. A customer's country of origin is a critical data point in this model. Iran is designated as a high-risk jurisdiction by the Financial Action Task Force (FATF) and is subject to significant international sanctions. Conversely, Ireland is a low-risk, FATF-member country. By incorrectly recording the customer as being from Ireland, the risk-rating system will apply the low-risk weighting associated with Ireland instead of the high-risk weighting for Iran. This directly and immediately results in the customer being assigned a significantly lower risk score (fewer risk points) than is appropriate.

B. prohibited from funding a new account.

This is incorrect. The erroneously low-risk rating would likely lead to reduced scrutiny, making it easier, not more difficult, for the customer to fund an account.

C. disallowed from opening new accounts.

This is incorrect. A low-risk classification would facilitate, rather than prevent, account opening, likely subjecting the customer to simplified due diligence measures.

D. not screened against applicable sanctions lists.

This is unlikely to be completely true. Most institutions screen all customers against core sanctions lists (e.g., OFAC SDN) at onboarding, regardless of nationality. While the error might prevent screening against Iran-specific lists, the most direct and certain outcome is the incorrect risk scoring.

1. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. FATF

Paris

France.

Reference: Interpretive Note to Recommendation 10 (Customer Due Diligence)

Paragraph 5(d)(i). This section explicitly lists "the customer’s country of origin" as a key variable for determining the level of customer risk. This confirms that an error in this data field directly impacts the risk assessment.

2. The Wolfsberg Group. (2015). Frequently Asked Questions (FAQs) on Risk Assessments for Money Laundering

Sanctions and Bribery & Corruption.

Reference: Page 6

Section "Country/Geographic Risk." The document states

"A FI’s risk assessment should include an assessment of the risks associated with the countries in which it operates and the countries its customers are from/in." This establishes the country of origin as a fundamental pillar of the risk assessment process

which is quantified through risk points.

3. Basel Committee on Banking Supervision. (2014). Sound Management of risks related to money laundering and financing of terrorism. BCBS Paper No. 275.

Reference: Annex 2

Paragraph 11(a). This guidance lists "country of origin and residence" as primary risk factors for assessing customer risk profiles. An incorrect country input would therefore lead to a flawed risk profile calculation.

The scenario presents multiple high-risk indicators: an offshore jurisdiction, a passive business purpose (holding shares), and a registered address shared by many other entities. This last point is a classic red flag for a shell company, which lacks physical presence and legitimate business operations. The combination of these factors significantly elevates the client's risk profile. According to the risk-based approach, a higher-risk client requires Enhanced Due Diligence (EDD) to adequately understand the customer's nature, beneficial ownership, and source of funds, thereby mitigating potential money laundering and terrorist financing risks.

A. Ask for the clientэs utility bill confirming the registered address.

A utility bill is ineffective for verifying a shared, non-operational address and fails to address the core risk of the entity being a shell company.

C. Follow the regular KYC requirements as per legal form of the client.

Applying standard due diligence is insufficient given the multiple high-risk indicators. A risk-based approach mandates escalating measures for such clients.

D. Follow the KYC requirements for the holding companies.

This is too generic. The specific red flags (offshore, shared address) necessitate more than standard procedures for holding companies; they are specific triggers for EDD.

1. Financial Action Task Force (FATF). (2020). FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. FATF

Paris

France.

Interpretive Note to Recommendation 10 (Customer Due Diligence)

Section C: States that examples of higher-risk situations that require Enhanced Due Diligence (EDD) include customer risk factors such as "the ownership structure of the company appears unusual or excessively complex given the nature of the company’s business." The use of a shared address in an offshore jurisdiction for a holding company fits this description.

2. Financial Action Task Force (FATF). (2018). Concealment of Beneficial Ownership. FATF

Paris

France.

Page 21

Section "Misuse of professional intermediaries": This report identifies the use of professional intermediaries to provide registered addresses

which are used by numerous other companies

as a key indicator of potential misuse of legal persons for illicit purposes

a characteristic often associated with shell companies.

3. The Wolfsberg Group. (2023). Wolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ) V1.4.

Question 10.2: Asks whether the institution's AML policies include a list of high-risk indicators for EDD. The guidance notes often list shell banks/companies and entities from high-risk jurisdictions as requiring EDD

reinforcing the principle that such characteristics trigger enhanced scrutiny.

A client amending their narrative regarding their source of wealth (SoW) because they cannot provide supplementary information is a significant red flag. This action directly undermines the verification process. It suggests the initial explanation was potentially false, and the client is now creating a new story to fit the available (or lack of) evidence. Such inconsistency and lack of transparency are classic indicators of a higher risk of financial crime, as the client may be attempting to obscure the true, possibly illicit, origin of their funds. This situation warrants immediate enhanced due to diligence and possible escalation.

B. It is reasonable that a client may not have retained specific bank statements from 15 years ago, making this a plausible situation, not an immediate concern.

C. Many high-net-worth individuals intentionally maintain a low or non-existent online presence for privacy and security reasons; this is not inherently suspicious.

D. An online career profile is for professional networking, not a financial disclosure document. Omitting personal investments like property is normal and expected.

1. The Wolfsberg Group

"Frequently Asked Questions (FAQs) on Source of Wealth and Source of Funds" (October 2020). This guidance emphasizes the need for a plausible and coherent narrative for a client's SoW. Section 3

"What are some of the practical challenges in establishing and corroborating SoW/SoF?"

implicitly supports that a changing narrative is not coherent and raises suspicion. An amended story directly contradicts the principle of a consistent and believable explanation.

2. Financial Action Task Force (FATF)

"Guidance for a Risk-Based Approach for the Banking Sector" (October 2014). Annex 2

page 31

lists high-risk indicators. While not explicitly stating "amends narrative

" it includes related red flags such as a "Customer is reluctant or refuses to provide information about the beneficial owner(s)

or the source of funds

" which aligns with the behavior of changing a story when pressed for proof.

3. University of Manchester

School of Law

"Counter-Terrorist Financing and the Financial Sector: The Moral Case for Inclusion" (2019). Academic analysis of due diligence often highlights that customer-provided information must be consistent and verifiable. Research in this area (e.g.

on the effectiveness of AML regimes) underscores that inconsistencies in customer statements are a primary trigger for enhanced scrutiny. A client amending their narrative is a prime example of such an inconsistency. (DOI: https://doi.org/10.1093/jhuman/huy019 - While the article's main topic is different

the underlying principles of due diligence and identifying suspicious behavior are relevant).