Free CAMS-RM Practice Test Questions and Answers (2026)

Transaction monitoring involves analyzing customer activity to detect unusual or suspicious patterns. A key component of managing this process is measuring its effectiveness and efficiency through Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs). The "number of alerts raised to a case analyzed by a front line unit" is a critical metric. It helps assess the quality of alerts generated by the system (i.e., the false positive rate) and the initial triage process, which are core parts of the monitoring function.

A. This is a performance metric (KPI) for a specific team's efficiency, which is an outcome of monitoring, but not part of the monitoring activity itself.

B. A backlog of customer data is an operational problem or a data management issue, not a metric or activity included within the monitoring process.

D. Alerts from a lookback are part of a specific, retrospective project to review historical activity, not part of routine, ongoing transaction monitoring.

1. ACAMS. (2024). CAMS-RM Study Guide. Chapter 4: Controls. The section on Transaction Monitoring discusses the importance of metrics and management information (MI) to oversee the health and effectiveness of the monitoring program, including alert-to-case conversion rates.

2. Wolfsberg Group. (2009). Wolfsberg Guidance on a Risk Based Approach for Managing Money Laundering Risks. This guidance emphasizes the need for ongoing monitoring and using management information to assess the effectiveness of the AML program, which includes analyzing alert volumes and outcomes. (Section: "Monitoring and Management Information," p. 10).

Effective model risk management requires robust governance and oversight, which is achieved through clear and consistent reporting to key stakeholders. Periodic reports on the status of model risk management are provided to those with ultimate responsibility for the institution's risk profile and control environment. This includes the risk management committee for functional oversight, the board of directors for ultimate accountability, senior management for strategic direction, and the audit committee for independent review and assurance. This comprehensive reporting structure ensures that model risk is understood and managed at all senior levels of the organization.

B. "Administrators" is a vague term for operational staff who are not the primary audience for high-level governance reports on risk status.

C. This list is incomplete as it omits the board of directors and the audit committee, both of which are critical governance bodies.

D. This list is too narrow, excluding the board of directors and senior management, who are essential recipients of risk management reporting.

1. ACAMS CAMS-RM Study Guide (2023). Chapter 3, "Model Risk Governance," Section: "Reporting," pp. 3-17 to 3-18. (Specifies that reports are provided to the board, senior management, and relevant committees like the risk and audit committees).

2. Basel Committee on Banking Supervision (BCBS). (2011, June). Principles for the Sound Management of Operational Risk. Principle 3, p. 11. (While focused on operational risk, it establishes the principle of reporting to the board, senior management, and relevant committees).

The Federal Deposit Insurance Corporation (FDIC) issued Financial Institution Letter (FIL) 22-2017 to provide supervisory guidance on model risk management. The document explicitly addresses its applicability to smaller institutions by setting an asset-based threshold. It states that the guidance is generally not expected to apply to FDIC-supervised institutions with under $1 billion in total assets. However, it includes a crucial exception: the guidance would still pertain to such an institution if its use of models is significant, complex, or poses an elevated risk.

A. This option is incorrect; the asset threshold mentioned in the official guidance is $1 billion, not $3 billion.

C. While periodic review and tuning of typologies is a best practice in model risk management, it is not the specific implication of FIL 22-2017 regarding its scope.

D. This is a general definition related to model risk management, not the specific guidance on applicability provided in FIL 22-2017.

1. Federal Deposit Insurance Corporation (FDIC). (2017, June 7). FIL-22-2017: Supervisory Guidance on Model Risk Management. Introduction, p. 1. Retrieved from https://www.fdic.gov/news/financial-institution-letters/2017/fil17022.html. (The document states, "It is not expected that this guidance will pertain to FDIC-supervised institutions with under $1 billion in total assets unless the institution's model use is significant, complex, or poses an elevated risk to the institution.").

The board of directors' role is strategic oversight, not operational management. Their training should focus on high-level risks, regulatory frameworks, and complex areas impacting the institution's overall risk profile. While they need to understand the risk associated with different categories of products and services, training on the specifics of every single product and service is too granular for their governance function. This level of detail is more appropriate for front-line staff, relationship managers, and product development teams who handle these items daily. The board's focus remains on the strategic implications of these risks.

A. Complex products and lines of business present significant, often novel, risks that require board-level understanding and oversight to ensure they are managed appropriately.

C. Understanding applicable laws and regulations is a fundamental responsibility of the board to ensure the institution maintains compliance and avoids legal and regulatory penalties.

D. The board's primary function in risk management is to understand and oversee the most significant risks the institution faces, making this a critical training component.

1. ACAMS CAMS6-RM - Certified Anti-Money Laundering Specialist – Risk Management Study Guide, (2020). Chapter 2, "Governance," pp. 2-15 - 2-18. The guide emphasizes that board training should be commensurate with their oversight role, focusing on the institution's risk profile, regulatory expectations, and strategic risks.

2. Office of the Comptroller of the Currency (OCC). (2020). Comptroller's Handbook: Corporate and Risk Governance. Section on "Roles and Responsibilities," pp. 9-11. This document outlines the board's role in strategic direction and risk appetite oversight, distinct from management's operational duties.

An institution's AML/CTF policy is the foundational document for its risk management program. A critical component of this policy is the customer acceptance criteria, which must be clearly defined. This includes the methodology for assessing a customer's risk profile and ensuring that the institution only onboards customers whose risk level is within its pre-defined and board-approved risk appetite or tolerance.

A. Data transmission standards are highly specific, technical procedures, which would be detailed in procedural documents, not the high-level governing policy.

C. This describes the purpose or context for enhancing controls, which might be stated in a policy's introduction, but it is not a core procedural component itself.

D. This describes a methodology for risk identification. The policy would mandate that such a methodology exists, but the detailed approach itself is part of the risk assessment framework.

1. ACAMS. (2023). CAMS Risk Management (CAMS-RM) Study Guide. Chapter 4: Risk Governance, Section: Policy and Procedures, p. 4.4. "The policy should include...Customer acceptance criteria including the method for defining the AML/CTF risk represented by the customer and whether that is within the risk tolerance of the financial institution."

2. Financial Action Task Force (FATF). (2023). FATF Recommendations. Recommendation 10: Customer Due Diligence, p. 15. This recommendation requires financial institutions to have policies and procedures for customer acceptance.

The Chief Executive Officer (CEO), as the leader of senior management, is responsible for implementing the strategy set by the Board of Directors. A critical component of this is developing the institution's risk appetite statement for the Board's review and approval. The CEO ensures that the risk appetite is embedded into the daily operations and strategic planning of the organization, setting the tone from the top for risk management culture.

B. Designing the specifics of the AML/CTF program is typically delegated to the compliance function or MLRO, not the CEO directly.

C. While the CEO must stay informed, this is a general responsibility for all senior management, not a specific, high-level strategic duty defining the CEO's role in risk.

D. This is poorly phrased. The Board of Directors is ultimately responsible for ensuring independent risk management, while the CEO is responsible for its implementation.

1. ACAMS. (2023). Advanced CAMS-Risk Management (CAMS-RM) Study Guide. Chapter 2: Governance, Section: Roles and Responsibilities, Subsection: Senior Management, p. 36.

2. Financial Stability Board. (2013). Thematic Review on Risk Governance. Peer Review Report, Section 3.2: Role of the board and senior management, p. 11.

Sanctions and watch lists are often conceptually categorized into "blacklists" and "whitelists." A blacklist contains entities (individuals, companies, countries) with whom transactions are prohibited or restricted by law, such as OFAC's SDN List. A whitelist, conversely, contains entities that are explicitly pre-approved or permitted. While screening systems primarily focus on blacklists to block illicit activity, the underlying logic of "prohibit" versus "permit" is fundamental to the screening process.

A. High-risk and low-risk are categories applied to customers or jurisdictions based on a risk assessment, not to the sanctions lists themselves, which are inherently high-risk.

B. "Vulnerable and non-vulnerable" is not standard terminology for categorizing sanctions lists; this language is more common in social or cybersecurity contexts.

D. "Peak and off-peak" is terminology related to demand or usage timing (e.g., for utilities or network traffic) and is irrelevant to sanctions compliance.

1. ACAMS CAMS Risk Management Study Guide (2020), Chapter 3: "Sanctions Screening," discusses the nature of sanctions lists which function as lists of prohibited parties (i.e., blacklists). The concept of whitelisting is also discussed as a method to reduce false positives by pre-approving known, legitimate entities.

2. Zaby, M. (2010). Sanctions Screening: A Basic Introduction. Journal of Money Laundering Control, 13(3), 255-263. https://doi.org/10.1108/13685201011055213. This article discusses the operational mechanics of screening against lists of prohibited entities, conceptually known as blacklists.

The core function of a Money Laundering Reporting Officer (MLRO) in the United Kingdom is to act as the central point of contact for all AML/CFT activity within the firm. The MLRO's primary legal obligation is to receive internal reports of suspicious activity from staff and, after evaluation, determine whether to make an external disclosure (a Suspicious Activity Report or SAR) to the UK's Financial Intelligence Unit, which is the National Crime Agency (NCA).

A. Reporting to senior management is a duty, but it is secondary to the MLRO's legal obligation to report suspicions to law enforcement. The reference to "ML 7.2" is overly specific and may be incorrect.

C. Screening against national and international findings is part of the firm's overall due diligence process, not the specific, defining role of the MLRO.

D. The MLRO receives internal reports of suspicion, not "communication reports under ML 4.1." This option is vague and uses a potentially incorrect regulatory citation.

1. Joint Money Laundering Steering Group (JMLSG). (2020). Prevention of money laundering and the financing of terrorism: Guidance for the UK Financial Sector. Part I, Chapter 2: The Money Laundering Reporting Officer, Section 2.4.

2. UK Government. (2002). Proceeds of Crime Act 2002. Part 7: Money Laundering, Section 331: "Disclosure to nominated officer and consent."

3. ACAMS. (2023). Advanced CAMS-Risk Management (CAMS-RM) Study Guide. Chapter 2: Governance, Section: Roles and Responsibilities, Subsection: Money Laundering Reporting Officer (MLRO), p. 38.

Section 326 of the USA PATRIOT Act mandates that financial institutions implement a Customer Identification Program (CIP). A key component of this program is recordkeeping. The rule requires that identifying information collected from the customer at account opening must be retained for a period of five years after the date the account is closed. This ensures that law enforcement has access to critical information for a reasonable period during investigations.

A. This misrepresents the information-sharing provisions of the PATRIOT Act; it's not about FinCEN providing information to the institution for recordkeeping purposes.

B. This relates to voluntary information sharing between financial institutions under Section 314(b) of the PATRIOT Act, not record retention requirements.

C. This states a ten-year retention period, which is incorrect. The mandated period under Section 326 for CIP records is five years.

1. ACAMS. (2023). Certified AML FinTech Compliance Associate (CAFCA) Study Guide. Chapter 3: The US PATRIOT Act and its Implications, Section: Customer Identification Program (CIP), p. 45. "Records must be retained for five years after the account is closed."

2. Financial Crimes Enforcement Network. (2003). Final Rule: Customer Identification Programs for Banks, Savings Associations, Credit Unions and Non-Federally Regulated Private Banks. 31 CFR § 103.121(b)(3)(ii). "The bank must retain the information...for five years after the date the account is closed."

A feedback loop is a control mechanism where the results of an action or process are used to modify that same action or process in the future. In the context of a KYC committee, information and trends observed about different customer types (e.g., higher-than-expected risk in a certain segment) are fed back into the system. The committee uses this information to refine risk ratings, update KYC policies, and enhance controls. This continuous cycle of review and adjustment is a classic example of a feedback loop designed to improve the effectiveness of the AML/CFT program.

B. Strategic planning is a high-level, forward-looking process for setting long-term organizational goals, not a routine information-sharing mechanism.

C. The "Five-Step approach" is a generic term and not a specific, recognized process for KYC committee information flow.

D. A lookback process is a specific, often regulatory-mandated, forensic review of past activity, not a routine mechanism for program improvement.

1. ACAMS. (2023). CAMS Risk Management (CAMS-RM) Study Guide. Chapter 4: Risk Mitigation and Control, Section: "Ongoing Monitoring and Review," p. 4-18. This section describes the cyclical nature of monitoring, reporting, and adjusting the risk framework.

2. ACAMS. (2023). CAMS Risk Management (CAMS-RM) Study Guide. Chapter 2: The Risk-Based Approach, p. 2-15. The guide emphasizes that the risk assessment is a "dynamic process" that should be updated based on new information, which is the essence of a feedback loop.

An effective sanctions compliance program requires that screening be conducted against the most current version of all relevant sanctions lists. Sanctions lists are frequently updated by authorities (e.g., OFAC, UN, EU). Any delay in updating the institution's internal lists and executing the screening process creates a compliance gap, potentially resulting in a violation. Therefore, prompt updates and screening upon list availability are critical operational requirements.

A. Senior management approves the sanctions policy but does not create or issue the sanctions lists; these are provided by governmental and international bodies.

B. A registration or approval regime applies to the institution itself (e.g., an MSB), not to the operational process of sanctions screening.

D. While dispute resolution is part of a compliance program, it is not the primary factor for ensuring the prompt execution of the screening process itself.

1. ACAMS CAMS Risk Management Study Guide (2020), Chapter 3: "Sanctions Screening," emphasizes the critical importance of timely updates to sanctions lists, stating that "the lists used for screening must be current" and that processes must be in place to ensure new lists are implemented promptly.

2. Financial Action Task Force (FATF). (2019). Guidance on Proliferation Financing Risk Assessment and Mitigation. Section 67. This guidance highlights the need for "ongoing monitoring" which includes processes to screen against updated lists of designated persons and entities.

An effective AML/CFT risk assessment program evaluates the combination of risks an institution faces. The fundamental pillars or components that are combined to determine the overall risk profile are the types of customers (Client risk), the geographic locations where it operates or transacts (Country risk), and the services or instruments it offers (Product risk). By analyzing these three core areas together, a financial institution can develop a comprehensive understanding of its inherent money laundering and terrorist financing vulnerabilities and apply commensurate controls.

B. Policy risk is a component of the control environment that mitigates inherent risk, not a primary component of inherent combination risk itself.

C. Institution risk and government risk are too broad; the standard model breaks these down into more specific, measurable components like client, country, and product.

D. Institution risk is not a standard primary category in this combination model; it is the entity being assessed based on the other risk factors.

1. ACAMS. (2023). Certified Anti-Money Laundering Specialist - Risk Management (CAMS-RM) Study Guide. Chapter 2: Risk Assessment. The guide details the methodology for conducting an enterprise-wide AML risk assessment, identifying the core components as customers, geography, and products/services.

2. Financial Action Task Force (FATF). (2013). Guidance for a Risk-Based Approach: The Banking Sector. p. 12, para. 29. This guidance outlines that risk assessments should consider risk factors including customers, countries or geographic areas, and products, services, transactions or delivery channels.

When developing country risk ratings, a financial institution should refer to credible, public sources. The Financial Action Task Force (FATF) is the global standard-setter for AML/CFT. Its 40 Recommendations provide the framework for a country's AML/CFT regime, and its Mutual Evaluation Reports (MERs) provide detailed assessments of a country's compliance and effectiveness. These documents are primary sources for determining the level of AML/CFT risk associated with a specific jurisdiction.

A. FinCEN provides guidance primarily for US institutions and often references FATF, but FATF is the international source.

C. The "United Kingdom Union" is not a recognized entity; guidance would come from UK authorities like the FCA, but FATF is the global standard.

D. The "UN Assessment Council" is not the correct name; the UN Security Council issues sanctions, which is a factor, but FATF provides the comprehensive AML/CFT framework guidance.

1. ACAMS CAMS-RM Study Guide (2023). Chapter 3: The Risk Assessment, Section: "Geographic Risk," pp. 3-15 - 3-17. (Explicitly lists FATF statements, 40 Recommendations, and Mutual Evaluation Reports as key sources for assessing country risk).

2. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. (The entire document serves as the foundational guidance).

3. Financial Action Task Force (FATF). Consolidated assessment ratings. (This section of the FATF website provides direct access to the outcomes of Mutual Evaluation reports, a key tool for this purpose).

Modern terrorist financing typologies often involve the movement of funds directly to an individual operative who will carry out an attack or provide logistical support. This method, which can include self-funding or small transfers from various sources, is difficult to detect as it can resemble normal, low-value financial activity. The funds flow directly to the point of use, bypassing larger, more easily identifiable organizational accounts. This makes the direct funding of an individual operative a critical pattern for financial institutions to identify.

A. While funds can flow through an intermediary person, the direct flow to the final operative is a more specific and challenging typology to detect.

B. This describes a reverse flow of funds away from the terrorist organization, which is not a funding mechanism for an operation.

C. This is a plausible flow, but "to the individual operative" is a more encompassing description of the final funding stage for lone actors or cell members.

1. Financial Action Task Force (FATF). (2015). Emerging Terrorist Financing Risks. This report details the shift towards smaller-scale attacks by individuals and small cells, often self-funded or financed through small, direct transfers, making the funding flow to the individual operative a key risk indicator (See pages 10-12).

2. ACAMS CAMS Risk Management Study Guide (2020), Chapter 2: "AML/CFT Risk Factors," describes terrorist financing typologies, including the methods used by lone actors and small cells where funds are moved directly to the individuals involved to procure materials for an attack.

A strategic plan defines the institution’s desired future position and the path to reach it after considering operational, regulatory and market implications. It therefore establishes the organisation’s forward-looking direction, against which risk management and resource allocation are aligned.

A. Describes reporting lines, not future direction.

C. A function that supports, rather than sets, strategy.

D. A measurement of remaining risk, not a planning guideline.

1. COSO “Enterprise Risk Management – Integrating with Strategy and Performance” (2017), Ch. 3, pp. 19-20.

2. ACAMS Risk Management Study Guide (2020), Ch. 2, p. 28.