CAMS Exam Study Guide 2026-2027

A scheme where competitors collude to manipulate the outcome of a bidding process, often involving corrupt payments to ensure a predetermined winner.

The offering, giving, receiving, or soliciting of something of value to influence the actions of an official or person in a position of trust.

The abuse of entrusted power for private gain; bribery is one common form of corrupt activity, but corruption also includes other misconduct such as embezzlement and extortion.

Grand corruption involves large-scale abuse of power by high-level officials, often involving significant sums, while petty corruption involves smaller-scale, everyday abuses, often by lower-level officials.

A form of government or rule characterized by systemic theft of public funds by those in power, representing an extreme form of grand corruption.

The heightened risk that transactions involving government-owned businesses may involve officials with both commercial and public authority, increasing the potential for corrupt influence.

A small payment made to expedite a routine, non-discretionary government action, distinct from a bribe intended to influence a discretionary decision.

Individuals closely connected to a PEP, such as relatives or business partners; they must be considered because corrupt PEPs may use these individuals to indirectly control or benefit from illicit funds.

A portion of a payment returned to a person who facilitated a transaction, commonly occurring in procurement or contracting arrangements as a reward for awarding business.

An individual who holds or has held a prominent public position; PEP status heightens risk because such individuals may have greater opportunity and potential motive to engage in corruption or bribery.

A domestic PEP holds a prominent position within the country where the financial institution operates, while a foreign PEP holds a prominent position in another country.

FATF recognizes corruption as a significant predicate offence for money laundering, encouraging countries to ensure their AML frameworks effectively address the proceeds of corrupt activity.

A U.S. law that generally prohibits bribing foreign government officials to obtain or retain business.

A UK law addressing bribery of both public officials and private individuals; it is generally considered broader in scope than the FCPA, which focuses specifically on foreign public officials.

They can be used to obscure beneficial ownership and disguise the movement of corrupt proceeds, similar to their use in broader money laundering schemes.

These industries often involve large government contracts, licensing, and interactions with public officials in resource-rich countries, creating significant opportunities for corrupt influence.

The elevated risk of corruption or bribery associated with PEPs warrants closer scrutiny of the source of funds, wealth, and the nature of the relationship.

Some jurisdictions have historically carved out narrow exceptions for facilitation payments, though this treatment varies and many modern frameworks discourage or prohibit them entirely.

Financial institutions can unknowingly process or hold the proceeds of bribery and corruption, making it important to recognize red flags even when the institution itself is not a party to the underlying corrupt act.

Individuals connected to an SOE may effectively function as government officials, so standard commercial due diligence alone may not adequately address corruption risk.

Using previously stolen username and password combinations to attempt unauthorized access to other accounts, exploiting the common practice of password reuse.

The unauthorized use of someone else's computing resources to mine cryptocurrency, generating illicit proceeds for the attacker at the victim's expense.

Cyber-enabled fraud uses technology to facilitate traditional types of fraud that could occur through other means, while cyber-dependent crime, such as hacking, can only exist because of computer technology.

Criminal activity that uses computers, networks, or digital technology as the primary tool or target, often to generate or facilitate illicit financial gain.

The risk that sensitive data will be improperly accessed or exposed; stolen data from breaches is often sold and later used to commit identity theft or account fraud.

Malicious software designed to infiltrate or damage a system; it can be used to steal banking credentials or directly manipulate transactions on an infected device.

Specialized criminal actors who offer money laundering capabilities to other cybercriminals, functioning as a service within the broader cybercriminal ecosystem.

A deceptive technique using fraudulent communications, often email, to trick victims into revealing sensitive information or credentials that can then be used for financial fraud.

Malicious software that encrypts a victim's data or systems, with attackers demanding payment, often in cryptocurrency, in exchange for restoring access.

Fraudulently transferring a victim's phone number to a criminal-controlled device, which can be used to intercept authentication codes and gain unauthorized access to financial accounts.

A targeted form of phishing directed at a specific individual or organization, often personalized to increase its credibility, unlike broad, generic phishing campaigns.

A network of compromised computers controlled remotely by an attacker; it can be used to conduct large-scale attacks, such as credential theft or distributed fraud schemes.

An attack that overwhelms a system with traffic to disrupt its normal operation; it can be used as a distraction tactic while other fraudulent activity occurs, or as extortion leverage.

A hidden part of the internet accessible only through specialized software, often used to anonymously buy and sell illicit goods and services, including stolen financial data.

They can identify suspicious transaction patterns associated with cyber-enabled crime and file appropriate reports, contributing to broader law enforcement efforts.

Stolen financial and personal data, illegal drugs, hacking tools and services, and other illicit goods.

Cryptocurrency transactions can be conducted with relative speed and reduced identifying information compared to traditional banking, making it attractive for moving illicit proceeds.

Cryptocurrency can offer perceived anonymity and speed of transfer, making it attractive for criminals seeking to receive payment while reducing traceability.

Rapid advances in technology continuously create new tools and techniques for both attackers and defenders, requiring constant adaptation to stay ahead of emerging threats.

Cybersecurity failures can directly enable financial crime, such as unauthorized account access or data theft, making strong cybersecurity a foundational element of overall financial crime prevention.

A launderer could sell an NFT to themselves (or a colluding party) at an inflated price, making illicit funds appear to be legitimate proceeds from an art or asset sale.

The analysis of publicly available blockchain transaction data to trace the flow of virtual assets and identify potentially illicit activity or wallet clusters.

Financial services, such as lending or trading, conducted through blockchain-based protocols without a traditional centralized intermediary; it presents unique challenges because there may be no clear regulated entity responsible for AML compliance.

Repeatedly buying and selling an asset, often between accounts controlled by the same person, to create artificial trading volume or inflate its apparent value.

A service that pools and mixes multiple users' cryptocurrency transactions to obscure the origin and destination of funds, considered high risk because it is specifically designed to break the transaction trail.

A unique digital asset representing ownership of a specific item or piece of content; it has emerged as an AML concern because its often-subjective valuation can be exploited to disguise the movement of illicit funds.

A type of cryptocurrency specifically designed to obscure transaction details, such as sender, receiver, and amount, making it more difficult to trace than more transparent blockchains.

A type of cryptocurrency designed to maintain a stable value, often pegged to a fiat currency; its price stability makes it attractive for everyday transactions, but also potentially useful for moving illicit value without cryptocurrency's typical volatility.

A business that conducts activities such as exchanging, transferring, or safekeeping virtual assets on behalf of others, typically covering cryptocurrency exchanges and similar service providers.

A digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, excluding digital representations of fiat currencies.

A requirement that VASPs collect and transmit certain originator and beneficiary information when transferring virtual assets above a defined threshold, similar to wire transfer requirements in traditional banking.

Traditional AML frameworks generally rely on regulating identifiable institutions, while many DeFi protocols operate through automated smart contracts without a clear central operator.

Cryptocurrency can offer a degree of pseudonymity and can be transferred without relying on traditional financial institutions, aligning with the anonymity darknet market participants often seek.

Virtual assets have increasingly been used to facilitate money laundering and terrorist financing, prompting FATF to require VASPs to implement AML/CFT controls similar to traditional financial institutions.

New virtual asset products, platforms, and laundering techniques emerge frequently, so ongoing education is necessary to keep detection and compliance efforts current and effective.

Unauthorized access to and control of an existing customer account, often occurring through stolen credentials, phishing, or malware.

Fraud that targets members of an identifiable group, such as a religious or cultural community, exploiting the trust within that group to make the scheme more convincing.

A scam where a fraudster impersonates a trusted executive or vendor via email to trick an employee into making an unauthorized wire transfer.

Fraud involving fraudulent or altered checks, including forged checks, counterfeit checks, and altered payee or amount information.

Writing checks against insufficient funds between multiple accounts, exploiting the delay in check clearing to create the appearance of available funds.

Unauthorized use of credit card information; common methods include stolen card data, card skimming, and application fraud using stolen identities.

The illegal or improper use of an older adult's funds or assets; older adults are often targeted due to factors such as accumulated savings, potential cognitive vulnerability, or social isolation.

Fraud committed by the actual account holder themselves, such as never intending to repay a loan, as opposed to third-party fraud, where someone else's identity is used without their knowledge.

The intentional deception used to gain an unfair or unlawful benefit; fraud is the act of obtaining illicit proceeds, while money laundering is the subsequent process of disguising those proceeds.

Fraud involving healthcare billing or services, such as billing for services never provided; it is significant due to the large scale of healthcare spending and the complexity of billing systems.

The unauthorized use of another person's identifying information; it commonly enables further financial crime, such as opening fraudulent accounts or making unauthorized transactions.

Fraud committed against or through an insurance company, such as staged accidents, exaggerated claims, or falsified policy applications.

Fraud involving fake or manipulated invoices, often used to trick a business into paying for goods or services that were never provided, or to redirect legitimate payments to a fraudster's account.

Fraud related to mortgage lending, which can include falsified income or asset information, inflated property appraisals, or straw buyer schemes.

The creation of a fictitious identity by combining real and fabricated information, such as a real Social Security number with a fake name; unlike traditional identity theft, it does not impersonate a single real, existing person.

The intentional falsification of tax information to reduce tax liability or claim improper refunds; tax evasion itself can be a predicate offense feeding proceeds into money laundering activity.

A fraudulent investment scheme that pays returns to earlier investors using funds contributed by newer investors, rather than from actual profit.

A scheme where a fraudster builds a fake romantic relationship with a victim, often online, to manipulate them into sending money.

Victims are sometimes manipulated into unknowingly acting as money mules themselves, transferring funds on behalf of the fraudster.

They require a continuous stream of new investor funds to pay earlier investors, and the scheme collapses once new investment can no longer keep pace with required payouts.

It can be difficult to detect using traditional identity verification, since the fabricated identity may pass some checks while being entirely fictitious.

The resulting wire transfer often appears to be a legitimate, authorized business payment, making it difficult to distinguish from genuine transactions based on transaction data alone.

Fraud and money laundering are often interconnected, and coordinated efforts help institutions detect and respond to schemes more effectively than siloed, separate approaches.

Fraud generates illicit proceeds that a perpetrator may then attempt to launder, making fraud one of the underlying criminal activities that produces the funds subject to laundering.

Fraud generates illicit proceeds that often flow through the financial system and require laundering, making fraud detection closely linked to broader AML efforts.

A customer making multiple cash deposits just under a reporting threshold across different branches or days.

Indicators or warning signs of potentially suspicious activity that warrant further review or investigation.

Placement, layering, and integration.

The natural person or persons who ultimately own or control an entity; identifying beneficial ownership is important because it helps uncover the true parties behind a transaction or account.

The physical transportation of large amounts of cash across borders to avoid the formal financial system and its reporting requirements.

Using casino chips, gaming transactions, or winnings to disguise the source of illicit funds, often by exchanging cash for chips and then cashing out with minimal or no actual gambling.

Mixing illicit funds with the legitimate revenue of a business to obscure the illicit portion within otherwise normal cash flow.

Using insurance products, such as purchasing a policy with illicit funds and then surrendering it early or taking out a loan against it, to disguise the source of funds.

The final stage, where laundered funds are reintroduced into the legitimate economy, appearing to come from a lawful source.

Moving funds through multiple accounts and jurisdictions via wire transfer to create a complex, hard-to-trace transaction trail.

To create enough transactional complexity and distance from the original source that tracing the funds back to their criminal origin becomes difficult.

A series of complex transactions designed to separate illicit funds from their criminal source and obscure the audit trail.

A scheme where a launderer creates a fake loan from a shell company or offshore entity back to themselves, disguising illicit funds as legitimate loan proceeds.

The process of disguising the illicit origin of proceeds from criminal activity so they appear to come from a legitimate source.

Deliberately inflating the stated value of goods or services in a trade transaction to move excess funds disguised as legitimate trade payment.

The initial introduction of illicit cash or proceeds into the financial system, such as depositing cash into a bank account.

Using real estate purchases to disguise illicit funds; real estate is attractive because it can involve large transaction values, price manipulation, and sometimes limited beneficial ownership disclosure.

Using multiple individuals to purchase negotiable instruments in amounts below reporting thresholds, then consolidating them to launder larger sums.

Breaking up large sums of cash into smaller transactions, often to fall below reporting thresholds and avoid detection.

The use of trade transactions, such as over- or under-invoicing goods, to disguise the movement of illicit funds across borders.

Deliberately understating the value of goods or services in a trade transaction, often used to move value out of a country while minimizing taxes or scrutiny.

A trade-based laundering system, historically associated with Latin America, where drug proceeds in one currency are exchanged for goods or currency in another, using brokers to bridge illicit funds with legitimate trade.

A business with real, ongoing operations that is used to blend illicit funds with legitimate revenue, unlike a shell company, which generally has no genuine business activity.

A company with no significant assets, operations, or employees, often used to disguise beneficial ownership and obscure the movement of illicit funds.

Individuals, sometimes unwittingly, who transfer or move illicit funds on behalf of criminals, often through their own personal bank accounts.

To avoid triggering mandatory reporting requirements, such as currency transaction reports, that apply above certain thresholds.

As financial institutions and regulators identify and close off known laundering methods, criminals adapt and develop new techniques to stay ahead of detection efforts.

Cash or other illicit proceeds are still close to their criminal origin and have not yet been obscured through multiple transactions.

Recognizing known typologies helps compliance professionals identify patterns of suspicious activity that might otherwise appear as isolated, unremarkable transactions.

Using unwitting participants can make the movement of funds appear more legitimate and can distance the actual criminals from direct exposure to detection.

Restrictions imposed by a government or international body on trade, financial transactions, or other economic activity, generally used as a foreign policy or national security tool.

Under OFAC's rules, an entity owned 50% or more, in aggregate, by one or more sanctioned parties is itself generally treated as sanctioned, even if not separately listed.

The risk that a correspondent bank could unknowingly process transactions on behalf of a sanctioned party through its relationship with a respondent bank.

Transferring cargo, such as oil, between vessels at sea or changing a vessel's registered flag to obscure its true origin, destination, or ownership.

Establishing a company that appears independent but is actually controlled by or benefits a sanctioned party, used to conduct transactions that would otherwise be prohibited.

Creating multiple layers of corporate ownership, often across jurisdictions, to obscure a sanctioned party's connection to an entity or transaction.

Deliberate efforts to circumvent or avoid the restrictions imposed by economic or trade sanctions.

The process of checking customers and transactions against government and international sanctions lists to identify potential matches; it is core because failing to screen properly can result in prohibited dealings with sanctioned parties.

Routing goods or funds through an intermediary, non-sanctioned country to obscure the true origin or destination of a transaction with a sanctioned party.

Falsifying the description, quantity, or value of goods in trade documentation to disguise a prohibited transaction with a sanctioned party as a legitimate trade with a non-sanctioned entity.

A screening alert that appears to match a sanctioned party but, upon review, does not actually correspond to that sanctioned individual or entity; it often occurs due to similar names or incomplete identifying information.

A person who appears to own or control an entity on paper but is actually acting on behalf of the true, often sanctioned, beneficial owner.

An individual or entity identified by the U.S. Treasury's Office of Foreign Assets Control as subject to sanctions, generally prohibiting U.S. persons from dealing with them.

A confirmed match between a customer or transaction party and a sanctioned individual or entity; upon confirmation, the institution must generally block or reject the transaction and report it as required by law.

Targeted sanctions apply to specific individuals, entities, or sectors, while comprehensive sanctions broadly restrict most or all economic activity with an entire country.

Certain jurisdictions with weaker sanctions enforcement or higher exposure to sanctioned countries can present elevated risk for facilitating evasion schemes.

Sanctions lists and ownership structures can change over time, so continuous monitoring helps ensure new designations or evolving relationships are captured after the initial onboarding screening.

Nominees can obscure the sanctioned party's true beneficial ownership or control of an entity, making detection through standard screening more difficult.

To avoid detection of their location or movements, often used to conceal a voyage to or from a sanctioned country or entity.

Sanctioned parties often use related entities, ownership structures, or intermediaries to continue operating, so a full understanding of the network helps identify indirect exposure.

Individuals who travel to join or support terrorist organizations abroad; they are a concern because their travel and support networks often involve identifiable financial transactions.

The risk that online crowdfunding platforms could be used to collect small donations that are ultimately directed toward terrorist purposes; it is a growing concern due to the increasing popularity and accessibility of online fundraising.

Any form of assistance, financial or otherwise, provided to a terrorist organization or its activities, which is generally criminalized under terrorist financing laws.

A scenario where an individual funds their own terrorist activity through personal means, such as employment income, small loans, or minor criminal activity, rather than receiving funds from an organized network.

The provision of funds to support terrorist activity or organizations; unlike money laundering, which disguises illicit funds, terrorist financing can involve legitimately or illegitimately sourced funds being directed toward an illicit purpose.

An entity formally identified by a government or international body as a terrorist organization; financial institutions are generally obligated to screen for and block transactions involving designated entities.

An informal value transfer system based on trust and networks of brokers, operating largely outside traditional banking; it can be exploited because it often leaves little formal documentation, making transactions harder to trace.

Terrorist financing aims to fund terrorist activity, while money laundering aims to disguise the illicit origin of criminal proceeds.

The United Nations maintains sanctions lists identifying individuals and organizations associated with terrorism, which member states are expected to incorporate into their own sanctions regimes.

Terrorist attacks can sometimes be funded with relatively small amounts of money, making detection based purely on transaction size less effective.

Take appropriate action according to applicable law, which may include blocking the transaction or account and reporting the match to the relevant authority.

They can be misused as a channel to collect and transfer funds toward terrorist purposes, either through complicit involvement or without the organization's knowledge.

Providing funds, training, weapons, lodging, or other resources that support the organization's activities.

Their charitable, cross-border activities and sometimes limited financial oversight can make them attractive vehicles for diverting funds toward illicit purposes.

Because terrorist financing does not always require large sums, small transactions can still support significant terrorist activity, requiring attention to context and patterns rather than amount alone.

Terrorist financing focuses on the ultimate use of funds for terrorism, so funds may originate from legal sources such as employment income or charitable donations before being diverted to an illicit purpose.

These systems often operate without the standardized recordkeeping and reporting requirements applied to formal financial institutions, reducing visibility into the transactions.

Self-funding often involves small, seemingly ordinary transactions that closely resemble normal personal financial activity, making them difficult to distinguish from legitimate behavior.

Terrorist financing networks often operate across multiple countries, so effective detection and disruption require coordinated information sharing and action among international partners.

While both involve funding illicit activity with serious security implications, proliferation financing specifically relates to funding weapons of mass destruction programs, requiring distinct detection considerations from terrorist financing generally.

25% or more ownership or control.

AMLA may impose binding decisions and apply administrative sanctions for serious, repeated, or systematic breaches of AML/CFT requirements.

It established a harmonized definition of which prominent public functions qualify an individual as a PEP, replacing varying national definitions.

The Anti-Money Laundering Authority, the EU's new central AML/CFT supervisor, headquartered in Frankfurt, Germany.

The Sixth Anti-Money Laundering Directive, which enhances national supervisory mechanisms, cooperation, and harmonizes elements such as beneficial ownership thresholds and the definition of Politically Exposed Persons.

A unified, directly applicable set of AML rules across all EU member states, established under the Anti-Money Laundering Regulation (AMLR).

A regulation is directly applicable EU-wide law, while a directive sets a goal that each member state must transpose into its own national legislation, which can result in variation between countries.

Directly supervising selected high-risk cross-border obliged entities in the financial sector, while coordinating with and supporting national supervisors and financial intelligence units.

The EU's AML/CFT legislative package, comprising the AMLA Regulation, the AML Regulation (Single Rulebook), and the Sixth Anti-Money Laundering Directive (AMLD6).

It coordinates with national supervisors, promotes supervisory convergence, and supports cooperation between national financial intelligence units.

Selected high-risk, cross-border obliged entities in the financial sector meeting criteria established under the AMLA Regulation.

July 1, 2025.

July 10, 2027.

It moves the EU away from a fragmented, directive-based model requiring separate national implementation toward a unified, directly applicable framework with centralized supervision for the highest-risk entities.

A regulation applies uniformly across all member states without requiring separate national transposition, eliminating the inconsistencies that arose from each country implementing a directive differently.

No, they are not directly legally binding, but they represent widely endorsed international standards that countries are expected to implement.

Countries generally incorporate the Recommendations into their own domestic laws and regulations, making them enforceable at the national level.

Seven categories, labeled A through G.

A comprehensive set of internationally endorsed standards representing the global framework for AML/CFT measures that countries are expected to implement.

AML/CFT policies and coordination, including the risk-based approach and national cooperation.

Transparency and beneficial ownership of legal persons (Recommendation 24) and legal arrangements, such as trusts (Recommendation 25).

The powers and responsibilities of competent authorities and other institutional measures, such as supervision and sanctions.

Money laundering offences and the confiscation of criminal proceeds.

International cooperation, including mutual legal assistance and extradition related to money laundering and terrorist financing.

Terrorist financing offences and measures to counter the financing of proliferation.

Obligations for financial institutions and designated non-financial businesses and professions, including customer due diligence, recordkeeping, and reporting suspicious transactions.

Both technical compliance with the FATF Recommendations and the practical effectiveness of the country's AML/CFT measures in achieving intended outcomes.

A peer review process assessing a country's compliance with the FATF Recommendations and the effectiveness of its AML/CFT framework.

The process of identifying and verifying a customer's identity, understanding the nature of the business relationship, and assessing the associated risk.

The recommendation establishing the requirement for financial institutions to conduct customer due diligence.

The recommendation requiring originator and beneficiary information to accompany wire transfers, helping ensure transparency in the movement of funds.

The recommendation requiring financial institutions to report suspicious transactions to the relevant national authority.

An approach requiring countries and institutions to identify, assess, and understand their money laundering and terrorist financing risks, and apply resources and controls proportionate to that risk.

Recommendation 24 addresses transparency and beneficial ownership of legal persons, such as companies, while Recommendation 25 addresses transparency and beneficial ownership of legal arrangements, such as trusts.

A list of jurisdictions subject to a call for action due to significant, unaddressed AML/CFT deficiencies, representing a more serious designation than the grey list.

A list of jurisdictions under increased monitoring due to identified strategic deficiencies in their AML/CFT frameworks, which they have committed to addressing.

An intergovernmental body that sets international standards for combating money laundering, terrorist financing, and proliferation financing.

It strengthened beneficial ownership transparency requirements for trusts and similar legal arrangements, bringing them broadly in line with the requirements for legal persons under Recommendation 24.

Most countries' AML/CFT laws are built around the FATF framework, so understanding it provides a common reference point for understanding AML/CFT requirements across different jurisdictions.

These designations indicate elevated money laundering or terrorist financing risk associated with that jurisdiction's financial system.

MONEYVAL, which covers Council of Europe member states and some other jurisdictions.

They provide practical, industry-informed guidance that helps translate high-level international standards into actionable practices for financial institutions.

Together, they establish standards, provide guidance, conduct assessments, and facilitate cooperation, forming the broader ecosystem that shapes AML/CFT expectations worldwide.

It provides a secure platform and framework for FIUs to share financial intelligence and best practices across borders.

Regional organizations that promote the implementation of FATF standards within their specific geographic regions, often conducting their own mutual evaluations.

A national agency responsible for receiving, analyzing, and disseminating suspicious activity reports and other financial intelligence to support AML/CFT efforts.

An independent annual ranking that assesses money laundering and terrorist financing risk levels across countries based on publicly available data.

An international body that sets global standards for bank supervision and regulation, including guidance relevant to sound AML/CFT risk management within banks.

An international network of Financial Intelligence Units that facilitates cooperation and information sharing among member countries.

An international body that monitors and makes recommendations about the global financial system, with an interest in risks, including financial crime, that could threaten financial stability.

To provide practical frameworks and standards that financial institutions can use to strengthen their AML/CFT programs, particularly in areas such as correspondent banking.

The IMF assesses AML/CFT frameworks as part of its broader financial sector assessments and provides technical assistance to member countries.

The World Bank provides technical assistance, research, and capacity-building support to help countries strengthen their AML/CFT frameworks.

A UN agency that provides technical assistance and supports international efforts against drug trafficking, organized crime, and related financial crime, including money laundering.

An association of global banks that develops AML/CFT guidance and best practices for the financial industry.

It facilitates international police cooperation, information sharing, and coordinated action against transnational financial crime and money laundering networks.

The UN has adopted conventions addressing money laundering, corruption, and organized crime, providing a foundational international legal framework for AML/CFT efforts.

They help extend the reach of FATF standards to countries and regions beyond FATF's direct membership, supporting broader global implementation.

Financial crime often crosses borders, so coordinated efforts among multiple international organizations help ensure a more consistent and effective global response.

These bodies play distinct but interconnected roles in the global AML/CFT landscape, and understanding their relationships provides a fuller picture of how international standards are developed and implemented.

Substantial fines, which can vary based on factors such as the severity of the violation, whether it was voluntarily disclosed, and the compliance program in place at the time.

Placing assets in which a sanctioned party has an interest into a blocked status, preventing their transfer, withdrawal, or use, though the assets are not confiscated.

The Office of Foreign Assets Control, operating under the U.S. Department of the Treasury.

A legal standard under which a person or entity can be held liable for a sanctions violation regardless of intent or knowledge that a violation occurred.

A program that broadly prohibits most transactions and dealings with an entire targeted country.

A broad authorization allowing a specific category of otherwise prohibited transactions without requiring individual application, publicly available for anyone who qualifies.

A program that targets specific designated individuals, entities, or sectors, rather than broadly restricting an entire country's economy.

An individual authorization granted to a particular person or entity for a specific transaction, requiring a direct application to OFAC, unlike a general license which applies broadly.

A proactive report made by a party to OFAC disclosing its own potential violation; it can generally result in a more favorable, reduced enforcement outcome compared to a violation discovered independently by OFAC.

A rule stating that an entity owned 50% or more, in aggregate, by one or more blocked persons is itself considered blocked, even if not separately listed on the SDN List.

OFAC sanctions generally restrict financial transactions and dealings with sanctioned parties or countries, while export controls specifically regulate the export of goods, technology, and services.

OFAC's primary sanctions list, identifying individuals and entities whose assets are blocked and with whom U.S. persons are generally prohibited from dealing.

Nearly all transactions and dealings, including transfers of funds, property, or services, unless specifically authorized by a license.

Because intent is not required to establish a violation, a party can face penalties even if it did not knowingly or willfully violate sanctions.

Sanctions lists are updated regularly, so ongoing screening helps ensure that new designations are identified even for existing customers and relationships.

No. U.S. companies and U.S. persons have been permanently exempted from CTA beneficial ownership reporting requirements.

No. Even for foreign reporting companies that remain subject to the CTA, U.S. persons are exempt from being reported as beneficial owners or company applicants.

Customer identification and verification, beneficial ownership identification and verification, understanding the nature and purpose of the relationship, and ongoing monitoring.

Internal policies, procedures, and controls; a designated compliance officer; ongoing employee training; and independent testing of the program.

It narrowed the definition of "reporting company" to include only entities formed under foreign law that have registered to do business in a U.S. state or Tribal jurisdiction, exempting all U.S.-formed entities.

FinCEN announced it would delete previously reported beneficial ownership information belonging to U.S. persons from its database.

It made the March 2025 exemption permanent, formally and finally removing the CTA beneficial ownership reporting requirement for U.S. companies and U.S. persons.

The Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Federal Reserve, among others depending on institution type.

Deliberately avoiding knowledge of facts that would otherwise establish wrongdoing; it is significant because courts and regulators can treat willful blindness as equivalent to actual knowledge in AML enforcement cases.

The individual designated to oversee a financial institution's BSA/AML compliance program, ensuring the institution meets its regulatory obligations.

The Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury responsible for administering the Bank Secrecy Act and serving as the U.S. financial intelligence unit.

Financial institutions must identify and verify the identity of beneficial owners of legal entity customers at the time a new account is opened.

A provision allowing the Treasury Secretary to designate a foreign jurisdiction, institution, or transaction type as a "primary money laundering concern" and impose special measures, such as enhanced recordkeeping or restrictions on correspondent accounts.

A provision allowing law enforcement to request that financial institutions search their records for accounts or transactions connected to suspected terrorists or money launderers.

A provision allowing financial institutions to voluntarily share information with each other, under a safe harbor, to help identify potential money laundering or terrorist financing.

A U.S. law requiring financial institutions to assist government agencies in detecting and preventing money laundering, primarily through recordkeeping and reporting requirements.

A U.S. law originally requiring most U.S. corporations, LLCs, and similar entities to report their beneficial ownership information to FinCEN.

A rule clarifying and strengthening customer due diligence requirements for financial institutions, including obtaining beneficial ownership information for legal entity customers.

A requirement that financial institutions implement procedures to verify the identity of customers opening new accounts.

OFAC administers and enforces economic and trade sanctions, while FinCEN focuses on administering the Bank Secrecy Act and serving as the U.S. financial intelligence unit.

A U.S. law enacted in 2001 following the September 11 terrorist attacks, which significantly expanded AML and counter-terrorist financing requirements.

1970.

Foreign reporting companies, meaning entities formed under the law of a foreign country that have registered to do business in a U.S. state or Tribal jurisdiction.

It introduced the most substantial changes to U.S. AML law in decades, including the original Corporate Transparency Act beneficial ownership reporting requirement and updated whistleblower and enforcement provisions.

Regulatory requirements can change substantially over time, and relying on outdated information about obligations such as CTA reporting could lead to incorrect compliance guidance or missed regulatory changes.

A Politically Exposed Person (PEP).

KYC provides the overarching principle of knowing your customer, CDD provides the standard baseline procedures to achieve that goal, and EDD provides an additional layer of scrutiny applied proportionally to higher-risk relationships.

More detailed information gathering, such as source of wealth verification, senior management approval, and more frequent ongoing monitoring.

Gaining insight into why the customer is opening the account and how they intend to use it, to establish a baseline for what constitutes normal activity.

Factors such as PEP status, high-risk geography, cash-intensive business type, or complex ownership structure.

Searching news and other public sources for negative information about a customer, supporting due diligence by identifying potential red flags not found in standard identity verification.

A change in a customer's actual risk profile over time that is not reflected in their current risk rating, occurring when periodic reassessment does not keep pace with changing circumstances.

A more rigorous level of due diligence applied to higher-risk customers or relationships, required when standard CDD is insufficient to adequately manage the identified risk.

The overall process of identifying and understanding a financial institution's customers to assess and manage risk.

The continuous process of monitoring a customer relationship over time, as opposed to due diligence performed only once at the start of the relationship.

A reduced level of due diligence applied to lower-risk customers or products, where the identified risk is low enough to justify a less intensive approach.

The origin of the specific funds involved in a particular transaction or account activity.

The origin of a customer's overall net worth or total assets, distinct from source of funds, which focuses on funds used in a specific transaction.

A classification, such as low, medium, or high risk, assigned to a customer based on their risk factors; it determines the intensity of due diligence and ongoing monitoring applied to that customer.

A specific occurrence, such as unusual transaction activity or a significant change in customer information, that prompts an immediate review of the customer relationship outside the standard review schedule.

Identifying and verifying the identity of the natural persons who own or control the entity, typically above a defined ownership percentage threshold.

SDD involves the least intensive level of scrutiny, standard CDD represents the baseline level, and EDD involves the most intensive, detailed level of scrutiny.

CDD is the specific set of procedures used to implement the broader KYC principle, including identifying, verifying, and understanding customers.

To confirm that the customer is who they claim to be, reducing the risk of identity fraud or the use of false identities to access the financial system.

Additional scrutiny may be warranted regarding the legitimacy of the relationship, source of funds, and the customer's connection to the jurisdiction where the account is held.

Formation documents, such as articles of incorporation, along with information identifying the entity's beneficial owners.

Government-issued identification, such as a passport or driver's license.

Cash transactions can be more difficult to trace and can more easily be used to disguise illicit proceeds compared to traceable electronic transactions.

Correspondent banking can expose an institution to the risks of a foreign bank's own customer base, which the institution cannot directly observe, warranting closer scrutiny.

Private banking often involves high-net-worth individuals, complex financial structures, and higher transaction values, all of which can carry elevated risk.

It can reveal reputational or legal issues, such as allegations of corruption, that may not be captured through standard identity or sanctions screening alone.

It provides evidence that due diligence decisions were made thoughtfully and consistently, supporting the institution's ability to demonstrate compliance during regulatory review.

Understanding overall wealth origin helps assess whether a customer's broader financial profile is consistent and legitimate, particularly for higher-risk relationships.

A customer's activity, circumstances, or associated risk factors can change, potentially warranting an updated risk rating and corresponding due diligence level.

Customer circumstances can change over time, and outdated information may no longer accurately reflect the customer's actual risk profile.

On a regular basis, commonly annually, though the appropriate frequency may vary depending on the institution's size and risk profile.

Internal policies, procedures, and controls; a designated compliance officer; ongoing employee training; and independent testing.

The overall framework of oversight and accountability for the compliance program; the board typically approves key policies and receives regular reporting on program effectiveness.

A periodic, objective evaluation of the AML compliance program's design and effectiveness, conducted independently of those who manage day-to-day compliance operations.

An organizational environment in which compliance and ethical behavior are genuinely valued and reinforced throughout the institution, not merely treated as a formal requirement.

Regular training covering relevant AML laws, regulations, internal policies, and how to recognize and report suspicious activity.

Overseeing the day-to-day implementation and effectiveness of the AML compliance program, ensuring the institution meets its regulatory obligations.

The risk assessment should directly inform how each pillar is designed and resourced, ensuring the program is appropriately tailored to the institution's actual risk profile.

Such a program is unlikely to be effectively implemented in practice, increasing the risk that real financial crime activity goes undetected despite formal documentation suggesting compliance.

The adequacy of policies and procedures, the effectiveness of transaction monitoring, training programs, and overall compliance with applicable regulations.

How the institution identifies, assesses, and mitigates money laundering and other financial crime risks, including specific processes for customer due diligence, monitoring, and reporting.

The pillars are interdependent, and weakness in one area, such as inadequate training, can undermine the effectiveness of other pillars, such as monitoring and reporting.

Regulatory developments, such as the CDD Rule, formally established customer due diligence, including beneficial ownership identification, as a distinct core requirement of an effective program.

Leadership commitment sets the tone for the entire organization, influencing whether compliance is treated as a genuine priority or merely a checkbox exercise.

Without adequate authority and resources, the compliance officer may be unable to implement necessary controls or escalate concerns effectively.

Risks, regulations, and the institution's own business can change over time, requiring the program to evolve accordingly to remain effective.

Different roles encounter different types of risk and responsibilities, so tailored training ensures each employee receives relevant, actionable guidance for their specific function.

Insufficient staffing or outdated technology can limit the program's ability to effectively detect and respond to financial crime risk.

Independence helps ensure an objective, unbiased assessment of the program, rather than a self-review that could overlook or minimize deficiencies.

Generic policies may not adequately address the institution's actual risks, potentially leaving gaps or imposing unnecessary burdens in areas of low risk.

Higher-risk customers are generally reviewed more frequently, while lower-risk customers may be reviewed on a longer periodic cycle.

Senior management and, often, the board should review and approve the overall methodology, ensuring it aligns with the institution's broader risk assessment.

A structured process of testing and reviewing an automated model's assumptions, logic, and outputs to confirm it is functioning accurately and as intended.

Assigning greater importance to certain risk factors within the overall scoring model; factors associated with historically higher risk, such as PEP status, may be weighted more heavily than lower-impact factors.

A structured methodology that assigns weighted values to various risk factors to calculate an overall risk score or rating for a customer.

A system that calculates customer risk ratings using predefined rules and algorithms; it typically offers greater consistency and efficiency compared to manual, judgment-based ratings.

A qualitative approach relies on judgment-based assessment of risk factors, while a quantitative approach uses numerical scoring and defined thresholds to calculate a rating.

The system may fail to capture nuanced or unusual circumstances that a human reviewer would recognize, potentially resulting in an inaccurate rating.

Higher risk carries a greater potential for undetected illicit activity, so more frequent review helps ensure the institution's understanding of the relationship remains current.

Risk ratings directly drive due diligence intensity, monitoring frequency, and resource allocation, so an inaccurate or poorly designed methodology can undermine the effectiveness of the entire compliance program.

Inconsistent application could result in similar customers being rated differently depending on where or how they were onboarded, undermining the reliability of the overall risk management framework.

Some situations involve context or information the automated model does not fully account for, requiring human judgment to adjust the rating appropriately.

The overall rating depends on how the model combines and weights individual factors, so the cumulative effect of multiple moderate factors, or the weight of one severe factor, can each drive the total score differently depending on the model's design.

Combining both approaches can capture the objectivity and consistency of quantitative scoring while still allowing for professional judgment on factors that are harder to quantify.

Validation helps confirm that the methodology is accurately identifying and rating risk as intended, and identifies any needed adjustments over time.

Key metrics such as SAR filing trends, audit findings, significant risks identified, and any regulatory concerns or enforcement actions.

A governance framework dividing risk management responsibilities across three levels: business operations, compliance oversight, and independent audit, each providing a distinct layer of risk control.

Providing high-level oversight and accountability, ensuring the program is adequately designed, resourced, and functioning effectively.

The institution's overall AML policy, risk assessment methodology, and, often, the appointment of the BSA/compliance officer.

Business units and front-line staff, who are directly responsible for identifying and managing risk in their day-to-day operations.

Providing oversight, guidance, and independent monitoring of the first line's risk management activities, including setting policies and standards.

Providing independent assurance by evaluating the effectiveness of both the first and second lines of defense.

Regulators expect genuine board-level accountability, and a disengaged board can result in a weaker overall compliance culture, increasing the likelihood of significant compliance failures and associated consequences.

Clear accountability helps ensure risks are identified and addressed at the appropriate level, preventing gaps where no one takes ownership of a particular risk.

A basic understanding allows the board to ask informed questions and provide meaningful oversight, rather than passively approving compliance matters without real scrutiny.

In cases involving significant or urgent criminal activity, an institution may proactively contact law enforcement in addition to its standard SAR filing obligation.

A technique that maps relationships between accounts, individuals, and entities to reveal connections that might not be apparent when reviewing a single account in isolation.

A software platform used to track, document, and manage investigations from initial alert through final disposition, supporting consistency and thorough recordkeeping.

An internal investigation is conducted by the institution itself to assess suspicious activity, while a referral to law enforcement involves formally providing information to authorities for their own independent investigation.

To gather sufficient information to determine whether the activity is genuinely suspicious and warrants a SAR filing or other action.

Staff who directly interact with the customer can provide valuable context about the relationship and any observed behavior that supports or contradicts the suspicion.

A well-documented investigation produces a clear, well-supported SAR narrative and demonstrates to regulators that the institution takes a rigorous, consistent approach to identifying and addressing suspicious activity.

Properly preserved evidence supports the credibility and usability of the investigation's findings, particularly if the matter is later referred to law enforcement or used in legal proceedings.

Suspicious activity often involves multiple connected accounts, so a broader review can reveal the full scope and pattern of the activity.

Premature conclusions can bias the remainder of the investigation, potentially causing an investigator to overlook contradictory evidence or reach an inaccurate final determination.

The identified risks guide decisions about customer due diligence procedures, transaction monitoring scenarios, staffing, and resource allocation across the program.

Customer risk, product and service risk, geographic risk, and delivery channel risk.

The risk associated with the types of customers an institution serves, such as PEPs, cash-intensive businesses, or customers in high-risk industries.

The risk associated with how products and services are delivered to customers; different channels can carry different risk levels due to varying degrees of direct customer interaction and verification.

The risk associated with the jurisdictions in which an institution operates or with which its customers have connections, considering factors such as AML/CFT regime strength.

The risk associated with specific products or services offered, such as wire transfers, correspondent banking, or private banking, which may carry different vulnerability levels to misuse.

A visual tool that plots risk factors according to their likelihood and potential impact, commonly used to summarize and communicate risk assessment results.

A structured evaluation of an institution's exposure to money laundering, terrorist financing, and other financial crime risks, used to inform the design of its compliance program.

Directing greater compliance resources and more intensive controls toward higher-risk areas identified in the risk assessment, rather than applying uniform controls across all areas regardless of risk.

Inherent risk is the level of risk present before considering any mitigating controls, while residual risk is the risk that remains after those controls have been applied.

A national or enterprise-wide assessment provides broader context on prevailing risks, which an individual institution should consider alongside its own specific risk factors when conducting its assessment.

Effective controls, such as monitoring and due diligence procedures, help mitigate identified risks, lowering the overall risk exposure from its inherent level.

A significant merger or acquisition, entry into a new market, launch of a new product, or identification of a significant new risk.

Senior management and, often, the board of directors, with support from the compliance function.

A sound risk assessment demonstrates that the institution's compliance program is appropriately tailored to its actual risk profile, rather than being generic or poorly informed.

It can result in under-controlling genuinely high-risk areas while over-controlling lower-risk areas, wasting resources and potentially missing real risk.

It identifies where an institution's greatest risks lie, allowing controls and resources to be appropriately tailored and prioritized.

Written documentation provides evidence of the methodology and conclusions used, supporting both internal governance and regulatory examination.

Different business lines may serve different customer types, offer different products, or operate in different geographies, each carrying distinct risk characteristics.

An institution's risk profile can change over time due to new products, customers, geographies, or emerging typologies, requiring the assessment to remain current.

Transactions in currency exceeding $10,000.

Yes, related suspicious transactions can generally be aggregated and described together within a single, comprehensive SAR narrative.

CTRs provide a routine record of large currency transactions regardless of suspicion, while SARs specifically flag activity that appears suspicious, together supporting a more complete financial intelligence picture.

No, a SAR should be filed based on a reasonable suspicion of illicit activity, not certainty that a crime has actually occurred.

The institution can face significant regulatory penalties, including fines and other enforcement action, for failing to meet its reporting obligations.

They could face significant civil or criminal penalties for violating confidentiality requirements associated with SAR filings.

A clear, detailed explanation of who, what, when, where, and why the activity is considered suspicious.

A legal protection shielding institutions and individuals from civil liability for filing a SAR in good faith, encouraging reporting without fear of being sued by the customer involved.

Deliberately breaking up transactions to stay under the CTR reporting threshold; it is itself illegal and reportable because it represents an intentional effort to evade legally required reporting.

Disclosing to a customer or other party that a SAR has been or will be filed regarding their activity; it is prohibited because it could allow the subject to evade detection or destroy evidence.

A follow-up SAR filed when previously reported suspicious activity continues, generally filed periodically to keep authorities updated on the ongoing pattern.

An exemption allowing certain qualifying customers to be excluded from routine CTR filing requirements, typically available to certain established, lower-risk commercial customers with regular, legitimate large cash activity.

A report filed by a financial institution documenting large cash transactions, providing a record used to detect potential money laundering or other illicit activity.

A report filed by a financial institution to alert law enforcement and regulators to activity that appears suspicious or potentially related to financial crime.

Generally within 15 days of the transaction.

Generally within 30 days of detecting the activity, with a possible extension of up to an additional 30 days if no suspect has been identified.

An alert or concern is escalated for investigation, findings are documented, and a determination is made regarding whether the activity meets the threshold for filing.

Financial institutions must retain copies of filed SARs and CTRs, along with supporting documentation, for a specified retention period.

SARs provide law enforcement with valuable financial intelligence that can support ongoing investigations or help identify new criminal activity.

Activity that has no apparent lawful purpose, is inconsistent with the customer's known business or profile, or otherwise appears designed to evade reporting requirements.

The BSA Officer or a similarly designated compliance leader with authority over SAR filing decisions.

A clear, thorough narrative helps law enforcement and analysts understand and act on the reported activity more effectively.

Timely filing ensures law enforcement receives potentially actionable information while it is still relevant and useful to an ongoing or developing investigation.

Regularly filing CTRs for known, legitimate businesses with predictable large cash needs, such as retailers, would add little investigative value while creating unnecessary filing burden.

Confidentiality protects the integrity of law enforcement investigations and prevents subjects of a SAR from learning they are under scrutiny.

Customer background and KYC information, transaction history, related account activity, and any other relevant context needed to assess the activity.

The determination made after reviewing an alert; the two general outcomes are that the alert is a false positive (no further action needed) or a true positive (warranting further investigation).

The process of adjusting monitoring scenario parameters, such as thresholds, to improve the accuracy and relevance of generated alerts.

Monitoring that looks for patterns of activity that deviate from a customer's typical behavior, rather than simply flagging transactions that exceed a fixed dollar threshold.

A testing method that reviews transactions falling just below the current alert thresholds, checking whether the system is missing potentially suspicious activity.

A more detailed review of a true positive alert, gathering additional information to determine whether the activity is actually suspicious and whether a report should be filed.

The process of reviewing customer transactions to identify potentially suspicious activity that may warrant further investigation or reporting.

An alert that, upon review, does not actually represent suspicious activity.

A retrospective review of past transactions, typically conducted after discovering a significant gap or deficiency in monitoring coverage, to identify any missed suspicious activity.

A predefined set of criteria or logic used to identify transactions or patterns that may indicate suspicious activity, automatically generating an alert when a transaction meets those criteria.

A scenario that flags activity exceeding a specific numerical threshold, such as a cash deposit over a certain dollar amount.

An alert that, upon review, does appear to represent potentially suspicious activity; it typically leads to a more detailed case investigation.

A notification generated when a transaction or pattern of activity matches a monitoring scenario, requiring review by an analyst.

To efficiently review large volumes of transactions and flag those that match defined patterns or criteria associated with potential money laundering or other financial crime.

To validate whether current monitoring thresholds are appropriately calibrated, or whether they may be missing activity that should have generated an alert.

Documentation provides a clear record of the analysis performed and the rationale for each disposition decision, supporting both internal quality control and regulatory examination.

A high volume of false positives consumes significant analyst time and resources without producing meaningful results, reducing overall program efficiency.

It provides an ongoing mechanism for detecting potentially illicit activity after the customer relationship has begun, complementing the upfront due diligence performed at onboarding.

If a monitoring gap existed for a period of time, a look-back review helps identify whether any suspicious activity during that period went undetected and unreported.

Customer behavior, typologies, and institutional risk profiles can change over time, so scenarios must be updated to remain effective and appropriately calibrated.

Generative AI can help produce an initial draft narrative based on case details, which an analyst can then review, refine, and finalize.

NLP can help quickly analyze large volumes of text to identify relevant negative information about a customer, reducing the manual effort required to review search results.

A model can be trained on past alerts labeled as true or false positives, helping it learn to predict the likely disposition of new alerts.

An unsupervised model can identify transactions or patterns that deviate significantly from normal behavior, without needing pre-labeled examples of suspicious activity.

A qualified analyst must review AI-generated content for accuracy and completeness, since the AI may not fully capture the nuance or specific facts of the case correctly.

Systematic errors in an AI model's outputs that unfairly favor or disadvantage certain groups; it is a concern because biased outcomes could result in unfair or inaccurate risk assessments.

Systematic errors in an AI model's outputs that unfairly favor or disadvantage certain groups; it is a concern because biased outcomes could result in unfair or inaccurate risk assessments.

A structured framework for overseeing the responsible development, deployment, and monitoring of AI systems, including policies, accountability, and risk management practices.

A structured framework for overseeing the responsible development, deployment, and monitoring of AI systems, including policies, accountability, and risk management practices.

A technique that identifies data points or patterns that differ significantly from expected norms, helping surface potentially suspicious activity that traditional rules might miss.

A technique that identifies data points or patterns that differ significantly from expected norms, helping surface potentially suspicious activity that traditional rules might miss.

Computer systems designed to perform tasks that typically require human intelligence, such as pattern recognition and decision-making, applied to help detect and prevent financial crime.

Computer systems designed to perform tasks that typically require human intelligence, such as pattern recognition and decision-making, applied to help detect and prevent financial crime.

A subset of AI in which systems learn patterns from data rather than following explicitly programmed rules, allowing performance to improve over time as more data is processed.

A subset of AI in which systems learn patterns from data rather than following explicitly programmed rules, allowing performance to improve over time as more data is processed.

The ability to understand and articulate how a model reached a particular output; it is important because regulators and institutions need to justify compliance decisions with clear reasoning.

The ability to understand and articulate how a model reached a particular output; it is important because regulators and institutions need to justify compliance decisions with clear reasoning.

A framework for identifying, assessing, and mitigating the risks associated with using models; it applies to AI/ML models because they, like any model, can produce inaccurate or biased outputs if not properly validated and monitored.

A framework for identifying, assessing, and mitigating the risks associated with using models; it applies to AI/ML models because they, like any model, can produce inaccurate or biased outputs if not properly validated and monitored.

A branch of AI focused on understanding and processing human language; it can be applied to tasks such as analyzing unstructured text data, including adverse media articles or transaction notes.

Supervised learning trains a model using labeled historical data with known outcomes, while unsupervised learning identifies patterns or anomalies in data without predefined labels.

Supervised learning trains a model using labeled historical data with known outcomes, while unsupervised learning identifies patterns or anomalies in data without predefined labels.

AI models can make errors or miss context that a human reviewer would catch, so unchecked reliance on AI outputs alone could lead to significant compliance failures.

AI and ML offer significant potential to improve detection accuracy and efficiency in an increasingly complex and high-volume financial crime landscape, making familiarity with these tools essential for modern AML professionals.

AI models can incorporate more complex patterns and context than simple threshold-based rules, potentially identifying genuinely suspicious activity more precisely.

If a model's decision-making process cannot be explained, it becomes difficult to verify that the model is functioning appropriately and fairly, or to justify its outputs during examination.

If a model's decision-making process cannot be explained, it becomes difficult to verify that the model is functioning appropriately and fairly, or to justify its outputs during examination.

Model performance can degrade or drift over time as underlying data and patterns change, so periodic validation helps ensure continued accuracy and reliability.

A model trained on biased or incomplete data can learn and replicate those same biases or blind spots in its outputs.

Average time to close an alert, or the ratio of true positives to total alerts generated.

To summarize historical alert volumes, SAR filing trends, or customer risk distribution across the institution.

By analyzing historical patterns, predictive models can help identify customers or transactions likely to represent emerging risk before a problem fully develops.

Measurable indicators used to track the performance and effectiveness of the compliance program over time.

Processing speed, data quality, and the need for specialized tools and expertise to effectively manage and interpret large data sets.

Extremely large and complex data sets that traditional data processing methods struggle to handle efficiently; modern analytics tools are increasingly designed to process and derive insights from such large volumes of data.

The process of examining data to identify patterns, trends, and insights that support financial crime detection and compliance decision-making.

The graphical representation of data, such as charts and graphs; it is valuable because it can make complex data easier to understand and communicate quickly.

A more advanced analytical approach that examines relationships across large networks of accounts and entities, building on basic link analysis to reveal broader patterns and connections.

A visual interface summarizing key compliance metrics and trends, typically displaying information such as alert volumes, SAR filings, and program performance indicators.

A centralized repository that consolidates data from multiple sources, providing a single, organized foundation for compliance analytics and reporting.

Descriptive analytics summarizes and explains what has already happened, while predictive analytics uses historical data to forecast what might happen in the future.

It ensures analysts and systems can access complete, consistent data, rather than working with fragmented information scattered across multiple disconnected systems.

Effective use of data analytics enables more efficient, proactive, and insightful financial crime detection, making it an increasingly essential skill in a data-driven compliance environment.

Analytics is only as reliable as the underlying data, so poor data governance can lead to inaccurate or misleading analytical results.

By identifying transaction patterns suggesting common control, such as addresses frequently transacting together, clustering can help build a more complete picture of an entity's overall activity.

Verification based on unique physical characteristics; common examples include facial recognition, fingerprint scanning, and voice recognition.

Specialized software that analyzes blockchain transaction data, enabling investigators to trace the flow of virtual assets and identify potentially illicit activity.

The process of confirming a person's identity through digital means; it has become increasingly important as more account opening and customer interactions occur remotely, without in-person verification.

Technology that authenticates identity documents, such as passports or driver's licenses, by analyzing security features and data, supporting remote onboarding without requiring in-person document review.

A technique that confirms a live person, rather than a photo or video, is present during verification; it is used to help prevent fraud involving fake or manipulated images.

A visual and analytical technique that maps the flow of funds across a network of blockchain transactions, helping identify relationships and patterns.

A technique that groups multiple blockchain addresses believed to be controlled by the same entity, based on patterns in transaction behavior.

A defined set of technical and procedural requirements for digital identity systems; standards help ensure different systems and institutions can reliably recognize and trust verified digital identities across different platforms and jurisdictions.

On-chain data refers to information recorded directly on the blockchain itself, while off-chain data refers to related information, such as exchange account details, stored outside the blockchain.

Identity spoofing involves using fake images, videos, or masks to impersonate someone else; liveness detection helps address this risk by confirming a real, live person is present during verification.

They provide tools and expertise to analyze blockchain data at scale, helping trace illicit funds and identify high-risk wallets or entities that would be difficult to detect through manual review alone.

While transaction details are often publicly visible, linking those transactions to real-world identities can still be challenging, though the underlying data itself is more accessible than many traditional financial records.

Without an in-person interaction, digital verification tools become the primary means of confirming that a prospective customer is genuinely who they claim to be.

As both digital onboarding and virtual asset activity continue to grow, proficiency with these tools has become essential for effectively identifying customers and detecting financial crime in an increasingly digital financial ecosystem.

A significant, unexplained change in transaction volume or pattern, or a change in the customer's beneficial ownership structure.

By continuously monitoring for relevant changes, pKYC can trigger a review as soon as a significant change occurs, rather than waiting for the next scheduled review date.

It reflects a broader trend of moving away from static, calendar-based compliance processes toward continuous, data-driven risk monitoring.

It continuously ingests relevant data, such as transaction activity or public record changes, to identify when a customer's profile may need to be updated.

Significant technology investment, data integration complexity, and the need to redesign existing review workflows and governance processes.

Transaction data, public records, sanctions and adverse media updates, and other relevant internal or external data sources.

It can help distribute review workload more evenly over time and focus review effort on customers where a genuine change has actually occurred, rather than reviewing every customer on a fixed schedule regardless of change.

A refresh triggered by a specific relevant event, such as a significant change in activity, rather than simply waiting for a fixed calendar date to arrive.

An approach that continuously monitors and updates customer information in near real time, rather than relying solely on fixed-interval periodic reviews.

Customer information can become outdated between scheduled reviews, meaning significant changes in risk could go unnoticed for an extended period.

Automation allows continuous monitoring and triggering of reviews across a large customer base without requiring manual tracking of every individual account.

Automated data integration, real-time monitoring capabilities, and analytics tools capable of identifying relevant changes as they occur.

Effective continuous monitoring depends on accurate, timely data flowing from multiple sources, so poor integration can undermine the entire approach.

It represents a more responsive, risk-sensitive approach to maintaining accurate customer information, addressing key limitations of traditional periodic review models.

Traditional periodic reviews can create large batches of reviews due at the same time, while pKYC spreads review triggers more naturally based on actual events, easing resource strain.

Many RegTech solutions are designed to be updated quickly in response to regulatory changes, helping institutions adapt more rapidly than they might with legacy systems.

RegTech solutions are often more modern, flexible, and data-driven, frequently leveraging advanced technologies such as AI, automation, and cloud computing, compared to older legacy systems.

Greater scalability, easier updates and maintenance, and often lower upfront infrastructure costs compared to traditional on-premises systems.

Integration challenges, reliance on vendor performance and security, and the risk that the solution may not be perfectly tailored to the institution's specific risk profile.

Assessing the vendor's security practices, regulatory track record, financial stability, and the solution's actual effectiveness for the institution's specific needs.

Technology specifically designed to help financial institutions and other regulated entities manage regulatory compliance more efficiently and effectively.

Technology used by regulators and supervisors themselves to more efficiently monitor and supervise regulated entities, representing the regulatory counterpart to RegTech used by industry.

The process of assessing and managing risks associated with third-party vendors; it is important because the institution remains ultimately responsible for compliance, even when relying on external technology.

A method allowing different software systems to communicate and share data with each other; it is relevant because it allows RegTech solutions to integrate more seamlessly with an institution's existing systems.

RegTech solutions can provide access to sophisticated compliance capabilities without requiring the institution to build and maintain that technology entirely on its own, potentially reducing overall compliance costs.

Functions such as customer due diligence, transaction monitoring, sanctions screening, regulatory reporting, and case management.

Even a sophisticated RegTech solution can only be as effective as the quality of the data it processes; poor data quality can undermine even the most advanced technology.

The growing volume and complexity of financial transactions and regulatory requirements make technology-driven solutions increasingly essential for efficient and effective compliance.

Third-party solutions can offer specialized expertise, faster implementation, and lower development costs compared to building custom technology internally.

Ongoing oversight helps ensure the solution continues to perform effectively and remains appropriately calibrated to the institution's evolving risk profile.

Batch processing can allow for more complex, resource-intensive analysis across larger data sets that may not be practical to run in real time.

Real-time monitoring allows faster detection and potential intervention, such as blocking a transaction before it completes.

Different business lines may use different core systems or data formats, complicating consistent integration and monitoring coverage across the organization.

Ensuring the vendor maintains strong data security and access controls, since sensitive customer and transaction data will be processed and stored outside the institution's own direct infrastructure.

The vendor's track record, system capabilities, scalability, integration compatibility, and ongoing support and update practices.

The technical process of setting up and adjusting monitoring rules and thresholds within the system, typically managed by a combination of compliance and technical staff.

A structured process of testing the system to confirm it is functioning as intended and effectively identifying the activity it is designed to detect.

A period during which the monitoring system is unavailable or not functioning; the institution should have a documented process to detect the outage, notify appropriate personnel, and take any necessary compensating measures.

The software platform and infrastructure that executes monitoring scenarios, generates alerts, and supports case management, functioning as the technical backbone of the monitoring process.

Reliable, well-structured data feeds and integration between the core banking system and the monitoring platform.

Real-time processing evaluates transactions as they occur, while batch processing evaluates groups of transactions collected over a set period, such as overnight.

It provides the workflow and documentation tools analysts use to review, investigate, and disposition alerts generated by the monitoring engine.

No matter how well-designed the monitoring methodology is, poor or unreliable underlying technology can undermine its ability to accurately and consistently detect suspicious activity.

The monitoring system's effectiveness depends entirely on receiving complete and accurate data, and integration issues can create gaps or inaccuracies in the underlying information.

As transaction volume and customer base grow, the system must be able to handle increased processing demands without degrading performance.

Cloud-based systems can offer greater scalability, easier updates, and potentially lower infrastructure costs compared to maintaining an on-premises system.

Emerging typologies, regulatory changes, and evolving technology capabilities require ongoing updates to keep the system's detection capabilities current.

A monitoring gap, even temporary, could allow suspicious activity to go undetected, so a clear contingency plan helps minimize this risk if the system becomes unavailable.

Documentation and approval provide a clear audit trail of changes and help ensure modifications are made thoughtfully, rather than informally or without proper oversight.

Initial validation confirms the system works as designed before relying on it, while periodic validation helps ensure it continues to perform effectively as conditions change over time.