ACAMS Certified AML FinTech Compliance Associate CAFCA Exam Guide 2026
Video
A challenger bank like Chime, Revolut, or N26 typically operates without a physical branch network. Which AFC risk is MOST elevated by this digital-only model?
Fintech Business Afc
Question · Easy
A 2026 CAFCA guide for ACAMS FinTech AML candidates covering BaaS, eKYC, crypto, sanctions, TM, official sources, traps, and free practice.
Blog
Under the Banking-as-a-Service (BaaS) model, who holds ultimate BSA/AML responsibility for monitoring transactions of a FinTech's end customers?
Question · Medium
Chapter 1: CAFCA Exam Overview and Study Strategy
1.1 CAFCA Exam Format, Official Domains, and Study Strategy
Study guide
In 2024 the FDIC issued a consent order against a small partner bank (e.g., Lineage Bank, Choice Bank) for AML/BSA failures tied to its FinTech program. What was the PRIMARY supervisory finding?
Finance Exam Prep Podcast
Listen on Spotify
Podcast
A Buy Now Pay Later (BNPL) provider such as Klarna, Afterpay, or Affirm offers split-pay installments at point of sale. Which AFC risk is MOST distinctive to the BNPL model versus traditional credit cards?
A payment processor (e.g., Stripe, Adyen, Square) acquires merchants and routes card transactions. Under FinCEN guidance, when does a payment processor itself become a Money Services Business (MSB)?
Question · Hard
Embedded finance lets a non-financial brand (e.g., a ride-share app) offer banking through a BaaS partner. Which CDD risk is MOST elevated when the end-user opens an account inside a non-financial app?
Chapter 2: Domain 1: FinTech Business Models and Their Vulnerabilities
2.1 Neobanks, Challenger Banks, and Digital Banking Models
Which is the BEST description of a digital wallet (e.g., Cash App, Venmo, Apple Cash)?
A peer-to-peer lending FinTech (LendingClub, Prosper) connects retail investors and borrowers. Which AFC concern is MOST acute in this model?
Which statement BEST captures why FinTech partner-bank ownership chains (the FinTech, its program manager, multiple BIN sponsors, and processors) raise AFC risk?
A neo-bank advertises 'open an account in 90 seconds.' From an AFC perspective, what is the MOST important compensating control for such speed?
2.2 Payment Processors, Gateways, and Merchant Acquirers
In digital onboarding, which is the BEST definition of eKYC (electronic KYC)?
Fintech Customer Risk
A FinTech onboarding flow asks the user to take a selfie and turn their head. What control is this implementing?
The four mandatory CIP data elements under USA PATRIOT Act Section 326 for an individual customer are:
Synthetic identity fraud is BEST described as:
2.3 Buy Now, Pay Later (BNPL) and Alternative Credit
Reading the NFC chip on an e-passport during onboarding provides what PRIMARY assurance over OCR-only document capture?
Behavioral biometrics in FinTech onboarding analyze:
Device fingerprinting at onboarding is MOST useful for detecting:
A FinTech sees an applicant whose phone IP geolocates to Lagos, Nigeria but whose stated address is Kansas City, Missouri. What is the MOST appropriate response?
2.4 BaaS Architecture, Embedded Finance, and Program Structures
Under the FinCEN CDD Rule, the beneficial ownership ownership-prong threshold for legal entity customers is:
A FinTech relies on a third-party identity verification vendor (e.g., Jumio, Onfido, Trulioo). Which statement BEST reflects regulatory expectations?
Under FinCEN guidance, a Virtual Asset Service Provider (VASP) operating in the US is generally regulated as:
Crypto Vasp
FATF Recommendation 16 — the 'Travel Rule' for virtual assets — generally requires originator and beneficiary information to be exchanged for VASP-to-VASP transfers above what FATF de minimis threshold?
Chapter 3: Domain 1: Financial Crime Types and the Regulatory Perimeter
3.1 Types of Financial Crime and Predicate Offences
OFAC sanctioned the Tornado Cash smart-contract mixer in August 2022. Which of the following BEST describes the current legal status as of 2026?
A New York-based crypto exchange must hold which state-specific authorization to operate?
The EU's Markets in Crypto-Assets Regulation (MiCA) creates a harmonized EU framework for crypto-asset issuers and Crypto-Asset Service Providers (CASPs). When did MiCA's CASP-related obligations generally begin to apply across the EU?
A blockchain analytics tool flags an inbound deposit at a VASP as having a 'mixer exposure' score of 92%. The compliance analyst should FIRST:
3.2 Licensing, Registration, Charters, and Regulatory Sandboxes
In decentralized finance (DeFi), which actor in a 'fully decentralized' protocol is MOST clearly identifiable as a regulated VASP under current FATF and FinCEN guidance?
A US VASP receives a wire instruction asking it to send Bitcoin to a wallet at a foreign exchange that does not respond to Travel Rule data requests. The compliant action is:
Which of the following is the BEST example of a 'darknet market' typology a crypto compliance team should monitor?
A US-based VASP discovers a customer wallet appears on the OFAC SDN List. The required action is:
3.3 Virtual Asset Service Provider (VASP) Framework & FinCEN MSB Rules
Stablecoins like USDC and USDT raise particular AFC concerns because they:
FATF's 'sunrise issue' in the Travel Rule refers to:
In real-time payment screening at a FinTech, a fuzzy match score is BEST used to:
Sanctions Screening
Which phonetic algorithm is COMMONLY used in sanctions screening to match name spellings that sound similar (e.g., 'Mohammed' vs. 'Muhammad')?
Chapter 4: Domain 1: Global AML Frameworks and Sources of Guidance
4.1 U.S. Regulatory Architecture: BSA, PATRIOT Act, and AMLA 2020
OFAC's '50 Percent Rule' (Revised Guidance) blocks the property of:
A FinTech's batch-screening job runs at 02:00 UTC. A new SDN designation is published at 14:00 UTC. What sanctions-control gap does this create?
Loading more…
