ACAMS Certified AFC Risk Manager (formerly Advanced CAMS-RM)

In the AFC (Anti-Financial Crime) Risk Management framework, what is the primary distinction between AFC and traditional AML?

• AAFC focuses only on cash transactions while AML covers all transactions
• BAFC is broader, covering AML, sanctions, fraud, and anti-bribery and corruption
• CAFC applies only to non-bank financial institutions
• DAFC replaces all prior AML obligations under the BSA

Under the Three Lines of Defense model, which line owns and manages risk in the day-to-day business activities?

• AFirst line (business and operations)
• BSecond line (compliance and risk)
• CThird line (internal audit)
• DFourth line (external regulators)

Which of the following best describes the role of the second line of defense in an AFC program?

• AConducting independent audits of the AML program
• BOwning customer onboarding and transaction execution
• CSetting risk policy, providing oversight, and challenging the first line
• DFiling SARs directly with FinCEN on behalf of the business

The 5th BSA pillar, added by the 2018 FinCEN CDD Final Rule, requires institutions to:

• AFile CTRs for all cash transactions over $5,000
• BMaintain risk-based CDD procedures including beneficial ownership identification
• CConduct independent testing every six months
• DDesignate a separate sanctions compliance officer

What is the key role of the Board of Directors in an AFC risk management program?

• AReviewing every SAR before filing
• BApproving the AFC risk appetite, framework, and receiving periodic reports
• CConducting transaction monitoring alert reviews
• DManaging OFAC screening false positives

Which document typically codifies the Board-approved tolerance for residual financial crime risk?

• AThe institution's AFC Risk Appetite Statement
• BThe annual SAR narrative
• CThe OFAC Sectoral Sanctions Identification list
• DThe FinCEN Form 111

Which of the following is a key governance principle when establishing the AFC compliance function?

• AThe AFC officer should report to the head of the business they oversee
• BThe AFC officer should have direct access to the Board and adequate independence
• CThe AFC officer must hold a CPA license
• DThe AFC officer must be a former regulator

Under FFIEC guidance, the institution-wide AFC risk assessment should be refreshed:

• AOnly when a new product is launched
• BAt minimum every five years
• CPeriodically, typically annually, and when material changes occur
• DOnly after a regulatory examination

Which of the following is the BEST description of the relationship between the institution's AFC risk appetite and product approvals?

• ARisk appetite is irrelevant to product approval decisions
• BProducts that exceed defined risk appetite require enhanced controls or escalation/reject…
• CAll new products automatically fall within risk appetite
• DRisk appetite only applies to existing products

Which AFC governance committee typically reviews material AFC issues, emerging risks, and remediation status?

• AThe Asset and Liability Committee (ALCO)
• BThe Financial Crime / AFC Risk Committee
• CThe Audit Committee on a daily basis
• DThe Operational Resilience Committee

Which of the following BEST defines inherent risk in an AFC risk assessment?

• AThe risk remaining after controls are applied
• BThe gross risk before considering the effectiveness of controls
• CThe residual risk reported to the Board
• DThe risk transferred via insurance

In a typical AFC risk assessment, residual risk is calculated as:

• AInherent risk multiplied by control effectiveness
• BInherent risk reduced by the effectiveness of controls
• CInherent risk plus control deficiencies
• DTotal transactions divided by SAR volume

Which of the following is a key input to determining inherent customer risk?

• AVolume of marketing emails sent to the customer
• BCustomer type, geography, products used, and transaction patterns
• CThe number of branches in the customer's home country
• DThe customer's last credit card payment date

What is materiality in the context of an AFC risk assessment?

• AThe total cost of the AFC program
• BThe threshold at which a risk is deemed significant enough to require Board attention or…
• CThe number of staff in compliance
• DThe volume of customer complaints

An institution rates its inherent ML risk in correspondent banking as 'High' and assesses control effectiveness as 'Strong'. Under a typical 5x5 heat map, the residual risk is most likely:

• ALow or Moderate-Low
• BAlways High regardless of controls
• CCritical / Severe
• DOutside risk appetite by definition

Which of the following is an example of a quantitative risk factor in an AFC enterprise-wide risk assessment?

• AThe tone at the top from the CEO
• BThe number of high-risk customers, SARs filed, and cross-border transaction volume
• CThe mood of the compliance team
• DThe brand reputation of the institution

During an enterprise risk assessment, which approach best ensures consistency across business units?

• AAllowing each business unit to design its own scoring scale
• BUsing a centralized methodology with standardized rating scales and definitions
• CHaving external auditors set the ratings
• DLetting the Board assign all risk ratings

An AFC risk assessment identifies residual risk in trade finance that exceeds the Board-approved risk appetite. The MOST appropriate first step is:

• AImmediately exit all trade finance business
• BDefine an action plan to enhance controls or, if not feasible, escalate for risk acceptan…
• CWait for the next regulatory exam to determine next steps
• DIgnore the result if revenue is strong

Which is a typical weakness in AFC risk assessments cited by regulators?

• AOver-reliance on FATF Recommendations
• BFailure to differentiate inherent and residual risk, or to document control effectiveness
• CUse of standardized rating scales
• DAnnual refresh frequency

Which framework is most commonly used as the methodological backbone for U.S. bank AFC risk assessments?

• AISO 31000
• BFFIEC BSA/AML Examination Manual
• CISACA COBIT
• DNIST CSF

Customer Identification Program (CIP) requirements derive primarily from:

• AFATF Recommendation 16
• BUSA PATRIOT Act Section 326
• COFAC General License 8
• DSEC Rule 17a-4

Under the 2018 FinCEN CDD Final Rule, beneficial ownership must be identified for legal entity customers using:

• AA 10% equity prong and a control prong
• BA 25% equity prong and a control prong (one individual with significant management respon…
• COnly a 51% equity prong
• DA 5% equity prong only

Which of the following is the MOST important factor that should trigger Enhanced Due Diligence (EDD) at onboarding?

• AThe customer's preferred branch location
• BCustomer is a foreign Politically Exposed Person (PEP)
• CThe customer requested mobile banking
• DThe customer has multiple email addresses

Which of the following best distinguishes Standard Due Diligence (SDD) from Enhanced Due Diligence (EDD)?

• ASDD is required only for businesses; EDD only for individuals
• BSDD applies to lower-risk customers; EDD applies to higher-risk customers and adds depth…
• CEDD is only used for sanctions screening
• DSDD requires quarterly reviews; EDD requires monthly reviews

Under FATF guidance, immediate family members and close associates of foreign PEPs:

• AAre not subject to PEP-related EDD
• BShould also be treated as PEPs for risk purposes
• COnly need standard due diligence
• DAre exempt if they live in a different country

Which of the following customer types is generally considered higher inherent risk for money laundering?

• AA long-standing salaried domestic individual customer
• BA Money Service Business (MSB) handling cross-border remittances
• CA US Treasury customer account
• DA SIPC-insured retail brokerage account

A bank is onboarding a charity that operates in a FATF high-risk jurisdiction. Which BEST describes the appropriate response?

• ADecline regardless of mitigation
• BApply EDD: verify governance, source of funds, beneficiaries, and consider enhanced monit…
• CApply only standard CIP
• DRefer to OFAC for a license before doing anything

Customer risk rating models should be:

• AStatic — set once at onboarding
• BDynamic — refreshed on a defined cadence and on event-driven triggers
• CSet only by relationship managers
• DSolely based on customer self-disclosure

Which of the following is a typical EDD measure?

• AReducing the number of identity verifications
• BObtaining source of wealth and source of funds documentation
• CSkipping ongoing monitoring
• DRemoving the customer from screening lists

Under the U.S. Corporate Transparency Act (CTA), beneficial ownership reporting to FinCEN by reporting companies has been:

• AFully and uneventfully implemented since 2022
• BSubject to legal challenges and enforcement has been stayed/limited as of late 2024
• CRepealed by Congress in 2023
• DReplaced by the SEC Form 10-K

Private banking is generally considered higher inherent risk because of:

• ALow transaction values
• BHigh-net-worth client base, complex structures, cross-border activity, and confidentialit…
• CMandatory cash-only operations
• DStatutory exemption from CDD

Correspondent banking risk is most heightened for which of the following?

• ADomestic-to-domestic correspondent accounts within the same country
• BForeign correspondent accounts with respondents in higher-risk jurisdictions
• CInternal cash management transfers
• DCustodial-only relationships

Which jurisdictions are classified by FATF as 'subject to a call for action' (the highest-risk tier)?

• AAll EU member states
• BJurisdictions on the FATF black list (currently includes DPRK, Iran, Myanmar)
• CAll offshore financial centers
• DJurisdictions with corporate income tax under 15%

Section 311 of the USA PATRIOT Act allows the Secretary of the Treasury to designate jurisdictions, institutions, or transactions as:

• AApproved partners
• BOf primary money laundering concern, allowing imposition of special measures
• CTax-exempt under FATCA
• DExempt from CDD

Non-face-to-face onboarding (e.g., fully digital account opening) typically:

• ACarries no incremental ML risk
• BCarries higher channel risk, requiring stronger ID verification (biometrics, document liv…
• CIs prohibited under the BSA
• DIs permitted only for low-balance accounts

Which of the following is a higher inherent geographic risk indicator for a customer?

• AHeadquartered in a FATF-compliant jurisdiction
• BSignificant operations in OFAC sanctioned or FATF high-risk jurisdictions
• CAll directors live in the same city
• DAudited by a Big Four firm

Trade finance is considered higher inherent risk because of:

• ACash-only settlement
• BComplex documentation, multiple intermediaries, and TBML typologies (over/under-invoicing…
• CSimplicity of underlying contracts
• DMandatory daily reporting to FATF

Channel risk in AFC risk assessment specifically refers to:

• AThe risk that ATMs run out of cash
• BThe delivery channel through which products are offered (face-to-face, online, agent, mob…
• CThe marketing channel used to attract customers
• DThe audit channel for findings escalation

Which of the following is the MOST appropriate risk-based mitigant for a high-risk product such as private banking with significant cross-border PEP exposure?

• AEliminate the product line immediately
• BApply layered EDD, dedicated relationship oversight, enhanced TM scenarios, and senior ap…
• CApply only standard CDD
• DCease all cross-border activity globally

Which channel is typically associated with the highest synthetic identity fraud and AFC risk?

• AIn-branch onboarding with photo ID verification
• BOnline/mobile self-service onboarding with weak document and biometric verification
• COnboarding via an in-house wealth advisor
• DOnboarding by a centralized in-person commercial team

The OFAC '50% Rule' provides that:

• A50% of all transactions must be reported to OFAC
• BEntities owned 50% or more, individually or in the aggregate, by SDNs are themselves bloc…
• COnly 50% of an SDN's funds are blocked
• DSanctions apply only after 50 days

Which of the following is an example of sectoral sanctions rather than full blocking sanctions?

• ASDN designation of an individual
• BOFAC Sectoral Sanctions Identification (SSI) list (e.g., Russia Directives 1-4)
• CUN Security Council asset freeze
• DUK OFSI consolidated list designation

Which of the following watchlists is most commonly part of a multi-list sanctions screening setup?

• AFBI Most Wanted only
• BOFAC SDN, EU Consolidated, UK OFSI, UN Consolidated, and internal lists
• CSEC EDGAR filings
• DFATCA participating institutions

Which screening technique improves recall when names are spelled differently or transliterated?

• AExact match only
• BFuzzy matching including phonetic algorithms (e.g., Soundex, Metaphone) and Levenshtein e…
• CManual review only
• DCase-sensitive substring matching

In sanctions screening governance, the threshold setting (e.g., name match score cutoff) should be:

• ASet arbitrarily by IT
• BTuned and validated through documented testing, governance approval, and periodic review
• CMaximized to 100% always
• DSet by the relationship manager

NYDFS Part 504 requires covered institutions to:

• AFile monthly OFAC reports
• BAnnually certify the effectiveness of transaction monitoring and sanctions filtering prog…
• COutsource sanctions screening to OFAC
• DReport all alerts to NYDFS in real time

A typical sanctions false-positive ratio target after tuning is in the range of:

• A50%-70%
• B95%-99% (only 1-5% of alerts are true matches)
• CBelow 10%
• DAlways 100%