1.1 CAFCA Exam Format, Official Domains, and Study Strategy
Key Takeaways
The CAFCA exam has 60 multiple-choice questions, some of them unscored pretest items, and a 90-minute time limit (ACAMS Candidate Handbook).
ACAMS requires CAFCA candidates to answer at least 70% of the scored questions correctly, with no penalty for guessing.
The five CAFCA domains are weighted 20% governance, 20% due diligence, 25% payment screening and monitoring, 20% investigations, and 15% scaling.
The CAFCA credential is valid for one year and is renewed free each year with active ACAMS membership and two recertification credits.
CAFCA, the Certified AML FinTech Compliance Associate, is the FinTech certification in the ACAMS associate-level family. ACAMS launched it in December 2020 with the specialist consultancy FINTRAIL, and testing began in 2021. The programme pairs an eight-hour digital course with a proctored 90-minute exam. This guide is independent CAFCA practice by OpenExamPrep. It follows the five domains published in the ACAMS CAFCA Candidate Handbook, and every chapter maps to one or more of the handbook's numbered sub-topics.
Current exam facts
| Item | CAFCA detail (ACAMS sources) |
|---|---|
| Questions | 60 multiple-choice items; some are unscored pretest items that are not identified |
| Time | 90 minutes |
| Passing standard | At least 70% of the scored questions answered correctly |
| Guessing | No penalty; answer every item |
| Delivery | Pearson VUE test centre or Pearson VUE online proctoring |
| Language | English |
| Eligibility | No formal eligibility requirements |
| Scheduling window | Schedule and sit the exam within six months of ACAMS accepting the application |
| Standard package (private sector) | US$1,045; ACAMS membership is required to obtain and keep the credential |
| Retake | US$199; associate exams can be retaken after a 30-day wait |
| Validity | One year; recertify free each year with an active membership and two recertification credits |
Two details catch candidates out. First, the 70% applies to scored items only, so you cannot tell which questions count. Treat every item as live. Second, the practice exam runs on the ACAMS learning management system, while the real exam runs at Pearson VUE. Expect a different interface on exam day. Course materials are removed from the LMS once you sit the exam, so finish your notes beforehand.
The five official domains
| Domain | Weight | Approximate items out of 60 | What it tests |
|---|---|---|---|
| 1. Governance, Guidance, and Regulation | 20% | about 12 | FinTech types and vulnerabilities, crime types, licensing and sandboxes, risk management framework, data privacy, risk-based approach, guidance sources, bank relationships, insider threat, risk types |
| 2. Due Diligence Across Customer Types | 20% | about 12 | CIP, KYC, eKYC, CDD and EDD; ID verification; data sources and their reliability; device data; sanctions, PEP and fraud screening; risk ratings; onboarding fraud red flags |
| 3. Payment Screening and Transaction Monitoring | 25% | about 15 | Purpose of monitoring; payment screening; red flags; payment methods including crypto; alert investigation; audit trails; transaction risk characteristics; systems and thresholds; KPIs and OKRs |
| 4. Investigations, Inquiries, and Reporting | 20% | about 12 | Customer communication; evidence review; analytical bias; SARs and STRs; working with law enforcement, partners and regulators; law enforcement requests; partner terms of service |
| 5. Scaling Anti-Financial Crime Strategies | 15% | about 9 | New products and features; refreshing the risk assessment; triggers for review; record retention and data storage; outsourcing, RegTech and independent testing |
Because some items are unscored, the item counts are estimates only. Domain 3 carries the most weight, so payment screening and monitoring deserve the most practice time. Domains 4 and 5 together account for 35% of the exam. Candidates who only study onboarding and crypto often lose marks there.
How the exam asks questions
CAFCA is written for practitioners at an earlier career stage than CAMS. The questions are mainly scenarios. A FinTech product team wants to remove a control, a partner bank asks for data, an alert shows rapid pass-through, or a customer asks why a payment is held. The best answer is usually the one that:
- Applies a risk-based control rather than an absolute ban or no control at all.
- Keeps the firm's legal obligations intact. Outsourcing a task never outsources the responsibility for it.
- Records the decision so that an auditor or regulator can follow it later.
- Protects confidentiality. Suspicion and reporting are never disclosed to the customer.
- Escalates through the right owner, such as the MLRO, the bank partner, or law enforcement through proper channels.
The outline is jurisdiction-neutral, but it names real regimes, such as GDPR and CCPA in the privacy topic. This guide uses US, EU, UK and Asian rules as worked examples. On the exam, choose the principle the rules share, unless the question names a jurisdiction.
Building a study plan
- Read the chapters in domain order. Then reread Chapters 14 to 18, which cover alerts, investigations, reporting and scaling, because these are the most procedural topics.
- For every section, write one sentence explaining why the control exists. Associate exams reward understanding of purpose.
- Practise timing. Ninety minutes for 60 items is 1.5 minutes per question. Flag long scenarios and come back to them.
- Use the end-of-section quizzes, then the OpenExamPrep CAFCA practice bank, and then the ACAMS practice exam in the LMS.
Realistic exam scenario
A candidate who scored 64% on a practice test notices that most misses came from questions about customer offboarding calls and law enforcement production orders. Those topics sit in Domain 4, worth about 12 items. The best remedy is targeted review of investigations and reporting, not more reading on FinTech business models, which is already a strength.
Common exam traps
- Assuming a scaled score. ACAMS publishes the CAFCA standard as 70% of scored questions, not a scaled score.
- Studying an unofficial outline. Some third-party outlines invent domains such as "ethics" or "crypto 20%". Use the five handbook domains.
- Treating CAFCA as a crypto exam. Crypto appears inside payment methods and transaction risk, alongside cards, wallets, instant payments and aggregation.
A candidate asks how CAFCA is scored. Which statement matches ACAMS's published standard?
At least 70% of all 60 questions, including pretest items, must be correct
A scaled score of 75 on a 0-100 scale is required
At least 70% of the scored questions must be answered correctly
The pass mark is set after each test window from a curve of candidate results
Which CAFCA domain carries the largest weight in the official outline?
Governance, Guidance, and Regulation
Due Diligence Across Customer Types
Scaling Anti-Financial Crime Strategies
Payment Screening and Transaction Monitoring
A CAFCA holder wants to keep the credential active next year. What does ACAMS require?
Retaking the full exam every year at the standard retake fee
Active ACAMS membership plus two recertification credits each year
Nothing, because the credential never expires once it has been earned
Earning 60 credits over three years and paying a recertification fee
Sections you finish are checked off in the contents.