Question 90
A challenge panel will not accept a sign-off for inadequate authority of the MLRO or BSA officer based only on policy language. The institution says it can now give the designated officer clear escalation authority and access to oversight; an operating record is necessary. What would substantiate resolution of the identified AFC weakness?
- Reporting charter and recorded board escalations
- Validated customer risk-factor configuration and examples
- Escalation samples reconciled to customer service records
- Audit independence declarations and approved audit plan
Explanation
Correct Answer
A:Given the deficiency of inadequate authority of the MLRO or BSA officer as the distinguishing point, the record gives an auditable link between the expected remediation and observed practice. It is especially useful for verifying that inadequate authority of the MLRO or BSA officer has not continued under a different workflow.
Incorrect Answers
B:This record would help assess whether steps to use transparent ownership, geography, delivery channel, and activity inputs worked in a different scenario. The current test needs to establish whether measures to give the designated officer clear escalation authority and access to oversight corrected inadequate authority of the MLRO or BSA officer; the suggested artifact cannot show that directly.
C:The proposed evidence corresponds to oversight of first-line ownership failure in identifying and escalating risk. It would leave the actual remediation, give the designated officer clear escalation authority and access to oversight, without a clear operational test in this case.
D:That documentation is meaningful where measures to separate control design ownership from independent assurance testing are the expected control. The present issue is inadequate authority of the MLRO or BSA officer, and the reviewer needs records specifically tracing the chosen remedy.
Question 91
A case was escalated for concern about legal and financial consequences of facilitating predicate crime, but whether funds came from prohibited resource extraction remains unverified. The investigator must choose the most probative corroboration. Which evidence is most probative of the unresolved link?
- Permits and export records linked to payment flows
- Alert backlog segmented by customer and corridor risk
- Donor-to-beneficiary payment trail and recipient screening
- Case logs matched to training and supervisory records
Explanation
Correct Answer
A:This source can help answer the pivotal question of establishing whether funds came from prohibited resource extraction. With the need to establish whether funds came from prohibited resource extraction in view, A documented comparison to the transaction trail gives the investigator a stronger basis for disposition than transaction size or appearance by itself.
Incorrect Answers
B:Such records could help establish whether monitoring resources match actual exposure in a different investigation. Here the precise evidential question involves establishing whether funds came from prohibited resource extraction, so the suggested material would be indirect and may not resolve the decisive uncertainty.
C:The proposed source is most informative for a question about whether apparently lawful donations reached a prohibited recipient. The current case calls for establishing whether funds came from prohibited resource extraction; using this instead could leave the customer explanation largely untested.
D:This can support due diligence on whether staff acted on written escalation duties, a separate risk dimension. It is not the primary independent check for whether funds came from prohibited resource extraction, which is the missing link in the described funds movement.
Question 92
The board's stated tolerance for high-risk customers conflicts with business onboarding incentives that reward volume only. Which program weakness is most directly exposed?
- Non-operational risk appetite language
- Risk appetite not translated into commercial limits
- Unaccountable governance decisions
- Undocumented override of risk appetite
Explanation
Correct Answer
B:When examining the need to set customer acceptance thresholds and incentive-compatible exception approvals, the breakdown is evident in the facts of the case, not merely in a missing policy label. It requires the team to set customer acceptance thresholds and incentive-compatible exception approvals; a review can then use risk appetite limits and reviewed acceptance exceptions to confirm actual execution.
Incorrect Answers
A:This weakness would appear in a process requiring staff to express measurable exposure limits and prohibited activities for specific products. It is not the defining break in the present case, where the remediation must be designed to set customer acceptance thresholds and incentive-compatible exception approvals to address the observed behavior.
C:The corresponding consequence of this alternative would be evidenced through action register with deadlines and overdue escalation. The stated control problem has a different operating symptom, addressed by measures to set customer acceptance thresholds and incentive-compatible exception approvals.
D:That deficiency is typically owned by designated risk acceptance committee and rectified through measures to escalate the breach for formal acceptance or rejection at the authorized level. This case calls for steps to set customer acceptance thresholds and incentive-compatible exception approvals, meaning the alternative misses the central governance or process gap.
Question 93
A governance decision is needed for a task to mandate prompt reporting of suspicion under domestic requirements. The correct body must have the mandate to perform or oversee that task. Who should be responsible for performing the designated regulatory or governance role?
- Sector supervisor or designated national assessment body
- National competent authority designating reporting obligations
- National AML policy authority implementing FATF standards
- Bank enterprise risk assessment owner
Explanation
Correct Answer
B:The requested task is linked to the obligation to mandate prompt reporting of suspicion under domestic requirements, which falls within this function's described remit. In assessing the compliance duty to mandate prompt reporting of suspicion under domestic requirements, the responsibility is not interchangeable with external standards setters, private advisers, or unrelated enforcement functions.
Incorrect Answers
A:That organization may contribute relevant information but primarily handles combine sector data, known typologies, and mitigation capacity. It cannot replace the proper lead for mandate prompt reporting of suspicion under domestic requirements and its associated review record.
C:In assessing the separate duty to require documented assessment and proportionate mitigation of ML and TF exposure as opposed to the current duty to mandate prompt reporting of suspicion under domestic requirements, its proper remit concerns FATF Recommendation 1 on risk-based assessment and implementation of require documented assessment and proportionate mitigation of ML and TF exposure. It could supply input, but the named task is owned by the body or team responsible for mandate prompt reporting of suspicion under domestic requirements.
D:With the separate duty to update exposure assumptions, controls, and board reporting for the corridor as opposed to the current duty to mandate prompt reporting of suspicion under domestic requirements in view, the alternative is associated with risk model change record tied to official national findings for another kind of obligation. It is not the authority chiefly accountable for mandate prompt reporting of suspicion under domestic requirements in the circumstances described.
Question 94
An implementation team needs to standardize data types and apply tested transformation rules after identifying inconsistent identity attribute normalization. The team is reviewing the source attributes and data lineage on which the remedy depends. Which source or attribute is essential to correct performance?
- Canonical date format with provenance and validation rules
- Unique cross-system identity keys and entity merge decisions
- Source-to-target field mappings and branch-level counts
- Data publication dates and corporate event history
Explanation
Correct Answer
A:Reliable input information is a prerequisite for correcting inconsistent identity attribute normalization; standardize data types and apply tested transformation rules cannot compensate for unknown or misleading source attributes. An appropriate test is measure mismatches before and after identity normalization.
Incorrect Answers
B:The proposed source is appropriate for a tool tackling identifier collisions and entity resolution failure. It does not supply the information needed to validate standardize data types and apply tested transformation rules against the current observed issue.
C:With the difference between incomplete transaction data ingestion and inconsistent identity attribute normalization in view, that information underpins reconcile source population to monitoring population with exception alerts when the problem is incomplete transaction data ingestion. The case instead depends on canonical date format with provenance and validation rules, which is necessary to correct the stated failure and make the output auditable.
D:The alternative dataset is relevant to stale external ownership data. It would not provide the key input required for standardize data types and apply tested transformation rules in this case, so apparent model performance could still be misleading.
Question 95
Control mapping has identified facilitation of illicit natural-resource proceeds as a vulnerability associated with legal and financial consequences of facilitating predicate crime. The design must be proportionate and leave an audit trail. Which safeguard is the strongest match to the particular risk?
- Trade-document consistency checks for import finance
- Environmental-crime indicators in sectoral risk controls
- Risk-weighted capacity allocation and monitoring tuning
- Board oversight of material AFC remediation commitments
Explanation
Correct Answer
B:The safeguard targets facilitation of illicit natural-resource proceeds, the specific vulnerability present in this relationship or payment flow. When examining the exposure to facilitation of illicit natural-resource proceeds, it belongs at the stage where the risk arises, with exception handling and monitoring proportionate to the assessed exposure.
Incorrect Answers
A:That safeguard is appropriate for a setting where the exposure is laundering of customs-fraud profits via invoicing. This scenario instead exposes facilitation of illicit natural-resource proceeds; a control operating on the other mechanism would not be the most proportionate response.
C:When examining the distinction between exposure to high-risk activity concealed by inefficient alert volumes and exposure to facilitation of illicit natural-resource proceeds, the measure is more suited to limiting high-risk activity concealed by inefficient alert volumes. It does not directly test or prevent facilitation of illicit natural-resource proceeds in the described customer or transaction process, even if it might help elsewhere in the AFC program.
D:The alternative would mitigate risks involving unaddressed confidence concerns among funding partners, not the principal failure here. The relevant control design must be built around facilitation of illicit natural-resource proceeds, with appropriate evidence and exceptions.
Question 96
Independent testing has confirmed risk appetite not translated into commercial limits. Management agrees that restating the existing policy will not resolve the process breakdown. Which corrective measure most directly closes this gap?
- Escalate the breach for formal acceptance or rejection at the authorized level
- Set customer acceptance thresholds and incentive-compatible exception approvals
- Express measurable exposure limits and prohibited activities for specific products
- Assign owners, target dates, and escalation thresholds to decisions
Explanation
Correct Answer
B:The proposed intervention closes the specific gap in this case: risk appetite not translated into commercial limits. It should be implemented by board risk committee with business leadership, with risk appetite limits and reviewed acceptance exceptions used to check that the new control operates as designed.
Incorrect Answers
A:This intervention solves a different weakness, namely undocumented override of risk appetite. It leaves the current risk appetite not translated into commercial limits substantially unresolved because the broken process here requires set customer acceptance thresholds and incentive-compatible exception approvals.
C:Given the contrast between non-operational risk appetite language and risk appetite not translated into commercial limits as the distinguishing point, this approach is usually evidenced by product limits, breach triggers, and board-approved risk appetite, addressing non-operational risk appetite language. It is not a substitute for the targeted corrective action needed to resolve risk appetite not translated into commercial limits in this workflow.
D:The alternative may improve a different part of AFC governance, but it primarily tackles unaccountable governance decisions. The actual defect, risk appetite not translated into commercial limits, requires a different control intervention.
Question 97
A formal report says the organization complies with FATF suspicious transaction reporting principle by taking steps to mandate prompt reporting of suspicion under domestic requirements. The reviewer will accept only traceable proof of what occurred. What evidence should be available to demonstrate operational compliance?
- Suspicious transaction reports with recorded grounds for suspicion
- Sectoral risk assessment with evidence-based drivers
- Beneficial ownership data quality and verification plan
- Risk justification and approved simplified CDD procedure
Explanation
Correct Answer
A:When examining the compliance duty to mandate prompt reporting of suspicion under domestic requirements, this is the best operational audit trail because it captures the relevant control or decision. It can be reconciled to the duty to mandate prompt reporting of suspicion under domestic requirements and the mandate of national competent authority designating reporting obligations without mistaking guidance for proof.
Incorrect Answers
B:Given the separate duty to combine sector data, known typologies, and mitigation capacity as opposed to the current duty to mandate prompt reporting of suspicion under domestic requirements as the distinguishing point, such evidence is useful when checking whether combine sector data, known typologies, and mitigation capacity occurred. The scenario instead requires proof that the responsible team acted to mandate prompt reporting of suspicion under domestic requirements, so the proposed artifact would not show the relevant control or decision.
C:In assessing the separate duty to improve access to adequate, accurate, up-to-date ownership evidence as opposed to the current duty to mandate prompt reporting of suspicion under domestic requirements, this documentation is linked to FATF beneficial-ownership transparency expectations and work performed by national competent authority governing company transparency. It does not directly demonstrate the implementation of the obligation to mandate prompt reporting of suspicion under domestic requirements in this case.
D:With the separate duty to retain essential identification and apply relief only where permitted as opposed to the current duty to mandate prompt reporting of suspicion under domestic requirements in view, the record supports another process: retain essential identification and apply relief only where permitted. The reviewer needs evidence of work to mandate prompt reporting of suspicion under domestic requirements, and the proposed record would leave that operational requirement unproven.
Question 98
Operations are comparing pre- and post-fix outcomes after adopting a measure to standardize data types and apply tested transformation rules. The deficiency being repaired was inconsistent identity attribute normalization. Which outcome test would most directly detect a recurrence of the defect?
- Compare transaction totals and missing-field rates each cycle
- Challenge merged profiles against known distinct-person samples
- Sample recently changed firms for ownership accuracy
- Measure mismatches before and after identity normalization
Explanation
Correct Answer
D:When examining the technical failure of inconsistent identity attribute normalization, the validation should reproduce the original failure mode and measure the resulting control outcome. Its inputs should reflect canonical date format with provenance and validation rules, and the expected outcome is evidence that standardize data types and apply tested transformation rules has corrected inconsistent identity attribute normalization.
Incorrect Answers
A:Given the difference between incomplete transaction data ingestion and inconsistent identity attribute normalization as the distinguishing point, that exercise tests a different analytical risk, incomplete transaction data ingestion. The acceptance test for this case should measure the actual outcome of standardize data types and apply tested transformation rules, rather than a nearby but unrelated metric.
B:This would be useful when implementing build a mastered identifier with verified source lineage, but the key failure here is inconsistent identity attribute normalization. With the difference between identifier collisions and entity resolution failure and inconsistent identity attribute normalization in view, it may pass even if the present defect persists, so it is not the most probative test.
C:This check would reveal failures like stale external ownership data, not whether standardize data types and apply tested transformation rules corrects the problem in this case. The relevant validation must challenge inconsistent identity attribute normalization using canonical date format with provenance and validation rules.
Question 99
A recycling dealer receives wires from a company convicted of bribing municipal officials for collection contracts. Which distinct threat pattern is most consistent with the observed facts?
- Corruption as a predicate source of criminal proceeds
- Illegal logging proceeds mixed into legitimate sales
- Cyber extortion as the origin of suspect payments
- Human trafficking proceeds entering a service business
Explanation
Correct Answer
A:The key issue is the unresolved relationship, which requires establishing whether the inflows relate to improperly awarded contracts. That inquiry is consistent with the indicated financial-crime pattern and matters because it can expose placement of corruption proceeds in commercial accounts; an assessment should document evidence both for and against suspicion.
Incorrect Answers
B:The alternative addresses activity that might produce integration of environmental-crime income into sales and would require evidence about the lawful provenance of timber represented by the payments. Those are not the facts that drive this scenario, whose defining task is to establish whether the inflows relate to improperly awarded contracts.
C:When examining the distinction between exposure to mislabeling extortion-related transfers as procurement and exposure to placement of corruption proceeds in commercial accounts, that interpretation is associated with a different situation where investigators must establish whether the transfer followed an extortion demand. It would direct attention toward mislabeling extortion-related transfers as procurement, whereas this case principally calls for establishing whether the inflows relate to improperly awarded contracts; the signals should not be treated as interchangeable.
D:Given the distinction between exposure to commercial processing of exploitation-related payments and exposure to placement of corruption proceeds in commercial accounts as the distinguishing point, this typology would be worth testing when the issue is establishing whether payer and passenger patterns match exploitation referrals, leading to exposure from commercial processing of exploitation-related payments. The present facts instead call for establishing whether the inflows relate to improperly awarded contracts, so choosing it would send the investigation toward a different mechanism.
Question 100
Following a finding of risk appetite not translated into commercial limits, a committee approves the need to set customer acceptance thresholds and incentive-compatible exception approvals. Primary remediation responsibility is still unassigned. Which accountable function should lead the documented remediation?
- Designated risk acceptance committee
- Enterprise risk reporting and second-line challenge function
- Enterprise risk appetite policy owner
- Board risk committee with business leadership
Explanation
Correct Answer
D:In assessing the need to set customer acceptance thresholds and incentive-compatible exception approvals, primary accountability belongs with the function able to execute the described process repair. Here that means ensuring the responsible team can set customer acceptance thresholds and incentive-compatible exception approvals, with the result demonstrated by risk appetite limits and reviewed acceptance exceptions and challenged by appropriate assurance functions.
Incorrect Answers
A:This function has a remit connected with the duty to escalate the breach for formal acceptance or rejection at the authorized level, and the associated problem is undocumented override of risk appetite. The current repair requires the responsible team to set customer acceptance thresholds and incentive-compatible exception approvals, so it should not be allocated to a team without direct control over that work.
B:When examining the contrast between understated residual risk due to open deficiencies and risk appetite not translated into commercial limits, its normal responsibility would be addressing understated residual risk due to open deficiencies. It may advise or review here, but the accountable execution of measures to set customer acceptance thresholds and incentive-compatible exception approvals belongs in the process identified by this case.
C:That group is suited to producing product limits, breach triggers, and board-approved risk appetite for another control issue. In the present case ownership must support measures to set customer acceptance thresholds and incentive-compatible exception approvals and closure of risk appetite not translated into commercial limits, not an unrelated assurance task.