Question 140
Management says that conflating inherent risk with residual risk has been addressed through work to score exposure before controls, then separately evaluate control effectiveness. The reviewer must independently verify how the revised control performed. What artifact would an independent reviewer need to test operating effectiveness?
- Inherent-risk, control-effectiveness, and residual-risk worksheets
- Validated customer risk-factor configuration and examples
- End-to-end sanctions test cases and gap ratings
- Agent and corridor data supporting recalculated exposure
Explanation
Correct Answer
A:Regarding the requirement to score exposure before controls, then separately evaluate control effectiveness when evaluating conflating inherent risk with residual risk in this assurance evidence decision, reviewers can trace a real process outcome through this evidence. It is aligned with the commitment to score exposure before controls, then separately evaluate control effectiveness and lets the institution determine whether the weakness, conflating inherent risk with residual risk, persists.
Incorrect Answers
B:When examining the contrast between customer risk assessment that ignores material exposure drivers and conflating inherent risk with residual risk, that documentation is meaningful where measures to use transparent ownership, geography, delivery channel, and activity inputs are the expected control. The present issue is conflating inherent risk with residual risk, and the reviewer needs records specifically tracing the chosen remedy.
C:Given the contrast between incomplete sanctions control effectiveness assessment and conflating inherent risk with residual risk as the distinguishing point, the artifact tests a different process led by sanctions risk assessment and control assurance team. It does not adequately demonstrate that conflating inherent risk with residual risk is now controlled, even if it could support wider AFC assurance.
D:In assessing the contrast between poor business-specific risk identification and conflating inherent risk with residual risk, this record would help assess whether steps to assess agent networks, destinations, volumes, and product vulnerabilities worked in a different scenario. The current test needs to establish whether measures to score exposure before controls, then separately evaluate control effectiveness corrected conflating inherent risk with residual risk; the suggested artifact cannot show that directly.
Question 141
A risk owner is designing safeguards against integration of environmental-crime income into sales in cases associated with illegal logging proceeds mixed into legitimate sales. Broad restrictions on unrelated customers would not address the particular weakness. Which safeguard most directly addresses this exposure?
- Supply-chain legitimacy checks for high-risk commodities
- Merchant underwriting and scam-complaint escalation
- Trade-document consistency checks for import finance
- Trafficking typology review across merchant and account data
Explanation
Correct Answer
A:The safeguard targets integration of environmental-crime income into sales, the specific vulnerability present in this relationship or payment flow. Given the exposure to integration of environmental-crime income into sales as the distinguishing point, it belongs at the stage where the risk arises, with exception handling and monitoring proportionate to the assessed exposure.
Incorrect Answers
B:The measure is more suited to limiting collection of fraud receipts through merchant accounts. It does not directly test or prevent integration of environmental-crime income into sales in the described customer or transaction process, even if it might help elsewhere in the AFC program.
C:In assessing the distinction between exposure to laundering of customs-fraud profits via invoicing and exposure to integration of environmental-crime income into sales, the alternative would mitigate risks involving laundering of customs-fraud profits via invoicing, not the principal failure here. The relevant control design must be built around integration of environmental-crime income into sales, with appropriate evidence and exceptions.
D:That safeguard is appropriate for a setting where the exposure is commercial processing of exploitation-related payments. This scenario instead exposes integration of environmental-crime income into sales; a control operating on the other mechanism would not be the most proportionate response.
Question 142
A sanctions team lowers a product's residual risk solely because a vendor claims its screening tool is highly accurate. Which defect should be recorded in the AFC program assessment?
- Poor business-specific risk identification
- Customer risk assessment that ignores material exposure drivers
- Conflating inherent risk with residual risk
- Unsupported control-effectiveness assumption
Explanation
Correct Answer
D:When examining the need to validate screening performance before applying mitigation credit, the breakdown is evident in the facts of the case, not merely in a missing policy label. It requires the team to validate screening performance before applying mitigation credit; a review can then use independent test results and approved effectiveness scoring to confirm actual execution.
Incorrect Answers
A:Given the contrast between poor business-specific risk identification and unsupported control-effectiveness assumption as the distinguishing point, the corresponding consequence of this alternative would be evidenced through agent and corridor data supporting recalculated exposure. The stated control problem has a different operating symptom, addressed by measures to validate screening performance before applying mitigation credit.
B:In assessing the contrast between customer risk assessment that ignores material exposure drivers and unsupported control-effectiveness assumption, that deficiency is typically owned by customer risk-scoring methodology lead and rectified through measures to use transparent ownership, geography, delivery channel, and activity inputs. This case calls for steps to validate screening performance before applying mitigation credit, meaning the alternative misses the central governance or process gap.
C:This weakness would appear in a process requiring staff to score exposure before controls, then separately evaluate control effectiveness. It is not the defining break in the present case, where the remediation must be designed to validate screening performance before applying mitigation credit to address the observed behavior.
Question 143
An AFC reviewer is assessing 2 distinct situations. Situation 1: A regulatory review finds a requirement to identify the domestic legal measures giving effect to relevant UN obligations, with a remit assigned to government body responsible for sanctions implementation. Situation 2: A regulatory review finds a requirement to apply applicable asset-freeze and non-availability restrictions through domestic law, with a remit assigned to national sanctions competent authority implementing UN designations. Which frameworks correctly govern at least one of the stated issues? Choose TWO.
- Local AML obligations within group minimum standards
- UN targeted financial sanctions implementation
- UN Counter-Terrorism Committee support and assessment functions
- Binding UN Security Council measures implemented by states
Explanation
Correct Answers
B:For situation 2, the decisive feature is the kind of obligation imposed, which requires the responsible party to apply applicable asset-freeze and non-availability restrictions through domestic law. It is distinguished by the responsible function, national sanctions competent authority implementing UN designations, and by the records used to demonstrate compliance.
D:For situation 1, this is the most direct governing concept because the required response is to identify the domestic legal measures giving effect to relevant UN obligations. The accountability of government body responsible for sanctions implementation and the expected evidence, domestic sanctions instrument and effective-date mapping, clarify its practical scope.
Incorrect Answers
A:In assessing the separate duty to apply local law while setting additional group controls where lawful as opposed to the current duty to identify the domestic legal measures giving effect to relevant UN obligations, the alternative is associated with local AML obligations within group minimum standards and the duty to apply local law while setting additional group controls where lawful. With the separate duty to apply local law while setting additional group controls where lawful as opposed to the current duty to identify the domestic legal measures giving effect to relevant UN obligations in view, in this item, situation 1 calls for action to identify the domestic legal measures giving effect to relevant UN obligations; situation 2 calls for action to apply applicable asset-freeze and non-availability restrictions through domestic law. Regarding the duty to identify the domestic legal measures giving effect to relevant UN obligations while considering local AML obligations within group minimum standards in this regulatory framework decision, it does not perform the particular principle role tested by these cases.
C:The alternative is associated with UN Counter-Terrorism Committee support and assessment functions and the duty to use official UN counter-terrorism material while checking national implementing duties. Given the separate duty to use official UN counter-terrorism material while checking national implementing duties as opposed to the current duty to identify the domestic legal measures giving effect to relevant UN obligations as the distinguishing point, in this item, situation 1 calls for action to identify the domestic legal measures giving effect to relevant UN obligations; situation 2 calls for action to apply applicable asset-freeze and non-availability restrictions through domestic law. Regarding the duty to identify the domestic legal measures giving effect to relevant UN obligations while considering UN Counter-Terrorism Committee support and assessment functions in this regulatory framework decision, it does not perform the particular principle role tested by these cases.
Question 144
A new liveness check blocks a large number of legitimate older users while fraud detection barely improves. What is the most important defect in the tool or data flow?
- Unvalidated friction from uniform extra screening
- Excessive customer friction unrelated to risk
- Biometric friction and unequal error impact
- OCR extraction mistaken for document authentication
Explanation
Correct Answer
C:Given the proposed capability of calibrate checks and provide secure alternative verification routes as the distinguishing point, the observed system behavior is consistent with the specifically identified control defect. The relevant remedy is calibrate checks and provide secure alternative verification routes, backed by reliable false rejection rates across relevant customer groups and validation through evaluate legitimate-user failures and fraud capture together.
Incorrect Answers
A:The alternative would explain a setting that needs customer risk segmentation and answer usefulness data. The present tool's failure is different and should instead be tested through evaluate legitimate-user failures and fraud capture together, making this diagnosis less defensible.
B:When examining the competing solutions of apply proportionate verification pathways with documented exceptions and calibrate checks and provide secure alternative verification routes, that defect is most directly corrected by apply proportionate verification pathways with documented exceptions, whose inputs include risk tier and completion-stage telemetry. Here the observed behavior calls for calibrate checks and provide secure alternative verification routes, so the alternative would misdirect the technical fix.
D:This problem is normally investigated with use document authenticity checks and trusted issuer verification where available and validated through challenge the system with forged but text-readable documents. Those activities address a different failure mode; the case requires calibrate checks and provide secure alternative verification routes supported by false rejection rates across relevant customer groups.
Question 145
A small firm remits large amounts to a cybercriminal-controlled wallet after a ransomware incident but reports them as software purchases. What is the most defensible risk characterization at this stage?
- Corruption as a predicate source of criminal proceeds
- Human trafficking proceeds entering a service business
- Cyber extortion as the origin of suspect payments
- Customs fraud as an underlying proceeds-generating offense
Explanation
Correct Answer
C:This characterization follows from the particular flow and relationships described, especially the need to establish whether the transfer followed an extortion demand. If substantiated, the resulting vulnerability is mislabeling extortion-related transfers as procurement; investigators should separate the alert from proof of the underlying offense.
Incorrect Answers
A:When examining the distinction between exposure to placement of corruption proceeds in commercial accounts and exposure to mislabeling extortion-related transfers as procurement, the alternative addresses activity that might produce placement of corruption proceeds in commercial accounts and would require evidence about whether the inflows relate to improperly awarded contracts. Those are not the facts that drive this scenario, whose defining task is to establish whether the transfer followed an extortion demand.
B:Given the distinction between exposure to commercial processing of exploitation-related payments and exposure to mislabeling extortion-related transfers as procurement as the distinguishing point, that interpretation is associated with a different situation where investigators must establish whether payer and passenger patterns match exploitation referrals. It would direct attention toward commercial processing of exploitation-related payments, whereas this case principally calls for establishing whether the transfer followed an extortion demand; the signals should not be treated as interchangeable.
D:With the distinction between exposure to laundering of customs-fraud profits via invoicing and exposure to mislabeling extortion-related transfers as procurement in view, the relevant clue for this alternative would be the need to establish whether the goods' declared origins agree with shipping evidence. No comparable fact is central to this case; the key unresolved link is establishing whether the transfer followed an extortion demand, making the proposed characterization weaker.
Question 146
An internal audit identifies unsupported control-effectiveness assumption in a process whose remedial ownership sits with sanctions control validation and risk-assessment owners. The reviewer requires an executable, testable correction. Which change best addresses the stated compliance-program problem?
- Score exposure before controls, then separately evaluate control effectiveness
- Validate screening performance before applying mitigation credit
- Evaluate end-to-end screening, disposition, and list governance
- Assess each relevant threat separately and reconcile shared controls
Explanation
Correct Answer
B:In assessing the deficiency of unsupported control-effectiveness assumption, the correction belongs to the deficient operational or governance process rather than an unrelated control. It reduces unsupported control-effectiveness assumption when sanctions control validation and risk-assessment owners implements it and collects independent test results and approved effectiveness scoring.
Incorrect Answers
A:This approach is usually evidenced by inherent-risk, control-effectiveness, and residual-risk worksheets, addressing conflating inherent risk with residual risk. It is not a substitute for the targeted corrective action needed to resolve unsupported control-effectiveness assumption in this workflow.
C:This intervention solves a different weakness, namely incomplete sanctions control effectiveness assessment. It leaves the current unsupported control-effectiveness assumption substantially unresolved because the broken process here requires validate screening performance before applying mitigation credit.
D:When examining the contrast between narrowly scoped enterprise financial-crime risk inventory and unsupported control-effectiveness assumption, the proposed step is appropriate when narrowly scoped enterprise financial-crime risk inventory is observed. The case instead concerns unsupported control-effectiveness assumption; the alternative would not repair the particular failing in time or at the correct control point.
Question 147
An implementation review is assessing binding UN Security Council measures implemented by states. The specifically designated accountable function is government body responsible for sanctions implementation, and the review will check domestic sanctions instrument and effective-date mapping to determine whether the required activity occurred. Which practical step best translates the principle into a functioning control?
- Identify the domestic legal measures giving effect to relevant UN obligations
- Check applicable designations, prohibitions, and the end user before processing
- Apply applicable asset-freeze and non-availability restrictions through domestic law
- Map EU-level requirements and each relevant member state's applicable rules
Explanation
Correct Answer
A:Here the appropriate implementation follows the regulatory or governance remit of government body responsible for sanctions implementation. It creates concrete action on the problem, with domestic sanctions instrument and effective-date mapping available to demonstrate completion.
Incorrect Answers
B:With the separate duty to check applicable designations, prohibitions, and the end user before processing as opposed to the current duty to identify the domestic legal measures giving effect to relevant UN obligations in view, this intervention relates to consignee screening and end-use assessment record in a separate regulatory setting. It cannot substitute for identify the domestic legal measures giving effect to relevant UN obligations here because the scenario involves a different obligation and authority.
C:That step is appropriate for an obligation involving UN targeted financial sanctions implementation. In this case the task is identify the domestic legal measures giving effect to relevant UN obligations, and carrying out the alternative would not satisfy the identified requirement.
D:Given the separate duty to map EU-level requirements and each relevant member state's applicable rules as opposed to the current duty to identify the domestic legal measures giving effect to relevant UN obligations as the distinguishing point, the alternative concerns a different risk overseen by EU and national competent AML supervisory authorities. It would not implement the specific requirement in the case, which requires the responsible party to identify the domestic legal measures giving effect to relevant UN obligations and an associated record.
Question 148
Risk testing has demonstrated biometric friction and unequal error impact. Engineering must adjust the affected control instead of merely accepting the false output. What technical change would best address the described control gap?
- Apply proportionate verification pathways with documented exceptions
- Pilot targeted risk-based questions and measure their control value
- Use authorized issuer or trusted reference verification checks
- Calibrate checks and provide secure alternative verification routes
- Use presentation-attack-resistant liveness verification and review
Explanation
Correct Answer
D:The improvement addresses biometric friction and unequal error impact by changing the relevant detection, verification, or governance capability. It depends on false rejection rates across relevant customer groups, and evaluate legitimate-user failures and fraud capture together provides a practical acceptance criterion.
Incorrect Answers
A:The alternative is useful for excessive customer friction unrelated to risk, but it acts on a different technical mechanism. When examining the difference between excessive customer friction unrelated to risk and biometric friction and unequal error impact, correcting the stated weakness requires calibrate checks and provide secure alternative verification routes and dependable false rejection rates across relevant customer groups.
B:When examining the difference between unvalidated friction from uniform extra screening and biometric friction and unequal error impact, that improvement can be tested through measure risk reduction versus completion-time impact, in a setting with unvalidated friction from uniform extra screening. Here the relevant acceptance criterion is evaluate legitimate-user failures and fraud capture together, so the alternative leaves the principal control gap open.
C:The technology is fitted to failure to validate applicant claims against independent sources, not the observed biometric friction and unequal error impact. In assessing the difference between failure to validate applicant claims against independent sources and biometric friction and unequal error impact, its benefit would be indirect without the focused remedy and validation described in the correct approach.
E:The alternative is useful for presentation attack against facial verification, but it acts on a different technical mechanism. When examining the difference between presentation attack against facial verification and biometric friction and unequal error impact, correcting the stated weakness requires calibrate checks and provide secure alternative verification routes and dependable false rejection rates across relevant customer groups.
Question 149
A case was escalated for concern about cyber extortion as the origin of suspect payments, but whether the transfer followed an extortion demand remains unverified. The investigator must choose the most probative corroboration. Which evidence is most probative of the unresolved link?
- Customs declarations compared with bills of lading
- Consumer complaints paired with marketing claims
- Harvest licenses traced to timber delivery records
- Incident response record and wallet transfer trace
Explanation
Correct Answer
D:This material provides a practical way to establish whether the transfer followed an extortion demand. When examining the need to establish whether the transfer followed an extortion demand, its value is in linking the customer's asserted purpose to observed facts, so investigators can articulate a reasoned conclusion.
Incorrect Answers
A:The document helps with investigations focused on whether the goods' declared origins agree with shipping evidence. In this case the evidential gap lies with whether the transfer followed an extortion demand, so the reviewer needs a more targeted source before reaching a conclusion.
B:Given the distinction between establishing whether promised investments existed and customers consented and establishing whether the transfer followed an extortion demand as the distinguishing point, such records could help establish whether promised investments existed and customers consented in a different investigation. Here the precise evidential question involves establishing whether the transfer followed an extortion demand, so the suggested material would be indirect and may not resolve the decisive uncertainty.
C:The proposed source is most informative for a question about the lawful provenance of timber represented by the payments. The current case calls for establishing whether the transfer followed an extortion demand; using this instead could leave the customer explanation largely untested.
Question 150
Accountability for work to validate screening performance before applying mitigation credit is disputed following a finding of unsupported control-effectiveness assumption. The owner must have control over execution. Where should primary ownership for resolving the weakness sit?
- Enterprise multi-risk assessment coordinator
- Sanctions risk assessment and control assurance team
- Business-unit risk assessment owner
- Sanctions control validation and risk-assessment owners
Explanation
Correct Answer
D:The named function is positioned to deliver the necessary change: validate screening performance before applying mitigation credit. It can coordinate other teams while remaining responsible for closing unsupported control-effectiveness assumption and producing independent test results and approved effectiveness scoring.
Incorrect Answers
A:Given the contrast between narrowly scoped enterprise financial-crime risk inventory and unsupported control-effectiveness assumption as the distinguishing point, that group is suited to producing integrated AFC taxonomy and documented coverage map for another control issue. In the present case ownership must support measures to validate screening performance before applying mitigation credit and closure of unsupported control-effectiveness assumption, not an unrelated assurance task.
B:The alternative's control domain is incomplete sanctions control effectiveness assessment, generally corrected through steps to evaluate end-to-end screening, disposition, and list governance. Here the relevant weakness is unsupported control-effectiveness assumption, requiring a different remediation ownership and workplan.
C:This function has a remit connected with the duty to assess agent networks, destinations, volumes, and product vulnerabilities, and the associated problem is poor business-specific risk identification. The current repair requires the responsible team to validate screening performance before applying mitigation credit, so it should not be allocated to a team without direct control over that work.