Question 310
After activity-volume metric masking reduced detection was identified, the corrective plan required steps to track detection yield and coverage with independently tested scenario results. Governance now needs an operational owner with decision rights. Who should own the corrective response, with other functions providing challenge as needed?
- Enterprise issue reporting and committee challenge owner
- Board AFC management information owner
- Customer risk-scoring methodology lead
- Investigations operations governance lead
- Monitoring performance and model governance lead
Explanation
Correct Answer
E:The named function is positioned to deliver the necessary change: track detection yield and coverage with independently tested scenario results. It can coordinate other teams while remaining responsible for closing activity-volume metric masking reduced detection and producing before-and-after alert yield and scenario outcome analysis.
Incorrect Answers
A:Given the contrast between management reporting that hides unresolved severity and activity-volume metric masking reduced detection as the distinguishing point, its normal responsibility would be addressing management reporting that hides unresolved severity. It may advise or review here, but the accountable execution of measures to track detection yield and coverage with independently tested scenario results belongs in the process identified by this case.
B:In assessing the contrast between KPI selection missing risk and control quality indicators and activity-volume metric masking reduced detection, that group is suited to producing segmented management dashboard showing CDD exceptions for another control issue. In the present case ownership must support measures to track detection yield and coverage with independently tested scenario results and closure of activity-volume metric masking reduced detection, not an unrelated assurance task.
C:With the contrast between customer risk assessment that ignores material exposure drivers and activity-volume metric masking reduced detection in view, the alternative's control domain is customer risk assessment that ignores material exposure drivers, generally corrected through steps to use transparent ownership, geography, delivery channel, and activity inputs. Here the relevant weakness is activity-volume metric masking reduced detection, requiring a different remediation ownership and workplan.
D:This function has a remit connected with the duty to add aging, prioritization, and escalation measures to management information, and the associated problem is failure to monitor case timeliness and unresolved risk. The current repair requires the responsible team to track detection yield and coverage with independently tested scenario results, so it should not be allocated to a team without direct control over that work.
Question 311
An AFC case review has raised this potential issue: suspicious early liquidation and third-party redemption. Investigators have yet to establish whether the payee is a legitimate investor-authorized recipient, and a conclusion based only on the alert would be premature. Which independent record best resolves this gap?
- Beneficiary authorization and investment account history
- Payroll and business-activity reconciliation
- Original and revised commercial agreements
- Loan-use invoices reconciled with beneficiary payments
Explanation
Correct Answer
A:These records directly help establish whether the payee is a legitimate investor-authorized recipient. With the need to establish whether the payee is a legitimate investor-authorized recipient in view, correlating them with the described activity can distinguish an ordinary commercial explanation from an unexplained pattern before any external reporting decision.
Incorrect Answers
B:The proposed source is most informative for a question about whether deposits arise from undeclared commercial activity. The current case calls for establishing whether the payee is a legitimate investor-authorized recipient; using this instead could leave the customer explanation largely untested.
C:This can support due diligence on why the affiliate was added before shipment, a separate risk dimension. It is not the primary independent check for whether the payee is a legitimate investor-authorized recipient, which is the missing link in the described funds movement.
D:Given the distinction between establishing whether disbursements support the approved business use and establishing whether the payee is a legitimate investor-authorized recipient as the distinguishing point, the document helps with investigations focused on whether disbursements support the approved business use. In this case the evidential gap lies with whether the payee is a legitimate investor-authorized recipient, so the reviewer needs a more targeted source before reaching a conclusion.
Question 312
A challenge panel will not accept a sign-off for activity-volume metric masking reduced detection based only on policy language. The institution says it can now track detection yield and coverage with independently tested scenario results; an operating record is necessary. What would substantiate resolution of the identified AFC weakness?
- Before-and-after alert yield and scenario outcome analysis
- Case-age distribution and breached-deadline tracking
- High-severity issue register and verified closure evidence
- Segmented management dashboard showing CDD exceptions
Explanation
Correct Answer
A:With the deficiency of activity-volume metric masking reduced detection in view, the record gives an auditable link between the expected remediation and observed practice. It is especially useful for verifying that activity-volume metric masking reduced detection has not continued under a different workflow.
Incorrect Answers
B:This record would help assess whether steps to add aging, prioritization, and escalation measures to management information worked in a different scenario. The current test needs to establish whether measures to track detection yield and coverage with independently tested scenario results corrected activity-volume metric masking reduced detection; the suggested artifact cannot show that directly.
C:The proposed evidence corresponds to oversight of management reporting that hides unresolved severity. It would leave the actual remediation, track detection yield and coverage with independently tested scenario results, without a clear operational test in this case.
D:That documentation is meaningful where measures to report targeted KRI breaches and control-failure trends by exposure are the expected control. The present issue is activity-volume metric masking reduced detection, and the reviewer needs records specifically tracing the chosen remedy.
Question 313
A compliance task requires an organization to submit evidence-based feedback on proposed obligations. The steering committee has not identified the function with the relevant authority or responsibility. Which body or function has the specifically described lead responsibility?
- Industry standards and professional association
- National legislative or policy-making authority
- Financial-sector prudential or conduct supervisor
- Domestic FIU coordinating foreign FIU requests
- Non-governmental research organization
Explanation
Correct Answer
B:This body or team has the relevant authority or duty for the action in this case: submit evidence-based feedback on proposed obligations. The distinction matters because consultation response and regulatory horizon-scanning log must be accountable to the proper decision maker.
Incorrect Answers
A:When examining the separate duty to evaluate guidance against binding local requirements and adopted policy as opposed to the current duty to submit evidence-based feedback on proposed obligations, this function normally leads work such as evaluate guidance against binding local requirements and adopted policy, which is distinct from the issue at hand. Given the separate duty to evaluate guidance against binding local requirements and adopted policy as opposed to the current duty to submit evidence-based feedback on proposed obligations as the distinguishing point, the current responsibility relates to submit evidence-based feedback on proposed obligations, so routing it here would misassign accountability.
C:In assessing the separate duty to provide evidence of control design, operation, and timely remediation as opposed to the current duty to submit evidence-based feedback on proposed obligations, the alternative is associated with regulatory findings and tracked remedial action closure for another kind of obligation. It is not the authority chiefly accountable for submit evidence-based feedback on proposed obligations in the circumstances described.
D:With the separate duty to route appropriate intelligence through authorized international channels as opposed to the current duty to submit evidence-based feedback on proposed obligations in view, that organization may contribute relevant information but primarily handles route appropriate intelligence through authorized international channels. It cannot replace the proper lead for submit evidence-based feedback on proposed obligations and its associated review record.
E:When examining the separate duty to use findings as corroborative context, not a binding legal obligation as opposed to the current duty to submit evidence-based feedback on proposed obligations, this function normally leads work such as use findings as corroborative context, not a binding legal obligation, which is distinct from the issue at hand. Given the separate duty to use findings as corroborative context, not a binding legal obligation as opposed to the current duty to submit evidence-based feedback on proposed obligations as the distinguishing point, the current responsibility relates to submit evidence-based feedback on proposed obligations, so routing it here would misassign accountability.
Question 314
A team has introduced a solution to use risk-calibrated fuzzy matching and transliteration logic in response to exact-match screening that misses spelling variations. Independent assurance requests a repeatable test using dependable normalized name aliases and script-transformation rules. What acceptance test best demonstrates control effectiveness?
- Replay a new designation to verify propagation timing
- Quantify omissions and retry failed customer records
- Test known spelling variants while measuring false matches
- Sample common-surname false positives for reliable closure
Explanation
Correct Answer
C:With the technical failure of exact-match screening that misses spelling variations in view, the validation should reproduce the original failure mode and measure the resulting control outcome. Its inputs should reflect normalized name aliases and script-transformation rules, and the expected outcome is evidence that use risk-calibrated fuzzy matching and transliteration logic has corrected exact-match screening that misses spelling variations.
Incorrect Answers
A:This would be useful when implementing implement controlled list ingestion with timestamps and integrity checks, but the key failure here is exact-match screening that misses spelling variations. In assessing the difference between sanctions list freshness and lineage gap and exact-match screening that misses spelling variations, it may pass even if the present defect persists, so it is not the most probative test.
B:This check would reveal failures like incomplete population coverage in ongoing sanctions screening, not whether use risk-calibrated fuzzy matching and transliteration logic corrects the problem in this case. The relevant validation must challenge exact-match screening that misses spelling variations using normalized name aliases and script-transformation rules.
D:That exercise tests a different analytical risk, insufficient secondary identifier comparison. The acceptance test for this case should measure the actual outcome of use risk-calibrated fuzzy matching and transliteration logic, rather than a nearby but unrelated metric.
Question 315
A risk owner is designing safeguards against investment proceeds paid to unverified third parties in cases associated with suspicious early liquidation and third-party redemption. Broad restrictions on unrelated customers would not address the particular weakness. Which safeguard most directly addresses this exposure?
- Profile-driven monitoring and customer purpose refresh
- Redemption-payee verification and exception escalation
- Source-of-collateral diligence for nonstandard guarantors
- Risk-based assessment of nested correspondent activity
Explanation
Correct Answer
B:The case needs a control aimed at investment proceeds paid to unverified third parties, not a generic restriction on all customers. When examining the exposure to investment proceeds paid to unverified third parties, the proposed design introduces that verification or detection step so staff can prevent, identify, and escalate exceptions consistently.
Incorrect Answers
A:In assessing the distinction between exposure to business-like cash flows inconsistent with personal onboarding and exposure to investment proceeds paid to unverified third parties, this control addresses business-like cash flows inconsistent with personal onboarding, a different vulnerability. The current exposure is investment proceeds paid to unverified third parties; installing the alternative without a tailored check would leave the key failure path substantially open.
C:When examining the distinction between exposure to illicit assets used to support credit facilities and exposure to investment proceeds paid to unverified third parties, the alternative would mitigate risks involving illicit assets used to support credit facilities, not the principal failure here. The relevant control design must be built around investment proceeds paid to unverified third parties, with appropriate evidence and exceptions.
D:That safeguard is appropriate for a setting where the exposure is unknown nested financial institutions routing payments. This scenario instead exposes investment proceeds paid to unverified third parties; a control operating on the other mechanism would not be the most proportionate response.
Question 316
A board receives only total training hours and cannot see which high-risk branches fail important CDD checks. Which defect should be recorded in the AFC program assessment?
- KPI selection missing risk and control quality indicators
- Activity-volume metric masking reduced detection
- Failure to monitor case timeliness and unresolved risk
- Management reporting that hides unresolved severity
Explanation
Correct Answer
A:With the need to report targeted KRI breaches and control-failure trends by exposure in view, this weakness explains how the observed business process failed to control the risk. Addressing it calls for steps to report targeted KRI breaches and control-failure trends by exposure and evidence beyond management's assurance that a policy exists.
Incorrect Answers
B:When examining the contrast between activity-volume metric masking reduced detection and KPI selection missing risk and control quality indicators, that deficiency is typically owned by monitoring performance and model governance lead and rectified through measures to track detection yield and coverage with independently tested scenario results. This case calls for steps to report targeted KRI breaches and control-failure trends by exposure, meaning the alternative misses the central governance or process gap.
C:This weakness would appear in a process requiring staff to add aging, prioritization, and escalation measures to management information. It is not the defining break in the present case, where the remediation must be designed to report targeted KRI breaches and control-failure trends by exposure to address the observed behavior.
D:In assessing the contrast between management reporting that hides unresolved severity and KPI selection missing risk and control quality indicators, the alternative diagnosis describes an issue corrected through steps to report severity-weighted outstanding findings and mitigation status. The scenario instead points to a failure requiring the team to report targeted KRI breaches and control-failure trends by exposure; confusing the two would send corrective effort to the wrong workflow.
Question 317
An AFC reviewer is assessing 2 distinct situations. Situation 1: An assessment of public-sector policy development and consultation asks whether the duty to submit evidence-based feedback on proposed obligations was actually discharged. Situation 2: An assessment of financial intelligence unit receipt and analysis of suspicious reports asks whether the duty to file with the designated FIU under applicable law was actually discharged. Which records directly evidence fulfillment of an obligation in one of these situations? Choose TWO.
- Consultation response and regulatory horizon-scanning log
- Authorized intelligence exchange record with sharing restrictions
- Gap assessment against internal trade-control standards
- Acknowledged STR submission and internal supporting case file
Explanation
Correct Answers
A:For situation 1, this record links the obligation to submit evidence-based feedback on proposed obligations with actual execution and provides a verifiable basis for review. It also helps demonstrate that national legislative or policy-making authority acted within the appropriate scope.
D:For situation 2, with the compliance duty to file with the designated FIU under applicable law in view, this is the best operational audit trail because it captures the relevant control or decision. It can be reconciled to the duty to file with the designated FIU under applicable law and the mandate of jurisdiction's financial intelligence unit without mistaking guidance for proof.
Incorrect Answers
B:Given the separate duty to route appropriate intelligence through authorized international channels as opposed to the current duty to submit evidence-based feedback on proposed obligations as the distinguishing point, the alternative is associated with FIU-to-FIU exchange using recognized cooperation channels and the duty to route appropriate intelligence through authorized international channels. In assessing the separate duty to route appropriate intelligence through authorized international channels as opposed to the current duty to submit evidence-based feedback on proposed obligations, in this item, situation 1 calls for action to submit evidence-based feedback on proposed obligations; situation 2 calls for action to file with the designated FIU under applicable law. Regarding the duty to submit evidence-based feedback on proposed obligations while considering FIU-to-FIU exchange using recognized cooperation channels in this implementation evidence decision, it does not perform the particular proof role tested by these cases.
C:The alternative is associated with private-sector association guidance rather than regulation and the duty to evaluate guidance against binding local requirements and adopted policy. With the separate duty to evaluate guidance against binding local requirements and adopted policy as opposed to the current duty to submit evidence-based feedback on proposed obligations in view, in this item, situation 1 calls for action to submit evidence-based feedback on proposed obligations; situation 2 calls for action to file with the designated FIU under applicable law. Regarding the duty to submit evidence-based feedback on proposed obligations while considering private-sector association guidance rather than regulation in this implementation evidence decision, it does not perform the particular proof role tested by these cases.
Question 318
A screening tool flags a person with the same surname as a designated party but different verified birth date and nationality. Which failure mode should the control owner investigate first?
- Sanctions list freshness and lineage gap
- Insufficient secondary identifier comparison
- Inadequate transaction-monitoring segmentation
- Exact-match screening that misses spelling variations
- Incomplete population coverage in ongoing sanctions screening
Explanation
Correct Answer
B:In assessing the proposed capability of use full identifier analysis for match disposition, the observed system behavior is consistent with the specifically identified control defect. The relevant remedy is use full identifier analysis for match disposition, backed by reliable authoritative dates of birth and nationalities for both parties and validation through sample common-surname false positives for reliable closure.
Incorrect Answers
A:Given the competing solutions of implement controlled list ingestion with timestamps and integrity checks and use full identifier analysis for match disposition as the distinguishing point, that defect is most directly corrected by implement controlled list ingestion with timestamps and integrity checks, whose inputs include list version, publication time, and change record. In assessing the competing solutions of implement controlled list ingestion with timestamps and integrity checks and use full identifier analysis for match disposition, here the observed behavior calls for use full identifier analysis for match disposition, so the alternative would misdirect the technical fix.
C:With the competing solutions of tune risk-specific scenarios using behavior and expected activity and use full identifier analysis for match disposition in view, this problem is normally investigated with tune risk-specific scenarios using behavior and expected activity and validated through back-test threshold performance across distinct segments. Those activities address a different failure mode; the case requires use full identifier analysis for match disposition supported by authoritative dates of birth and nationalities for both parties.
D:When examining the competing solutions of use risk-calibrated fuzzy matching and transliteration logic and use full identifier analysis for match disposition, the alternative would explain a setting that needs normalized name aliases and script-transformation rules. The present tool's failure is different and should instead be tested through sample common-surname false positives for reliable closure, making this diagnosis less defensible.
E:That defect is most directly corrected by reconcile active accounts and beneficial owners into each screening run, whose inputs include source population counts and included ownership relationships. In assessing the competing solutions of reconcile active accounts and beneficial owners into each screening run and use full identifier analysis for match disposition, here the observed behavior calls for use full identifier analysis for match disposition, so the alternative would misdirect the technical fix.
Question 319
An institution extends credit to an entity whose guarantor is a recently established offshore shell, and the guarantee funding is unexplained. What is the most defensible risk characterization at this stage?
- Unclear source of collateral for secured lending
- Private-banking opacity across related accounts
- Personal account used as a business collection vehicle
- Nested correspondent banking exposure
Explanation
Correct Answer
A:The pivotal investigative task is to establish the origin and controller of the guarantor's funds. Examining that uncertainty is how the investigator distinguishes this scenario from adjacent typologies and evaluates the exposure to illicit assets used to support credit facilities.
Incorrect Answers
B:With the distinction between exposure to layered high-net-worth accounts without verified controllers and exposure to illicit assets used to support credit facilities in view, that interpretation is associated with a different situation where investigators must establish who ultimately owns and controls the linked assets. It would direct attention toward layered high-net-worth accounts without verified controllers, whereas this case principally calls for establishing the origin and controller of the guarantor's funds; the signals should not be treated as interchangeable.
C:This typology would be worth testing when the issue is establishing whether deposits arise from undeclared commercial activity, leading to exposure from business-like cash flows inconsistent with personal onboarding. The present facts instead call for establishing the origin and controller of the guarantor's funds, so choosing it would send the investigation toward a different mechanism.
D:Given the distinction between exposure to unknown nested financial institutions routing payments and exposure to illicit assets used to support credit facilities as the distinguishing point, the relevant clue for this alternative would be the need to establish which downstream institutions use the account. No comparable fact is central to this case; the key unresolved link is establishing the origin and controller of the guarantor's funds, making the proposed characterization weaker.
Question 320
An internal audit identifies KPI selection missing risk and control quality indicators in a process whose remedial ownership sits with board AFC management information owner. The reviewer requires an executable, testable correction. Which change best addresses the stated compliance-program problem?
- Report severity-weighted outstanding findings and mitigation status
- Report targeted KRI breaches and control-failure trends by exposure
- Establish empowered compliance oversight and risk-commensurate resourcing
- Track detection yield and coverage with independently tested scenario results
Explanation
Correct Answer
B:When examining the deficiency of KPI selection missing risk and control quality indicators, the correction belongs to the deficient operational or governance process rather than an unrelated control. It reduces KPI selection missing risk and control quality indicators when board AFC management information owner implements it and collects segmented management dashboard showing CDD exceptions.
Incorrect Answers
A:With the contrast between management reporting that hides unresolved severity and KPI selection missing risk and control quality indicators in view, this approach is usually evidenced by high-severity issue register and verified closure evidence, addressing management reporting that hides unresolved severity. It is not a substitute for the targeted corrective action needed to resolve KPI selection missing risk and control quality indicators in this workflow.
C:This intervention solves a different weakness, namely insufficient program governance and resources. It leaves the current KPI selection missing risk and control quality indicators substantially unresolved because the broken process here requires report targeted KRI breaches and control-failure trends by exposure.
D:In assessing the contrast between activity-volume metric masking reduced detection and KPI selection missing risk and control quality indicators, the proposed step is appropriate when activity-volume metric masking reduced detection is observed. The case instead concerns KPI selection missing risk and control quality indicators; the alternative would not repair the particular failing in time or at the correct control point.