Question 400
Following a finding of siloed fraud and AML risk management, a committee approves the need to create controlled intelligence flows between fraud and AFC teams. Primary remediation responsibility is still unassigned. Which accountable function should lead the documented remediation?
- Fraud-AML joint risk coordination lead
- AFC learning and competency owner
- Reputational-risk and AFC senior governance liaison
- Head of AFC organizational planning
- First-line staff training and incident escalation lead
Explanation
Correct Answer
A:Primary ownership needs to sit with the function able to ensure that the organization can create controlled intelligence flows between fraud and AFC teams. The problem identified as siloed fraud and AML risk management requires accountability for actual process change; advice and independent testing are supporting, separate duties.
Incorrect Answers
B:Its normal responsibility would be addressing lack of role-based financial-crime training. It may advise or review here, but the accountable execution of measures to create controlled intelligence flows between fraud and AFC teams belongs in the process identified by this case.
C:That group is suited to producing escalation trace from screening finding to risk committee for another control issue. In the present case ownership must support measures to create controlled intelligence flows between fraud and AFC teams and closure of siloed fraud and AML risk management, not an unrelated assurance task.
D:The alternative's control domain is unbalanced compliance team capabilities, generally corrected through steps to build complementary prevention, detection, reporting, and assurance functions. Here the relevant weakness is siloed fraud and AML risk management, requiring a different remediation ownership and workplan.
E:This function has a remit connected with the duty to practice reporting workflows and provide usable escalation guidance, and the associated problem is training that omits operational escalation. The current repair requires the responsible team to create controlled intelligence flows between fraud and AFC teams, so it should not be allocated to a team without direct control over that work.
Question 401
A former senior official becomes a paid adviser to a company that recently won contracts from the official's old agency. Which interpretation most directly explains the concern in this case?
- Close-associate PEP concealment of beneficial ownership
- Revolving-door corruption and influence risk
- PEP family-member wealth opacity
- Potential kickback payment to a public official
Explanation
Correct Answer
B:This characterization follows from the particular flow and relationships described, especially the need to establish whether advisory fees correspond to genuine services. If substantiated, the resulting vulnerability is payments tied to influence over government awards; investigators should separate the alert from proof of the underlying offense.
Incorrect Answers
A:When examining the distinction between exposure to public-sector funds routed to concealed associates and exposure to payments tied to influence over government awards, that interpretation is associated with a different situation where investigators must establish whether the intermediary is controlled by a PEP associate. It would direct attention toward public-sector funds routed to concealed associates, whereas this case principally calls for establishing whether advisory fees correspond to genuine services; the signals should not be treated as interchangeable.
C:The relevant clue for this alternative would be the need to establish whether the assets derive from independent legitimate activity. No comparable fact is central to this case; the key unresolved link is establishing whether advisory fees correspond to genuine services, making the proposed characterization weaker.
D:The alternative addresses activity that might produce unexplained contractor transfers to decision-makers and would require evidence about whether the transfer is connected to contract consideration. Those are not the facts that drive this scenario, whose defining task is to establish whether advisory fees correspond to genuine services.
Question 402
A bank's reputational-risk committee learns of a corruption scandal months after customer KYC identified the same adverse media. What is the principal control-design or governance failure?
- Compliance team reporting structure that weakens independence
- Missing cross-functional escalation for material reputational threats
- Lack of role-based financial-crime training
- Siloed fraud and AML risk management
Explanation
Correct Answer
B:In assessing the need to route relevant adverse media to reputational and AFC risk owners, this weakness explains how the observed business process failed to control the risk. Addressing it calls for steps to route relevant adverse media to reputational and AFC risk owners and evidence beyond management's assurance that a policy exists.
Incorrect Answers
A:The alternative diagnosis describes an issue corrected through steps to separate commercial pressure from sanctions decision authority. The scenario instead points to a failure requiring the team to route relevant adverse media to reputational and AFC risk owners; confusing the two would send corrective effort to the wrong workflow.
C:That deficiency is typically owned by AFC learning and competency owner and rectified through measures to deliver modules matched to job risk and control responsibilities. This case calls for steps to route relevant adverse media to reputational and AFC risk owners, meaning the alternative misses the central governance or process gap.
D:This weakness would appear in a process requiring staff to create controlled intelligence flows between fraud and AFC teams. It is not the defining break in the present case, where the remediation must be designed to route relevant adverse media to reputational and AFC risk owners to address the observed behavior.
Question 403
A sector regulator's thematic review reports widespread deficiencies in beneficial ownership collection. What source of authority or core principle is most relevant to the described problem?
- Wolfsberg correspondent-banking due diligence guidance
- FIU typology dissemination as a risk intelligence source
- Thematic supervisory findings informing control expectations
- Corruption-risk indicator versus legally binding sanctions data
Explanation
Correct Answer
C:The decisive feature is the kind of obligation imposed, which requires the responsible party to benchmark internal CDD failures against identified sector weaknesses. It is distinguished by the responsible function, sector's competent supervisory regulator, and by the records used to demonstrate compliance.
Incorrect Answers
A:In assessing the separate duty to use structured respondent due diligence while confirming legal minima separately as opposed to the current duty to benchmark internal CDD failures against identified sector weaknesses, the alternative governs a different activity: use structured respondent due diligence while confirming legal minima separately. Although related to financial-crime compliance, it does not establish the precise duty that sector's competent supervisory regulator must perform here.
B:With the separate duty to translate typology signals into an institutional exposure review as opposed to the current duty to benchmark internal CDD failures against identified sector weaknesses in view, its main application involves FIU strategic analysis and reporting function and an implementation such as translate typology signals into an institutional exposure review. The facts in this scenario call for benchmark internal CDD failures against identified sector weaknesses, making that framework secondary rather than controlling.
D:This principle is relevant where the obligation is to treat perception ratings as one risk input and screen against official lists, under enterprise AFC risk-intelligence function. The present case instead requires benchmark internal CDD failures against identified sector weaknesses, so it addresses a different legal or operational question.
Question 404
Diagnostics confirm uninterpretable pKYC refresh triggers. The technology owner needs a sustainable corrective capability rather than an ad hoc downstream workaround. Which solution design most directly corrects the defect?
- Capture model reasons and require explainable review decisions
- Trigger reassessment from significant customer-role changes
- Schedule review intensity based on risk and material events
- Pilot targeted risk-based questions and measure their control value
Explanation
Correct Answer
A:The improvement addresses uninterpretable pKYC refresh triggers by changing the relevant detection, verification, or governance capability. It depends on feature changes, timestamps, and analyst feedback, and check that triggered reviews have traceable underlying events provides a practical acceptance criterion.
Incorrect Answers
B:The alternative is useful for missing event-driven KYC refresh, but it acts on a different technical mechanism. Correcting the stated weakness requires capture model reasons and require explainable review decisions and dependable feature changes, timestamps, and analyst feedback.
C:That improvement can be tested through measure overdue refresh rates weighted by risk severity, in a setting with poor refresh prioritization by risk. Here the relevant acceptance criterion is check that triggered reviews have traceable underlying events, so the alternative leaves the principal control gap open.
D:The technology is fitted to unvalidated friction from uniform extra screening, not the observed uninterpretable pKYC refresh triggers. With the difference between unvalidated friction from uniform extra screening and uninterpretable pKYC refresh triggers in view, its benefit would be indirect without the focused remedy and validation described in the correct approach.
Question 405
An AFC case review has raised this potential issue: revolving-door corruption and influence risk. Investigators have yet to establish whether advisory fees correspond to genuine services, and a conclusion based only on the alert would be premature. Which independent record best resolves this gap?
- Beneficial ownership network and relationship checks
- Individual PEP risk assessment and transaction history
- Independent source-of-wealth evidence and relationship mapping
- Tender chronology and documented payment purpose
- Service deliverables and procurement history
Explanation
Correct Answer
E:These records directly help establish whether advisory fees correspond to genuine services. Given the need to establish whether advisory fees correspond to genuine services as the distinguishing point, correlating them with the described activity can distinguish an ordinary commercial explanation from an unexplained pattern before any external reporting decision.
Incorrect Answers
A:When examining the distinction between establishing whether the intermediary is controlled by a PEP associate and establishing whether advisory fees correspond to genuine services, such records could help establish whether the intermediary is controlled by a PEP associate in a different investigation. Here the precise evidential question involves establishing whether advisory fees correspond to genuine services, so the suggested material would be indirect and may not resolve the decisive uncertainty.
B:The proposed source is most informative for a question about whether individual risk factors justify enhanced controls. The current case calls for establishing whether advisory fees correspond to genuine services; using this instead could leave the customer explanation largely untested.
C:In assessing the distinction between establishing whether the assets derive from independent legitimate activity and establishing whether advisory fees correspond to genuine services, this can support due diligence on whether the assets derive from independent legitimate activity, a separate risk dimension. It is not the primary independent check for whether advisory fees correspond to genuine services, which is the missing link in the described funds movement.
D:With the distinction between establishing whether the transfer is connected to contract consideration and establishing whether advisory fees correspond to genuine services in view, the document helps with investigations focused on whether the transfer is connected to contract consideration. In this case the evidential gap lies with whether advisory fees correspond to genuine services, so the reviewer needs a more targeted source before reaching a conclusion.
Question 406
An AFC control owner acknowledges missing cross-functional escalation for material reputational threats, and assurance requests an implementable correction at the point of failure. What intervention should be prioritized to repair the deficient control?
- Separate commercial pressure from sanctions decision authority
- Route relevant adverse media to reputational and AFC risk owners
- Coordinate incident response with KYC control assurance and case preservation
- Create controlled intelligence flows between fraud and AFC teams
Explanation
Correct Answer
B:This action addresses the mechanism causing missing cross-functional escalation for material reputational threats, while retaining a defensible audit trail. A reviewer could subsequently inspect escalation trace from screening finding to risk committee to determine if the control is effective.
Incorrect Answers
A:Given the contrast between compliance team reporting structure that weakens independence and missing cross-functional escalation for material reputational threats as the distinguishing point, the proposed step is appropriate when compliance team reporting structure that weakens independence is observed. The case instead concerns missing cross-functional escalation for material reputational threats; the alternative would not repair the particular failing in time or at the correct control point.
C:With the contrast between cyber incident disconnected from compliance evidence integrity and missing cross-functional escalation for material reputational threats in view, the alternative may improve a different part of AFC governance, but it primarily tackles cyber incident disconnected from compliance evidence integrity. The actual defect, missing cross-functional escalation for material reputational threats, requires a different control intervention.
D:This intervention solves a different weakness, namely siloed fraud and AML risk management. It leaves the current missing cross-functional escalation for material reputational threats substantially unresolved because the broken process here requires route relevant adverse media to reputational and AFC risk owners.
Question 407
An AFC reviewer is assessing 2 distinct situations. Situation 1: A competent body is examining its implementation of thematic supervisory findings informing control expectations. Situation 2: A competent body is examining its implementation of FIU typology dissemination as a risk intelligence source. Which actions are each the most direct implementation step for a different stated case? Choose TWO.
- Treat perception ratings as one risk input and screen against official lists
- Determine the legally applicable reporting threshold and duty
- Translate typology signals into an institutional exposure review
- Benchmark internal CDD failures against identified sector weaknesses
Explanation
Correct Answers
C:For situation 2, this action is within the stated mandate and produces a checkable compliance result. It should be carried out under FIU strategic analysis and reporting function with documented scenario gap review against published typology preserved for challenge and oversight.
D:For situation 1, the described requirement calls for an implementable action, not only a statement of policy. In this situation it addresses the core problem directly, with sector's competent supervisory regulator responsible and control self-assessment linked to supervisory findings providing an audit trail.
Incorrect Answers
A:In assessing the separate duty to treat perception ratings as one risk input and screen against official lists as opposed to the current duty to benchmark internal CDD failures against identified sector weaknesses, the alternative is associated with corruption-risk indicator versus legally binding sanctions data and the duty to treat perception ratings as one risk input and screen against official lists. With the separate duty to treat perception ratings as one risk input and screen against official lists as opposed to the current duty to benchmark internal CDD failures against identified sector weaknesses in view, in this item, situation 1 calls for action to benchmark internal CDD failures against identified sector weaknesses; situation 2 calls for action to translate typology signals into an institutional exposure review. Regarding the duty to benchmark internal CDD failures against identified sector weaknesses while considering corruption-risk indicator versus legally binding sanctions data in this compliance implementation decision, it does not perform the particular action role tested by these cases.
B:The alternative is associated with difference between voluntary guidance and mandatory reporting law and the duty to determine the legally applicable reporting threshold and duty. When examining the separate duty to determine the legally applicable reporting threshold and duty as opposed to the current duty to benchmark internal CDD failures against identified sector weaknesses, in this item, situation 1 calls for action to benchmark internal CDD failures against identified sector weaknesses; situation 2 calls for action to translate typology signals into an institutional exposure review. Regarding the duty to benchmark internal CDD failures against identified sector weaknesses while considering difference between voluntary guidance and mandatory reporting law in this compliance implementation decision, it does not perform the particular action role tested by these cases.
Question 408
An engineering team plans to capture model reasons and require explainable review decisions to resolve uninterpretable pKYC refresh triggers. Before rollout, it must verify the completeness and provenance of the relevant inputs. Which data requirement is most critical to making the solution reliable?
- Current customer risk tier and outstanding refresh age
- Feature changes, timestamps, and analyst feedback
- Reliable external corporate appointment events
- High-quality portrait and verified document attributes
Explanation
Correct Answer
B:The selected data dependency supports the proposed technical control, capture model reasons and require explainable review decisions. Verifying lineage and completeness is essential because uninterpretable pKYC refresh triggers will otherwise survive in downstream decisions.
Incorrect Answers
A:That information underpins schedule review intensity based on risk and material events when the problem is poor refresh prioritization by risk. The case instead depends on feature changes, timestamps, and analyst feedback, which is necessary to correct the stated failure and make the output auditable.
C:These attributes help evaluate test update latency from public record to new risk classification in another workflow. The present failure involves uninterpretable pKYC refresh triggers, making feature changes, timestamps, and analyst feedback the more direct dependency to verify.
D:In assessing the difference between missing identity document-to-person binding and uninterpretable pKYC refresh triggers, the proposed source is appropriate for a tool tackling missing identity document-to-person binding. It does not supply the information needed to validate capture model reasons and require explainable review decisions against the current observed issue.
Question 409
A risk owner is designing safeguards against payments tied to influence over government awards in cases associated with revolving-door corruption and influence risk. Broad restrictions on unrelated customers would not address the particular weakness. Which safeguard most directly addresses this exposure?
- PEP-related conflict-of-interest escalation
- EDD on PEP close associates and related entities
- Event-driven PEP rescreening and customer risk refresh
- Corruption-triggered transaction review for PEP accounts
Explanation
Correct Answer
A:The safeguard targets payments tied to influence over government awards, the specific vulnerability present in this relationship or payment flow. Given the exposure to payments tied to influence over government awards as the distinguishing point, it belongs at the stage where the risk arises, with exception handling and monitoring proportionate to the assessed exposure.
Incorrect Answers
B:The measure is more suited to limiting public-sector funds routed to concealed associates. It does not directly test or prevent payments tied to influence over government awards in the described customer or transaction process, even if it might help elsewhere in the AFC program.
C:In assessing the distinction between exposure to stale classification of politically exposed customers and exposure to payments tied to influence over government awards, the alternative would mitigate risks involving stale classification of politically exposed customers, not the principal failure here. The relevant control design must be built around payments tied to influence over government awards, with appropriate evidence and exceptions.
D:That safeguard is appropriate for a setting where the exposure is unexplained contractor transfers to decision-makers. This scenario instead exposes payments tied to influence over government awards; a control operating on the other mechanism would not be the most proportionate response.
Question 410
After missing cross-functional escalation for material reputational threats was identified, the corrective plan required steps to route relevant adverse media to reputational and AFC risk owners. Governance now needs an operational owner with decision rights. Who should own the corrective response, with other functions providing challenge as needed?
- Third-party KYC service owner
- Reputational-risk and AFC senior governance liaison
- AFC technology project owner with privacy and security partners
- Fraud-AML joint risk coordination lead
Explanation
Correct Answer
B:The central responsibility is to route relevant adverse media to reputational and AFC risk owners and retain evidence of completion, not simply offer second opinions. That aligns with the work needed to resolve missing cross-functional escalation for material reputational threats and maintain escalation trace from screening finding to risk committee.
Incorrect Answers
A:Given the contrast between outsourced onboarding assurance gap and missing cross-functional escalation for material reputational threats as the distinguishing point, its normal responsibility would be addressing outsourced onboarding assurance gap. It may advise or review here, but the accountable execution of measures to route relevant adverse media to reputational and AFC risk owners belongs in the process identified by this case.
C:The alternative's control domain is privacy and cybersecurity controls excluded from AFC project design, generally corrected through steps to include lawful processing, least privilege, and security review at design stage. Here the relevant weakness is missing cross-functional escalation for material reputational threats, requiring a different remediation ownership and workplan.
D:This function has a remit connected with the duty to create controlled intelligence flows between fraud and AFC teams, and the associated problem is siloed fraud and AML risk management. The current repair requires the responsible team to route relevant adverse media to reputational and AFC risk owners, so it should not be allocated to a team without direct control over that work.