Question 60
Senior oversight asks who should be responsible for addressing blurred first- and second-line responsibility. The approved change is to return routine process execution to operations while retaining independent second-line challenge, not merely issue advisory opinions. Which function should be assigned responsibility for this control repair?
- Second-line head of AFC compliance
- Chief audit executive or audit committee
- Monitoring performance and model governance lead
- Board-approved MLRO or BSA officer function
Explanation
Correct Answer
A:With the need to return routine process execution to operations while retaining independent second-line challenge in view, primary accountability belongs with the function able to execute the described process repair. Here that means ensuring the responsible team can return routine process execution to operations while retaining independent second-line challenge, with the result demonstrated by responsibility matrix and sampled independent challenge and challenged by appropriate assurance functions.
Incorrect Answers
B:When examining the contrast between compromised third-line independence and blurred first- and second-line responsibility, this function has a remit connected with the duty to separate control design ownership from independent assurance testing, and the associated problem is compromised third-line independence. The current repair requires the responsible team to return routine process execution to operations while retaining independent second-line challenge, so it should not be allocated to a team without direct control over that work.
C:Given the contrast between activity-volume metric masking reduced detection and blurred first- and second-line responsibility as the distinguishing point, its normal responsibility would be addressing activity-volume metric masking reduced detection. It may advise or review here, but the accountable execution of measures to return routine process execution to operations while retaining independent second-line challenge belongs in the process identified by this case.
D:That group is suited to producing reporting charter and recorded board escalations for another control issue. In the present case ownership must support measures to return routine process execution to operations while retaining independent second-line challenge and closure of blurred first- and second-line responsibility, not an unrelated assurance task.
Question 61
An urban bank is repeatedly fined after frontline staff ignored suspicious cash activity, despite the bank holding a written AML policy. Which interpretation most directly explains the concern in this case?
- Regulatory enforcement exposure from ineffective implementation
- Reputational damage with banking-service disruption
- Legal and financial consequences of facilitating predicate crime
- Operational costs from misallocated compliance resources
Explanation
Correct Answer
A:The case hinges on establishing whether staff acted on written escalation duties; that unresolved link is the distinguishing clue for this risk interpretation. The associated exposure is policies that exist on paper but are not followed, so the suspicion needs corroboration rather than an automatic finding of wrongdoing.
Incorrect Answers
B:This typology would be worth testing when the issue is establishing whether partner exits were linked to unresolved AFC deficiencies, leading to exposure from unaddressed confidence concerns among funding partners. The present facts instead call for establishing whether staff acted on written escalation duties, so choosing it would send the investigation toward a different mechanism.
C:The relevant clue for this alternative would be the need to establish whether funds came from prohibited resource extraction. No comparable fact is central to this case; the key unresolved link is establishing whether staff acted on written escalation duties, making the proposed characterization weaker.
D:The alternative addresses activity that might produce high-risk activity concealed by inefficient alert volumes and would require evidence about whether monitoring resources match actual exposure. Those are not the facts that drive this scenario, whose defining task is to establish whether staff acted on written escalation duties.
Question 62
An AFC reviewer is assessing 2 distinct situations. Situation 1: Management claims it now can return routine process execution to operations while retaining independent second-line challenge after finding blurred first- and second-line responsibility; independent testing is pending. Situation 2: Management claims it now can separate control design ownership from independent assurance testing after finding compromised third-line independence; independent testing is pending. Which artifacts demonstrate actual control operation for one of the situations? Choose TWO.
- Escalation samples reconciled to customer service records
- Responsibility matrix and sampled independent challenge
- Reporting charter and recorded board escalations
- Audit independence declarations and approved audit plan
- Outcome-based control tests and remediated findings
Explanation
Correct Answers
B:For situation 1, in assessing the deficiency of blurred first- and second-line responsibility, this is the strongest proof of operating effectiveness because it records the relevant control action. It provides a check on the response to blurred first- and second-line responsibility, not just management's stated intention.
D:For situation 2, this artifact would show whether separate control design ownership from independent assurance testing was executed and whether compromised third-line independence was reduced in practice. Given the deficiency of compromised third-line independence as the distinguishing point, A signed policy without operating evidence would be an insufficient effectiveness test.
Incorrect Answers
A:The alternative concerns first-line ownership failure in identifying and escalating risk, typically addressed through steps to require business staff to report concerns through protected AFC channels. In assessing the contrast between first-line ownership failure in identifying and escalating risk and blurred first- and second-line responsibility, for the presented control failures, situation 1 requires measures to return routine process execution to operations while retaining independent second-line challenge; situation 2 requires measures to separate control design ownership from independent assurance testing. The alternative proof would not meet those requirements.
C:The alternative concerns inadequate authority of the MLRO or BSA officer, typically addressed through steps to give the designated officer clear escalation authority and access to oversight. When examining the contrast between inadequate authority of the MLRO or BSA officer and blurred first- and second-line responsibility, for the presented control failures, situation 1 requires measures to return routine process execution to operations while retaining independent second-line challenge; situation 2 requires measures to separate control design ownership from independent assurance testing. The alternative proof would not meet those requirements.
E:The alternative concerns confusing training completion with operational effectiveness, typically addressed through steps to test whether controls actually detect, escalate, and resolve identified threats. In assessing the contrast between confusing training completion with operational effectiveness and blurred first- and second-line responsibility, for the presented control failures, situation 1 requires measures to return routine process execution to operations while retaining independent second-line challenge; situation 2 requires measures to separate control design ownership from independent assurance testing. The alternative proof would not meet those requirements.
Question 63
A national authority wants peer evaluation of whether its AML regime meets internationally agreed standards. Which framework best characterizes the compliance obligation at issue?
- FATF Recommendation 10 on customer due diligence
- Sectoral financial-crime risk assessment methodology
- FATF effectiveness assessment as distinct from technical compliance
- FATF mutual evaluation and follow-up process
Explanation
Correct Answer
D:This is the most direct governing concept because the required response is to participate in peer review and address prioritized recommendations. The accountability of FATF or relevant FATF-style regional body and the expected evidence, mutual evaluation report with action plan and follow-up, clarify its practical scope.
Incorrect Answers
A:Its main application involves financial-sector AML supervisor enforcing domestic CDD rules and an implementation such as require identification and reasonable verification of beneficial owners. The facts in this scenario call for participate in peer review and address prioritized recommendations, making that framework secondary rather than controlling.
B:With the separate duty to combine sector data, known typologies, and mitigation capacity as opposed to the current duty to participate in peer review and address prioritized recommendations in view, this authority supports combine sector data, known typologies, and mitigation capacity and produces evidence such as sectoral risk assessment with evidence-based drivers. The required response here is participate in peer review and address prioritized recommendations, so the legal or governance route is not the same.
C:This principle is relevant where the obligation is to evaluate real operational outcomes alongside legal framework adoption, under FATF-style mutual evaluation assessment team. The present case instead requires participate in peer review and address prioritized recommendations, so it addresses a different legal or operational question.
Question 64
A transaction monitoring feed silently omits one branch because a source-system interface changed field names. What is the most important defect in the tool or data flow?
- Failure to validate applicant claims against independent sources
- Inconsistent identity attribute normalization
- Incomplete transaction data ingestion
- Identifier collisions and entity resolution failure
Explanation
Correct Answer
C:Given the proposed capability of reconcile source population to monitoring population with exception alerts as the distinguishing point, the observed system behavior is consistent with the specifically identified control defect. The relevant remedy is reconcile source population to monitoring population with exception alerts, backed by reliable source-to-target field mappings and branch-level counts and validation through compare transaction totals and missing-field rates each cycle.
Incorrect Answers
A:With the competing solutions of use authorized issuer or trusted reference verification checks and reconcile source population to monitoring population with exception alerts in view, the alternative would explain a setting that needs trusted government or official identity-source response. The present tool's failure is different and should instead be tested through compare transaction totals and missing-field rates each cycle, making this diagnosis less defensible.
B:That defect is most directly corrected by standardize data types and apply tested transformation rules, whose inputs include canonical date format with provenance and validation rules. Here the observed behavior calls for reconcile source population to monitoring population with exception alerts, so the alternative would misdirect the technical fix.
D:This problem is normally investigated with build a mastered identifier with verified source lineage and validated through challenge merged profiles against known distinct-person samples. Those activities address a different failure mode; the case requires reconcile source population to monitoring population with exception alerts supported by source-to-target field mappings and branch-level counts.
Question 65
An AFC case review has raised this potential issue: regulatory enforcement exposure from ineffective implementation. Investigators have yet to establish whether staff acted on written escalation duties, and a conclusion based only on the alert would be premature. Which independent record best resolves this gap?
- Case logs matched to training and supervisory records
- Correspondent termination notices and remediation history
- Alert backlog segmented by customer and corridor risk
- Permits and export records linked to payment flows
Explanation
Correct Answer
A:These records directly help establish whether staff acted on written escalation duties. Given the need to establish whether staff acted on written escalation duties as the distinguishing point, correlating them with the described activity can distinguish an ordinary commercial explanation from an unexplained pattern before any external reporting decision.
Incorrect Answers
B:The proposed source is most informative for a question about whether partner exits were linked to unresolved AFC deficiencies. The current case calls for establishing whether staff acted on written escalation duties; using this instead could leave the customer explanation largely untested.
C:This can support due diligence on whether monitoring resources match actual exposure, a separate risk dimension. It is not the primary independent check for whether staff acted on written escalation duties, which is the missing link in the described funds movement.
D:The document helps with investigations focused on whether funds came from prohibited resource extraction. In this case the evidential gap lies with whether staff acted on written escalation duties, so the reviewer needs a more targeted source before reaching a conclusion.
Question 66
Internal audit is asked to design the transaction monitoring scenarios that it will later audit. Which program weakness is most directly exposed?
- Blurred first- and second-line responsibility
- Failure to consider frequency, impact, and control vulnerabilities
- First-line ownership failure in identifying and escalating risk
- Compromised third-line independence
Explanation
Correct Answer
D:When examining the need to separate control design ownership from independent assurance testing, the decisive control failure lies in the handling of the scenario's specific risk or obligation. The appropriate repair is to separate control design ownership from independent assurance testing, under the accountability of chief audit executive or audit committee, and then test its operation.
Incorrect Answers
A:Given the contrast between blurred first- and second-line responsibility and compromised third-line independence as the distinguishing point, this weakness would appear in a process requiring staff to return routine process execution to operations while retaining independent second-line challenge. It is not the defining break in the present case, where the remediation must be designed to separate control design ownership from independent assurance testing to address the observed behavior.
B:The alternative diagnosis describes an issue corrected through steps to assess severity and multiple risk pathways for the product. The scenario instead points to a failure requiring the team to separate control design ownership from independent assurance testing; confusing the two would send corrective effort to the wrong workflow.
C:With the contrast between first-line ownership failure in identifying and escalating risk and compromised third-line independence in view, the corresponding consequence of this alternative would be evidenced through escalation samples reconciled to customer service records. The stated control problem has a different operating symptom, addressed by measures to separate control design ownership from independent assurance testing.
Question 67
An implementation review is assessing FATF mutual evaluation and follow-up process. The specifically designated accountable function is FATF or relevant FATF-style regional body, and the review will check mutual evaluation report with action plan and follow-up to determine whether the required activity occurred. Which practical step best translates the principle into a functioning control?
- Participate in peer review and address prioritized recommendations
- Retain essential identification and apply relief only where permitted
- Require documented assessment and proportionate mitigation of ML and TF exposure
- Mandate prompt reporting of suspicion under domestic requirements
Explanation
Correct Answer
A:Here the appropriate implementation follows the regulatory or governance remit of FATF or relevant FATF-style regional body. It creates concrete action on the problem, with mutual evaluation report with action plan and follow-up available to demonstrate completion.
Incorrect Answers
B:With the separate duty to retain essential identification and apply relief only where permitted as opposed to the current duty to participate in peer review and address prioritized recommendations in view, this intervention relates to risk justification and approved simplified CDD procedure in a separate regulatory setting. It cannot substitute for participate in peer review and address prioritized recommendations here because the scenario involves a different obligation and authority.
C:When examining the separate duty to require documented assessment and proportionate mitigation of ML and TF exposure as opposed to the current duty to participate in peer review and address prioritized recommendations, that step is appropriate for an obligation involving FATF Recommendation 1 on risk-based assessment. In this case the task is participate in peer review and address prioritized recommendations, and carrying out the alternative would not satisfy the identified requirement.
D:Given the separate duty to mandate prompt reporting of suspicion under domestic requirements as opposed to the current duty to participate in peer review and address prioritized recommendations as the distinguishing point, the alternative concerns a different risk overseen by national competent authority designating reporting obligations. It would not implement the specific requirement in the case, which requires the responsible party to participate in peer review and address prioritized recommendations and an associated record.
Question 68
Risk testing has demonstrated incomplete transaction data ingestion. Engineering must adjust the affected control instead of merely accepting the false output. What technical change would best address the described control gap?
- Reconcile source population to monitoring population with exception alerts
- Use contextual identifiers and source credibility when assessing records
- Use document authenticity checks and trusted issuer verification where available
- Build a mastered identifier with verified source lineage
- Standardize data types and apply tested transformation rules
Explanation
Correct Answer
A:With the technical failure of incomplete transaction data ingestion in view, this solution corrects the failure rather than merely handling additional alerts. It directly tackles incomplete transaction data ingestion, provided source-to-target field mappings and branch-level counts is controlled and compare transaction totals and missing-field rates each cycle is performed before release.
Incorrect Answers
B:That improvement can be tested through review false-positive decisions for common-name cohorts, in a setting with unverified same-name external-data matches. Here the relevant acceptance criterion is compare transaction totals and missing-field rates each cycle, so the alternative leaves the principal control gap open.
C:The technology is fitted to OCR extraction mistaken for document authentication, not the observed incomplete transaction data ingestion. In assessing the difference between OCR extraction mistaken for document authentication and incomplete transaction data ingestion, its benefit would be indirect without the focused remedy and validation described in the correct approach.
D:This capability addresses identifier collisions and entity resolution failure and relies on unique cross-system identity keys and entity merge decisions. The current failure is incomplete transaction data ingestion; deploying it would not fix the broken data or decision path described in the case.
E:With the difference between inconsistent identity attribute normalization and incomplete transaction data ingestion in view, the alternative is useful for inconsistent identity attribute normalization, but it acts on a different technical mechanism. Correcting the stated weakness requires reconcile source population to monitoring population with exception alerts and dependable source-to-target field mappings and branch-level counts.
Question 69
An AFC reviewer is assessing 2 distinct situations. Situation 1: The unresolved link is whether partner exits were linked to unresolved AFC deficiencies, and the observed exposure involves unaddressed confidence concerns among funding partners. Situation 2: The unresolved link is whether funds came from prohibited resource extraction, and the observed exposure involves facilitation of illicit natural-resource proceeds. Which interpretations correctly identify the central financial-crime risk in one of these situations? Choose TWO.
- Legal and financial consequences of facilitating predicate crime
- Operational costs from misallocated compliance resources
- Customs fraud as an underlying proceeds-generating offense
- Reputational damage with banking-service disruption
Explanation
Correct Answers
A:For situation 2, the pivotal investigative task is to establish whether funds came from prohibited resource extraction. Examining that uncertainty is how the investigator distinguishes this scenario from adjacent typologies and evaluates the exposure to facilitation of illicit natural-resource proceeds.
D:For situation 1, the key issue is the unresolved relationship, which requires establishing whether partner exits were linked to unresolved AFC deficiencies. That inquiry is consistent with the indicated financial-crime pattern and matters because it can expose unaddressed confidence concerns among funding partners; an assessment should document evidence both for and against suspicion.
Incorrect Answers
B:This alternative describes operational costs from misallocated compliance resources and the exposure to high-risk activity concealed by inefficient alert volumes. In assessing the distinction between exposure to high-risk activity concealed by inefficient alert volumes and exposure to unaddressed confidence concerns among funding partners, in the given fact patterns, situation 1 concerns establishing whether partner exits were linked to unresolved AFC deficiencies; situation 2 concerns establishing whether funds came from prohibited resource extraction. None centers on the alternative's defining mechanism.
C:This alternative describes customs fraud as an underlying proceeds-generating offense and the exposure to laundering of customs-fraud profits via invoicing. With the distinction between exposure to laundering of customs-fraud profits via invoicing and exposure to unaddressed confidence concerns among funding partners in view, in the given fact patterns, situation 1 concerns establishing whether partner exits were linked to unresolved AFC deficiencies; situation 2 concerns establishing whether funds came from prohibited resource extraction. None centers on the alternative's defining mechanism.
Question 70
Independent testing has confirmed compromised third-line independence. Management agrees that restating the existing policy will not resolve the process breakdown. Which corrective measure most directly closes this gap?
- Separate control design ownership from independent assurance testing
- Require business staff to report concerns through protected AFC channels
- Express measurable exposure limits and prohibited activities for specific products
- Return routine process execution to operations while retaining independent second-line challenge
- Give the designated officer clear escalation authority and access to oversight
Explanation
Correct Answer
A:This responds to the identified weakness, compromised third-line independence, at the point where the process breaks down. Assigning the change to chief audit executive or audit committee and testing audit independence declarations and approved audit plan makes remediation verifiable rather than aspirational.
Incorrect Answers
B:The proposed step is appropriate when first-line ownership failure in identifying and escalating risk is observed. The case instead concerns compromised third-line independence; the alternative would not repair the particular failing in time or at the correct control point.
C:With the contrast between non-operational risk appetite language and compromised third-line independence in view, this approach is usually evidenced by product limits, breach triggers, and board-approved risk appetite, addressing non-operational risk appetite language. It is not a substitute for the targeted corrective action needed to resolve compromised third-line independence in this workflow.
D:The alternative may improve a different part of AFC governance, but it primarily tackles blurred first- and second-line responsibility. The actual defect, compromised third-line independence, requires a different control intervention.
E:This intervention solves a different weakness, namely inadequate authority of the MLRO or BSA officer. It leaves the current compromised third-line independence substantially unresolved because the broken process here requires separate control design ownership from independent assurance testing.