Question 800
Following a finding of under-prioritization of terrorist-financing indicators, a committee approves the need to apply threat-sensitive escalation criteria beyond monetary size. Primary remediation responsibility is still unassigned. Which accountable function should lead the documented remediation?
- MLRO reporting confidentiality owner
- Suspicious activity reporting quality reviewer
- Terrorist-financing investigations lead
- Investigations records governance owner
Explanation
Correct Answer
C:The central responsibility is to apply threat-sensitive escalation criteria beyond monetary size and retain evidence of completion, not simply offer second opinions. That aligns with the work needed to resolve under-prioritization of terrorist-financing indicators and maintain priority decision log referencing relevant typology indicators.
Incorrect Answers
A:This function has a remit connected with the duty to keep reporting decisions confidential and use approved internal communications, and the associated problem is risk of prohibited tipping off and compromised confidentiality. The current repair requires the responsible team to apply threat-sensitive escalation criteria beyond monetary size, so it should not be allocated to a team without direct control over that work.
B:When examining the contrast between SAR narrative missing the basis for suspicion and under-prioritization of terrorist-financing indicators, its normal responsibility would be addressing SAR narrative missing the basis for suspicion. It may advise or review here, but the accountable execution of measures to apply threat-sensitive escalation criteria beyond monetary size belongs in the process identified by this case.
D:In assessing the contrast between failure to retain investigative support and under-prioritization of terrorist-financing indicators, the alternative's control domain is failure to retain investigative support, generally corrected through steps to preserve the case file under applicable retention and confidentiality rules. Here the relevant weakness is under-prioritization of terrorist-financing indicators, requiring a different remediation ownership and workplan.
Question 801
An investor acquires a luxury apartment through a nominee and immediately grants a large loan secured on it to a related company. Which distinct threat pattern is most consistent with the observed facts?
- Property purchase concealing beneficial ownership
- Rapid property flipping without economic justification
- Real estate equity extraction through related-party loans
- Real estate pre-sale receipts without genuine development
Explanation
Correct Answer
C:The case hinges on establishing whether the purported lender and borrower share control; that unresolved link is the distinguishing clue for this risk interpretation. The associated exposure is property value recycled through non-arm's-length debt, so the suspicion needs corroboration rather than an automatic finding of wrongdoing.
Incorrect Answers
A:The relevant clue for this alternative would be the need to establish who ultimately controls the purchasing vehicle. No comparable fact is central to this case; the key unresolved link is establishing whether the purported lender and borrower share control, making the proposed characterization weaker.
B:Given the distinction between exposure to artificial property price appreciation moving value and exposure to property value recycled through non-arm's-length debt as the distinguishing point, the alternative addresses activity that might produce artificial property price appreciation moving value and would require evidence about whether valuations support each price change. Those are not the facts that drive this scenario, whose defining task is to establish whether the purported lender and borrower share control.
D:This typology would be worth testing when the issue is establishing whether the underlying project has lawful approvals, leading to exposure from fictitious developments used to attract or move funds. The present facts instead call for establishing whether the purported lender and borrower share control, so choosing it would send the investigation toward a different mechanism.
Question 802
Operations wants to exit a risky customer but has not considered outstanding legal restraints or contractual obligations. What is the principal control-design or governance failure?
- Failure to execute enterprise-wide offboarding
- Uncontrolled customer termination process
- Risk of prohibited tipping off and compromised confidentiality
- Overreliance on one threshold in case disposition
Explanation
Correct Answer
B:In assessing the need to use cross-functional approval and lawful exit sequencing, this weakness explains how the observed business process failed to control the risk. Addressing it calls for steps to use cross-functional approval and lawful exit sequencing and evidence beyond management's assurance that a policy exists.
Incorrect Answers
A:The alternative diagnosis describes an issue corrected through steps to assign a single accountable exit coordinator and verify product closure. The scenario instead points to a failure requiring the team to use cross-functional approval and lawful exit sequencing; confusing the two would send corrective effort to the wrong workflow.
C:With the contrast between risk of prohibited tipping off and compromised confidentiality and uncontrolled customer termination process in view, that deficiency is typically owned by MLRO reporting confidentiality owner and rectified through measures to keep reporting decisions confidential and use approved internal communications. This case calls for steps to use cross-functional approval and lawful exit sequencing, meaning the alternative misses the central governance or process gap.
D:This weakness would appear in a process requiring staff to assess combined behavior, customer profile, counterparties, and context. It is not the defining break in the present case, where the remediation must be designed to use cross-functional approval and lawful exit sequencing to address the observed behavior.
Question 803
A bank receives intelligence from a PPP but has no procedure to test whether its monitoring scenarios detect the described activity. What source of authority or core principle is most relevant to the described problem?
- Data minimization as a limit on PPP sharing
- Public-private partnership for financial-crime intelligence
- Limitations of third-party and peer information reliance
- Lawful inter-institution financial-crime information exchange
- Operationalizing PPP intelligence in private-sector controls
Explanation
Correct Answer
E:This is the most direct governing concept because the required response is to convert indicators to documented detection tests and feedback. The accountability of participating bank threat-intelligence team and the expected evidence, typology-to-monitoring change and effectiveness results, clarify its practical scope.
Incorrect Answers
A:In assessing the separate duty to restrict personal information to lawful, necessary, proportionate uses as opposed to the current duty to convert indicators to documented detection tests and feedback, the alternative governs a different activity: restrict personal information to lawful, necessary, proportionate uses. Although related to financial-crime compliance, it does not establish the precise duty that participating bank threat-intelligence team must perform here.
B:With the separate duty to set legal scope, purposes, participant controls, and feedback loops as opposed to the current duty to convert indicators to documented detection tests and feedback in view, its main application involves public-private financial crime coordination forum and an implementation such as set legal scope, purposes, participant controls, and feedback loops. The facts in this scenario call for convert indicators to documented detection tests and feedback, making that framework secondary rather than controlling.
C:This authority supports retain each institution's accountability for required customer checks and produces evidence such as reliance assessment and independent verification evidence. The required response here is convert indicators to documented detection tests and feedback, so the legal or governance route is not the same.
D:Given the separate duty to confirm legal authority, scope, security, and use restrictions as opposed to the current duty to convert indicators to documented detection tests and feedback as the distinguishing point, this principle is relevant where the obligation is to confirm legal authority, scope, security, and use restrictions, under each institution's designated information-sharing officer. The present case instead requires convert indicators to documented detection tests and feedback, so it addresses a different legal or operational question.
Question 804
A new capability to create verified person-to-entity and entity-to-entity graph links has been deployed using director IDs, company addresses, and provenance confidence. The prior defect was entity resolution failure in ownership network analysis, and the owner needs an outcome-based acceptance test. Which validation exercise would provide the strongest evidence of improved performance?
- Audit data flows for unauthorized cross-border exposure
- Review precision of links across shared-service nodes
- Test detection of known connected corporate networks
- Trace test cases backward to original funding accounts
Explanation
Correct Answer
C:Given the technical failure of entity resolution failure in ownership network analysis as the distinguishing point, the proposed validation directly challenges the weakness, not an unrelated performance statistic. It can reveal whether create verified person-to-entity and entity-to-entity graph links works on the relevant data and exceptions before broader deployment.
Incorrect Answers
A:This check would reveal failures like privacy-unsafe centralization of sensitive data, not whether create verified person-to-entity and entity-to-entity graph links corrects the problem in this case. The relevant validation must challenge entity resolution failure in ownership network analysis using director IDs, company addresses, and provenance confidence.
B:When examining the difference between false relationships inferred from common benign nodes and entity resolution failure in ownership network analysis, the alternative is tailored to contextualize link strength and avoid equating connection with guilt and its separate data requirement. It would not provide decisive evidence that the remedy in this scenario eliminates entity resolution failure in ownership network analysis.
D:This would be useful when implementing reconstruct both origin and destination paths with temporal context, but the key failure here is entity resolution failure in ownership network analysis. With the difference between one-directional transaction graph analysis and entity resolution failure in ownership network analysis in view, it may pass even if the present defect persists, so it is not the most probative test.
Question 805
An AFC reviewer is assessing 3 distinct situations. Situation 1: The review concerns real estate equity extraction through related-party loans but cannot yet establish whether the purported lender and borrower share control. Situation 2: The review concerns PEP family-member wealth opacity but cannot yet establish whether the assets derive from independent legitimate activity. Situation 3: The review concerns luxury-art intermediary concealment of principals but cannot yet establish whether the buyer, seller, and payer are the same parties. Which proposed records directly address the distinctive unanswered question in one of these situations? Choose THREE.
- Principal identities, provenance, and payment trail
- Land title, permits, and escrow records
- Independent valuations and related-party sale records
- Independent source-of-wealth evidence and relationship mapping
- Property financing documents and owner-control map
Explanation
Correct Answers
A:For situation 3, this material provides a practical way to establish whether the buyer, seller, and payer are the same parties. Given the need to establish whether the buyer, seller, and payer are the same parties as the distinguishing point, its value is in linking the customer's asserted purpose to observed facts, so investigators can articulate a reasoned conclusion.
D:For situation 2, the central evidential gap concerns establishing whether the assets derive from independent legitimate activity; this material is designed to resolve that specific uncertainty. When examining the need to establish whether the assets derive from independent legitimate activity, it should be checked against account-level events and independent sources, not accepted solely because the customer supplies it.
E:For situation 1, this material provides a practical way to establish whether the purported lender and borrower share control. Given the need to establish whether the purported lender and borrower share control as the distinguishing point, its value is in linking the customer's asserted purpose to observed facts, so investigators can articulate a reasoned conclusion.
Incorrect Answers
B:This record would be useful when investigating real estate pre-sale receipts without genuine development. In assessing the distinction between establishing whether the underlying project has lawful approvals and establishing whether the purported lender and borrower share control, here situation 1 needs to establish whether the purported lender and borrower share control; situation 2 needs to establish whether the assets derive from independent legitimate activity; situation 3 needs to establish whether the buyer, seller, and payer are the same parties. Regarding establishing whether the purported lender and borrower share control when evaluating real estate pre-sale receipts without genuine development in this diagnostic evidence decision, it does not directly resolve any of those distinct evidentiary gaps.
C:In assessing the distinction between establishing whether valuations support each price change and establishing whether the purported lender and borrower share control, this record would be useful when investigating rapid property flipping without economic justification. With the distinction between establishing whether valuations support each price change and establishing whether the purported lender and borrower share control in view, here situation 1 needs to establish whether the purported lender and borrower share control; situation 2 needs to establish whether the assets derive from independent legitimate activity; situation 3 needs to establish whether the buyer, seller, and payer are the same parties. Regarding establishing whether the purported lender and borrower share control when evaluating rapid property flipping without economic justification in this diagnostic evidence decision, it does not directly resolve any of those distinct evidentiary gaps.
Question 806
An AFC control owner acknowledges uncontrolled customer termination process, and assurance requests an implementable correction at the point of failure. What intervention should be prioritized to repair the deficient control?
- Preserve the case file under applicable retention and confidentiality rules
- Assess combined behavior, customer profile, counterparties, and context
- Assign a single accountable exit coordinator and verify product closure
- Use cross-functional approval and lawful exit sequencing
Explanation
Correct Answer
D:This responds to the identified weakness, uncontrolled customer termination process, at the point where the process breaks down. Assigning the change to customer termination governance committee and testing recorded legal review and controlled closure checklist makes remediation verifiable rather than aspirational.
Incorrect Answers
A:The proposed step is appropriate when failure to retain investigative support is observed. The case instead concerns uncontrolled customer termination process; the alternative would not repair the particular failing in time or at the correct control point.
B:In assessing the contrast between overreliance on one threshold in case disposition and uncontrolled customer termination process, this approach is usually evidenced by pattern analysis and reasoned case closure record, addressing overreliance on one threshold in case disposition. It is not a substitute for the targeted corrective action needed to resolve uncontrolled customer termination process in this workflow.
C:The alternative may improve a different part of AFC governance, but it primarily tackles failure to execute enterprise-wide offboarding. The actual defect, uncontrolled customer termination process, requires a different control intervention.
Question 807
A compliance implementation note cites operationalizing PPP intelligence in private-sector controls but lacks an operational action plan. The responsible function must deliver a traceable response. What should the responsible institution implement to address the described requirement?
- Set legal scope, purposes, participant controls, and feedback loops
- Share aggregated indicators that cannot readily reveal individuals
- Convert indicators to documented detection tests and feedback
- Confirm legal authority, scope, security, and use restrictions
Explanation
Correct Answer
C:When examining the mandate of participating bank threat-intelligence team, this action is within the stated mandate and produces a checkable compliance result. It should be carried out under participating bank threat-intelligence team with typology-to-monitoring change and effectiveness results preserved for challenge and oversight.
Incorrect Answers
A:The alternative concerns a different risk overseen by public-private financial crime coordination forum. It would not implement the specific requirement in the case, which requires the responsible party to convert indicators to documented detection tests and feedback and an associated record.
B:With the separate duty to share aggregated indicators that cannot readily reveal individuals as opposed to the current duty to convert indicators to documented detection tests and feedback in view, its purpose is to address privacy-preserving collaborative typology analysis; that does not complete the practical duty described. The requested outcome requires convert indicators to documented detection tests and feedback, not merely another compliance activity.
D:Given the separate duty to confirm legal authority, scope, security, and use restrictions as opposed to the current duty to convert indicators to documented detection tests and feedback as the distinguishing point, that step is appropriate for an obligation involving lawful inter-institution financial-crime information exchange. In this case the task is convert indicators to documented detection tests and feedback, and carrying out the alternative would not satisfy the identified requirement.
Question 808
Network analytics flags two persons as criminal associates solely because they transferred money through one common employer. What is the core technology-control problem?
- One-directional transaction graph analysis
- False relationships inferred from common benign nodes
- Generative AI hallucination in investigative summaries
- Uncontrolled automated or manual case closure
- Entity resolution failure in ownership network analysis
Explanation
Correct Answer
B:When examining the proposed capability of contextualize link strength and avoid equating connection with guilt, the observed result points to a failure in the underlying data or control process, rather than necessarily to wrongdoing by a customer. The targeted fix is contextualize link strength and avoid equating connection with guilt, relying on node types, transaction purpose, and relationship confidence and a check such as review precision of links across shared-service nodes.
Incorrect Answers
A:The problem described by this alternative concerns trace test cases backward to original funding accounts and a separate analytical failure. When examining the competing solutions of reconstruct both origin and destination paths with temporal context and contextualize link strength and avoid equating connection with guilt, it does not capture the central weakness the institution needs to resolve with contextualize link strength and avoid equating connection with guilt.
C:Given the competing solutions of require source citations and analyst verification before decisions and contextualize link strength and avoid equating connection with guilt as the distinguishing point, the alternative would explain a setting that needs verified transaction evidence and source-linked model outputs. The present tool's failure is different and should instead be tested through review precision of links across shared-service nodes, making this diagnosis less defensible.
D:That defect is most directly corrected by enforce reason-coded dispositions and evidence completeness checks, whose inputs include structured disposition codes and review-permission records. Here the observed behavior calls for contextualize link strength and avoid equating connection with guilt, so the alternative would misdirect the technical fix.
E:With the competing solutions of create verified person-to-entity and entity-to-entity graph links and contextualize link strength and avoid equating connection with guilt in view, the problem described by this alternative concerns test detection of known connected corporate networks and a separate analytical failure. When examining the competing solutions of create verified person-to-entity and entity-to-entity graph links and contextualize link strength and avoid equating connection with guilt, it does not capture the central weakness the institution needs to resolve with contextualize link strength and avoid equating connection with guilt.
Question 809
After a thematic review of real estate equity extraction through related-party loans, the compliance committee prioritizes reducing property value recycled through non-arm's-length debt. The control should work at the relevant entry point. What targeted measure should reduce the identified vulnerability?
- Look-through ownership checks for property transactions
- Connected-party and valuation anomaly review
- Developer legitimacy and escrow verification
- Related-party financing review at property acquisition
Explanation
Correct Answer
D:The case needs a control aimed at property value recycled through non-arm's-length debt, not a generic restriction on all customers. When examining the exposure to property value recycled through non-arm's-length debt, the proposed design introduces that verification or detection step so staff can prevent, identify, and escalate exceptions consistently.
Incorrect Answers
A:The alternative would mitigate risks involving anonymous legal entities acquiring high-value property, not the principal failure here. The relevant control design must be built around property value recycled through non-arm's-length debt, with appropriate evidence and exceptions.
B:That safeguard is appropriate for a setting where the exposure is artificial property price appreciation moving value. This scenario instead exposes property value recycled through non-arm's-length debt; a control operating on the other mechanism would not be the most proportionate response.
C:This control addresses fictitious developments used to attract or move funds, a different vulnerability. The current exposure is property value recycled through non-arm's-length debt; installing the alternative without a tailored check would leave the key failure path substantially open.
Question 810
After uncontrolled customer termination process was identified, the corrective plan required steps to use cross-functional approval and lawful exit sequencing. Governance now needs an operational owner with decision rights. Who should own the corrective response, with other functions providing challenge as needed?
- Complex financial-crime investigations unit
- MLRO suspicious reporting decision function
- Customer termination governance committee
- Enterprise offboarding program manager
Explanation
Correct Answer
C:With the need to use cross-functional approval and lawful exit sequencing in view, primary accountability belongs with the function able to execute the described process repair. Here that means ensuring the responsible team can use cross-functional approval and lawful exit sequencing, with the result demonstrated by recorded legal review and controlled closure checklist and challenged by appropriate assurance functions.
Incorrect Answers
A:Given the contrast between fragmented investigation missing relationship networks and uncontrolled customer termination process as the distinguishing point, its normal responsibility would be addressing fragmented investigation missing relationship networks. It may advise or review here, but the accountable execution of measures to use cross-functional approval and lawful exit sequencing belongs in the process identified by this case.
B:That group is suited to producing timely documented suspicion assessment and filing decision for another control issue. In the present case ownership must support measures to use cross-functional approval and lawful exit sequencing and closure of uncontrolled customer termination process, not an unrelated assurance task.
D:This function has a remit connected with the duty to assign a single accountable exit coordinator and verify product closure, and the associated problem is failure to execute enterprise-wide offboarding. The current repair requires the responsible team to use cross-functional approval and lawful exit sequencing, so it should not be allocated to a team without direct control over that work.