Question 810
After uncontrolled customer termination process was identified, the corrective plan required steps to use cross-functional approval and lawful exit sequencing. Governance now needs an operational owner with decision rights. Who should own the corrective response, with other functions providing challenge as needed?
- Complex financial-crime investigations unit
- MLRO suspicious reporting decision function
- Customer termination governance committee
- Enterprise offboarding program manager
Explanation
Correct Answer
C:With the need to use cross-functional approval and lawful exit sequencing in view, primary accountability belongs with the function able to execute the described process repair. Here that means ensuring the responsible team can use cross-functional approval and lawful exit sequencing, with the result demonstrated by recorded legal review and controlled closure checklist and challenged by appropriate assurance functions.
Incorrect Answers
A:Given the contrast between fragmented investigation missing relationship networks and uncontrolled customer termination process as the distinguishing point, its normal responsibility would be addressing fragmented investigation missing relationship networks. It may advise or review here, but the accountable execution of measures to use cross-functional approval and lawful exit sequencing belongs in the process identified by this case.
B:That group is suited to producing timely documented suspicion assessment and filing decision for another control issue. In the present case ownership must support measures to use cross-functional approval and lawful exit sequencing and closure of uncontrolled customer termination process, not an unrelated assurance task.
D:This function has a remit connected with the duty to assign a single accountable exit coordinator and verify product closure, and the associated problem is failure to execute enterprise-wide offboarding. The current repair requires the responsible team to use cross-functional approval and lawful exit sequencing, so it should not be allocated to a team without direct control over that work.
Question 811
A law firm receives client money into its escrow account and is asked to forward it to a third party unrelated to the legal matter. What is the most defensible risk characterization at this stage?
- Misuse of professional client accounts for layering
- Company formation services enabling anonymous shells
- Investment-migration gatekeeper funding opacity
- Professional attestation used to lend credibility to unknown funds
- Luxury-art intermediary concealment of principals
Explanation
Correct Answer
A:The pivotal investigative task is to establish whether the payment is connected to the legal engagement. Examining that uncertainty is how the investigator distinguishes this scenario from adjacent typologies and evaluates the exposure to client accounts serving as general-purpose payment channels.
Incorrect Answers
B:That interpretation is associated with a different situation where investigators must establish who instructs nominee directors and benefits from companies. It would direct attention toward anonymous legal persons created without look-through checks, whereas this case principally calls for establishing whether the payment is connected to the legal engagement; the signals should not be treated as interchangeable.
C:When examining the distinction between exposure to third-party capital obscured in residency investments and exposure to client accounts serving as general-purpose payment channels, this typology would be worth testing when the issue is establishing whether contributing funds belong to applicants or legitimate sponsors, leading to exposure from third-party capital obscured in residency investments. The present facts instead call for establishing whether the payment is connected to the legal engagement, so choosing it would send the investigation toward a different mechanism.
D:The relevant clue for this alternative would be the need to establish the independent basis for a source-of-funds certification. No comparable fact is central to this case; the key unresolved link is establishing whether the payment is connected to the legal engagement, making the proposed characterization weaker.
E:The alternative addresses activity that might produce anonymous ownership and settlement in high-value art and would require evidence about whether the buyer, seller, and payer are the same parties. Those are not the facts that drive this scenario, whose defining task is to establish whether the payment is connected to the legal engagement.
Question 812
A challenge panel will not accept a sign-off for uncontrolled customer termination process based only on policy language. The institution says it can now use cross-functional approval and lawful exit sequencing; an operating record is necessary. What would substantiate resolution of the identified AFC weakness?
- Closed-account evidence across all channels and products
- Priority decision log referencing relevant typology indicators
- Complete secured SAR support file and retention record
- Entity network diagram and multi-account flow summary
- Recorded legal review and controlled closure checklist
Explanation
Correct Answer
E:With the deficiency of uncontrolled customer termination process in view, the record gives an auditable link between the expected remediation and observed practice. It is especially useful for verifying that uncontrolled customer termination process has not continued under a different workflow.
Incorrect Answers
A:With the contrast between failure to execute enterprise-wide offboarding and uncontrolled customer termination process in view, the artifact tests a different process led by enterprise offboarding program manager. It does not adequately demonstrate that uncontrolled customer termination process is now controlled, even if it could support wider AFC assurance.
B:When examining the contrast between under-prioritization of terrorist-financing indicators and uncontrolled customer termination process, this record would help assess whether steps to apply threat-sensitive escalation criteria beyond monetary size worked in a different scenario. The current test needs to establish whether measures to use cross-functional approval and lawful exit sequencing corrected uncontrolled customer termination process; the suggested artifact cannot show that directly.
C:The proposed evidence corresponds to oversight of failure to retain investigative support. It would leave the actual remediation, use cross-functional approval and lawful exit sequencing, without a clear operational test in this case.
D:In assessing the contrast between fragmented investigation missing relationship networks and uncontrolled customer termination process, that documentation is meaningful where measures to analyze connected parties, common controllers, and full transfer paths are the expected control. The present issue is uncontrolled customer termination process, and the reviewer needs records specifically tracing the chosen remedy.
Question 813
An AFC reviewer is assessing 2 distinct situations. Situation 1: The required operating or regulatory task is to convert indicators to documented detection tests and feedback. Situation 2: The required operating or regulatory task is to set legal scope, purposes, participant controls, and feedback loops. Which authorities or functions have the described responsibility for one of these cases? Choose TWO.
- Participating bank threat-intelligence team
- PPP data-governance and privacy oversight function
- Receiving institution's AML compliance owner
- Public-private financial crime coordination forum
Explanation
Correct Answers
A:For situation 1, when examining the compliance duty to convert indicators to documented detection tests and feedback, the function matches the precise jurisdictional and operational task in the stem. Its performance is reflected in typology-to-monitoring change and effectiveness results, rather than in a generic statement of standards.
D:For situation 2, responsibility follows the power to direct or oversee work to set legal scope, purposes, participant controls, and feedback loops. When examining the compliance duty to set legal scope, purposes, participant controls, and feedback loops, assigning it elsewhere could produce advice or intelligence without a valid accountable regulatory or institutional decision.
Incorrect Answers
B:The alternative is associated with data minimization as a limit on PPP sharing and the duty to restrict personal information to lawful, necessary, proportionate uses. In assessing the separate duty to restrict personal information to lawful, necessary, proportionate uses as opposed to the current duty to convert indicators to documented detection tests and feedback, in this item, situation 1 calls for action to convert indicators to documented detection tests and feedback; situation 2 calls for action to set legal scope, purposes, participant controls, and feedback loops. Regarding the duty to convert indicators to documented detection tests and feedback while considering data minimization as a limit on PPP sharing in this responsible function decision, it does not perform the particular actor role tested by these cases.
C:The alternative is associated with limitations of third-party and peer information reliance and the duty to retain each institution's accountability for required customer checks. With the separate duty to retain each institution's accountability for required customer checks as opposed to the current duty to convert indicators to documented detection tests and feedback in view, in this item, situation 1 calls for action to convert indicators to documented detection tests and feedback; situation 2 calls for action to set legal scope, purposes, participant controls, and feedback loops. Regarding the duty to convert indicators to documented detection tests and feedback while considering limitations of third-party and peer information reliance in this responsible function decision, it does not perform the particular actor role tested by these cases.
Question 814
Risk testing has demonstrated false relationships inferred from common benign nodes. Engineering must adjust the affected control instead of merely accepting the false output. What technical change would best address the described control gap?
- Contextualize link strength and avoid equating connection with guilt
- Reconstruct both origin and destination paths with temporal context
- Prove data compatibility and end-to-end workflow fit in a pilot
- Create verified person-to-entity and entity-to-entity graph links
- Use lawful transfer safeguards or privacy-preserving distributed computation
- Automate controlled ingestion with source lineage and audit logs
Explanation
Correct Answer
A:Given the technical failure of false relationships inferred from common benign nodes as the distinguishing point, this solution corrects the failure rather than merely handling additional alerts. It directly tackles false relationships inferred from common benign nodes, provided node types, transaction purpose, and relationship confidence is controlled and review precision of links across shared-service nodes is performed before release.
Incorrect Answers
B:In assessing the difference between one-directional transaction graph analysis and false relationships inferred from common benign nodes, that improvement can be tested through trace test cases backward to original funding accounts, in a setting with one-directional transaction graph analysis. With the difference between one-directional transaction graph analysis and false relationships inferred from common benign nodes in view, here the relevant acceptance criterion is review precision of links across shared-service nodes, so the alternative leaves the principal control gap open.
C:The technology is fitted to poor integration due diligence before technology purchase, not the observed false relationships inferred from common benign nodes. When examining the difference between poor integration due diligence before technology purchase and false relationships inferred from common benign nodes, its benefit would be indirect without the focused remedy and validation described in the correct approach.
D:When examining the difference between entity resolution failure in ownership network analysis and false relationships inferred from common benign nodes, this capability addresses entity resolution failure in ownership network analysis and relies on director IDs, company addresses, and provenance confidence. The current failure is false relationships inferred from common benign nodes; deploying it would not fix the broken data or decision path described in the case.
E:The alternative is useful for privacy-unsafe centralization of sensitive data, but it acts on a different technical mechanism. Correcting the stated weakness requires contextualize link strength and avoid equating connection with guilt and dependable node types, transaction purpose, and relationship confidence.
F:That improvement can be tested through reconcile case evidence against upstream transaction records, in a setting with manual evidence transfer causing case incompleteness. With the difference between manual evidence transfer causing case incompleteness and false relationships inferred from common benign nodes in view, here the relevant acceptance criterion is review precision of links across shared-service nodes, so the alternative leaves the principal control gap open.
Question 815
An AFC reviewer is assessing 2 distinct situations. Situation 1: The review concerns misuse of professional client accounts for layering but cannot yet establish whether the payment is connected to the legal engagement. Situation 2: The review concerns investment-migration gatekeeper funding opacity but cannot yet establish whether contributing funds belong to applicants or legitimate sponsors. Which proposed records directly address the distinctive unanswered question in one of these situations? Choose TWO.
- Applicant funding provenance and sponsor identities
- Incorporation mandates and true-owner declarations
- Matter files, escrow ledger, and beneficiary instructions
- Principal identities, provenance, and payment trail
Explanation
Correct Answers
A:For situation 2, this source can help answer the pivotal question of establishing whether contributing funds belong to applicants or legitimate sponsors. With the need to establish whether contributing funds belong to applicants or legitimate sponsors in view, A documented comparison to the transaction trail gives the investigator a stronger basis for disposition than transaction size or appearance by itself.
C:For situation 1, the central evidential gap concerns establishing whether the payment is connected to the legal engagement; this material is designed to resolve that specific uncertainty. Given the need to establish whether the payment is connected to the legal engagement as the distinguishing point, it should be checked against account-level events and independent sources, not accepted solely because the customer supplies it.
Incorrect Answers
B:This record would be useful when investigating company formation services enabling anonymous shells. When examining the distinction between establishing who instructs nominee directors and benefits from companies and establishing whether the payment is connected to the legal engagement, here situation 1 needs to establish whether the payment is connected to the legal engagement; situation 2 needs to establish whether contributing funds belong to applicants or legitimate sponsors. Regarding establishing whether the payment is connected to the legal engagement when evaluating company formation services enabling anonymous shells in this diagnostic evidence decision, it does not directly resolve any of those distinct evidentiary gaps.
D:This record would be useful when investigating luxury-art intermediary concealment of principals. In assessing the distinction between establishing whether the buyer, seller, and payer are the same parties and establishing whether the payment is connected to the legal engagement, here situation 1 needs to establish whether the payment is connected to the legal engagement; situation 2 needs to establish whether contributing funds belong to applicants or legitimate sponsors. Regarding establishing whether the payment is connected to the legal engagement when evaluating luxury-art intermediary concealment of principals in this diagnostic evidence decision, it does not directly resolve any of those distinct evidentiary gaps.
Question 816
A high-risk account remains open after a formal exit decision because different product teams assume one another will close it. Which defect should be recorded in the AFC program assessment?
- Improper use of confidential investigative information in an RFI
- Uncontrolled customer termination process
- Failure to execute enterprise-wide offboarding
- Improper disclosure through a partner request
Explanation
Correct Answer
C:Given the need to assign a single accountable exit coordinator and verify product closure as the distinguishing point, the situation reveals this defect because the existing workflow does not reliably achieve the relevant AFC objective. The corresponding repair is to assign a single accountable exit coordinator and verify product closure, with ownership resting in enterprise offboarding program manager.
Incorrect Answers
A:With the contrast between improper use of confidential investigative information in an RFI and failure to execute enterprise-wide offboarding in view, the corresponding consequence of this alternative would be evidenced through approved information request and restricted intelligence segregation. The stated control problem has a different operating symptom, addressed by measures to assign a single accountable exit coordinator and verify product closure.
B:That deficiency is typically owned by customer termination governance committee and rectified through measures to use cross-functional approval and lawful exit sequencing. This case calls for steps to assign a single accountable exit coordinator and verify product closure, meaning the alternative misses the central governance or process gap.
D:The alternative diagnosis describes an issue corrected through steps to check authorized sharing channels and permitted purpose before release. The scenario instead points to a failure requiring the team to assign a single accountable exit coordinator and verify product closure; confusing the two would send corrective effort to the wrong workflow.
Question 817
A formal report says the organization complies with operationalizing PPP intelligence in private-sector controls by taking steps to convert indicators to documented detection tests and feedback. The reviewer will accept only traceable proof of what occurred. What evidence should be available to demonstrate operational compliance?
- Approval and audit record for exchanged indicators
- Typology-to-monitoring change and effectiveness results
- Purpose-and-access register for shared intelligence
- PPP charter and protected intelligence-sharing protocol
Explanation
Correct Answer
B:This record links the obligation to convert indicators to documented detection tests and feedback with actual execution and provides a verifiable basis for review. It also helps demonstrate that participating bank threat-intelligence team acted within the appropriate scope.
Incorrect Answers
A:When examining the separate duty to confirm legal authority, scope, security, and use restrictions as opposed to the current duty to convert indicators to documented detection tests and feedback, that artifact shows activity in the remit of each institution's designated information-sharing officer, not the performance of the required step. It would be an indirect reference rather than defensible proof that the necessary work to convert indicators to documented detection tests and feedback happened.
C:In assessing the separate duty to restrict personal information to lawful, necessary, proportionate uses as opposed to the current duty to convert indicators to documented detection tests and feedback, this documentation is linked to data minimization as a limit on PPP sharing and work performed by PPP data-governance and privacy oversight function. It does not directly demonstrate the implementation of the obligation to convert indicators to documented detection tests and feedback in this case.
D:The record supports another process: set legal scope, purposes, participant controls, and feedback loops. The reviewer needs evidence of work to convert indicators to documented detection tests and feedback, and the proposed record would leave that operational requirement unproven.
Question 818
The proposed remedy is to contextualize link strength and avoid equating connection with guilt, in response to false relationships inferred from common benign nodes. The control owner wants to specify which dependable input data makes this feasible. What data dependency should be verified before deploying the remedy?
- Actual payment schemas and interface specifications
- Node types, transaction purpose, and relationship confidence
- Director IDs, company addresses, and provenance confidence
- Bidirectional transfer events and timestamps
Explanation
Correct Answer
B:Reliable input information is a prerequisite for correcting false relationships inferred from common benign nodes; contextualize link strength and avoid equating connection with guilt cannot compensate for unknown or misleading source attributes. An appropriate test is review precision of links across shared-service nodes.
Incorrect Answers
A:The alternative dataset is relevant to poor integration due diligence before technology purchase. It would not provide the key input required for contextualize link strength and avoid equating connection with guilt in this case, so apparent model performance could still be misleading.
C:The proposed source is appropriate for a tool tackling entity resolution failure in ownership network analysis. It does not supply the information needed to validate contextualize link strength and avoid equating connection with guilt against the current observed issue.
D:That information underpins reconstruct both origin and destination paths with temporal context when the problem is one-directional transaction graph analysis. The case instead depends on node types, transaction purpose, and relationship confidence, which is necessary to correct the stated failure and make the output auditable.
Question 819
Control mapping has identified client accounts serving as general-purpose payment channels as a vulnerability associated with misuse of professional client accounts for layering. The design must be proportionate and leave an audit trail. Which safeguard is the strongest match to the particular risk?
- Source-of-funds verification for investment programs
- Evidence-based restrictions on source-of-funds attestations
- Provenance and ultimate-party verification for art trades
- Matter-linked approval for client-account disbursements
- Beneficial ownership verification by company service providers
Explanation
Correct Answer
D:This directly reduces the chance of client accounts serving as general-purpose payment channels by placing a relevant check in the affected process. In assessing the exposure to client accounts serving as general-purpose payment channels, its effectiveness should be measured against real exceptions, without assuming that a risk indicator proves criminal conduct.
Incorrect Answers
A:In assessing the distinction between exposure to third-party capital obscured in residency investments and exposure to client accounts serving as general-purpose payment channels, that safeguard is appropriate for a setting where the exposure is third-party capital obscured in residency investments. With the distinction between exposure to third-party capital obscured in residency investments and exposure to client accounts serving as general-purpose payment channels in view, this scenario instead exposes client accounts serving as general-purpose payment channels; a control operating on the other mechanism would not be the most proportionate response.
B:With the distinction between exposure to unsupported professional assurance over illicit funds and exposure to client accounts serving as general-purpose payment channels in view, this control addresses unsupported professional assurance over illicit funds, a different vulnerability. The current exposure is client accounts serving as general-purpose payment channels; installing the alternative without a tailored check would leave the key failure path substantially open.
C:The measure is more suited to limiting anonymous ownership and settlement in high-value art. It does not directly test or prevent client accounts serving as general-purpose payment channels in the described customer or transaction process, even if it might help elsewhere in the AFC program.
E:That safeguard is appropriate for a setting where the exposure is anonymous legal persons created without look-through checks. With the distinction between exposure to anonymous legal persons created without look-through checks and exposure to client accounts serving as general-purpose payment channels in view, this scenario instead exposes client accounts serving as general-purpose payment channels; a control operating on the other mechanism would not be the most proportionate response.
Question 820
An internal audit identifies failure to execute enterprise-wide offboarding in a process whose remedial ownership sits with enterprise offboarding program manager. The reviewer requires an executable, testable correction. Which change best addresses the stated compliance-program problem?
- Assign a single accountable exit coordinator and verify product closure
- Use cross-functional approval and lawful exit sequencing
- Apply threat-sensitive escalation criteria beyond monetary size
- State who did what, when, how, and why it appears suspicious
Explanation
Correct Answer
A:This action addresses the mechanism causing failure to execute enterprise-wide offboarding, while retaining a defensible audit trail. A reviewer could subsequently inspect closed-account evidence across all channels and products to determine if the control is effective.
Incorrect Answers
B:The alternative may improve a different part of AFC governance, but it primarily tackles uncontrolled customer termination process. The actual defect, failure to execute enterprise-wide offboarding, requires a different control intervention.
C:Given the contrast between under-prioritization of terrorist-financing indicators and failure to execute enterprise-wide offboarding as the distinguishing point, this intervention solves a different weakness, namely under-prioritization of terrorist-financing indicators. It leaves the current failure to execute enterprise-wide offboarding substantially unresolved because the broken process here requires assign a single accountable exit coordinator and verify product closure.
D:In assessing the contrast between SAR narrative missing the basis for suspicion and failure to execute enterprise-wide offboarding, the proposed step is appropriate when SAR narrative missing the basis for suspicion is observed. The case instead concerns failure to execute enterprise-wide offboarding; the alternative would not repair the particular failing in time or at the correct control point.