Question 80
A bank appoints a reporting officer but grants no direct route to senior governance for material suspicious-activity issues. What is the principal control-design or governance failure?
- Customer risk assessment that ignores material exposure drivers
- First-line ownership failure in identifying and escalating risk
- Inadequate authority of the MLRO or BSA officer
- Blurred first- and second-line responsibility
Explanation
Correct Answer
C:Given the need to give the designated officer clear escalation authority and access to oversight as the distinguishing point, the decisive control failure lies in the handling of the scenario's specific risk or obligation. The appropriate repair is to give the designated officer clear escalation authority and access to oversight, under the accountability of board-approved MLRO or BSA officer function, and then test its operation.
Incorrect Answers
A:With the contrast between customer risk assessment that ignores material exposure drivers and inadequate authority of the MLRO or BSA officer in view, the alternative diagnosis describes an issue corrected through steps to use transparent ownership, geography, delivery channel, and activity inputs. The scenario instead points to a failure requiring the team to give the designated officer clear escalation authority and access to oversight; confusing the two would send corrective effort to the wrong workflow.
B:When examining the contrast between first-line ownership failure in identifying and escalating risk and inadequate authority of the MLRO or BSA officer, the corresponding consequence of this alternative would be evidenced through escalation samples reconciled to customer service records. The stated control problem has a different operating symptom, addressed by measures to give the designated officer clear escalation authority and access to oversight.
D:In assessing the contrast between blurred first- and second-line responsibility and inadequate authority of the MLRO or BSA officer, this weakness would appear in a process requiring staff to return routine process execution to operations while retaining independent second-line challenge. It is not the defining break in the present case, where the remediation must be designed to give the designated officer clear escalation authority and access to oversight to address the observed behavior.
Question 81
An evidence review concerning operational costs from misallocated compliance resources finds the file does not establish whether monitoring resources match actual exposure. The investigator wants a record that can be checked independently. What documentation offers the most direct corroboration?
- Alert backlog segmented by customer and corridor risk
- Consumer complaints paired with marketing claims
- Correspondent termination notices and remediation history
- Case logs matched to training and supervisory records
Explanation
Correct Answer
A:This material provides a practical way to establish whether monitoring resources match actual exposure. Given the need to establish whether monitoring resources match actual exposure as the distinguishing point, its value is in linking the customer's asserted purpose to observed facts, so investigators can articulate a reasoned conclusion.
Incorrect Answers
B:Given the distinction between establishing whether promised investments existed and customers consented and establishing whether monitoring resources match actual exposure as the distinguishing point, the document helps with investigations focused on whether promised investments existed and customers consented. In this case the evidential gap lies with whether monitoring resources match actual exposure, so the reviewer needs a more targeted source before reaching a conclusion.
C:In assessing the distinction between establishing whether partner exits were linked to unresolved AFC deficiencies and establishing whether monitoring resources match actual exposure, such records could help establish whether partner exits were linked to unresolved AFC deficiencies in a different investigation. Here the precise evidential question involves establishing whether monitoring resources match actual exposure, so the suggested material would be indirect and may not resolve the decisive uncertainty.
D:The proposed source is most informative for a question about whether staff acted on written escalation duties. The current case calls for establishing whether monitoring resources match actual exposure; using this instead could leave the customer explanation largely untested.
Question 82
A lessons-learned committee is addressing inadequate authority of the MLRO or BSA officer. It needs a specific remediation action that can be tested for effectiveness. What should be implemented to prevent this particular recurrence?
- Separate control design ownership from independent assurance testing
- Give the designated officer clear escalation authority and access to oversight
- Return routine process execution to operations while retaining independent second-line challenge
- Require business staff to report concerns through protected AFC channels
Explanation
Correct Answer
B:This responds to the identified weakness, inadequate authority of the MLRO or BSA officer, at the point where the process breaks down. Assigning the change to board-approved MLRO or BSA officer function and testing reporting charter and recorded board escalations makes remediation verifiable rather than aspirational.
Incorrect Answers
A:Given the contrast between compromised third-line independence and inadequate authority of the MLRO or BSA officer as the distinguishing point, the alternative may improve a different part of AFC governance, but it primarily tackles compromised third-line independence. The actual defect, inadequate authority of the MLRO or BSA officer, requires a different control intervention.
C:The proposed step is appropriate when blurred first- and second-line responsibility is observed. The case instead concerns inadequate authority of the MLRO or BSA officer; the alternative would not repair the particular failing in time or at the correct control point.
D:This approach is usually evidenced by escalation samples reconciled to customer service records, addressing first-line ownership failure in identifying and escalating risk. It is not a substitute for the targeted corrective action needed to resolve inadequate authority of the MLRO or BSA officer in this workflow.
Question 83
Authorities require designated businesses to submit alerts on reasonable suspicion instead of waiting for proven criminality. What source of authority or core principle is most relevant to the described problem?
- Proportionate simplified due diligence under FATF standards
- FATF Recommendation 1 on risk-based assessment
- FATF Recommendation 10 on customer due diligence
- FATF suspicious transaction reporting principle
Explanation
Correct Answer
D:The issue calls for a response to mandate prompt reporting of suspicion under domestic requirements, and this framework defines the corresponding public or private obligation. The relevant implementation responsibility lies with national competent authority designating reporting obligations, not with an unrelated institution or voluntary practice.
Incorrect Answers
A:The alternative governs a different activity: retain essential identification and apply relief only where permitted. Although related to financial-crime compliance, it does not establish the precise duty that national competent authority designating reporting obligations must perform here.
B:Its main application involves national AML policy authority implementing FATF standards and an implementation such as require documented assessment and proportionate mitigation of ML and TF exposure. The facts in this scenario call for mandate prompt reporting of suspicion under domestic requirements, making that framework secondary rather than controlling.
C:This authority supports require identification and reasonable verification of beneficial owners and produces evidence such as customer files showing verified beneficial-owner information. The required response here is mandate prompt reporting of suspicion under domestic requirements, so the legal or governance route is not the same.
Question 84
Customer dates of birth are stored in different formats across core banking and screening tools, degrading match quality. Which technical or analytical weakness explains the observed result?
- Unverified same-name external-data matches
- Identifier collisions and entity resolution failure
- Inconsistent identity attribute normalization
- Disconnected detection and investigation tools
- Incomplete transaction data ingestion
Explanation
Correct Answer
C:Given the proposed capability of standardize data types and apply tested transformation rules as the distinguishing point, the case reveals a specific failure mode in monitoring, screening, onboarding, or analytics. Addressing it requires standardize data types and apply tested transformation rules; independent confirmation should include measure mismatches before and after identity normalization instead of vendor claims alone.
Incorrect Answers
A:With the competing solutions of use contextual identifiers and source credibility when assessing records and standardize data types and apply tested transformation rules in view, this problem is normally investigated with use contextual identifiers and source credibility when assessing records and validated through review false-positive decisions for common-name cohorts. When examining the competing solutions of use contextual identifiers and source credibility when assessing records and standardize data types and apply tested transformation rules, those activities address a different failure mode; the case requires standardize data types and apply tested transformation rules supported by canonical date format with provenance and validation rules.
B:The alternative would explain a setting that needs unique cross-system identity keys and entity merge decisions. The present tool's failure is different and should instead be tested through measure mismatches before and after identity normalization, making this diagnosis less defensible.
D:In assessing the competing solutions of introduce a governed cross-control case and identity linkage layer and standardize data types and apply tested transformation rules, the problem described by this alternative concerns trace an end-to-end multi-risk case across integrated systems and a separate analytical failure. It does not capture the central weakness the institution needs to resolve with standardize data types and apply tested transformation rules.
E:With the competing solutions of reconcile source population to monitoring population with exception alerts and standardize data types and apply tested transformation rules in view, this problem is normally investigated with reconcile source population to monitoring population with exception alerts and validated through compare transaction totals and missing-field rates each cycle. When examining the competing solutions of reconcile source population to monitoring population with exception alerts and standardize data types and apply tested transformation rules, those activities address a different failure mode; the case requires standardize data types and apply tested transformation rules supported by canonical date format with provenance and validation rules.
Question 85
After a thematic review of operational costs from misallocated compliance resources, the compliance committee prioritizes reducing high-risk activity concealed by inefficient alert volumes. The control should work at the relevant entry point. What targeted measure should reduce the identified vulnerability?
- Risk-weighted capacity allocation and monitoring tuning
- Board oversight of material AFC remediation commitments
- Control-effectiveness testing and remediation ownership
- Environmental-crime indicators in sectoral risk controls
Explanation
Correct Answer
A:This directly reduces the chance of high-risk activity concealed by inefficient alert volumes by placing a relevant check in the affected process. Given the exposure to high-risk activity concealed by inefficient alert volumes as the distinguishing point, its effectiveness should be measured against real exceptions, without assuming that a risk indicator proves criminal conduct.
Incorrect Answers
B:That safeguard is appropriate for a setting where the exposure is unaddressed confidence concerns among funding partners. This scenario instead exposes high-risk activity concealed by inefficient alert volumes; a control operating on the other mechanism would not be the most proportionate response.
C:This control addresses policies that exist on paper but are not followed, a different vulnerability. The current exposure is high-risk activity concealed by inefficient alert volumes; installing the alternative without a tailored check would leave the key failure path substantially open.
D:The measure is more suited to limiting facilitation of illicit natural-resource proceeds. It does not directly test or prevent high-risk activity concealed by inefficient alert volumes in the described customer or transaction process, even if it might help elsewhere in the AFC program.
Question 86
Senior oversight asks who should be responsible for addressing inadequate authority of the MLRO or BSA officer. The approved change is to give the designated officer clear escalation authority and access to oversight, not merely issue advisory opinions. Which function should be assigned responsibility for this control repair?
- Chief audit executive or audit committee
- Board risk committee with business leadership
- First-line relationship management supervisor
- Board-approved MLRO or BSA officer function
- Second-line head of AFC compliance
Explanation
Correct Answer
D:The central responsibility is to give the designated officer clear escalation authority and access to oversight and retain evidence of completion, not simply offer second opinions. That aligns with the work needed to resolve inadequate authority of the MLRO or BSA officer and maintain reporting charter and recorded board escalations.
Incorrect Answers
A:The alternative's control domain is compromised third-line independence, generally corrected through steps to separate control design ownership from independent assurance testing. In assessing the contrast between compromised third-line independence and inadequate authority of the MLRO or BSA officer, here the relevant weakness is inadequate authority of the MLRO or BSA officer, requiring a different remediation ownership and workplan.
B:In assessing the contrast between risk appetite not translated into commercial limits and inadequate authority of the MLRO or BSA officer, this function has a remit connected with the duty to set customer acceptance thresholds and incentive-compatible exception approvals, and the associated problem is risk appetite not translated into commercial limits. The current repair requires the responsible team to give the designated officer clear escalation authority and access to oversight, so it should not be allocated to a team without direct control over that work.
C:Its normal responsibility would be addressing first-line ownership failure in identifying and escalating risk. It may advise or review here, but the accountable execution of measures to give the designated officer clear escalation authority and access to oversight belongs in the process identified by this case.
E:Given the contrast between blurred first- and second-line responsibility and inadequate authority of the MLRO or BSA officer as the distinguishing point, the alternative's control domain is blurred first- and second-line responsibility, generally corrected through steps to return routine process execution to operations while retaining independent second-line challenge. In assessing the contrast between blurred first- and second-line responsibility and inadequate authority of the MLRO or BSA officer, here the relevant weakness is inadequate authority of the MLRO or BSA officer, requiring a different remediation ownership and workplan.
Question 87
A compliance implementation note cites FATF suspicious transaction reporting principle but lacks an operational action plan. The responsible function must deliver a traceable response. What should the responsible institution implement to address the described requirement?
- Update exposure assumptions, controls, and board reporting for the corridor
- Mandate prompt reporting of suspicion under domestic requirements
- Retain essential identification and apply relief only where permitted
- Combine sector data, known typologies, and mitigation capacity
Explanation
Correct Answer
B:Here the appropriate implementation follows the regulatory or governance remit of national competent authority designating reporting obligations. It creates concrete action on the problem, with suspicious transaction reports with recorded grounds for suspicion available to demonstrate completion.
Incorrect Answers
A:The alternative concerns a different risk overseen by bank enterprise risk assessment owner. It would not implement the specific requirement in the case, which requires the responsible party to mandate prompt reporting of suspicion under domestic requirements and an associated record.
C:When examining the separate duty to retain essential identification and apply relief only where permitted as opposed to the current duty to mandate prompt reporting of suspicion under domestic requirements, this intervention relates to risk justification and approved simplified CDD procedure in a separate regulatory setting. It cannot substitute for mandate prompt reporting of suspicion under domestic requirements here because the scenario involves a different obligation and authority.
D:That step is appropriate for an obligation involving sectoral financial-crime risk assessment methodology. In this case the task is mandate prompt reporting of suspicion under domestic requirements, and carrying out the alternative would not satisfy the identified requirement.
Question 88
Diagnostics confirm inconsistent identity attribute normalization. The technology owner needs a sustainable corrective capability rather than an ad hoc downstream workaround. Which solution design most directly corrects the defect?
- Standardize data types and apply tested transformation rules
- Capture model reasons and require explainable review decisions
- Reconcile source population to monitoring population with exception alerts
- Build a mastered identifier with verified source lineage
Explanation
Correct Answer
A:The improvement addresses inconsistent identity attribute normalization by changing the relevant detection, verification, or governance capability. It depends on canonical date format with provenance and validation rules, and measure mismatches before and after identity normalization provides a practical acceptance criterion.
Incorrect Answers
B:The alternative is useful for uninterpretable pKYC refresh triggers, but it acts on a different technical mechanism. Correcting the stated weakness requires standardize data types and apply tested transformation rules and dependable canonical date format with provenance and validation rules.
C:That improvement can be tested through compare transaction totals and missing-field rates each cycle, in a setting with incomplete transaction data ingestion. Here the relevant acceptance criterion is measure mismatches before and after identity normalization, so the alternative leaves the principal control gap open.
D:The technology is fitted to identifier collisions and entity resolution failure, not the observed inconsistent identity attribute normalization. With the difference between identifier collisions and entity resolution failure and inconsistent identity attribute normalization in view, its benefit would be indirect without the focused remedy and validation described in the correct approach.
Question 89
A bank processes transactions tied to environmental crime and later faces restitution claims and asset-freezing orders. What financial-crime risk should be the starting hypothesis for the review?
- Fraud proceeds being laundered through a mule account
- Legal and financial consequences of facilitating predicate crime
- Reputational damage with banking-service disruption
- Operational costs from misallocated compliance resources
Explanation
Correct Answer
B:The key issue is the unresolved relationship, which requires establishing whether funds came from prohibited resource extraction. That inquiry is consistent with the indicated financial-crime pattern and matters because it can expose facilitation of illicit natural-resource proceeds; an assessment should document evidence both for and against suspicion.
Incorrect Answers
A:This typology would be worth testing when the issue is establishing whether the incoming transfer was authorized by the real payer, leading to exposure from rapid movement of impersonation-fraud proceeds. The present facts instead call for establishing whether funds came from prohibited resource extraction, so choosing it would send the investigation toward a different mechanism.
C:The alternative addresses activity that might produce unaddressed confidence concerns among funding partners and would require evidence about whether partner exits were linked to unresolved AFC deficiencies. Those are not the facts that drive this scenario, whose defining task is to establish whether funds came from prohibited resource extraction.
D:That interpretation is associated with a different situation where investigators must establish whether monitoring resources match actual exposure. It would direct attention toward high-risk activity concealed by inefficient alert volumes, whereas this case principally calls for establishing whether funds came from prohibited resource extraction; the signals should not be treated as interchangeable.
Question 90
A challenge panel will not accept a sign-off for inadequate authority of the MLRO or BSA officer based only on policy language. The institution says it can now give the designated officer clear escalation authority and access to oversight; an operating record is necessary. What would substantiate resolution of the identified AFC weakness?
- Reporting charter and recorded board escalations
- Validated customer risk-factor configuration and examples
- Escalation samples reconciled to customer service records
- Audit independence declarations and approved audit plan
Explanation
Correct Answer
A:Given the deficiency of inadequate authority of the MLRO or BSA officer as the distinguishing point, the record gives an auditable link between the expected remediation and observed practice. It is especially useful for verifying that inadequate authority of the MLRO or BSA officer has not continued under a different workflow.
Incorrect Answers
B:This record would help assess whether steps to use transparent ownership, geography, delivery channel, and activity inputs worked in a different scenario. The current test needs to establish whether measures to give the designated officer clear escalation authority and access to oversight corrected inadequate authority of the MLRO or BSA officer; the suggested artifact cannot show that directly.
C:The proposed evidence corresponds to oversight of first-line ownership failure in identifying and escalating risk. It would leave the actual remediation, give the designated officer clear escalation authority and access to oversight, without a clear operational test in this case.
D:That documentation is meaningful where measures to separate control design ownership from independent assurance testing are the expected control. The present issue is inadequate authority of the MLRO or BSA officer, and the reviewer needs records specifically tracing the chosen remedy.