CAMS Study Guide: Financial Crime Risk, Governance, Controls and Investigation
CAMS, the Certified Anti-Money Laundering Specialist credential from ACAMS, is designed for AML and broader anti-financial-crime professionals, including compliance, risk, audit, KYC and monitoring teams. ACAMS states an exam format of 120 questions in 210 minutes and a passing score of 75. Confirm current booking details with ACAMS.
This guide covers financial crime risks and methods; global AFC frameworks, governance and regulation; AFC compliance programs; and tools and technology. It separates international standards, binding local requirements, institutional policy and sound practice.
How to use this guide
- Study each concept as a decision rule, then explain its boundary without looking.
- Use the 20 original practice questions to diagnose errors in reasoning.
- Check current jurisdictional requirements when a scenario depends on local law.
See the ACAMS CAMS certification page for provider information.
Scope and study priorities
| ACAMS subject area | Scope | Editorial study priority |
|---|---|---|
| Understanding Risks and Methods of Financial Crime | Money laundering, terrorist financing, sanctions, fraud, corruption, tax evasion and sector typologies | High: explain mechanisms and choose proportionate responses to indicators |
| Global AFC Frameworks, Governance, and Regulations | FATF standards, domestic implementation, sanctions, beneficial ownership and information sharing | High: separate standards, binding law and operational effectiveness |
| Building an AFC Compliance Program | Risk assessment, CDD, EDD, roles, testing, reporting and remediation | High: connect risk findings to control design and accountable decisions |
| Tools and Technologies to Fight Financial Crime | Monitoring, screening, investigations, data, digital identity and AI controls | High: diagnose evidence gaps, detection failures and escalation choices |
60 CAMS concepts 1-10
1. Money laundering as movement of value
Understanding Risks and Methods of Financial Crime
Money laundering concerns the handling of criminal proceeds to obscure origin or make them appear legitimate. Placement, layering and integration describe common analytical stages, not a mandatory sequence that every case follows. Start with the suspected source of value, trace how control and appearance change, and ask which evidence connects transactions. The language of stages is useful for explaining risk but cannot prove a particular offence.
Example: A business deposits cash, moves it through several companies and later purchases property. The analyst traces each transfer and tests whether the cash came from real sales.
Pitfall: Calling any complex transfer layering skips the source question. Complexity may support inquiry, but the analyst still needs evidence about purpose, parties and underlying funds.
2. Placement and cash entry points
Understanding Risks and Methods of Financial Crime
Placement refers to introducing potentially illicit value into a financial channel. Cash-intensive businesses, deposits and currency exchange can offer entry points, yet their use is often legitimate. Compare deposits with documented sales, seasonality, locations and expected volumes. Patterns matter more than a single amount. A practical inquiry establishes whether activity fits a credible commercial explanation before escalation or closure.
Example: A new market stall deposits more cash than expected during a festival week. Sales records and event attendance help the reviewer test the increase.
Pitfall: A cash business is not inherently suspicious. Equally, a plausible business category does not excuse unexplained deposits that materially exceed its documented activity.
3. Layering and transaction chains
Understanding Risks and Methods of Financial Crime
Layering uses transfers, conversions or structures that make the origin or ownership of value harder to follow. Investigators should reconstruct the chain: sender, recipient, timing, amount, economic purpose and any change in asset form. Rapid movement through several accounts can be relevant when it lacks a commercial rationale. The inquiry should still test ordinary explanations such as treasury operations or settlement arrangements.
Example: Funds arrive in a newly opened account, move through two affiliated companies within hours and return as a loan. The reviewer examines contracts and corporate relationships.
Pitfall: The number of transfers alone does not establish laundering. A documented treasury chain may be complex, while a single concealed transfer can be significant.
4. Integration and apparent legitimacy
Understanding Risks and Methods of Financial Crime
Integration describes value returning to the economy with an apparently legitimate explanation, such as investment income, a business sale or a loan repayment. The explanation should be checked against economic substance and earlier funds flow. A lawful asset purchase does not cleanse an unlawful source. Equally, an investment structure should not be called criminal merely because it has several entities.
Example: A customer describes incoming funds as proceeds from a property sale. The analyst compares the sale contract, ownership record and payment trail with the stated amount.
Pitfall: Treating a polished contract as proof of legitimacy ignores whether the asset or buyer was financed with the same unexplained funds being investigated.
5. Terrorist financing and source of funds
Understanding Risks and Methods of Financial Crime
Terrorist financing analysis asks where funds go and what they support, as well as where they came from. Funds can originate from lawful donations, wages or businesses. Review recipient links, stated purpose and transaction pattern under applicable local law. Avoid assuming that a lawful source resolves destination risk, or that a charitable label establishes misuse. The evidence must connect the activity to a relevant concern.
Example: A charity's donations are documented, but payments to an unfamiliar intermediary have no program records. The investigator checks the intermediary and intended beneficiaries.
Pitfall: Focusing only on whether donors earned the funds legally misses the possible end use. Conversely, an overseas charity payment alone is not proof of prohibited financing.
6. Predicate offences, fraud and tax crime
Understanding Risks and Methods of Financial Crime
A predicate offence is underlying criminal conduct capable of generating proceeds that may later be laundered. Fraud, corruption and qualifying tax crimes can supply such proceeds, but the definition and treatment of tax offences depend on applicable law. Distinguish criminal tax evasion from lawful tax planning before interpreting unusual tax-related payments. Then trace the value produced by the suspected conduct and its subsequent movement. An opaque transfer may indicate concealment without identifying the predicate offence.
Example: A company uses fabricated supplier invoices to divert revenue and then sends the proceeds through related entities. Investigators assess the false invoicing, any locally defined tax offence and the later movement of funds as separate questions.
Pitfall: Do not label a disputed tax position criminal solely because the structure is complex. Establish the relevant local offence and the evidence connecting it to the funds.
7. Fraud proceeds in AML analysis
Understanding Risks and Methods of Financial Crime
Fraud may be both an immediate customer harm and a source of funds that later move through accounts. Compare victim reports, account opening dates, beneficiary changes and speed of onward transfer. A fraud response may require urgent operational action, while AML reporting follows the applicable regime and its own decision process. Coordinating the two workstreams prevents evidence or timing gaps without merging their legal tests.
Example: Several victims send funds to a recently opened account, followed by rapid withdrawals. Fraud staff act on account risk while AML investigators map the proceeds flow.
Pitfall: A fraud label does not settle every AML question. The investigator must still examine who controlled the account, where funds went and what reporting duties apply.
8. Corruption and bribery indicators
Understanding Risks and Methods of Financial Crime
Bribery and corruption risk can appear through payments to intermediaries, opaque ownership or fees disproportionate to documented services. Examine the commercial purpose, decision maker, timing and beneficial owner. Public office or government business may raise exposure, but neither establishes wrongdoing alone. The control response should address the specific route by which a benefit could reach an official or decision maker.
Example: A contractor proposes a large success fee to a consultant shortly before a public tender award. Compliance requests service evidence and checks the consultant's ownership.
Pitfall: A high commission is not automatically a bribe. The decisive concern is the unsupported value transfer and its connection to a relevant decision.
9. Trade-based money laundering
Understanding Risks and Methods of Financial Crime
Trade can move value through manipulated prices, quantities, quality descriptions or shipments. Compare invoices with contracts, shipping evidence, customs data where available and independent price ranges. A discrepancy should be assessed in light of freight, grade, timing and commercial terms. The method is especially relevant when the movement of money and goods diverges without a credible explanation.
Example: An importer pays for 500 units, but carrier and warehouse records show 100. The analyst seeks documents that could explain the difference before escalating.
Pitfall: A price outside a public average is not conclusive. Specialized specifications and delivery terms can explain differences, so test comparable goods and actual shipment evidence.
10. MSBs, remittance corridors and correspondent exposure
Understanding Risks and Methods of Financial Crime
Money services businesses serve legitimate payment needs but can move funds rapidly across borders. Assess senders, beneficiaries, agents, corridors and aggregate patterns rather than transfer size alone. A bank providing correspondent services should also understand its respondent's business, controls and access offered to other institutions or remitters. Nested activity can limit visibility into the underlying parties. Identify what information the bank receives, where visibility ends and which proportionate controls address that gap under applicable rules.
Example: A correspondent bank sees rising payments through a respondent used by several remitters. It asks how the respondent identifies remitters and their customers, then compares the answers with observed corridors and volumes.
Pitfall: A higher-risk corridor or nested relationship is a reason to investigate exposure, not proof of illicit activity. Small transfers can also form a material aggregate pattern.
60 CAMS concepts 11-20
11. Gambling and value conversion
Understanding Risks and Methods of Financial Crime
Gambling products can convert deposits into withdrawals or transferable balances. Review source of funding, actual gaming activity, withdrawal destination and links among accounts. Low play relative to deposits may be a useful indicator, but the business rules and customer behavior matter. The control objective is to identify unexplained value conversion without assuming every large win or withdrawal is suspicious.
Example: A customer deposits funds, places a few small wagers and requests payment to a new account. The operator compares play history and ownership of the destination.
Pitfall: A withdrawal after limited play is an indicator, not a finding. Promotional rules or legitimate changes in preference may explain it if independently supported.
12. Real estate and professional gatekeepers
Understanding Risks and Methods of Financial Crime
Property transactions can absorb large value and involve companies, agents, lawyers or other gatekeepers. Examine who provides the money, who controls the buyer, transaction price and rationale for rapid resale or unusual financing. A professional intermediary may supply useful records but does not remove the institution's own duties. Relevant obligations for property actors vary by jurisdiction.
Example: A company buys property using funds from an unrelated third party. The lender traces the payer's relationship to the buyer and checks the transaction rationale.
Pitfall: Assuming a lawyer's involvement proves clean funds delegates the institution's judgment. The intermediary's presence is evidence of a process, not proof of source.
13. Virtual-asset activity and changing standards
Understanding Risks and Methods of Financial Crime
Virtual-asset analysis should start with the service actually performed, custody arrangements and transfer counterparties. FATF's 2021 virtual-asset guidance discusses service providers, peer-to-peer exposure and the Travel Rule, but it does not incorporate later amendments to the Recommendations, including changes made in 2025. Read the guidance with the current Recommendations and applicable domestic rules. A public blockchain trail can show transfers; attributing an address to a person requires further evidence. A DeFi label or NFT label alone does not decide whether the activity falls within a regulated definition.
Example: A customer moves assets from an exchange to several self-hosted addresses. The analyst traces flows, checks the stated purpose and seeks corroboration before attributing the addresses to a named person.
Pitfall: Do not apply a 2021 guidance passage as if it states current domestic law, or assume that every interface called DeFi is a regulated service provider.
14. Sanctions and proliferation exposure
Understanding Risks and Methods of Financial Crime
Sanctions and proliferation financing exposure may arise through parties, goods, routes, ownership or end use. Identify the applicable jurisdiction and specific restriction before deciding what the institution must do. A customer can present both AML and sanctions concerns, but the legal tests and immediate handling may differ. Escalation should preserve evidence and prevent an unreviewed transaction from proceeding where a restriction may apply.
Example: A trade payment names an intermediary linked to controlled equipment. The analyst checks the goods, end user, ownership and applicable restrictions before release.
Pitfall: A country risk rating is not a sanctions prohibition. Conversely, a seemingly ordinary product can matter when the end user or controlled component changes the analysis.
15. Red flags versus conclusions
Understanding Risks and Methods of Financial Crime
A red flag is an observation that makes a hypothesis worth testing. Record what was seen, why it departs from expected behavior, what evidence could explain it and what remains unresolved. Several weak indicators may combine into a meaningful pattern, while a strong apparent indicator may have a documented explanation. This discipline improves escalation quality and avoids both automatic suspicion and premature dismissal.
Example: A merchant receives midnight payments from several countries. Its documented online operating hours explain timing, but unexplained refund recipients still require review.
Pitfall: Calling an indicator proof invites unsupported reporting decisions. Calling it harmless after one explanation may overlook other material facts in the same pattern.
16. FATF standards and binding U.S. and EU requirements
Global AFC Frameworks, Governance, and Regulations
The FATF Recommendations set international standards; domestic law determines an institution's binding duties. In the United States, BSA statutes and implementing rules establish applicable program, recordkeeping and reporting obligations under FinCEN's legal authorities. EU Regulation 2024/1624 generally applies from 10 July 2027, with specified categories from 10 July 2029; adoption alone does not make every provision applicable in 2026. Distinguish that regulation's start dates from directives requiring national implementation. Map each requirement to the covered entity, jurisdiction, effective date and institutional control.
Example: A group compliance team compares customer due diligence in its U.S. and EU operations. It records current U.S. rules separately from the EU regulation's future application dates and each entity's existing local duties.
Pitfall: Do not cite a FATF standard as a local filing rule or treat an adopted EU provision as already applicable. Check the covered institution, effective rule and jurisdiction.
17. Risk-based approach
Global AFC Frameworks, Governance, and Regulations
A risk-based approach allocates attention and controls according to identified exposure. Assess customer, product, channel and geographic factors, then consider how they combine in actual activity. Higher risk usually calls for stronger evidence or monitoring; lower risk can support proportionate measures where law permits. The decision should be documented so reviewers can understand both the risk and the chosen response.
Example: A local payroll account and a complex cross-border trading company receive different verification and monitoring intensity because their exposures differ in identifiable ways.
Pitfall: Risk-based does not mean optional compliance. Mandatory local requirements still apply, and a low rating needs evidence rather than a convenient label.
18. Technical compliance and effectiveness
Global AFC Frameworks, Governance, and Regulations
Technical compliance examines whether required laws, powers and institutional arrangements exist. Effectiveness asks whether the system produces useful outcomes. A country may have strong legal text but weak investigations, supervision or asset recovery. For institutional learning, compare a control's written design with evidence that it detects, escalates and resolves relevant cases. Neither a policy document nor a raw alert count demonstrates performance alone.
Example: A regulator finds that banks have reporting policies but submit reports with little usable transaction detail. The gap concerns how the system works in practice.
Pitfall: A high number of reports is not automatically effective. Quality, timeliness and use of information matter more than volume without context.
19. National, sector and institutional risk assessments
Global AFC Frameworks, Governance, and Regulations
National and sector assessments identify threats and vulnerabilities beyond one institution's portfolio. Translate their findings into an assessment of the customers, products and channels the institution actually serves. U.S. FinCEN priorities can inform this work, but a stated priority does not itself create a new suspicious activity reporting trigger; applicable duties come from statutes and rules within FinCEN's legal authorities. Document how external intelligence changes a control, and test whether the change addresses observed exposure rather than assigning every customer in a named sector the same risk rating.
Example: After an assessment identifies misuse of import companies, a bank reviews its trade portfolio. It selects relevant payment and document checks, then applies local reporting rules to any resulting investigation.
Pitfall: Copying a national rating into customer files substitutes sector context for customer evidence. Treating a policy priority as an independent filing threshold likewise misstates its role.
20. FATF and regional-body mutual evaluations
Global AFC Frameworks, Governance, and Regulations
FATF and FATF-style regional bodies assess jurisdictions through mutual evaluations and follow-up processes. Read both technical compliance findings, which address the legal and institutional framework, and effectiveness findings, which examine results. A report can reveal weaknesses in supervision, beneficial ownership information or investigations that matter to a firm's exposure. Check the report date and subsequent follow-up before using a finding. Translate it into questions about actual counterparties and transactions rather than treating a country rating as a customer verdict.
Example: A bank reviews an evaluation describing weak beneficial ownership information in a counterparty's jurisdiction. It requests evidence for a particular corporate structure and checks later follow-up before setting controls.
Pitfall: A favorable jurisdiction result does not clear an individual customer. An unfavorable result calls for proportionate inquiry, not an automatic conclusion that every transaction is suspicious.
60 CAMS concepts 21-30
21. UN, regional and national sanctions
Global AFC Frameworks, Governance, and Regulations
Sanctions analysis starts with the regimes that have a legal connection to the institution or transaction. UN Security Council measures may be implemented through domestic or regional law; a country may also impose additional restrictions. FATF targeted-financial-sanctions standards address specified terrorist-financing and proliferation-financing risks, but they do not replace the applicable sanctions law. Identify the payment route and relevant jurisdictions, then examine the parties, ownership, goods and prohibited conduct under each applicable regime. A possible name match requires identity resolution and legal analysis before disposition.
Example: A payment involving an EU customer passes through a U.S. correspondent. The sanctions team checks the legal reach of each relevant regime and resolves the possible party match before deciding how the payment must be handled.
Pitfall: Do not assume a UN designation has identical direct legal effect everywhere. Do not treat every screening alert as a confirmed prohibited transaction.
22. OFAC aggregate and indirect ownership
Global AFC Frameworks, Governance, and Regulations
Under OFAC's U.S. 50 Percent Rule, an entity owned 50 percent or more in aggregate, directly or indirectly, by one or more blocked persons is itself treated as blocked even if unnamed on a list. Trace the actual ownership chain and identify entities that are blocked at an intermediate level. A blocked intermediary's stake is assessed under OFAC's guidance; mechanically multiplying a blocked owner's percentage through that entity can give the wrong result. Control alone below the ownership threshold does not automatically block an entity under this rule, though other prohibitions may apply.
Example: A blocked person owns 30 percent of Company T. Another blocked entity owns 25 percent of T. The blocked stakes aggregate to 55 percent for this U.S. ownership analysis.
Pitfall: Do not clear an unnamed entity solely because no single listed person directly owns 50 percent. Do not treat a control relationship alone as satisfying this ownership test.
23. Sanctions program governance
Global AFC Frameworks, Governance, and Regulations
OFAC's compliance framework describes management commitment, risk assessment, internal controls, testing and training for U.S. sanctions risk. Use it to evaluate whether screening and escalation work as a system. It is a framework, not a universal statute for every country. A credible program assigns owners, tests list updates, records decisions and corrects failures that may have affected transactions.
Example: After a failed list update, management funds a feed fix, tests the corrected search index and reviews transactions processed during the gap.
Pitfall: A vendor contract does not transfer accountability for sanctions control quality. The institution still needs evidence that its own screening population and lists are complete.
24. Beneficial ownership chains
Global AFC Frameworks, Governance, and Regulations
Beneficial ownership analysis seeks the natural person or persons who ultimately own or control a customer, according to applicable local rules. Trace entities, trusts, nominees and voting arrangements rather than stopping at the first legal owner. Reconcile documents that conflict and identify the evidence used. A chart is useful only when the underlying records support its links and conclusions.
Example: A company is owned by a holding company and a trust. The onboarding team obtains records that identify relevant people and explain how control is exercised.
Pitfall: A nominee's name may conceal rather than resolve ownership. Equally, a claimed controller should not be accepted solely because the applicant supplies a neat diagram.
25. Legal ownership and effective control
Global AFC Frameworks, Governance, and Regulations
Share percentages are important, but ownership and control may diverge through voting rights, appointment powers or other arrangements. Assess both routes under the applicable definition and retain evidence for the conclusion. A person with a small economic interest may direct a company; a large passive stake may carry different rights. The purpose is an accurate picture of who can benefit from or direct the customer.
Example: A founder owns a minority stake but can appoint most directors under a shareholder agreement. The analyst evaluates control as well as share ownership.
Pitfall: A percentage table cannot answer every control question. Read relevant agreements and governance records instead of assuming the largest shareholder always directs the entity.
26. Financial intelligence units and the Egmont Group
Global AFC Frameworks, Governance, and Regulations
A financial intelligence unit receives and analyzes reports under its domestic mandate and may disseminate intelligence to competent authorities. The Egmont Group supports cooperation among member FIUs through established channels; membership does not give a bank independent authority to send customer files abroad. An institution must follow its local reporting route, protect restricted report information and document the basis for its own filing decision. Cross-border requests should move through authorized legal and institutional processes.
Example: A bank reports linked cross-border transactions to its local FIU with a clear payment trail. Any FIU-to-FIU exchange occurs through the authorities' channels rather than an informal bank disclosure.
Pitfall: Do not treat an international cooperation network as an exception to local confidentiality, privacy or reporting rules.
27. Information sharing and public-private cooperation
Global AFC Frameworks, Governance, and Regulations
Information sharing may occur between institutions or through public-private arrangements, but each exchange needs an applicable legal basis and defined purpose. Before disclosure, identify who may receive which customer or transaction fields, what safeguards apply, and whether a suspicious-report document or its existence is protected. A public-private partnership can improve typology intelligence without authorizing unrestricted transfer of identifiable case files. Record the channel and decision so investigators can distinguish a lawful intelligence lead from evidence they may disclose or rely on.
Example: A partnership circulates an approved typology describing payment patterns. A bank checks the local sharing mechanism before supplying transaction-level details about a named customer.
Pitfall: Participation in a partnership is not blanket permission to disclose customer data. Removing a name may still leave an identifiable transaction trail.
28. Privacy and data minimization
Global AFC Frameworks, Governance, and Regulations
AML work often requires sensitive personal and transactional data. Collect and share what is relevant to a defined purpose, restrict access and retain records according to applicable law and policy. Excessive collection can create privacy risk without improving an investigation. Too little data can make a control ineffective. A documented purpose and access trail help explain why a particular dataset was necessary.
Example: A case team needs beneficiary names and payment dates to test a network link, but has no reason to circulate unrelated medical information in the customer's file.
Pitfall: More data is not always stronger due diligence. Unrelated information can obscure the decision and increase exposure if accessed or shared improperly.
29. Ethics and escalation independence
Global AFC Frameworks, Governance, and Regulations
Financial crime judgments can be distorted by revenue pressure or a senior customer's influence. Define escalation rights and record overrides, evidence and decision makers. Staff should be able to raise a concern without relying on the commercial owner to approve the concern itself. Independence does not mean compliance alone owns every decision; it means material challenge can reach an authorized forum.
Example: A senior executive asks staff to waive ownership checks for a valuable client. The reviewer records the request and escalates through the approved governance route.
Pitfall: A verbal assurance from a powerful sponsor is not evidence about the customer's ownership. Document the basis for any exception and who accepted its risk.
30. Financial inclusion with effective controls
Global AFC Frameworks, Governance, and Regulations
Rigid evidence requirements can exclude people who present manageable risk but lack standard documents. Where domestic rules permit, alternative identification methods and proportionate product controls can support access while preserving CDD. Assess the reliability of the alternative evidence and the account's intended use. The risk-based approach should create a defensible path to service, not a blanket exemption from verification.
Example: An applicant lacks a utility bill but provides permitted alternative evidence. The institution documents its verification method and applies limits suited to expected activity.
Pitfall: Financial inclusion is not permission to skip required identity checks. Nor does missing one conventional document automatically make the applicant high risk.
60 CAMS concepts 31-40
31. Enterprise-wide risk assessment
Building an AFC Compliance Program
An enterprise-wide risk assessment links the institution's customers, products, channels and geographies to plausible financial crime threats. It should consider inherent exposure, control design and residual risk, with evidence for each judgment. Its value lies in decisions: staffing, monitoring, due diligence and new-product approval. Review it when the business or threat picture changes, not only on a calendar.
Example: A bank launches instant cross-border payments. Its risk team evaluates corridors, speed, customer segments and available intervention time before approving the control package.
Pitfall: A polished heat map is weak if its ratings do not change controls. Record the assumptions and decisions each material risk finding produced.
32. Inherent and residual risk
Building an AFC Compliance Program
Inherent risk describes exposure before considering the mitigating effect of controls. Residual risk considers the exposure that remains after those controls operate. A low residual rating needs evidence that controls work; a written procedure alone is insufficient. Compare customer behavior and control results over time. This distinction helps leaders decide whether to accept, reduce or change an exposure.
Example: A high-volume remittance product has elevated inherent corridor risk. Tested monitoring and documented agent oversight reduce some exposure, but residual risk remains above average.
Pitfall: Subtracting a control score mechanically can hide weak execution. A failed list feed should change the residual-risk judgment even if the policy looks strong.
33. Customer identification and verification
Building an AFC Compliance Program
Customer identification records who the customer claims to be; verification tests that claim with reliable evidence under applicable rules. Select methods suited to the customer type and channel, and record exceptions. Remote onboarding may require different fraud and identity controls from in-person service. Completing a form is not the same as establishing that its key claims are reliable.
Example: A remote applicant submits an identity document and a live capture. The team checks the permitted evidence and resolves a mismatch before activating the account.
Pitfall: An uploaded document is not automatically verified identity. Examine authenticity, consistency and the method required by local rules and institutional policy.
34. Purpose and expected activity
Building an AFC Compliance Program
CDD should establish why a customer wants the relationship and what activity is reasonably expected. Record products, counterparties, geographies, volumes and funding patterns at a useful level of detail. The baseline supports later monitoring and should change when reliable evidence shows the business has changed. A vague label such as 'general trading' gives investigators little to compare with actual payments.
Example: An importer expects monthly supplier payments in two named markets. Sudden daily payments to unrelated intermediaries trigger a review of whether the business model changed.
Pitfall: Expected activity is a testable baseline, not a permanent ceiling. Legitimate growth may explain a deviation, but that explanation needs evidence.
35. Customer risk rating
Building an AFC Compliance Program
A customer risk rating combines relevant factors and helps set due diligence and monitoring intensity. Define the scoring logic, permitted overrides and approval authority. Ratings should reflect evidence about the customer and its activity, not stereotypes or commercial preference. Review changes in ownership, products, geography or behavior that may make the original rating stale.
Example: A domestic distributor begins sourcing from new overseas intermediaries. Compliance reassesses the rating using the changed activity and records the control implications.
Pitfall: A high-risk label does not explain which exposure matters. A low-risk label does not excuse monitoring when actual transactions contradict the original profile.
36. Enhanced due diligence
Building an AFC Compliance Program
Enhanced due diligence seeks additional understanding or assurance where exposure warrants it. Measures may include deeper ownership analysis, source-of-funds evidence, business-purpose checks or more frequent review, subject to applicable rules. Choose evidence that addresses the identified uncertainty. Repeating standard checks without testing the specific risk adds cost but little assurance. Record what the extra work established and what remains unresolved.
Example: A company has several foreign holding entities and unusual payment corridors. The team maps its controllers and verifies the economic purpose of expected transactions.
Pitfall: EDD is not a fixed stack of documents for every customer. Ask what question each item answers and whether the answer changes the decision.
37. Source of funds and source of wealth
Building an AFC Compliance Program
Source of funds concerns the origin of money used in a specific transaction or relationship. Source of wealth concerns how a person's broader assets were accumulated. The two inquiries can support each other but answer different questions. Match requested evidence to the risk: a bank statement may trace an immediate transfer without explaining the origin of long-standing wealth.
Example: A customer funds an investment from a recent company sale. The team verifies sale proceeds for the transfer and assesses whether the sale plausibly explains accumulated assets.
Pitfall: A transfer from another bank establishes a route, not necessarily the economic origin. Avoid treating the last account as the full source explanation.
38. Politically exposed persons
Building an AFC Compliance Program
A politically exposed person may present elevated corruption exposure because of a prominent public function, subject to local definitions and requirements. Assess the role, jurisdiction, transaction purpose, connections and available safeguards. Family members or close associates may also require attention under applicable rules. The status is a risk factor, not an accusation, and should lead to proportionate evidence and approval.
Example: A newly appointed official opens a business account for a private company. Compliance examines ownership, business purpose and funding against the relevant PEP controls.
Pitfall: Automatic rejection treats status as misconduct. Automatic acceptance because a public official is well known ignores the specific exposure and required checks.
39. Ongoing due diligence
Building an AFC Compliance Program
CDD continues after onboarding. Compare actual behavior with the customer's understood purpose, update material facts and investigate deviations. Review frequency should reflect risk and relevant local requirements. Event-driven review can be more useful than waiting for a periodic date when ownership, products or transaction patterns change. Keep the customer profile usable for monitoring rather than merely complete on paper.
Example: A manufacturer begins receiving third-party payments after a new distribution agreement. The reviewer checks the agreement and updates expected activity if it is supported.
Pitfall: A current review date does not mean the profile is current. An unexamined ownership change can invalidate earlier assumptions immediately.
40. Three lines of defence
Building an AFC Compliance Program
Business teams manage risks in their activities; compliance and risk functions set frameworks and challenge; internal audit provides independent assurance. Exact structures vary, but accountability should remain clear. A second-line review does not erase the business owner's responsibility for onboarding or transactions. Audit should assess control design and operation rather than become the routine approver of decisions it later reviews.
Example: A relationship manager proposes an exception, compliance challenges the evidence and an authorized owner decides. Internal audit later tests whether exceptions followed the process.
Pitfall: Sending every difficult decision to internal audit compromises its assurance role. Define an operational approval route and preserve audit's independent review.
60 CAMS concepts 41-50
41. Policies, procedures and control evidence
Building an AFC Compliance Program
A policy sets expectations and authority; procedures explain how staff carry out controls. Evidence shows whether the steps actually occurred. Translate broad requirements into owners, triggers, records and escalation points. A control should be understandable to the staff who run it and testable by those who review it. Where local law differs, procedures should identify the jurisdictional variation.
Example: A sanctions policy requires screening. The procedure names the list source, update check, match reviewer, escalation route and records retained for each disposition.
Pitfall: A comprehensive policy cannot compensate for a broken workflow. Test whether required data arrived and decisions were made, not just whether the document exists.
42. Role-based training
Building an AFC Compliance Program
Training should connect a role's decisions to the risks and controls it encounters. A teller, trade analyst and model owner need different examples and escalation practice. Assess understanding through realistic decisions rather than attendance alone. Update training when products, threats or procedures change. Feedback from case errors can reveal where a lesson needs to be rewritten.
Example: After repeated weak trade escalations, the bank trains analysts to compare invoices, shipping records and commercial explanations using recent anonymized cases.
Pitfall: Completion percentages measure attendance, not judgment. A team can finish a module yet still misclassify the same risk indicator in live cases.
43. Independent testing
Building an AFC Compliance Program
Independent testing examines whether controls are suitably designed and operating. Define the population, sample rationale, test steps and evidence before reaching a conclusion. Findings should distinguish isolated errors from systemic failures and identify the affected period. The tester's independence and scope matter; management retains responsibility for fixing the issue and confirming the remedy works.
Example: Testing finds that one payment type bypassed monitoring after a software release. The team identifies affected transactions, repairs mapping and validates the restored feed.
Pitfall: A sample with no exceptions cannot prove every transaction was covered if the sample excluded an entire channel. Check completeness before interpreting results.
44. Board and senior management reporting
Building an AFC Compliance Program
Leaders need decision-useful information on exposure, control performance, material incidents and remediation. Pair metrics with interpretation: a falling alert count may signal tuning success or a failed data feed. Explain assumptions, trends, ownership and decisions required. Reporting should enable challenge and resource allocation, not merely show activity totals. Escalate material weaknesses in time for action.
Example: A dashboard shows fewer sanctions alerts after an update. The report explains a reconciliation failure, affected volume, immediate containment and the proposed remedy.
Pitfall: Green indicators based only on volume can hide missed risk. Report both detection quality and known control limitations.
45. Recordkeeping and remediation
Building an AFC Compliance Program
Useful records show the evidence, reasoning, decision maker and timing of a control action, subject to local retention rules. Remediation should identify root cause, affected population, owner, deadline and proof of effectiveness. Closing an issue because a procedure was rewritten is weak if the underlying system or behavior has not changed. A lookback may be needed when the gap affected past activity.
Example: A screening defect is fixed and tested, then prior transactions are reviewed for missed matches. The issue file records findings and approval to close.
Pitfall: A completed action item is not necessarily a corrected control. Verify operation on real or representative data before treating the risk as resolved.
46. Monitoring as a detection system
Tools and Technologies to Fight Financial Crime
Transaction monitoring compares activity with risk patterns and customer expectations. Its effectiveness depends on data coverage, scenario logic, thresholds, alert handling and feedback. Define which products and transaction types enter the system before judging detection. A useful scenario identifies behavior worth investigation, not simply the largest possible number of alerts. Investigators then test context and explanations.
Example: A new instant-payment product launches. The monitoring team verifies that its transactions enter the feed and tests rapid onward-transfer scenarios against sample cases.
Pitfall: More alerts do not automatically mean better detection. A noisy rule can consume capacity while a missing product produces no alerts at all.
47. Data lineage and completeness
Tools and Technologies to Fight Financial Crime
Data lineage traces each monitoring or screening field from source to decision system. Reconcile counts and key attributes across interfaces, especially after releases or product changes. Completeness and accuracy are separate: every record may arrive while a critical beneficiary field is blank. A control can be well designed in theory and ineffective because the input needed for its logic never reaches it.
Example: A payment feed has the expected record count, but beneficiary country is missing for one channel. The team tests mapping and assesses affected alerts.
Pitfall: A successful file transfer proves transmission, not usable content. Validate fields, values and coverage against the source population.
48. Scenario thresholds and segmentation
Tools and Technologies to Fight Financial Crime
Thresholds define when a monitoring scenario creates an alert. Segmentation allows different customer or product groups to use criteria suited to their behavior. Tune with both suspicious and ordinary cases, testing sensitivity and operational workload. A threshold change should have a documented objective and approval. Avoid hiding a weak scenario by raising its threshold until alerts disappear.
Example: A payroll rule generates many routine alerts. Analysts test a separate payroll segment while checking that rapid third-party transfers remain detectable.
Pitfall: A lower false-positive rate can mask missed cases. Review what the proposed tuning excludes, not only how much workload it saves.
49. Alert triage and evidence
Tools and Technologies to Fight Financial Crime
Triage determines which alerts need deeper work based on stated facts, customer profile and available records. Preserve the transaction trail and explain why an alert was escalated or closed. A good disposition addresses the rule's specific concern rather than repeating a generic customer description. Consistent triage improves later quality review and helps identify rules that generate unproductive alerts.
Example: A rapid-transfer alert involves a known property settlement. The analyst checks contract dates and counterparties, then documents why the timing is explained.
Pitfall: Writing 'activity consistent with profile' without showing the comparison is not an evidential explanation. Record the facts that resolved the triggered concern.
50. Investigative hypothesis testing
Tools and Technologies to Fight Financial Crime
An investigation should frame plausible explanations and identify evidence that could support or weaken each one. Review parties, chronology, amounts, customer history and external information available lawfully. Seek disconfirming evidence as well as confirming evidence. This approach guards against treating a typology match as proof and helps the final decision show why a benign explanation was accepted or rejected.
Example: A series of transfers resembles mule activity. The investigator tests employment payments, device links and onward transfers before deciding whether the pattern remains unexplained.
Pitfall: Collecting only facts that support the first suspicion creates confirmation bias. Ask what evidence a legitimate explanation would produce and whether it exists.
60 CAMS concepts 51-60
51. Watchlist matching and identity resolution
Tools and Technologies to Fight Financial Crime
Screening finds possible matches between customer or transaction data and relevant lists. Name similarity starts a review; identifiers, dates, locations and other reliable attributes help resolve identity. Too-strict matching can miss variants, while too-broad matching can overwhelm reviewers. Document the logic and evidence behind true-match and false-match decisions, and escalate unresolved cases under applicable rules.
Example: A payment name resembles a listed party, but date of birth and location differ. The reviewer evaluates the quality of each identifier before disposition.
Pitfall: A common-name match is not a confirmed sanctions hit. Equally, one mismatched attribute may not clear a case if the underlying data is unreliable.
52. List updates and screening coverage
Tools and Technologies to Fight Financial Crime
Screening depends on timely, complete list ingestion and coverage of the intended customer and transaction population. Reconcile the provider file, internal index and screened records. After an update failure, fix the pipeline and evaluate exposure during the gap. Match volume is a weak quality measure unless the team knows whether lists and transactions were present.
Example: Newly listed names appear in a vendor file but not the search index. The team repairs ingestion and rechecks transactions processed after the update.
Pitfall: Fewer alerts after a list update may mean a defect, not improved precision. Verify the loaded names before changing fuzzy-match settings.
53. Case management and audit trail
Tools and Technologies to Fight Financial Crime
Case management should preserve the trigger, evidence reviewed, investigative steps, decisions and approvals. A clear chronology lets another reviewer understand what was known at each point. Access controls protect sensitive material, and version history reduces confusion when new facts arrive. Good case records also support quality assurance, remediation and lawful information requests.
Example: An investigator links three alerts, records bank statements and customer responses, then documents why the combined pattern merits escalation.
Pitfall: A final disposition without the intermediate evidence is hard to challenge or reproduce. Record the path to the decision, not only its label.
54. Suspicious activity reporting decisions
Tools and Technologies to Fight Financial Crime
A suspicious activity or transaction report decision follows the applicable local reporting regime and an authorized institutional process. Document the activity, evidence, unresolved concerns and rationale. A red flag initiates inquiry but does not dictate filing by itself. Where disclosure restrictions apply, limit customer communication appropriately. Reporting should be timely and accurate under the relevant rules, with no invented universal threshold.
Example: A case team cannot reconcile rapid transfers with the customer's stated business. It records the evidence and escalates for a local reporting decision.
Pitfall: Treating every alert as reportable dilutes judgment. Treating a customer's unsupported explanation as decisive can prematurely close a well-evidenced concern.
55. Digital identity proofing versus authentication
Tools and Technologies to Fight Financial Crime
Identity proofing assesses an applicant's claimed identity. Authentication checks whether a returning user controls an accepted authenticator. CDD may also require understanding a legal entity's beneficial ownership and purpose. NIST authentication guidance can inform technical controls, but it is distinct from local CDD law. A stronger login can reduce account takeover while leaving onboarding or ownership gaps unresolved.
Example: A bank adds a strong mobile authenticator. Fraudulent logins decline, but compliance still needs evidence supporting a corporate customer's claimed controllers.
Pitfall: A successful biometric login does not establish who ultimately owns the corporate customer. It answers a session-access question, not the full CDD question.
56. Model validation and change control
Tools and Technologies to Fight Financial Crime
Validation asks whether a model or rule performs for its intended population and purpose. Examine data, assumptions, outcomes, missed cases and performance by segment. Changes need testing, approval and a record of expected effects. A launch test cannot guarantee continued performance after customer mix or products change. Human review remains valuable when its decisions are captured as evidence for improvement.
Example: A ranking model scores new payment-product cases too low. The team tests representative cases and governs a revised model before deployment.
Pitfall: A strong overall accuracy figure can conceal poor detection in a small high-risk segment. Examine the errors that matter to the control objective.
57. Analytics and network evidence
Tools and Technologies to Fight Financial Crime
Network analysis can reveal shared accounts, devices, addresses or transaction paths. Each link has a different evidential strength. A shared intermediary may reflect common service use rather than common control; a repeated device may reflect a shared workplace or fraud operation. Investigators should label the link type, test alternative explanations and avoid turning an inferred association into an identity claim.
Example: Several accounts send funds through one intermediary. The analyst tests whether it is a legitimate payment processor before calling the customers a coordinated network.
Pitfall: A graph edge is not proof of conspiracy. The meaning of the link depends on how it was created and whether independent evidence supports coordination.
58. Automation with human accountability
Tools and Technologies to Fight Financial Crime
Automation can sort alerts, gather records and check routine conditions, but responsibility for control outcomes remains with the institution. Define when a human must review, how exceptions are surfaced and what evidence the system records. Monitor for silent failures such as missing fields or changed source formats. Effective automation makes decisions more consistent and reviewable while preserving routes for challenge.
Example: A tool attaches transaction histories to alerts, but flags incomplete data for a reviewer rather than silently closing those cases.
Pitfall: Fast processing is not proof of sound judgment. Measure error types and missed cases, especially where automated closure removes human visibility.
59. AI-assisted investigation controls
Tools and Technologies to Fight Financial Crime
An AI-generated case summary or recommendation should be tested against the source population and the decision it is meant to support. Reconcile inputs to source transactions, check whether material facts are omitted or invented, and compare recommendations on cases with materially similar evidence. Test performance across relevant customer and product segments, then repeat targeted checks when data, prompts or the underlying population change. Preserve source references, output versions and the investigator's reasoning so an authorized reviewer can examine a disagreement and correct the record. Human sign-off is meaningful only when the reviewer can see the underlying evidence.
Example: Two cases have the same rapid-transfer pattern, but the tool recommends escalation for only one. Reviewers trace both outputs to their source transactions, find that one feed omitted a beneficiary change and assess affected cases before wider use.
Pitfall: A fluent summary with citations can still omit an uncited transaction or draw an unsupported conclusion. Check source coverage and recommendation consistency, not just whether the text reads well.
60. Control feedback loop
Tools and Technologies to Fight Financial Crime
Investigation outcomes, quality reviews, testing findings and external intelligence should feed back into monitoring and screening design. Classify errors by cause: missing data, weak logic, poor triage or unclear policy. Assign an owner and verify that a change fixes the problem without creating a new gap. This loop turns isolated cases into measurable improvements in the broader AFC program.
Example: Several missed cases share a newly introduced payment code. The team updates mapping, tests detection and reviews transactions processed since the code appeared.
Pitfall: Changing a rule after one case can overfit it to an anecdote. Test the change against representative suspicious and ordinary activity.
Six-session study plan
Official references
These references support the guide's standards and examples. FATF publications are international standards and guidance; applicable domestic law determines binding duties. Verify current provider and jurisdictional details at the source.
- ACAMS CAMS Certification
- FATF Recommendations
- OFAC: Entities Owned by Blocked Persons (50 Percent Rule)
- OFAC: A Framework for Compliance Commitments
- FATF: Risk-Based Approach to Virtual Assets and VASPs
- NIST SP 800-63B-4: Authentication and Authenticator Management
- FinCEN Legal Authorities and Bank Secrecy Act framework
- EU Regulation 2024/1624 (AMLR), official text
- FATF 2025 financial inclusion and proportionate AML/CFT guidance
- NIST SP 800-63A-4: Identity Proofing and Enrollment
- FinCEN: current Beneficial Ownership Information reporting
- FinCEN: Customer Due Diligence Final Rule
- FinCEN FIN-2026-R001: beneficial-owner verification exceptive relief