Exam Overview and What Makes It Hard
Exam overview
The Certified AFC Investigator, formerly known as Advanced CAMS-FCI, is an advanced specialist credential for professionals who perform or supervise complex financial crime investigations. ACAMS currently describes the exam as 90 single-choice questions in 180 minutes. Appointment rules, fees, and language availability can change, so check current details directly with ACAMS before booking.
This guide is written in English as study material; that does not indicate which languages are available for the official exam. The concepts follow the four published domains and are original study explanations, not real or recalled exam questions. This edition reflects provider information verified on 11 October 2026.
How to use this guide
Work from governance foundations to complex investigation methods, then typologies and reporting. For each scenario, distinguish observed facts from interpretations, identify what would corroborate or challenge a hypothesis, and choose a proportionate next step. Apply the relevant jurisdiction’s rules where the facts require a legal decision.
- Governance: intake, prioritization, quality assurance, escalation, staffing, and independence.
- Investigation practice: strategy, evidence, analysis, open sources, interviews, and cross-border cooperation.
- Typologies: recognize patterns while testing alternative explanations and possible convergence.
- Reporting: make decisions under applicable law and communicate specific, supportable facts.
Published syllabus and official domain weights
| Domain | Published scope | Official domain weight |
|---|---|---|
| Governance of an AFC Investigations Unit | Intake standards, prioritization, service-level agreements, quality assurance, management reporting, escalation, staffing, and investigation independence. | 20% |
| Leading Complex Investigations | Case strategy, evidence, account and transaction analysis, open-source intelligence, adverse media, link analysis, interviews, and cross-border cooperation. | 30% |
| Financial Crime Typologies — Intermediate | Layering, trade-based money laundering, mule networks, fraud proceeds, corruption, sanctions evasion, cyber-enabled crime, and virtual assets. | 30% |
| Reporting Suspicious Activity | SAR/STR decision-making, narrative quality, supporting documentation, law-enforcement referrals, information sharing, and post-filing controls. | 20% |
60 concepts, from unit governance to useful reporting 1–10
1. The investigation unit’s mandate
Governance of an AFC Investigations Unit
A clear mandate defines which referrals the unit handles, its investigative authority, how it works with other functions, and what outcomes it is expected to produce. It gives investigators a consistent boundary without dictating the conclusion of an individual case. A mandate should make responsibilities understandable to staff and stakeholders, including who can approve scope changes or resolve conflicts.
Practical example: A unit receives an alert about suspected customer fraud. Its mandate says it may review related accounts and escalate relevant findings, but it must refer employee misconduct to a separate independent function.
Common misconception: A mandate is not a script for deciding whether activity is suspicious. Overly prescriptive instructions can suppress case-specific judgment; vague authority can leave important referrals unowned.
2. Minimum intake information
Governance of an AFC Investigations Unit
Intake standards make referrals usable and comparable by identifying the information needed to understand the trigger, relevant customers or accounts, known activity, prior reviews, and urgency. They should also provide a way to handle incomplete referrals rather than allowing missing fields to become an automatic rejection. The aim is a reliable starting point, not a guarantee that the referral is complete.
Practical example: A referral lacks the date range behind an unusual-activity alert. The intake team asks for that detail and records what can still be triaged while it is outstanding.
Common misconception: A complete template does not prove the referral is accurate or important. Treat required fields as a quality aid, not a substitute for validating the underlying information.
3. Risk-based triage
Governance of an AFC Investigations Unit
Triage sorts incoming matters according to relevant risk, potential harm, time sensitivity, complexity, and available information. A defensible method makes the factors visible and allows an experienced reviewer to override a score when the facts justify it. Triage determines where attention begins; it does not decide guilt, reporting obligations, or the ultimate case outcome.
Practical example: Two referrals arrive together. One concerns a high-volume account with an immediate risk of funds moving onward; the other is an older, low-activity alert. The unit documents why the first receives earlier review.
Common misconception: A numerical score is not an objective truth. Rigidly following a score can bury unusual but serious cases or disguise weak assumptions in the underlying criteria.
4. Priorities can change as facts develop
Governance of an AFC Investigations Unit
Prioritization is an ongoing decision, not a one-time intake label. New counterparties, rapid movement of funds, linked cases, emerging vulnerability, or a time-sensitive request may justify changing the case’s order or resources. Recording why priority changed helps managers distinguish considered reassessment from inconsistent handling and supports fair allocation across the caseload.
Practical example: A routine payment investigation reveals that several related accounts are sending funds onward within minutes. The investigator updates the risk assessment and requests a priority review.
Common misconception: Initial triage should not lock a case into a low-priority lane. Equally, new information should be assessed and documented rather than treated as automatic proof of criminality.
5. Service-level agreements as controls
Governance of an AFC Investigations Unit
Service-level agreements set expected handling times or milestones so that work is visible, managed, and less likely to stall. They help identify capacity problems and overdue decisions. They should be designed with escalation and exception mechanisms, because complex investigations may require justified additional work. The control is timely, accountable progress—not speed at the expense of reliable analysis.
Practical example: A case approaches its review milestone, but a key cross-border response is pending. The investigator documents the dependency, seeks an authorized extension, and keeps the case visible.
Common misconception: Meeting an internal deadline is not evidence of a sound investigation. Closing a complex case merely to satisfy a target can create a governance failure rather than improve performance.
6. Case ownership and accountability
Governance of an AFC Investigations Unit
Clear case ownership identifies who is responsible for strategy, updates, decisions, and escalation, even when multiple specialists contribute. Managers remain accountable for oversight without replacing the investigator’s documented analysis. Where responsibilities are divided, the record should show who made each material decision and who must act next, reducing gaps during handoffs or staff absences.
Practical example: A transaction analyst supplies a network map while a case investigator owns the overall assessment. The case record assigns follow-up tasks and identifies the person responsible for the next review.
Common misconception: Shared contribution does not mean shared accountability is clear by default. A case can stall when every participant assumes another person owns the decision or follow-up.
7. Escalation routes
Governance of an AFC Investigations Unit
Escalation routes define how investigators raise significant risk, unresolved disagreement, resource constraints, potential conflicts, or decisions beyond their authority. A useful route identifies the recipient, the information required, and how the decision returns to the case team. Escalation should preserve a record of competing views and the rationale for the action taken.
Practical example: An investigator believes a case requires specialist review, but the assigned manager sees it as routine. The investigator uses the documented escalation channel and records the evidence behind the request.
Common misconception: Escalation is not an admission that the investigator has failed. Waiting until a deadline or serious issue has passed can make a sound escalation process ineffective.
8. Investigation independence
Governance of an AFC Investigations Unit
Independence means that findings and investigative decisions are not improperly shaped by the commercial interests or personal relationships affected by the case. Governance can support it through clear reporting lines, conflict declarations, reassignment options, and protected escalation. Independence does not remove oversight; it protects the integrity of judgment while keeping decisions reviewable.
Practical example: A case concerns a major client managed by an investigator’s close business contact. The investigator discloses the relationship, and a manager assigns an independent reviewer.
Common misconception: Independence is not achieved merely because an investigator signs a declaration. A real or perceived conflict needs practical management and a documented explanation of the safeguard.
9. Quality assurance: design and operation
Governance of an AFC Investigations Unit
Quality assurance examines both whether the review process is designed to catch important failures and whether staff actually apply it in practice. Design review asks whether standards and controls address the unit’s risks. Operating review tests real files, decisions, and records. The distinction helps identify whether a problem calls for process redesign, clearer guidance, coaching, or closer supervision.
Practical example: A review finds that all files use the approved template, but complex closures lack documented alternative hypotheses. The template itself may need redesign, not just reminders to complete it.
Common misconception: A process can operate exactly as designed and still be inadequate. Conversely, a strong written procedure offers little assurance if case reviews show it is routinely ignored.
10. Representative quality sampling
Governance of an AFC Investigations Unit
Quality reviews need a sample that can reveal weaknesses across relevant case types, investigators, risk levels, and outcomes. A sample restricted to easy or recently closed files may miss delay, weak escalation, or premature closure. Sampling choices should match the question being tested, and findings should be recorded clearly enough to identify recurring patterns rather than isolated impressions.
Practical example: A manager reviews routine closures and escalated cases, including open matters, to test whether prioritization and escalation work as intended across different case paths.
Common misconception: A large sample is not automatically representative. If it excludes complex files or cases still in progress, it may provide false reassurance about how the unit operates.
60 concepts, from unit governance to useful reporting 11–20
11. Management reporting that supports decisions
Governance of an AFC Investigations Unit
Management reporting should connect activity measures to decisions about risk, quality, capacity, and performance. Volumes and elapsed time can show workload pressure, while outcomes from quality reviews may reveal weak reasoning or inconsistent escalation. Useful reports explain definitions, trends, limitations, and actions required; they do not imply that one metric alone measures investigative effectiveness.
Practical example: A dashboard shows rising case volumes and fewer completed reviews. Managers compare the figures with complexity and staffing information before changing allocation or expectations.
Common misconception: A high closure count does not necessarily mean strong investigative work. Metrics without context can reward fast disposal and hide weak decisions or unresolved risk.
12. Capacity and specialist capability
Governance of an AFC Investigations Unit
Staffing decisions should account for both workload and the skills needed for the cases received. A unit may need access to transaction analysis, language, technology, trade, or virtual-asset expertise, depending on its caseload. Training, supervision, and specialist consultation should be arranged so investigators know when their knowledge is insufficient and how to obtain help without losing case ownership.
Practical example: A case involves complex digital-asset flows beyond the assigned investigator’s experience. The investigator keeps responsibility for the case but requests a specialist’s documented analysis.
Common misconception: Adding headcount alone does not solve a capability gap. Nor should a specialist’s involvement become a reason to stop recording how their analysis informs the overall case.
13. Start with an investigation strategy
Leading Complex Investigations
A case strategy states the question being investigated, the main hypotheses, known information, evidence gaps, planned steps, and conditions for reassessment or closure. It turns a broad suspicion into a reasoned sequence of work. The strategy can evolve as findings emerge, but recording changes helps explain why the investigation widened, narrowed, or changed direction.
Practical example: An account receives unexplained transfers and quickly sends funds to several businesses. The investigator plans to compare activity with the customer profile, identify counterparties, and test whether the business explanation fits.
Common misconception: A strategy is not a fixed theory that evidence must confirm. Treating the opening suspicion as settled can turn later research into confirmation seeking instead of investigation.
14. Distinguish investigative leads from substantiated findings
Leading Complex Investigations
Investigative intelligence can direct attention, generate hypotheses, or help prioritize inquiries; information used as evidence may support a case assessment. These are not always mutually exclusive categories, and their precise meaning can depend on context and applicable standards. Record the source, reliability, verification, relevance, and use of information so that an unverified lead is not presented as an established fact.
Practical example: An online article names a customer’s associate in an alleged fraud. The investigator records the article as a lead, checks the identity and allegation against reliable sources, and looks for relevant account records before drawing a connection to the customer’s activity.
Common misconception: Public availability does not establish that an allegation is true. A lead can guide inquiries, but the report should distinguish the allegation from independently verified facts and avoid claiming more than the available information supports.
15. Provenance and reliability of information
Leading Complex Investigations
Provenance records where information came from, when it was obtained, how it was collected, and whether it has been altered or independently checked. Reliability concerns the source’s authority, accuracy, relevance, and limitations. These questions matter when investigators combine internal records, external material, and third-party analysis; without them, a case may depend on an untraceable or misunderstood assertion.
Practical example: A spreadsheet received from another team contains transaction totals but no source details. The investigator asks for the underlying records and documents which figures were independently reproduced.
Common misconception: A polished document or system export is not automatically reliable. Its origin, completeness, context, and any transformation still need consideration before it supports a conclusion.
16. Build a customer and account baseline
Leading Complex Investigations
A baseline describes the customer’s known profile, expected activity, relationships, and account purpose so observed transactions can be assessed in context. A departure from the baseline can be informative, but only if the baseline itself is current and sufficiently grounded. Investigators should distinguish verified customer information from assumptions and consider whether changes in legitimate circumstances explain a shift in activity.
Practical example: A small importer begins receiving large payments from unrelated individuals. The investigator compares the new activity with the stated business, account history, and available information about its customers.
Common misconception: Unusual compared with a profile does not automatically mean suspicious. The profile may be stale, incomplete, or based on an inaccurate assumption that itself needs checking.
17. Analyse transactions in context
Leading Complex Investigations
Transaction analysis examines amounts, frequency, direction, timing, counterparties, purpose, and relationship to expected activity. Looking at individual payments alone can conceal an aggregate pattern; looking only at aggregates can conceal meaningful details. A clear analysis links the selected period and transactions to the investigative question and explains why the observed pattern matters.
Practical example: Several modest incoming transfers appear ordinary when viewed separately. A timeline shows that they are quickly consolidated and sent to a new overseas counterparty inconsistent with the account’s stated use.
Common misconception: A large payment is not inherently suspicious, and small payments are not inherently harmless. Meaning depends on the customer, pattern, purpose, and other available facts.
18. Use timelines to test explanations
Leading Complex Investigations
A timeline places relevant account events alongside customer activity, external events, communications, and investigative actions. It can reveal sequencing, rapid movement, gaps, or contradictions that are difficult to see in separate records. A timeline should distinguish confirmed dates from estimates and avoid implying causation merely because two events occurred close together.
Practical example: Payments begin shortly after a customer reports a change in business activity. A timeline helps test whether the new explanation preceded the transactions or was offered only after questions arose.
Common misconception: Temporal proximity alone does not prove that one event caused another. A timeline organizes facts; investigators still need evidence linking events to the hypothesis.
19. Analyse counterparties and purpose
Leading Complex Investigations
Counterparty analysis asks who is sending or receiving funds, how they relate to the customer, and whether the payment purpose makes sense in context. Names alone rarely establish a meaningful relationship. Investigators can compare transaction descriptions, known business activities, shared details, and available records while marking uncertainty about identity, ownership, or role.
Practical example: A customer describes repeated payments as supplier costs. The investigator reviews recipient profiles and invoices to see whether the counterparties plausibly provide the claimed goods or services.
Common misconception: An unfamiliar counterparty is not proof of wrongdoing. The concern becomes stronger when the relationship, purpose, transaction pattern, and customer explanation fail to fit together.
20. Link analysis reveals relationships
Leading Complex Investigations
Link analysis organizes relationships among people, accounts, entities, transactions, locations, and events. It can expose shared identifiers, common intermediaries, or repeated movement that is hard to recognize in isolated records. A useful link map distinguishes direct, verified connections from inferred or uncertain ones and remains focused on the investigative question rather than collecting connections indiscriminately.
Practical example: Several accounts send funds to different businesses, then converge on one intermediary. A link map helps determine whether the shared route is meaningful and which records could verify the relationships.
Common misconception: A visual connection is not proof of coordination. Links can result from common service providers, coincidence, or incomplete identity data, so their basis and significance must be tested.
60 concepts, from unit governance to useful reporting 21–30
21. Evaluate open-source information
Leading Complex Investigations
Open-source intelligence can help identify leads, relationships, reputational concerns, and questions for further inquiry. Investigators should assess who published the information, when it was published, what it actually says, whether the subject is correctly identified, and whether independent sources support it. Record what the source contributed without overstating its evidential value.
Practical example: A company website lists a customer as a regional distributor. The investigator records the source and date, then compares that claim with account activity and other available information.
Common misconception: Search results are not a complete or neutral account of a person or business. Repetition across sites may trace back to one unverified source rather than provide independent corroboration.
22. Assess adverse media carefully
Leading Complex Investigations
Adverse media can inform risk assessment and investigative direction, but its significance depends on identity match, source quality, allegation, timing, resolution, and connection to the activity under review. Investigators should document how they assessed the report and what follow-up was proportionate. An allegation may be relevant even when it is not proof of the customer’s conduct.
Practical example: A credible report alleges misconduct by a person linked to a customer. The investigator verifies the identity and relationship, reviews the report’s status, and checks whether account activity connects to the alleged conduct.
Common misconception: Treating an allegation as established fact unfairly overstates the evidence. Ignoring it because it is only media can also be unsound if it is a relevant, credible risk signal.
23. Plan interviews around questions
Leading Complex Investigations
Interview planning begins by identifying what is unknown, which person may have relevant knowledge, and what reliable records should be reviewed first. Questions should be clear, neutral, and designed to test explanations rather than secure agreement with a theory. The investigator should capture the source, context, and limitations of the information obtained and follow applicable internal procedures.
Practical example: Before asking about a cluster of payments, the investigator checks the transaction record and prepares questions about the stated counterparties, business purpose, and timing.
Common misconception: An interview response is not self-verifying. A confident explanation may be accurate or mistaken; assess it against independent records and avoid leading questions that shape the answer.
24. Cross-border cooperation
Leading Complex Investigations
Cross-border work requires coordination about the investigative question, available records, responsible parties, and applicable information-handling constraints. Different institutions or jurisdictions may have distinct processes and legal requirements. A disciplined request is specific, necessary to the case, and tracked through response and follow-up; uncertainty should be escalated to appropriate specialists rather than resolved by assumption.
Practical example: A transaction passes through an overseas affiliate. The investigator identifies the precise account records needed and uses the organization’s approved channel to request them.
Common misconception: A cross-border connection does not make every international route suspicious. Nor should investigators assume that information can be shared or used without considering applicable rules.
25. Test alternative hypotheses
Leading Complex Investigations
Alternative-hypothesis testing asks what legitimate or different criminal explanations could account for the same facts, and what evidence would distinguish them. It reduces confirmation bias and makes the final reasoning more credible. Investigators need not treat every explanation as equally likely; they should show why material alternatives were examined, supported, weakened, or left unresolved.
Practical example: A sequence of rapid transfers could indicate layering, but may also reflect a genuine payment-collection business. The investigator tests both against customer records, counterparties, and transaction purpose.
Common misconception: Considering alternatives does not require endless investigation or artificial neutrality. The goal is a reasoned assessment, not giving implausible explanations equal weight with well-supported facts.
26. Choose proportionate investigative steps
Leading Complex Investigations
Proportionality matches the scope and intrusiveness of an investigative step to the case question, risk, available evidence, and applicable authority. A focused request may resolve an important gap better than broad collection. Investigators should explain why a step is relevant, what it is expected to establish, and whether a less extensive route could answer the same question.
Practical example: The key uncertainty is the purpose of three payments. The investigator first reviews relevant invoices and account records rather than requesting unrelated records across the customer’s entire relationship.
Common misconception: More data do not automatically produce better analysis. Overbroad work can waste resources, obscure the relevant facts, and raise handling concerns without improving the case.
27. Make the work reproducible
Leading Complex Investigations
A reproducible case record lets another qualified reviewer understand what was examined, which sources were used, how analysis was performed, and why decisions followed. It includes enough detail to revisit important calculations, searches, and judgment calls. Reproducibility supports quality review and continuity; it does not require recording every trivial action or copying entire data sets into narrative.
Practical example: An investigator records the date range, filters, and accounts used to calculate incoming and outgoing totals, allowing a reviewer to reproduce the analysis.
Common misconception: A conclusion without a traceable method is difficult to evaluate. Conversely, saving large volumes of raw material without explaining its relevance does not make the reasoning reproducible.
28. Recognize when scope should change
Leading Complex Investigations
New evidence may justify expanding, narrowing, or redirecting a case. A scope change should identify the finding that prompted it, the newly relevant question, any revised resources, and who approved the change when approval is required. This keeps a complex investigation controlled while allowing the strategy to respond to meaningful discoveries.
Practical example: An invoice-fraud review identifies the same intermediary in unrelated customer accounts. The investigator documents a proposed network review and obtains the appropriate case-level approval.
Common misconception: A wider scope is not always a better investigation. Expanding simply because new information exists can dilute the original question and create unnecessary work.
29. Coordinate complex case contributors
Leading Complex Investigations
Complex cases may involve investigators, analysts, specialists, managers, and external partners. Coordination requires a shared question, clear task ownership, controlled distribution of relevant findings, and a record of unresolved differences. This reduces duplicated effort and conflicting conclusions while preserving each contributor’s source material and analytical limitations.
Practical example: A transaction analyst and an investigator review the same network. They agree on identifiers and time periods, assign distinct tasks, and reconcile any differences before the case assessment is updated.
Common misconception: A meeting summary is not a substitute for source-level analysis. Coordination should align work, but each important claim still needs its basis and responsible contributor recorded.
30. Decide whether the investigation is ready to close
Leading Complex Investigations
Closure is a reasoned decision that the assigned questions have been addressed sufficiently, remaining gaps are understood, and any required escalation or reporting assessment has been completed. It should explain the evidence considered, material uncertainties, and why further work is or is not proportionate. Closure can be revisited when significant new information emerges under the unit’s process.
Practical example: The customer provides records that explain the payment pattern, and transaction analysis supports the explanation. The investigator documents the assessment, remaining limitations, and basis for closure.
Common misconception: Closure is not justified merely because an alert is old, a target was reached, or no single transaction proves a crime. The case rationale must address the actual concern.
60 concepts, from unit governance to useful reporting 31–40
31. Layering as a movement pattern
Financial Crime Typologies — Intermediate
Layering describes transactions that may obscure the origin, ownership, or destination of funds through movement across accounts, entities, products, or locations. Investigators look for patterns such as rapid onward transfers, unnecessary complexity, or inconsistent economic purpose. Those features are indicators, not a conclusion; their meaning depends on the customer profile, counterparties, explanations, and supporting evidence.
Practical example: Funds arrive from several unrelated sources, pass through a newly opened business account, and quickly move to another entity. The investigator examines purpose and relationships before assessing whether the route obscures ownership.
Common misconception: Multiple transfers do not prove laundering. Legitimate businesses can use complex payment chains, so the analysis must explain why the structure is inconsistent with the known activity.
32. Mule networks
Financial Crime Typologies — Intermediate
A money mule may receive, move, or withdraw funds on behalf of others, sometimes knowingly and sometimes under deception or coercion. Investigators look for connected accounts, similar recruitment or payment patterns, rapid fund movement, and relationships among senders and recipients. The role and knowledge of each person should be assessed individually rather than inferred from a shared pattern alone.
Practical example: Several personal accounts receive transfers from unrelated people and send most funds onward soon after. The investigator compares account links and customer explanations before assessing whether the accounts form a network.
Common misconception: An account that moves suspicious funds is not automatically evidence that its holder knowingly joined a criminal scheme. Pattern, context, and individual circumstances matter.
33. Trace possible fraud proceeds
Financial Crime Typologies — Intermediate
Fraud proceeds may enter accounts through deception, impersonation, investment schemes, or other misrepresentation, then be rapidly transferred, converted, or withdrawn. Investigators examine the victim-to-account path, timing, onward movement, and links to related reports or accounts. The purpose is to understand and support the suspected flow, not to assume every unusual receipt is fraud-derived.
Practical example: A customer receives transfers shortly after several senders report an online investment loss. The investigator maps receipt and onward movement and checks whether the reports relate to the same destination.
Common misconception: A complaint or chargeback alone does not establish the full flow or responsible person. Corroborate the reported fraud indicators with account records and relevant links.
34. Trade-based money laundering
Financial Crime Typologies — Intermediate
Trade-based money laundering can exploit the movement of goods, services, documents, and payments to transfer value or disguise proceeds. Investigators compare the commercial rationale with trade records, counterparties, routes, quantities, pricing, and payment flows. No single discrepancy proves misuse; a pattern of inconsistent elements may justify deeper examination and specialist input.
Practical example: A business makes repeated payments for goods that do not appear in its usual trade profile. The investigator compares available invoices, shipment information, counterparties, and account activity.
Common misconception: A trade-document inconsistency may reflect error, incomplete records, or ordinary commercial complexity. Do not label it laundering without assessing the wider transaction and business context.
35. Interpret trade anomalies in context
Financial Crime Typologies — Intermediate
Unusual pricing, quantities, routes, counterparties, or payment arrangements can indicate value shifting or concealment, but each anomaly needs commercial context. Investigators should compare like with like where possible, account for timing and product differences, and note limits in market data. A discrepancy becomes more persuasive when it converges with unexplained payment behavior or inconsistent documentation.
Practical example: An invoice appears materially higher than a broad public price reference. The investigator checks product specifications, delivery terms, and comparable transactions before deciding whether the difference is meaningful.
Common misconception: A public price comparison is not a definitive valuation. Differences in quality, delivery, geography, or contract terms can make a simple price comparison misleading.
36. Corruption-related financial indicators
Financial Crime Typologies — Intermediate
Corruption may generate or move value through bribes, concealed benefits, intermediaries, or unexplained wealth. Investigators look for relationships between decision-makers, counterparties, payments, services, and apparent benefits. A customer’s position or association can guide risk assessment, but the case requires analysis connecting relevant funds or transactions to the suspected conduct.
Practical example: A public-contract supplier pays an unusually large consulting fee to an intermediary with an undisclosed relationship to a decision-maker. The investigator examines the service, payment trail, and available relationship evidence.
Common misconception: Public office, political connections, or unexplained wealth alone do not prove corruption. Treat these as risk factors and assess the transactions and relationships that may support or weaken concern.
37. Use PEP information as a risk factor
Financial Crime Typologies — Intermediate
Politically exposed person information can help identify exposure to corruption risk and inform proportionate scrutiny. It is one input among customer activity, relationships, source information, and jurisdictional context. Investigators should verify identity and the person’s connection to the customer, then assess relevant transactions rather than treating status as an allegation or a finding.
Practical example: A customer is linked to a politically exposed person through ownership information. The investigator verifies the link and considers whether unusual payments connect to the person’s role or known business activity.
Common misconception: PEP status is not proof of wrongdoing and does not by itself establish that a customer should be refused or exited. Risk should be assessed in context.
38. Recognize possible sanctions evasion
Financial Crime Typologies — Intermediate
Sanctions evasion can involve concealed parties, intermediaries, misleading trade details, or altered payment routes intended to obscure a restricted connection. Investigators assess the relevant list or restriction, identity resolution, ownership or control facts, transaction path, and applicable jurisdictional rules. A name similarity or indirect connection is a lead for careful review, not an automatic determination.
Practical example: A payment includes a newly inserted intermediary and a changed goods description. The investigator checks the parties and transaction against applicable screening and escalation procedures before drawing a conclusion.
Common misconception: There is no single universal ownership or control rule that resolves every sanctions question. Apply the relevant jurisdiction’s requirements and do not treat a screening hit alone as proof.
39. Cyber-enabled financial crime
Financial Crime Typologies — Intermediate
Cyber-enabled crime uses digital access, communications, or platforms to facilitate offenses such as account compromise, fraud, or extortion. Financial investigation focuses on how funds enter, move through, and leave accounts, and whether technical indicators connect to financial activity. Coordination with appropriate specialists can help interpret digital evidence while keeping financial conclusions grounded in records.
Practical example: A customer reports a compromised account followed by unfamiliar transfers. The investigator maps the transaction sequence and coordinates with the relevant technical team to understand available access indicators.
Common misconception: A technical alert does not by itself identify who initiated a transaction or why. Connect technical findings to verified financial records and preserve uncertainty about attribution.
40. Trace virtual-asset flows carefully
Financial Crime Typologies — Intermediate
Virtual assets can be used to receive, move, convert, or obscure value, and investigators may need to connect customer records with platform or blockchain information. A wallet address is not automatically a known person, and analytic labels may carry limitations. Assessment should document the source, confidence, time period, and link between the digital flow and the customer or account.
Practical example: A customer’s account sends funds to a platform before value moves to an external wallet. The investigator records the verified account link and treats later wallet attribution as a separate question.
Common misconception: A blockchain transaction may show movement between addresses without establishing the identity, purpose, or criminality of the parties. Do not overstate what the available analysis can prove.
60 concepts, from unit governance to useful reporting 41–50
41. Recognize typology convergence
Financial Crime Typologies — Intermediate
One case can involve several connected patterns, such as fraud proceeds moving through mule accounts before trade payments or virtual-asset conversion. Convergence matters because an early label may explain only part of the activity. Investigators should keep relevant hypotheses open long enough to test links, while avoiding speculative expansion unsupported by evidence.
Practical example: A suspected invoice-fraud case reveals unusually priced goods and a virtual-asset payment leg. The investigator reassesses scope and checks whether the new features connect to the original fund flow.
Common misconception: Finding one plausible typology does not prove every other suspected crime in the chain. Keep the analysis open, but distinguish verified links from possibilities that still require testing.
42. Do not treat typology labels as explanations
Financial Crime Typologies — Intermediate
A typology label summarizes a possible pattern; it does not explain the facts or identify the actors’ purpose. Investigators should translate a label into observable features, then test those features against records and context. This keeps an assessment specific and makes it possible for another reviewer to see why the pattern does—or does not—fit.
Practical example: Instead of recording only “possible layering,” an investigator describes the rapid transfers, account relationships, and lack of an apparent business purpose that prompted the concern.
Common misconception: Using a familiar label can create false confidence. A concise name cannot replace the factual explanation needed to support a case assessment or report.
43. Assess legitimate explanations fairly
Financial Crime Typologies — Intermediate
A plausible legitimate explanation should be checked against available evidence, customer profile, transaction behavior, and counterparties. The investigator need not accept an unsupported account at face value, but should not dismiss it solely because it conflicts with an initial suspicion. Record what was checked, what supported or contradicted the explanation, and what remains uncertain.
Practical example: A customer says many small transfers are customer refunds. The investigator compares the stated business, payment descriptions, and available sales records to see whether the pattern fits.
Common misconception: An explanation is not validated simply because it sounds ordinary. Equally, an explanation should not be rejected just because the activity first appeared unusual.
44. Distinguish network patterns from coincidence
Financial Crime Typologies — Intermediate
Network analysis can identify shared accounts, devices, addresses, intermediaries, or transaction routes that may connect activity. The strength of a link depends on the reliability and uniqueness of the identifier and whether independent facts reinforce it. Investigators should consider common infrastructure and innocent shared services before treating connections as evidence of coordination.
Practical example: Three customers use the same payment intermediary. The investigator checks transaction timing and other shared identifiers before assessing whether the connection suggests a coordinated scheme.
Common misconception: A shared address or service provider may have many legitimate users. One common attribute is rarely enough to establish that separate customers acted together.
45. Treat laundering stages as a model, not a checklist
Financial Crime Typologies — Intermediate
Placement, layering, and integration can help organize thinking about how illicit value may enter and move through the financial system. Real activity may not follow a neat sequence, and a case may show only one part of a possible flow. Investigators should use the model to ask useful questions, not require evidence of every stage before assessing concern.
Practical example: An investigation identifies a likely entry point and rapid onward transfers but no clear final use of funds. The investigator documents the observed movement without inventing a completed sequence.
Common misconception: A case need not display every textbook stage to merit analysis. Conversely, a transaction resembling one stage does not by itself establish that the funds are criminal proceeds.
46. Triangulate typology indicators
Financial Crime Typologies — Intermediate
Triangulation compares different kinds of information—such as transaction records, customer explanations, business documents, and external sources—to see whether they independently support a hypothesis. Sources should not be treated as independent if they repeat the same underlying claim. Stronger analysis identifies both converging facts and conflicts that remain unresolved.
Practical example: An invoice, account transfer, and shipment record each describe the same payment in different ways. The investigator compares dates, parties, and amounts to test whether they tell a consistent story.
Common misconception: Several documents do not necessarily mean several independent sources. If each repeats information from one original report, counting them as separate corroboration exaggerates support.
47. Interpret cross-border patterns without stereotyping
Financial Crime Typologies — Intermediate
Cross-border flows may be relevant because of counterparties, routes, business purpose, or applicable risks, but geography alone does not establish suspicion. Investigators should assess the actual transaction, customer profile, and relationship while using current jurisdictional information where relevant. Avoid relying on broad assumptions about a country or community in place of case-specific facts.
Practical example: A business makes regular payments to a new overseas supplier. The investigator checks the commercial relationship, payment purpose, and route rather than treating the destination alone as proof of risk.
Common misconception: An international transfer is not inherently suspicious, and a familiar destination is not automatically safe. Geographic context informs analysis but cannot replace evidence about the activity.
48. Use conflicting facts to guide further work
Financial Crime Typologies — Intermediate
Conflicting evidence may indicate a weak hypothesis, incomplete records, a changed customer circumstance, or concealment. Investigators should identify the precise inconsistency, consider its significance, and choose a targeted step to resolve it where proportionate. A conflict should be recorded even if it cannot be resolved; ignoring it can make the final assessment appear stronger than the file supports.
Practical example: A customer describes a payment as a supplier deposit, while available documents describe a consulting service. The investigator checks the counterparty relationship and supporting records before updating the assessment.
Common misconception: A contradiction is not automatically proof of deception. It is a reason to test the explanation and assess the quality and context of each source.
49. Make reporting decisions under applicable rules
Reporting Suspicious Activity
A SAR/STR decision must follow the institution’s obligations in the applicable jurisdiction and the facts known at the relevant time. International standards can inform the broader framework, but they are not automatically domestic law. Investigators should identify the proper internal decision-maker and process, document the basis, and seek jurisdictional guidance when the rule or facts are unclear.
Practical example: A case involves customers and activity in more than one country. The investigator records the relevant locations and routes the decision through the institution’s process for determining applicable reporting duties.
Common misconception: Do not apply a reporting threshold, deadline, or filing rule from one jurisdiction as if it were universal. Confirm the governing requirement rather than guessing from a general standard.
50. Suspicion is not proof of a predicate offense
Reporting Suspicious Activity
A reportable suspicion assessment, where required by applicable law, is not the same as proving a crime or identifying the responsible person. Investigators should describe the facts that created concern and avoid stating an unproven offense as established. The decision should follow the relevant legal and institutional standard, with uncertainty expressed accurately rather than hidden or exaggerated.
Practical example: A customer’s funds move through several unrelated accounts without a clear purpose. The investigator explains the activity and concerns without claiming to know the exact source crime.
Common misconception: Waiting for proof of a specific offense may misunderstand the applicable reporting standard. At the same time, suspicion does not license unsupported accusations about a person or crime.
60 concepts, from unit governance to useful reporting 51–60
51. Build a clear report narrative
Reporting Suspicious Activity
A useful narrative gives a reader unfamiliar with the case enough context to understand who is involved, what happened, when it happened, how the funds moved, and why the activity raises concern. Organize the story around relevant events and links, not internal workflow. The narrative should be concise enough to follow while preserving details needed to understand the suspicion.
Practical example: A report explains the customer’s stated business, identifies the unexpected incoming payments, traces their movement to related accounts, and states why the activity conflicts with the known profile.
Common misconception: A list of alerts or a label such as “suspicious activity” is not a narrative. The reader needs a factual sequence and a reasoned connection to the concern.
52. Make the account of events specific
Reporting Suspicious Activity
Specificity means identifying relevant parties, accounts or transaction references, dates or periods, amounts where available, and the movement or pattern that matters. Include enough detail for a reader to distinguish one event from another and understand how the concern developed. Avoid unsupported precision when records are incomplete; clearly state estimates or limitations instead.
Practical example: Rather than saying “funds moved quickly,” the narrative describes the sequence, relevant dates, destinations, and what records support that account.
Common misconception: More detail is not always more useful. Unfocused transaction dumps can obscure the pattern, while vague summaries prevent a reader from understanding or following it.
53. Separate observed facts from assessment
Reporting Suspicious Activity
A strong report distinguishes recorded facts from analytical inferences and reported allegations. It can state what the institution observed, what the customer or another source claimed, and why the investigator considers the pattern concerning. This separation lets a reader evaluate the reasoning and prevents uncertain information from being presented as verified fact.
Practical example: The narrative says account records show transfers to three recipients, while the customer stated they were supplier payments; it then explains why the available records do not support that purpose.
Common misconception: Blending facts and conclusions can make a report sound more certain than the evidence. Mark allegations and interpretations clearly instead of presenting them as direct observations.
54. Explain why the pattern is suspicious
Reporting Suspicious Activity
A narrative should connect concrete facts to the concern rather than expect the reader to infer the significance. Explain how the activity differs from the known profile, why the stated purpose is unsupported, or how related transactions fit together. The reasoning should be proportionate to the available evidence and should acknowledge material alternative explanations or limitations.
Practical example: The report notes that a business described as a local retailer received payments from unrelated individuals and quickly transferred most funds to an unexplained intermediary.
Common misconception: Listing red flags without explaining their relationship leaves the reader to guess. A clear rationale is stronger than a dramatic typology label or unsupported conclusion.
55. Select supporting documentation for relevance
Reporting Suspicious Activity
Supporting material should substantiate the narrative and help a recipient understand or verify important facts. Choose relevant records, analysis, and source information according to applicable procedures and reporting requirements. Make sure the narrative accurately describes what is attached or available, and identify gaps where expected material could not be obtained.
Practical example: A case concerns rapid onward payments. The investigator provides the relevant transaction analysis and records that support the sequence described in the narrative.
Common misconception: Attaching everything in the file can make key information harder to find. A large bundle does not replace selecting and accurately describing the records that support the report.
56. Distinguish a report from a law-enforcement referral
Reporting Suspicious Activity
Suspicious activity reporting and a direct referral to law enforcement can serve related but distinct functions, depending on jurisdiction and institutional process. A referral may present a focused investigative lead or response to a request; a formal report follows its applicable reporting channel. Staff should know who authorizes each action and ensure one does not silently substitute for another.
Practical example: An investigator identifies a possible link to an active inquiry. The investigator uses the approved referral route and separately completes any required internal assessment of suspicious activity reporting.
Common misconception: Sending information to a law-enforcement contact does not automatically satisfy a separate reporting obligation. Follow the appropriate channels and document each decision.
57. Handle information sharing with care
Reporting Suspicious Activity
Information sharing should have a clear purpose, authorized route, and appropriate control over what is disclosed and recorded. Rules and permissions depend on the relevant jurisdiction and context. Investigators should coordinate with designated legal, compliance, or information-sharing functions when needed, and avoid assuming that a request alone resolves all restrictions.
Practical example: An external partner requests customer records connected to a case. The investigator verifies the request through the approved process and seeks internal guidance before sharing material.
Common misconception: A well-intentioned request does not automatically authorize disclosure. Nor should staff assume that all information must be withheld; apply the relevant process and rules.
58. Post-filing case controls
Reporting Suspicious Activity
Filing a report does not necessarily end the institution’s monitoring, investigation, or escalation responsibilities. Post-filing controls should specify how new activity is assessed, how material developments are recorded, who reviews the case, and how any further action follows applicable rules. The case record should make clear what changed after the initial decision.
Practical example: After a report, the customer begins using a new intermediary. The investigator reviews the activity under the institution’s process and documents whether it changes the assessment.
Common misconception: A prior filing is not a permanent answer to future activity. Equally, repeated filings should not be automatic; reassess new facts and follow applicable procedures.
59. Reassess continued or new activity
Reporting Suspicious Activity
Later activity can reinforce, change, or weaken an earlier assessment. Investigators should compare new transactions with the reported pattern, note whether counterparties or methods have changed, and decide whether a fresh review or further reporting consideration is warranted under applicable rules. A clear link to prior findings helps preserve continuity without assuming the old explanation still applies.
Practical example: A customer’s activity resumes through a different account after a reported pattern. The investigator checks whether the new route connects to the earlier activity and records the basis for the next decision.
Common misconception: Treating every later transaction as the same case can miss a changed pattern. Treating it as wholly unrelated can also overlook meaningful continuity; test the link.
60. Use reporting outcomes to improve the unit
Reporting Suspicious Activity
Reporting quality can improve when a unit reviews recurring narrative weaknesses, documentation gaps, decision delays, and relevant feedback from permitted channels. Lessons should inform training, templates, triage, and quality assurance while respecting confidentiality and applicable restrictions. The purpose is to improve future work, not to measure investigators solely by the number or outcome of reports.
Practical example: Quality reviews find that narratives often omit why customer explanations were not supported. The unit updates guidance and checks later files to see whether the reasoning is clearer.
Common misconception: A report’s later outcome does not by itself prove that the original decision was right or wrong. Evaluate the quality of reasoning against the information available at the time.
Six actionable study steps
Source and version note
Primary source: ACAMS, Certified AFC Investigator program page, https://www.acams.org/en/certifications/afc-investigator. The provider dossier records the current name, former program name, audience, exam format, and official domain weights as verified on 11 October 2026. Check the provider page for updates before booking. This guide is original educational material and does not reproduce or claim to predict exam questions.