CFCS Exam Guide: Investigating Financial Crime Across Disciplines
The Certified Financial Crime Specialist credential is designed for financial crime analysts, investigators, financial intelligence unit staff, compliance professionals, auditors, regulators, and law-enforcement partners. This guide develops the judgment needed to follow value, assess evidence, select controls, and coordinate responses across twelve content areas.
Exam format: ACFCS currently describes 135 scenario-based multiple-choice questions, a four-hour exam, and a passing score of 88 out of 135 on its exam-preparation page. ACFCS pages have differed on format details, so confirm the current requirements before booking.
How to use this guide
- Work through the concepts in order, then revisit cases that join two or more crime types.
- For each scenario, identify the applicable law or standard, the evidence available, the decision boundary, and the next defensible step.
- Use original free practice scenarios and review why plausible alternatives fail.
Content areas and study priorities
| Content area | Official domain weight | This guide's study priority |
|---|---|---|
| Money laundering | No domain weight published here | High: trace methods, predicate conduct, and evidence |
| Fraud detection and prevention | No domain weight published here | High: separate loss prevention from proceeds response |
| Corruption enforcement and investigation | No domain weight published here | High: examine intermediaries, intent, and records |
| Tax evasion and enforcement | No domain weight published here | Standard: distinguish lawful planning from concealment |
| Asset recovery | No domain weight published here | High: preserve value and select a viable remedy |
| Financial crime investigations | No domain weight published here | High: plan lawful, reproducible evidence gathering |
| Interpreting financial documents | No domain weight published here | High: reconcile records and limit conclusions |
| Money and commodities flows | No domain weight published here | High: follow value through settlement and intermediaries |
| Compliance programs and sanctions controls | No domain weight published here | High: match controls to exposure and jurisdiction |
| Cybersecurity and privacy | No domain weight published here | Standard: coordinate containment, evidence, and privacy |
| Ethics and professional responsibility | No domain weight published here | Standard: resolve conflicts and document judgment |
| International standards and financial crime convergence | No domain weight published here | High: connect standards to cross-border cases |
60 core concepts 1-10
1. Predicate conduct and proceeds
Money laundering
Laundering analysis begins with the suspected source of value, not a memorized transaction pattern. A predicate offense may generate cash, receivables, property, or digital value. Investigators should identify the conduct that could produce those assets, the timing of acquisition, and the transactions that obscure ownership or origin. A suspicious transfer alone does not establish that the funds are criminal proceeds; alternative sources and applicable legal definitions still matter.
Applied example: A small importer receives several payments from unrelated consumers before purchasing a warehouse. The analyst compares sales records and delivery evidence with the deposits, then examines whether the warehouse purchase converts proceeds from a possible fraud scheme.
Common mistake: Calling every unusual deposit laundering skips the predicate analysis. Trace the plausible source and movement of value, while keeping suspicion separate from proof of an underlying offense.
2. Placement, layering, and integration as analytic aids
Money laundering
The familiar laundering stages describe functions, not a required sequence. Placement introduces value into a financial channel, layering complicates tracing, and integration makes assets appear usable or legitimate. One transaction may serve several functions, while some schemes never involve physical cash. The useful question is what each step changes about access, ownership, traceability, or apparent legitimacy. Document the mechanism rather than forcing every fact into a stage label.
Applied example: Fraud proceeds enter a payment processor and are paid to a related consulting company, which buys equipment. The analyst maps who controlled each account and how the transfer chain changed the apparent source.
Common mistake: Assuming every case starts with cash placement misses proceeds that originate in bank accounts. Classify the function of each movement only after tracing how value entered the scheme.
3. Gatekeepers and professional services
Money laundering
Lawyers, accountants, company-service providers, and property professionals can create structures or transactions that move value. Their involvement is neither proof of misconduct nor a substitute for examining the work performed. Assess who instructed the professional, who paid, whether the service had a credible commercial purpose, and which records reveal ultimate control. Privilege and professional secrecy vary by jurisdiction, so investigators should use lawful channels before seeking protected material.
Applied example: A newly formed company uses a service provider to acquire property for an overseas principal. The investigator obtains public filings and payment records first, then evaluates what further records can lawfully identify the controller.
Common mistake: Treating professional involvement as automatic complicity confuses access with intent. Test the service, instructions, payment route, and knowledge before attributing participation in a laundering scheme.
4. Terrorist financing and source versus destination
Money laundering
Terrorist financing can involve legitimately earned funds, so an investigation cannot depend on finding criminal origins. The destination, intended use, counterparties, and pattern of collection may be more revealing than the initial source. Examine whether payments support an individual, network, travel, procurement, or operational expense, while testing innocent explanations. The FATF recommendations frame international counter-terrorist-financing standards; specific reporting and freezing duties arise through applicable law.
Applied example: A community fundraiser sends frequent small payments to a travel coordinator near a conflict area. Analysts verify beneficiaries, invoices, and counterparties before deciding whether the payment pattern warrants escalation under local requirements.
Common mistake: Equating clean source funds with low terrorist-financing risk misses the possible use of those funds. Evaluate destination and purpose without treating geography or charitable activity alone as proof.
5. Converging crimes in one value chain
Money laundering
A single value chain can contain fraud, corruption, tax evasion, and laundering without making those offenses interchangeable. Build a chronology of how the asset was generated, transferred, disguised, and spent. For each suspected offense, identify its separate elements and supporting evidence. This prevents a strong case for one offense from masking a weak inference about another. The broader AML framework in the CAMS guide can support focused review of the laundering segment.
Applied example: A procurement officer steers a contract to a supplier that inflates invoices and pays a consultant. The team separates possible bribery evidence from false-expense records and traces whether the consultant payment concealed proceeds.
Common mistake: A complex scheme does not prove every financial crime named in it. Map each alleged offense to conduct, intent, jurisdiction, and evidence before combining conclusions.
6. Fraud event versus proceeds response
Fraud detection and prevention
Fraud controls seek to prevent or reverse an unauthorized loss, while an AML response examines the movement and possible concealment of proceeds. These processes may run together but have different immediate decisions, evidence, and reporting triggers. A bank may block a payment, reimburse a victim under applicable rules, preserve account records, and separately assess suspicious activity. Document which action addresses customer harm and which addresses potential crime proceeds.
Applied example: A customer reports an unauthorized transfer to a newly opened account. Operations attempts recovery and secures the customer account; investigators trace the recipient's onward transfers and assess whether a reporting obligation applies.
Common mistake: Recovering the customer's money does not close the proceeds question. Conversely, a suspicious-activity review cannot replace prompt loss-containment steps when a transfer can still be stopped.
7. Payment fraud controls across the transaction
Fraud detection and prevention
Payment fraud may exploit account access, altered instructions, merchant settlement, or beneficiary substitution. Controls should match the point where the attacker changes the transaction: authentication for account access, independent confirmation for instruction changes, beneficiary checks, and post-payment monitoring. Evaluate both false positives and the time available to intervene. A control that detects fraud only after settlement may aid investigation but cannot prevent that loss.
Applied example: A supplier sends new bank details from a compromised email account. The buyer's payment team calls a previously verified number, detects the substitution, and preserves the email headers for investigation.
Common mistake: Treating a familiar sender address as proof of an authorized instruction ignores account compromise. Confirm material payment changes through an independent channel already on record.
8. Identity fraud and synthetic profiles
Fraud detection and prevention
Identity fraud includes impersonating a real person and assembling a synthetic profile from genuine and fabricated attributes. Detection compares the claimed identity, the applicant's control of documents and devices, and the consistency of activity over time. A valid identifier does not prove that the applicant is its rightful owner. The CAFS guide offers additional practice on fraud analytics; here, assess how a signal changes the decision and what corroboration it requires.
Applied example: Several credit applications share a device and address but present different names and apparently valid identifiers. The analyst checks document provenance and application history before deciding whether the pattern indicates a coordinated synthetic-identity attempt.
Common mistake: A passed database check verifies a data match, not the person presenting it. Separate identity attributes, identity proofing, and later account use when evaluating fraud risk.
9. Fraud evidence across lending, claims, and benefits
Fraud detection and prevention
Start with the representation that caused money or credit to be granted, then identify an independent way to test it. In lending, verify income, collateral, and occupancy against records outside the application. For insurance or health-care claims, establish whether the loss or service occurred, whether the claimant or provider was eligible, and whether the amount was inflated. For public benefits, apply the relevant eligibility and disclosure rules. Analytics prioritize review; they do not establish a false statement, intent, or loss without corroboration.
Applied example: A clinic bills repeatedly for visits on days its premises were closed. Reviewers compare appointment records, patient accounts, access logs, and payments, then distinguish unsupported claims from possible scheduling or billing errors.
Common mistake: A shared anomaly score cannot resolve every product's rules. Identify the disputed claim, who made it, the independent evidence, and the applicable decision rule before alleging fraud.
10. Internal fraud and divided authority
Fraud detection and prevention
Internal fraud can exploit approval rights, access to customer data, or the ability to alter records. Map each critical task to who can initiate, approve, reconcile, and override it. Segregation of duties reduces opportunity, while independent logs and exception review make concealment harder. When a small team cannot separate roles fully, compensating review should focus on high-risk overrides and evidence that the reviewer was genuinely independent.
Applied example: A clerk can create vendors and release low-value payments. A monthly reviewer matches new vendors to ownership and invoice evidence, discovers repeated payments to a related entity, and preserves the approval trail.
Common mistake: Two signatures offer little protection if both approvers rely on the same unchecked record. Verify that each control adds independent scrutiny of the transaction and its beneficiary.
60 core concepts 11-20
11. Bribery mechanism and intent
Corruption enforcement and investigation
A bribery inquiry should identify the benefit, recipient, decision sought, intermediary, and evidence of intent. A payment can be routed through a consultant, relative, charity, or inflated contract, so the label on an invoice is rarely decisive. Compare timing with procurement decisions and examine communications, work product, approvals, and pricing. Applicable offenses differ across jurisdictions; distinguish a suspicious conflict from the elements needed for a particular legal charge.
Applied example: A contractor pays a local adviser just before a permit is approved. Investigators compare the adviser's deliverables, fee, ownership, and messages with the permit timeline before inferring whether the fee bought influence.
Common mistake: An unusually large advisory fee is a lead, not proof of bribery. Test whether services were performed and whether the recipient could influence the decision.
12. Third-party corruption risk
Corruption enforcement and investigation
Third parties may create exposure when they act for an organization or move funds to officials, even if a contract calls them independent. Risk review should examine beneficial ownership, qualifications, payment terms, location, and the business reason for the intermediary. Controls need to continue after onboarding: compare actual services, invoices, and expenses with the approved scope. Escalation should preserve evidence of what the organization knew and when.
Applied example: A distributor requests an extra commission to resolve a customs delay and supplies no revised scope. Compliance pauses the payment, checks ownership and correspondence, and asks for a documented explanation of the proposed service.
Common mistake: A signed anti-bribery clause does not verify actual conduct. Compare payments and work performed with the contract, and investigate unexplained changes before funds leave.
13. Books, records, and concealed benefits
Corruption enforcement and investigation
A corrupt benefit may be hidden as a marketing expense, rebate, travel charge, or vendor invoice. Reconcile general-ledger entries to contracts, approvals, receipts, and proof of service, then test whether the recorded purpose matches reality. In some jurisdictions, inaccurate books or deficient controls can create exposure apart from a provable bribe. Avoid assuming every accounting error is intentional; look for repeated exceptions, override authority, and contemporaneous explanations.
Applied example: A regional office records repeated client hospitality with identical receipts and no attendee names. The auditor checks card statements, venue records, and approval logs to determine whether the expenses conceal benefits to officials.
Common mistake: A clean ledger code does not make a transaction legitimate. The classification must be supported by source documents and the actual economic purpose of the expenditure.
14. Cross-border corruption nexus
Corruption enforcement and investigation
Cross-border conduct can implicate more than one anti-corruption regime, but jurisdiction must be demonstrated rather than assumed. Map the parties' locations, corporate relationships, payment route, decision maker, and acts performed in each place. Then identify which law reaches the conduct and what mental state it requires. An internal policy may prohibit a payment even where the legal classification is uncertain; record those conclusions separately.
Applied example: A parent company approves a foreign subsidiary's agent payment through a shared treasury center. Counsel maps approval, banking, and incorporation links before assessing which jurisdictions may investigate and which records should be preserved.
Common mistake: Assuming one headquarters location determines all applicable law overlooks local acts and payment routes. Establish each jurisdictional link before applying a statute or declaring a violation.
15. Corruption proceeds and recovery
Corruption enforcement and investigation
Corruption cases often require parallel work: proving the improper benefit and finding assets that can be restrained or returned. Trace payments through intermediaries into accounts, property, or business interests, recording each conversion and owner. Early preservation may matter because assets can move faster than a prosecution. Recovery powers, victim claims, and return arrangements depend on the jurisdictions involved, so the tracing plan should identify the authority needed for each step.
Applied example: A public-contract kickback moves through a consultancy into an apartment held by a relative. Investigators document the consultancy's funding and purchase trail while counsel assesses restraint and competing ownership claims.
Common mistake: Finding an expensive asset near a suspect does not establish it was bought with corrupt proceeds. Link the source, transfers, acquisition, and beneficial control before seeking a remedy.
16. Offshore control and tax reporting
Tax evasion and enforcement
An offshore entity may serve a genuine business purpose or conceal a resident's control of income and assets. Trace formation records, signatories, funding, instructions, and distributions, then compare actual control with tax disclosures required in each relevant jurisdiction. Cross-border information reporting can provide leads, but a missing or inconsistent report must be assessed against the applicable person's duty, entity classification, reporting period, and available exceptions. Nominee ownership alone does not establish evasion; identify the concealed fact and evidence of intent.
Applied example: A resident directs investments through an overseas company with a nominee director. Investigators compare banking instructions and distributions with the resident's filings, then determine which disclosures were required for the years under review.
Common mistake: An offshore address or absent information return is not, by itself, a tax offense. Establish who owed the reporting duty and whether the underlying transaction was misstated or concealed.
17. Lawful tax planning versus tax evasion
Tax evasion and enforcement
Tax avoidance generally uses lawful choices about transactions or structures, although an arrangement may still be challenged under the applicable tax law. Evasion involves unlawful concealment, falsification, or failure to meet a known tax duty. Examine the transaction's economic substance, disclosures, accounting treatment, and contemporaneous advice before inferring intent. A low effective tax rate or offshore company is a lead, not a conclusion. Identify the jurisdiction, tax period, taxpayer, and precise obligation before assessing whether a false statement or concealed fact matters.
Applied example: A group shifts licensing income to an overseas affiliate. Investigators compare actual staff, decision making, contracts, and tax filings with the claimed business activity, then assess the arrangement under the relevant years' local rules.
Common mistake: Do not call every tax-saving structure evasion. Equally, formal paperwork does not resolve a case when records show a knowingly false account of control, activity, or income.
18. VAT and carousel-style fraud
Tax evasion and enforcement
Value-added tax fraud can exploit a gap between tax collected on sales and tax remitted to the state. In a carousel-style pattern, goods or invoices circulate through multiple entities, sometimes with a trader that disappears before paying tax. Reconstruct invoice, payment, shipping, and tax-return sequences to determine whether trade occurred and who gained the tax benefit. Local tax rules determine liability; circular trading alone is an investigative lead.
Applied example: Electronics pass through four companies in six days, and one seller fails to remit collected tax. Analysts compare serial numbers, transport records, bank settlements, and refund claims to determine whether the chain was genuine.
Common mistake: A circular invoice chain is not enough to prove a false refund. Establish the applicable tax treatment, actual movement of goods, and the missing remittance.
19. Customs value and trade declarations
Tax evasion and enforcement
Customs fraud may involve misstating value, origin, quantity, or classification to alter duties or restrictions. Compare the declaration with purchase orders, freight records, insurance, payments, and the physical goods. Price differences can also reflect quality, timing, or contract terms, so use comparable transactions carefully. A discrepancy becomes stronger evidence when the same party controls both records and repeatedly benefits from the declared value.
Applied example: An importer declares machine parts at a fraction of the insured value. The examiner reviews specifications, purchase correspondence, freight documents, and related-party payments before estimating whether the declaration was false.
Common mistake: Using one market price as conclusive evidence ignores condition and contract terms. Reconcile multiple records and identify who made or approved the declaration.
20. Employment tax and hidden payroll
Tax evasion and enforcement
Employment tax evasion can be concealed through cash wages, false contractor labels, or payroll records that omit workers. Compare rosters, access logs, production capacity, bank withdrawals, invoices, and filed returns. Worker classification depends on local law and actual working arrangements, not just the contract title. Investigators should estimate the discrepancy methodically and preserve the underlying records so another reviewer can reproduce the calculation.
Applied example: A restaurant reports six employees but schedules fifteen people each week. Reviewers match shifts, cash withdrawals, supplier activity, and payroll filings before estimating unreported wages under local rules.
Common mistake: A cash withdrawal does not prove off-book wages. Link payments to workers and work performed, and distinguish classification disputes from deliberate false reporting.
60 core concepts 21-30
21. Recovery planning before assets move
Asset recovery
Asset recovery starts by identifying the available remedy and the assets it can reach. Build an inventory showing location, registered owner, estimated value, encumbrances, and the evidentiary link to the offense. Prioritize assets that can be transferred quickly, while considering whether immediate action might alert subjects or prejudice another investigation. Restraint authority and notice requirements vary by jurisdiction; coordinate the sequence with the body empowered to act.
Applied example: A suspect holds cash, shares, and a mortgaged property in different countries. The recovery team ranks transfer risk and net value, then prepares evidence for the relevant restraint applications.
Common mistake: Freezing the most visible asset first may preserve little recoverable value. Check ownership, liens, legal authority, and the risk that early action triggers movement elsewhere.
22. Tracing through commingled funds
Asset recovery
When illicit and legitimate funds share an account, tracing requires a transaction chronology rather than an assertion that every later purchase is tainted. Record deposits, withdrawals, balances, and transfers, then apply the tracing rules recognized by the relevant court or statute. Different legal theories can produce different recoverable amounts. Preserve the original statements and calculation method, and identify any point where the chain becomes uncertain.
Applied example: Fraud proceeds enter a trading account that already holds savings. Analysts reconcile daily balances and securities purchases, then show which proposed tracing result depends on the jurisdiction's accepted method.
Common mistake: Treating the entire mixed account as criminal proceeds can overstate the claim. Explain the legal tracing method and where legitimate value entered or left.
23. Restraint, confiscation, and forfeiture
Asset recovery
Restraint preserves property while a case develops; confiscation or forfeiture is a later legal outcome under the applicable process. The distinction affects burden, timing, ownership challenges, and what may be spent or sold. Investigators should identify whether the remedy targets specific property, its value, or property connected to an offense. Document third-party interests early, because an apparently clear asset may be encumbered or legitimately co-owned.
Applied example: Authorities restrain a vehicle bought after a fraud while the ownership case proceeds. Records reveal a lender's security interest, so the recovery estimate reflects the debt and the applicable forfeiture procedure.
Common mistake: A restraint order does not mean the state already owns the asset. Preserve value while respecting the later adjudication and legitimate third-party claims.
24. Substitute assets and value-based remedies
Asset recovery
Some legal systems permit a value-based order or substitute-asset recovery when directly traceable proceeds have been dissipated. The remedy depends on the governing statute and case facts; it is not a general permission to seize any property associated with a suspect. Calculate the recoverable value, identify lawful ownership, and separate double counting from genuine gains. Evidence of dissipation and existing liens affects both the legal application and realistic recovery.
Applied example: A fraudster spends most receipts on travel but retains an unrelated investment account. Counsel assesses whether local law permits value-based recovery and documents the gain before seeking restraint of substitute property.
Common mistake: The absence of the original proceeds does not automatically end recovery, but unrelated assets are not automatically available. Identify the specific legal remedy and calculate its limit.
25. Cross-border recovery, judgments, and insolvency
Asset recovery
Locating a foreign asset is only the first step. Identify whether the holding state can restrain it through mutual legal assistance, its own proceedings, or recognition of a judgment, and what evidence each route requires. Check ownership, secured debts, insolvency proceedings, and competing victim claims before estimating recoverable value. An informal lead may support urgent preservation but may not support execution. Plan custody, costs, and conditions for return early so a freeze can lead to an enforceable distribution.
Applied example: Fraud proceeds fund shares held by a company entering insolvency abroad. The team seeks lawful preservation, obtains purchase records, and assesses judgment recognition alongside the administrator's and secured creditors' claims before estimating victim recovery.
Common mistake: A domestic judgment does not necessarily execute abroad, and a frozen asset may have prior claims. Confirm the foreign procedure, priority rules, and net value before promising repatriation.
26. Predication and investigation scope
Financial crime investigations
Before collecting intrusive records, define the allegation, lawful purpose, decision maker, and threshold for each proposed step. A working hypothesis should be specific enough to test but open to disconfirmation. List expected evidence, alternative explanations, and the point at which the inquiry should expand or close. This keeps an investigation proportionate and helps explain why a record or interview was sought when it was sought.
Applied example: An alert alleges that a merchant launders card-fraud proceeds. The investigator first verifies the chargeback pattern, ownership, and settlement flows, then requests additional records tied to a documented hypothesis.
Common mistake: Starting with a broad data sweep can create privacy exposure and obscure the core question. Define the suspected conduct and the evidence needed to test it.
27. Open-source intelligence and verification
Financial crime investigations
Public records, websites, and social media can identify leads, relationships, and timelines, but they vary in provenance and reliability. Capture the source, access date, exact content, and method used, then corroborate consequential claims with independent records. A cached page may show historical information, while a profile may be impersonated or self-reported. Privacy and lawful-access rules still apply even when information appears publicly available.
Applied example: A website lists a suspect as a company's director, while the corporate register shows a different person. The investigator archives both versions and checks filing dates before using the discrepancy in an interview.
Common mistake: A search result snippet is neither a stable record nor verified identity evidence. Preserve the underlying page and corroborate who created it and when.
28. Intelligence versus admissible evidence
Financial crime investigations
An intelligence report can direct inquiry without satisfying the authentication or disclosure requirements of a court or regulator. Track the origin, handling restrictions, and corroboration status of each lead. When a source cannot be disclosed, seek independently obtainable records that establish the relevant fact. Do not quietly convert a confidential assertion into a factual finding; record the source limitation and the evidence that later supported or contradicted it.
Applied example: A partner agency reports an undisclosed beneficial owner but restricts onward use. Investigators obtain company filings, banking instructions, and witness records through authorized channels before making the ownership allegation.
Common mistake: Repeating a restricted intelligence claim in several reports does not create independent corroboration. Trace each assertion back to its origin and seek usable evidence.
29. Interview sequence and contamination
Financial crime investigations
Plan interviews around what each person could know and what documents already establish. Begin with open questions, record the witness's own account, then test discrepancies using specific records. Interview order can prevent one subject from shaping others' memories or destroying evidence. Follow local rules on warnings, representation, recording, and disclosure. Preserve both inculpatory and exculpatory answers, including uncertainty and corrections made during the interview.
Applied example: Before interviewing a payment approver, investigators secure approval logs and speak with the records custodian. They then ask the approver to describe the process before showing a disputed override.
Common mistake: Leading with the investigator's theory can contaminate the account. Obtain an unprompted chronology first, then use documents to test precise differences.
30. Cross-border evidence and lawful process
Financial crime investigations
Records held abroad raise questions of access authority, privacy, secrecy, admissibility, and preservation. Identify where the data and custodian are located, who can lawfully produce it, and whether a formal cooperation channel is needed. A voluntary copy may be useful intelligence but may not satisfy later evidentiary requirements. Maintain a request log and collection history so the team can explain how each foreign record entered the case.
Applied example: A platform outside the investigator's jurisdiction holds account messages. The team sends a preservation request through an available lawful channel while assessing the formal process needed for usable production.
Common mistake: A colleague's overseas contact cannot automatically bypass local disclosure law. Establish the lawful route and document the record's provenance before relying on it.
60 core concepts 31-40
31. Reconciliation as an investigative method
Interpreting financial documents
Reconciliation compares records that should describe the same economic event from different viewpoints. Start with a defined period and population, match transactions by identifier, amount, date, and counterparty, then explain unmatched items. Timing differences, fees, reversals, and currency conversion may be legitimate. The strongest discrepancy is one that remains after those explanations are tested and can be tied to a person or control failure.
Applied example: A charity's ledger shows grants paid to a supplier, but bank records show different beneficiaries. The examiner matches payment references and approval files before identifying which entries remain unexplained.
Common mistake: A mismatch is an investigative question, not automatic falsification. Test cutoffs, reversals, fees, and data-entry errors before attributing intent.
32. Cash flow versus reported profit
Interpreting financial documents
Profit recognizes income and expenses under accounting rules; cash flow records when money actually moves. A profitable entity can have little cash because receivables are unpaid, while strong cash receipts can arise from borrowing or asset sales. Compare operating cash flow with revenue, receivables, inventory, and related-party balances. An unusual gap is a lead to test recognition and collectability, not by itself proof of manipulation.
Applied example: A distributor reports rising profits while customer payments fall and receivables age. The analyst reviews invoices, subsequent collections, credit notes, and related-party sales before assessing whether revenue was overstated.
Common mistake: Assuming profit equals cash misses ordinary timing differences and financing. Identify which account created the gap and whether supporting transactions actually occurred.
33. Ledger entries and source documents
Interpreting financial documents
A ledger entry records an accounting assertion; source documents help establish the underlying event. For a selected entry, trace the invoice or contract, approval, goods receipt, bank settlement, and any later adjustment. Note who could create or change each record. Matching documents can still be fabricated together, so independent evidence such as delivery data or counterparty confirmation may matter where the transaction is material.
Applied example: A consulting expense has an invoice and approval but no work product. The reviewer checks meeting records, payment beneficiary, contract scope, and the consultant's independent confirmation before accepting the expense.
Common mistake: An invoice attached to a ledger entry is not independent proof of service. Test performance and payment destination, especially where one person controls both documents.
34. Financial ratios as leads
Interpreting financial documents
Ratios can expose changes that deserve inquiry, such as rising receivables against flat sales or unusually thin margins in a related-party business. Select peers with comparable products and accounting periods, then inspect the underlying transactions. A ratio compresses many causes into one number and cannot identify fraud on its own. Document the expected range, the observed change, and the records needed to distinguish operational change from manipulation.
Applied example: A wholesaler's inventory turnover drops sharply while sales rise. The investigator checks stock counts, returns, purchase records, and valuation methods before deciding whether inventory exists and is saleable.
Common mistake: A ratio outside an industry average is not a finding of crime. Verify peer comparability and trace the account balances producing the number.
35. Protecting financial evidence
Interpreting financial documents
Spreadsheets and exported statements can lose formulas, metadata, or context when copied. Preserve an original, record the source and collection method, and work from a controlled copy. For electronic records, note time zone, file version, and any transformation used to normalize data. A reproducible calculation lets another reviewer verify the conclusion and distinguish an original transaction from a later correction or analyst-created field.
Applied example: An investigator receives a general-ledger export with hidden columns. The team preserves the original file, records its hash and source, then analyzes a copy with every transformation logged.
Common mistake: Pasting selected rows into a new sheet can erase audit context. Preserve the original and document filtering, formulas, and later adjustments before citing results.
36. Correspondent banking and payment messages
Money and commodities flows
Cross-border payments may pass through correspondent banks that provide access to another currency or market. Map ordering customer, beneficiary, intermediaries, accounts, and settlement banks from the available messages and account records. A correspondent's role in processing does not establish that it knew the underlying parties' full purpose. Missing or inconsistent originator and beneficiary information can affect review, but the legal obligation depends on the payment type and jurisdiction.
Applied example: A payment from a regional bank reaches a supplier through two correspondents. Analysts reconcile message fields with account statements to determine where funds actually settled and which bank held customer records.
Common mistake: Treating every bank named in a message as the final holder of funds confuses routing with settlement. Follow account entries and identify each institution's role.
37. Money services, informal transfer, and prepaid value
Money and commodities flows
Value can move through licensed money services, informal agents, or prepaid instruments without a matching cross-border bank transfer. Separate the customer's funding, the beneficiary's access to value, and later settlement among issuers, agents, or merchants. Prepaid cards and wallets can add reloads, transfers, purchases, and redemption to that trail. Match identifiers and balances across each step, while testing ordinary use and legitimate netting arrangements. Licensing, recordkeeping, and reporting duties depend on the activity and local law.
Applied example: Several people load prepaid cards at different agents, and one wallet redeems the balances abroad. Analysts reconcile funding receipts, card identifiers, wallet transfers, redemption records, and the issuer's settlement account to locate the value.
Common mistake: Searching only for an international wire can miss a payout or redemption. Do not infer unlawful transfer solely from an informal channel or prepaid product; establish the transaction path and applicable duty.
38. Trade-based value movement
Money and commodities flows
Trade can move value through mispriced goods, false quantities, duplicate invoices, or shipments that differ from documents. Build a transaction chain linking contract, invoice, customs filing, transport, insurance, and payment. Compare prices with genuinely similar goods and terms. A discrepancy has greater significance when it shifts value between connected parties or repeats without commercial explanation. The purpose is to explain the value transfer, not merely flag an odd invoice.
Applied example: A related importer pays twice the market range for ordinary fabric. Reviewers check quality, freight terms, shipment weight, and supplier ownership before estimating whether the price transferred value abroad.
Common mistake: A high unit price alone does not establish trade-based laundering. Product differences and contract terms may explain it; trace who benefits from any unexplained excess.
39. Digital-asset movement and attribution
Money and commodities flows
A blockchain transaction can show movement between addresses, while attribution to a person requires separate evidence such as exchange records, device data, or admissions. Map custody, conversions, and timing, then distinguish an address cluster from a verified owner. The FATF virtual-asset guidance discusses risks and service-provider activity, but definitions and obligations require the current recommendations and applicable local implementation. The CCAS guide develops blockchain mechanics in greater depth.
Applied example: Stolen funds reach several addresses before an exchange deposit. An investigator traces the transfers, obtains lawful exchange records, and keeps the earlier address-cluster inference separate from the verified account holder.
Common mistake: A cluster label is not identity proof. Explain the heuristic and its uncertainty, then seek independent records before alleging who controlled an address.
40. Human-trafficking financial flows
Money and commodities flows
Trafficking-related transactions may involve recruitment fees, transport, lodging, wage diversion, or payments to controllers. No single transaction pattern identifies a victim. Compare financial activity with employment arrangements, shared addresses, control of accounts, and available safeguarding information. A response should consider immediate victim safety and confidentiality alongside financial investigation. Avoid actions that expose a potential victim to a controller or assume that all participants have equal agency.
Applied example: Several workers' wages enter accounts controlled from one device and quickly pay a transport company. The team checks employer records and account authority while coordinating a safe referral through appropriate channels.
Common mistake: Shared housing or similar transfers may have benign explanations. Look for control over earnings and movement, and protect potential victims during verification.
60 core concepts 41-50
41. Risk assessment to control design
Compliance programs and sanctions controls
A risk assessment should connect exposure to a control that can detect, prevent, or mitigate it. Identify products, customers, locations, delivery channels, and transaction types, then assess inherent risk and the effect of existing controls. Record the evidence behind ratings and the owner of each gap. A single enterprise score is less useful when it hides a high-risk channel. The OFAC compliance framework offers a U.S. sanctions reference, not a universal statutory checklist.
Applied example: A payments firm expands into cross-border business payouts. Its assessment finds weak beneficiary data, so it strengthens onboarding fields, screening, and exception review before raising transaction limits.
Common mistake: Calling a business high risk without identifying the control gap does not guide action. Specify the exposure, failure mode, control, and evidence that the control works.
42. Customer due diligence and beneficial ownership
Compliance programs and sanctions controls
Customer due diligence links a customer to its purpose, expected activity, controllers, and relevant risk. For an entity, compare ownership records with voting rights, control arrangements, and the people who actually direct transactions. Refresh information when events challenge the original profile, rather than treating onboarding as permanent proof. FATF beneficial-ownership standards guide jurisdictional implementation; the precise collection, verification, and reporting duties depend on the law applicable to the institution.
Applied example: A trading company changes directors and begins paying a new related supplier. The analyst obtains updated control documents and compares the supplier relationship with the stated business purpose before resetting monitoring expectations.
Common mistake: A share register may omit control through agreements or nominees. Check actual decision authority, while applying the ownership thresholds and verification rules of the relevant jurisdiction.
43. Monitoring alerts and reporting decisions
Compliance programs and sanctions controls
Transaction monitoring should produce reviewable leads tied to the institution's risks. An analyst compares the alert with the customer's profile, counterparties, history, and available explanation, then records what was checked and why the case was escalated or closed. Reporting thresholds, deadlines, and confidentiality rules arise from applicable law. In the United States, the FinCEN legal framework identifies governing authorities; a stated enforcement priority is not itself a new filing trigger.
Applied example: A business sends payments to unrelated personal accounts after receiving unusually large deposits. The analyst reviews invoices and account history, documents unresolved concerns, and applies the institution's legal reporting criteria.
Common mistake: An alert is not an automatic report, and a plausible story is not automatic closure. Evaluate corroborating records and the specific reporting rule that applies.
44. Sanctions matching and ownership
Compliance programs and sanctions controls
A sanctions alert requires identity adjudication, legal scope, and a transaction decision. Compare identifiers beyond the name, then identify the applicable regime and the person's role in the transaction. Under the U.S. OFAC 50 Percent Rule, certain entities are blocked through aggregate ownership by blocked persons; control alone below that threshold does not automatically trigger that ownership rule, although other prohibitions may apply. UK and EU tests require their own analysis.
Applied example: A supplier resembles a listed person and has two blocked minority owners. The sanctions team verifies identifiers, ownership paths, and the payment's U.S. nexus before deciding whether to block or release it.
Common mistake: A name match or vague control concern is not a complete legal conclusion. Resolve identity and apply the relevant regime's ownership and transaction rules.
45. Control testing and employee risk
Compliance programs and sanctions controls
Control design says what should happen; testing determines whether it did happen across a defined population. Sample transactions, inspect evidence of review, test exceptions, and follow remediation to closure. Employee access, incentives, and override rights can undermine otherwise sound procedures. Training should address decisions staff actually make, while governance should identify who accepts residual risk and who can challenge that acceptance independently.
Applied example: A firm says every sanctions override receives second approval. Testing finds several approvals entered after payment release, so management changes access rights and retests the release workflow.
Common mistake: A policy document is not evidence that a control operated. Test actual transactions, timing, and reviewer independence, then verify that corrective action changed the result.
46. Social engineering and payment authority
Cybersecurity and privacy
Social engineering manipulates a person into disclosing access or authorizing a transaction. The message may appear technically authentic because a real mailbox or account was compromised. Focus controls on the decision being changed: a new beneficiary, urgent exception, credential reset, or disclosure of sensitive data. Preserve message headers and call records when possible. Technical authentication of a channel does not establish that the human instruction was authorized.
Applied example: A finance employee receives an urgent payment request from the chief executive's real email account. A callback to a previously verified number exposes the compromise, and the team preserves the message and access logs.
Common mistake: A genuine account can carry a fraudulent instruction. Verify unusual changes through an independent channel and avoid treating sender authentication as transaction approval.
47. Account takeover and authentication
Cybersecurity and privacy
Account takeover occurs when an attacker gains control of an established account, sometimes through stolen credentials, session tokens, or social engineering. Examine the access path, device changes, credential resets, beneficiary additions, and transaction sequence. Strong authentication reduces some attacks but does not prove every later action was legitimate. NIST authentication guidance addresses authenticator management; it is distinct from identity proofing and from financial-sector customer due diligence duties.
Applied example: A customer passes a one-time code after a phishing call, and a new payee is added. Investigators examine session logs and call timing while operations secures the account and attempts payment recovery.
Common mistake: A successful login is not conclusive authorization of the transfer. Assess whether the customer was deceived, the session was hijacked, or the account was otherwise compromised.
48. Identity proofing in digital onboarding
Cybersecurity and privacy
Digital identity proofing asks whether the applicant is the person claimed, while authentication asks whether a returning user controls an accepted authenticator. Controls may examine document validity, liveness, data consistency, and binding between applicant and credential. The NIST identity-proofing guidance describes assurance methods, but institutions must separately meet applicable customer identification and beneficial-owner requirements. A strong selfie check cannot establish the ownership structure of a corporate customer.
Applied example: An applicant presents a valid-looking identity card and passes facial comparison, but the business account's controller remains undisclosed. Onboarding verifies the individual and separately obtains the entity's ownership information.
Common mistake: Passing biometric comparison does not satisfy every identity or customer-due-diligence duty. Identify which claim the control verifies and which claims still need evidence.
49. Incident response and evidence preservation
Cybersecurity and privacy
A financial-crime incident may require immediate containment and a later reconstruction of what happened. Separate decisions to disable access, stop payments, preserve logs, notify affected parties, and assess reporting duties. Record who made each decision and when. Forensic copies and access controls help protect evidence, but containment should not be delayed solely to obtain a perfect image when ongoing loss is preventable.
Applied example: A compromised employee account is issuing refunds to new cards. Security disables the session, payments stops unsettled refunds, and investigators preserve relevant logs before routine retention deletes them.
Common mistake: Wiping a device immediately may remove evidence, while waiting can allow more loss. Coordinate containment and preservation according to the incident's timing and available controls.
50. Privacy limits in shared investigations
Cybersecurity and privacy
Fraud, security, and AML teams often need overlapping data, but each use should have a lawful basis and defined purpose. Share the minimum information needed for the decision, track access, and observe retention and cross-border transfer rules. Privacy duties can coexist with reporting or preservation obligations; resolve conflicts under the applicable law rather than assuming one function overrides all others. Document restrictions attached to data received from partners.
Applied example: A security team identifies compromised customers across several countries. It shares transaction identifiers with fraud investigators while legal staff determine which personal data can be transferred for a broader inquiry.
Common mistake: Internal availability does not make every use permissible. Define the investigative purpose and legal basis before copying entire customer files into a shared workspace.
60 core concepts 51-60
51. Conflicts of interest and recusal
Ethics and professional responsibility
A conflict can arise when an investigator, approver, or adviser has a financial, personal, or career interest in the outcome. Disclose the relationship promptly and assess whether independent review, restricted participation, or recusal is needed. The decision should address both actual influence and whether a reasonable reviewer could trust the process. A legal permission to remain involved does not always resolve the professional judgment problem.
Applied example: An analyst is assigned to review a vendor owned by a close relative. The analyst discloses the connection, preserves existing work, and transfers substantive decisions to an independent reviewer.
Common mistake: Promising to be objective does not remove a material conflict. Use a documented arrangement that protects the decision and its credibility.
52. Confidentiality and need-to-know access
Ethics and professional responsibility
Financial-crime work often involves sensitive customer information, intelligence, and allegations that may never be substantiated. Limit access to people with a defined role, use approved channels, and record permitted disclosures. Confidentiality is not absolute: applicable law may require reporting or production to an authority. The ethical task is to disclose accurately to the proper recipient without widening circulation or overstating unverified claims.
Applied example: A manager asks for details of an employee investigation out of curiosity. The case lead provides only operational restrictions needed for staffing and routes substantive access through the authorized process.
Common mistake: A senior title alone does not create a need to know. Match the disclosure to the person's responsibility and the legal or institutional basis for access.
53. Independence under commercial pressure
Ethics and professional responsibility
Investigators and compliance officers may face pressure to close a case, approve a customer, or avoid documenting a concern. Maintain an evidence-based record of the decision, the uncertainty, and the person accepting any residual risk. Escalate through the governance route appropriate to the issue, including independent oversight when management is implicated. Independence does not mean rejecting every business request; it means applying the same criteria despite its commercial importance.
Applied example: A major client requests release of a held payment before ownership questions are resolved. The reviewer records the unresolved facts and escalates the decision to an independent sanctions authority.
Common mistake: Commercial urgency cannot supply missing evidence. Conversely, indefinite delay without a stated question is poor judgment; identify what fact would change the decision.
54. Fair presentation of uncertain findings
Ethics and professional responsibility
A professional report should separate observed facts, witness statements, analytic inference, and unresolved questions. Describe evidence that weakens the preferred theory as well as evidence that supports it. State confidence in terms tied to source quality and corroboration, not dramatic language. This allows a decision maker to choose a proportionate response and later reviewers to reproduce the reasoning. Correct material errors promptly, including those that favor the investigation.
Applied example: A report links three accounts by address but notes that the building contains many unrelated tenants. The analyst adds device and payment evidence before drawing a coordination inference.
Common mistake: Calling a plausible hypothesis a proven fact can distort legal and operational decisions. Label each inference and disclose the evidence that could change it.
55. Escalation when duties conflict
Ethics and professional responsibility
Legal requirements, institutional policy, contractual confidentiality, and professional duties can point toward different immediate actions. Identify which rule binds whom, its jurisdiction and timing, and whether an exception or protected reporting channel exists. Seek qualified advice for a genuine legal conflict while preserving relevant evidence and recording the decision path. Ethical concern may justify escalation even when a reporting trigger has not yet been established.
Applied example: A partner asks for customer records during a joint inquiry, but the agreement restricts onward disclosure. The investigator preserves the records, checks the applicable legal gateway, and escalates the request before sharing.
Common mistake: Treating internal policy as identical to law can produce the wrong disclosure decision. Identify each obligation separately and follow the valid route for resolving their conflict.
56. International standards and industry guidance
International standards and financial crime convergence
Cross-border cases may draw on several frameworks with different purposes. The FATF recommendations set international AML, counter-terrorist-financing, and proliferation-financing standards for national implementation. OECD anti-bribery instruments address corruption in international business; Basel Committee materials inform banking supervision; Wolfsberg publications provide private-sector financial-crime guidance. None should be cited as a universal, directly enforceable filing or freezing rule. Identify the issue each framework addresses, then find the applicable domestic law, regulator requirement, or institutional policy before directing action.
Applied example: A bank reviews payments to a foreign procurement agent. Investigators use anti-bribery guidance to frame the corruption risk and banking guidance to assess controls, while counsel identifies the statutes and reporting rules that govern the transaction.
Common mistake: Treating every international publication as law can create false obligations. State whether a source is a standard, supervisory guidance, industry practice, domestic rule, or internal policy.
57. United Nations listings and local effect
International standards and financial crime convergence
A United Nations listing is an authoritative starting point for identifying a designated person or entity. The applicable measures depend on the relevant sanctions regime and how a jurisdiction implements it. Screen names with identifiers, resolve possible matches, and determine which transaction or asset is affected. The UN consolidated list does not, by itself, describe every domestic prohibition, license, reporting duty, or ownership rule applicable to a particular institution.
Applied example: A bank flags a customer whose name resembles a UN-listed individual. Analysts compare birth date and nationality, then consult the applicable domestic measure before deciding what to do with the account.
Common mistake: A similar name is not an established match, and a confirmed listing does not answer every operational question. Verify identity and the implementing rule.
58. Divergent sanctions regimes
International standards and financial crime convergence
A cross-border transaction may touch U.S., UK, EU, or other sanctions regimes through parties, currency, location, or services. Analyze each nexus separately, then apply the corresponding list, ownership or control test, licensing route, and reporting rule. UK financial sanctions guidance illustrates a jurisdiction-specific framework; it cannot be replaced by the U.S. automatic blocking ownership test. Record where one regime prohibits an action that another permits.
Applied example: A UK company pays an EU supplier through a U.S. dollar correspondent. The team maps all three nexuses and checks each relevant regime before deciding whether a license or payment hold is required.
Common mistake: Importing one country's ownership threshold into another regime can produce a false release or false block. Apply the rule attached to each legal nexus.
59. Phased legal change and control readiness
International standards and financial crime convergence
A law can be adopted before all its provisions apply. Read commencement and transitional provisions alongside the substantive text, then distinguish current duties from controls being prepared for future dates. The EU anti-money-laundering regulation has phased application, with Article 90 generally pointing to July 2027 and specified categories later. A control program should plan implementation without describing a future provision as already fully enforceable.
Applied example: An EU group updates customer procedures ahead of a new regulation. Legal staff mark which provisions already apply, which begin later, and which national rules govern today's cases.
Common mistake: An enacted text is not always an operative duty on the publication date. Check commencement, entity scope, and any transitional rule before citing it.
60. Converged response to a multi-crime case
International standards and financial crime convergence
Complex cases benefit from a shared chronology and separate decision tracks. Map suspected predicate conduct, asset movement, customer and sanctions exposure, cyber events, evidence sources, and recovery opportunities. Assign each action to the team with authority to perform it, then coordinate timing so containment does not destroy evidence or alert subjects unnecessarily. Record legal duties by jurisdiction and distinguish them from voluntary cooperation or institutional policy.
Applied example: A compromised supplier account receives procurement payments and sends funds abroad. Fraud seeks recovery, security preserves access logs, AML traces proceeds, and counsel checks sanctions and disclosure duties before external sharing.
Common mistake: One team cannot assume its case closure resolves every risk. Reconcile the separate fraud, AML, sanctions, privacy, and recovery decisions against the same verified timeline.
Six-session study plan
Official references
Exam-format details come from ACFCS. The allocations below are this guide's study priorities, not official exam blueprint weights. FATF and other international materials are standards or guidance; applicable duties depend on local law.
- ACFCS CFCS Exam Preparation
- ACFCS CFCS Exam
- ACFCS CFCS Handbook and Application
- FATF Recommendations
- OFAC: Entities Owned by Blocked Persons (50 Percent Rule)
- OFAC: A Framework for Compliance Commitments
- FATF: Risk-Based Approach to Virtual Assets and VASPs
- NIST SP 800-63B-4: Authentication and Authenticator Management
- FinCEN Legal Authorities and Bank Secrecy Act framework
- EU Regulation 2024/1624 (AMLR), official text
- FATF 2025 financial inclusion and proportionate AML/CFT guidance
- NIST SP 800-63A-4: Identity Proofing and Enrollment
- UK OFSI financial sanctions general guidance
- UN Security Council consolidated sanctions list
- Council of the EU: restrictive measures and sanctions
- U.S. Department of Justice: Foreign Corrupt Practices Act
- IRS Internal Revenue Manual: tax avoidance distinguished from evasion
- StAR Asset Recovery Handbook, second edition
- NIST SP 800-61 Revision 3: Cybersecurity Incident Response
- FinCEN: current Beneficial Ownership Information reporting
- FinCEN: Customer Due Diligence Final Rule
- FinCEN FIN-2026-R001: beneficial-owner verification exceptive relief
- EU Regulation 2023/1114: Markets in Crypto-assets (MiCA)
- EU Regulation 2023/1113: information accompanying transfers