Exam Overview and Format
About this guide
The Certified Know Your Customer Associate (CKYCA) is an associate-level ACAMS certification for professionals involved in KYC, customer due diligence, onboarding, and periodic reviews. This guide presents 60 original learning concepts in a practical sequence, from customer identification to ongoing monitoring and escalation.
ACAMS describes the exam format as 60 questions in 90 minutes. The exam includes unscored pilot items, and the passing percentage applies to scored items. The stated pass requirement is 72% of scored items. Check the official CKYCA page and the ACAMS associate-certification help page for current details before booking.
This guide is written in English for study convenience. Site language availability does not establish that ACAMS offers the exam in that language; verify official exam-language options directly with ACAMS. The syllabus priorities below are editorial study guidance, not official domain weights. Information was checked against the supplied official-provider references on October 11, 2026; exam arrangements may change.
KYC requirements depend on applicable law, regulation, and institutional policy. International standards such as FATF Recommendations are not automatically domestic law. Use the jurisdiction and policy that apply to the case rather than assuming a universal threshold, deadline, or response.
CKYCA Study Map
| Domain | Coverage | Suggested study priority |
|---|---|---|
| KYC and CDD Foundations | Purpose of KYC, identification and verification, risk-based onboarding, customer profiles, and expected activity. | Build the foundations; these ideas inform decisions in every other domain. |
| Customer Due Diligence and Enhanced Due Diligence | CDD, simplified and enhanced measures, source of funds and wealth, PEPs, adverse media, geography, and escalation. | Practice proportionate decisions and distinguish indicators from conclusions. |
| Beneficial Ownership and Complex Structures | Entity ownership and control, layered structures, trusts, nominees, registry information, and reasonable verification. | Trace ownership and control carefully; record evidence and unresolved gaps. |
| Periodic Reviews and Ongoing Monitoring | Scheduled reviews, trigger events, profile maintenance, quality control, documentation, and escalation handoffs. | Apply the earlier concepts over time and respond promptly to meaningful changes. |
60 Practical CKYCA Concepts 1–10
1. Why KYC exists
KYC and CDD Foundations
Know Your Customer work helps an institution understand who it serves, why the relationship is being opened, and what activity would make sense for that customer. The information supports risk assessment and later monitoring; collection alone is not the objective. Useful KYC connects reliable facts about the customer to a reasoned view of the relationship.
Example: A small design firm expects local client payments and ordinary supplier expenses. Recording that purpose gives the onboarding team a basis for judging whether later activity fits the relationship.
Common misconception: A completed form is not proof that KYC is effective. Information must be sufficiently reliable, understood in context, and useful for decisions about the relationship.
2. Identification is not verification
KYC and CDD Foundations
Identification means obtaining details that describe a customer, such as a name or date of formation. Verification means taking reasonable steps, under applicable requirements and policy, to establish that key details are accurate. The distinction matters because an unverified declaration may be useful information without being adequate evidence of identity.
Example: An applicant enters a name and address on a form. The analyst compares relevant details with suitable evidence and records any material mismatch before deciding whether identity has been sufficiently verified.
Common misconception: Do not treat a customer's statement as automatically verified. It may be a starting point, but the institution must assess suitable corroboration for the case.
3. Identify the customer and the people acting for them
KYC and CDD Foundations
A relationship may involve a customer plus one or more representatives, agents, or signatories. Establishing the customer's identity does not by itself explain who is acting, their authority, or the capacity in which they act. Collect and verify the relevant information according to the relationship, applicable requirements, and institutional policy.
Example: A company director submits an account application. The analyst verifies the company as customer and checks the director's identity and authority to act for it.
Common misconception: Do not assume that the person who completes onboarding is the customer or an owner. Their role and authority are separate questions to establish.
4. Assess the quality of identity evidence
KYC and CDD Foundations
Evidence is useful when it is relevant to the fact being checked, sufficiently reliable for the risk, and assessed in context. Independence, authenticity, recency, and consistency can all matter. No single document type is universally best in every situation; the institution should use evidence and methods allowed by applicable rules and its own procedures.
Example: A company extract confirms the registered name, but not necessarily the person controlling the company. The analyst obtains and assesses separate ownership and control information.
Common misconception: A document that looks official does not verify every fact in a file. Check what it actually establishes, and do not extend its evidential value beyond that scope.
5. Resolve material discrepancies
KYC and CDD Foundations
Differences between customer-provided information and independent evidence may have innocent explanations, but material discrepancies can weaken confidence in the profile. Identify what differs, assess whether the difference affects identity or risk, and seek clarification or further evidence as appropriate. Record the resolution, or clearly preserve the unresolved issue for decision-makers.
Example: A registry shows a different trading address from the application. The analyst asks whether the company recently moved and documents evidence supporting the updated address.
Common misconception: Do not silently choose whichever version is more convenient. An unresolved material conflict can change the risk assessment and should remain visible.
6. Apply a risk-based approach
KYC and CDD Foundations
A risk-based approach matches the depth and frequency of due diligence to the risks identified in the customer and relationship. It is neither identical treatment for everyone nor permission to overlook risk. Analysts should explain which factors matter, what controls address them, and why the chosen measures are reasonable under applicable law and policy.
Example: Two businesses seek similar services, but one has opaque ownership and activity across several markets. The analyst requests proportionate additional information rather than applying identical checks.
Common misconception: More checks are not automatically better in every case. Excessive or irrelevant requests can obscure important risks; the measures should address the actual risk.
7. Consider risk factors in context
KYC and CDD Foundations
Customer type, products, delivery channels, geography, ownership, and anticipated activity can each inform risk. Their significance depends on how they interact, not on a single label in isolation. A sound assessment explains the connection between a factor and the relationship's exposure, then considers whether available controls reduce that exposure.
Example: A cross-border supplier is not rated solely by its location. The analyst also considers the business purpose, counterparties, payment pattern, ownership transparency, and controls.
Common misconception: A single risk factor is not a complete assessment. Avoid automatic conclusions based only on an industry, location, customer category, or product.
8. Separate inherent risk from residual risk
KYC and CDD Foundations
Inherent risk describes exposure before considering controls; residual risk describes what remains after relevant controls are applied. Keeping them distinct helps explain why a relationship may begin with significant exposure yet be manageable with effective safeguards, or remain concerning despite a well-organized file. Assess both instead of letting one label replace the analysis.
Example: A complex corporate structure creates higher inherent opacity. Verified ownership information and suitable ongoing review may reduce, but do not erase, the residual risk.
Common misconception: Do not call a customer low risk merely because controls exist. Assess whether those controls work and what exposure remains after applying them.
9. Build a useful customer profile
KYC and CDD Foundations
A customer profile brings together identity, purpose, ownership or control, business or personal context, and anticipated activity. It should be coherent enough to guide decisions and monitoring, not just a collection of fields. Analysts should identify gaps that affect understanding, distinguish confirmed facts from assumptions, and keep the profile aligned with evidence.
Example: A wholesaler's profile records its main markets, suppliers, expected payment types, and relevant owners. A later change in trading pattern can then be assessed against a meaningful baseline.
Common misconception: A profile is not useful simply because every field is populated. Empty explanations, stale details, or unsupported assumptions can make a complete-looking file misleading.
10. Define the purpose of the relationship
KYC and CDD Foundations
Understanding why a customer wants a product or service helps determine what information is relevant and what activity is plausible. The stated purpose should make sense alongside the customer's circumstances, business model, and intended use. If it is vague or inconsistent, seek clarification rather than inventing a rationale for the customer.
Example: A newly formed company requests international payment services. The analyst asks about its planned trade, counterparties, and intended payment use to assess whether the request is coherent.
Common misconception: Do not confuse the product requested with the purpose of using it. Product selection alone may not explain who will pay, who will receive funds, or why.
60 Practical CKYCA Concepts 11–20
11. Establish expected activity
KYC and CDD Foundations
Expected activity translates the customer's purpose and circumstances into a practical baseline for later review. It may include the kinds of transactions, counterparties, locations, or changes that are plausible, without pretending to predict every payment. A useful baseline is specific enough to support comparison and flexible enough to reflect legitimate business variation.
Example: A seasonal retailer expects higher incoming payments during its busy months and regular payments to known suppliers. Recording this pattern helps contextualize later activity.
Common misconception: Expected activity is not a rigid forecast. A deviation calls for assessment, not automatic suspicion, because legitimate activity can change.
12. Use a coherent onboarding sequence
KYC and CDD Foundations
Effective onboarding connects identification, verification, purpose, risk assessment, and approval into a logical decision. Each step should produce information that supports the next, while material gaps are resolved or handled under applicable policy before proceeding. The sequence can vary by institution, but the reasoning and responsibility for decisions should remain clear.
Example: An analyst confirms who the applicant is, understands the proposed use, assesses ownership and activity risk, and submits unresolved questions for review before the relationship is approved.
Common misconception: Do not treat onboarding as a checklist completed in any order. A risk decision made before key facts are understood may need to be revisited.
13. Assess remote identity checks carefully
KYC and CDD Foundations
Remote onboarding can introduce risks such as impersonation, altered documents, or unreliable capture of evidence. Controls should address the method used, the evidence's authenticity, and whether the person interacting is linked to the claimed identity. Choose methods consistent with applicable requirements and policy, and escalate unresolved doubts rather than assuming digital means either safe or unsafe.
Example: A video onboarding session shows a possible mismatch between the applicant and submitted identification. The reviewer pauses approval and requests an approved additional verification step.
Common misconception: Do not assume that a digital check is inherently reliable or inherently weak. Evaluate the actual method, evidence, and remaining uncertainty.
14. Make the risk decision explainable
KYC and CDD Foundations
A defensible decision explains the facts considered, the risk identified, the controls applied, and the reason for the outcome. This allows another reviewer to understand the judgment without reconstructing it from scattered records. Clear reasoning also helps the institution revisit the decision when circumstances change or quality review identifies a gap.
Example: The analyst records why the customer's ownership evidence was sufficient, which activity concerns were addressed, and why the remaining risk fits the institution's approval process.
Common misconception: A risk score without reasoning is not a complete rationale. Scores summarize inputs; they do not explain how evidence supported the final decision.
15. Know when CDD remains incomplete
KYC and CDD Foundations
If essential customer, representative, or ownership information cannot be established to the required standard, the institution must follow applicable law and its procedures for unresolved CDD. The appropriate response may depend on the stage, jurisdiction, and policy; possibilities can include requesting evidence, restricting progression, escalating, or deciding not to proceed.
Example: An applicant repeatedly declines to identify the people controlling its company. The analyst documents the gap and refers the case for a decision under local requirements and institutional policy.
Common misconception: Do not assume every information gap requires the same outcome. Assess materiality, applicable rules, timing, and policy before deciding what action follows.
16. Understand the purpose of CDD
Customer Due Diligence and Enhanced Due Diligence
Customer due diligence combines understanding the customer and purpose with assessing risk and maintaining information over the relationship. It is broader than collecting identity documents and narrower than proving every aspect of a customer's life. The right scope depends on the relationship, the risks, applicable requirements, and what is needed to make a reasoned decision.
Example: For a new company account, the analyst establishes the company, its representatives, ownership, purpose, and expected activity, then records how those facts shape the risk assessment.
Common misconception: CDD is not a one-time identity check. Its value depends on connecting onboarding information to later review and keeping important details current.
17. Use simplified measures only when appropriate
Customer Due Diligence and Enhanced Due Diligence
Simplified due diligence means applying less intensive measures where a lower-risk assessment and applicable rules permit it. It does not mean abandoning understanding of the customer, ignoring suspicious indicators, or treating a customer category as an automatic exemption. The institution should document why the reduced measures are justified and what ongoing attention remains appropriate.
Example: A customer and product present a well-supported lower-risk profile. The analyst applies the institution's permitted simplified process while retaining appropriate monitoring and recordkeeping.
Common misconception: Do not treat simplified measures as a way to bypass CDD. The customer still needs an adequate, risk-based understanding under applicable requirements.
18. Apply enhanced due diligence proportionately
Customer Due Diligence and Enhanced Due Diligence
Enhanced due diligence addresses elevated or specific risks through additional inquiry, corroboration, or review. The extra measures should respond to identified uncertainties rather than accumulate without purpose. Depending on the case and applicable rules, they may examine ownership, relationship purpose, funding, wealth, counterparties, or controls more closely.
Example: An ownership chain is unusually difficult to verify. The analyst seeks corroborating ownership records and a clearer account of the company's purpose, then documents any remaining uncertainty.
Common misconception: EDD is not synonymous with refusing a relationship. It means understanding and managing relevant risk more deeply before reaching a supported decision.
19. Distinguish source of funds from source of wealth
Customer Due Diligence and Enhanced Due Diligence
Source of funds concerns the origin of money used in a particular transaction or relationship. Source of wealth concerns how a customer's overall wealth was accumulated. The questions overlap but are not interchangeable: evidence explaining a single transfer may not explain overall wealth, and a wealth narrative may not establish the origin of the funds under review.
Example: A customer accumulated wealth through a long-running business but funds a new investment with a recent property sale. The analyst assesses the sale proceeds for the transaction and the business for overall wealth.
Common misconception: Do not use one answer to close both questions automatically. Match the inquiry and evidence to whether the concern is transaction-specific or about accumulated wealth.
20. Assess funding explanations against evidence
Customer Due Diligence and Enhanced Due Diligence
A funding explanation is more useful when it is plausible for the customer, consistent with the transaction, and supported by evidence appropriate to the risk. The analyst should examine unexplained third-party contributions, unusual routes, or conflicts with the profile without presuming wrongdoing. The objective is to resolve relevant uncertainty and record the basis for the conclusion.
Example: A company receives a large payment from an unfamiliar party. The analyst asks about the commercial connection and reviews relevant invoices or contracts before updating the assessment.
Common misconception: An explanation is not substantiation by itself. Consider whether the supporting evidence genuinely connects the payer, payment, and stated purpose.
60 Practical CKYCA Concepts 21–30
21. Treat PEP status as a risk factor
Customer Due Diligence and Enhanced Due Diligence
A politically exposed person (PEP) is an individual entrusted with a prominent public function under the definition applicable to the case. How former officials are treated can depend on applicable rules and risk. PEP status can create heightened exposure to corruption-related risks and may call for enhanced measures under applicable law and policy. It is not evidence that the person has committed an offence, and the assessment should remain individualized.
Example: A screening result identifies a senior public official as a potential PEP. The analyst verifies the match, assesses the relationship context, and applies the institution's relevant measures.
Common misconception: PEP status does not establish criminality or require automatic rejection. It informs risk assessment; evidence and applicable policy determine the response.
22. Verify a possible PEP match
Customer Due Diligence and Enhanced Due Diligence
Screening can identify a possible match, but analysts must distinguish the actual customer from people with similar names or incomplete records. Compare relevant identifiers and reliable contextual information, then record whether the match is confirmed, ruled out, or unresolved. The process prevents both missed exposure and unnecessary adverse decisions based on mistaken identity.
Example: A search returns a public official with the customer's common name. Date of birth and country differ, so the analyst records why the result is likely a false match.
Common misconception: A name-only alert is not confirmation. Resolve identity using relevant identifiers rather than treating a screening result as a final finding.
23. Consider PEP-related connections under applicable rules
Customer Due Diligence and Enhanced Due Diligence
Family members and close associates may be covered by laws, regulatory expectations, or institutional policies related to PEP risk. The applicable scope and treatment can vary, so analysts should establish the nature of the relationship and apply the relevant definition rather than assuming every acquaintance receives identical treatment. Document the basis for the classification and resulting assessment.
Example: A customer is reported to be a business partner of a public official. The analyst checks whether the relationship meets the applicable close-associate criteria and assesses its relevance.
Common misconception: Do not extend PEP-related treatment to any person who has met an official. A meaningful connection and the governing definition matter.
24. Evaluate adverse media, not just its headline
Customer Due Diligence and Enhanced Due Diligence
Adverse media is information from public sources that may indicate relevant concerns, but its reliability, subject, date, and outcome require assessment. Distinguish allegations from confirmed findings and establish whether the person or entity is actually the customer. Relevant reporting can prompt further inquiry or reassessment without itself proving misconduct.
Example: A news article reports an investigation of a company executive. The analyst confirms the person's identity, reviews the article's context and status, and records its relevance to the relationship.
Common misconception: Do not treat every negative article as a proven fact. Check source quality, identity, recency, and whether the report describes an allegation or an established outcome.
25. Assess geographic risk in context
Customer Due Diligence and Enhanced Due Diligence
Geographic exposure may arise from customer residence, business operations, counterparties, transaction routes, or ownership links. Its significance depends on the relevant risks and current information, not simply a country label. Use applicable institutional policy and authoritative jurisdiction-specific sources, then consider the exposure alongside purpose, activity, controls, and other customer facts.
Example: A business pays suppliers in several countries. The analyst considers the nature of the trade and counterparties rather than assigning its entire relationship risk from one destination alone.
Common misconception: A country connection is not proof of illicit activity. Treat geography as one contextual factor and avoid unsupported blanket conclusions.
26. Interpret FATF monitoring lists carefully
Customer Due Diligence and Enhanced Due Diligence
FATF public statements identify jurisdictions with strategic deficiencies or heightened monitoring concerns, but listing alone does not impose a universal duty to apply blanket EDD or terminate relationships. Consider relevant local measures, institutional policy, and the customer's actual exposure. A proportionate decision explains how the jurisdictional factor affects this particular relationship.
Example: A customer has a supplier in a jurisdiction under increased FATF monitoring. The analyst checks applicable policy and assesses the trade, payment route, counterparties, and other risk factors.
Common misconception: Do not equate increased monitoring with a universal prohibition. FATF status informs context; applicable law and individualized risk assessment guide action.
27. Investigate third-party funding
Customer Due Diligence and Enhanced Due Diligence
Funds provided by someone other than the customer may be legitimate, but the relationship between payer and customer can matter to the purpose and risk. Establish who funded the payment, why, and whether that arrangement fits the customer's profile. Seek evidence proportionate to the circumstances, then decide whether the explanation resolves the concern or needs further review.
Example: A new company receives startup capital from a director's family business. The analyst documents the connection and reviews evidence supporting the stated financing arrangement.
Common misconception: Third-party funding is an indicator for inquiry, not proof of wrongdoing. Do not escalate to a conclusion without considering the explanation and available evidence.
28. Assess whether the relationship purpose remains plausible
Customer Due Diligence and Enhanced Due Diligence
Purpose should be tested against the customer's actual circumstances and requested services. A plausible purpose helps explain expected activity; a vague or changing explanation may require clarification. Analysts should focus on material inconsistency and seek a grounded account rather than insisting that customers fit a stereotyped business model.
Example: A consultancy begins receiving regular payments described as wholesale sales. The analyst asks about the change in business activity and obtains information that supports or challenges the explanation.
Common misconception: Unfamiliar does not automatically mean implausible. Assess whether the explanation is coherent for this customer and supported by relevant facts.
29. Choose additional evidence to answer a specific question
Customer Due Diligence and Enhanced Due Diligence
Additional documents are valuable when they resolve a defined uncertainty, such as identity, ownership, funding, or business purpose. Asking for material without knowing what it should establish can burden customers while leaving the real risk unanswered. State the question first, choose evidence that can address it, and assess the evidence's limits.
Example: The analyst cannot explain an unusually large incoming transfer. Rather than requesting an unfocused bundle, they seek documents showing the transaction's origin and commercial purpose.
Common misconception: More paperwork does not guarantee stronger CDD. Evidence should be relevant to a decision question and assessed for what it actually proves.
30. Use escalation to obtain the right decision
Customer Due Diligence and Enhanced Due Diligence
Escalation brings unresolved, material, or policy-defined concerns to people with the authority or expertise to decide them. A good referral presents the relevant facts, inquiries completed, remaining gaps, and the decision sought. Escalation should not replace ordinary analysis, but it is important when the case exceeds the analyst's authority or cannot be resolved at their level.
Example: An analyst verifies the customer but cannot reconcile a major ownership discrepancy. They send a concise, evidence-based referral to the designated reviewer for a decision.
Common misconception: Escalation is not a substitute for clear casework. Include what is known and unresolved so the recipient can make an informed decision.
60 Practical CKYCA Concepts 31–40
31. Distinguish screening from due diligence
Customer Due Diligence and Enhanced Due Diligence
Screening is one tool used as part of customer due diligence. It compares customer information with relevant lists or data sources and may identify a possible match or risk signal. Analysts must resolve identity and context, then consider the result alongside information about the customer's purpose, circumstances, and overall risk. Screening alone does not establish the customer's status or explain the relationship.
Example: A company name resembles a listed entity. The analyst checks identifiers and ownership information, resolves whether it is the same entity, and follows the institution's applicable process.
Common misconception: A screening alert is not a fully assessed result. Resolve identity and context before drawing conclusions or recording a confirmed match.
32. Make the diligence depth fit the question and risk
Customer Due Diligence and Enhanced Due Diligence
The quality of diligence depends on whether the information obtained addresses the identified risk at a suitable depth. A straightforward point may need limited corroboration, while opaque ownership or unexplained funding may require several sources or specialist review. Reassess if evidence conflicts, remains incomplete, or reveals a different risk than initially expected.
Example: A company provides a plausible ownership chart, but it conflicts with registry information. The analyst seeks further corroboration before treating the structure as established.
Common misconception: Do not equate completing the requested checks with resolving the risk. Conflicting or weak evidence may mean further work is still needed.
33. Look through entities to natural persons
Beneficial Ownership and Complex Structures
A legal entity can be the customer, while beneficial ownership analysis seeks the natural persons who ultimately own or control it under applicable definitions. This requires distinguishing the entity's legal identity from the people behind its economic interests or decision-making. The method and any thresholds depend on jurisdiction and policy, so do not import a universal definition.
Example: A corporation applies for an account, but another company owns its shares. The analyst traces the chain to identify relevant natural persons and assess control.
Common misconception: The immediate shareholder is not necessarily the ultimate beneficial owner. Follow the structure far enough to identify people meeting the applicable ownership or control tests.
34. Map each layer in an ownership chain
Beneficial Ownership and Complex Structures
Layered structures should be mapped step by step, showing each entity, its jurisdiction, and its ownership or control relationship to the next. The map makes gaps visible and prevents a listed intermediate company from being mistaken for the final answer. Analysts should preserve the evidence supporting each link and note where reliable information is unavailable.
Example: A domestic company is held by a regional holding company, which is owned by two investment entities. The analyst records each link and investigates the people behind them.
Common misconception: Do not stop at the first holding company. An intermediate entity explains a layer, not necessarily the natural persons who ultimately own or control the customer.
35. Trace indirect ownership accurately
Beneficial Ownership and Complex Structures
Indirect ownership exists when a person holds an interest through one or more intermediary entities. An analyst must understand the chain and apply the relevant calculation or legal test under the governing jurisdiction and policy. Do not assume that every indirect interest is treated identically across regimes; document the method and source information used.
Example: A person owns part of a holding company, which in turn owns part of the customer. The analyst traces both links and applies the institution's applicable assessment method.
Common misconception: Do not report only direct shareholders when indirect interests matter. The ownership chain can change who meets the relevant beneficial-ownership test.
36. Do not assume one universal ownership threshold
Beneficial Ownership and Complex Structures
Ownership thresholds and definitions used to identify beneficial owners vary by jurisdiction, regulation, and institutional policy. A percentage can be a useful screening point, but it may not capture control or satisfy every applicable definition. Establish which rule governs the case and consider other relevant ownership or control rights where required.
Example: A shareholder falls below an internal ownership indicator but holds significant voting rights. The analyst checks the applicable control test instead of ending the inquiry at the percentage.
Common misconception: A familiar percentage is not a universal legal rule. Confirm the relevant jurisdiction and policy before treating a threshold as decisive.
37. Assess control as well as ownership
Beneficial Ownership and Complex Structures
A person may exercise significant influence or control without holding a large share of the company. Relevant indicators can include voting arrangements, appointment rights, contracts, or other means recognized by applicable rules. Assessing ownership alone can miss who directs the entity; record the specific evidence supporting any control conclusion.
Example: A minority investor can appoint most board members under a shareholder agreement. The analyst examines that right and assesses whether it represents control under the applicable framework.
Common misconception: Do not assume that the largest shareholder always controls the company. Decision-making rights and arrangements may give another person meaningful control.
38. Examine control arrangements beyond share registers
Beneficial Ownership and Complex Structures
A share register may not show every arrangement affecting control. Voting agreements, contractual rights, financing terms, or informal influence may be relevant depending on the facts and applicable definitions. Ask targeted questions when the known structure does not explain who makes important decisions, and distinguish documented rights from speculation.
Example: The shareholder register identifies several investors, but one founder appears to make all major decisions. The analyst asks about governance and reviews evidence of decision-making authority.
Common misconception: Do not infer control solely from a person's influence or title. Establish facts that connect the person to relevant decision rights or other recognized means of control.
39. Understand nominee arrangements
Beneficial Ownership and Complex Structures
A nominee may hold shares or act in another capacity for an underlying person. The registered holder therefore may not reveal the person with the economic interest or control. Establish the nominee's role, the underlying arrangement, and the relevant principal using measures proportionate to risk and consistent with applicable requirements.
Example: A nominee company appears as a shareholder in a registry. The analyst requests information about the underlying principal and records how the arrangement is evidenced.
Common misconception: The existence of a nominee does not prove that a structure is illicit. But recording only the nominee may leave ownership or control unexplained.
40. Identify relevant roles in a trust
Beneficial Ownership and Complex Structures
Trust arrangements can involve different roles, such as settlor, trustee, protector, and beneficiary, with different rights and functions. Which people must be identified and how their roles affect risk depends on applicable law and policy. Understand the arrangement sufficiently to determine who created it, administers it, benefits from it, or can influence its decisions.
Example: A trust owns shares in a customer company. The analyst records its relevant parties and reviews who can direct the trustee or benefit from the arrangement.
Common misconception: Do not assume the trustee is the only relevant person. Other parties may have rights, benefits, or influence that matter to the ownership assessment.
60 Practical CKYCA Concepts 41–50
41. Use registries as a source, not a complete answer
Beneficial Ownership and Complex Structures
Company and beneficial-ownership registries can provide valuable information, but coverage, accuracy, access, and verification methods differ. Treat registry results as one source and consider whether they answer the particular ownership or control question. Where information is missing, outdated, or inconsistent, seek proportionate corroboration rather than assuming completeness.
Example: A public registry lists a company director but provides no ownership details. The analyst obtains additional ownership information and checks whether it aligns with the customer's declaration.
Common misconception: A registry entry does not necessarily establish every beneficial owner or controller. Assess its scope, reliability, and consistency with other evidence.
42. Assess customer-declared ownership
Beneficial Ownership and Complex Structures
A customer declaration can be a useful source of ownership information, particularly when the structure is not fully visible elsewhere. Its reliability depends on detail, consistency, plausibility, and appropriate corroboration for the risk. Record what the customer stated and how the institution assessed it instead of presenting a declaration as independently verified fact.
Example: The company supplies a signed ownership chart. The analyst compares its names and percentages with available records and follows up on a missing intermediate owner.
Common misconception: Do not confuse a signed declaration with independent verification. It is evidence to assess, not automatic proof that the structure is complete and accurate.
43. Cross-check ownership information
Beneficial Ownership and Complex Structures
Cross-checking compares information from different sources to see whether the ownership story is coherent. Sources may include registries, corporate documents, customer explanations, and other reliable records. The aim is not to collect sources for their own sake, but to resolve material inconsistencies and understand the limits of the evidence.
Example: A corporate chart names one ultimate owner, while current company documents indicate a recent transfer. The analyst seeks updated evidence before finalizing the beneficial-ownership record.
Common misconception: Multiple sources are not automatically independent or consistent. Check whether each source genuinely corroborates the relevant fact.
44. Do not treat complexity alone as proof
Beneficial Ownership and Complex Structures
Multi-layered or cross-border structures can have legitimate commercial, investment, or governance purposes. Complexity can make ownership harder to understand and may therefore justify further inquiry, but it does not establish wrongdoing on its own. Assess the explanation, transparency, control, and evidence before deciding how the structure affects risk.
Example: A multinational group uses several holding entities for regional operations. The analyst maps the chain, understands the stated purpose, and evaluates whether the ultimate owners can be reasonably established.
Common misconception: Do not reject a relationship merely because its ownership chart is complicated. Respond to demonstrated risks and information gaps, not complexity as a standalone verdict.
45. Document what could and could not be verified
Beneficial Ownership and Complex Structures
A clear ownership record distinguishes established facts, customer assertions, reasonable inferences, and unresolved gaps. This distinction helps reviewers judge whether the verification effort was adequate and what decision remains. If a person cannot be identified or control cannot be resolved, document the steps taken and follow applicable policy and legal requirements.
Example: The analyst traces three corporate layers but cannot corroborate the final shareholder's identity. The file records sources checked, follow-up attempts, and the unresolved issue.
Common misconception: Do not convert uncertainty into a definite ownership conclusion. State precisely what the evidence supports and refer material unresolved gaps through the proper process.
46. Resolve ownership changes and discrepancies
Beneficial Ownership and Complex Structures
Conflicting or newly changed ownership information can affect the customer profile, risk assessment, and required review. Determine whether the difference reflects a timing issue, reporting delay, transaction, or possible control change. Obtain suitable evidence, update records when justified, and escalate material uncertainty under applicable policy.
Example: A customer reports a new shareholder, but a registry still shows the former owner. The analyst requests transfer evidence and records the discrepancy pending verification.
Common misconception: Do not keep using an old ownership record simply because it is already in the file. A credible change report should prompt timely assessment and appropriate updating.
47. Understand scheduled periodic reviews
Periodic Reviews and Ongoing Monitoring
A periodic review revisits customer information and risk at intervals set by applicable requirements and institutional policy. Its purpose is to assess whether the existing profile remains accurate and whether the diligence level still fits. The schedule does not replace monitoring between reviews, and review depth should reflect the customer's circumstances and risk.
Example: During a scheduled review, an analyst confirms the customer's business remains active, checks key ownership information, and compares current activity with the documented profile.
Common misconception: A scheduled review is not merely a date-based form refresh. Reassess whether the relationship still makes sense and whether material facts have changed.
48. Recognize trigger events
Periodic Reviews and Ongoing Monitoring
A trigger event is a meaningful change or new information that may require review outside the ordinary schedule. Examples can include ownership changes, new adverse information, altered business activity, or transactions inconsistent with the profile. The institution's policy defines relevant triggers; analysts should act promptly enough for the event to inform current decisions.
Example: A long-standing customer begins operating in a new market with unfamiliar counterparties. The analyst initiates the appropriate off-cycle assessment rather than waiting for the next scheduled review.
Common misconception: Do not defer every reassessment to the calendar. A material trigger may require attention before the next routine review.
49. Refresh information according to relevance
Periodic Reviews and Ongoing Monitoring
Refreshing customer information means checking whether important details remain accurate, not repeatedly requesting every item without purpose. Focus on facts that support identity, ownership, purpose, risk, and expected activity, using the relevant procedure and available evidence. Record what was confirmed, what changed, and what still needs attention.
Example: A review confirms the company address and business purpose but reveals a new director. The analyst updates the representative information and assesses whether authority or risk has changed.
Common misconception: Do not treat unchanged information as automatically reliable just because it was collected before. Consider its age, significance, and the reason for reviewing it.
50. Compare activity with the customer profile
Periodic Reviews and Ongoing Monitoring
Ongoing monitoring gains meaning when actual activity is compared with the customer's known purpose and expected pattern. A deviation may have a legitimate explanation, but it can also reveal a changed relationship or a risk that was not previously understood. The comparison should lead to proportionate inquiry and a recorded assessment, not automatic labeling.
Example: A local services firm begins receiving frequent international payments. The analyst compares the change with the profile and asks whether the business has expanded or changed.
Common misconception: Do not assume that unusual activity is automatically suspicious. Determine whether it is new, material, explainable, and consistent with the wider relationship.
60 Practical CKYCA Concepts 51–60
51. Treat unusual activity as an indicator
Periodic Reviews and Ongoing Monitoring
Unusual activity is activity that warrants comparison or inquiry because it differs from what is understood about the customer or raises a relevant concern. Its significance depends on context, evidence, and the explanation obtained. A sound analyst distinguishes a prompt for review from a conclusion about intent or criminality.
Example: A customer makes a payment much larger than its usual transactions. The analyst checks the payment purpose, source, counterparty, and whether the change fits the customer's circumstances.
Common misconception: An unusual pattern is not proof of crime. Investigate and document the concern, then follow escalation procedures if the facts justify further action.
52. Reassess risk when circumstances change
Periodic Reviews and Ongoing Monitoring
A risk rating should reflect current knowledge, not simply repeat the onboarding assessment. Changes in ownership, geography, purpose, products, activity, or adverse information may alter exposure or control effectiveness. Reassess the factors that changed and their combined effect, then record the reason for retaining or changing the rating.
Example: A customer adds a new line of international business and changes its main counterparties. The analyst evaluates whether the previous risk assessment still describes the relationship.
Common misconception: Do not assume a past low-risk decision remains valid forever. It was based on prior facts and may need revision as the relationship evolves.
53. Escalate high-risk cases with a clear handoff
Periodic Reviews and Ongoing Monitoring
A high-risk case may need review by a designated specialist, manager, or committee under institutional policy. A useful handoff identifies the risk, facts, inquiries, evidence, unresolved questions, and requested decision. Escalation supports informed oversight; it does not remove the analyst's responsibility to maintain accurate records and follow assigned actions.
Example: A review identifies changed ownership and activity inconsistent with the profile. The analyst summarizes both issues, supporting documents, and the question requiring senior review.
Common misconception: Do not send a bare label such as high risk without the reasoning. The reviewer needs the case facts and remaining decision points.
54. Distinguish internal escalation from external reporting
Periodic Reviews and Ongoing Monitoring
Internal case escalation routes concerns through the institution's procedures; external suspicious-activity reporting is a separate process governed by applicable law and authorized roles. An analyst should follow the internal handoff and confidentiality controls rather than deciding unilaterally whether an external report is legally required. Reporting duties, deadlines, and restrictions vary by jurisdiction.
Example: An analyst identifies unresolved concerns and refers the case through the designated internal channel. The authorized function assesses any external reporting obligations under local law.
Common misconception: Do not assume an internal referral automatically satisfies external reporting requirements, or that every employee independently files a report. Follow applicable law and role-specific procedures.
55. Keep an auditable decision trail
Periodic Reviews and Ongoing Monitoring
A useful record shows what information was reviewed, when the work occurred, who made the decision, what rationale was used, and what follow-up remains. This trail supports continuity, quality assurance, and later reassessment. Record relevant evidence and reasoning in a clear manner, subject to retention, privacy, and access requirements that apply to the institution.
Example: The analyst logs the new ownership evidence, the date checked, the conclusion, and the outstanding verification step so another reviewer can continue the case.
Common misconception: Do not rely on memory or unexplained status fields. If the reasoning is not recorded, future reviewers may be unable to understand or defend the decision.
56. Apply quality control to decisions, not just fields
Periodic Reviews and Ongoing Monitoring
Quality control should test whether evidence supports conclusions and whether material risks received appropriate attention. A form can be complete while the analysis is weak, inconsistent, or outdated. Reviewers should examine the logic linking facts to ratings and actions, identify recurring gaps, and direct corrections through the institution's process.
Example: A quality reviewer sees all required fields completed but finds no explanation for a significant ownership mismatch. The file is returned for a documented resolution.
Common misconception: Do not measure file quality only by completion rates. A polished checklist cannot replace sound analysis or evidence-based decisions.
57. Prioritize review backlogs by risk and urgency
Periodic Reviews and Ongoing Monitoring
When reviews are delayed, triage should consider risk, meaningful trigger events, exposure, and applicable regulatory or policy expectations. A queue position alone does not show which case deserves attention first. Use approved prioritization methods, make limitations visible, and escalate capacity or overdue concerns through the proper governance channels.
Example: A team has limited review capacity and a new trigger affecting a higher-risk customer. Under its approved process, it prioritizes the case ahead of routine lower-risk reviews.
Common misconception: Do not treat every overdue review as equally urgent or quietly ignore delays. Apply defined risk criteria and make material backlogs visible.
58. Decide what follows when concerns remain unresolved
Periodic Reviews and Ongoing Monitoring
If reasonable inquiries do not resolve a material concern, the next step depends on the issue, the relationship stage, applicable law, and institutional authority. Options may include further diligence, restrictions, senior review, relationship decisions, or referral for reporting assessment. Document why the selected action is appropriate; do not treat one outcome as universal.
Example: A customer cannot provide information needed to understand a significant change in ownership. The analyst refers the documented gap for a decision under the institution's procedures and local requirements.
Common misconception: Do not let an unresolved concern sit indefinitely or assume immediate termination is always required. Follow the relevant escalation and decision framework.
59. Protect confidentiality during escalation
Periodic Reviews and Ongoing Monitoring
Sensitive review and reporting information should be shared only with people authorized under applicable law and institutional procedures. This supports investigation integrity, customer privacy, and compliance with any jurisdiction-specific restrictions. Analysts should use approved channels and avoid disclosing internal concerns or reporting decisions to a customer unless authorized.
Example: A customer asks why an internal review is underway. The analyst follows approved communication guidance and does not disclose restricted information while the appropriate team assesses the case.
Common misconception: Do not assume it is harmless to explain every internal concern to the customer. Confidentiality and tipping-off rules vary, so follow local law and policy.
60. Use review outcomes to improve the profile
Periodic Reviews and Ongoing Monitoring
A completed review should leave the customer record more accurate and useful for future decisions. Update confirmed changes, revise expected activity or risk where justified, assign follow-up actions, and preserve unresolved issues. This closes the loop between monitoring and the profile that guides later work, rather than treating review as an isolated administrative task.
Example: After confirming that a customer has expanded into a new market, the analyst updates the profile, reassesses relevant risks, and records the next required follow-up.
Common misconception: Do not close a review without carrying its conclusions into the customer record. Otherwise, future monitoring may continue to rely on an outdated understanding.
Six-Step Study Plan
Official Sources and Verification
The official-provider references supplied for this guide are the ACAMS CKYCA certification page (https://www.acams.org/en/certifications/ckyca) and the ACAMS associate-certification help page (https://www.acams.org/en/help-center/associate-certifications). They describe the certification focus and exam format. Checked against the supplied dossier on October 11, 2026. This guide is original study material, not an official ACAMS publication. Local laws, regulations, institutional policies, exam logistics, and language availability should be verified with their authoritative sources.