CAMS-FCI Advanced CAMS-Financial Crimes Investigations Questions and Answers

Compare customer and transaction records against periodically updated sanctions lists provided by governmental bodies. This is stated in the Certified Anti-Money Laundering Specialist (the 6th edition) manual on page 595, which states: “Sanctions screening requirements include that a financial institution should compare customer and transaction records against periodically updated sanctions lists provided by governmental bodies.”

Verified Answer: D The recommendation that the AMLO should make is to conduct an in-depth investigation into accumulated remittance information in the past year to find the trend of such transactions. This is because the regular and increasing remittances from a country with high piracy activity may indicate a possible link to illicit funds derived from piracy or other criminal activities. According to the World Bank, remittances are often used as a channel for money laundering and terrorist financing, especially when they originate from or are destined to high-risk jurisdictions1. Therefore, the AMLO should analyze the remittance data to identify the sources, destinations, amounts, frequencies, and purposes of the transactions, and compare them with the customer profiles, expected activities, and risk ratings. The AMLO should also review any relevant information from external sources, such as media reports, sanctions lists, or law enforcement alerts, to determine if there are any red flags or indicators of suspicious activity. If the investigation reveals any evidence or suspicion of money laundering or terrorist financing, the AMLO should file a SAR/STR to the appropriate AML authority.

References:

Remittances data - Migration data portal

The instruction that the person in charge of the broker-dealer should provide to their employees is to take notes on the questions and comments made by the agents (A). This is because taking notes can help the employees to recall and document what happened during the search warrant execution, which can be useful for legal or regulatory purposes. According to ACAMS3, “the FI should instruct its staff to cooperate with LE agents during a search warrant execution, but also to take notes of what is being searched, seized, or asked by the agents” (p. 35). The FI should also “keep copies of any documents or records that are taken by LE agents” (p. 35).

The other instructions are not correct. The person in charge of the broker-dealer should not instruct their employees to sign consent forms permitting the agents to search employees’ offices (B), as this is unnecessary and potentially risky, as the agents already have a valid search warrant that authorizes them to search the premises. The person in charge of the broker-dealer should not instruct their employees to provide agents with unlimited access to customers’ personal data ©, as this could violate privacy or data protection laws, as well as compromise customer trust and confidentiality. The person in charge of the broker-dealer should not instruct their employees to volunteer information not requested by the agents that they think may be useful (D), as this could interfere with the LE investigation or expose them to legal or regulatory risks.

References:

• Introduction to Transnational Organized Crime
• ACAMS Law Enforcement and Financial Crimes Investigations eLearning Course Module
• Law Enforcement Requests and Actions

Section 314(b) of the USA PATRIOT Act allows financial institutions to share information with each other, under a safe harbor that offers protection from liability, in order to better identify and report potential money laundering or terrorist financing activities. The intended benefits of this information sharing include:

Participating financial institutions sharing information about suspicious activity by customers that may have otherwise gone unnoticed. For example, if a customer is conducting transactions with multiple financial institutions that individually do not appear suspicious, but collectively indicate a pattern of money laundering or terrorist financing, the financial institutions can share this information and report it to the authorities.

Detecting money laundering and terrorist financing approaches and schemes across multiple financial institutions. For example, if a financial institution identifies a new typology or modus operandi of money laundering or terrorist financing, it can share this information with other financial institutions to help them prevent or detect similar activities by their customers.

Obtaining additional information on customers or transactions regarding potential money laundering or terrorist financing. For example, if a financial institution has incomplete or insufficient information on a customer or a transaction that raises suspicion, it can request more information from another financial institution that may have dealt with the same customer or transaction.

References:

• Section 314(b) | FinCEN.gov
• Section 314(b) Fact Sheet - FinCEN.gov

The correct answer is C because reviewing the structure of the transactions to the three entities can help the investigator to identify any red flags or indicators of fraud, such as unusual amounts, frequency, destinations, or beneficiaries. The other options are not as relevant or effective in this scenario. Option A is not necessary because the investigator already knows the source of funds for the customer. Option B is not advisable because contacting the customer directly may alert them to the investigation and compromise its integrity. Option D is not helpful because inspecting electronic banking login records does not provide any information about the nature or purpose of the transactions.

References:

• Advanced CAMS-FCI Study Guide, page 281
• Financial Crime Typologies - Intermediate Certificate Course, Module 32

Weaker cybersecurity controls are a main vulnerability that has led to an increase in ransomware attacks on small businesses, as they make them easier targets for cybercriminals who can exploit their systems and demand payment for restoring access to their data. The other options are not relevant to the vulnerability, as they relate to the consequences or responses of the victims.

Chain hopping is a technique used by criminals to obscure the traceability of cryptocurrency transactions by converting the funds to a different type of cryptocurrency, often using multiple exchanges or platforms. The other options are not related to chain hopping. References: Advanced CAMS-FCI Study Guide, page 38.

The reason why it is important for the casino to maintain control of the output from the provider is that the casino maintains ultimate responsibility for this activity and should maintain control to avoid non-compliance ©. This is because the casino is accountable for its own AML/CFT obligations and cannot delegate or outsource them to a third-party provider. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should ensure that it has adequate oversight and control over any third-party providers that it engages for AML/CFT purposes, such as conducting due diligence, verifying information, or monitoring transactions” (p. 25). The FI should also “review and evaluate the performance and quality of the third-party providers on a regular basis, and address any issues or gaps that may arise” (p. 25).

The other options are not as relevant or accurate as option C. The clients of the casino prefer to know that the casino is keeping their information secure when being held by a third-party (A) is not a reason why the casino should maintain control of the output from the provider, but rather a customer expectation or preference. As with all third-party relationships, proper control must be maintained to ensure profitability (B) is not a reason why the casino should maintain control of the output from the provider, but rather a general business principle or objective. Other casinos are frequently looking to reduce costs and share ideas, so if this relationship is successful, the model can be used by other businesses (D) is not a reason why the casino should maintain control of the output from the provider, but rather a potential benefit or outcome.

The best step for the investigator to take next is to request information about the beneficiaries related to the company. This will help to identify the ultimate beneficial owners of the funds and the purpose of the transactions. Requesting information from the company or filing a SAR/STR to the FIU where the company is located may not be feasible or effective, as the company may not cooperate or the FIU may not have jurisdiction over the offshore entity. Conducting an open-source search may provide some information about the ownership and registration of the company, but it may not be sufficient or reliable to determine the nature and legitimacy of the transactions.

References:

• SAR Narrative Guidance Package
• Best Practices for Drafting an STR or SAR

According to the Certified Anti-Money Laundering Specialist (the 6th edition), the financial institution (Fl) should take the following actions:

A. Review the client's activity, determine if suspicious activity exists, and report accordingly. The Fl should assess the risk of the situation and determine if there is any suspicious activity that needs to be reported to the appropriate authorities. This would involve conducting a review of the client's account activity and transactions to determine if there are any indicators of money laundering or terrorist financing.

D. Inform local LEA and regulator of the request for awareness. The Fl should inform the local law enforcement agency and regulator of the request from the foreign jurisdiction to raise awareness of the situation and determine if any further actions need to be taken.

According to the Certified Anti-Money Laundering Specialist (CAMS) study guide, 6th edition, page 105, the correct answer is C. It can be difficult to determine if there is negative media associated with counterparties solely from the customer's account activity and KYC file.

The study guide explains that negative media can include news articles, government sanctions lists, and other sources of public information that may indicate that a counterparty is involved in illicit activities. However, this information may not be readily available in a customer's account activity or KYC file, and may require additional research or investigation.

The identification details of the beneficial owner and authorized signatory are key for law enforcement’s physical surveillance of cash activity, as they would help identify the person who controls and operates the company and who is responsible for its financial transactions. The company’s operating address is also key, as it would help locate the premises where the cash activity takes place and observe any suspicious movements or behaviors. The identification details of the nominee shareholder and directors are not relevant, as they are not involved in the management or operation of the company. The company’s registered address is also not relevant, as it is likely to be a shell or mailbox address that does not reflect the actual location of the business.

References: Advanced CAMS-FCI Study Guide, page 44-45; [FATF Guidance on Transparency and Beneficial Ownership], page 12-13.

The fact that should not be included in the SAR/STR narrative is the request by law enforcement (D). This is because the request by law enforcement is confidential and should not be disclosed to the customer or anyone else who is not authorized to know it. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should not include any reference to the LE request in the SAR/STR narrative, as this could compromise the LE investigation or alert the customer of the suspicion” (p. 35). The FI should also not inform the customer of the LE request or delay filing the SAR/STR because of it.

The other facts should be included in the SAR/STR narrative, as they are relevant and indicative of human trafficking money laundering. The air travel and hotel expenses (A) show that the customer is involved in moving people across different locations, which could be a sign of human smuggling or trafficking. The time of the cash deposits (B) shows that the customer is receiving cash payments during unusual hours, which could be a sign of illicit activities or services. The sporting event © shows that the customer is exploiting a high-demand situation for their business, which could be a sign of opportunistic or organized crime.

The main premise for filing a SAR/STR is that the entity is not implementing adequate internal controls according to what is expected, and mishandling of funds could be occurring. This raises suspicion that the entity may be involved in corruption, fraud, or diversion of funds for illicit purposes. Trust service providers are obliged by law to follow government internal controls, as they are subject to AML/CFT regulations and supervision. Cash disbursements are allowed for social welfare programs, but they should be properly documented and verified. Social welfare programs are not necessarily difficult to document, as there are ways to identify and monitor the beneficiaries, such as biometric data or unique identifiers.

The correct answer is A because a SAR/STR narrative should be concise, clear, and complete, addressing the who, what, when, where, why, and how of the suspicious activity. Option B is incorrect because providing too much information can make the narrative confusing and irrelevant. Option C is incorrect because the introduction should provide a summary of the suspicious activity, not the conclusion. Option D is incorrect because suspect names should be mentioned in the narrative to identify the parties involved in the suspicious activity.

References: Advanced CAMS-FCI Certification Handbook, page 17; Leading Complex Investigations Certificate, Module 3.

Financial institutions should perform the following actions to ensure proper data governance:

Establish an appropriate data management method for collecting and storing information. This is important to ensure that the data is consistent, reliable, and accessible for various purposes, such as risk assessment, compliance reporting, and customer service. Data management methods may include defining data standards, policies, and procedures; implementing data quality controls and validation checks; and using appropriate data storage systems and formats.

Ensure the accuracy of customer identification records and transaction records and appropriately manage data as a prerequisite for the effective use of IT systems. This is important to comply with the anti-money laundering and counter-terrorist financing (AML/CFT) requirements, such as customer due diligence, transaction monitoring, and suspicious activity reporting. Accurate and complete customer and transaction data also enables financial institutions to use IT systems more effectively for data analysis, risk management, and decision making.

Periodically validate integrity and accuracy of information used for IT systems such as customer information, customer identification records, and transaction records. This is important to ensure that the data remains up-to-date, relevant, and reliable over time. Data validation may include verifying the source and quality of the data; identifying and correcting any errors or inconsistencies; and updating or deleting any obsolete or redundant data.

References:

• Data Governance for Financial Institutions - Capgemini
• Small and Medium-Sized Deposit-Taking Institutions (SMSBs) Capital and Liquidity Requirements - OSFI

The OFAC sanctions screening audit program should include the requirement that all clients with foreign identification are subject to enhanced due diligence, as this provides an extra layer of protection against potential violations of OFAC sanctions.

The first valid step in the Mutual Legal Assistance Treaty (MLAT) international cooperation process is for the central authority of the requesting country to send a letter of request to the central authority of the other country. The letter of request should provide a summary of the facts and information required, the reasons for the request, and any specific legal or procedural requirements that need to be met. (CAMS Manual, 6th Edition, Page 233).

The investigator should document the investigation process and retain all relevant documents in the case management system. This is because documenting the investigation process is a good practice to ensure the quality and consistency of the investigation, as well as to facilitate the review and audit of the investigation. Retaining all relevant documents is also important to support the evidence and findings of the investigation, as well as to comply with the record-keeping requirements of the relevant authorities. The other options are incorrect because:

• A. Excluding any open-source information from record-keeping is not advisable, as open-source information can provide valuable insights and context for the investigation, and may not be easily retrievable in the future.
• B. Adding all of the information the FI has about the subject, their account(s) activity, research results, KYC information, etc. to the SAR/STR is not necessary, as the SAR/STR should only contain the essential information that is relevant and material to the suspicious activity. Adding too much information may obscure the main points and make the SAR/STR less effective.
• D. Not documenting the investigation process if a SAR/STR is not filed is not acceptable, as the investigation process should be documented regardless of the outcome. Documenting the investigation process can help justify why a SAR/STR was not filed, and also provide a reference for future investigations involving the same subject or activity.

References:

• Advanced CAMS-FCI Certification | ACAMS, Section 3: Reporting Suspicious Activity, page 14
• Leading Complex Investigations Certificate | ACAMS, Module 4: Documenting Your Investigation, page 4

The investigator should determine that a nephew of the general (Bank A’s customer) should be flagged as a senior PEP ©. This is because the nephew is related to a senior military official who is a customer of Bank A, which is a high-risk jurisdiction with strict capital controls. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should identify and flag any customers who are PEPs or have close associations with PEPs, such as family members or business partners” (p. 24). The FI should also conduct enhanced due diligence on these customers and monitor their transactions for any suspicious or unusual activity.

The other options are not correct. The investigator should not determine that a nephew of the general should be treated well to avoid reputational damage to the bank (A), as this could compromise the integrity and objectivity of the investigation, as well as expose the bank to legal or regulatory risks. The investigator should not determine that a nephew of the general is a high-net-worth individual (B), as this is not relevant or material to the investigation, as the nephew’s wealth does not affect his potential PEP status or risk level. The investigator should not determine that a nephew of the general is a trustworthy source (D), as this could be biased or inaccurate, as the nephew’s trustworthiness does not depend on his relation to the general or his involvement in the transaction.

References: 1: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, available at ACAMS

A product of analysis is a conclusion or inference that is derived from facts or judgments, using analytical techniques or tools. Option B is a product of analysis because it implies that the investigator has used a tool or technique, such as a threshold analysis, to identify a pattern of structured cash deposits that may indicate an attempt to evade reporting requirements. The other options are facts or judgments that can be verified by evidence or observation.

References: Advanced CAMS-FCI Certification Handbook, page 23.

This is stated in the Certified Anti-Money Laundering Specialist (the 6th edition) manual on page 595, which states: “Potential indicators of money laundering associated with Trust and Company Service Providers include the use of legal persons in jurisdictions with strict secrecy laws, structuring cash deposits into third party accounts, multi-jurisdictional wire transfers with no legal purpose, and frequent deposits to or withdrawals from bank accounts.”

The correct answer is D because it is a suspicious activity that Y, who is the authorized signatory of the customer, also signed on behalf of the lenders. This indicates a possible conflict of interest, collusion, or fraud. The other options are not suspicious activities based on the information given.

References: [Advanced CAMS-FCI Study Guide], page 17-18

The step that the investigator should take next is to flag the nephew as a PEP by association (D). This is because the nephew is related to a general who is a senior military official and a customer of Bank A, which is a high-risk jurisdiction with strict capital controls. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should identify and flag any customers who are PEPs or have close associations with PEPs, such as family members or business partners” (p. 24). The FI should also conduct enhanced due diligence on these customers and monitor their transactions for any suspicious or unusual activity.

The other options are not correct. The investigator should not file a SAR/STR in relation to corruption involving the nephew and the general (A), as this could be premature or unnecessary, as there is no evidence of corruption or criminal activity between them. The investigator should not determine whether there is a business relationship between the nephew and the general (B), as this is not relevant or material to the investigation, as the nephew and the general are customers of different banks and are not involved in the same transaction. The investigator should not seek senior management approval to continue the relationship with the nephew ©, as this could be premature or disproportionate, as there is no indication that the nephew poses a high risk or requires termination.

References: 1: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, available at ACAMS

The best next step in the investigation is to check the jurisdiction’s list of known charities with connections to terrorist activity ©. This is because the FI has a responsibility to verify the legitimacy and reputation of the beneficiary of the funds, especially if it is a charity or non-profit organization that operates in a high-risk jurisdiction or sector. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should conduct enhanced due diligence on all parties involved in the investigation, including checking various sources of information, such as watch lists, sanctions lists, negative news, and official registries” (p. 24). The FI should also check if the beneficiary is consistent with the customer’s profile and expected activity.

The other options are not as appropriate or effective as option C. Contacting the financial institution in Turkey that has a relationship with Forever Free and advising them of the investigation (A) could violate confidentiality or data protection laws, as well as compromise the investigation or alert the customer or beneficiary of the suspicion. Updating the customer profile to include Forever Free as the recipient of the funds (B) could be premature or inaccurate, as it does not verify the nature and purpose of the transfer or the identity and legitimacy of the beneficiary. Filing a SAR/STR with the new information learned about the beneficiary (D) could also be premature or incomplete, as it does not confirm if there is any suspicious or criminal activity involved in the transfer or if there are any other red flags or indicators.

The observations at the on-site visits that would justify writing a SAR/STR are signs of severe wear and poor maintenance at the site (A), lights turned off at the site during operational hours ©, and a full parking lot of cars with no staff at the site (F). These observations suggest that the daycare businesses are not operating legitimately or providing adequate services to their customers, and that they may be misusing governmental grants or laundering money through their accounts. These observations are consistent with some of the red flags for fraud identified by ACAMS2, such as:

• Inadequate facilities or equipment for the type of business
• Lack of visible activity or customers at the business location
• Discrepancy between reported income and expenses
• Unusual volume or frequency of transactions

The other observations are not as relevant or indicative of fraud as options A, C, and F. A site located in a commercial building (B) could be a normal or legitimate choice for a daycare business, depending on its size, location, and availability. Visible attendance with children being dropped off by parents (D) could show that the daycare business is providing genuine services to its customers, although it does not rule out possible fraud or money laundering. Visible signage indicating the purpose of building (E) could also show that the daycare business is transparent and legitimate, although it does not guarantee its quality or compliance.

References: 1: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, available at ACAMS 2: ACAMS Fraud Prevention eLearning Course Module 3: Fraud Detection Techniques

The FI is required to ensure that the request includes an end date © when it receives a keep open letter from LE for the identified account. This is because the FI has to balance its legal obligations to cooperate with LE and to protect its customers’ privacy and rights. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should request a written confirmation from LE that includes a specific end date for the request, as well as a point of contact for any questions or concerns” (p. 35). The FI should also document the request and its compliance with it, and continue to monitor the account for any suspicious activity.

The other options are not correct. The FI should not contact the client for information relating to the account (A), as this could compromise the LE investigation or alert the client of the suspicion. The FI should not stop filing SAR/STR reports on the account and/or customer (B), as this could violate its regulatory obligations and expose it to legal risks. The FI should not notify LE immediately after new transactions (D), as this could also interfere with the LE investigation or tip off the client. The FI should follow the instructions of LE regarding when and how to share information.