Free CAFCA sample questions

Correct answer: The customer's biometric facial scan data used for liveness detection.

Biometric data (facial scans, fingerprints) is classified as 'Special Category Data' or SPII under GDPR because it uniquely identifies a person based on physical characteristics and carries a higher risk if compromised. Address and email are standard PII.

Correct answer: To test innovative products in a controlled environment with regulatory supervision, allowing for the evaluation of risks and controls before a full-scale launch.

Regulatory sandboxes allow firms to test new technologies under regulator supervision with safeguards in place. It is not an exemption from compliance but a controlled testing ground to ensure the new method meets regulatory expectations before mass rollout.

Correct answer: We accept medium operational risks associated with innovative onboarding but have zero tolerance for willful sanctions violations or bribery.

A robust Risk Appetite Statement is nuanced. It acknowledges that 'zero risk' is impossible in operations (e.g., fraud attempts happen) but sets strict boundaries (zero tolerance) for legal/regulatory breaches like sanctions. It defines the level of risk the firm is willing to accept to achieve its goals.

Correct answer: False

False. 'De-risking' typically refers to financial institutions (banks) terminating or restricting business relationships with entire categories of clients (like FinTechs or MSBs) because the compliance cost or risk is perceived as too high, rather than managing the risk of individual clients.

Correct answers: Drug Trafficking; Bribery and Corruption

Drug trafficking is a classic predicate offense; the money generated is 'dirty' and needs laundering.

Bribery generates illicit proceeds, making it a predicate crime to money laundering.

Correct answer: Segregation of Duties (SoD) requiring dual authorization for outgoing payments.

Segregation of Duties (SoD) is the primary control for internal fraud. By ensuring no single employee can initiate and approve a transaction alone (dual authorization), the risk of insider theft is significantly reduced.