Free CAMS sample questions

Correct answer: Change procedures and systems as necessary and provide employee training

When a new law requires customer information, the institution must build the requirement into its compliance program: update its written procedures, change its systems so the data is captured and kept, and train the staff who must collect it. FATF's Interpretive Note to Recommendation 18 says AML/CFT programmes include internal policies, procedures and controls and an ongoing employee training programme, and the FFIEC manual expects internal controls to provide for timely updates in response to changes in regulations. Changing procedures alone or systems alone leaves part of the program out of step with the law, and sending a notice to customers does not by itself make the institution compliant, because staff and systems must still obtain, verify and record the information.

Correct answer: Validating the successful remediation of the issue once management indicates the issue is resolved

Internal audit is the independent third line of defence, so it does not design or run the fix. Management owns the remediation (directing it, writing new procedures and training staff), and the auditor then tests whether the corrective action works. The FFIEC BSA/AML Examination Manual says independent testing may be done more often to verify or validate mitigating or remedial actions, and that the persons doing the testing should not be involved in other BSA functions, such as training or developing policies and procedures, that could create a conflict of interest. Directing the remediation, developing alert-clearing procedures or delivering training would compromise the auditor's independence.

Correct answer: Using Black Market Peso Exchange

The Black Market Peso Exchange is a form of trade-based money laundering. A peso broker takes drug dollars in the United States, places them into bank accounts (often through structured deposits) and uses them to pay U.S. exporters for goods shipped to importers in Latin America; the importers pay the broker in local currency, which the broker passes to the cartel, so no cash crosses the border (FATF, Trade-Based Money Laundering: Trends and Developments, 2020). Forming shell companies, structuring and investing illicit funds in legitimate businesses also use deposit-taking institutions, but none of them is tied to international trade the way the peso exchange is.

Correct answers: The customer’s stated investment goal is not reflective of account activity; The compliance officer receives a law enforcement query regarding the movement of funds

Two facts call for action. First, the account activity contradicts the customer's stated purpose: an account opened for long-term investment is used for an immediate overseas wire, repeated currency purchases and full depletion within a month, and the FATF report on ML/TF in the securities sector (2009) treats activity inconsistent with the customer's stated investment objectives as a suspicious indicator. Second, the FFIEC manual says a law enforcement inquiry is relevant to the customer's risk assessment and should cause the firm to review the account activity, even though it does not by itself require a report. A large opening deposit and a corporate account with several beneficial owners are normal for institutional or wealthy clients and are not red flags on their own; they only call for the usual beneficial-ownership due diligence.

Two facts call for action. First, the account activity contradicts the customer's stated purpose: an account opened for long-term investment is used for an immediate overseas wire, repeated currency purchases and full depletion within a month, and the FATF report on ML/TF in the securities sector (2009) treats activity inconsistent with the customer's stated investment objectives as a suspicious indicator. Second, the FFIEC manual says a law enforcement inquiry is relevant to the customer's risk assessment and should cause the firm to review the account activity, even though it does not by itself require a report. A large opening deposit and a corporate account with several beneficial owners are normal for institutional or wealthy clients and are not red flags on their own; they only call for the usual beneficial-ownership due diligence.

Correct answer: Ensure non-profit organizations cannot be used to conceal or obscure the diversion of funds intended for legitimate purposes to terrorists’ organizations

FATF Recommendation 8 asks countries to apply focused, proportionate, risk-based measures to protect non-profit organisations from terrorist financing abuse, including abuse that conceals or obscures the clandestine diversion of funds intended for legitimate purposes to terrorist organisations, without unduly disrupting legitimate NPO activity. FATF does not ask countries to make NPOs register with the FIU, to ban their cross-border transactions, or to freeze NPO assets in general. Asset freezing applies to designated persons and entities under Recommendation 6, and Recommendation 8 instead warns against NPOs being exploited to escape asset-freezing measures.

Correct answer: Report the conversation to the compliance officer

Advising a customer on how to avoid a suspicious transaction report is a serious warning sign about the colleague and must be escalated internally to the compliance (AML) officer, who decides whether to investigate and report. FFIEC Appendix F lists attempts to persuade staff not to file required reports, and employees who fail to follow policies and procedures, as red flags. Going straight to the local police bypasses the institution's reporting chain (any external report goes to the FIU through the compliance function), confronting the colleague could alert them and the customer, and ignoring it because the colleague is the relationship manager defeats the purpose of internal controls.

Correct answers: The name and address of a U.S. person who is authorized to receive service of legal process for the bank; The name and address of all beneficial owners who own 25% or more of the bank

Under sections 313 and 319(b) of the USA PATRIOT Act (31 CFR 1010.630), a U.S. institution that keeps a correspondent account for a foreign bank must keep records identifying the owners of the foreign bank (unless its shares are publicly traded) and the name and street address of a person in the United States who is authorised to accept service of legal process for records about the account; it usually obtains these through the foreign bank's certification, renewed at least every three years. An owner here is a person who owns, controls or can vote 25 percent or more of a class of voting securities (31 CFR 1010.605(j)). The foreign bank certifies that it is not a shell bank and does not serve shell banks; it does not list shell banks it serves, because that is prohibited. The rule does not require the foreign bank to give prompt notice of suspicious activity by its customers.

Under sections 313 and 319(b) of the USA PATRIOT Act (31 CFR 1010.630), a U.S. institution that keeps a correspondent account for a foreign bank must keep records identifying the owners of the foreign bank (unless its shares are publicly traded) and the name and street address of a person in the United States who is authorised to accept service of legal process for records about the account; it usually obtains these through the foreign bank's certification, renewed at least every three years. An owner here is a person who owns, controls or can vote 25 percent or more of a class of voting securities (31 CFR 1010.605(j)). The foreign bank certifies that it is not a shell bank and does not serve shell banks; it does not list shell banks it serves, because that is prohibited. The rule does not require the foreign bank to give prompt notice of suspicious activity by its customers.

Correct answers: Charges of deceptive business practices; Imposition of regulatory sanctions

Legal risk comes from breaking laws and regulations. Inadequate privacy policies can lead to regulatory sanctions under data-protection law (for example, administrative fines under Article 83 of the EU GDPR), and in the United States the Federal Trade Commission takes action against companies that do not keep their privacy promises, charging them under Section 5 of the FTC Act, which bars unfair and deceptive acts and practices. Diminished reputation and higher marketing or public relations costs are real consequences, but they are reputational and financial risks, not legal ones; the Basel Committee's paper on the compliance function lists legal or regulatory sanctions separately from financial loss and loss to reputation.

Legal risk comes from breaking laws and regulations. Inadequate privacy policies can lead to regulatory sanctions under data-protection law (for example, administrative fines under Article 83 of the EU GDPR), and in the United States the Federal Trade Commission takes action against companies that do not keep their privacy promises, charging them under Section 5 of the FTC Act, which bars unfair and deceptive acts and practices. Diminished reputation and higher marketing or public relations costs are real consequences, but they are reputational and financial risks, not legal ones; the Basel Committee's paper on the compliance function lists legal or regulatory sanctions separately from financial loss and loss to reputation.

Correct answers: Information relating to the foreign bank’s anti-money laundering program; The identity of each owner of 10% or more of the foreign bank, unless its shares are publicly traded

Section 312 of the USA PATRIOT Act (31 CFR 1010.610) requires enhanced due diligence for correspondent accounts of foreign banks that operate under an offshore banking license. The U.S. bank must obtain and consider information about the foreign bank's anti-money laundering program and, if the foreign bank's shares are not publicly traded, identify each owner holding 10 percent or more and the nature and extent of that ownership; it must also monitor the account and find out whether the foreign bank provides correspondent services to other foreign banks. The rule does not require a list of all the foreign bank's customers (only, for payable-through accounts, the persons who can direct transactions through them), and it does not require the foreign regulator to approve the account.

Section 312 of the USA PATRIOT Act (31 CFR 1010.610) requires enhanced due diligence for correspondent accounts of foreign banks that operate under an offshore banking license. The U.S. bank must obtain and consider information about the foreign bank's anti-money laundering program and, if the foreign bank's shares are not publicly traded, identify each owner holding 10 percent or more and the nature and extent of that ownership; it must also monitor the account and find out whether the foreign bank provides correspondent services to other foreign banks. The rule does not require a list of all the foreign bank's customers (only, for payable-through accounts, the persons who can direct transactions through them), and it does not require the foreign regulator to approve the account.

Correct answer: Using illicit funds that had previously been deposited to purchase a luxury vehicle

Integration is the final stage, when laundered funds that are already in the financial system and insulated by layering are used in transactions that make them look legitimate, such as buying assets. The FFIEC manual gives the purchase and resale of real estate, securities and other assets as integration examples, so using previously deposited funds to buy a luxury vehicle is integration. Depositing illicit funds into a front company's account and having third parties exchange illicit cash for negotiable instruments are placement, which brings the cash into the system, and wiring funds from one bank to another is layering, which complicates the paper trail.