ABA AML and Fraud Professional (CAFP) Certification Sample Questions

02. While investigating a case, an analyst at a regional bank discovers that a transaction-monitoring scenario intended to detect this activity had been inadvertently deactivated during a system update, so similar activity across other accounts went unalerted.
Beyond resolving the individual case, what is the MOST appropriate remediation?
a) Refer the matter to internal audit to determine the required remediation.
b) Document only the individual case conclusion and take no further remediation action.
c) Lower alert thresholds bank-wide to compensate for the lost coverage.
d) Restore the scenario, review the inactive window, and strengthen change controls.

03. For the third consecutive testing cycle, a bank's independent testing reports the same unresolved deficiency in how the BSA/AML monitoring rules are validated. Each cycle, management has acknowledged the finding and promised remediation, but the deficiency persists. The matter is now before the board's designated committee.
Which governance response is MOST appropriate?
a) Treat the repeat finding as an escalated governance concern, require a time-bound remediation plan with accountable owners, and oversee it to completion.
b) Accept management's renewed verbal assurance and simply defer the unresolved finding again to the next scheduled testing cycle as before.
c) Direct the internal audit function to stop reporting the finding entirely until management has fully completed all of its remediation on its own preferred timeline.
d) Reclassify the persistent finding as immaterial because it has recurred without yet producing any formally confirmed regulatory violation.

04. Some time ago, an analyst at a large bank cleared an alert on a customer's cash activity as consistent with the customer's retail business. The same pattern has now recurred repeatedly and has grown inconsistent with the documented business volume, despite the earlier explanation.
How should the recurrence affect the disposition?
a) The activity should be cleared again automatically because it had been explained once before.
b) The earlier no-file conclusion is binding, so no new analysis is required.
c) The persistence and change in scale warrant a fresh analysis that may support a filing.
d) The account should be closed without any further review or documentation.

05. After documented investigation, a bank confirms that an incoming wire involves a party on the applicable sanctions list and blocks the funds. The operations team considers the sanctions obligation fully discharged once the funds are frozen.
Which statement about the institution's reporting obligation is correct?
a) Blocking the funds completes the obligation; no further report to the sanctions authority is required.
b) The institution must report the blocked transaction to the administering sanctions authority within the required timeframe.
c) The institution should notify the customer that the wire was blocked so the customer can contest the match.
d) A suspicious activity report to the financial-intelligence unit fully satisfies the sanctions-reporting requirement for the block.

06. Months ago, a cash-intensive business deposited a large volume of illicit currency into its accounts. Now an analyst observes those funds being routed through a chain of shell-company wire transfers, back-to-back loans between related entities, and repeated movements across multiple institutions, all of which serve mainly to obscure the money's origin.
Which stage of money laundering does this current activity best represent?
a) Placement, because currency is being introduced into the financial system.
b) Integration, because the funds are being spent on legitimate assets.
c) The predicate offense, because the underlying crime generated the funds.
d) Layering, because complex transfers obscure the funds' trail.

07. At a bank, frontline branch staff verify customer identity and screen activity at account opening as part of their daily operational duties.
Under the three-lines-of-defense model, which line owns this control activity?
a) The first line, the business unit that owns and executes the control in daily operations.
b) The second line, the independent compliance and risk function that provides oversight.
c) The third line, the internal audit function providing independent assurance over controls.
d) The board audit committee, acting as a governance body outside the three lines.

08. While the bank is gathering records to respond to a law-enforcement request about a customer, a branch manager who knows the customer socially wants to give the customer a discreet heads-up.
What is the controlling principle here?
a) The tipping-off rules apply only to the BSA officer, so an ordinary branch manager is free to speak with the customer directly.
b) The manager may inform the customer as a courtesy as long as no SAR has yet been filed on the activity.
c) The manager may tell the customer only the name of the requesting agency but disclose nothing further.
d) The manager must not disclose the existence of the request, or any related SAR or investigation, to the customer.

09. Two unaffiliated banks each suspect that a shared customer may be involved in the same suspicious activity, and one bank's BSA officer wants to share information with the other to investigate.
Under the voluntary institution-to-institution information-sharing framework, what is the PRIMARY governance precondition before the banks share such information?
a) A subpoena or binding court order that compels each participating bank to exchange the specific customer information involved here.
b) Each institution must have completed the required registration to use the voluntary sharing framework and share only for permitted purposes.
c) Written and signed consent from the shared customer that specifically authorizes the interbank exchange of their account information.
d) A firm determination that the underlying activity is already definitively criminal before any information may lawfully be exchanged between them.

10. During onboarding, a compliance analyst confirms that a prospective customer is an exact match to an individual on the OFAC SDN list. The analyst argues that because the bank uses a risk-based program and this customer is low-risk with a small anticipated balance, the match can be treated as immaterial.
Which statement BEST evaluates this reasoning?
a) It is flawed; strict-liability sanctions rules override the risk-based rationale.
b) It is sound, provided the analyst documents the low-risk rationale in the customer file.
c) It is sound, because a risk-based program permits proportionate responses to low-value relationships.
d) It is flawed only if the customer's balance later rises above a material threshold.