CAMS-FCI Advanced CAMS-Financial Crimes Investigations Question and Answers

According to U.S. law, money mules can be prosecuted even if they were unaware that money was transferred, as long as they acted with reckless disregard of the source of the funds or the purpose of the transaction1. This is because money mules are considered to be aiding and abetting money laundering, which does not require proof of specific intent2.

References: 1: Money Mule Awareness Booklet, page 8 2: Money Laundering: An Overview of 18 U.S.C. § 1956 and Related Federal Criminal Law, page 7

The activity type that the FI should target for creating an automated alert for human trafficking money laundering is multiple deposits between midnight and 4:00 AM (B). This is because this pattern is consistent with the indicators of human trafficking identified by the Financial Action Task Force (FATF) and the Egmont Group1, which include:

• Frequent cash deposits, often in round amounts, outside of normal business hours
• Deposits made at different branches or ATMs in various locations
• Lack of information about the nature and purpose of the business
• Involvement in online platforms that advertise sexual services
• Expenses related to travel and accommodation
• The other options are not as relevant or specific as option B. Payments made to multiple hotels in the same city (A) could be a legitimate business expense or a sign of other types of money laundering, such as tax evasion or fraud. Deposits made within days of major sporting events © could also be explained by other factors, such as increased tourism or gambling. Payments made for virtual currency (D) are not directly related to human trafficking, although they could be used to facilitate money laundering in general.

References: 1: FATF and Egmont Group, Financial Flows from Human Trafficking, July 2018, available at FATF

The additional information that would trigger filing a SAR/STR is the fact that the funds for the seed capital were in the form of 50 cashier’s checks of 10,000 GBP each and 50 money orders of 10,000 GBP. This is because this indicates a possible attempt to avoid the reporting threshold of 10,000 GBP for cash transactions, which is a common money laundering technique known as structuring or smurfing12. The other options are not necessarily suspicious, as they do not involve cash transactions or indicate any illicit source of funds. The fact that the client’s spouse was a PEP does not automatically make the transaction suspicious unless there are other red flags or risk factors associated with the PEP34

References: 1: Money Laundering Techniques 2: Structuring 3: Politically exposed person 4: PEP Definition & Meaning - Merriam-Webster

According to the Certified Anti-Money Laundering Specialist (CAMS) Manual , 6th edition, if a bank's transaction surveillance system triggers an alert for a deposit of 250.000 USD into a client's account, the bank should take the following actions:

• Request information and documentation from the client on the background of the transaction (CAMS Manual, 6th edition, page 46).
• Contact the client advisor to learn if he has any insight on the transaction background (CAMS Manual, 6th edition, page 47).
• Review the transaction background in the bank's transaction platform (CAMS Manual, 6th edition, page 47).

Discarding the alert as a false positive hit and reviewing the alert if the deposit is made in cash should not be done.

The bank should request additional information and documentation from the client to better understand the nature of the transaction. Additionally, the bank should reach out to the client advisor to learn if they have any insight on the transaction background. Finally, the bank should review the transaction background in the bank's transaction platform to determine if any additional alerts or anomalies are present. (CAMS Manual, 6th Edition, Pages 117-118)

According to the FinCEN’s 314(a) Fact Sheet1, the steps that the investigator should take when fulfilling the request are:

• Search its records expeditiously to determine whether it maintains(ed) any accounts for the subject(s) listed in the request. This is option F.
• Report back to the Financial Crimes Enforcement Network (FinCEN) within 15 days of receipt of the request via a secure internet website. This is option E.
• Report to Financial Crimes Enforcement Network (FinCEN) that a match was found without revealing any other details. This is option D.

The other options are incorrect because:

• Exiting the relationship with the business since it appears that customer is under investigation is not required by the 314(a) program and may interfere with law enforcement’s investigation. This is option A.
• Not responding to Financial Crimes Enforcement Network (FinCEN) if the requested information is not present in the financial institution’s system of records is contrary to the 314(a) program, which requires financial institutions to respond whether or not they have a match. This is option B.
• Reviewing the account(s) activity and proactively filing a SAR/STR using the 314(a) request as the basis for the filing is not appropriate, as the 314(a) request itself is not a sufficient reason to file a SAR/STR. The financial institution should only file a SAR/STR if it has its own independent suspicion of money laundering or terrorist financing. This is option C.

References: 1: FinCEN’s 314(a) Fact Sheet

Chain hopping is a technique used by criminals to obscure the traceability of cryptocurrency transactions by converting the funds to a different type of cryptocurrency, often using multiple exchanges or platforms. The other options are not related to chain hopping. References: Advanced CAMS-FCI Study Guide, page 38.

According to the Certified Anti-Money Laundering Specialist (CAMS) study guide, 6th edition, page 105, the correct answer is C. It can be difficult to determine if there is negative media associated with counterparties solely from the customer's account activity and KYC file.

The study guide explains that negative media can include news articles, government sanctions lists, and other sources of public information that may indicate that a counterparty is involved in illicit activities. However, this information may not be readily available in a customer's account activity or KYC file, and may require additional research or investigation.

The most concerning trading pattern for a compliance officer when a new customer has been onboarded in a securities firm is the customer accumulating securities of a low volume counter in small increments on a weekly basis. This type of behavior could indicate that the customer is attempting to obscure their identity or the true purpose of their trading activity, which can be indicative of money laundering or other suspicious activity. (CAMS Manual, 6th Edition, Page 170).

The fact that should not be included in the SAR/STR narrative is the request by law enforcement (D). This is because the request by law enforcement is confidential and should not be disclosed to the customer or anyone else who is not authorized to know it. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should not include any reference to the LE request in the SAR/STR narrative, as this could compromise the LE investigation or alert the customer of the suspicion” (p. 35). The FI should also not inform the customer of the LE request or delay filing the SAR/STR because of it.

The other facts should be included in the SAR/STR narrative, as they are relevant and indicative of human trafficking money laundering. The air travel and hotel expenses (A) show that the customer is involved in moving people across different locations, which could be a sign of human smuggling or trafficking. The time of the cash deposits (B) shows that the customer is receiving cash payments during unusual hours, which could be a sign of illicit activities or services. The sporting event © shows that the customer is exploiting a high-demand situation for their business, which could be a sign of opportunistic or organized crime.

Deposit trading is a pattern of suspicious activity where a client deposits large amounts of money into an account, and then transfers the funds to other accounts, often in different jurisdictions or countries. This could be an attempt to disguise the source or destination of the funds, or to avoid reporting requirements. Deposit trading is also known as layering, which is the second stage of money laundering.

References: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, page 43; ACAMS Glossary, page 34.

The correct answer is A and C because these indicators suggest that the customer is using fraudulent documents and misrepresenting the goods to conceal the illicit nature of the transactions. Fentanyl traffickers often use front companies and falsified invoices to disguise their shipments as legitimate products, such as medical supplies or chemicals. Reviewing the invoices and transportation documents, as well as the FDA product certifications, can help to identify discrepancies or anomalies that indicate fraud or deception.

References: Fentanyl and Fentanyl Analogues: Federal Trends and Trafficking Patterns, page 18; Fentanyl Trafficking Offenses, page 2.

The investigator should review how the wire transfers were initiated first, because this could indicate the level of involvement and knowledge of the LLC account holders. If the wire transfers were initiated online or by phone, it could suggest that the account holders were trying to avoid face-to-face contact with the bank staff and reduce the chances of being questioned or identified. If the wire transfers were initiated in person at a branch, it could indicate that the account holders were confident or careless about their activities, or that they had some relationship with the bank staff. The method of initiation could also affect the quality and quantity of information collected by the bank about the wire transfers, such as the purpose, source, and destination of the funds. References: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, page 65.

The correct answer is D because it is a suspicious activity that Y, who is the authorized signatory of the customer, also signed on behalf of the lenders. This indicates a possible conflict of interest, collusion, or fraud. The other options are not suspicious activities based on the information given.

References: [Advanced CAMS-FCI Study Guide], page 17-18

The most likely reason for conducting a reverse transaction is to conceal or launder illicit funds. A reverse transaction is a transaction that reverses a previous transaction, such as a refund, a chargeback, or a cancellation. Reverse transactions can be used by money launderers to obscure the source, ownership, or destination of funds, or to create false records or invoices. For example, a money launderer may initiate a wire transfer from a high-risk jurisdiction to a low-risk jurisdiction, and then reverse the transaction after receiving confirmation of the funds. This way, the money launderer can create a paper trail that shows legitimate funds coming from a low-risk jurisdiction, while hiding the true origin of the funds.

References: Advanced CAMS-FCI Study Guide, page 40-41.

Compare customer and transaction records against periodically updated sanctions lists provided by governmental bodies. This is stated in the Certified Anti-Money Laundering Specialist (the 6th edition) manual on page 595, which states: “Sanctions screening requirements include that a financial institution should compare customer and transaction records against periodically updated sanctions lists provided by governmental bodies.”

The parties that should be trained on emerging trends and red flags are the financial crimes investigation unit (A) and the branch personnel ©. These parties are directly involved in detecting, investigating, and reporting suspicious activity related to check cashing or other types of fraud or money laundering. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should provide regular and relevant training to its staff on the AML program, policies, procedures, and systems, as well as on the latest typologies, indicators, and best practices for financial crimes investigations” (p. 36). The FI should also “ensure that the training is tailored to the specific roles and responsibilities of the staff, and that it is updated and evaluated periodically” (p. 36).

The other parties are not as relevant or appropriate as options A and C. The loan department (B) is not directly related to check cashing or other types of fraud or money laundering, although it may have some exposure to credit or identity fraud. The senior management (D) is responsible for overseeing and supporting the AML program, but not for conducting or supervising financial crimes investigations. The board of directors (E) is responsible for approving and reviewing the AML program, but not for implementing or monitoring it.

References: 1: ACAMS Advanced Financial Crimes Investigations Certification Study Guide, available at ACAMS

The best information to share at the very beginning of a well-written SAR/STR narrative is the purpose of the SAR/STR narrative and a general description of the known or alleged violation. This is because this information provides an overview of why the SAR/STR is being filed and what type of suspicious activity or transaction is involved. It also helps to capture the attention of the reader and set the tone for the rest of the narrative.

References: Reporting Suspicious Activity Certificate, Module 4, page 7.

The Asian/Pacific Financial Action Task Force-Style Regional Body (APG) helps its members implement recommendations from the FATF by facilitating the adoption and implementation of internationally accepted AML measures by member jurisdictions (CAMS Manual, 6th Edition, Page 22). The APG also encourages cooperative AML efforts in the region, which can include information-sharing and mutual evaluations to assess member compliance with FATF recommendations (CAMS Manual, 6th Edition, Page 25). Therefore, options C and D are the correct answers.

The primary purposes of Financial Action Task Force (FATF)-Style Regional Bodies are to promote effective implementation of FATF recommendations and to provide expertise and input in FATF policy-making. (CAMS Manual, 6th Edition, Page 180)

According to the CAMS study guide, the Financial Action Task Force (FATF) Regional Style Bodies are organizations created by the FATF to promote the implementation of anti-money laundering and countering the financing of terrorism (AML/CFT) measures in specific regions. One of the key characteristics of these bodies is the implementation of regional mutual evaluation procedures.

Regional mutual evaluations involve member countries evaluating each other's AML/CFT regimes to identify strengths and weaknesses and to develop best practices for improvement. This process allows for greater cooperation between countries and can help to identify and address regional AML/CFT risks more effectively. It also promotes consistency in AML/CFT standards and practices within the region.

One of the actions that is part of the enhanced due diligence process is collecting beneficial ownership details regarding the client’s account. This is important to identify the natural persons who ultimately own or control the client, and to assess the potential risks associated with them. According to the Financial Action Task Force (FATF), beneficial ownership information should include1:

• The name, nationality, and country of residence of each beneficial owner.
• The date of birth or incorporation of each beneficial owner.
• The nature and extent of the beneficial interest held by each beneficial owner.
• The means by which the beneficial ownership or control is exercised.

References:

FATF Guidance on Transparency and Beneficial Ownership

The best reason the EU bank should file a SAR/STR is that the events raise concerns that the payment represents proceeds from insider trading, which is a form of market abuse and a predicate offense for money laundering in many jurisdictions. The fact that the originator was indicted by U.S. law enforcement, arrested in Switzerland, and extradited for alleged insider trading indicates that there is a strong suspicion that the funds are derived from criminal activity. The other options are not sufficient reasons to file a SAR/STR, as they do not directly relate to the nature or source of the funds.

References: [Financial Action Task Force Report on Money Laundering and Terrorist Financing Risks and Vulnerabilities Associated with Gold], page 17 : [Leading Complex Investigations Certificate], page 12

When writing or reviewing a SAR/STR, it is important to ensure that the narrative is kept to the point; easy to read; and addresses the who, what, when, where, why, and how. This is because the narrative is the most crucial part of the SAR/STR, as it provides a clear and concise summary of the suspicious activity or transaction that triggered the report. The narrative should include all the relevant information that would help law enforcement or regulators to understand the nature and context of the activity or transaction, such as123:

• The who: The names, addresses, account numbers, and other identifying information of the parties involved in the activity or transaction, such as customers, beneficiaries, intermediaries, or third parties.
• The what: The type, amount, frequency, and purpose of the activity or transaction, such as cash deposits, wire transfers, check payments, or purchases of goods or services.
• The when: The date, time, and duration of the activity or transaction, and whether it was a one-time occurrence or part of a pattern or trend.
• The where: The location or channel of the activity or transaction, such as branches, ATMs, online platforms, or mobile applications.
• The why: The reason or rationale for the activity or transaction, and why it was considered suspicious or unusual based on the customer’s profile, behavior, or expected activity.
• The how: The method or mechanism of the activity or transaction, such as cash, check, debit card, credit card, cryptocurrency, or prepaid card.

References:

• How to write the perfect “Suspicious Activity Reports” (SAR)? | i-AML
• Writing for Prosecution: Best Practices For Composing SAR Narratives That Assist Prosecutors | ACAMS
• SAR Writing Examples and Proper Formatting: Write for Your Reader - Alessa

The total suspicious transaction amount that the investigator should report is 659,000,000 USD. This is the sum of the two transactions involving the LLC and the state-run oil company, which are 59,000,000 USD and 600,000,000 USD respectively. The other transactions that the LLC made to other accounts, a money brokerage firm, and real estate purchases are not relevant to the question, as they are not part of the series of transactions that triggered the alert.

References: Advanced CAMS-FCI Certification | ACAMS

The main premise for filing a SAR/STR is that the entity is not implementing adequate internal controls according to what is expected, and mishandling of funds could be occurring. This raises suspicion that the entity may be involved in corruption, fraud, or diversion of funds for illicit purposes. Trust service providers are obliged by law to follow government internal controls, as they are subject to AML/CFT regulations and supervision. Cash disbursements are allowed for social welfare programs, but they should be properly documented and verified. Social welfare programs are not necessarily difficult to document, as there are ways to identify and monitor the beneficiaries, such as biometric data or unique identifiers.

The reason why it is important for the casino to maintain control of the output from the provider is that the casino maintains ultimate responsibility for this activity and should maintain control to avoid non-compliance ©. This is because the casino is accountable for its own AML/CFT obligations and cannot delegate or outsource them to a third-party provider. According to the ACAMS Advanced Financial Crimes Investigations Certification Study Guide1, “the FI should ensure that it has adequate oversight and control over any third-party providers that it engages for AML/CFT purposes, such as conducting due diligence, verifying information, or monitoring transactions” (p. 25). The FI should also “review and evaluate the performance and quality of the third-party providers on a regular basis, and address any issues or gaps that may arise” (p. 25).

The other options are not as relevant or accurate as option C. The clients of the casino prefer to know that the casino is keeping their information secure when being held by a third-party (A) is not a reason why the casino should maintain control of the output from the provider, but rather a customer expectation or preference. As with all third-party relationships, proper control must be maintained to ensure profitability (B) is not a reason why the casino should maintain control of the output from the provider, but rather a general business principle or objective. Other casinos are frequently looking to reduce costs and share ideas, so if this relationship is successful, the model can be used by other businesses (D) is not a reason why the casino should maintain control of the output from the provider, but rather a potential benefit or outcome.

The request for information should include the following elements:

• Details of DEF Oil Resource Ltd parent company and the name(s) of the beneficial owner(s) (Option A): This is necessary to verify the identity and ownership structure of the remitter and to assess the risk level of the customer and the transaction.
• The account profile of the customer and their KYC data (Option C): This is necessary to understand the nature and purpose of the customer’s business relationship with the respondent bank and to compare it with the observed transactional activity.
• The contract pertaining to the purchase of property in another country (Option E): This is necessary to verify the legitimacy and source of funds for the transaction and to identify the ultimate beneficiary of funds.

The other options are not relevant or necessary for the request for information. The full transaction history of the correspondent bank’s customer (Option B) is too broad and may not be related to suspicious activity. The respondent bank’s customer’s senior management bonus plan (Option D) is not relevant to the transaction and may not be available to the respondent bank. The last 6 months of transactional history (Option F) is also too broad and may not be related to the suspicious activity.

References:

Advanced CAMS-FCI Certification Handbook, page 19