CAMS-RM Practice Questions

Section 326 of the USA PATRIOT Act mandates the creation of a Customer Identification Program (CIP). A key component of the CIP rule is recordkeeping. Financial institutions are explicitly required to maintain a record of all identifying information obtained from the customer. This information must be retained for a period of five years after the date the account is closed. For credit card accounts, the retention period is five years after the account becomes dormant. This ensures that law enforcement has access to critical identifying information for an appropriate period during investigations.

A. Section 326 pertains to recordkeeping requirements for customer identification, not the mandatory suspension of accounts.

B. The trigger for the five-year retention period is the closure of the account, not simply when identifying information is collected for recordkeeping.

D. This is incorrect; Section 326 of the USA PATRIOT Act imposes a legal requirement to retain information, which supersedes general data privacy preferences in this context.

1. 31 C.F.R. § 1020.220(a)(3)(ii). "Record retention. The bank must retain the information in paragraph (a)(3)(i)(A) of this section for a period of five years after the date the account is closed..."

2. ACAMS CAMS6 - Certified Anti-Money Laundering Specialist Study Guide, 6th Edition, (2020). Chapter 5, "Compliance Standards for Anti-Money Laundering and Combating the Financing of Terrorism," pp. 178-179. The guide details the requirements of Section 326, including the five-year record retention rule after account closure.

3. Financial Crimes Enforcement Network (FinCEN). (2003). Final Rule: Customer Identification Programs for Banks, Savings Associations, Credit Unions, and Non-Federally Regulated Private Banks. This document establishes the final regulations for Section 326, specifying the recordkeeping requirements.

Section 352 of the USA PATRIOT Act requires U.S. financial institutions to establish an anti-money laundering (AML) program that includes, at a minimum, four key pillars. These pillars are foundational to modern AML compliance frameworks. Option D, "The development of internal policies, procedures, and controls," is a direct and accurate statement of the first of these four pillars. These controls are the documented rules and processes that guide an institution's AML efforts.

A. Talent and performance management is a human resources function, not one of the four legally mandated AML pillars.

B. The audit function must be independent to ensure objective assessment of the AML program; a "dependent" function would be a violation.

C. Risk metrics and thresholds are a component of internal controls but are not considered a standalone pillar of the program.

1. ACAMS. (2022). Certified Anti-Money Laundering Specialist (CAMS) Study Guide. Chapter 1: Money Laundering Risks and Methods. The guide explicitly lists the four pillars required by the USA PATRIOT Act.

2. USA PATRIOT Act of 2001, Pub. L. 107-56, Title III, Section 352. This section amends the Bank Secrecy Act (31 U.S.C. 5318(h)(1)) to mandate AML programs that include "(A) the development of internal policies, procedures, and controls; (B) the designation of a compliance officer; (C) an ongoing employee training program; and (D) an independent audit function to test programs."

3. Financial Crimes Enforcement Network (FinCEN). (2020). FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual. Section: "AML Compliance Program Structure." This manual details the required four pillars for an adequate BSA/AML compliance program.

Effective model risk management requires robust governance and oversight, which is achieved through clear and consistent reporting to key stakeholders. Periodic reports on the status of model risk management are provided to those with ultimate responsibility for the institution's risk profile and control environment. This includes the risk management committee for functional oversight, the board of directors for ultimate accountability, senior management for strategic direction, and the audit committee for independent review and assurance. This comprehensive reporting structure ensures that model risk is understood and managed at all senior levels of the organization.

B. "Administrators" is a vague term for operational staff who are not the primary audience for high-level governance reports on risk status.

C. This list is incomplete as it omits the board of directors and the audit committee, both of which are critical governance bodies.

D. This list is too narrow, excluding the board of directors and senior management, who are essential recipients of risk management reporting.

1. ACAMS CAMS-RM Study Guide (2023). Chapter 3, "Model Risk Governance," Section: "Reporting," pp. 3-17 to 3-18. (Specifies that reports are provided to the board, senior management, and relevant committees like the risk and audit committees).

2. Basel Committee on Banking Supervision (BCBS). (2011, June). Principles for the Sound Management of Operational Risk. Principle 3, p. 11. (While focused on operational risk, it establishes the principle of reporting to the board, senior management, and relevant committees).

Transaction monitoring involves analyzing customer activity to detect unusual or suspicious patterns. A key component of managing this process is measuring its effectiveness and efficiency through Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs). The "number of alerts raised to a case analyzed by a front line unit" is a critical metric. It helps assess the quality of alerts generated by the system (i.e., the false positive rate) and the initial triage process, which are core parts of the monitoring function.

A. This is a performance metric (KPI) for a specific team's efficiency, which is an outcome of monitoring, but not part of the monitoring activity itself.

B. A backlog of customer data is an operational problem or a data management issue, not a metric or activity included within the monitoring process.

D. Alerts from a lookback are part of a specific, retrospective project to review historical activity, not part of routine, ongoing transaction monitoring.

1. ACAMS. (2024). CAMS-RM Study Guide. Chapter 4: Controls. The section on Transaction Monitoring discusses the importance of metrics and management information (MI) to oversee the health and effectiveness of the monitoring program, including alert-to-case conversion rates.

2. Wolfsberg Group. (2009). Wolfsberg Guidance on a Risk Based Approach for Managing Money Laundering Risks. This guidance emphasizes the need for ongoing monitoring and using management information to assess the effectiveness of the AML program, which includes analyzing alert volumes and outcomes. (Section: "Monitoring and Management Information," p. 10).

FATF Recommendation 24 specifically addresses the responsibilities of countries (jurisdictions) regarding the transparency and beneficial ownership of legal persons. The core mandate is for countries to implement measures that prevent the misuse of corporate vehicles like companies and trusts for money laundering or terrorist financing. This includes ensuring that accurate and current information on the ultimate beneficial owners (UBOs) is available and can be accessed efficiently by competent authorities, such as law enforcement and financial intelligence units.

A. This is an observation about the difficulty of implementation, not the content of the recommendation itself.

B. This is also an observation and incorrectly focuses on financial institutions' challenges rather than the country-level obligation outlined in Recommendation 24.

D. This incorrectly assigns the primary responsibility of Recommendation 24 to financial institutions; their CDD obligations regarding UBO are covered under Recommendation 10.

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Recommendation 24, p. 21. The text explicitly states, "Countries should take measures to prevent the misuse of legal persons..."

2. ACAMS. (2023). Certified Anti-Money Laundering Specialist - Risk Management (CAMS-RM) Study Guide. Chapter 1: Regulatory Frameworks and International Standards. The guide discusses the FATF Recommendations, clarifying that Recommendation 24 places obligations on countries to ensure UBO transparency.

A policy is a foundational document within a risk governance framework. It is a high-level statement that articulates the institution's intent and principles regarding a specific risk area. It defines the scope, sets boundaries, and aligns with the institution's overall risk appetite statement. Policies provide the "why" and "what" for the risk management program, serving as the basis from which more detailed procedures and controls are developed.

A. This describes procedures or standards, which are the detailed instructions for implementing a policy, not the definition of the policy itself.

C. This describes the responsibilities of a policy owner. Furthermore, a key responsibility is ensuring the policy is updated to reflect changes in regulations, not that it remains unchanged.

D. This option is incorrect because options A and C are flawed descriptions of a policy.

1. ACAMS. (2024). CAMS-RM Study Guide. Chapter 2: Governance. This section defines the hierarchy of governance documents, distinguishing between high-level policies, more detailed standards, and specific operational procedures.

2. The Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. This framework discusses the importance of establishing policies as part of the governance and culture component to communicate the organization's standards.

The Federal Deposit Insurance Corporation (FDIC) issued Financial Institution Letter (FIL) 22-2017 to provide supervisory guidance on model risk management. The document explicitly addresses its applicability to smaller institutions by setting an asset-based threshold. It states that the guidance is generally not expected to apply to FDIC-supervised institutions with under $1 billion in total assets. However, it includes a crucial exception: the guidance would still pertain to such an institution if its use of models is significant, complex, or poses an elevated risk.

A. This option is incorrect; the asset threshold mentioned in the official guidance is $1 billion, not $3 billion.

C. While periodic review and tuning of typologies is a best practice in model risk management, it is not the specific implication of FIL 22-2017 regarding its scope.

D. This is a general definition related to model risk management, not the specific guidance on applicability provided in FIL 22-2017.

1. Federal Deposit Insurance Corporation (FDIC). (2017, June 7). FIL-22-2017: Supervisory Guidance on Model Risk Management. Introduction, p. 1. Retrieved from https://www.fdic.gov/news/financial-institution-letters/2017/fil17022.html. (The document states, "It is not expected that this guidance will pertain to FDIC-supervised institutions with under $1 billion in total assets unless the institution's model use is significant, complex, or poses an elevated risk to the institution.").

A Sanctions Screening Committee is a governance body responsible for the oversight of the sanctions compliance program. Its primary functions include reviewing and approving the program's framework, policies, and risk appetite. A key part of this oversight is managing and reviewing the effectiveness of the screening process through key performance indicators (KPIs) and metrics. This ensures the program is operating as intended and meeting regulatory expectations. The committee provides strategic direction rather than performing day-to-day operational tasks.

B. Unfreezing accounts is an operational decision executed by a specific team after investigation, not the primary role of an oversight committee.

C. Reporting is done to regulatory bodies or senior management, not vaguely defined "contractor agencies," which is an inaccurate term in this context.

D. This is too narrow; the committee oversees all sanctions screening metrics, not just those related to positive (adverse) media.

1. ACAMS. (2023). CAMS-RM Study Guide. Chapter 3: Governance and Leadership. The guide discusses the role of board and senior management committees in overseeing the risk management framework, which includes setting risk appetite and monitoring program effectiveness through metrics.

2. The Wolfsberg Group. (2019). Guidance on Sanctions Screening. Section 3.2: Governance and Oversight. This document emphasizes the need for "appropriate governance and oversight," which includes "management information (MI) and metrics to monitor the effectiveness of the screening programme."

A feedback loop is a control mechanism where the results of an action or process are used to modify that same action or process in the future. In the context of a KYC committee, information and trends observed about different customer types (e.g., higher-than-expected risk in a certain segment) are fed back into the system. The committee uses this information to refine risk ratings, update KYC policies, and enhance controls. This continuous cycle of review and adjustment is a classic example of a feedback loop designed to improve the effectiveness of the AML/CFT program.

B. Strategic planning is a high-level, forward-looking process for setting long-term organizational goals, not a routine information-sharing mechanism.

C. The "Five-Step approach" is a generic term and not a specific, recognized process for KYC committee information flow.

D. A lookback process is a specific, often regulatory-mandated, forensic review of past activity, not a routine mechanism for program improvement.

1. ACAMS. (2023). CAMS Risk Management (CAMS-RM) Study Guide. Chapter 4: Risk Mitigation and Control, Section: "Ongoing Monitoring and Review," p. 4-18. This section describes the cyclical nature of monitoring, reporting, and adjusting the risk framework.

2. ACAMS. (2023). CAMS Risk Management (CAMS-RM) Study Guide. Chapter 2: The Risk-Based Approach, p. 2-15. The guide emphasizes that the risk assessment is a "dynamic process" that should be updated based on new information, which is the essence of a feedback loop.

An effective AML/CFT program relies on robust internal controls, which include measures to mitigate risks posed by internal actors. Employees, particularly those in sensitive or high-risk roles, should be screened not only upon hiring but also periodically throughout their employment. This ongoing screening helps to identify any changes in an employee's circumstances (e.g., new criminal convictions, financial distress, or inclusion on a sanctions list) that could make them a higher risk to the institution. This practice is a critical safeguard against internal fraud, collusion, and other insider threats that could compromise the AML/CFT program.

B. While all customers are subject to ongoing monitoring, the term "loyal" is irrelevant, and periodic screening is a distinct internal control process most critically applied to employees.

C. The Board of Directors is screened, typically at appointment and upon changes, but the routine, periodic screening of the broader employee base is a more standard operational control.

D. The CEO and Directors are a subset of the Board of Directors and senior management; "Employees" is a broader and more fundamental group requiring periodic screening.

1. ACAMS CAMS6 - Certified Anti-Money Laundering Specialist Study Guide, 6th Edition, (2020). Chapter 4, "Designing a Comprehensive AML/CTF Program," pp. 132-134. The guide discusses employee conduct and the importance of screening as a key internal control.

2. Wolfsberg Group. (2017). Anti-Bribery and Corruption Compliance Programme Guidance. Section 3.2 "Risk-based Human Resources Processes," p. 10. This guidance recommends screening of employees in relevant roles on a periodic basis.

3. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. Recommendation 18. This recommendation covers internal controls, including screening procedures to ensure high standards when hiring employees.