CCAS Practice Questions

CDD includes verifying the customer’s identity using reliable, independent documentation before or

during onboarding.

Mining generates new cryptoassets (A) by rewarding miners for solving complex cryptographic

puzzles. It also validates transactions on the blockchain (D) by confirming and recording them in

blocks, ensuring the integrity of the ledger.

While mining indirectly contributes to network security, the core security mechanisms involve

consensus protocols beyond mining alone (B). Optimizing network functionality (C) is usually a

development task rather than a mining function.

Mixing and tumbling services are used to obscure the origin of funds by blending multiple

transactions, resulting in unknown or disguised sources of funds. This is a classic money laundering

technique.

Rapid trades (B), IP address obfuscation (C), and transactions to high-risk jurisdictions (D) are

separate or related risks but not direct indicators of mixing/tumbling.

Decentralized exchanges lack a central counterparty responsible for AML compliance, making it

difficult to enforce KYC/CDD, monitor transactions, or implement controls. This structural

characteristic increases inherent AML risk compared to centralized exchanges, which have

accountable operators.

Transaction cost (A), validator nodes (B), or asset types (D) are less impactful in the compliance risk

rating.

Blockchain’s transparent ledger enables investigators to trace transaction histories indefinitely,

aiding ML/TF detection.

The Financial Action Task Force (FATF) guidance on Virtual Assets and Virtual Asset Service Providers

(VASPs) explicitly highlights that transactions involving unhosted wallets (wallets not held or

controlled by a regulated entity) pose a high inherent risk for money laundering and terrorist

financing. This is because unhosted wallets are more difficult to monitor and control, lack identifiable

customer information, and are often exploited for illicit activities.

The DFSA AML Module, aligned with FATF recommendations, mandates that Relevant Persons

incorporate this risk into their business-wide risk assessments. The increased volume of transactions

to and from unhosted wallets should therefore be assigned a high inherent risk rating to trigger

enhanced controls such as enhanced due diligence (EDD) and transaction monitoring.

Supporting extracts include:

FATF Guidance on Virtual Assets (October 2021) states: "Unhosted wallets or transactions with them

represent a high risk of ML/TF due to limited or no access to identifying information."

DFSA AML Module (AML/VER25/05-24) Section 4.1 & 6.1 on Risk-Based Approach: mandates firms to

assess and rate risks posed by customers and products, explicitly including virtual assets and

unhosted wallets as high risk.

COB Module also requires heightened controls and disclosures when dealing with transactions

involving unhosted wallets【AML/VER25/05-24: Sections 4.1, 6.1, COB/VER45/05-24: Sections 6.13,

15.6】.

Thus, option D (High) is the correct risk rating.

Code uniqueness is critical because reuse or replication of vulnerable code exposes protocols to

known exploits. Unique, well-audited, and secure code minimizes compromise risk in decentralized

finance (DeFi) and smart contracts.

Security standards (A), authentication (B), and regulation (C) are important but secondary to the

fundamental security of the code itself.

Fuzzy matches require further review to confirm whether the match is a true hit or a false positive,

ensuring compliance accuracy.

The primary purpose of a security audit for smart contracts is to protect investors’ funds by

identifying vulnerabilities, coding errors, and weaknesses in the smart contract or underlying

protocol that could be exploited. This proactive approach helps prevent hacks, exploits, and financial

loss.

While performance issues (B) may be noted, the critical concern is security. Identifying bad actors (C)

is not within the scope of a code audit but is a broader operational issue. Copyright concerns (A) are

unrelated.

AML and crypto governance frameworks underline the importance of security audits to mitigate

operational risks in DeFi and other smart contract-based applications.

FATF Recommendation 15 requires countries to regulate VASPs for AML/CFT purposes, applying the

same preventive measures as financial institutions.