ACAMS - Association of Certified Anti-Money Laundering Specialists Conducting Investigations Questions and Answers 1 — Questions and Answers
Question 1: An AML investigator is reviewing a corporate account for a company that imports electronics. The account shows several large, round-figure wire transfers to a new supplier in a high-risk jurisdiction, which is inconsistent with the company's established payment patterns. The investigator has already reviewed all internal customer due diligence (CDD) information. What is the most appropriate next step to gather more context?
- Immediately file a Suspicious Activity Report (SAR) based on the red flags.
- Conduct open-source intelligence (OSINT) research on the new supplier and review public records. (Correct answer)
- Contact the customer directly to inquire about the purpose of the new payments.
- Close the account immediately to mitigate the financial institution's risk.
Correct answer: Conduct open-source intelligence (OSINT) research on the new supplier and review public records.
The most appropriate next step is to gather more information discreetly. Open-source intelligence (OSINT) allows the investigator to research the new supplier, check for adverse media, verify its business legitimacy, and look for any connections to sanctioned or high-risk entities without alerting the customer. Filing a SAR may be premature without further context. Contacting the customer could lead to tipping off, and closing the account is an action taken after a risk decision is made, not typically as an investigative step.
Question 2: During an AML investigation, a relationship manager receives an inquiry from a customer asking why a recent transaction is being delayed. Which of the following responses by the relationship manager would most likely be considered illegal 'tipping off'?
- "We are conducting a routine compliance review as required for certain transactions."
- "Your transaction has been flagged by our AML system, and we must investigate it before deciding whether to report it to the authorities." (Correct answer)
- "There appears to be a standard processing delay in the payment system; we will notify you when it is complete."
- "To complete our processing, could you please provide the invoice related to this transaction?"
Correct answer: "Your transaction has been flagged by our AML system, and we must investigate it before deciding whether to report it to the authorities."
Tipping off is the act of informing a person who is the subject of a suspicious activity report (or is under investigation) in a way that could prejudice the investigation. Stating explicitly that the transaction was flagged by the AML system and that a report to authorities is being considered directly reveals the suspicion and the potential for law enforcement involvement. The other options provide plausible, non-alarming business reasons for a delay or a request for information.
Question 3: When an AML investigator concludes an investigation and decides *not* to file a Suspicious Activity Report (SAR), what is a critical component that must be included in the investigation file?
- A detailed justification for the decision, including the specific factors and evidence reviewed. (Correct answer)
- A copy of the customer's most recent government-issued photo identification.
- The exact date the account is scheduled for its next periodic CDD review.
- An attestation signed by the relationship manager confirming the customer's good standing.
Correct answer: A detailed justification for the decision, including the specific factors and evidence reviewed.
Auditors and regulators will scrutinize the rationale for not filing a SAR. The investigation file must contain a clear and detailed justification explaining why the activity, although initially flagged, was determined not to be suspicious upon review. This demonstrates a sound and defensible decision-making process. While not always a strict regulatory requirement, it is a widely accepted best practice. The other options are either part of the standard customer file or are not directly relevant to documenting the conclusion of a specific investigation.
Question 4: A financial institution receives a grand jury subpoena for the financial records of one of its customers. What is the most critical action the institution must take upon receipt?
- Immediately notify the customer that law enforcement has requested their records.
- Conduct an internal investigation and file a SAR on the customer before responding.
- Comply with the subpoena's request for information while maintaining strict confidentiality about its existence. (Correct answer)
- Freeze all transactions on the account until the subpoena has been fulfilled.
Correct answer: Comply with the subpoena's request for information while maintaining strict confidentiality about its existence.
A grand jury subpoena is a formal legal order that must be complied with. A critical aspect of such subpoenas is the requirement for secrecy to avoid compromising the investigation. Notifying the customer could be considered obstruction of justice. While the receipt of a subpoena should prompt a review of the customer's activity to determine if a SAR is warranted, it does not automatically require one to be filed. Freezing the account is not typically required by a subpoena alone and should only be done with a specific court order, such as a seizure warrant.
Question 5: At the conclusion of a complex money laundering investigation, the compliance officer has determined that a SAR must be filed. The investigation revealed a sophisticated network of shell companies moving funds. Which of the following is the most important element to include in the SAR narrative?
- The personal opinion of the investigator on the customer's character.
- A recommendation to law enforcement on which specific statutes may have been violated.
- An exhaustive list of every non-suspicious transaction in the account during the review period.
- A chronological and detailed description of the suspicious activity, covering the 'who, what, where, when, and why'. (Correct answer)
Correct answer: A chronological and detailed description of the suspicious activity, covering the 'who, what, where, when, and why'.
The primary purpose of the SAR narrative is to provide a clear, concise, and comprehensive account of the suspicious activity for law enforcement. Covering the 'who, what, where, when, why, and how' provides law enforcement with the actionable intelligence they need. Personal opinions are unprofessional, legal conclusions are the responsibility of law enforcement, and including non-suspicious activity clutters the report and obscures the key facts.
Question 6: An investigator is analyzing an alert on a customer's account involving structured cash deposits followed by an outgoing wire transfer. The investigator has reviewed account opening documents, transaction history, and notes from the relationship manager. Which of the following represents the next logical step of gathering *external* information?
- Reviewing security camera footage of the deposits being made.
- Performing a public internet search on the beneficiary of the wire transfer. (Correct answer)
- Checking the institution's central database for other accounts linked to the customer.
- Interviewing the teller who accepted the cash deposits.
Correct answer: Performing a public internet search on the beneficiary of the wire transfer.
Options A, C, and D all represent the gathering of *internal* information that is already within the financial institution's possession or accessible through its staff and systems. Performing a public internet search on the wire beneficiary is a classic example of using external, open-source intelligence (OSINT) to add context to the investigation, such as verifying the beneficiary's business or looking for adverse information.
ACAMS - Association of Certified Anti-Money Laundering Specialists Conducting Investigations Questions and Answers 1
An AML investigator is reviewing a corporate account for a company that imports electronics.
The account shows several large, round-figure wire transfers to a new supplier in a high-risk jurisdiction, which is inconsistent with the company's established payment patterns.
The investigator has already reviewed all internal customer due diligence (CDD) information.
What is the most appropriate next step to gather more context?