Financial-Crime Typologies and Red-Flag Analysis

Introduction and Context

Anti-money-laundering (AML) professionals do not detect crime by identifying a single suspicious transaction. They detect patterns that are inconsistent with a customer’s legitimate purpose, economic profile, expected activity, or known business environment. A typology is a recurring method by which illicit funds are generated, moved, concealed, converted, or integrated into the legitimate economy. A red flag is an indicator that warrants further examination; it is not, by itself, proof of criminal conduct.

For investment banks, private-equity firms, broker-dealers, custodians, correspondent banks, and capital-markets intermediaries, typology analysis is especially important because transactions may be large, cross-border, highly structured, and executed through multiple legal entities. Criminals may exploit securities accounts, corporate vehicles, trade finance, correspondent relationships, payment technology, virtual assets, and professional advisers. Effective monitoring therefore combines transaction data with customer due diligence, beneficial-ownership information, contextual research, sanctions screening, adverse-media analysis, and professional judgment.

This chapter develops a practical framework for identifying major financial-crime typologies and converting red flags into defensible investigative decisions. The central principle is proportionality: institutions should investigate activity according to risk, avoid stereotyping, document reasoning, and escalate where the totality of circumstances creates reasonable suspicion.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain how typologies differ from individual red flags and from proof of criminality.
2. Detect patterns involving rapid movement of funds, structuring, pass-through accounts, and nested correspondent relationships.
3. Identify indicators of market manipulation, insider dealing, trade-based money laundering, cyber-enabled fraud, and virtual-asset abuse.
4. Assess the role of professional enablers and beneficial-ownership structures.
5. Build an evidence-based investigation, distinguish false positives from meaningful risk, and determine when escalation is appropriate.
6. Evaluate the limitations and governance requirements of automated transaction monitoring and artificial intelligence.

1. A Framework for Typology Analysis

1.1 From predicate offence to placement, layering, and integration

Money laundering generally involves the processing of proceeds of crime so that their criminal origin is obscured. The traditional three-stage model is useful but not universal:

• Placement introduces illicit proceeds into the financial system. Examples include cash deposits, purchase of financial instruments, or conversion into payment balances.
• Layering separates funds from their source through transfers, securities transactions, loans, trade payments, or corporate structures.
• Integration makes the proceeds appear legitimate, for example through property purchases, dividends, loans, investment returns, or sale proceeds.

The stages may overlap, occur in a different order, or be absent. A cyber-fraud proceeds account may receive electronic funds and immediately transfer them onward, combining placement and layering. A market manipulation scheme may generate apparently legitimate investment profits, making integration difficult to distinguish from ordinary trading.

1.2 The risk-based analytical model

A useful investigative model examines five dimensions:

The analyst should avoid treating risk as a simple count of alerts. Several weak indicators may collectively be significant, while a single strong indicator—such as confirmed account takeover—may justify immediate containment.

1.3 Red flags: indicators, not conclusions

A red flag becomes more meaningful when it is specific, repeated, unexplained, and connected to other evidence. For example, an international transfer is not inherently suspicious. It becomes more concerning when it is inconsistent with the customer’s profile, routed through unrelated jurisdictions, followed by rapid onward transfers, and supported by unreliable documentation.

The following analytical questions are consistently useful:

• Is the activity consistent with the customer’s known income, wealth, business, and stated purpose?
• Is there a plausible economic explanation independent of the transaction itself?
• Who ultimately controls the funds, account, asset, or legal entity?
• Are transactions circular, fragmented, unusually rapid, or needlessly complex?
• Does the activity coincide with confidential information, corporate events, cyber incidents, or unusual market conditions?
• Are documents independently verifiable, or merely internally consistent?

2. Rapid Movement of Funds and Pass-Through Accounts

2.1 The typology

A pass-through account receives funds and transfers most or all of them onward with limited economic activity. Such accounts may be used to layer proceeds, obscure the original beneficiary, or exploit a legitimate institution’s reputation. The account holder may be a willing participant, a money mule, a shell company, or an innocent person whose credentials have been compromised.

Common patterns include:

• multiple incoming payments from unrelated persons followed by consolidated outbound transfers;
• funds entering and leaving within minutes or hours;
• little evidence of payroll, inventory, operating expenses, or genuine investment activity;
• transfers to high-risk jurisdictions or virtual-asset platforms;
• repeated use of round amounts or near-total balance depletion;
• incoming funds followed by purchases of easily transferable securities or digital assets;
• a dormant account becoming active immediately after opening or after a change of ownership.

Velocity should be interpreted in context. A treasury account may legitimately receive and deploy funds quickly, while a personal account used for ordinary living expenses generally should not behave like a clearing account.

2.2 Analytical techniques

Investigators should calculate simple descriptive measures, while recognizing that no threshold is universally suspicious. Useful measures include transaction frequency, time between receipt and onward payment, percentage of incoming funds transferred out, number of counterparties, and concentration by jurisdiction.

For a review period, the pass-through ratio may be expressed as:

where P is the pass-through ratio, O is qualifying outbound value, and I is qualifying inbound value during the same period. Both values must use the same currency and period, and the analyst must define whether chargebacks, internal transfers, and legitimate treasury movements are included. A high ratio is an indicator only; it is not a universal rule or proof of laundering.

Network analysis can reveal that apparently unrelated accounts share devices, IP addresses, beneficiaries, directors, introducers, or payment instructions. The institution should preserve the transaction chain, including timestamps, originators, beneficiaries, payment messages, account notes, and any linked securities or wallet activity.

3. Structuring and Smurfing

Structuring is the deliberate division of transactions to avoid reporting, identification, or monitoring controls. It may involve cash deposits, wire transfers, securities purchases, money-service transactions, or virtual-asset conversions. “Smurfing” commonly describes the use of several persons or accounts to conduct smaller transactions that collectively represent a larger flow.

Indicators include:

• repeated transactions just below a known control or reporting threshold;
• similar amounts across several branches, accounts, or related persons;
• deposits followed by transfers to a common beneficiary;
• activity that changes immediately after a customer is informed of a control;
• use of family members, employees, or nominee directors without a clear business rationale;
• transaction splitting by date, currency, payment rail, or legal entity.

Threshold proximity must be handled carefully. Legitimate businesses may naturally make payments in standardized amounts, and an institution should not rely on a threshold alone. A sound investigation compares the pattern with the customer’s normal behavior, expected cash cycle, industry practice, and known counterparties.

4. Market Manipulation and Insider Dealing

4.1 Distinguishing market abuse from ordinary trading

Market abuse typologies are particularly relevant to investment banking because illicit conduct may occur through apparently legitimate brokerage and custody accounts. Market manipulation seeks to create a false or misleading impression of supply, demand, price, or market activity, or to influence prices improperly. Insider dealing involves trading, recommending, or disclosing information while in possession of material non-public information, subject to the applicable legal framework.

Potential manipulation patterns include:

• matched orders or wash trades that create artificial volume;
• layering or spoofing, in which orders are placed to create a false impression and then cancelled after the price moves;
• marking the close through unusual trades near the end of a reporting period;
• coordinated trading among connected accounts;
• ramping a thinly traded security before selling into increased demand;
• circular transfers of securities or funds that create artificial performance;
• social-media promotion followed by undisclosed selling.

Potential insider-dealing indicators include trading shortly before a takeover announcement, earnings release, rating change, or other price-sensitive event; unusual options activity; a new account trading a concentrated position; or communication links between traders and employees with access to confidential information. Timing alone is not enough. Investigators should examine information access, communication records, trading rationale, prior behavior, restricted lists, wall-crossing records, and the customer’s relationship to the issuer.

4.2 Integrated surveillance

AML monitoring and market-abuse surveillance should exchange relevant information while respecting legal and confidentiality requirements. A suspicious securities transaction may involve both market abuse and laundering: illicit gains may be transferred through related accounts, converted into other assets, or withdrawn as apparently legitimate investment proceeds.

5. Trade-Based Money Laundering

Trade-based money laundering (TBML) disguises the movement of value through international trade. The underlying goods may be real, falsely described, over- or under-invoiced, shipped multiple times, or not shipped at all. Trade finance products can be abused because banks often process documents rather than physically inspect goods.

Typical schemes include:

• Over-invoicing: the importer pays more than the goods’ legitimate value, transferring additional value abroad.
• Under-invoicing: the exporter receives less documented value, with the balance settled separately.
• Multiple invoicing: several invoices are used to justify more than one payment for the same shipment.
• Phantom shipments: documentation exists but goods are never shipped.
• Misdescription: the quantity, quality, classification, or nature of goods is falsified.
• Third-party payments: a party unrelated to the underlying trade pays or receives funds without a clear rationale.

Red flags include unusual trade routes, high-risk jurisdictions unrelated to the goods, inconsistent commodity descriptions, prices far outside independent benchmarks, repeated amendments, vague letters of credit, complex shipping arrangements, and counterparties with no credible commercial presence. Analysts should compare invoices, bills of lading, customs data, purchase orders, insurance, packing lists, shipping routes, and beneficial ownership. A single price difference may reflect legitimate quality, freight, or market factors; the concern arises from unexplained combinations of anomalies.

6. Correspondent Banking and Nested Relationships

Correspondent banking allows one institution to provide payment, clearing, settlement, or cash-management services to another institution, often across borders. A respondent bank may in turn provide access to its own customers through a nested relationship. This structure can obscure the true originator or beneficiary and may expose a correspondent to risks it cannot directly observe.

Important red flags include:

• unexplained growth in payment volumes or corridors;
• activity inconsistent with the respondent’s business model or licensing;
• transactions involving shell banks, opaque ownership, or weak supervision;
• large volumes of payments for unrelated third parties;
• repeated use of payable-through or nested accounts without adequate transparency;
• reluctance to provide customer, sanctions, or suspicious-activity information;
• rapid movement through jurisdictions with no apparent commercial connection.

Effective controls include respondent due diligence, understanding ownership and management, assessing AML controls, defining permitted activities, setting transaction and country limits, monitoring expected payment flows, and conducting periodic reviews. A correspondent should understand what services are being provided and to whom, while avoiding assumptions that the respondent’s regulatory status alone eliminates risk.

7. Cyber-Enabled Fraud and Account Takeover

Cyber-enabled financial crime combines social engineering, malware, credential theft, business-email compromise, synthetic identities, and mule accounts. The laundering phase may begin with a fraudulent payment into an account that appears legitimate, followed by rapid transfer through several accounts, conversion into virtual assets, purchase of goods, or cross-border remittance.

Indicators include:

• a new device, IP address, or location shortly before a high-value payment;
• changes to contact details or payment beneficiaries followed by urgent instructions;
• unusual login times, impossible travel, or repeated failed authentication;
• payment requests inconsistent with prior communication style;
• newly opened accounts receiving many unrelated credits;
• rapid onward movement to exchanges, payment processors, or foreign banks;
• victims and recipients sharing technical identifiers or contact details.

The response has two dimensions. First, the institution should contain loss through authentication, payment recall, account restriction, and coordination with fraud and cyber teams. Second, it should preserve evidence and assess whether the recipient is a victim, a mule, or a professional laundering node. Customer protection, privacy, evidence integrity, and timely reporting must be balanced.

8. Virtual Assets

Virtual assets can enable fast cross-border transfers, pseudonymous transactions, mixing services, decentralized applications, and conversion across many tokens. Risk is not inherent in the technology; it depends on the service, counterparties, controls, transaction pattern, and jurisdiction.

Red flags may include:

• funds entering from or leaving to high-risk or unregistered virtual-asset services;
• rapid movement through multiple wallets with no investment rationale;
• exposure to mixers, privacy-enhancing tools, darknet markets, ransomware addresses, or sanctioned services;
• immediate conversion among assets and fiat currencies;
• use of many newly created wallets or addresses with no established history;
• mismatch between the customer’s stated wealth and digital-asset activity;
• transactions linked to fraud typologies, including investment scams and extortion.

Blockchain visibility does not automatically identify the person controlling a wallet. Address attribution may be uncertain, transactions may pass through intermediaries, and analytics providers may differ. Analysts should document the source and confidence of wallet intelligence, distinguish direct from indirect exposure, and avoid treating a risk score as a conclusion. Travel-rule, licensing, sanctions, custody, and recordkeeping obligations vary by jurisdiction and must be applied according to the institution’s legal framework.

9. Professional Enablers and Beneficial Ownership

Professional enablers may include lawyers, accountants, company-formation agents, trust and company service providers, brokers, real-estate professionals, and other advisers. Most professionals perform legitimate services, but some knowingly or recklessly facilitate concealment through nominee arrangements, opaque trusts, false invoices, sham loans, or layered companies.

Red flags include:

• structures with no evident commercial purpose;
• repeated use of the same adviser, address, nominee director, or signatory across unrelated entities;
• unexplained changes in ownership before a transaction or investigation;
• refusal to identify the natural person who ultimately benefits;
• legal opinions or invoices that appear designed to create a superficial appearance of legitimacy;
• funds moving through client accounts without a clear connection to the professional service;
• unusually complex ownership spanning jurisdictions with no business rationale.

Beneficial ownership analysis should identify the natural person who ultimately owns or controls the customer, directly or indirectly, or exercises control through other means. Ownership percentages alone may be insufficient where voting agreements, trusts, bearer-like arrangements, or informal control exist. Documentary evidence should be corroborated through registries, corporate records, independent databases, open-source research, and explanations from the customer.

10. A Structured Red-Flag Investigation

A professional investigation should be reproducible. The following sequence is suitable for an alert, referral, or thematic review:

1. Define the trigger. Record the transaction, system rule, source of intelligence, and date.
2. Establish the baseline. Review customer risk rating, expected activity, occupation, business model, products, jurisdictions, and prior alerts.
3. Map the activity. Identify originators, beneficiaries, intermediaries, related accounts, devices, securities, wallets, and timing.
4. Form hypotheses. Consider legitimate explanations as well as laundering, fraud, market abuse, sanctions evasion, or tax-related risks.
5. Test independently. Verify invoices, ownership, market events, shipping, employment, counterparties, and source of funds using reliable evidence.
6. Assess the totality. Weigh consistency, scale, repetition, concealment, control, and response quality.
7. Decide and document. Close with a reasoned explanation, escalate for enhanced due diligence, restrict activity where authorized, or file a report where the legal threshold is met.
8. Learn and tune. Feed confirmed typologies and false-positive findings into scenarios, training, customer risk models, and quality assurance.

The investigation record should explain not only what was found, but why particular evidence was considered reliable, why alternative explanations were accepted or rejected, and what uncertainty remains.

11. Applied Case: The Meridian Export Group

The following is a fictional illustrative case.

Background

Meridian Export Group, a newly incorporated trading company, opens a corporate account and requests trade-finance services. Its stated business is the export of industrial components from Country A to distributors in Countries B and C. The beneficial owner is a resident of Country A, while the director and registered office are provided by a company-services firm.

Problem

Within three months, Meridian receives 42 payments from unrelated companies. Most are in round amounts. Approximately 90% of the funds leave within 24 hours: some are paid to an account in Country D, some purchase highly liquid securities, and some are sent to a virtual-asset service. Several invoices describe different goods using nearly identical language. Shipping documents show routes that are commercially unusual, and one counterparty shares a telephone number with another Meridian supplier.

Analysis

No single fact proves laundering. However, the combined indicators are material:

• the account behaves as a pass-through account rather than an operating exporter;
• unrelated counterparties and rapid onward movement suggest possible layering;
• repeated round amounts and common contact details raise concerns about coordination;
• trade documents and routes require independent verification;
• securities and virtual-asset transfers may represent rapid value conversion;
• the professional intermediary and cross-border structure make beneficial-ownership analysis important.

The analyst requests contracts, customs records, bills of lading, proof of delivery, inventory records, bank statements, source-of-wealth information, and an explanation for the securities and virtual-asset activity. Independent shipping data shows that two consignments were never loaded. The customer cannot explain the common telephone number and provides documents created after the review began.

Approach and outcome

The institution places the relationship under enhanced review, limits additional trade-finance exposure in accordance with policy, informs relevant fraud and sanctions teams, and escalates the matter to the designated AML officer. The officer considers applicable reporting obligations and preserves the transaction, communication, and documentary evidence. The institution also reviews other customers introduced by the same professional firm and tests whether similar counterparties appear elsewhere in its network.

Learning points

1. A typology is often visible only when transaction, trade, ownership, and network data are combined.
2. Rapid movement is meaningful when inconsistent with the stated business model.
3. Documents must be independently verified; plausibility is not verification.
4. Securities and virtual assets can be layering channels even when the original account is a conventional corporate account.
5. Escalation should be based on the totality of evidence, not on a single threshold or nationality.

12. Technology, AI, and Governance

Transaction-monitoring systems use rules, thresholds, customer segmentation, network analytics, anomaly detection, and increasingly machine-learning models. AI can identify unusual relationships and prioritize investigations, but it does not replace legal judgment or customer-context analysis.

Important governance controls include:

• documented purpose, data lineage, and model ownership;
• testing for accuracy, stability, explainability, and discriminatory effects;
• human review of material decisions;
• controls for false negatives as well as false positives;
• protection of confidential and personal data;
• audit trails showing inputs, model versions, analyst actions, and outcomes;
• periodic validation against emerging typologies and confirmed cases.

A model that learns from historical alerts may reproduce past investigator bias or miss new criminal methods. Conversely, a highly sensitive model may overwhelm investigators and reduce the quality of decisions. Effective programs therefore combine automation with expert review, thematic investigations, scenario tuning, and management information that measures outcomes rather than alert volume alone.

13. Challenges, Limitations, and Ethical Issues

Typology analysis has several limitations. Legitimate cross-border commerce can resemble TBML. Fast settlement can be normal for treasury operations. High-risk jurisdictions may be commercially necessary. Privacy restrictions can limit access to useful data. Criminals deliberately adapt once controls become known.

Institutions should avoid de-risking entire communities or sectors without evidence. Nationality, ethnicity, occupation, religion, or residence should never substitute for individualized risk analysis. Customers should receive fair treatment, and investigations should respect confidentiality, due process, data-protection requirements, and restrictions on tipping off. Information sharing should be lawful, proportionate, and secure.

A sound control environment also recognizes that suspicious-activity reporting is not a finding of guilt. It is a regulated communication of concern based on the applicable legal standard. Final determinations belong to competent authorities and courts.

Best-Practice Checklist

• Understand the customer’s business and expected transaction profile before relying on automated alerts.
• Identify natural-person beneficial owners and persons exercising control.
• Examine transaction chains, not isolated payments.
• Combine AML, fraud, sanctions, market-abuse, cyber, and trade-finance intelligence where permitted.
• Verify documents independently and record the source and reliability of evidence.
• Use thresholds as investigative prompts, not conclusions.
• Investigate both direct and indirect exposure to high-risk services and networks.
• Document legitimate explanations, unresolved contradictions, and decision rationale.
• Tune monitoring scenarios using confirmed cases and false-positive analysis.
• Escalate promptly where delay could enable dissipation of funds or destruction of evidence.

Chapter Summary

Financial-crime typologies describe recurring methods for moving, concealing, converting, or legitimizing illicit value. Red flags are contextual indicators, not proof. Effective analysis begins with the customer, purpose, pattern, network, and quality of explanation. Rapid movement, pass-through accounts, structuring, and smurfing are best identified through transactional and network analysis. Market manipulation and insider dealing require integration of trading, communications, corporate-event, and access information. TBML demands comparison of financial records with trade, shipping, customs, and ownership evidence. Correspondent and nested banking relationships require transparency over respondent activities and underlying customers. Cyber-enabled fraud, virtual assets, and professional enablers create additional channels for concealment and value transfer.

A defensible investigation tests competing explanations, independently verifies evidence, assesses the totality of circumstances, protects customer rights, and documents its reasoning. Automation and AI can improve detection, but governance, explainability, human judgment, and continuous typology development remain essential.

Key Terms

Beneficial owner: The natural person who ultimately owns or controls a customer or benefits from an arrangement.

Correspondent banking: Banking services provided by one institution to another institution, often across borders.

Layering: Transactions intended to distance illicit proceeds from their source.

Market manipulation: Conduct that creates a false or misleading market impression or improperly influences price or activity.

Money mule: A person or account used to receive and transfer proceeds, knowingly or unknowingly.

Nested relationship: A respondent’s use of a correspondent account to provide access to its own customers or other institutions.

Pass-through account: An account receiving and transferring funds with little apparent independent economic activity.

Placement: Introduction of illicit proceeds into the financial system.

Predicate offence: The underlying crime that generates proceeds subsequently laundered.

Red flag: An indicator requiring further examination, not proof of wrongdoing.

Smurfing: Structuring transactions through multiple persons or accounts.

Source of funds: The origin of money used in a particular transaction or relationship.

Source of wealth: The origin of a customer’s overall accumulated wealth.

Structuring: Deliberately dividing transactions to avoid controls or reporting requirements.

Trade-based money laundering: Concealment or transfer of value through trade transactions.

Typology: A recurring method or pattern of financial crime.

Virtual asset: A digital representation of value that can be digitally traded or transferred, subject to applicable legal definitions.

Wash trade: A transaction in which there is no genuine change in beneficial ownership or economic exposure.

Review Questions

Short Answer Questions

1. Why is a red flag not equivalent to proof of money laundering?
2. Define a pass-through account and state two indicators of its use.
3. What is structuring, and why can threshold proximity alone be misleading?
4. Identify two forms of trade-based money laundering.
5. Why is beneficial-ownership analysis important in complex corporate structures?

Long Answer Questions

1. Explain how an institution should investigate rapid movement of funds using customer, transaction, and network information.
2. Compare market manipulation and insider dealing, including relevant surveillance indicators.
3. Discuss the principal risks of correspondent and nested banking relationships and the controls that address them.
4. Explain how cyber-enabled fraud and virtual assets can interact in a laundering chain.
5. Evaluate the benefits and limitations of AI-based transaction monitoring.

Analytical / Application Questions

1. A newly formed company receives payments from 30 unrelated entities and transfers 85% of the funds abroad within one business day. What additional evidence would you seek, and how would you distinguish legitimate treasury activity from pass-through laundering?
2. A customer makes concentrated purchases of a thinly traded security two days before a takeover announcement and sells shortly afterward. Develop an investigative plan covering trading records, communications, information access, and AML implications.
3. An importer presents consistent invoices and shipping documents, but the prices are substantially above independent benchmarks and payments are made by unrelated third parties. Analyse the possible TBML indicators and recommend proportionate next steps.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a red flag in AML analysis?

A. It is conclusive proof that a customer committed a crime.

B. It is an indicator that warrants contextual examination.

C. It is a transaction that exceeds a universal global threshold.

D. It is evidence that must always lead to account closure.

Correct Answer: B. It is an indicator that warrants contextual examination.

Question 2

Which pattern is most characteristic of a pass-through account?

A. Regular payroll payments and ordinary operating expenses

B. Long-term investment with documented objectives

C. Multiple unrelated credits followed by rapid onward transfers

D. Periodic interest receipts from a known deposit account

Correct Answer: C. Multiple unrelated credits followed by rapid onward transfers

Question 3

What is the primary purpose of structuring?

A. To improve a customer’s credit rating

B. To divide transactions to evade controls or reporting requirements

C. To diversify a legitimate investment portfolio

D. To reduce foreign-exchange settlement time

Correct Answer: B. To divide transactions to evade controls or reporting requirements

Question 4

Which activity is most consistent with marking the close?

A. Trading near market close to influence a reported closing price

B. Buying securities according to a documented long-term plan

C. Receiving dividend income from a held investment

D. Transferring securities between two custodians

Correct Answer: A. Trading near market close to influence a reported closing price

Question 5

Which is a trade-based money-laundering technique?

A. Over-invoicing exported goods to transfer additional value

B. Paying a documented salary through a bank account

C. Rebalancing a diversified index portfolio

D. Using an audited invoice at an independently verified market price

Correct Answer: A. Over-invoicing exported goods to transfer additional value

Question 6

Why can nested correspondent relationships create heightened risk?

A. They eliminate the need for customer due diligence.

B. They may obscure the underlying customers using the correspondent access.

C. They prevent all cross-border payments.

D. They guarantee that every transaction is domestic.

Correct Answer: B. They may obscure the underlying customers using the correspondent access.

Question 7

Which is a likely indicator of cyber-enabled account takeover?

A. Stable login behavior over several years

B. A new device and changed beneficiary followed by an urgent high-value payment

C. A regular salary credit from a known employer

D. A documented annual tax payment

Correct Answer: B. A new device and changed beneficiary followed by an urgent high-value payment

Question 8

Which statement about virtual-asset analytics is most accurate?

A. A blockchain address always identifies its controlling person with certainty.

B. A risk score is itself proof of criminal conduct.

C. Address attribution may be uncertain and should be assessed with other evidence.

D. Virtual assets cannot be used for layering.

Correct Answer: C. Address attribution may be uncertain and should be assessed with other evidence.

Question 9

What should beneficial-ownership analysis ultimately seek to identify?

A. Only the company’s registered office

B. The natural person who ultimately owns or controls the arrangement

C. The bank employee who approved the account

D. The jurisdiction with the lowest tax rate

Correct Answer: B. The natural person who ultimately owns or controls the arrangement

Question 10

Which is an appropriate principle for AI-based transaction monitoring?

A. Human review is unnecessary once a model is deployed.

B. Models should be governed, validated, explainable, and monitored for bias and errors.

C. Historical alerts should be used without testing because they are always objective.

D. Alert volume is the only meaningful measure of effectiveness.

Correct Answer: B. Models should be governed, validated, explainable, and monitored for bias and errors.