Global AML/KYC Legal and Regulatory Architecture

Introduction

Money laundering, terrorist financing and proliferation financing are transnational risks. A transaction may involve a customer in one country, an account in a second, an intermediary in a third and a beneficiary in a fourth. The legal and regulatory response is therefore not a single statute but a layered architecture comprising international conventions, global standards, supervisory guidance, national legislation, institutional policies and private-sector controls.

For banks, this architecture creates two simultaneous obligations. First, the institution must comply with the law of each jurisdiction in which it operates or provides services. Second, it must meet supervisory expectations concerning governance, risk assessment, customer due diligence, transaction monitoring, reporting and record keeping. Compliance is consequently not limited to checking identity at account opening. It is a continuing system for understanding customers, detecting suspicious conduct and demonstrating effective control to regulators.

This chapter examines the principal international instruments and explains how they influence national law and banking practice. It also evaluates extraterritorial exposure, regulatory consequences and the limits of formal compliance.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the relationship between UN conventions, FATF standards, Basel guidance, Wolfsberg principles and national regulation.
2. Evaluate the risk-based approach to AML/KYC compliance.
3. Distinguish legally binding obligations from soft-law standards and industry guidance.
4. Analyse beneficial ownership, enhanced due diligence, suspicious transaction reporting and correspondent-banking expectations.
5. Assess how extraterritorial rules create legal and operational exposure for banks.
6. Recommend governance and control responses to regulatory findings and enforcement risk.

1. The Architecture of Global AML/KYC Regulation

The global framework can be understood as a hierarchy of influence rather than a strict hierarchy of law.

A central analytical distinction is between hard law and soft law. A domestic AML statute is generally enforceable through courts or administrative processes. FATF Recommendations are not treaties and do not directly prosecute a bank. Nevertheless, they exert powerful influence because countries are assessed against them, regulators use them when designing rules, and financial institutions are judged against the resulting supervisory expectations. Basel and Wolfsberg materials are also generally non-binding, although they may become practically significant when incorporated into supervisory guidance, internal policy or contractual requirements.

The architecture is therefore best described as a process of translation: international norms are interpreted by national authorities and converted into obligations that banks must implement.

2. United Nations Foundations

The United Nations provides the principal international-law foundation for combating financial crime.

2.1 Vienna Convention

The 1988 United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances requires parties to criminalise money laundering connected with drug trafficking and to establish cooperation mechanisms. It also supports measures concerning confiscation, extradition and mutual legal assistance. Its historical importance lies in treating the laundering of criminal proceeds as an independent target of law enforcement rather than merely as an incidental consequence of the underlying offence.

2.2 Palermo Convention

The 2000 United Nations Convention against Transnational Organized Crime broadens the framework beyond narcotics. It requires states to criminalise participation in organised criminal groups and money laundering, and encourages preventive measures for financial institutions, including customer identification, record keeping and reporting of suspicious transactions. It also strengthens extradition and mutual legal assistance.

2.3 Terrorist Financing Convention

The 1999 International Convention for the Suppression of the Financing of Terrorism addresses the provision or collection of funds for terrorist acts. The financing offence is important because funds may originate from lawful sources. A bank must therefore consider not only whether money represents criminal proceeds, but also whether it may support terrorism.

2.4 United Nations Convention against Corruption

The 2003 United Nations Convention against Corruption addresses bribery, embezzlement, illicit enrichment and asset recovery. It is especially relevant to politically exposed persons (PEPs), public procurement, state-owned enterprises and cross-border recovery of assets. Its preventive provisions support customer due diligence, transparency and suspicious transaction reporting.

2.5 Security Council measures

UN Security Council resolutions can impose targeted financial sanctions, including asset freezes and prohibitions on making funds or economic resources available to designated persons or entities. Sanctions screening is conceptually distinct from AML transaction monitoring: sanctions controls focus on designated parties and prohibited dealings, whereas AML controls focus on laundering, terrorist financing and other suspicious activity. In practice, banks must coordinate both systems while preserving their different legal tests and escalation processes.

3. FATF: The Core Global Standard

The Financial Action Task Force (FATF), established in 1989, is the leading global standard setter for AML, counter-terrorist financing (CTF) and counter-proliferation financing. Its Recommendations, together with interpretive notes and assessment methodology, form the central reference point for national frameworks.

3.1 The FATF Recommendations

The 40 Recommendations cover the principal elements of an effective framework, including:

• national risk assessment and risk-based policies;
• criminalisation of money laundering and terrorist financing;
• confiscation and provisional measures;
• preventive measures for financial institutions and designated non-financial businesses and professions;
• beneficial ownership transparency;
• supervision and enforcement;
• financial intelligence units (FIUs);
• international cooperation; and
• targeted financial sanctions.

The Recommendations should not be read as a checklist detached from risk. FATF expects proportionate, risk-based measures. A low-risk relationship may permit simplified measures where national law allows them, while a high-risk relationship requires enhanced scrutiny. Simplification is not the same as exemption from knowing the customer or identifying the beneficial owner.

3.2 The risk-based approach

The risk-based approach allocates resources according to the likelihood and potential impact of financial crime. A bank should identify, assess, understand and document risk at enterprise, business-line, customer, product, delivery-channel and geographic levels.

A useful conceptual model is:

Here, likelihood represents the probability that a risk event may occur, and impact represents the severity of its consequences. This is a governance model rather than a universally prescribed regulatory equation. Banks may use qualitative scales, quantitative scoring or hybrid methods. The model is useful only if assumptions, data quality, thresholds and management judgment are documented. A numerical score does not replace professional investigation.

Risk factors commonly include:

• customer type and ownership complexity;
• occupation, business activity and source of wealth;
• geography and exposure to high-risk jurisdictions;
• products such as private banking, cash-intensive services or correspondent banking;
• delivery channels, including non-face-to-face onboarding;
• transaction volume, velocity and counterparties; and
• adverse media, sanctions indicators or law-enforcement information.

The risk-based approach has two dimensions. Inherent risk is exposure before controls. Residual risk is exposure after controls. A strong control environment should reduce risk, but a low residual score is credible only where controls are actually effective and independently tested.

3.3 Customer due diligence and beneficial ownership

FATF-aligned CDD normally requires the institution to:

1. identify and verify the customer;
2. identify and take reasonable measures to verify the beneficial owner;
3. understand the purpose and intended nature of the relationship; and
4. conduct ongoing due diligence and scrutiny of transactions.

A beneficial owner is the natural person who ultimately owns or controls a legal person or arrangement, or the person on whose behalf a transaction is conducted. Ownership percentages may assist analysis, but control can arise through voting rights, contractual arrangements, appointment rights or other means. If no natural person can be identified after reasonable measures, the relevant senior managing official may be recorded under applicable law; this is a fallback, not a substitute for genuine ownership analysis.

3.4 Politically exposed persons

FATF distinguishes foreign PEPs, domestic PEPs and persons entrusted with prominent functions by international organisations. The risk response generally includes senior-management approval, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. Family members and close associates may also require treatment under national law and risk assessment.

PEP status is not evidence of criminality. It is a risk factor reflecting exposure to bribery, corruption and influence. Controls must therefore be proportionate, documented and free from discriminatory assumptions.

3.5 Suspicious transaction reporting and FIUs

A bank must report suspicion to the competent FIU when the applicable legal threshold is met. Suspicion normally requires more than an unusual transaction; it involves a reasoned basis, formed from facts and circumstances, that funds may be connected with criminal activity or terrorist financing. The institution generally must not disclose the report or its existence to the customer where tipping-off prohibitions apply.

The FIU receives, analyses and disseminates financial intelligence. It is not normally the same body as the prudential supervisor, police or prosecutor. Effective reporting therefore requires clear internal escalation, timely decision-making, confidentiality and high-quality narratives explaining why activity is suspicious.

3.6 Beneficial ownership reforms and digital finance

FATF strengthened its beneficial ownership standards in 2022, emphasising adequate, accurate and up-to-date information and permitting countries to use multiple complementary mechanisms rather than relying on a single company register. Financial institutions should not assume that a registry entry is automatically complete or accurate.

FATF Recommendation 15 applies AML/CTF expectations to virtual assets and virtual asset service providers. Relevant risks include pseudonymous transfers, rapid cross-border movement, unhosted-wallet exposure and weakly regulated intermediaries. Technology changes the risk profile but does not remove the fundamental requirements of customer identification, beneficial ownership analysis, monitoring and reporting.

4. Basel Committee Guidance and Banking Supervision

The Basel Committee on Banking Supervision does not legislate AML offences. Its contribution is to integrate financial-crime risk into sound governance and prudential supervision.

The Committee’s customer-due-diligence principles and later guidance emphasise:

• board responsibility for approving risk appetite and oversight;
• senior management responsibility for implementation;
• a three-lines model involving business ownership, compliance oversight and independent assurance;
• customer acceptance and identification procedures;
• consolidated risk management across branches and subsidiaries;
• controls for correspondent banking; and
• adequate staffing, systems, training and internal audit.

Basel’s perspective is particularly important because AML failure can become a prudential issue. Weak controls may cause legal penalties, loss of correspondent relationships, liquidity stress, operational disruption, reputational damage and unsafe risk concentration.

Correspondent banking

In correspondent banking, one institution provides services to another institution, often enabling payments, clearing or access to financial markets. The correspondent may not know the ultimate originator or beneficiary of every underlying transaction. It should therefore understand the respondent bank’s business, ownership, management, AML controls, regulatory status, customer base and reputation. Shell-bank relationships are prohibited or severely restricted under many national regimes.

The correspondent should not treat a respondent’s licence as proof of effective AML compliance. Reliance requires evidence, contractual clarity, information-sharing arrangements and risk-based monitoring.

5. Wolfsberg Principles and Industry Practice

The Wolfsberg Group is an association of global banks that develops private-sector principles and guidance. Its publications address areas such as private banking, correspondent banking, sanctions, counter-terrorist financing, beneficial ownership, payment transparency and suspicious activity monitoring.

Wolfsberg principles are not legislation. Their value lies in practical interpretation and peer standards. They encourage banks to move beyond formal documentation toward understanding the customer’s business model, expected activity, source of wealth, source of funds and transaction purpose.

A critical distinction is between customer risk and transaction risk. A customer may be legitimate but conduct an unusual transaction; conversely, a transaction may appear ordinary while occurring within a high-risk relationship. Effective controls combine customer profiling, transaction analysis, contextual investigation and human judgment.

Industry guidance also supports proportionality. De-risking—terminating all relationships in a category merely because it presents some risk—may reduce short-term exposure but can produce financial exclusion and push activity into less transparent channels. The stronger approach is targeted risk management, unless legal prohibitions or unacceptable residual risk require exit.

6. National Regulation: Translating Standards into Duties

National regimes differ in terminology, institutional structure and enforcement style, but commonly contain the following components:

1. an AML/CTF statute or criminal code;
2. regulations prescribing CDD, record keeping, reporting and controls;
3. an FIU receiving suspicious transaction reports;
4. a prudential or conduct supervisor;
5. sanctions and enforcement powers;
6. rules concerning company ownership and registries; and
7. mechanisms for international cooperation.

Banks must distinguish at least four sources of domestic obligation:

• primary legislation, which creates offences and duties;
• regulations, which provide detailed mandatory requirements;
• supervisory rules and guidance, which explain expected systems and controls; and
• enforcement practice, which reveals how authorities interpret effectiveness.

A bank operating internationally should maintain a legal inventory mapping each relevant jurisdiction’s requirements. Group policy may set a global minimum, but local law may be stricter. The institution must apply the stricter standard where legally permissible, resolve conflicts through legal advice and document decisions.

7. Extraterritorial Exposure

Extraterritorial exposure arises when a bank is affected by another jurisdiction’s law despite being incorporated elsewhere. Common connecting factors include:

• a branch, subsidiary, representative office or agent;
• use of the other country’s currency or clearing system;
• customers, beneficiaries or counterparties located there;
• securities listed or marketed there;
• data, technology or service providers located there;
• correspondent relationships; and
• conduct considered to have effects in that jurisdiction.

The United States, European Union, United Kingdom and other jurisdictions may impose overlapping AML, sanctions, anti-bribery, data-protection and reporting requirements. A foreign bank can therefore face investigations or restrictions even where the conduct occurred partly outside the regulator’s territory.

Extraterritorial risk should be assessed through a legal-entity and activity map. The bank should identify where customers, accounts, employees, servers, payment rails, currencies and decision-making functions are located. It should then determine which laws apply and whether local rules conflict with group controls.

Conflicts are especially difficult where one jurisdiction restricts disclosure of customer data while another requires production of records. Solutions may include lawful information-sharing channels, regulator-to-regulator cooperation, data localisation, approved centralised access and carefully designed group policies. Informal assumptions are dangerous; conflicts require documented legal analysis.

8. Regulatory Expectations and Consequences of Non-Compliance

Supervisors increasingly assess effectiveness rather than the mere existence of policies. They may examine:

• board minutes and management information;
• enterprise-wide and business-level risk assessments;
• customer files and beneficial ownership evidence;
• alert-generation and case-closure quality;
• suspicious report timeliness and narrative quality;
• sanctions-screening governance;
• model validation and data lineage;
• training completion and competence;
• outsourcing and third-party oversight; and
• internal audit findings and remediation.

Typical weaknesses include incomplete ownership information, excessive reliance on customer declarations, ineffective transaction-monitoring scenarios, unexplained alert closures, poor escalation, fragmented data, weak correspondent-bank due diligence and failure to update risk assessments.

Consequences may include:

• supervisory remediation orders;
• monetary penalties;
• restrictions on products, customers or expansion;
• licence conditions or withdrawal;
• individual accountability proceedings;
• criminal liability in serious cases;
• asset restraint or confiscation;
• correspondent-bank termination;
• civil litigation and customer harm; and
• severe reputational damage.

The amount of a fine is not the only measure of seriousness. A remediation programme can consume substantial management time, require external monitors, delay strategic initiatives and undermine confidence in the institution.

9. Governance and the Meaning of Effective Compliance

An effective AML/KYC programme normally contains:

• board-approved risk appetite;
• a documented enterprise-wide risk assessment;
• clear customer acceptance and exit criteria;
• reliable CDD and beneficial ownership processes;
• risk-sensitive enhanced due diligence;
• integrated sanctions and transaction-monitoring controls;
• independent compliance testing and internal audit;
• adequate staffing, technology and training;
• secure records and defensible data governance;
• protected whistleblowing and escalation channels; and
• timely, tracked remediation.

Technology can support identity verification, network analytics, adverse-media review and alert prioritisation. Artificial intelligence may identify complex patterns, but it introduces risks of opacity, bias, false positives, data leakage and automation bias. A bank remains responsible for decisions made with technological assistance. Models require validation, explainability appropriate to their use, monitoring for drift and meaningful human review.

The ethical objective is broader than avoiding penalties. AML/KYC controls should protect the financial system while respecting privacy, due process, inclusion and proportionality. Suspicion must be based on evidence, not nationality, religion, ethnicity or lawful political activity. Records should explain decisions sufficiently for review without collecting irrelevant personal information.

10. Applied Case: Cross-Border Correspondent Banking

The following is an illustrative case, not a report of a real institution.

Background

Northbridge Bank, headquartered in Country A, provides US-dollar clearing through a correspondent in Country B. It maintains a relationship with Meridian Bank, a rapidly growing institution in Country C. Meridian serves importers, remittance businesses and digital-asset firms.

Problem

Northbridge’s monitoring system detects a sharp increase in payments from Meridian to companies in several high-risk jurisdictions. Payment descriptions are generic, beneficial ownership information for some corporate beneficiaries is inconsistent, and Meridian’s responses to information requests are delayed. The relationship manager argues that Meridian is licensed and that terminating the account would damage an important commercial relationship.

Analysis

The licence is relevant but not conclusive. The risk assessment should consider Meridian’s customer base, exposure to digital assets, ownership, governance, sanctions controls, transaction transparency and ability to identify underlying customers. The pattern may reflect legitimate trade, but unexplained growth, generic narratives and inconsistent ownership information increase risk.

The bank should distinguish three questions:

1. Is the activity prohibited by sanctions or another law?
2. Does the available information create a reportable suspicion?
3. Can Northbridge manage the residual correspondent-banking risk within its risk appetite?

Approach

Northbridge’s committee imposes temporary risk controls, requests a detailed transaction population and requires Meridian to provide ownership records, customer-risk segmentation, screening procedures and explanations for selected payments. Compliance performs independent testing and enhances monitoring scenarios. The bank files a report where the statutory threshold is met, without disclosing that fact to Meridian. It also sets a remediation deadline and escalation triggers.

Outcome

Meridian supplies some information but cannot explain several beneficiaries or demonstrate effective monitoring of its digital-asset customers. Northbridge determines that residual risk remains outside appetite and exits the relationship through a controlled process, while preserving records and meeting legal obligations.

Learning points

• A regulated counterparty is not automatically a low-risk counterparty.
• Correspondent banks must understand the respondent’s underlying risk.
• Commercial importance cannot override legal duties or risk appetite.
• Exit decisions should be evidence-based and documented.
• Reporting, confidentiality and customer communication must be handled separately.

11. Critical Evaluation and Contemporary Developments

Global convergence has improved cooperation, but it has not eliminated fragmentation. FATF standards are interpreted differently; national definitions of suspicion and beneficial ownership vary; and enforcement intensity is uneven. Mutual evaluations can identify technical compliance without fully capturing whether controls produce useful intelligence or prevent harm.

Three continuing debates are significant. First, some critics argue that complex global standards impose disproportionate costs on smaller institutions and exclude legitimate customers. Second, transparency initiatives must balance public interest against privacy and cybersecurity. Third, private banks increasingly perform quasi-public gatekeeping functions, raising questions about accountability when accounts are restricted or closed.

Contemporary risks include ransomware, online fraud, misuse of legal persons, trade-based money laundering, professional enablers, instant payments and virtual assets. Effective regulation must therefore be technologically neutral but operationally adaptive. A bank should review typologies, regulatory communications, internal incidents and emerging threats rather than waiting for a new law before updating controls.

Best-Practice Implementation Framework

A postgraduate compliance professional should approach implementation through the following sequence:

1. Map legal entities, products, jurisdictions and delivery channels.
2. Identify applicable laws, regulations, sanctions and supervisory expectations.
3. Conduct and approve an enterprise-wide risk assessment.
4. Translate risks into customer, product and transaction controls.
5. Establish ownership and accountability at board, senior-management and operational levels.
6. Test data quality, model performance, alert handling and reporting.
7. Investigate root causes rather than treating symptoms.
8. Document judgments, limitations, exceptions and remediation.
9. Reassess controls after regulatory change, incidents or material business change.

Chapter Summary

AML/KYC regulation is a layered global architecture. UN conventions establish international legal foundations; FATF provides the principal global standards; Basel integrates financial crime into banking governance and supervision; Wolfsberg develops practical industry guidance; and national authorities convert these principles into enforceable duties. The risk-based approach requires proportionate but effective identification, beneficial ownership verification, ongoing monitoring, reporting and governance. PEP controls, correspondent-banking due diligence, sanctions screening and virtual-asset oversight are specialised applications of this framework. Extraterritorial exposure arises from cross-border entities, currencies, payment systems, customers and conduct. Non-compliance can produce fines, restrictions, criminal consequences, loss of correspondent access and lasting reputational harm. Effective programmes depend on evidence, accountability, independent testing, reliable data and ethical proportionality rather than policies that exist only on paper.

Key Terms

FATF: The global standard-setting body for AML, CTF and proliferation-financing controls.

FATF Recommendations: Forty internationally recognised standards for combating financial crime.

Risk-based approach: Allocation of controls and resources according to assessed risk.

Customer due diligence: Measures used to identify, verify and understand a customer and relationship.

Beneficial owner: The natural person who ultimately owns, controls or benefits from an entity or transaction.

Enhanced due diligence: Additional measures applied to higher-risk relationships or activity.

Politically exposed person: A person entrusted with a prominent public function, together with relevant family or associate relationships under applicable law.

Suspicious transaction report: A confidential report submitted to the competent authority when the legal suspicion threshold is met.

Financial intelligence unit: The national body that receives and analyses financial intelligence reports.

Correspondent banking: Banking services provided by one institution to another institution.

Shell bank: A bank without meaningful physical presence and affiliation with a regulated financial group, subject to legal restrictions.

Hard law: Legally enforceable rules created through legislation, regulation or binding orders.

Soft law: Non-binding standards or guidance that may strongly influence practice and supervision.

Extraterritoriality: Application or effect of a jurisdiction’s law beyond its territorial borders.

Targeted financial sanctions: Measures freezing assets or prohibiting funds or services involving designated persons or entities.

Residual risk: Risk remaining after controls have been applied.

De-risking: Termination or avoidance of relationships based on broad risk categories rather than proportionate assessment.

Model validation: Independent assessment of whether a compliance model is reliable, appropriate and properly implemented.

Review Questions

Short Answer Questions

1. Why are FATF Recommendations influential even though they are not treaties?
2. What is the difference between a customer’s source of wealth and source of funds?
3. Why is beneficial ownership analysis important for legal entities?
4. What is the role of an FIU?
5. State two consequences of ineffective AML/KYC controls.

Long Answer Questions

1. Explain how UN conventions, FATF standards, Basel guidance and Wolfsberg principles interact in the banking sector.
2. Critically evaluate the risk-based approach, including its benefits and limitations.
3. Discuss the responsibilities of a correspondent bank when assessing a respondent bank.
4. Explain how a bank should manage conflicts between home-country and host-country requirements.
5. Analyse why a formal AML/KYC policy may exist while the institution’s control framework remains ineffective.

Analytical / Application Questions

1. A bank discovers that a long-standing corporate customer has changed ownership through several opaque entities. Design a proportionate response, including escalation and documentation.
2. A foreign respondent bank is licensed but cannot explain a rapid increase in payments to high-risk jurisdictions. Assess whether enhanced monitoring, remediation or exit is appropriate.
3. A transaction-monitoring model produces many false positives but misses several suspicious networks. Recommend a governance, data and model-validation programme to address the problem.

Multiple Choice Questions with Answers

Question 1

Which body is the principal global standard setter for AML and counter-terrorist financing?

A. The FATF

B. The Basel Committee

C. The Wolfsberg Group

D. The International Monetary Fund

Correct Answer: A. The FATF

Question 2

Which statement best describes the risk-based approach?

A. Every customer must receive identical controls

B. Controls and resources should reflect assessed risk

C. Only high-value transactions require monitoring

D. Low-risk customers may be exempt from identification

Correct Answer: B. Controls and resources should reflect assessed risk

Question 3

Who is normally the beneficial owner of a company?

A. The external auditor

B. The account-opening employee

C. The natural person who ultimately owns or controls it

D. The company’s registered office

Correct Answer: C. The natural person who ultimately owns or controls it

Question 4

What is the primary role of a financial intelligence unit?

A. To set bank interest rates

B. To receive and analyse financial intelligence reports

C. To approve every customer account

D. To conduct all criminal trials

Correct Answer: B. To receive and analyse financial intelligence reports

Question 5

Which activity is generally associated with enhanced treatment for a PEP relationship?

A. Senior-management approval

B. Automatic account closure

C. Removal of transaction monitoring

D. Waiver of source-of-funds checks

Correct Answer: A. Senior-management approval

Question 6

Why is a respondent bank’s licence insufficient by itself for correspondent-bank due diligence?

A. A licence proves that all transactions are legitimate

B. A licence does not demonstrate the effectiveness of its AML controls

C. Licences are irrelevant to banking relationships

D. Correspondent banks cannot assess respondent institutions

Correct Answer: B. A licence does not demonstrate the effectiveness of its AML controls

Question 7

Which is an example of extraterritorial exposure?

A. A bank applying only its internal dress code

B. A foreign bank being affected by sanctions linked to a payment in a regulated currency system

C. A customer changing an address within one branch

D. A bank publishing its annual report

Correct Answer: B. A foreign bank being affected by sanctions linked to a payment in a regulated currency system

Question 8

What is residual risk?

A. Risk before any controls are applied

B. Risk eliminated by a law

C. Risk remaining after controls are applied

D. Risk unrelated to the institution

Correct Answer: C. Risk remaining after controls are applied

Question 9

Which statement about Wolfsberg principles is most accurate?

A. They are generally private-sector industry guidance rather than legislation

B. They replace national AML statutes

C. They are criminal codes adopted by the UN

D. They apply only to central banks

Correct Answer: A. They are generally private-sector industry guidance rather than legislation

Question 10

Why should AI-assisted AML systems remain subject to human governance?

A. AI can create opacity, bias and data-quality risks

B. AI is legally prohibited in all monitoring

C. Human review makes data quality irrelevant

D. AI systems cannot process transaction information

Correct Answer: A. AI can create opacity, bias and data-quality risks