Compliance, Fraud and Information Protection

Introduction and Context

Banking depends on trust. Customers must believe that deposits, payments, personal information and credit decisions will be handled lawfully and securely. Society, in turn, expects banks not to facilitate money laundering, terrorist financing, bribery, sanctions evasion, fraud or abuse of consumers. Compliance is therefore not merely a legal department’s responsibility; it is an operating discipline embedded in products, processes, technology, governance and professional judgment.

This chapter examines the principal controls used by banks to identify, prevent, investigate and report financial crime while protecting customer information. It adopts a risk-based approach: controls should be proportionate to the nature, scale and complexity of the risk. The precise legal obligations differ by jurisdiction, so institutions must apply the relevant statute, regulator guidance and reporting thresholds in the country or countries in which they operate. International standards, especially those associated with the Financial Action Task Force (FATF), provide a widely used reference point but do not replace domestic law.

The central challenge is to balance three objectives:

1. Financial integrity: preventing the banking system from being used for crime.
2. Customer and market fairness: treating customers fairly and protecting them from deception, discrimination and unsuitable products.
3. Information resilience: preserving confidentiality, integrity and availability of information and services.

Learning Objectives

By the end of this chapter, students should be able to:

• explain the purpose and stages of AML/CFT compliance;
• apply customer due diligence and enhanced due diligence using a risk-based framework;
• distinguish transaction monitoring, sanctions screening, fraud detection and suspicious activity reporting;
• describe escalation, investigation, recordkeeping and reporting responsibilities;
• explain anti-bribery, consumer-protection and data-privacy requirements;
• evaluate cybersecurity and information-protection controls;
• analyse an integrated compliance and fraud scenario and recommend proportionate action.

1. Compliance as a Risk-Governance System

Compliance means adhering to applicable laws, regulations, supervisory expectations, internal policies and ethical standards. A modern compliance system is broader than checking documents. It includes risk identification, preventive controls, detective controls, corrective action, management information, independent testing and continuous improvement.

A useful governance model is the three lines model:

The board and senior management remain accountable for an effective compliance culture. A compliance officer may administer a programme, but responsibility cannot be delegated away by the board or business managers.

A risk-based approach begins with inherent risk, meaning exposure before controls, and considers residual risk, meaning exposure after controls. A simple conceptual relationship is:

This is not a universal numerical law. It is a management model: “control effect” cannot always be measured in the same units as inherent risk, and risks may interact rather than subtract mechanically. In quantitative risk registers, institutions may use scored models, but the assumptions, weighting and data quality must be documented.

Risk assessments commonly consider customer type, geography, product, delivery channel, transaction behaviour, legal-entity structure, volume, velocity and exposure to cash or cross-border activity. A high-risk classification should lead to stronger controls, not automatic rejection. Equally, a low-risk classification does not eliminate the obligation to respond to unusual activity.

2. AML and CFT Foundations

2.1 Money laundering

Money laundering is the process of disguising the criminal origin of assets so that they appear legitimate. The traditional stages are:

• Placement: introducing proceeds into the financial system, for example through cash deposits or purchases.
• Layering: moving funds through transactions, accounts, entities or jurisdictions to obscure the audit trail.
• Integration: using apparently legitimate wealth to acquire assets, invest or conduct business.

The stages may overlap, occur in a different order or be absent altogether. Terrorist financing differs because funds may originate from lawful or unlawful sources; the concern is their intended use to support terrorism. Counter-terrorist financing (CFT) therefore focuses particularly on purpose, networks and movement of value, not only on the source of wealth.

2.2 Customer due diligence

Customer due diligence (CDD) generally involves:

1. identifying and verifying the customer;
2. identifying beneficial owners and understanding ownership and control;
3. understanding the purpose and intended nature of the relationship;
4. establishing a risk profile;
5. conducting ongoing monitoring;
6. keeping records for the legally prescribed period.

A beneficial owner is the natural person who ultimately owns or controls a customer, directly or indirectly, or on whose behalf a transaction is conducted. Legal ownership and beneficial ownership are not necessarily the same. Complex chains of companies, trusts or nominees require analysis rather than simple collection of incorporation documents.

The customer may be an individual, company, partnership, trust, charity, public body or financial institution. Identification should use reliable, independent sources. Digital identity systems can improve efficiency, but the bank must understand assurance levels, fraud risks, liveness testing, false matches and the governance of outsourced identity providers.

2.3 Enhanced and simplified due diligence

Enhanced due diligence (EDD) is appropriate when risk is higher. Measures may include obtaining additional information about source of wealth and source of funds, clarifying ownership and control, requiring senior approval, increasing review frequency and applying more intensive transaction monitoring.

Politically exposed persons (PEPs), their family members and close associates require risk-sensitive treatment. PEP status is not proof of wrongdoing and should not automatically result in account closure. It indicates potential exposure to corruption and requires appropriate assessment and controls.

Simplified due diligence may be permitted for demonstrably lower-risk situations under local law. It must not be used where there is suspicion of money laundering or terrorist financing, or where legal restrictions prohibit it.

2.4 Ongoing monitoring

CDD is not a one-time event. Monitoring compares actual activity with expected activity and relevant risk indicators. Indicators may include unexplained cash intensity, rapid movement of funds, unusual cross-border payments, transactions inconsistent with a customer’s business, use of multiple accounts, sudden changes in behaviour, or payments involving opaque intermediaries.

An indicator is not a conclusion. A legitimate explanation may exist, and a suspicious transaction does not necessarily establish a crime. Staff must document the facts, relevant context, enquiries and rationale for decisions.

3. Transaction Monitoring and Suspicious Activity Reporting

Transaction monitoring may be manual, automated or hybrid. Rules-based systems can identify thresholds, frequency, velocity, geographic patterns and structuring. Behavioural analytics can compare activity with a customer’s historical profile or peer group. Machine-learning tools may rank alerts, but they do not remove the need for explainability, validation, human review and governance.

A typical alert-management process is:

1. Detection: a rule, model or employee identifies unusual activity.
2. Triage: the alert is prioritised and duplicate or clearly irrelevant alerts are removed under controlled procedures.
3. Investigation: the analyst reviews transactions, customer information, counterparties, history and external information permitted by law.
4. Disposition: the alert is closed with documented rationale, escalated for further review or referred to the MLRO/compliance officer.
5. Reporting decision: the authorised officer decides whether a suspicious activity report (SAR), suspicious transaction report (STR) or equivalent must be filed.
6. Action and feedback: controls may be strengthened, the relationship reviewed and lessons incorporated into monitoring scenarios.

A SAR/STR is a report to the competent authority when the applicable legal suspicion threshold is met. It is not a criminal accusation and does not require proof beyond reasonable doubt. Employees must not disclose (“tip off”) the existence or content of a report where prohibited by law. The bank should preserve confidentiality, restrict access and maintain a clear audit trail.

Recordkeeping should show what was known at the time, who made the decision, which policies were applied and what evidence supported the outcome. Poorly documented closure decisions create regulatory and litigation risk even when the conclusion is reasonable.

Worked application: an alert

A small import business normally receives ten domestic payments per month and pays known suppliers. Over three days it receives 42 payments from unrelated individuals, immediately transfers most funds to a newly added overseas beneficiary and provides vague invoices when contacted.

The pattern is concerning because it is inconsistent with the expected profile, involves many third parties and shows rapid onward movement. The analyst should not conclude solely from volume that laundering has occurred. The analyst should verify the business purpose, counterparties, invoices, beneficial ownership, source of funds and relevant sanctions information. If reasonable suspicion remains, the case should be escalated to the authorised reporting officer, who determines whether a SAR/STR is required. The customer should not be told that a report has been filed where disclosure is prohibited.

4. Sanctions Compliance

Sanctions are legal restrictions imposed by states or international bodies. They may target countries, governments, entities, vessels, aircraft, sectors, goods, services or named individuals. A bank’s obligations depend on applicable law, licensing arrangements, currency, branch location, correspondent relationships and the jurisdictional connection of a transaction.

Sanctions controls generally include:

• screening customers, beneficial owners, counterparties and payment messages;
• identifying ownership and control, not merely exact name matches;
• screening at onboarding and periodically thereafter;
• screening transactions before execution where required;
• investigating possible matches using reliable data;
• blocking, rejecting or freezing activity when legally required;
• escalating potential breaches and preserving evidence.

A false positive occurs when a legitimate customer or transaction resembles a listed person or entity. A false negative occurs when a true match is missed. Poorly governed tuning can increase either risk. Screening systems therefore need data-quality controls, transliteration logic, alias management, threshold governance and independent testing. A bank must never treat a screening result as a final legal determination without appropriate review.

Sanctions evasion may involve intermediaries, transshipment, altered payment descriptions, shell companies or changes in beneficial ownership. Staff should consider the full transaction context rather than relying only on name matching.

5. Fraud Risk Management

Fraud is intentional deception or unauthorised conduct for financial or other benefit. Banking fraud can be internal or external and may involve customers, employees, agents, suppliers or organised networks. Common categories include payment fraud, account takeover, identity fraud, card fraud, cheque fraud, loan fraud, insider abuse, procurement fraud and cyber-enabled social engineering.

Fraud controls follow a lifecycle:

• Prevent: segregation of duties, authentication, transaction limits, secure design, employee screening and customer education.
• Detect: anomaly detection, reconciliation, confirmation calls, device intelligence, whistleblowing and exception reports.
• Respond: stop or recall payments where possible, secure accounts, preserve evidence, notify relevant functions and support affected customers.
• Recover: investigate, pursue recovery, improve controls and consider disciplinary or legal action.

A strong control environment applies the principle that no individual should control initiation, approval, execution and reconciliation of a high-risk transaction. This is segregation of duties. Exceptions must be documented and independently reviewed.

Fraud analytics can use rules, supervised classification, network analysis and behavioural models. Model performance should be assessed with measures suited to the use case. For example, precision is the proportion of flagged cases that are truly relevant:

Recall is the proportion of relevant cases detected:

These formulas assume clearly defined labels and a representative evaluation sample. A fraud team may prefer high recall for severe losses, while excessive false positives can overwhelm investigators and inconvenience legitimate customers. The appropriate balance depends on harm, legal duties, operational capacity and customer impact.

6. Anti-Bribery and Corruption

Bribery involves offering, promising, giving, requesting or accepting an improper advantage to influence conduct. Corruption risks arise in public-sector dealings, licensing, procurement, intermediaries, gifts and hospitality, charitable contributions, sponsorships and facilitation payments.

A bank should maintain:

• a clear prohibition on bribery and improper payments;
• risk-based due diligence on agents, introducers and vendors;
• approval and recording rules for gifts, hospitality and expenses;
• controls over charitable donations and political contributions;
• accurate books and records;
• confidential reporting and protection against retaliation;
• training and disciplinary procedures.

A payment can be suspicious even if described as a consulting fee. The bank should examine the service, contract, beneficiary, rate, timing, approvals and relationship to a decision-maker. Anti-bribery controls overlap with AML controls because corrupt proceeds may be concealed through accounts, companies or intermediaries.

7. Consumer Protection and Conduct

Compliance is also concerned with how customers are treated. Consumer-protection duties commonly address transparency, suitability or responsible lending, fair marketing, complaints handling, privacy, accessibility, vulnerable customers and unauthorised transactions.

Important conduct principles include:

• communicate fees, risks, conditions and interest calculations clearly;
• avoid misleading or aggressive sales practices;
• assess affordability and avoid irresponsible lending;
• design products for an identified target market;
• provide accessible complaint and redress channels;
• investigate unauthorised payments fairly and promptly;
• protect customers from scams without unreasonably denying legitimate access.

Banks face a difficult balance in scam cases. Strong friction, such as confirmation steps or delayed execution, can reduce losses but may frustrate customers and create exclusion. Controls should be proportionate, explainable and reviewed for disparate effects on older customers, persons with disabilities, migrants and customers with limited digital access.

8. Data Privacy and Information Protection

Privacy concerns the lawful and fair handling of personal information. Information protection is the broader discipline of preserving confidentiality, integrity and availability. Banks usually process identity data, financial records, biometric information, communications, transaction metadata and credit information, making governance especially important.

Core privacy principles found in many legal regimes include:

• lawful, fair and transparent processing;
• specified and legitimate purposes;
• data minimisation;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• accountability.

AML, fraud prevention and regulatory reporting may provide a lawful basis for processing, but the bank must still limit access, use information for appropriate purposes, meet notice requirements where applicable, and respect restrictions on disclosure and retention. Privacy does not mean deleting records that law requires the bank to retain; nor does a retention duty justify indefinite and uncontrolled use.

A privacy impact assessment is appropriate for high-risk processing, such as biometric onboarding, large-scale monitoring or automated decisions. It should identify data flows, purposes, risks, safeguards, affected persons and residual risk.

Access should follow least privilege: users receive only the access necessary for their role. Controls include strong authentication, role-based access, encryption, logging, secure disposal, data-loss prevention and third-party oversight. Encryption protects data in transit and at rest, but it does not replace access control or secure application design.

9. Cybersecurity and Operational Resilience

Cybersecurity protects systems and information against unauthorised access, alteration, disruption and destruction. A practical control framework includes:

• asset inventory and data classification;
• secure configuration and patch management;
• multi-factor authentication;
• network segmentation;
• endpoint and email protection;
• vulnerability assessment and penetration testing;
• continuous logging and security monitoring;
• tested backup and recovery procedures;
• incident response and crisis communication;
• supplier and cloud-service risk management.

The confidentiality–integrity–availability (CIA) model provides a basic analytical lens. A ransomware incident may threaten availability and integrity; credential theft may threaten confidentiality and transaction integrity; a denial-of-service attack primarily threatens availability. Controls should be mapped to the specific threat rather than applied as a checklist.

Incident response normally includes preparation, detection and analysis, containment, eradication, recovery and post-incident learning. Notification obligations may apply to regulators, law enforcement, customers or privacy authorities. The bank should not delay legally required notification while waiting for every technical detail, but initial notifications must be accurate and appropriately qualified.

Third parties create concentration and supply-chain risks. Contracts should address security standards, audit rights, incident notification, subcontracting, data location, continuity and exit arrangements. Outsourcing a function does not outsource accountability.

10. Escalation, Investigation and Decision Quality

Escalation frameworks should define triggers, authority, time limits and documentation. Triggers may include suspected money laundering, sanctions matches, material fraud, cyber incidents, employee misconduct, privacy breaches, repeated control failures and serious customer harm.

A sound investigation separates facts, assumptions and conclusions. Investigators should ask:

• What happened, when and through which channel?
• Which accounts, systems, customers and third parties were involved?
• What information was available at the time?
• Which rule, law or policy may apply?
• Is immediate containment necessary?
• Who has authority to decide, report, freeze, reimburse or notify?
• What evidence must be preserved?
• Could the control failure affect other customers?

Escalation should be neither excessive nor suppressed. Over-escalation creates alert fatigue and delays, while under-escalation allows harm to continue. Senior management information should include meaningful trends: alert volumes, ageing, SAR/STR decisions, sanctions false positives, fraud losses, recovery, complaints, access violations, incidents, overdue remediation and repeat findings. Metrics should be interpreted carefully; a high number of reports may indicate strong detection, weak controls, or both.

11. Governance of Technology and Artificial Intelligence

Automation can improve consistency and scale, but it introduces model, data, privacy and conduct risks. Before deploying an AI or analytics model, a bank should define its purpose, data sources, decision rights, performance measures, human oversight, validation process and retirement criteria.

Key controls include:

• data quality and representativeness testing;
• independent validation before production use;
• monitoring for drift and changing criminal typologies;
• explainable alert reasons;
• access and change controls;
• bias and disparate-impact assessment;
• human review for consequential decisions;
• documented override and appeal processes;
• secure treatment of prompts, training data and outputs.

Generative AI should not be given unrestricted access to confidential customer data. Outputs may be inaccurate, disclose sensitive information or create fabricated investigative narratives. If used for summarising cases, the source record, reviewer and verification process must remain clear.

12. Illustrative Integrated Case

Background. Meridian Bank, a fictional regional bank, onboards Northstar Trading Ltd, a newly incorporated importer. The company has two beneficial owners, one of whom is a close associate of a senior foreign public official. Northstar requests internet banking, international payments and a corporate card. During the first month, the account receives many small payments from individuals, sends funds to a logistics company in a high-risk jurisdiction and generates a sanctions-screening alert involving a similarly named company.

Problem. The bank must determine whether the activity reflects legitimate trade, laundering, sanctions evasion, fraud or a combination. It must also protect customer information and avoid unjustified account restriction.

Analysis. Onboarding should have recorded the PEP-related risk, ownership structure, expected activity, trade model and source of wealth. The transaction pattern is inconsistent with the stated business purpose. The sanctions alert requires resolution using ownership, address, registration and transaction data rather than name similarity alone. The volume and speed of payments may indicate layering or a payment-fraud network. Staff must preserve evidence and avoid tipping off the customer if a report is made.

Approach. The relationship manager escalates to AML compliance and sanctions operations. Compliance conducts EDD, including obtaining lawful source-of-funds information and commercial documents. Sanctions staff compare identifiers and determine whether the alert is a false positive or a true match under applicable rules. Fraud investigators analyse device, beneficiary and payment-network links. Cybersecurity staff review access logs after an unusual administrator login. The MLRO decides whether a SAR/STR is required, while legal and senior management determine whether transactions must be held, rejected, blocked or permitted under law. Customer communications are carefully limited to legitimate operational explanations.

Outcome. In this illustrative case, the sanctions alert is cleared as a false positive, but the source-of-funds documents are inconsistent and several “customers” are linked to the same device. The bank files the legally required report, restricts relevant activity under applicable law, preserves records, reviews possible victim accounts and strengthens monitoring. It does not publicly accuse Northstar or disclose the report. An independent review identifies weaknesses in beneficial-owner verification and alert linkage.

Learning points. The case demonstrates that AML, sanctions, fraud, privacy and cybersecurity controls intersect. No single alert proves misconduct. Effective action requires coordinated investigation, documented reasoning, proportionate restrictions, confidentiality, lawful reporting and remediation of the underlying control weaknesses.

13. Challenges and Limitations

Compliance programmes face several structural limitations. Criminal methods change faster than static rules. Data may be incomplete, inconsistent or unavailable across institutions. Cross-border legal conflicts can restrict information sharing. Excessive alerts can overwhelm investigators, while poorly calibrated controls miss sophisticated activity. De-risking—terminating whole categories of customers or jurisdictions rather than managing specific risks—may reduce short-term exposure but can exclude legitimate customers and drive activity outside regulated channels.

Human judgment remains essential but is vulnerable to bias, incentives and fatigue. Independence, rotation, training, quality assurance and protected escalation channels help reduce these weaknesses. Regulators increasingly expect evidence that controls work in practice, not merely that policies exist.

Best-Practice Checklist

A bank should:

• maintain a current enterprise-wide financial-crime and information-risk assessment;
• identify beneficial owners and understand purpose and expected activity;
• apply proportionate CDD and EDD;
• validate and tune monitoring and screening systems;
• document alert decisions and protect SAR/STR confidentiality;
• integrate fraud, AML, sanctions, privacy and cyber investigations;
• enforce segregation of duties and least privilege;
• test incident response, continuity and recovery;
• govern vendors, cloud services and AI models;
• measure customer harm, false positives, losses, recovery and remediation;
• provide effective training, whistleblowing and independent assurance;
• review controls after incidents, typology changes and regulatory developments.

Chapter Summary

Compliance, fraud prevention and information protection form an integrated banking-control system. AML and CFT programmes identify customers, beneficial owners, purpose and risk, then monitor activity and report reasonable suspicion through authorised channels. Sanctions controls require risk-sensitive screening of customers, ownership, counterparties and transactions. Fraud management combines prevention, detection, response and recovery, supported by segregation of duties and analytics.

Anti-bribery controls address improper advantages, intermediaries, gifts, records and reporting. Consumer protection requires fair treatment, clear information, responsible products, accessible complaints processes and proportionate scam controls. Privacy requires lawful, purpose-limited and secure processing, while cybersecurity protects confidentiality, integrity and availability through layered technical and organisational safeguards. Effective governance depends on board oversight, clear escalation, independent assurance, reliable records and accountable use of technology. The risk-based approach does not eliminate risk; it makes decisions proportionate, explainable and responsive to changing threats.

Key Terms

AML: Anti-money laundering measures designed to prevent the financial system being used to disguise criminal proceeds.

CFT: Counter-terrorist financing measures addressing the movement or use of funds for terrorism.

Beneficial owner: The natural person who ultimately owns or controls a customer or transaction.

Customer due diligence (CDD): Identification, verification, risk assessment and ongoing understanding of a customer.

Enhanced due diligence (EDD): Additional controls applied where money-laundering or other risks are higher.

Politically exposed person (PEP): A person entrusted with a prominent public function, together with relevant associated persons under applicable law.

Transaction monitoring: Review of account and payment activity to identify unusual or potentially suspicious behaviour.

SAR/STR: Suspicious activity report or suspicious transaction report submitted to a competent authority.

Sanctions: Legal restrictions imposed on specified persons, entities, activities, goods, services or jurisdictions.

False positive: A legitimate event incorrectly identified as a match or suspicious case.

False negative: A relevant match or suspicious case that a control fails to detect.

Fraud: Intentional deception or unauthorised conduct for financial or other benefit.

Segregation of duties: Dividing incompatible responsibilities among different people or systems.

Bribery: Offering, giving, requesting or accepting an improper advantage to influence conduct.

Consumer protection: Rules and practices that promote fair treatment, transparency, suitability and redress.

Data minimisation: Collecting and using no more personal data than necessary for a legitimate purpose.

Least privilege: Giving a user or system only the access needed for authorised tasks.

Operational resilience: The ability to continue critical services, respond to disruption and recover effectively.

Model risk: The possibility that an analytical or AI model produces unreliable, biased or misunderstood results.

Residual risk: Risk remaining after controls have been applied.

Review Questions

Short Answer Questions

1. What are the three traditional stages of money laundering?
2. Why is beneficial-owner identification important?
3. What is the difference between a false positive and a false negative?
4. State two purposes of enhanced due diligence.
5. What does the principle of least privilege require?

Long Answer Questions

1. Explain how a bank should design a risk-based AML/CFT programme from onboarding through ongoing monitoring and reporting.
2. Compare transaction monitoring, sanctions screening and fraud detection, including their different purposes and limitations.
3. Discuss the relationship between privacy protection, AML recordkeeping and lawful information sharing.
4. Explain the three lines model and evaluate the responsibilities of the board, business units, compliance and internal audit.
5. Describe a comprehensive cybersecurity and operational-resilience programme for a retail bank.

Analytical / Application Questions

1. A new corporate customer receives numerous small payments from unrelated individuals and rapidly transfers funds overseas. Design an investigation and escalation plan, identifying the evidence required and the decisions that must be documented.
2. A sanctions-screening system generates a very high number of false positives, causing payment delays. Analyse the risks of reducing screening sensitivity and recommend governance controls for tuning the system.
3. A bank uses an AI model to decline or delay suspected scam payments. Evaluate the model’s fraud, privacy, fairness, explainability and consumer-protection risks, and propose a control framework before deployment.

Multiple Choice Questions with Answers

Question 1

Which activity is most directly associated with identifying the natural person who ultimately controls a company?

A. Beneficial-owner identification

B. Password rotation

C. Liquidity forecasting

D. Interest-rate repricing

Correct Answer: A. Beneficial-owner identification

Question 2

Which statement best describes terrorist financing risk?

A. It always involves funds obtained from a criminal offence

B. It concerns only cash deposits

C. Funds may come from lawful sources but be intended to support terrorism

D. It is identical to sanctions screening

Correct Answer: C. Funds may come from lawful sources but be intended to support terrorism

Question 3

What is the appropriate interpretation of a transaction-monitoring alert?

A. It proves that a crime has occurred

B. It is an indicator requiring proportionate review

C. It must always result in account closure

D. It can be ignored if the customer is long-established

Correct Answer: B. It is an indicator requiring proportionate review

Question 4

Which action is generally associated with enhanced due diligence?

A. Removing ongoing monitoring

B. Obtaining additional source-of-funds information

C. Allowing anonymous accounts

D. Disclosing a SAR to the customer

Correct Answer: B. Obtaining additional source-of-funds information

Question 5

What is a false positive in sanctions screening?

A. A true listed person missed by the system

B. A legitimate customer incorrectly identified as a possible match

C. A transaction deliberately structured to evade sanctions

D. A confirmed sanctions breach

Correct Answer: B. A legitimate customer incorrectly identified as a possible match

Question 6

Which control most directly reduces the risk that one employee can initiate and approve a fraudulent payment?

A. Segregation of duties

B. A marketing campaign

C. A higher overdraft limit

D. Longer customer statements

Correct Answer: A. Segregation of duties

Question 7

In the formula Precision = True positives ÷ (True positives + False positives), what does precision measure?

A. The proportion of flagged cases that are truly relevant

B. The proportion of relevant cases that were missed

C. The total number of customer complaints

D. The average time to recover a payment

Correct Answer: A. The proportion of flagged cases that are truly relevant

Question 8

Which principle requires collecting no more personal data than is necessary for a legitimate purpose?

A. Data minimisation

B. Unlimited retention

C. Open access

D. Automatic disclosure

Correct Answer: A. Data minimisation

Question 9

Which body normally provides independent assurance under the three lines model?

A. The sales team

B. The customer-service desk

C. Internal audit

D. The payment beneficiary

Correct Answer: C. Internal audit

Question 10

Why should an AI-based compliance model receive human oversight?

A. Because models can never process data

B. Because outputs may be inaccurate, biased or insufficiently explainable

C. Because automation is prohibited in all banking activities

D. Because human review eliminates all false positives

Correct Answer: B. Because outputs may be inaccurate, biased or insufficiently explainable