Customer Due Diligence, AML and Sanctions Compliance

Introduction and context

Financial institutions perform an essential economic function: they accept deposits, provide credit, transfer funds, facilitate trade, and connect customers to national and international payment systems. These services can also be misused to launder criminal proceeds, finance terrorism, evade sanctions, conceal corruption, or disguise fraud. Customer due diligence (CDD), anti-money-laundering (AML) controls, and sanctions compliance are therefore central components of financial crime risk management.

The objective is not simply to collect identity documents. An effective compliance programme seeks to understand who the customer is, who ultimately owns or controls the relationship, why the customer requires financial services, how funds are generated, and whether observed activity is consistent with the customer’s known profile. Controls must be proportionate to risk, responsive to changing circumstances, and supported by reliable evidence.

Rules vary by jurisdiction. Institutions must comply with applicable legislation, regulatory guidance, financial-intelligence-unit requirements, data-protection law, and sanctions regimes in the countries in which they operate. International standards, especially those developed by the Financial Action Task Force (FATF), provide an important reference point but do not replace domestic law.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and stages of customer due diligence.
2. Identify and verify customers, beneficial owners, and persons exercising control.
3. Apply a risk-based approach to CDD and enhanced due diligence (EDD).
4. Explain politically exposed person (PEP), sanctions, and adverse-media screening.
5. Interpret the relationship between transaction monitoring and suspicious-activity reporting.
6. Explain recordkeeping, governance, confidentiality, and escalation requirements.
7. Analyse a practical case involving customer onboarding, ownership opacity, sanctions exposure, and unusual transactions.

1. The financial-crime risk landscape

Money laundering is commonly described as the process of disguising the criminal origin of property or funds. A traditional model identifies three overlapping stages:

• Placement: introducing illicit proceeds into the financial system.
• Layering: conducting transactions designed to obscure the origin, ownership, or movement of funds.
• Integration: making funds appear legitimate through investments, business revenue, property, or other assets.

The model is useful pedagogically, but real cases do not always follow these stages in order. Terrorist financing may involve legally obtained funds used for an illegal purpose. Sanctions evasion may involve concealment of a restricted person, destination, vessel, product, or beneficial owner rather than laundering criminal proceeds. Fraud proceeds may move rapidly through accounts before being withdrawn or transferred internationally.

The principal institutional risks include:

• accepting a fictitious or stolen identity;
• failing to identify the true beneficial owner;
• allowing shell companies to obscure control;
• processing payments for sanctioned persons or jurisdictions;
• overlooking bribery, corruption, tax crime, trafficking, or cybercrime proceeds;
• filing poor-quality or delayed suspicious-activity reports; and
• treating compliance as a documentation exercise rather than an ongoing risk-management process.

2. The CDD lifecycle

CDD is a continuing process rather than a single onboarding event. A practical lifecycle contains six connected activities:

1. Customer identification: obtaining basic identifying information.
2. Customer verification: testing that information against reliable, independent sources.
3. Beneficial-ownership and control analysis: identifying the natural persons who ultimately own or control the customer.
4. Purpose and expected-activity assessment: understanding why the relationship is needed and how it is expected to operate.
5. Risk assessment and classification: determining the level and nature of risk.
6. Ongoing monitoring and review: comparing actual activity with the expected profile and updating information when circumstances change.

CDD applies to individuals, companies, partnerships, trusts, foundations, charities, public bodies, financial institutions, and other legal arrangements. The information required should reflect the legal form and risk of the customer.

Identification and verification

For an individual, relevant information may include full legal name, date and place of birth, nationality, residential address, occupation, tax or national identification number, and contact details. For a legal person, the institution may need the legal name, registration number, registered office, principal business address, legal form, incorporation date, business activity, directors, authorised signatories, ownership structure, and tax information.

Identification means obtaining information. Verification means assessing whether the information is genuine and belongs to the customer. Possible sources include government-issued identity documents, official company registries, regulated credit databases, reliable electronic identity systems, and independent documentary evidence. No source is universally reliable; the institution must consider quality, independence, currency, fraud risk, and the legal requirements of the relevant jurisdiction.

A document that appears authentic may still be insufficient if it does not establish that the person presenting it is the document holder. Remote onboarding therefore requires controls such as liveness checks, document authentication, biometric comparison where lawful, device and IP analysis, and manual review of exceptions. Technology supports judgement; it does not eliminate the need for governance or human escalation.

Beneficial ownership

The beneficial owner is generally the natural person or persons who ultimately own or control a customer or on whose behalf a transaction is conducted. Legal ownership and beneficial ownership are not necessarily the same. A company may be registered in the name of one shareholder while another person exercises control through voting agreements, nominee arrangements, financing, family relationships, or the power to appoint management.

A practical analysis normally follows a cascading approach:

1. Identify natural persons who directly or indirectly own a significant interest, applying the threshold required by applicable law.
2. Identify natural persons who exercise control through voting rights, management rights, contractual arrangements, or other means.
3. If no individual can be identified using ownership or control tests, identify the relevant senior managing official, while documenting the analysis and avoiding the assumption that this person is automatically the true owner.

Ownership percentages should be traced through each layer. If Person A owns 60% of Company X and Company X owns 70% of Company Y, Person A’s indirect economic ownership of Company Y is 42% (60% × 70%). This calculation does not by itself determine control: voting agreements or other rights may produce control even where economic ownership is lower.

Beneficial-ownership analysis is especially important for trusts, private investment vehicles, charities, partnerships, and companies incorporated in secrecy jurisdictions. For a trust, relevant persons may include the settlor, trustees, protector, beneficiaries or class of beneficiaries, and anyone exercising ultimate effective control, subject to applicable law.

3. Risk-based CDD

A risk-based approach directs greater resources toward relationships presenting higher money-laundering, terrorist-financing, proliferation-financing, fraud, or sanctions risk. It does not mean refusing every customer associated with a higher-risk country or business. It means identifying specific risk factors, applying proportionate controls, documenting the reasoning, and monitoring the relationship appropriately.

A useful risk assessment considers four dimensions:

An institution may use a scoring model, but a score is not a substitute for professional judgement. A simple illustrative model could assign ratings from 1 to 5 to customer, geographic, product, and channel risk, then calculate a weighted score:

Here, R is the composite risk score, C, G, P, and D are the four component ratings, and w_c, w_g, w_p, and w_d are weights that sum to 1. This is an internal management tool, not a universal regulatory formula. Its validity depends on appropriate calibration, reliable data, periodic testing, and the ability to override the score when qualitative facts demand escalation.

Risk classification should lead to action. Lower-risk relationships may receive simplified measures only where legally permitted and where there is no suspicion. Standard-risk relationships require ordinary CDD. Higher-risk relationships normally require EDD, senior approval, more frequent review, deeper ownership analysis, stronger source-of-funds evidence, and closer transaction monitoring.

4. Enhanced due diligence

EDD is a set of additional measures applied when the relationship presents elevated risk. It should address the reason for the risk rather than become an indiscriminate request for documents.

EDD may include:

• obtaining detailed information about source of wealth and source of funds;
• understanding the customer’s business model, suppliers, customers, and expected payment corridors;
• identifying all relevant beneficial owners and controllers;
• obtaining evidence of wealth, such as audited accounts, sale agreements, inheritance documents, or tax records where appropriate;
• requiring senior management approval before establishing or continuing the relationship;
• shortening review cycles;
• setting tailored transaction limits or controls;
• conducting enhanced adverse-media and open-source research; and
• reviewing connected persons, counterparties, intermediaries, and related accounts.

Source of wealth concerns how a person accumulated total wealth. Source of funds concerns where the specific money used in a transaction or relationship originated. A customer may have substantial legitimate wealth but be unable to explain the origin of a particular payment. Conversely, a single legitimate transaction does not establish that all of a customer’s wealth is legitimate.

EDD must remain proportionate and lawful. Excessive or irrelevant collection can breach privacy principles, create customer discrimination, and overwhelm investigators with low-value information.

5. Politically exposed persons

A politically exposed person is an individual who is or has been entrusted with a prominent public function. Definitions vary, but commonly include senior political figures, senior government officials, senior judicial or military officials, executives of state-owned enterprises, and important officials of political parties. Family members and known close associates may also be covered under applicable law.

PEP status is not proof of criminal conduct. Public office can create increased exposure to bribery, corruption, misuse of public funds, and influence trading, so PEP relationships generally require risk-sensitive EDD. Typical measures include senior approval, establishing source of wealth and source of funds, enhanced monitoring, and ongoing review.

Institutions should distinguish:

• foreign PEPs, connected with a foreign public function;
• domestic PEPs, connected with a domestic public function; and
• international-organisation PEPs, connected with a senior function in an international organisation.

A person should not normally be treated as permanently high risk solely because former office has ended. The institution should consider residual influence, continuing relationships, and the level of risk presented. Screening systems should be supported by date of birth, nationality, role, employer, and other identifiers to reduce false matches.

6. Sanctions compliance

Sanctions are legal restrictions imposed by governments or international bodies to pursue foreign-policy, security, human-rights, counter-terrorism, or non-proliferation objectives. They may target countries, governments, organisations, vessels, aircraft, companies, individuals, sectors, goods, services, or specific types of transactions.

Sanctions compliance is distinct from AML compliance, although the controls overlap. AML focuses primarily on the origin and purpose of funds and activity. Sanctions controls focus on whether a prohibited person, place, object, service, or transaction is involved. A transaction can be suspicious for AML purposes without involving a sanctioned person, and a sanctions breach can occur without evidence that funds are criminal proceeds.

A sound sanctions programme includes:

1. identifying which sanctions regimes apply to the institution;
2. maintaining current and authoritative screening data;
3. screening customers, beneficial owners, directors, signatories, counterparties, payment parties, vessels, and relevant goods or destinations;
4. applying controls to payments before execution where required;
5. investigating potential matches;
6. blocking, rejecting, freezing, or reporting transactions where legally required; and
7. documenting decisions and escalation.

A name match is not automatically a true match. Analysts should compare identifiers such as date of birth, address, nationality, registration number, passport number, industry, and associated entities. A potential true match must not be resolved merely because the customer appears reputable or because the payment is commercially attractive.

Sanctions screening also requires attention to ownership and control. A company may not be listed by name but may be owned or controlled by a designated person. Institutions must apply the ownership and control rules of the relevant regime. They should also consider indirect routing, trans-shipment, trade documents, unusual vessel changes, shell companies, and attempts to disguise the final destination.

7. Transaction monitoring and suspicious-activity reporting

Transaction monitoring compares observed activity with expected behaviour and identifies patterns requiring investigation. Monitoring may be rule-based, scenario-based, statistical, network-based, or a combination of methods.

Illustrative red flags include:

• rapid movement of funds through newly opened accounts;
• transactions inconsistent with stated business activity;
• unexplained payments involving high-risk jurisdictions;
• multiple accounts funneling funds to one beneficiary;
• structuring transactions to avoid reporting or identification thresholds;
• unexplained third-party payments;
• sudden increases in turnover;
• frequent cash deposits followed by international transfers;
• payments involving sanctioned or high-risk parties; and
• customers unwilling to explain ownership, source of funds, or transaction purpose.

A transaction alert is not the same as a suspicious-activity report (SAR), suspicious-transaction report (STR), or equivalent filing. The alert is an internal detection event. An investigator must assess facts, context, customer profile, documentary evidence, and available intelligence before deciding whether a report is required.

A useful investigation sequence is:

1. Define the alert and relevant period.
2. Establish the customer’s expected activity.
3. Review transactions, counterparties, channels, geography, and linked accounts.
4. Obtain and assess explanations and supporting documents.
5. Search internal records and reliable external sources.
6. Decide whether suspicion is reasonable under applicable law.
7. Escalate, file, restrict, or exit in accordance with policy.
8. Record the rationale, including why an alert was closed if no report is filed.

The legal reporting threshold is jurisdiction-specific. Institutions should not require proof beyond the statutory standard, but they should avoid filing reports based solely on stereotypes or unsupported assumptions. Reports should be timely, factual, sufficiently detailed, and clear about the basis for suspicion. They should not disclose the report or its existence to the customer where tipping-off restrictions apply.

8. Recordkeeping and governance

Records enable regulators, investigators, auditors, and law-enforcement agencies to reconstruct decisions and transactions. Required retention periods vary by law, but records commonly include identification and verification evidence, beneficial-ownership analysis, risk assessments, account files, transaction records, alerts, investigation notes, SAR or STR decisions, filed reports, training records, and approvals.

Good records are:

• accurate and contemporaneous;
• sufficiently detailed to explain the decision;
• protected against unauthorised access or alteration;
• retrievable within a reasonable period; and
• retained for the legally required period after the relationship or transaction ends.

Governance should allocate responsibility among the board, senior management, the money-laundering reporting or compliance officer, business units, operations, technology teams, internal audit, and external assurance providers. The three-lines model is useful: business functions own day-to-day risk, compliance provides oversight and challenge, and internal audit provides independent assurance.

Controls should be tested for effectiveness, not merely existence. Testing may examine false-positive rates, alert ageing, quality of beneficial-ownership files, sanctions-list update speed, escalation outcomes, staff training, and the consistency of decisions across similar cases.

9. Technology, data, and artificial intelligence

Modern institutions use digital identity verification, sanctions-screening platforms, transaction-monitoring systems, graph analytics, natural-language processing, and machine-learning models. These tools can improve speed and identify relationships that manual review may miss.

However, technology creates its own risks. Poor-quality data can produce both false negatives and excessive false positives. A model trained on historical investigations may reproduce past bias. Explainability may be limited, especially where complex machine-learning techniques are used. Vendor systems may not reflect the institution’s products, customer base, or applicable legal requirements.

AI-assisted compliance should therefore include documented purpose, data governance, validation, access controls, human review, outcome testing, change management, and audit trails. The institution remains responsible for decisions outsourced to a vendor. A model output is an investigative signal, not a determination of guilt.

10. Illustrative case: Northbridge Trade Services

Background

Northbridge Trade Services Ltd is a newly incorporated company seeking a business account and international payment services. It states that it imports industrial equipment. The company is owned by a holding company registered abroad. The holding company is owned by a trust, and the customer initially provides only the name of a professional trustee. The proposed account expects monthly turnover of approximately $400,000, with payments to suppliers in three countries.

Problem

During onboarding, the institution identifies several concerns:

• the ownership chain contains multiple legal layers;
• the proposed beneficial owner is not clearly established;
• the director has limited experience in the stated industry;
• the expected activity includes payments through a high-risk corridor;
• an adverse-media search identifies a similar name linked to public procurement allegations; and
• sanctions screening produces a possible match for one overseas supplier.

Analysis

The institution should not automatically reject Northbridge. It should separate the issues and investigate them. The ownership structure requires a documented analysis of the holding company, trust parties, persons exercising control, and any nominee arrangements. The possible PEP or adverse-media match requires reliable identifiers and source evaluation; a similar name alone is insufficient.

The supplier match must be investigated before payment services are activated. The institution should determine whether the supplier is the listed entity, whether it is owned or controlled by a designated person, and which sanctions rules apply. It should also assess the destination, goods, shipping documents, intermediaries, and payment route.

Because the risk is elevated, EDD is appropriate. The institution may request incorporation and trust documents, ownership charts, audited accounts or contracts, invoices, shipping information, source-of-funds evidence, information about customers and suppliers, and an explanation of the procurement allegations. Senior compliance approval should be required before activation.

Approach and outcome

The customer supplies a complete trust deed and ownership chart. The analysis shows that a former public official is the settlor and retains rights to replace the trustee. The official is therefore relevant to the PEP and control analysis. The customer also provides contracts supporting expected turnover, but the proposed supplier is confirmed as majority-owned by a designated person. The institution declines to process payments to that supplier and files the legally required sanctions notification. It continues assessing whether the relationship itself can be maintained under applicable law, documenting the decision and applying enhanced monitoring.

A later review identifies several incoming payments from unrelated companies followed by rapid transfers to personal accounts. The explanations are inconsistent with the stated import business. After investigation, the institution files a suspicious-activity report, restricts certain services, and refers the matter to senior management and the relevant authorities as required.

Learning points

1. Beneficial ownership requires analysis of control, not just registry ownership.
2. PEP status is a risk factor, not evidence of wrongdoing.
3. Sanctions screening must examine ownership, control, goods, routing, and destination.
4. EDD should resolve specific risks through relevant evidence.
5. Transaction monitoring must compare actual activity with the customer’s expected profile.
6. Decisions, including refusal, continuation, escalation, and closure, must be documented.

11. Challenges and limitations

CDD systems face several persistent challenges. Beneficial-ownership data may be incomplete, outdated, or inconsistent across registries. Digital identity fraud can involve synthetic identities assembled from genuine information. Screening systems may generate large volumes of false positives, creating investigator fatigue. Criminals adapt quickly, using professional intermediaries, cryptocurrency, trade-based techniques, mule accounts, and rapidly changing corporate structures.

A risk-based approach can also fail if risk categories become crude proxies for nationality, geography, occupation, or customer type. This may produce financial exclusion and push legitimate customers toward less regulated channels. Institutions should use evidence-based indicators, review outcomes for bias, provide escalation routes, and avoid treating entire communities as inherently suspicious.

Another limitation is fragmented information. One institution may see only part of a network. Information sharing between regulated entities and public authorities can improve detection, but it must respect privacy, confidentiality, due process, and applicable legal restrictions.

12. Professional and ethical implications

Compliance professionals exercise significant power over access to financial services. They must balance public protection with fair treatment, confidentiality, data minimisation, and procedural consistency. Customers should not be told confidential reporting information, but they should receive clear and lawful communication about ordinary documentation requirements and service decisions.

Ethical practice requires resisting commercial pressure to weaken controls, avoiding discriminatory assumptions, protecting confidential data, escalating uncertainty, and maintaining intellectual honesty in investigative conclusions. “Know your customer” should not become “exclude unfamiliar customers.” It should mean making a reasonable, evidence-based assessment of identity, purpose, risk, and activity.

Best-practice framework

An effective CDD, AML, and sanctions programme should:

• be based on documented enterprise-wide risk assessment;
• use reliable and current customer and ownership information;
• apply proportionate controls throughout the relationship;
• integrate onboarding, screening, monitoring, investigations, and reporting;
• maintain clear escalation and approval authorities;
• update sanctions data promptly;
• validate monitoring scenarios and models;
• train staff according to their roles;
• test controls independently; and
• measure outcomes, not merely the number of alerts or documents collected.

Chapter Summary

Customer due diligence is an ongoing process of identifying and verifying customers, determining beneficial ownership, understanding purpose and expected activity, assessing risk, and monitoring relationships. A risk-based approach allocates stronger controls to higher-risk situations while avoiding unjustified exclusion.

Enhanced due diligence addresses elevated risk through deeper ownership analysis, source-of-wealth and source-of-funds review, senior approval, enhanced monitoring, and more frequent reassessment. PEP status requires risk-sensitive controls but is not proof of misconduct. Sanctions compliance is legally distinct from AML: it requires screening and investigation of designated persons, ownership and control, jurisdictions, goods, services, and transaction routes.

Transaction monitoring produces alerts that must be investigated in context. Suspicious-activity reporting depends on the applicable legal threshold and requires timely, factual, well-documented decisions. Strong governance, recordkeeping, data quality, model validation, human judgement, confidentiality, and ethical conduct are essential to an effective programme.

Key Terms

Customer due diligence: Processes used to identify, verify, understand, and monitor a customer.

Anti-money laundering: Measures designed to prevent and detect laundering of criminal proceeds.

Beneficial owner: The natural person who ultimately owns or controls a customer or transaction.

Control: The ability to direct decisions, management, voting, or assets, whether or not accompanied by legal ownership.

Risk-based approach: Allocating controls and resources in proportion to identified risk.

Enhanced due diligence: Additional measures applied to higher-risk relationships.

Source of wealth: The origin of a person’s total accumulated wealth.

Source of funds: The origin of money used in a specific transaction or relationship.

Politically exposed person: A person entrusted with a prominent public function, including relevant family members or close associates under applicable law.

Sanctions: Legal restrictions imposed against specified persons, entities, countries, sectors, goods, services, or activities.

True match: A screening result that refers to the same person or entity as the listed subject.

Transaction monitoring: Review of financial activity to identify patterns requiring investigation.

Suspicious-activity report: A report submitted to the competent authority when the applicable suspicion threshold is met.

Tipping off: Improperly disclosing that a suspicious-activity report or investigation exists.

Adverse media: Negative, credible information from public or other lawful sources.

Structuring: Breaking transactions into smaller amounts to avoid controls or reporting requirements.

Recordkeeping: Creating and retaining evidence of customer, transaction, investigation, and compliance decisions.

Three lines model: Allocation of risk ownership, compliance oversight, and independent audit assurance.

Model risk: The risk that a compliance model is inaccurate, unsuitable, biased, or improperly used.

Review Questions

Short Answer Questions

1. What is the difference between customer identification and customer verification?
2. Why is beneficial ownership different from legal ownership?
3. Define source of wealth and source of funds.
4. Why is a sanctions name match not automatically a true match?
5. What is the purpose of ongoing transaction monitoring?

Long Answer Questions

1. Explain the CDD lifecycle and show how each stage supports the next.
2. Discuss how a financial institution should apply a risk-based approach to customer onboarding.
3. Explain the purpose, scope, and limitations of enhanced due diligence.
4. Compare AML controls with sanctions controls, identifying areas of overlap and difference.
5. Discuss the governance, recordkeeping, and ethical requirements of an effective financial-crime compliance programme.

Analytical / Application Questions

1. A company is owned through three jurisdictions and refuses to identify the individual who controls its bank account. Analyse the risks and recommend an appropriate CDD response.
2. A customer’s transaction volume increases tenfold within two months, with payments to unrelated third parties in several countries. Design an investigation plan and explain when escalation or reporting may be appropriate.
3. A sanctions-screening system produces thousands of alerts, most of which are false positives. Analyse possible causes and propose improvements that preserve detection effectiveness and fair customer treatment.

Multiple Choice Questions with Answers

Question 1

Which statement best describes customer due diligence?

A. Collecting an identity document only when an account is opened

B. An ongoing process of identification, verification, risk assessment, and monitoring

C. Screening transactions only after a suspicious-activity report is filed

D. Refusing all customers connected with foreign jurisdictions

Correct Answer: B. An ongoing process of identification, verification, risk assessment, and monitoring

Question 2

Who is generally the beneficial owner of a company?

A. The company’s external auditor

B. The employee who opens the bank account

C. The natural person who ultimately owns or controls the company

D. The government registrar in the company’s place of incorporation

Correct Answer: C. The natural person who ultimately owns or controls the company

Question 3

What is the principal distinction between source of wealth and source of funds?

A. Source of wealth concerns total accumulated wealth, while source of funds concerns money used in a specific transaction

B. Source of wealth applies only to companies, while source of funds applies only to individuals

C. Source of wealth concerns sanctions, while source of funds concerns identity verification

D. There is no distinction between the two terms

Correct Answer: A. Source of wealth concerns total accumulated wealth, while source of funds concerns money used in a specific transaction

Question 4

Which measure is most characteristic of enhanced due diligence?

A. Removing all monitoring after onboarding

B. Obtaining deeper information about source of wealth and source of funds

C. Accepting customer explanations without supporting evidence

D. Applying the same review frequency to every customer

Correct Answer: B. Obtaining deeper information about source of wealth and source of funds

Question 5

Why does PEP status generally require additional controls?

A. PEPs are automatically presumed to have committed a financial crime

B. Public functions can create increased exposure to corruption and misuse of public resources

C. PEPs are prohibited from holding bank accounts

D. PEP screening replaces beneficial-ownership analysis

Correct Answer: B. Public functions can create increased exposure to corruption and misuse of public resources

Question 6

Which statement about sanctions screening is correct?

A. Every similar name is automatically a confirmed sanctions match

B. Only the account holder needs to be screened

C. A potential match should be investigated using additional identifiers and relevant ownership information

D. Sanctions compliance is identical to AML compliance

Correct Answer: C. A potential match should be investigated using additional identifiers and relevant ownership information

Question 7

What is the proper relationship between a transaction alert and a suspicious-activity report?

A. Every alert must automatically become a report

B. An alert is an internal detection event requiring investigation before a reporting decision

C. A report is filed before any transaction occurs in every case

D. Alerts are created only after law enforcement requests them

Correct Answer: B. An alert is an internal detection event requiring investigation before a reporting decision

Question 8

If Person A owns 60% of Company X and Company X owns 70% of Company Y, what is Person A’s indirect economic ownership of Company Y, ignoring other interests?

A. 10%

B. 42%

C. 60%

D. 70%

Correct Answer: B. 42%

Question 9

Which practice best supports effective compliance governance?

A. Measuring success only by the number of alerts generated

B. Allowing business staff to override sanctions decisions without records

C. Independent testing of controls, documented escalation, and clear accountability

D. Deleting investigation records when an account is closed

Correct Answer: C. Independent testing of controls, documented escalation, and clear accountability

Question 10

Why is human review still important when artificial intelligence is used in AML monitoring?

A. AI systems are legally incapable of processing transactions

B. Human review helps assess context, data quality, explainability, and exceptional circumstances

C. Human review guarantees that no false positives occur

D. AI can only be used for document storage

Correct Answer: B. Human review helps assess context, data quality, explainability, and exceptional circumstances