Chapter 4
Legal, Regulatory and Institutional Frameworks
Bachelors Program in Banking Finance and Insurance
Fraud, Cyber Risk & Financial Crime Management
•
Bachelor
Legal, Regulatory and Institutional Frameworks
Introduction
Financial crime is regulated through a layered system of international standards, national legislation, sectoral rules, institutional controls and supervisory enforcement. No single law or agency can address money laundering, terrorist financing, bribery, sanctions evasion, cybercrime and misuse of personal data. Effective control therefore depends on coordination among governments, regulators, financial institutions, law-enforcement bodies, intelligence agencies, courts and private-sector technology providers.
For banks, insurers and other financial institutions, legal compliance is not merely a formal obligation. It is a risk-management function that protects the integrity of the financial system, preserves confidence, supports correspondent relationships and reduces exposure to criminal, civil, regulatory and reputational consequences. Compliance officers and managers must understand both the substance of applicable rules and the institutional processes through which those rules are implemented.
This chapter explains the principal international and national frameworks governing financial crime. It focuses on anti-money-laundering and counter-terrorist-financing standards, anti-bribery laws, economic sanctions, cyber and data-protection obligations, regulatory reporting, information sharing and supervisory enforcement. Because national laws differ, international instruments are used as common reference points rather than as substitutes for domestic legal advice.
Learning Objectives
By the end of this chapter, students should be able to:
Explain the purpose and structure of the global AML/CFT regime.
Describe the role of the Financial Action Task Force and its Recommendations.
Explain how customer due diligence, beneficial ownership rules and risk-based supervision operate.
Identify major cyber-security, data-protection and record-keeping obligations affecting financial institutions.
Analyse regulatory reporting and information-sharing processes.
Evaluate supervisory enforcement tools and institutional accountability.
Apply the frameworks to a practical financial-crime scenario.
1. The Architecture of Financial-Crime Regulation
Financial-crime regulation operates at four connected levels.
1.1 International standards
International standards establish common expectations and facilitate cooperation. Important institutions include:
the Financial Action Task Force (FATF), which develops global AML/CFT and counter-proliferation-financing standards;
the United Nations, whose Security Council resolutions create obligations relating to terrorism and proliferation sanctions;
the Basel Committee on Banking Supervision, which issues principles relevant to governance, customer due diligence and risk management;
the International Association of Insurance Supervisors, which develops insurance supervisory standards;
the Egmont Group, which supports cooperation among financial intelligence units; and
regional bodies such as the European Union, the Council of Europe and FATF-style regional bodies.
International standards may be binding, persuasive or politically influential depending on the instrument and the jurisdiction. A UN Security Council resolution implemented through domestic law may create enforceable obligations, whereas a supervisory principle may operate through licensing conditions or regulatory expectations.
1.2 National legislation
Domestic legislation defines offences, powers and institutional responsibilities. It commonly covers:
money laundering and terrorist financing offences;
powers and duties of financial intelligence units;
customer identification and beneficial ownership;
suspicious-transaction reporting;
freezing and confiscation of criminal assets;
corruption and bribery;
sanctions implementation;
cybercrime and critical-infrastructure protection;
personal-data processing and cross-border transfers; and
corporate and managerial liability.
A multinational bank must comply with the law of each jurisdiction in which it operates, while also managing conflicts between local requirements. Local counsel and regulatory liaison are therefore essential for high-risk or cross-border activities.
1.3 Supervisory rules and guidance
Regulators translate legislation into operational expectations. These may include rules, notices, codes, examination manuals, enforcement decisions and thematic guidance. Although guidance may not always have the same legal status as legislation, supervisors may treat disregard of it as evidence of inadequate systems and controls.
1.4 Institutional policies and controls
The final layer consists of internal policies, procedures, risk assessments, systems, training, quality assurance and governance. A legal obligation becomes effective only when it is converted into clear operational controls. For example, a statutory requirement to identify beneficial owners requires procedures for collecting ownership information, verifying it, assessing control structures and escalating unresolved uncertainty.
2. Money Laundering, Terrorist Financing and Related Threats
2.1 Money laundering
Money laundering is the process by which the proceeds of crime are disguised, moved, transformed or integrated into the legitimate economy. A traditional model identifies three overlapping stages:
Placement: introducing illicit proceeds into the financial or commercial system.
Layering: conducting transactions designed to obscure the origin, ownership or movement of funds.
Integration: making criminal proceeds appear legitimate through investments, purchases, loans, businesses or other assets.
The model is useful for teaching, but real cases do not always follow this sequence. Criminals may use professional intermediaries, digital assets, trade transactions, shell companies, gambling, real estate or informal value-transfer systems. Money laundering can also involve relatively small transactions conducted repeatedly rather than one large transfer.
2.2 Terrorist financing
Terrorist financing involves collecting, providing, moving or using funds or other assets to support terrorist acts, organisations or individuals. Unlike conventional money laundering, the funds may originate from lawful sources such as salaries, donations or legitimate businesses. The critical question is often the intended use rather than the criminal origin of the money.
This difference affects controls. A low-value transaction may be significant if it connects a customer to a designated person, conflict zone or extremist network. Institutions must therefore assess purpose, destination, networks and behavioural indicators, not only transaction size.
2.3 Proliferation financing
Proliferation financing concerns the provision of funds or financial services connected with the development, acquisition or transfer of nuclear, chemical or biological weapons and their delivery systems. It commonly involves trade finance, shipping, procurement networks, dual-use goods and front companies. Sanctions screening, customer due diligence and trade-document review are particularly important controls.
2.4 Bribery and corruption
Bribery involves offering, promising, giving, requesting or accepting an improper advantage to influence a person performing a function. Corruption may involve public officials, private-sector employees, procurement processes, licensing, customs, courts or state-owned enterprises. Financial institutions may be exposed when they process bribe payments, manage assets for corrupt officials or fail to identify unexplained wealth.
2.5 Sanctions evasion
Sanctions evasion occurs when a person deliberately circumvents restrictions imposed on designated persons, countries, goods, services or sectors. Methods can include front companies, hidden beneficial owners, falsified trade documents, ship-to-ship transfers, indirect routing and manipulation of payment messages.
3. The FATF Framework
The FATF is the principal global standard-setter for AML/CFT and counter-proliferation financing. Its Recommendations provide a framework covering legal systems, preventive measures, institutional arrangements, supervision, transparency, enforcement and international cooperation.
The Recommendations are implemented through national laws and assessed through mutual evaluations and follow-up processes. FATF does not normally prosecute institutions or impose direct penalties on individual banks. Instead, it evaluates whether jurisdictions have adequate technical compliance and whether their systems are effective in practice.
3.1 Risk-based approach
The central principle is the risk-based approach. Institutions should identify, assess and understand their money-laundering, terrorist-financing and proliferation-financing risks, then apply controls proportionate to those risks.
A risk-based approach is not the same as treating every customer identically. It normally considers:
customer type and ownership structure;
products and services;
delivery channels;
geographic exposure;
transaction patterns;
the purpose and expected nature of the relationship; and
information from law-enforcement, supervisory and reputable public sources.
Higher risk may justify enhanced due diligence, senior approval, more frequent reviews, stronger transaction monitoring and closer scrutiny of source of wealth and source of funds. Lower risk may justify simplified measures only where permitted by law and where the risk assessment supports them. Simplification must never be used when there is suspicion or a specific legal prohibition.
3.2 Customer due diligence
Customer due diligence generally requires an institution to:
identify the customer;
verify identity using reliable, independent information;
identify and reasonably verify beneficial owners;
understand the purpose and intended nature of the relationship;
conduct ongoing monitoring; and
maintain appropriate records.
A beneficial owner is the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is conducted. Ownership percentages can be relevant, but control may arise through voting rights, appointment powers, contractual arrangements or other means. A company director or nominee is not automatically the beneficial owner merely because that person appears in corporate documents.
3.3 Politically exposed persons
Politically exposed persons, or PEPs, are individuals entrusted with prominent public functions and, where required by applicable law, their family members and close associates. PEP status is not evidence of criminal conduct. It indicates potential exposure to corruption risk and normally requires additional controls, such as senior management approval, establishing source of wealth and funds, and enhanced ongoing monitoring.
3.4 Correspondent banking
Correspondent banking enables one financial institution to provide services to another institution in a different jurisdiction. Correspondent relationships can create opacity because the respondent bank's customers may indirectly access the correspondent's systems. Controls commonly include understanding the respondent institution's business, reputation, supervision, AML/CFT controls and senior management approval. Institutions should not establish relationships with shell banks or permit their accounts to be used by shell banks.
3.5 Suspicious transaction reporting
Institutions must report suspicions to the competent financial intelligence unit or other designated authority when the legal threshold is met. Suspicion is generally based on reasonable grounds, not proof beyond a reasonable doubt. A report should explain the facts, parties, transactions, timeline, risk indicators and reasons for concern.
Tipping off is the unlawful disclosure that a suspicious-transaction report or related investigation has been made or is contemplated. Internal discussion on a controlled need-to-know basis is different from alerting the customer or an unauthorised third party.
3.6 Record keeping
Records should be sufficient to reconstruct transactions and demonstrate compliance. They commonly include identification documents, ownership information, risk assessments, account files, transaction records, alerts, investigations, reports, training records and management decisions. Retention periods vary by jurisdiction; institutions must follow applicable law and ensure that retention does not conflict with data-minimisation requirements.
4. Anti-Bribery and Corporate Integrity Laws
Anti-bribery regimes often have both domestic and extraterritorial features. Major examples include the United States Foreign Corrupt Practices Act, the United Kingdom Bribery Act and laws implementing the OECD Anti-Bribery Convention. Their precise scope differs, but common themes include prohibiting improper payments, addressing books-and-records failures, regulating intermediaries and encouraging effective compliance programmes.
A sound anti-bribery programme includes:
senior-level commitment;
risk assessment by country, industry, customer and transaction;
controls over gifts, hospitality, travel, donations and sponsorships;
third-party due diligence;
accurate books and records;
segregation of duties and approval controls;
confidential reporting channels;
investigation and remediation procedures; and
disciplinary consequences applied consistently.
Financial institutions should pay particular attention to agents, consultants, introducers, brokers, customs intermediaries and politically connected counterparties. Excessive commissions, vague services, offshore accounts, unusual payment instructions and requests for cash are warning signs, though none alone proves bribery.
5. Economic Sanctions and Asset Freezing
Sanctions may be imposed by the United Nations, regional organisations or individual states. They can include:
asset freezes;
prohibitions on making funds or economic resources available;
restrictions on correspondent banking;
arms or trade embargoes;
restrictions on shipping, aviation or technology;
sectoral financing restrictions; and
travel bans.
Sanctions compliance requires more than screening customer names at onboarding. Institutions should screen customers, beneficial owners, counterparties, payment messages, vessels, addresses and relevant transactions. Screening systems must manage aliases, transliteration differences, false positives, list updates and retrospective searches.
A key distinction is between name matching and ownership or control analysis. A company may be prohibited because it is owned or controlled by a designated person even if the company's name does not appear on a list. The applicable ownership rule differs across regimes, so institutions must apply the relevant law rather than a single global assumption.
When a potential match arises, staff should avoid making funds available until the alert is resolved according to procedure. Possible actions include pausing a payment, escalating to sanctions specialists, requesting additional information, freezing assets where legally required and filing reports with the competent authority.
6. Cybersecurity and Data Protection
Financial-crime compliance increasingly depends on digital systems, but those systems create legal and operational risks. Institutions must protect customer information, transaction data, investigative records and reporting systems from unauthorised access, alteration, loss and disclosure.
6.1 Cybersecurity obligations
Cyber obligations vary by jurisdiction but commonly require:
governance and accountability for information security;
risk assessment and security policies;
access control and least privilege;
authentication and privileged-account management;
encryption where appropriate;
secure software development;
logging, monitoring and vulnerability management;
incident response and business continuity;
third-party and cloud-provider oversight; and
notification of serious incidents within prescribed periods.
Cybercrime laws may criminalise unauthorised access, interference with systems, data interception, malware distribution and digital fraud. Sectoral resilience laws may also require financial institutions to test critical services and report operational incidents.
6.2 Data-protection principles
Data-protection laws commonly require a lawful basis for processing personal data, purpose limitation, data minimisation, accuracy, security, retention controls and respect for data-subject rights. AML/CFT laws may provide a legal basis for processing and reporting, but they do not eliminate the need for security, proportionality and governance.
A practical tension exists between privacy and financial-crime prevention. Institutions must retain enough information to detect and investigate crime while avoiding unnecessary collection or indefinite retention. Access to suspicious-activity files should be restricted because disclosure may breach both reporting secrecy and privacy obligations.
Automated monitoring and artificial intelligence introduce additional issues: data quality, explainability, bias, human review, model validation, auditability and accountability for erroneous decisions. An institution should not assume that a vendor is legally responsible for all outcomes. The regulated entity normally remains accountable for its control environment.
7. Regulatory Reporting and Institutional Information Sharing
7.1 Types of reporting
Financial institutions may be required to submit:
suspicious transaction or activity reports;
large-cash or threshold reports;
sanctions-related notifications;
regulatory returns and risk data;
cyber-incident reports;
data-breach notifications;
prudential and operational-resilience reports; and
disclosures required by tax-transparency or beneficial-ownership regimes.
Reporting thresholds, deadlines, confidentiality rules and recipient agencies differ across jurisdictions. A report should be timely, factually accurate, internally approved where required and supported by retained evidence.
7.2 The role of the financial intelligence unit
A financial intelligence unit receives, analyses and disseminates financial information relating to suspected money laundering, terrorist financing and associated offences. It may be administrative, law-enforcement, judicial or hybrid in structure. The FIU is not normally a substitute for the institution's own investigation and does not usually tell the reporting institution whether a suspicion has been confirmed.
7.3 Information sharing
Information sharing can occur internally within a financial group, between institutions, with regulators, with FIUs and with law-enforcement agencies. It can improve detection of networks that are invisible to one institution acting alone. However, sharing must respect legal authority, confidentiality, purpose limitation, cross-border-transfer rules, professional secrecy and data security.
Institutions should establish formal protocols covering who may share information, what can be shared, how requests are authenticated, how disclosures are recorded and how customer rights are managed. Informal sharing through unsecured email or personal messaging applications creates significant legal and cyber risk.
8. Supervision and Enforcement
Supervisors use a combination of preventive, corrective and punitive tools. These may include:
licensing and authorisation conditions;
risk-based inspections;
requests for information;
thematic reviews;
remediation directions;
business restrictions;
temporary management or independent monitors;
administrative fines;
licence suspension or withdrawal;
public censures; and
referrals for criminal prosecution.
Enforcement decisions commonly consider the seriousness and duration of the breach, customer or market harm, senior-management involvement, benefit obtained, cooperation, self-reporting, remediation and previous history. A large penalty is not the only risk. Restrictions on growth, loss of correspondent banking, management disqualification and reputational damage may be more consequential.
Three lines of responsibility
A useful governance model divides responsibility as follows:
First line: business units own customer and transaction risks and operate controls.
Second line: compliance and risk functions set standards, advise, challenge and monitor.
Third line: internal audit independently evaluates governance and control effectiveness.
The board and senior management remain responsible for culture, resources, risk appetite and remediation. Delegation of tasks does not necessarily eliminate accountability.
Figure: The layered relationship between international standards, national institutions, supervision and internal controls.
9. Applied Case: Northbridge Bank and a Complex Trade Network
This is an illustrative case.
Background
Northbridge Bank provides trade finance and correspondent services. It receives an application from Meridian Imports, a company incorporated locally but owned through companies in three jurisdictions. Meridian requests a letter of credit for electronic components shipped from a free-trade zone to a country subject to heightened sanctions risk.
Problem
The customer provides incomplete information about its beneficial owners. The invoice price is substantially above comparable market prices, the shipping route is indirect, and one intermediary has a name similar to a person on a sanctions list. A relationship manager argues that the transaction is commercially urgent and that the customer is a long-standing client.
Analysis
The case combines several risks:
opaque ownership and possible nominee arrangements;
trade-based money laundering indicators;
potential sanctions exposure;
a high-risk intermediary;
pressure to bypass normal review; and
possible data-sharing and reporting consequences.
No single indicator proves a violation. However, the combination justifies enhanced due diligence and escalation. The bank should identify and verify the natural persons who ultimately own or control Meridian, understand the purpose and economics of the trade, verify the goods and counterparties, review shipping and payment information, resolve the sanctions alert and assess the intermediary.
Approach and solution
The bank pauses the transaction under its escalation procedure without informing the customer that a suspicious report may be filed. Compliance requests reliable ownership documents, independent corporate records, contracts, transport documents, evidence of pricing and information about the end user. Sanctions specialists investigate the possible match and apply the relevant ownership and control rules. Trade-finance specialists compare the documentation with the commercial rationale.
If concerns remain and the legal threshold is met, the bank files the appropriate report with the FIU and makes any required sanctions notification. It documents the decision, preserves evidence, reviews related transactions and considers whether the wider customer relationship should be restricted or exited. The bank also assesses whether the intermediary or relationship manager breached internal policy.
Outcome
The review identifies an undisclosed beneficial owner connected to a designated party and materially inconsistent trade documents. The bank rejects the transaction, applies legally required controls, reports the matter and conducts a look-back review of earlier transactions. It strengthens screening of ownership structures and introduces mandatory second-line approval for high-risk trade-finance cases.
Learning points
Customer history does not replace current risk assessment.
Sanctions screening must include ownership and control, not only names.
Trade documentation can reveal financial-crime risk even when payments appear ordinary.
Escalation decisions should be evidence-based and documented.
Reporting, privacy and tipping-off obligations must be managed together.
10. Implementation Challenges and Best Practices
10.1 Common challenges
Institutions face several recurring difficulties:
fragmented data across business units and countries;
poor-quality beneficial-ownership information;
excessive false positives in screening;
alert backlogs and inconsistent investigations;
overreliance on outsourced vendors;
rapidly changing sanctions and typologies;
conflicts between secrecy, privacy and reporting laws;
insufficient specialist staff; and
weak board understanding of financial-crime risk.
10.2 Good-practice framework
A mature programme should include:
an enterprise-wide risk assessment linked to the institution's products, customers and geographies;
clear board-approved risk appetite and accountability;
proportionate onboarding and ongoing due diligence;
reliable beneficial-ownership processes;
calibrated transaction monitoring and sanctions screening;
documented investigation and reporting standards;
secure information-sharing arrangements;
independent testing and model validation;
scenario-based staff training;
prompt remediation of control weaknesses; and
metrics that measure outcomes, not merely activity.
Useful management information may include alert ageing, investigation quality, reporting timeliness, repeat control failures, unresolved ownership cases, sanctions-screening performance, training completion and audit findings. Volume alone is a poor measure of effectiveness: a high number of alerts may indicate either strong detection or badly calibrated systems.
11. Contemporary Developments
Financial-crime regulation is evolving in response to digital assets, instant payments, artificial intelligence, virtual IBANs, embedded finance, remote onboarding and geopolitical conflict. Regulators increasingly expect institutions to understand technology-enabled risks while avoiding indiscriminate de-risking.
Digital-asset businesses may fall within AML/CFT obligations depending on national law. Their risks can include pseudonymous transfers, cross-border activity, mixers, decentralised services and rapid movement between platforms. At the same time, blockchain analytics are not infallible and require contextual investigation.
Artificial intelligence may improve anomaly detection, entity resolution and document analysis. It may also create discriminatory outcomes, explainability problems, data leakage and automation bias. Human accountability, validation, record keeping and override controls remain necessary.
The future direction of regulation is toward greater operational resilience, stronger beneficial-ownership transparency, closer public-private cooperation and more integrated supervision. Institutions that treat compliance as a static checklist will struggle. Effective programmes must be dynamic, intelligence-led and connected to enterprise risk management.
Chapter Summary
Financial-crime control is a layered system linking international standards, national law, supervisory expectations and institutional procedures. FATF provides the central global AML/CFT framework, built around risk assessment, customer due diligence, beneficial-ownership transparency, suspicious-transaction reporting, record keeping and international cooperation. Terrorist financing and proliferation financing differ from conventional money laundering because lawful funds or specialised procurement networks may be involved.
Anti-bribery laws require controls over public-official exposure, intermediaries, gifts, books and records and third parties. Sanctions regimes require timely screening, ownership-and-control analysis, freezing or rejection where required and careful reporting. Cybersecurity and data-protection obligations require secure processing, access control, incident response, proportionality and governance of automated tools.
Financial intelligence units, regulators, law-enforcement agencies and private institutions must share information lawfully and securely. Supervisors can impose remediation, restrictions, fines, licence consequences and criminal referrals. Ultimately, boards, senior managers, business units, compliance functions and internal audit share responsibility for an effective control environment. The strongest programmes are risk-based, documented, proportionate, intelligence-led and continuously tested.
Key Terms
Anti-money laundering (AML): Laws, regulations and controls designed to prevent and detect the laundering of criminal proceeds.
Beneficial owner: The natural person who ultimately owns or controls a customer or transaction.
Counter-terrorist financing (CFT): Measures designed to prevent funds or assets being used to support terrorism.
Customer due diligence (CDD): Identification, verification, understanding and monitoring of customers and relationships.
Enhanced due diligence (EDD): Additional measures applied to higher-risk customers, products or transactions.
Financial Action Task Force (FATF): International body that develops global AML/CFT and proliferation-financing standards.
Financial intelligence unit (FIU): National body that receives, analyses and disseminates financial intelligence.
Integration: The stage at which illicit proceeds are made to appear legitimate.
Layering: Transactions intended to obscure the origin or ownership of illicit funds.
Money laundering: Concealing, converting or using criminal proceeds to make them appear legitimate.
Politically exposed person (PEP): A person entrusted with a prominent public function, together with relevant family or associate categories under applicable law.
Proliferation financing: Financing connected with the development, acquisition or transfer of weapons of mass destruction or delivery systems.
Risk-based approach: Allocating controls according to the nature and level of identified financial-crime risk.
Sanctions: Legal restrictions imposed on persons, entities, countries, goods, services or activities.
Suspicious transaction report: A report submitted to a competent authority when a legally defined suspicion arises.
Tipping off: Unlawfully revealing that a suspicious-activity report or investigation exists or may exist.
Trade-based money laundering: Using trade transactions, documents or pricing to move or disguise criminal value.
Three lines model: Governance allocation among business operations, risk and compliance oversight, and independent internal audit.
Review Questions
Short Answer Questions
What are the three traditional stages of money laundering?
Why is beneficial-ownership identification important?
What is the purpose of a financial intelligence unit?
How does terrorist financing differ from conventional money laundering?
What is meant by tipping off?
Long Answer Questions
Explain how international standards, national legislation, supervisory rules and internal controls interact.
Discuss the principal elements of a risk-based AML/CFT programme.
Compare anti-bribery compliance and sanctions compliance, identifying common and distinct controls.
Explain how data-protection and financial-crime obligations can conflict and how an institution should manage the relationship.
Evaluate the roles of the board, business units, compliance and internal audit in financial-crime governance.
Analytical / Application Questions
A bank identifies a customer whose ownership structure includes several offshore companies, an unusually complex payment route and a possible sanctions match. Design an escalation and investigation process, explaining the legal and governance issues.
A transaction-monitoring system generates a very high number of alerts but produces few useful reports. Analyse possible causes and recommend improvements without weakening risk coverage.
A multinational financial group receives a request from a foreign law-enforcement agency for customer information. Explain the factors it should consider before sharing the information and identify the relevant internal controls.
Multiple Choice Questions with Answers
Question 1
Which institution is the principal global standard-setter for AML/CFT and proliferation-financing standards?
A. Financial Action Task Force
B. World Trade Organization
C. International Monetary Fund only
D. International Criminal Court
Correct Answer: A. Financial Action Task Force
Question 2
Which person is the beneficial owner of a company?
A. The employee who opens the bank account
B. The natural person who ultimately owns or controls the company
C. The external auditor in every case
D. The bank relationship manager
Correct Answer: B. The natural person who ultimately owns or controls the company
Question 3
What is the principal purpose of a suspicious transaction report?
A. To prove guilt beyond reasonable doubt
B. To notify the competent authority of a legally relevant suspicion
C. To inform the customer that an investigation has begun
D. To replace all internal investigations
Correct Answer: B. To notify the competent authority of a legally relevant suspicion
Question 4
Which statement best describes terrorist financing?
A. It always involves proceeds from a completed crime
B. It may involve funds obtained from lawful sources
C. It concerns only cash transactions
D. It is identical to tax evasion
Correct Answer: B. It may involve funds obtained from lawful sources
Question 5
Which control is especially relevant to politically exposed persons?
A. Automatic rejection in every case
B. Senior approval and examination of source of wealth and funds
C. Removal of all transaction-monitoring controls
D. Disclosure of the customer's status to the public
Correct Answer: B. Senior approval and examination of source of wealth and funds
Question 6
What does tipping off generally involve?
A. Updating a customer record
B. Unlawfully revealing the existence or possible existence of a suspicious-activity report
C. Submitting a regulatory return
D. Conducting an internal audit
Correct Answer: B. Unlawfully revealing the existence or possible existence of a suspicious-activity report
Question 7
Which is a core data-protection principle relevant to financial-crime compliance?
A. Unlimited collection of personal data
B. Purpose limitation and appropriate security
C. Permanent retention of every document
D. Public disclosure of investigative files
Correct Answer: B. Purpose limitation and appropriate security
Question 8
Which body normally receives and analyses suspicious transaction reports?
A. The financial intelligence unit
B. The marketing department
C. The external insurance broker
D. The payment beneficiary
Correct Answer: A. The financial intelligence unit
Question 9
Under the three lines model, which function provides independent assurance?
A. The front-office business unit
B. The customer
C. Internal audit
D. The transaction beneficiary
Correct Answer: C. Internal audit
Question 10
Why must sanctions screening consider ownership and control?
A. A company may be restricted through its relationship with a designated person even if its own name is not listed
B. Names are never relevant to sanctions compliance
C. Ownership information is used only for marketing
D. Screening is required only after a payment is completed
Correct Answer: A. A company may be restricted through its relationship with a designated person even if its own name is not listed