Privacy, Cybersecurity and Other Supporting Functions

Part of: Controls, Investigations and the AFC Organization (ACAMS CAMS)

Anti-financial crime (AFC) compliance does not operate in isolation. The AML/CFT function depends on, and must coordinate with, a network of supporting functions inside the organization: privacy and data protection, cybersecurity and information security, information technology, legal, human resources, internal audit, fraud, sanctions and third-party risk management. The CAMS exam tests whether you understand how these functions interact with the AML program, where their priorities can conflict, and how a compliance professional should navigate those conflicts. This guide explains why this topic matters, what each supporting function does, how the pieces fit together in practice, and how to approach exam questions on the subject.

1. Why This Topic Is Important

Financial crime has converged. Money laundering, fraud, cybercrime and sanctions evasion are no longer separate problems. Ransomware proceeds must be laundered. Business email compromise (BEC) produces wire transfers that flow through correspondent networks. Account takeovers create mule accounts. A suspicious transaction may be the laundering leg of a cyber attack, and a cyber event may be the first indicator of a laundering scheme. Regulators such as FinCEN have explicitly stated that AML and cybersecurity teams should share information so that suspicious activity reports (SARs) capture cyber-related indicators. A CAMS-certified professional is expected to understand this convergence.

Privacy law constrains how AML works. AML/CFT depends on collecting, storing, analyzing and sometimes sharing large volumes of personal data. Data protection regimes (for example the EU General Data Protection Regulation and its national equivalents) impose limits on collection, retention, cross-border transfer and secondary use of personal information. The FATF itself recognizes in Recommendation 2 that AML/CFT policies should be compatible with data protection and privacy rules. Misunderstanding this tension leads to either regulatory breaches on the privacy side or weakened AML controls on the compliance side.

The AML program is only as strong as its weakest supporting pillar. Transaction monitoring depends on IT data quality. Customer due diligence depends on access controls and record retention. Investigations depend on legal advice about privilege and subpoenas. Culture depends on HR screening, training and performance incentives. Internal audit validates that everything actually works. Exam questions on this domain often disguise a supporting-function problem as an AML problem, and the best answer identifies the real root cause.

2. What the Topic Covers: The Supporting Functions

2.1 Privacy and Data Protection

The privacy function (often led by a Data Protection Officer or Chief Privacy Officer) is responsible for ensuring that personal data is processed lawfully, fairly and securely. Key concepts you should know:

- Lawful basis for processing. AML processing is normally justified by a legal obligation (the institution must comply with AML laws) and by legitimate interests in preventing crime. This means customer consent is generally not the basis for CDD and monitoring, and customers cannot simply withdraw from AML scrutiny.
- Purpose limitation and data minimization. Data collected for AML should be used for AML and related compliance purposes, not repurposed for marketing without a separate legal basis. Institutions should collect what is necessary and proportionate.
- Retention. FATF Recommendation 11 requires AML records to be retained for at least five years. Privacy law requires that data not be kept longer than necessary. The AML retention obligation generally prevails, but the institution must document the justification and dispose of data securely when the retention period ends.
- Data subject rights. Individuals may have rights to access, correct or erase their data. Most regimes provide exemptions where disclosure would prejudice the prevention or detection of crime. Critically, an institution must not disclose that a SAR has been filed or that an investigation is under way: this would constitute tipping off. Privacy requests therefore require careful coordination between the privacy and AML teams.
- Cross-border data transfers. Global institutions sharing customer data between affiliates for group-wide AML purposes (encouraged by FATF Recommendation 18) must respect transfer restrictions and local secrecy laws. Group-wide information sharing policies should address how to meet both objectives.
- Information sharing with other institutions and authorities. In the United States, Section 314(b) of the USA PATRIOT Act provides a safe harbor for voluntary sharing between financial institutions regarding possible money laundering or terrorist financing, provided the institution registers and follows the rules. Section 314(a) governs requests from law enforcement via FinCEN. Elsewhere, public-private partnerships and similar frameworks operate within data protection rules.
- Data security. Privacy law requires appropriate technical and organizational measures to protect personal data, which links directly to the cybersecurity function.

2.2 Cybersecurity and Information Security

Cybersecurity protects the confidentiality, integrity and availability of systems and data. For the AML professional, the relevant points are:

- Cyber-enabled financial crime. Typologies include ransomware (payments often demanded in virtual assets, then laundered through mixers, exchanges and chain-hopping), business email compromise (fraudulent wire instructions impersonating executives or vendors), account takeover (credential theft followed by rapid fund movement), phishing and malware, synthetic identity fraud, money mule recruitment and payment-card fraud.
- Cyber indicators in SARs. FinCEN advisories (notably the 2016 advisory on cyber events and cyber-enabled crime) make clear that institutions should report cyber events that involve or affect transactions, and should include technical indicators such as IP addresses with timestamps, device identifiers, virtual asset wallet addresses, email addresses, malware hashes and file names. Reporting a cyber event that would not independently require a SAR may still be appropriate when it affects financial transactions.
- Collaboration between AML and cyber teams. Regulators expect the BSA/AML function and the information security function to communicate. Cyber teams hold indicators that help investigators; investigators hold transaction patterns that help the cyber team identify compromised accounts. Joint case reviews, shared alert channels and inclusion of cyber staff in financial crime committees are good practice.
- Information security controls supporting AML. Access controls and segregation of duties (so that staff cannot alter monitoring thresholds or delete alerts without a trail), audit logging, encryption of customer data at rest and in transit, change management for monitoring systems, and business continuity so that monitoring and reporting continue after an incident.
- Incident response. When a breach occurs, the institution may have notification duties to regulators, customers and law enforcement. A breach of customer data can itself drive downstream fraud and laundering, so AML teams should be informed and may need to heighten monitoring on affected accounts.
- Insider threat. Employees are a vector for both cyber and AML risk. Pre-employment screening, access rights aligned to roles, monitoring of privileged users and whistleblower channels address this.

2.3 Information Technology and Data Management

Transaction monitoring, sanctions screening, customer risk rating and regulatory reporting all rely on complete, accurate and timely data. Key issues: data lineage and data quality (missing fields, inconsistent customer identifiers, truncated names that defeat screening), system integration after mergers, model governance and validation of monitoring scenarios, documented tuning and threshold changes, and vendor-supplied systems that must be independently validated. Regulatory enforcement actions frequently cite data feeds that were never connected to monitoring or screening systems.

2.4 Legal

The legal department advises on regulatory interpretation, responds to subpoenas, grand jury requests and regulatory inquiries, manages litigation holds, advises on privilege in investigations, negotiates with regulators on enforcement actions, and reviews contracts for third parties. Compliance and legal are distinct functions: legal advises on what the law requires, compliance designs and operates the program. In an investigation, legal helps determine what may be disclosed to whom, while compliance decides whether a SAR is warranted.

2.5 Human Resources

HR supports the AML program through background and criminal checks on prospective employees (and periodic re-screening of staff in sensitive roles), onboarding and ongoing AML training records, incorporation of compliance behavior into performance evaluations and compensation, disciplinary processes for control breaches, and protection of whistleblowers. A strong compliance culture, set by the board and senior management, is reinforced or undermined by HR practices such as rewarding revenue without regard to control failures.

2.6 Internal Audit

Internal audit is the third line of defense. It provides independent, risk-based testing of the AML program, including the supporting functions, and reports to the board or audit committee rather than to the compliance officer. Audit scope should cover transaction monitoring system logic, data integrity, CDD file quality, SAR decision quality, training effectiveness, and remediation of prior findings. FATF requires an independent audit function to test the system (Recommendation 18).

2.7 Fraud, Sanctions and Financial Crime Convergence

Many institutions are moving toward integrated financial crime units (sometimes called FRAML or AFC) that combine AML, fraud, sanctions and anti-bribery. Benefits include shared data, shared investigators and a single view of customer risk. Risks include loss of specialist expertise and confusion over distinct legal obligations (for example, fraud losses may be a business decision, whereas SAR filing is a legal requirement). Exam questions may ask you to recognize when fraud findings should feed into AML reporting.

2.8 Third-Party and Vendor Risk Management

Institutions outsource KYC utilities, screening tools, cloud hosting and even parts of monitoring. The institution remains responsible for compliance. Vendor due diligence, contractual rights to audit, data protection clauses, subcontractor oversight and exit plans are all expected. Reliance on third parties for CDD (FATF Recommendation 17) is permitted under conditions, but ultimate responsibility stays with the institution.

3. How It Works: The Three Lines of Defense and Governance

The standard governance model places business units as the first line (owning customer relationships and performing initial CDD and escalations), compliance and risk functions such as AML, privacy, information security and legal as the second line (setting policy, monitoring, advising and challenging), and internal audit as the third line (independent assurance). Senior management and the board sit above all three, with ultimate accountability.

In practice, coordination happens through committees (financial crime risk committee, data governance committee, cyber risk committee), through formal escalation paths, through shared risk assessments and through documented policies that resolve conflicts in advance. A well-designed program will have written procedures for, among other things: how a privacy access request involving a customer under investigation is handled; how cyber incidents are escalated to the AML team; how monitoring system changes are approved and tested; how employee misconduct is reported; and how group-wide information sharing complies with local law.

4. A Worked Scenario

A bank's information security team detects that several retail customers' online banking credentials were compromised through a phishing campaign. Within days, funds from these accounts are transferred to newly opened accounts at another institution and then withdrawn in cash or converted to virtual assets.

How the supporting functions should work together: the cyber team provides IP addresses, device IDs and timestamps; the fraud team quantifies losses and blocks further transfers; the AML team files SARs that describe both the cyber event and the money movement, including the technical indicators, and considers 314(b) sharing with the receiving institution; legal advises on customer notification and any law enforcement engagement; privacy confirms the lawful basis for sharing data and ensures notifications do not tip off subjects; IT reviews whether monitoring rules should be tuned to detect similar patterns; HR and internal audit assess whether any insider involvement or control gap contributed. The correct exam answer in such a scenario will almost always favor coordination, documented escalation and comprehensive reporting over siloed handling.

5. Exam Tips: Answering Questions on Privacy, Cybersecurity and Other Supporting Functions

Tip 1: Remember that AML obligations usually have a statutory basis that overrides consent. If a question suggests a customer can refuse monitoring or demand deletion of CDD records during the retention period, the answer that honors the AML legal obligation while respecting privacy safeguards is correct. Never choose an option that deletes required records to satisfy a privacy request.

Tip 2: Tipping off always wins. When a privacy request, a customer complaint or an internal inquiry would reveal that a SAR was filed or that an investigation is under way, the correct response protects the confidentiality of the SAR. Look for answers that involve consulting legal and compliance and applying the crime-prevention exemption, not answers that fully disclose.

Tip 3: Cyber events can be reportable. If a scenario describes a cyber attack affecting transactions, the best answer typically involves filing a SAR (or equivalent report) that includes cyber indicators, and sharing information between the cyber and AML teams. Do not assume cyber incidents belong only to the IT department.

Tip 4: Include technical indicators in reports. Questions may ask what information should be in a cyber-related SAR. Expect IP addresses with time stamps, device identifiers, email addresses, virtual asset wallet addresses, malware details and a description of the attack method. Vague descriptions are inferior answers.

Tip 5: Responsibility cannot be outsourced. If a vendor fails, the institution is accountable. The correct answer emphasizes due diligence, oversight, audit rights and contingency plans, never shifting blame to the vendor.

Tip 6: Know the three lines of defense. Internal audit is independent and reports to the board or audit committee; it does not design controls or make SAR decisions. Compliance is second line. Business units are first line. Questions that place audit in an operational role are describing a weakness.

Tip 7: Identify the root cause. Many scenario questions describe a monitoring failure that is really a data or IT problem (for example a new product feed never connected to the monitoring system), or a culture problem that is really an HR or incentive problem. The best answer fixes the root cause rather than the symptom.

Tip 8: Escalate and document. When options differ mainly in process, prefer the answer that escalates to the appropriate function (legal, compliance officer, board), documents the decision and preserves evidence. Avoid answers involving unilateral action by a junior employee or informal undocumented handling.

Tip 9: Balance, do not sacrifice. ACAMS favors answers that reconcile competing obligations. If one option ignores privacy entirely and another ignores AML entirely, the correct option is usually the one that satisfies the AML requirement in a privacy-compliant manner, for example sharing only necessary data through a lawful channel such as 314(b) or a group-wide policy that respects local law.

Tip 10: Watch for distractors about consent and marketing. Using AML-collected data for marketing without a separate basis is a privacy breach. Using it for fraud prevention or sanctions screening is generally compatible. Know the difference.

Tip 11: Insider threat links HR, cyber and AML. If a scenario involves an employee bypassing controls, overriding alerts or accessing accounts without a business need, the answer should involve HR, information security and compliance together, plus consideration of a SAR if the employee's conduct involves suspicious transactions.

Tip 12: Convergence is a trend, not a replacement. Integrated financial crime units are encouraged, but questions may test whether you still understand the separate legal duties of AML reporting, sanctions blocking and fraud recovery. Keep the obligations distinct even when the teams are combined.

6. Sample Practice Questions

Question 1. A customer under active SAR review submits a data subject access request asking for all information the bank holds about him, including any internal reports. What should the bank do?
A. Provide all records, including the SAR, because privacy law grants access rights.
B. Refuse the request entirely and close the account.
C. Provide the personal data the customer is entitled to while withholding the SAR and investigation materials under the applicable crime-prevention exemption, with legal and compliance involved.
D. Delay the response until the investigation concludes and then disclose everything.
Answer: C. Disclosing the SAR would constitute tipping off. Privacy regimes provide exemptions for information that would prejudice crime prevention. The institution should still honor the portions of the request it lawfully can.

Question 2. The information security team detects that a corporate client's email was compromised and that wire instructions sent to the bank were altered by the attacker. Funds were already transferred. Which action is MOST appropriate for the AML function?
A. Treat the matter as an IT incident with no AML implications.
B. File a SAR describing the business email compromise, include the available cyber indicators such as IP addresses and email headers, and coordinate with the fraud and cyber teams.
C. Wait for the client to file a police report before taking any action.
D. Notify only the correspondent bank by telephone.
Answer: B. Regulatory guidance treats cyber-enabled transactions as reportable and expects technical indicators to be included, with cross-functional coordination.

Question 3. An audit finds that transactions from a newly launched mobile payment product were never fed into the transaction monitoring system for eighteen months. What is the root cause most likely to be identified?
A. Inadequate customer due diligence.
B. Weak change management and data governance between IT and compliance for new products.
C. Insufficient SAR narrative quality.
D. Failure of the board to approve the AML policy.
Answer: B. The failure lies in the supporting IT and product governance process that should ensure new data sources are connected to monitoring before launch.

Question 4. A global bank wants its regional AML teams to share customer alert information with the group financial crime unit in another country. What is the BEST approach?
A. Share everything freely because AML always overrides privacy.
B. Prohibit all sharing to avoid privacy risk.
C. Implement a group-wide information sharing policy that defines the lawful basis, limits data to what is necessary, addresses local secrecy and transfer rules, and secures the data in transit and at rest.
D. Ask each customer for consent before sharing.
Answer: C. FATF Recommendation 18 calls for group-wide sharing, and privacy law requires proportionality, lawful basis and security. Consent is not an appropriate or reliable basis for AML processing.

7. Key Terms to Memorize

Tipping off; data minimization; purpose limitation; lawful basis; retention period (five years minimum under FATF); data subject access request; crime-prevention exemption; FATF Recommendation 2 (data protection compatibility), 11 (record keeping), 17 (reliance on third parties), 18 (internal controls, group-wide programs, independent audit); Section 314(a) and 314(b); cyber-enabled crime; business email compromise; account takeover; ransomware; cyber indicators (IP address, device ID, wallet address, hash); three lines of defense; segregation of duties; model validation; vendor due diligence; insider threat; whistleblower protection; integrated financial crime (FRAML).

8. Summary

Privacy, cybersecurity and the other supporting functions are the infrastructure on which an effective AML program rests. The exam expects you to recognize that AML obligations are legally grounded and generally prevail over consent-based privacy arguments, that tipping off must never occur, that cyber events affecting transactions are reportable with technical indicators, that responsibility cannot be outsourced, that internal audit must remain independent, and that the best answers reconcile competing duties through coordination, escalation and documentation rather than through siloed or unilateral action. Master these principles and the scenario-based questions in this domain become far more predictable.