Requests for Information and Customer Communication

Overview
Requests for Information (RFIs) and customer communication sit at the heart of the Controls, Investigations, and the AFC Organization domain of the CAMS exam. Nearly every investigation an AML/AFC team conducts depends on obtaining information that the compliance function does not already hold: from the relationship manager, from the customer, from a correspondent bank, from another financial institution, or in response to a demand from law enforcement or a regulator. How that information is requested, how the customer is spoken to, and how confidentiality is protected can determine whether an investigation succeeds, whether the institution breaks the law, and whether a legitimate customer relationship is preserved or needlessly damaged.

Why This Topic Is Important
1. Legal exposure: Most jurisdictions criminalize tipping off a customer that a suspicious activity report (SAR/STR) has been or may be filed. A poorly worded RFI or an unguarded conversation by a front-line employee can constitute tipping off, exposing the employee and the institution to prosecution and regulatory sanction.
2. Investigative integrity: If a subject learns they are under scrutiny, they can move funds, destroy records, or alter behavior. The investigation, and possibly a law enforcement case, is compromised.
3. Quality of decision-making: Investigators cannot decide whether activity is suspicious without context. Well-structured RFIs close the gap between what the transaction monitoring system shows and what the customer is actually doing.
4. Regulatory expectations: Supervisors expect documented, timely, risk-based requests, and they expect institutions to respond completely and promptly to lawful requests from authorities (for example, section 314(a) requests in the United States, production orders, subpoenas, or FIU requests).
5. Customer and reputational risk: Aggressive, unexplained, or repeated requests frustrate legitimate customers and can cause de-risking disputes or complaints. Professional communication protects the franchise while fulfilling compliance duties.
6. Exam weight: CAMS scenario questions frequently test judgment: who should contact the customer, what may be said, what must never be said, and what to do when a customer refuses to cooperate.

What a Request for Information Is
An RFI is a formal or semi-formal request for documents, explanations, or data needed to assess money laundering, terrorist financing, sanctions, or fraud risk. RFIs flow in several directions, and the exam expects you to recognize each type:

Internal RFIs - Compliance or the financial crime investigations unit asks the business line (relationship managers, branch staff, trade finance operations, private bankers) for what they know about the customer: the stated purpose of the account, expected activity, meeting notes, documents already on file, and any recent interactions.

Customer-facing RFIs - Requests to the customer for KYC refresh documents, source of funds or source of wealth evidence, invoices and contracts supporting transactions, explanations of counterparties, beneficial ownership information, or clarification of unusual activity.

Correspondent and interbank RFIs - A correspondent bank asks a respondent bank about a payment, a counterparty, or the underlying customer of a wire. Respondent banks must have procedures to respond fully and quickly, because failure to respond is itself a red flag that can lead to termination of the correspondent relationship. Standardized questionnaires such as the Wolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ) are a form of structured RFI.

Institution-to-institution information sharing - Under safe-harbor frameworks such as USA PATRIOT Act section 314(b) in the United States, or public-private partnerships such as the UK's JMLIT, financial institutions may voluntarily share information about possible money laundering or terrorist financing. Participation generally requires registration or notice, a legitimate AML purpose, and strict use limitations.

Requests from authorities - Law enforcement, regulators, FIUs, and courts issue subpoenas, production orders, warrants, grand jury requests, 314(a) lists, and supervisory information requests. The institution is the recipient of the RFI and must verify authenticity, assess legal basis and scope, respond within deadlines, preserve records, and keep the request confidential from the customer.

How the RFI Process Works
Step 1 - Trigger and gap analysis. An alert, referral, negative news hit, correspondent inquiry, or periodic review surfaces a question the current file cannot answer. The investigator defines precisely what is unknown: Who is the counterparty? What is the economic rationale? Where did the funds originate? Is the beneficial owner correctly identified?

Step 2 - Identify the best source. Good practice is to exhaust internal and open sources first: account opening records, prior reviews, transaction history, public registries, adverse media, and internal systems. Contacting the customer is usually a later step, not a first step, because it carries tipping-off risk and because the customer may give a self-serving answer.

Step 3 - Draft the request. An effective RFI is specific, neutral, proportionate, and time-bound. It asks for defined documents or facts rather than open-ended narratives, states a business or regulatory reason (for example, periodic review or regulatory KYC requirements), and never references suspicion, monitoring alerts, investigations, law enforcement, or SAR filing. Leading questions and accusatory language are avoided.

Step 4 - Choose the channel and messenger. In most institutions the relationship manager or front-line staff member delivers the request to the customer, using language approved or scripted by compliance. This preserves the normal relationship and reduces the chance of tipping off. Compliance typically does not reveal its involvement. Where the relationship manager is a subject of concern or has a conflict, compliance may bypass the business line and use an independent channel.

Step 5 - Document everything. Date sent, what was asked, who asked, what was received, what remains outstanding, and the investigator's assessment of the response. Documentation supports the SAR narrative, regulatory examination, and any later legal process.

Step 6 - Evaluate the response. Investigators test whether the explanation is plausible, consistent with the customer profile, corroborated by independent evidence, and complete. Vague, evasive, inconsistent, or partial responses are themselves red flags. Legitimate customers can normally explain their own transactions; difficulty doing so, reluctance to provide documents, or hostility to routine questions all heighten suspicion.

Step 7 - Decide and escalate. Possible outcomes include closing the case with documented rationale, filing a SAR/STR, imposing account restrictions, enhanced monitoring, updating the customer risk rating, or recommending exit of the relationship. A refusal to provide information is frequently a basis for a SAR and for relationship termination, but the decision to exit should follow policy, be approved at the right level, and be timed so as not to interfere with law enforcement (some jurisdictions and agencies may ask the institution to keep an account open).

Principles of Customer Communication
Never tip off. Do not disclose that a SAR has been or will be filed, that an alert fired, that compliance is investigating, or that law enforcement has made contact. This prohibition extends to indirect hints such as sudden account closure explained by reference to suspicious activity.
Use a plausible, consistent rationale. Frame requests as routine due diligence, regulatory requirements, periodic review, or updating records. All staff who may interact with the customer should give the same message.
Train and script the front line. Front-line employees are the most likely to be asked by a customer why information is needed, or why a payment was delayed. They need approved responses, a clear escalation path, and the understanding that they must not speculate.
Stay professional and proportionate. Requests should match the risk; a low-risk retail customer should not receive a private-bank-style source-of-wealth interrogation for an ordinary transaction.
Be careful with written channels. Emails and letters create a permanent record; language must be reviewed to ensure nothing in them could be read as tipping off or as a defamatory accusation.
Handle exit conversations carefully. If the institution decides to end a relationship, the customer is told that the institution is exercising its right to close the account under the terms of the agreement, typically without explaining the underlying reason. Legal and compliance should approve the wording.

Responding to Requests From Authorities
Verify the request is genuine and issued under valid legal authority. Route it to a designated point of contact (often the AML/BSA officer or legal department). Determine scope and deadline; seek clarification or negotiate scope through legal counsel if the request is overly broad. Search all relevant systems and affiliates within the legal perimeter. Preserve records subject to legal hold. Deliver complete, accurate, organized responses, and keep a log. Do not inform the customer. If a 314(a) request produces a match, report the match to FinCEN as instructed; the request itself does not require a SAR, but the institution should review the customer's activity and file a SAR if independently warranted.

Cross-Border and Data Protection Considerations
Information sharing across borders may be restricted by bank secrecy laws, data protection regimes such as GDPR, and local blocking statutes. Group-wide compliance programs should establish lawful mechanisms to share information needed for AML purposes among affiliates while respecting these constraints. On the exam, the correct answer typically balances the AML obligation with the legal limits, often by involving legal counsel and using recognized gateways rather than ignoring either obligation.

Common Red Flags Arising From RFIs
Customer refuses or delays providing information; provides documents that appear altered or inconsistent; offers explanations that change over time; becomes angry or threatens to move business when asked routine questions; a respondent bank fails to answer a correspondent inquiry or gives generic answers; the relationship manager resists or discourages contact with the customer; the customer asks whether a report has been filed or whether the bank is working with authorities.

How to Answer Exam Questions on This Topic
CAMS questions in this area are scenario-based and ask for the best or most appropriate action. Apply the following reasoning sequence:
1. Identify the type of RFI in the scenario (internal, customer, correspondent, interbank, or authority).
2. Ask whether any option would tip off the customer. Eliminate it immediately.
3. Ask whether internal and public information has been exhausted before contacting the customer. If not, the best answer usually gathers internal information first.
4. Look for the option that is specific, documented, routed through the proper channel, and reviewed by the appropriate function.
5. For refusals and non-cooperation, the best answer typically involves escalation, consideration of a SAR, and a policy-driven exit decision, not an immediate unilateral closure with an explanation given to the customer.
6. For requests from authorities, the best answer involves verification, legal review, timely and complete response, confidentiality, and record preservation.

Exam Tips: Answering Questions on Requests for Information and Customer Communication
Tip 1 - The tipping-off filter comes first. Any answer in which an employee tells a customer about a SAR, an investigation, an alert, or law enforcement interest is wrong, no matter how reasonable the rest of the option sounds.
Tip 2 - Relationship managers deliver, compliance designs. When a question asks who should contact the customer, the usual best answer is the relationship manager using compliance-approved language, keeping the compliance function invisible to the customer. Watch for exceptions where the relationship manager is implicated.
Tip 3 - Internal before external. If one option says review existing KYC files, transaction history, and open-source information and another says call the customer, the internal review is almost always the better first step.
Tip 4 - Routine framing is correct framing. Options that describe the request as part of periodic review or regulatory KYC obligations are preferred over options that mention unusual, suspicious, or questionable activity in communications with the customer.
Tip 5 - Refusal is a red flag, not an automatic crime. A customer declining to provide information should lead to escalation and SAR consideration; it does not by itself prove money laundering. Choose answers that treat refusal as a risk indicator requiring documented follow-up.
Tip 6 - Exit without explanation. If the scenario involves closing an account, the correct communication cites the account agreement or the institution's discretion, not the suspicious activity. Also recognize that law enforcement may request that an account remain open.
Tip 7 - Verify, then comply. For subpoenas, production orders, and FIU or 314(a) requests, the best answer verifies legitimacy, involves legal or the designated officer, responds completely within the deadline, and maintains confidentiality. Ignoring, delaying, or notifying the customer are wrong.
Tip 8 - Know the safe harbors. Recognize that voluntary institution-to-institution sharing (such as 314(b)) requires meeting the program's conditions and limits use of the information to AML/CFT purposes. Sharing outside these conditions is a distractor.
Tip 9 - Correspondent silence is a signal. In correspondent banking scenarios, a respondent bank that will not or cannot answer an RFI about its customer is a significant red flag that may justify enhanced due diligence, restrictions, or termination.
Tip 10 - Documentation is never the wrong answer. When comparing otherwise similar options, the one that records the request, the response, and the investigator's rationale is stronger.
Tip 11 - Balance competing laws with counsel. In cross-border or data protection scenarios, choose the answer that satisfies AML obligations through lawful channels with legal input rather than the answer that breaches one law to satisfy another.
Tip 12 - Watch for absolute words. Options containing always, never, immediately close, or refuse all requests are frequently distractors; AML decision-making is risk-based and policy-driven.

Quick Recap
RFIs are the investigator's primary tool for closing knowledge gaps. They must be specific, documented, proportionate, and delivered through the right channel using neutral language. Customer communication must never reveal suspicion, alerts, SAR filings, or law enforcement interest. Requests from authorities must be verified, answered completely and on time, and kept confidential. On the exam, filter every option through tipping-off risk, sequence (internal before external), proper roles, documentation, and policy-based escalation, and you will consistently select the best answer.