Credit Reference, Criminal Record and Identity Checks

1. Why This Topic Matters for the CAMS Exam

Every anti-money laundering (AML) programme rests on one foundational question: do we really know who we are dealing with? Credit reference, criminal record and identity checks are the practical tools that answer that question at the point of onboarding. The FATF Recommendations (particularly Recommendation 10 on Customer Due Diligence and Recommendation 17 on reliance on third parties), the USA PATRIOT Act Section 326 Customer Identification Program (CIP) rules, the EU Anti-Money Laundering Directives and the Wolfsberg Principles all require financial institutions to identify and verify customers using reliable, independent source documents, data or information. The CAMS exam tests whether you understand not only what these checks are, but why they are performed, how they fit into a risk-based approach, and what their limitations are.

This topic sits inside the Data Onboarding and Screening Technology domain because modern institutions no longer rely purely on a teller inspecting a passport. They ingest data electronically, cross-match it against external databases, apply algorithms and biometrics, and generate risk scores. The exam expects you to understand the interplay between the regulatory requirement (verify identity, assess risk) and the technological means (electronic identity verification, database screening, fuzzy-matching engines).

Failing to perform these checks properly leads directly to the classic AML failures the exam loves to describe: shell companies opened with stolen identities, mules recruited through synthetic identities, criminals employed inside the institution, and politically exposed persons (PEPs) slipping through unnoticed. Regulators have imposed multi-million and multi-billion fines where onboarding controls were weak, so this is high-stakes material in both the real world and the exam room.

2. What Are Credit Reference, Criminal Record and Identity Checks?

2.1 Identity Checks (Identification and Verification, or ID and V)

Identification is collecting information about who the customer claims to be: full name, date of birth, residential address, nationality and an official identification number (passport number, national ID, tax number). Verification is confirming that this information is true using independent sources. The CAMS exam draws a sharp distinction between these two steps; identification is what the customer tells you, verification is what you prove.

Verification can be documentary (inspecting a government-issued photo ID, utility bill, bank statement, certificate of incorporation, articles of association) or non-documentary (comparing customer-provided data to information from a credit bureau, public database, government registry, or by contacting the customer at a verified address or telephone number). Under the US CIP rules, institutions must state in their written programme which methods they will use and when.

For legal entities, identity checks extend to beneficial ownership: identifying natural persons who ultimately own or control the entity (commonly at a 25% threshold or lower under a risk-based approach) and, where no owner meets the threshold, a senior managing official. The exam frequently tests that verifying the company is not enough; you must look through to the people behind it.

2.2 Credit Reference Checks

A credit reference check queries a credit reference agency (also called a credit bureau), such as Experian, Equifax or TransUnion and their national equivalents. For AML purposes the primary value is not the credit score itself but the corroboration of identity and address: the bureau holds a long history of where a person has lived, which accounts they hold, and whether their name, date of birth and address combination has a consistent footprint. A person who claims a 20-year residential history but has no electronic footprint at all is either a genuine thin-file customer (young adult, recent immigrant) or a synthetic identity. Credit data also helps establish source of wealth and expected activity; a customer with a modest credit profile who suddenly moves large sums may be a money mule.

Important nuance for the exam: credit checks are a supporting tool. A good credit score does not verify identity on its own, and a poor credit score is not an AML red flag by itself. Credit bureau data is also subject to consumer protection and data protection laws (for example the Fair Credit Reporting Act in the US, GDPR in the EU), so institutions must have a lawful basis and, often, customer consent, and must use the data only for permitted purposes.

2.3 Criminal Record Checks

Criminal record checks confirm whether an individual has convictions, pending charges, or is subject to court orders. In AML they appear in two contexts:

First, customer screening. Institutions screen prospective customers against sanctions lists (OFAC SDN list, UN, EU, UK HMT), PEP databases, law enforcement wanted lists and adverse media. A documented criminal history, especially for fraud, drug trafficking, corruption or terrorism offences, moves a customer into a high-risk category requiring Enhanced Due Diligence (EDD) or outright rejection.

Second, employee screening. The FATF and most national regulators require that an effective AML programme include screening procedures to ensure high standards when hiring employees. Criminals actively seek to place insiders in banks, money services businesses and casinos. Pre-employment checks typically include criminal background verification, confirmation of qualifications, previous employment references, regulatory disbarment checks and, for sensitive roles, credit history (as an indicator of vulnerability to bribery). The CAMS exam regularly tests that employee screening is one of the core elements of an AML compliance programme alongside policies, a designated compliance officer, training and independent testing.

Limitations the exam expects you to know: criminal records are jurisdiction-specific (a clean record in one country says nothing about another), many jurisdictions restrict access to spent or minor convictions, records may be incomplete or delayed, and a criminal record check is not a sanctions check; the two must both be performed.

3. How These Checks Work in Practice

3.1 The Onboarding Data Flow

A typical digital onboarding journey proceeds as follows:

Step 1: Data capture. The customer enters personal details into a web or mobile application, or a relationship manager inputs them into the core banking or Customer Relationship Management (CRM) system. Data standardisation (consistent name formats, address parsing, date formats) occurs here. Poor data quality at capture is a root cause of screening failures later, a point often tested.

Step 2: Document authentication. The customer photographs an ID document. Software checks machine-readable zones (MRZ), holograms, fonts, expiry dates and security features against templates for thousands of document types. Near-field communication (NFC) chips in e-passports can be read directly.

Step 3: Biometric matching and liveness detection. A selfie is compared to the ID photo using facial recognition. Liveness detection (blinking, head movement, texture analysis) guards against presentation attacks using printed photos or deepfakes.

Step 4: Electronic identity verification (eIDV). The institution sends the name, date of birth and address through an Application Programming Interface (API) to one or more data providers: credit bureaus, electoral rolls, telephone directories, government registries, utility databases and, where legally permitted, death registers. A match is returned with a confidence score. Many jurisdictions require a 2+2 match (two data elements matched against two independent sources) as a minimum for electronic verification of lower-risk customers.

Step 5: Screening. The verified identity is screened against sanctions, PEP, adverse media and internal blacklists. Screening engines use fuzzy logic to catch transliterations (Mohammed, Muhammad, Mohamed), name reversals, nicknames, dates of birth within a tolerance range, and aliases. Each institution sets a match threshold; too strict and real matches are missed (false negatives), too loose and analysts drown in false positives. The exam tests that false negatives are the more dangerous error from a regulatory standpoint, while false positives create operational cost.

Step 6: Risk scoring and decisioning. Results feed a customer risk rating model considering customer type, geography, products and delivery channel. Low-risk customers may be auto-approved with Simplified Due Diligence; medium-risk receive standard CDD; high-risk (PEPs, adverse criminal findings, high-risk jurisdictions, complex ownership) are referred to compliance for EDD, senior management approval and, where warranted, decline. A potential sanctions match must be escalated and resolved before the account is activated or funds move.

Step 7: Record keeping and ongoing monitoring. All identification data, copies of documents, verification results and decision rationale are retained (typically at least five years after the end of the relationship under FATF standards, longer in some jurisdictions). Identity data is periodically refreshed and re-screened because people become PEPs, get sanctioned or acquire convictions after onboarding. Onboarding is a moment; due diligence is a lifecycle.

3.2 Reliance on Third Parties and Outsourcing

Institutions may rely on third parties (introducers, other regulated financial institutions, identity verification vendors) to perform elements of CDD, but FATF Recommendation 17 is clear: ultimate responsibility remains with the relying institution. The institution must be satisfied that the third party is regulated and supervised, that it can obtain the underlying CDD information immediately on request, and that the third party is not based in a high-risk jurisdiction. Vendor due diligence, contractual rights to audit and periodic testing of vendor output are expected controls.

3.3 Data Protection and Consent

Credit reference and criminal record data are sensitive personal data. Institutions must balance AML obligations against privacy laws such as the GDPR, which treats criminal conviction data as a special category requiring explicit legal authority. In most jurisdictions AML and counter-terrorist financing obligations provide a lawful basis for processing, but institutions must still practise data minimisation, purpose limitation and secure storage. The exam sometimes presents a scenario where a compliance officer must reconcile an AML obligation with a privacy objection; the correct answer typically recognises that AML laws usually override privacy restrictions for legitimate CDD purposes, but the institution must document the basis and protect the data.

4. Common Red Flags Detected Through These Checks

Identity documents that fail authentication or appear altered.
Customer reluctant to provide identification or offering only copies when originals are requested.
Mismatch between stated address and credit bureau address history, or no electronic footprint for an adult claiming long residency (possible synthetic identity).
Multiple applications with the same device, IP address or telephone number but different identities (mule networks).
Date of birth or name that nearly matches a sanctions or PEP list entry, especially combined with a matching nationality.
Adverse media linking the applicant to fraud, corruption or organised crime.
Beneficial owner that cannot be identified, or ownership structures spanning secrecy jurisdictions without a business rationale.
Prospective employee with unexplained gaps in employment, unverifiable references or undisclosed convictions.

5. Exam Tips: Answering Questions on Credit Reference, Criminal Record and Identity Checks

Tip 1: Separate identification from verification. If a question asks what step is missing after a customer provided their name and address, the answer is almost always verification against independent, reliable sources. Collecting information is never sufficient on its own.

Tip 2: Apply the risk-based approach, not a one-size-fits-all rule. CAMS rewards answers that scale the depth of checks to the risk. A low-risk domestic retail customer can be verified electronically; a high-risk PEP from a high-risk jurisdiction needs EDD, source of wealth verification and senior management sign-off. If an answer option says all customers must undergo the same enhanced checks, it is usually wrong.

Tip 3: Know what each check does and does not do. A credit check corroborates identity and address and informs expected activity; it is not a sanctions screen. A criminal record check reveals convictions in a given jurisdiction; it is not a PEP screen and does not cover other countries. A sanctions screen does not reveal criminal history. If a scenario describes an institution performing only one of these and asks what the gap is, identify the missing check.

Tip 4: Remember employee screening. When a question lists the components of an AML compliance programme and includes personnel screening or background checks, recognise it as a legitimate element. When a scenario involves a cashier or relationship manager facilitating laundering, the control weakness is usually inadequate pre-employment screening or ongoing staff monitoring.

Tip 5: Ultimate responsibility cannot be outsourced. If the question involves a vendor, an introducer or a correspondent performing CDD, the correct answer will state that the institution relying on them remains responsible and must be able to obtain the underlying records.

Tip 6: Potential sanctions matches require escalation and resolution before proceeding. Never select an answer that opens the account first and investigates later. Likewise, never select an answer that involves telling the customer they are being investigated for suspicious activity; that is tipping off.

Tip 7: Favour the answer that documents and escalates. When a frontline employee finds a discrepancy in identity data or an adverse criminal finding, the exam-correct action is to escalate to the compliance function (often the MLRO or BSA Officer), document the finding, and allow the risk decision to be made at the appropriate level, rather than making a unilateral decision to accept or reject.

Tip 8: Watch for technology terminology. Expect terms such as electronic identity verification, fuzzy matching, false positives and false negatives, biometric liveness, API integration and data quality. Understand that poor data quality (inconsistent name formats, missing dates of birth) degrades screening effectiveness, and that tuning match thresholds is a documented, risk-based decision that must be tested and validated.

Tip 9: Record retention is a frequent distractor. Identification and verification records must be kept for at least five years after the relationship ends under FATF standards. If an option suggests destroying records at account closure, eliminate it.

Tip 10: Balance privacy with AML obligations. When privacy law appears in a question, the correct answer typically acknowledges that AML laws provide a lawful basis for collecting identity, credit and criminal data, while requiring the institution to protect the data, limit its use to the stated purpose and comply with local consent requirements.

Tip 11: Read for the word best or most appropriate. Several options may be partially correct. The best answer is the one that is risk-based, independent, documented, escalated through proper channels, and consistent with FATF Recommendations 10 and 17. Eliminate options that are absolute (always, never, all customers), that rely solely on customer self-declaration, or that delay screening until after the account is active.

6. Quick Revision Summary

Identity checks: identify, then verify from independent reliable sources; documentary and non-documentary methods; include beneficial owners.
Credit reference checks: corroborate identity and address, inform expected activity; subject to consumer and data protection law; supporting tool, not a substitute for verification.
Criminal record checks: used for both customers and employees; jurisdiction-limited; distinct from sanctions and PEP screening; feeds risk rating and EDD decisions.
Technology: eIDV, document authentication, biometrics, fuzzy matching, API data feeds, risk scoring, ongoing re-screening.
Governance: risk-based approach, third-party reliance with retained responsibility, escalation to compliance, no tipping off, five-year record retention, privacy compliance.

Master these principles and the vocabulary around them, and you will be able to handle any CAMS scenario on onboarding checks with confidence.