Using Typology Reports, Advisories and FIU Feedback

Why This Topic Matters

Anti-financial crime (AFC) programs cannot operate in isolation. Criminals constantly adapt their methods, and an institution that relies only on its own internal experience will quickly fall behind. Typology reports, regulatory advisories and Financial Intelligence Unit (FIU) feedback are the primary channels through which the wider AFC community shares what it is seeing. The CAMS exam tests this area because the ACAMS body of knowledge expects a compliance professional to understand that a risk-based approach is only as good as the intelligence that feeds it. The Financial Action Task Force (FATF) Recommendations, the Egmont Group principles and national regulators (such as FinCEN in the United States, the UK's NCA/UKFIU, AUSTRAC in Australia and FINTRAC in Canada) all stress that institutions should use external intelligence to calibrate controls, train staff and improve the quality of suspicious activity reporting. In short, this topic connects the international standards you learn about in theory to the daily practice of transaction monitoring, customer due diligence and reporting.

What Are Typology Reports?

A typology is a described pattern or method used by criminals to launder money, finance terrorism, evade sanctions or commit related crimes. A typology report is a published study that documents these methods, usually illustrated with sanitised case examples, red flag indicators and sometimes statistical trends.

Key producers of typology reports include:
• FATF – publishes thematic reports such as those on trade-based money laundering, professional money laundering networks, virtual assets, real estate, and the misuse of legal persons and arrangements.
• FATF-Style Regional Bodies (FSRBs) – for example MONEYVAL, APG, GAFILAT, ESAAMLG and MENAFATF produce regional typologies reflecting local risks.
• The Egmont Group – the global network of FIUs publishes case collections and best-practice papers drawn from member FIUs.
• National FIUs – such as FinCEN, AUSTRAC, FINTRAC and the UKFIU, which publish strategic analysis and indicator lists.
• Other bodies – the Wolfsberg Group, the Basel Committee, the World Bank and the IMF issue guidance that often includes typological content.

Typology reports are strategic rather than tactical: they describe how a scheme works and what indicators might reveal it, not specific named suspects.

What Are Advisories?

An advisory (sometimes called an alert, notice or bulletin) is a time-sensitive communication from a regulator, FIU or standard-setter that warns institutions about a specific emerging threat, jurisdiction or activity. Advisories are generally more targeted and urgent than typology reports.

Common examples:
• FinCEN Advisories – for example on human trafficking, elder financial exploitation, ransomware, COVID-19 fraud, Russian oligarch sanctions evasion or corruption involving politically exposed persons. Many FinCEN advisories include SAR filing instructions, asking institutions to insert a specific key term (such as a reference code) in the SAR narrative so the FIU can track related reports.
• FATF public statements – the "black list" (High-Risk Jurisdictions subject to a Call for Action) and the "grey list" (Jurisdictions under Increased Monitoring), issued after each plenary, which institutions must factor into country risk ratings and apply enhanced due diligence or counter-measures as appropriate.
• Sanctions advisories – from OFAC, the EU, the UK's OFSI and the UN, warning of evasion techniques in sectors such as shipping, gold or virtual currency.
• Supervisory bulletins – from banking supervisors highlighting observed control weaknesses or examination findings.

What Is FIU Feedback?

FATF Recommendation 29 and 34 and the Egmont Group principles encourage FIUs to give feedback to reporting entities. Feedback closes the loop: institutions file suspicious transaction or activity reports (STRs/SARs), and the FIU tells them, collectively or individually, how useful those reports were and what trends they reveal.

Feedback can be:
• General (strategic) feedback – annual reports, statistics on filing volumes, sector-specific trend analysis, lists of common quality problems in SAR narratives, and published red flag indicators.
• Specific (case-level) feedback – acknowledgement that a report was received and, where legally permitted, an indication that it contributed to an investigation. In many jurisdictions tipping-off laws limit how much specific feedback an FIU can give, so general feedback is more common.
• Public-private partnerships – forums such as the UK's Joint Money Laundering Intelligence Taskforce (JMLIT), the FinCEN Exchange in the United States and the Fintel Alliance in Australia, where FIUs, law enforcement and institutions share intelligence in near real time.

How It Works: Putting Intelligence into Practice

The CAMS exam expects you to understand the practical cycle by which an institution consumes this material. A well-run AFC program typically follows these steps:

1. Monitor and collect – a designated function (often within compliance or financial intelligence) subscribes to FATF, FSRB, FIU and regulator publications and tracks sanctions and advisory releases.

2. Assess relevance – not every typology applies to every institution. A retail bank, a casino, a money services business and a trade finance desk face different exposures. The institution evaluates whether its products, customers, delivery channels and geographies are implicated.

3. Update the enterprise-wide risk assessment – new typologies and jurisdictional advisories feed directly into inherent risk ratings for countries, products and customer types. FATF grey-list changes, for example, should trigger a review of country risk scoring.

4. Adjust controls – this is the heart of the topic. Red flags from typology reports and advisories are translated into transaction monitoring scenarios, thresholds and rules; customer due diligence questionnaires; sanctions screening parameters; and onboarding restrictions. Advisory-specific SAR key terms are built into the reporting workflow.

5. Train staff – front-line employees, relationship managers and investigators receive targeted training on the new patterns so that they can recognise them in practice. Regulators regularly cite the use of current typologies as a hallmark of effective training.

6. Improve reporting quality – FIU feedback about weak SAR narratives (vague descriptions, missing dates, no explanation of why the activity is suspicious) is used to improve templates, investigator guidance and quality assurance.

7. Document and evidence – the institution records how each major publication was reviewed, what decision was taken and why. Examiners and auditors look for this evidence; failure to act on a widely publicised advisory is a frequent examination finding.

8. Feed back to the system – by filing high-quality SARs and participating in public-private partnerships, the institution itself becomes a source of intelligence for future typologies, completing the cycle.

Worked Illustration

Suppose an FIU publishes an advisory on trade-based money laundering through over- and under-invoicing of electronics exports, with a request that related SARs include a particular key term. A compliant institution would: identify customers in the electronics import/export sector; review trade finance transactions for pricing anomalies against market benchmarks; add scenarios to its monitoring system flagging mismatches between invoice values, shipping documents and payment amounts; brief trade finance staff; and ensure that any resulting SARs carry the requested key term. The institution would then note the review in its compliance committee minutes.

Common Pitfalls the Exam Likes to Probe

• Treating typology reports as merely informational reading rather than inputs to risk assessment and controls.
• Confusing a typology (a method of laundering) with a red flag (an observable indicator of that method) or a predicate offence (the underlying crime).
• Assuming FIU feedback will reveal the outcome of a specific investigation; in most jurisdictions tipping-off and confidentiality rules prevent this, and feedback is mainly strategic.
• Ignoring the SAR key-term instruction in an advisory, which undermines the FIU's ability to aggregate related reports.
• Applying a typology mechanically without a risk-based assessment of whether it is relevant to the institution's own business model.
• Forgetting that FATF jurisdictional statements are themselves a form of advisory that must flow into country risk ratings and, for black-listed jurisdictions, into counter-measures.

Exam Tips: Answering Questions on Using Typology Reports, Advisories and FIU Feedback

1. Look for the "action" answer. CAMS questions in this area usually present a scenario in which a new report or advisory has been published and ask what the compliance officer should do. The best answer is almost always the one that translates intelligence into a concrete program change: updating the risk assessment, calibrating monitoring rules, delivering targeted training or revising SAR procedures. Answers that merely "circulate the report" or "file it for reference" are distractors.

2. Apply the risk-based approach. If an option proposes applying a typology to every customer regardless of relevance, or ignoring it because it seems unrelated, both are likely wrong. The correct option assesses relevance to the institution's own products, customers and geographies and then responds proportionately.

3. Know who publishes what. Be ready to match FATF with global typology reports and jurisdictional lists; FSRBs with regional typologies; the Egmont Group with FIU cooperation and case collections; national FIUs with advisories and SAR feedback; and the Wolfsberg Group with private-sector banking guidance. Questions sometimes test this by asking which body is the most appropriate source for a particular kind of intelligence.

4. Remember the SAR key term. If a scenario mentions a regulator advisory with filing instructions, the correct response includes referencing the advisory's specified term in the SAR narrative so the FIU can link reports.

5. Understand the limits of FIU feedback. If an option expects the FIU to confirm whether a specific customer is under investigation, treat it with suspicion. Feedback is generally aggregated and strategic; confidentiality and tipping-off rules constrain case-level disclosure.

6. Connect to training and governance. Many questions ask how typologies improve a program's effectiveness. Strong answers mention that typologies make training realistic and current, and that senior management and the board should be informed of material new risks through the compliance reporting cycle.

7. Watch for the examination angle. If the scenario involves a regulator reviewing the institution, the examiner's concern will be whether the institution can demonstrate that it considered and acted upon published advisories. The answer that emphasises documented evidence of review and response is usually correct.

8. Eliminate extremes. Options that say "immediately exit all customers" in a sector named in a typology, or "no action is required because the report is non-binding," are typically wrong. The CAMS exam rewards measured, documented, risk-based responses.

9. Read for the feedback loop. When a question describes an FIU telling institutions that SAR narratives are too vague, the expected remedy is to improve narrative quality (who, what, when, where, why and how), strengthen investigator guidance and implement quality review, not simply to file more reports.

10. Keep the big picture. Ultimately this topic is about the two-way flow of intelligence between the public and private sectors. If you can articulate that typologies and advisories flow into the institution to sharpen controls, and high-quality SARs flow out to strengthen national and international understanding, you will be well positioned to answer any variation the exam presents.

Key Takeaways

• Typology reports describe criminal methods and red flags; advisories warn of specific or emerging threats and may carry filing instructions; FIU feedback tells institutions how useful their reporting has been and what trends are emerging.
• The main sources are FATF, FSRBs, the Egmont Group, national FIUs, supervisors and sanctions authorities, plus industry bodies such as the Wolfsberg Group.
• Effective institutions operationalise this intelligence through the risk assessment, monitoring systems, due diligence, training, reporting quality and documented governance.
• On the exam, favour answers that are risk-based, action-oriented, documented and respectful of confidentiality and tipping-off constraints.