AFC Program Governance and Risk Management

Program pillars, three lines of defence, the MLRO, risk appetite, enterprise risk assessment, policies, committees, KPIs and KRIs, reporting duties and life-cycle controls.

5 minutes 5 Questions

AFC (Anti-Financial Crime) Program Governance and Risk Management is a core domain of the CAMS body of knowledge, focusing on how an organization structures, oversees, and continuously calibrates its defenses against money laundering, terrorist financing, sanctions evasion, fraud, and corruption. …

Concepts covered
Management Information and Board ReportingThreshold and Currency Transaction ReportingIncorporating Guidance and Best Practice into PoliciesInherent Risk, Control Effectiveness and Residual RiskRisk Appetite Statement: Purpose and ContentCustomer Life-Cycle Controls and Exit DecisionsHorizon Scanning and Regulatory Change ManagementPolicies, Standards and Procedures: Hierarchy and ContentThe Risk-Based Approach and Proportionate ControlsEnhanced Due Diligence: Triggers and MeasuresCulture of Compliance and Tone from the TopBSA Officer and MLRO Role, Authority and IndependenceKeeping Accounts Open for Law EnforcementKey Performance Indicators and Key Risk IndicatorsKnow Your Customer and Customer IdentificationWorking with Other Risk Management FunctionsTypes of Risk Assessment: Inputs, Outputs and MitigationCustomer Due Diligence and Beneficial OwnershipPillars of an AFC Compliance ProgramGovernance Committees and Terms of ReferenceTransaction Monitoring Program DesignSuspicious Activity Reporting ObligationsEnterprise-Wide Risk Assessment MethodologyThree Lines of Defence ModelCustomer Risk Rating and AssessmentCommunicating Risk Appetite and Linking Controls
Test mode:
Start practice test

CAMS - AFC Program Governance and Risk Management Example Questions

Test your knowledge of AFC Program Governance and Risk Management

Question 1

A small business customer has held an account with a bank for many years and is rated low risk. During ongoing screening, a KYC analyst finds that the company's sole owner has just been appointed deputy minister of finance. The next periodic review is eighteen months away. What should the bank do with this customer's risk rating?

Correct Answer: Trigger a review now, re-rate the customer, and apply EDD with senior approval

Becoming a PEP is a material change in the customer's risk profile. It should trigger an event-driven review right away rather than waiting for the scheduled cycle. The bank should re-rate the customer, obtain senior management approval to continue the relationship, and apply enhanced due diligence, including checks on source of wealth and source of funds.
Waiting eighteen months leaves a known higher risk unmanaged. Freezing the account is unjustified because PEP status is not a sanctions designation. Filing an STR is wrong because PEP status alone is not suspicious activity.
Key concept: trigger-based (event-driven) risk reassessment and PEP enhanced due diligence.

Question 2

A bank's AML policy states that high-risk customers are subject to enhanced due diligence. The head of KYC now wants to write down the system screens, the checklist and the sequence of steps that analysts follow to collect and verify source-of-wealth evidence when onboarding a high-risk client. Where should this content be placed?

Correct Answer: In the onboarding procedure used by KYC analysts

System screens, checklists and step-by-step sequences describe how analysts carry out a task, so they belong in the onboarding procedure used by KYC analysts, which turns policy and standards into operational instructions.
The board-approved AML policy sets high-level principles and commitments, such as requiring EDD for high-risk customers, not detailed workflows. The EDD standard defines minimum requirements, meaning what evidence is needed, rather than the screens and steps used to collect it. The risk appetite statement defines how much risk the bank will accept, not how analysts perform verification.
Key concept: the AML document hierarchy, running from policy (why and what) to standards (minimum requirements) to procedures (how).

Question 3

An MLRO's quarterly board report shows three items, all rated green: alerts closed within service levels, staff training completion and suspicious activity report volumes. A board member points out that none of these show whether the firm's financial crime exposure is moving toward the limits set in its risk appetite statement. Which addition to the report would BEST close this gap?

Correct Answer: Overdue high-risk customer reviews tracked against appetite tolerances

Tracking overdue high-risk customer reviews against appetite tolerances is the best addition. It is a forward-looking key risk indicator tied directly to the risk appetite statement, so the board can see whether exposure is approaching or breaching its agreed limits.
Benchmarking alerts closed per analyst against peers measures productivity, not exposure against the firm's own appetite. Comparing suspicious activity report volumes with last year only shows a reporting trend and gives no threshold to judge risk by. Splitting training completion by business line and seniority adds detail to a compliance activity metric but still says nothing about risk exposure.
Key concept: distinguishing activity metrics from key risk indicators linked to risk appetite tolerances.

More AFC Program Governance and Risk Management questions
465 questions (total)
Practice 100 questions
One session at a time, always new questions