Monitoring, Investigation and AI Technology

Periodic and perpetual KYC, adverse media tools, rules-based transaction monitoring and its tuning, the move to AI and machine learning, investigation and network analysis tools, privacy technology, tool selection and operational effectiveness.

5 minutes 5 Questions

In the Certified Anti-Money Laundering Specialist (CAMS) framework, Monitoring, Investigation and AI Technology describe how financial institutions detect, examine and report suspicious activity while leveraging modern tools to strengthen compliance programs. Transaction Monitoring is the ongoing,…

Concepts covered
Explainability, Bias and Governance of AI ModelsPerpetual KYC and Event-Driven ReviewsRules-Based Transaction Monitoring and ScenariosPrivacy-Enhancing TechnologiesTransitioning from Rules to Machine Learning MonitoringRisk-Based Prioritisation of Resources and InvestmentOpen-Source Intelligence and Investigation AutomationAdverse Media Screening Tools and AIPeriodic KYC Refresh and Risk-Based PrioritisationOperational Effectiveness and Efficiency MetricsSelecting and Integrating AFC ToolsModel Risk Management and Scenario TuningNetwork and Link Analysis ToolsAbove-the-Line and Below-the-Line TestingCustomer Segmentation and Threshold Setting
Test mode:
Start practice test

CAMS - Monitoring, Investigation and AI Technology Example Questions

Test your knowledge of Monitoring, Investigation and AI Technology

Question 1

After a core banking migration, alerts from a bank's outbound wire scenario fall sharply, though total wire volumes and customer mix are unchanged. Thresholds were not altered, and below-the-line testing of the scenario's output finds no productive activity near the threshold. A reconciliation shows that several new payment codes from the migrated system do not reach the monitoring engine. Which conclusion BEST explains the alert drop?

Correct Answer: Incomplete data mapping into the scenario

The reconciliation shows that new payment codes from the migrated system never reach the monitoring engine. Those wires are simply invisible to the scenario, so incomplete data mapping is the root cause of the alert drop.
Reduced inherent risk does not fit, because wire volumes and customer mix are unchanged. A threshold set too high is ruled out, since thresholds were not altered and below-the-line testing found no productive activity near the threshold. Customer behaviour drift is unsupported, because activity patterns remained stable and the gap is a technical feed issue.
Key concept: data integrity and completeness validation of transaction monitoring feeds after system changes.

Question 2

Which of the following best describes how perpetual KYC differs from a traditional periodic KYC refresh model?

Correct Answer: Profiles are updated as event-driven data changes occur, rather than only on a fixed risk-tiered review date

Perpetual KYC keeps customer profiles current by updating them continuously when trigger events or data changes occur. Examples include ownership changes, adverse media hits, sanctions list updates or unusual transaction patterns. This replaces sole reliance on calendar-based reviews set by risk tier.
Using AI to speed up scheduled reviews still follows the periodic model; it only makes each scheduled review more efficient. A uniform annual cycle for everyone is still periodic and abandons the risk-based approach. Refreshing only high-risk customers while exempting low-risk files breaches ongoing due diligence obligations, which apply to all customers.
Key concept: event-driven, continuous customer due diligence (perpetual KYC) versus static periodic refresh.

Question 3

In network and link analysis used to detect links to criminality, what does a high betweenness centrality score indicate about a node, such as an account or entity?

Correct Answer: It sits on many shortest paths linking other nodes

Betweenness centrality measures how often a node lies on the shortest paths between other nodes. A high score means the account or entity acts as a bridge or broker controlling flows between otherwise separate parts of a network, which is typical of intermediaries, money mules or gatekeepers in laundering schemes.
Having the largest count of direct links describes degree centrality, not betweenness. Linking mainly to well-connected nodes describes eigenvector centrality, which measures influence through important neighbours. Having the shortest average distance to all other nodes describes closeness centrality, which measures how quickly a node can reach the rest of the network.
Key concept: distinguishing centrality measures in link analysis, where betweenness identifies brokers and bridges.

More Monitoring, Investigation and AI Technology questions
287 questions (total)
Practice 100 questions
One session at a time, always new questions