Study CAMS as a set of applied decisions. For every concept, learn what distinguishes it from its nearest neighbor, then apply it to a short paper scenario and defend your conclusion. Track your reasoning in a written rationale, because documenting risk decisions is both a study method and the core professional habit the syllabus emphasizes.
Why the three-stage laundering model does not explain every suspicious flow
The placement, layering, and integration model describes how criminal proceeds are cleaned. Terrorist and proliferation financing may involve legitimate-origin funds moving toward a harmful purpose, so flow-based analysis must ask about both the source and the destination of money.
Trace a laundering example end to end: cash from street-level drug sales is deposited in small amounts (placement), moved through a sequence of transfers and a shell company invoice (layering), and finally invested in a restaurant whose books absorb the unexplained revenue (integration). Practice narrating where a given transaction sits in that arc. Placement scenarios stress cash handling and mule networks; layering stresses complexity whose main function is obscuring the audit trail; integration stresses assets whose apparent legitimacy is the point.
Now contrast a financing flow: an individual with a clean salary history sends modest, well-structured funds abroad, and the recipient pools them with other senders' transfers. There may be no criminal proceeds at any point, so the laundering arc simply does not fit. Recognize facilitators instead: fundraising fronts, collection agents, mule accounts, and opaque end users. Proliferation financing adds evasion of measures targeting proliferation-sensitive goods, often surfacing through trade documentation and end-user questions. The analytical habit to build is asking what the money is for, not only where it came from.
Turning the risk-based approach into a defensible rating decision
The risk-based approach directs stronger controls where assessed risk is higher, using combined customer, product, channel, geographic, and delivery factors. Its practical test is whether each risk factor you identified changes a specific control, and whether your rating rationale would survive scrutiny.
Worked scenario: an assessment at a money services business assigns every cash-intensive customer the same high rating because cash appears on the institutional risk list. The plausible mistake is single-factor scoring. Cash is a genuine risk indicator, but a cross-border remittance corridor with weak transparency differs from a domestic paycheck-cashing customer, and a rating that ignores that difference cannot calibrate due diligence or monitoring intensity. The better decision is to combine factors, document why each contributes, and record what the resulting rating changes: approval level, expected-activity review frequency, and monitoring thresholds.
This is also where risk differs from the rule-based tick-box alternative. A rule says every customer of type X gets treatment Y regardless of context; a risk-based decision says the combination of factors, weighted and explained, drives the treatment. When you study domain A and C together, practice writing one sentence per risk factor stating the control it should influence. If a factor in your assessment triggers no control anywhere in your program description, that is a gap to notice, and noticing it is exactly the connective reasoning program design depends on.
Drawing the CDD and EDD line without guessing
Customer due diligence establishes and verifies identity, understands ownership and control, and builds an expected-activity profile. Enhanced due diligence is triggered when risk is higher, adding depth on beneficial ownership, source of funds and wealth, and ongoing scrutiny.
CDD answers three questions: who is the customer, who ultimately owns or controls legal entities behind the customer, and what activity should this relationship look like. Beneficial ownership matters here because shell companies and nominee directors exist precisely to separate visible actors from real ones. A company with a tidy registry extract but no plausible operating history, a registered agent as its only contact point, and directors who hold dozens of similar entities is opacity you can observe, and that observation belongs in your risk picture.
EDD is not a bigger version of CDD done for everyone; it is CDD plus specific deeper measures when risk factors demand it. Practice naming the trigger in your own words: a politically exposed person or their close associate, a customer connected to a higher-risk jurisdiction under your institution's assessment, an unusually complex or deliberately opaque structure, or activity inconsistent with the expected profile. Then name the response: corroborating source of funds and wealth rather than merely recording an assertion, senior approval for the relationship, and tighter ongoing review. Trigger and response are easy to conflate, so practice naming both separately until you can produce either one without prompting.
Sanctions screening and transaction monitoring fail in opposite ways
Sanctions screening matches names and identifiers against lists at defined points and mainly fails through false positives and false negatives in matching. Transaction monitoring detects behavioral patterns over time and mainly fails through thresholds that miss risk or overwhelm reviewers.
Because the two tools answer different questions, study them with different worries in mind. Screening asks whether this entity or counterparty matches a designated party, so its vulnerabilities live in data quality, transliteration, matching sensitivity, and the moment of the check, such as onboarding, list updates, and payment processing. Monitoring asks whether behavior diverges from the expected profile, so its vulnerabilities live in scenario design, threshold calibration, and whether alerts are investigated with enough context to mean anything.
The table below is worth rebuilding from memory as an exercise, because writing the failure mode for each tool forces you to explain why the governance questions differ. A screening backlog of unresolved potential matches and a monitoring model whose tuning history cannot be explained are both technology problems, but they demand different evidence: one is resolved through entity resolution decisions and documented dispositions, the other through validation, tuning rationale, and demonstrable data lineage from source systems to the model. Keeping the two governance conversations separate prevents you from requesting the wrong evidence when a deficiency surfaces.
| Dimension | Sanctions screening | Transaction monitoring |
|---|---|---|
| Core question | Does this party match a designated or prohibited one? | Does observed activity deviate from expected behavior? |
| Fires at | Defined checkpoints: onboarding, list updates, transactions | Periodically, across accumulated activity patterns |
| Characteristic failure | False positives from weak matching; false negatives from poor data | Thresholds that over-alert or conceal genuine deviations |
| Governance evidence | Matching logic, data quality, alert disposition records | Model validation, tuning rationale, data lineage, human review |
Deciding when suspicion is enough to escalate
Suspicious activity reporting under FATF-style standards attaches once you know, suspect, or have reasonable grounds to suspect that funds relate to criminal activity, regardless of amount. The governing judgment is forming and acting on that suspicion, while protecting its confidentiality.
Worked scenario: a monitoring analyst notices round-amount transfers from a customer whose stated business is consulting, paired with payments to parties in a jurisdiction the institution's assessment flags as higher risk. The analyst delays escalation for weeks, wanting two more months of transactions to build a complete picture. The mistake is treating completeness as a precondition; the reporting standard attaches to reasonable grounds for suspicion, not to a proven case, and further internal investigation is a matter for the institution's escalation process, not a reason to sit on the concern. The better decision is to escalate promptly through the internal reporting channel so the designated function can decide, and to document the indicators and reasoning that formed the suspicion.
The second half of the decision is confidentiality. Suppose the relationship manager, pressed by the customer, explains that the bank is reviewing the transfers. That disclosure risks tipping off, and the defensible posture is a neutral, scripted response that neither confirms nor denies any review. Notice how the two obligations interact: internal escalation is encouraged and expected, external disclosure to the customer is the hazard. Escalation and disclosure are distinct acts with different rules, and keeping them clearly separate is what makes it coherent to continue serving a customer ordinarily while a report is pending.
Judging a monitoring model by its inputs, tuning, and oversight
A credible financial crime technology program can show where its data comes from, why thresholds and scenarios are set as they are, how models are validated, and where humans review outcomes. Data lineage, tuning, and human-in-the-loop review are the accountability backbone.
Start with inputs, because no scenario detects what the data never shows. If customer addresses are stale or entity resolution merges two distinct people, both screening and monitoring inherit the defect. A useful self-test is tracing one field, such as counterparty country, from the source system through any transformations to the alert it influences; if you cannot describe that path, data lineage is the concept to study next. Machine learning and network analytics extend this: they can surface hidden connections, but their outputs are harder to explain, which is why explainability and documented validation sit beside them in the syllabus.
Tuning is where judgment lives. Lower thresholds catch more but flood reviewers with false positives, and an alert queue nobody can work properly is its own control failure; higher thresholds reduce noise but risk false negatives. Neither extreme is virtuous by itself, so the defensible position is a documented rationale, periodic review, and evidence that tuning decisions respond to outcomes rather than workload pressure alone. Add third-party technology into the same frame: outsourcing a tool does not outsource accountability, so governance questions about oversight and resilience apply to vendors exactly as to in-house systems.
A preparation sequence, a rubric exercise, and readiness checks
Sequence study around the catalog's emphasis: financial crime risks and program-building first, frameworks and technology next. Anchor each session in a written scenario decision, then grade yourself with the rubric below before moving on.
An adaptable sequence: spend the first block on domain A, tracing laundering, terrorist financing, and proliferation financing through the sectors listed in the coverage areas, since roughly a third of the blueprint rests there. Give domain C equal weight next, because program design converts risks into controls. Split remaining time between domains B and D. Each week, close by writing one scenario from memory: a customer, an activity pattern, and a decision, plus a two-line rationale. Keep the rationales; rereading your own reasoning a week later reveals whether you wrote analysis or assertion.
Rubric exercise: build a one-page fictional customer file with deliberately mixed signals, such as a plausible business, a complex ownership chain, and activity that is odd but not conclusively criminal. Score your written response against four checks: did you name the risk factors rather than a single headline risk; did you connect each factor to a specific control; did you separate observed facts from inference; and did you state what would change your assessment? Two out of four is a starting point, three is solid, four suggests you are ready to generate scenarios without the file. Self-check scores measure learning progress only; they are not predictions of exam outcomes. As a final readiness pass, confirm you can state the tipping-off boundary, rebuild the screening-versus-monitoring table from memory, and explain why a suspicion report does not wait for a complete case. For eligibility, scheduling, and administrative details, rely on the issuer's certifications page rather than secondary summaries.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.