Certified Anti-Money Laundering Specialist (CAMS) Exam Guide

1. 1Definitions of anti-money laundering (AML), countering the financing of terrorism (CFT), sanctions, fraud, anti-bribery and corruption (ABC), and tax evasion
2. 2Financial systems, the economic, reputational, and social consequences of money laundering (ML), and the risks/impacts of violations of anti-financial crime (AFC) regulations
3. 3The predicate crimes underlying financial crime
4. 4How ML, terrorist financing (TF), sanctions, bribery and corruption, tax evasion, and fraud may manifest within different sectors through products and services, customers, jurisdictions, and channels
5. 5Financial crime (FC) risks related to products within different business segments in the banking sector
6. 6FC risks related to the banking of high-risk sectors
7. 7FC risks related to the banking of politically exposed persons (PEPs) and high-risk customers
8. 8FC risks related to products within other financial sectors
9. 9FC risks related to money services businesses (MSBs), payment service providers (PSPs), and ecommerce platforms
10. 10FC risks related to insurance products
11. 11FC risks related to virtual asset service providers (VASPs), cryptoassets, and related products
12. 12FC risks related to gaming and gambling
13. 13FC risks related to real estate
14. 14FC risks related to gatekeepers
15. 15FC risks related to trusts and company service providers
16. 16FC risks related to accountants
17. 17FC risks related to other high-risk business sectors and structures

Example scenario: A small import business starts receiving frequent wires from unrelated third parties just below its usual invoice amounts. Which typology does this suggest, and what would you look at next?

1. 1The Financial Action Task Force's (FATF) role, function, regional bodies, and how to apply the principles relating to FATF recommendations
2. 2The United Nations' (UN) role and sanctions regimes
3. 3The role of regulators, law enforcement, and financial intelligence units (FIUs) in protecting financial integrity and its citizens
4. 4Objectives of public sector groups, private sector groups, and non-governmental organizations
5. 5How regulatory authorities cooperate when conducting regulatory exams, how law enforcement agencies and FIUs cooperate when conducting money laundering investigations, including cross-border investigations
6. 6How to leverage relevant reports provided by regulators, FIUs, and other authorities to identify trends and typologies within differing jurisdictions
7. 7Guidance and/or special reports from non-government bodies
8. 8National and sectoral risk assessments and how they may impact the risk-based approach and the risk assessment in an organization
9. 9The AFC regulations and main regulatory bodies in the US and EU, including money laundering and sanctions
10. 10The importance of awareness of AFC and sanctions regulatory regimes in differing jurisdictions
11. 11Public-private partnerships (PPP), why they are important, what they achieve, and their strengths and limitations when sharing data and intelligence
12. 12How the private sector can foster collaboration in the fight against financial crime, including what to consider when sharing data and intelligence
13. 13Other laws and regulations that impact AML/counter-terrorist financing (CTF) applications, including but not limited to data privacy, consumer protection, environmental, social, and governance (ESG), conduct and ethics, and financial inclusion

1. 1What makes an effective compliance program and what are the core pillars of the AFC program
2. 2Roles and responsibilities of the three lines of defense, and the Bank Secrecy Act (BSA) officer/Money Laundering Reporting Officer (MLRO)
3. 3The purpose of a risk appetite statement (RAS), how to define and write a RAS, and how to communicate the RAS and implement corresponding controls in the organization
4. 4Enterprise risk assessment: how inherent risk is identified, and the controls used to assess residual risk to AML, CFT, fraud, sanctions, ABC, and tax evasion
5. 5The importance of a risk based approach (RBA) and building controls commensurate with risks
6. 6The difference between policies, standards, and procedures; how policies, standards, and procedures enable an organization to mitigate risks and what they need to contain
7. 7Reviewing regulatory guidance and obligations, incorporating horizon scanning, and industry best practices as part of drafting policies and procedures
8. 8The importance of governing committees, their structure, terms of references, and roles in organizational decision making
9. 9The key performance indicators (KPIs), key risk indicators (KRIs), management reporting information, and information on emerging and evolving financial crime risks needed by boards and management committees to make decisions and discharge oversight responsibilities
10. 10The FC reporting requirements in differing jurisdictions
11. 11The other risk management teams, including operational risk, financial risk and non-financial risk, and reputational risk
12. 12The purpose of controls at the point of onboarding and throughout the customer life cycle, including exit controls (e.g., consideration at the relevant committee and liaison with law enforcement and FIUs regarding keeping accounts open as needed)
13. 13The designing, implementing, and monitoring of controls, including but not limited to know your customer (KYC), customer due diligence (CDD), Enhanced Due Diligence (EDD), employee due diligence, customer risk assessment, and transaction monitoring
14. 14The role of risk assessment, the types of risk assessment and how to identify, assess, and mitigate AML, CFT, sanctions, fraud, ABC, tax evasion risks; inputs to and output of risk assessment in managing AFC risks
15. 15Designing controls for potential high-risk scenarios in relation to customers, products, services, channels, and jurisdictions, including but not limited to transactions involving conflict zones, dual-use goods, PEPs, and complex ownership structures
16. 16Other due diligence requirements, including but not limited to employee due diligence and insider threats, vendors, and third parties
17. 17How to investigate unusual transactions and activities and gather information, including how to identify suspicious activities through transactions, staff reports, and external sources
18. 18How to document your investigation to determine when to escalate and report suspicion; how to write and document your suspicious activity report (SAR); or how to complete your internal investigation within required timelines
19. 19When to escalate using the governance structure, including the decision-making process and documentation when offboarding the customer
20. 20Responding to court orders, subpoenas, and law enforcement agency requests for information, and responding to partners' organizations (in the context of the FinCEN sections 314a, 314b, Article 75 of Regulation (EU) 2024/1624, and COSMIC in Singapore)
21. 21De-risking and financial inclusion
22. 22Communicating with customers through established channels, use of requests for information (RFIs), consequences of tipping off, and raising awareness
23. 23How to raise awareness and train staff regarding the risks related to FC
24. 24The typical structure and principles of FC teams, their roles and responsibilities, and the most common position of the FC teams in the organizational chart
25. 25Interaction between AFC professionals and the front office, including but not limited to relationship managers and account managers; their roles and responsibilities in the detection of financial crime
26. 26The different functions or departments within an organization that help make the organization's AFC compliance program more robust, including but not limited to data privacy, cybersecurity, and other types of risk management functions

Example scenario: Transaction monitoring flags a long-standing customer whose cash deposits tripled after a change of business. What should the analyst do before deciding whether to file a SAR?

1. 1Tools available to implement controls across the customer lifecycle
2. 2Data quality, integrity, access, definitions, and taxonomy
3. 3Building a good customer experience with the right level of friction
4. 4Onboarding controls: the latest solutions for KYC, including but not limited to digital onboarding, electronic-know your customer (E-KYC), digital identity, facial recognition, liveness checks, biometrics, and geolocation
5. 5Onboarding controls: automated/manual external data sources used for KYC and screening, including but not limited to credit reference agencies, beneficial ownership registers, adverse media, criminal records, and government identity checks
6. 6Onboarding controls: name screening/customer screening and use of sanctions lists (including UN, Office of Foreign Assets Control (OFAC), EU, and other internal and external watch lists such as fraud and terrorist financing lists)
7. 7Ongoing controls: periodic refresh and perpetual KYC, including prioritization, applying a risk-based approach, and consideration of the use of artificial intelligence (AI)/machine learning-based tools
8. 8Ongoing controls: adverse media screening tools and consideration of the use of AI/machine learning-based tools
9. 9Ongoing controls: customer/batch screening for sanctions, use of fuzzy logic within the tools, considerations of AI/machine learning-based tools, and list management
10. 10Ongoing controls: transaction/payment screening, including specific payment message types, including but not limited to SWIFT, blockchain transactions, and consideration of the use of AI/machine learning-based tools
11. 11Ongoing controls: traditional transaction monitoring, the use of a rules-based approach to transaction monitoring, customer segmentation, scenario coverage, threshold setting, statistical testing (ATL/BTL), model risk management, and tuning scenarios for effectiveness
12. 12Ongoing controls: enhancing efficiencies and effectiveness, transitioning from rules-based to primary and/or secondary AI/machine learning-based tools
13. 13Ongoing controls: investigations, the use of open source tools, automation to support investigators, and consideration of the use of AI/machine learning-based tools
14. 14Ongoing controls: network analysis tools to determine any links to criminality, and consideration of the use of AI/machine learning-based tools
15. 15Technologies helping to navigate privacy and data protection rules
16. 16What to consider when choosing the best AFC tool for an organization and considerations for integration
17. 17Operational effectiveness, efficient controls, and the use of a risk-based approach to prioritize resources and investment