Prepare for the AML and CFT Certification by studying each syllabus topic as a sequence of decisions: which stage of laundering the scenario shows, which level of due diligence the customer relationship requires, what observable facts support suspicion, and which control or report the situation triggers. Work through written scenarios, map typologies to specific controls, and test yourself with a rubric that checks whether you can justify each decision, not just name the concept.
Why the three stages of money laundering change the red flags you should spot
Placement, layering, and integration describe where illicit funds are in the laundering cycle, and each stage produces different observable patterns, so identifying the stage is a useful first decision whenever you analyze a scenario.
Placement is the physical or digital entry of cash into the financial system: structured cash deposits, exchange house remittances, or cash-intensive business accounts absorbing unexplained revenue. Layering is movement designed to obscure the audit trail: rapid transfers between accounts, conversion between currencies or instruments, and chains of transactions that add distance between the source and the funds. Integration is re-entry as apparently legitimate wealth: asset purchases, business investments, or loans backed by previously layered funds.
A useful practice habit is matching the observed pattern to the stage, because the red flags differ. A customer depositing cash in many small instalments points to placement and structuring. An account that receives funds and forwards them within hours, leaving a small balance, points to layering. A dormant company suddenly buying property with an unexplained loan points to integration. In your notes, tag every typology you study with its stage, and practice that tagging until it is automatic.
- Placement red flags: unusual cash volume or composition relative to the customer's stated business, deposits split across branches or days.
- Layering red flags: rapid pass-through activity, round-amount transfers, transactions with no economic explanation.
- Integration red flags: asset acquisitions funded by loans from related parties or unexplained income.
KYC versus CDD versus EDD: which level of diligence does the scenario require?
KYC is the identity component, CDD is the broader process of understanding and risk-rating the customer, and EDD is the enhanced scrutiny applied to higher-risk relationships. Practice deciding which level the facts of each scenario require.
Treat KYC as a subset of CDD. KYC answers who the customer is: verified identity, legal form, and beneficial ownership. CDD adds who the customer is in a business sense: the purpose and intended nature of the relationship, the source of funds and, where relevant, the source of wealth, plus ongoing monitoring calibrated to the risk rating. A plausible mistake in practice is answering a scenario about source-of-funds questions with 'KYC' when the concept being tested is CDD, because the situation is about understanding the relationship, not merely identity.
EDD is triggered by higher risk, not by transaction size alone. Typical higher-risk factors in scenarios include politically exposed persons, customers from or in jurisdictions subject to countermeasures or identified as higher risk, complex or opaque ownership structures, and unusually large or unexplained transactions. EDD means senior approval for the relationship, deeper source-of-wealth corroboration, and intensified monitoring. Practice by reading a scenario and naming the trigger first, then the diligence level, then two concrete EDD actions; rehearse that three-step habit until it is automatic.
| Concept | Core question it answers | Typical trigger in a scenario | Example action |
|---|---|---|---|
| KYC | Who is the customer? | Opening any new relationship or account | Verify identity and legal form |
| CDD | What is the expected nature of this relationship? | Standard onboarding and ongoing monitoring | Record purpose, expected activity, beneficial ownership; monitor against profile |
| EDD | Is this relationship higher risk, and is it still acceptable? | PEP status, opaque ownership, high-risk jurisdiction links, unexplained activity | Senior approval, corroborate source of wealth, intensified review |
| Simplified diligence | Is risk demonstrably low? | Low-risk customer types where permitted by the framework | Reduce frequency or depth of measures, never omit them entirely |
Worked scenario: recognizing structuring instead of counting transactions
Structuring is splitting transactions to stay below a threshold or avoid attention. The mistake is evaluating each transaction in isolation; the better decision is to look at the pattern and escalate it as suspicious.
Scenario: a retail trader with a modest stated turnover deposits 9,500 in currency units at the same bank on four consecutive working days, at two different branches, always in cash, with no supplier payments following. The plausible mistake is concluding that nothing is reportable because every individual deposit sits below the reporting threshold and the customer's account history is otherwise clean. That reasoning evaluates four events separately when the observable fact is a pattern across them.
The better decision is to aggregate the view: the total cash volume is inconsistent with the declared business, the amounts cluster just under a known threshold, and the branch-splitting suggests deliberate avoidance of attention. That combination is itself grounds for internal escalation and, if suspicion remains after review, a suspicious transaction report under the institution's procedures. Note why it matters: structuring does not require the underlying funds to be proven criminal; evading a reporting or review threshold is a red flag in its own right. In your practice, always ask whether a scenario shows a pattern across transactions before concluding that each transaction is unremarkable.
From suspicion to STR: articulating grounds and respecting tipping-off rules
A suspicious transaction report is filed when you cannot reasonably explain activity consistent with the customer's profile, and the suspicion must be documented on observable facts while confidentiality about the report is strictly preserved.
Train yourself to write suspicion as a two-part statement: the observed facts, and the reason they do not fit the known customer profile. For example: 'Account received three round-amount transfers from unrelated third parties within a week and forwarded most of the funds abroad the same day; this is inconsistent with the account's declared use for local retail receipts.' That structure is exactly what internal escalation and report-filing decisions require, and it is also how you should justify an STR recommendation in your practice answers rather than restating that the customer 'looks suspicious.'
The second half of this topic is confidentiality, commonly called the tipping-off prohibition: informing a customer or a third party that a report has been made, or is contemplated, is itself an offence in most AML/CFT frameworks, and it extends to behavior that could tip the customer off, such as pausing an account without a legitimate, separately justified reason. When you review practice items, flag any option in which the staff member politely tells the customer that a report may be filed, and train yourself to reject it, because disclosure in that situation is prohibited conduct rather than a safe step. Learn the boundary as a rule of conduct: escalate internally, file through the designated channel, and say nothing to the customer about the reporting process.
Worked scenario: trade-based money laundering and incomplete scrutiny
Trade-based laundering moves value through mispriced or misrepresented goods. The plausible mistake is treating a complete-looking document file as adequate review; the better decision is testing the documents against market reality.
Scenario: an import company presents an invoice for goods valued far above the observable market price for that commodity, financed through a letter of credit, with payment routed to a supplier in a jurisdiction linked in the news to laundering networks. The plausible mistake is closing the review because the file contains an invoice, a bill of lading, and a shipping document, and the CDD record is complete. Document completeness is not the test; plausibility is.
The better decision is to apply enhanced scrutiny: compare the invoice value with an independent price reference, check whether the goods, quantity, and route are internally consistent, and examine the ownership links between importer and supplier for related-party over-invoicing. Over- and under-invoicing, multiple invoicing of the same shipment, and phantom shipments are the named typologies here, and each has a corresponding documentary check. Why it matters: trade finance is a classic layering channel, and a strong practice answer recommends EDD and price verification, which demonstrates exactly the judgment this material is meant to develop.
Internal controls and record keeping: mapping the three lines and the retention duty
Effective programs assign clear roles: front-line staff detect and escalate, the compliance function advises and files, management and audit oversee, while record keeping preserves the transaction trail so past activity can be reconstructed on demand.
Structure your study of internal controls around who does what at each stage. Front-line and business staff perform CDD at onboarding and recognize anomalies during the relationship; the compliance or AML function sets risk appetite and procedures, reviews escalations, and makes the report-filing decision; senior management owns the risk appetite and ensures resources; internal audit independently tests that the controls operate as designed. To turn this role list into applied knowledge, write your own one-line breakdown prompts, such as an escalation that was never reviewed or an EDD approval that was never obtained, and for each one name the layer that should have caught it and what that layer's duty was. Anchoring each duty to a role through prompts you author yourself is far more durable than re-reading the list.
Record keeping serves two purposes to distinguish in your notes: enabling reconstruction of individual transactions so investigators can trace funds, and demonstrating that the institution followed its own procedures, for example that EDD approval was obtained. Records typically cover customer identity data, transaction records, and the analysis behind decisions to file or not file, retained for the period set by the applicable framework. When a scenario offers a shortcut such as discarding internal review notes after a decision, the better answer preserves the analysis, because the reasoning behind a filing decision is part of the record.
FATF standards, cross-border issues, and a typology-mapping exercise with a self-check rubric
The FATF Recommendations form the international baseline that national AML/CFT laws implement, so when you study cross-border cases, practice connecting the international standard, the local legal duty, and the emerging typology involved.
Learn the architecture, not a list of forty texts. Key pillars to associate by name: risk-based CDD including beneficial ownership, suspicious transaction reporting and its confidentiality, institutional internal controls, international cooperation, and targeted financial sanctions related to proliferation and terrorism financing. Cross-border scenarios usually involve a correspondent relationship, a customer with assets or family in another jurisdiction, or a higher-risk jurisdiction connection; the decision to practice is applying EDD and checking the relevant framework, not declaring which country's law governs. Because national implementation varies, always tie obligations to the local law that your syllabus identifies rather than assuming the FATF text itself is directly enforceable.
Exercise to run weekly: take one typology, such as a remittance house handling structured cash, a shell company with pass-through accounts, or crypto-asset off-ramping into a bank account, and fill in a five-row map: laundering stage, observable red flags, required diligence level, control or escalation triggered, and one record or report generated. Self-check rubric: score each row 0 to 2, where 2 means specific and justifiable, 1 means partially correct, and 0 means missing or generic. A map scoring 9 or above out of 10 across three different typologies is a sensible milestone before moving to mixed practice sets; treat that as a learning benchmark, not a pass prediction.
- Preparation sequence: weeks 1–2 build concept cards for stages, KYC/CDD/EDD, STR, tipping off, and FATF pillars; week 3 map six typologies with the exercise rubric; week 4 work mixed scenarios and retest weak maps; final week do timed mixed review and re-score the maps you scored below 9.
- Readiness checks: you can name the stage and two red flags from any short scenario; you can state the EDD trigger and two EDD actions; you can write a two-part suspicion statement in under three sentences; you can explain the tipping-off boundary in one sentence without notes.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.