The listed syllabus stacks neighboring concepts — CDD against enhanced due diligence, front-running against insider dealing, compliance against internal audit — and studying them as definitions blurs the boundaries. The useful skill is discrimination: for each named concept, know its one-sentence decision rule, the fact that triggers it, and the next required action. Study in contrast pairs: write the rule and trigger for each member, then sort short scenarios into buckets and note where you hesitate. Work the two worked examples below, run the scenario-sorting exercise in the final section, and hold yourself to the readiness checks there rather than to vague feelings of familiarity.
Regulatory Framework: Duties Attach to Roles, Not to the Rulebook as a Whole
Study regulation by asking who holds each obligation, what triggers it, and what the required response is. A rule that binds the firm as licensee differs from one that binds an individual officer personally.
Many framework rules are principle-based: they state an outcome, such as maintaining adequate systems, and leave the method to the firm. Others are prescriptive and specify the exact step. Read each rule and label it. For principle-based rules, practice naming the evidence that would demonstrate compliance — a documented policy, a monitoring record, a training log. For prescriptive rules, memorize the step itself. Mixing these two modes confuses scenario answers, because the correct option follows from which mode the rule uses.
Separate the regulator's enforcement function from the firm's preventive compliance function. Enforcement asks whether a breach occurred and what sanction follows; compliance asks how to make breaches unlikely and how to detect them early. When a scenario describes a potential breach, decide whether the question concerns the duty breached, the control that should have prevented it, or the escalation that should follow discovery. Naming the layer first narrows the plausible options before you evaluate any of them.
Compliance Management Systems: Map Each Obligation to a Control You Could Test
A compliance management system is a cycle: identify the obligation, assign a control owner, monitor, report, and remediate. Practice tracing one obligation end to end rather than memorizing the cycle's labels.
Distinguish a compliance monitoring plan from ad hoc control testing. A monitoring plan states which obligations will be reviewed, how often, and by what method, with frequency driven by risk rating. A higher-risk obligation such as client onboarding justifies scheduled file and transaction reviews; a lower-risk obligation may warrant periodic policy attestation. When a scenario gives a firm's activities and asks where compliance effort should go, rank the risks first, then match monitoring frequency to the ranking.
Trace one obligation fully as an exercise. Take 'maintain records of client orders.' Identify the control (a timestamped order log), the owner (operations, with compliance oversight), the monitoring test (sample orders against a source record), the reporting route (compliance reporting to senior management), and the remediation path (gap logged, fix assigned, retested). Writing this chain for five obligations builds the mapping skill that scenario items probe, and it exposes obligations whose controls you can currently describe only vaguely.
Ethics Questions Turn on Classifying the Conflict Before Reaching for a Rule
Before applying any conduct rule, classify the situation: personal interest, gift or benefit, information advantage, or competing duty. Each class carries different disclosure and approval mechanics, so misclassification derails the answer.
Personal account dealing rules concern an employee trading where personal interests could conflict with clients or the firm; gift and entertainment rules concern external benefits that could bias business judgment; misuse-of-position rules concern leveraging role or information for private benefit. The classes overlap in feel but differ in the required response — pre-clearance and restrictions in one case, threshold-based disclosure in another, outright prohibition in a third. Learn each class's response separately, then test overlap cases against both.
Practice the classification step explicitly: given a short vignette, write the class, the interest at risk, and the required next step before considering options. Aim for language like: 'personal interest — employee holds shares of a client firm — requires disclosure and pre-approval before related dealing.' If you can produce that sentence pattern for vignettes across all four classes, you have the discrimination this topic requires; if you cannot, return to the class definitions rather than to more vignettes.
AML/CFT: Walk the CDD-to-Escalation Path on Paper Before Facing It Live
AML/CFT questions follow a decision path: apply due diligence proportionate to risk, recognize when indicators cross into suspicion, and escalate through the internal channel without alerting the customer. Rehearse each fork separately.
Keep customer due diligence and enhanced due diligence conceptually distinct. CDD establishes who the customer is and whether activity matches the stated purpose and expected profile. EDD is the higher-scrutiny tier applied when risk factors elevate concern — unusual complexity, opaque ownership, or activity inconsistent with the profile. The trigger fact decides the tier: consistent, explainable activity stays within CDD; indicators of mismatch move it to EDD. Suspicion, the trigger for escalation, sits below proof — you escalate on reasonable grounds, not on certainty of wrongdoing.
Worked example: a consultant's account receives cash deposits, each just under an internal threshold, while his declared income is modest. Mistake: declining escalation because the deposits are 'explainable' — applying a proof standard to a suspicion trigger. Better decision: treat the structuring pattern and profile mismatch as escalation indicators, escalate internally with a documented rationale, and avoid inquiries that would reveal the review to the customer, since tipping off is a distinct concern in AML frameworks. Why it matters: wrong threshold and premature disclosure are separate concepts this topic tests together. Confirm your syllabus's exact thresholds and procedures.
Market Conduct: Identify the Information Type, Then the Prohibited Act
Market conduct violations are defined by the combination of information type and act. Classify the information first — pending client order, non-public issuer information, or misleading communication — then match the prohibited conduct.
Front-running concerns acting on knowledge of a pending client order for personal or proprietary benefit ahead of that order. Insider dealing concerns dealing on inside information about an issuer. Misleading conduct concerns statements or practices that distort understanding of a market or product. These share a surface feature — non-public information — but the prohibited act and the corresponding controls differ: order-handling restrictions for pending order information, restricted-list and MNPI handling for issuer information, disclosure standards for communications. Classify the information before evaluating any option.
Worked example: a dealer learns of tomorrow's large client buy order and purchases the same instrument for the firm's proprietary book beforehand. Mistake: labeling it insider dealing and checking only the restricted list — an issuer-information control — then concluding the instrument is unrestricted. Better decision: identify the information as a pending client order, which implicates front-running rules protecting client order priority, a different control set covering order handling. Why it matters: the label determines the right control, and an available option can share your instinct while applying the wrong control — check the label before choosing. Confirm which conduct rules your syllabus enumerates.
Governance: Second Line versus Third Line Is a Reporting and Independence Question
Compliance and risk sit in the second line, advising and monitoring within management; internal audit is the third line, independently assuring both. Escalation routes and independence bases, not job titles, define the boundary.
The second line designs controls, advises the business, monitors adherence, and reports to senior management and the board; the third line assesses whether the first two lines work and reports with independence from them. In scenarios, the tell is the question asked: 'what should we do about this risk' is second-line work; 'is the control framework operating as designed' is third-line work. Assigning a third-line question to compliance — or the reverse — blurs the independence the governance structure depends on.
Escalation direction also distinguishes the roles. Compliance escalates breaches and control failures to senior management and the board or its committee, and raises regulatory matters through the firm's designated channel. Internal audit escalates opinions on effectiveness, not individual transaction decisions. When a vignette describes a discovered breach, ask who owns the response: the second line recommends remediation and monitors it; the third line may later test whether remediation held. Write the reporting chain for both roles for one breach and compare them.
| Dimension | Compliance (second line) | Risk management (second line) | Internal audit (third line) |
|---|---|---|---|
| Primary question | Are regulatory obligations being met? | Are risks identified and within appetite? | Do the first two lines work as designed? |
| Position | Within management, advisory and monitoring | Within management, risk-focused | Independent of management |
| Typical output | Obligation mapping, monitoring reports, breach escalation | Risk assessments, appetite and limit frameworks | Assurance opinions and follow-up on remediation |
| Relationship to a breach | Detects, escalates, tracks remediation | Assesses risk of recurrence | Independently evaluates handling afterwards |
Preparation Sequence: Contrast Pairs First, Scenario Sorting Second, Rubric Last
Spend the first pass building one-sentence decision rules for each contrast pair, the second pass sorting mini-scenarios, and the final pass against a written rubric. Self-check scores mark learning milestones, not predicted results.
An adaptable sequence: first, for each of the six syllabus topics, list its named concepts in contrast pairs and write the decision rule and trigger fact for each member. Second, write or collect two short vignettes per pair and sort them, recording label, trigger, and next step in one line each. Third, redraw the governance and AML decision paths from memory and compare against notes. Repeat any pair whose rules you cannot state without checking. The order matters more than the calendar; stretch or compress it to your weeks.
Exercise: build a ten-row sheet — five AML and conduct pairs, five governance and ethics pairs. For each row, write the rule, the trigger, and the next step. Then use a shuffled set of six unlabeled vignettes and sort each within a minute. Expected observations: hesitation on EDD-versus-CDD triggers, or on second- versus third-line questions, marks those pairs for another pass. A clean sort with a stated next step for every vignette indicates the discrimination is holding; any blank row means return to definitions first.
- Rubric — score each contrast pair: 0 (rule not recallable), 1 (recallable but trigger unclear), 2 (rule, trigger, and next step all stated from memory).
- A rubric total of 16/20 or higher before scenario sorting suggests the concept layer is solid; below that, work definitions first.
- Readiness check 1: you can redraw the CDD-to-escalation path, including where tipping-off risk begins, without notes.
- Readiness check 2: you can classify a conduct vignette by information type before reading any answer options.
- Readiness check 3: for any breach scenario, you can name the owning line, the escalation route, and the remediation owner.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.