ROLE OF TRANSACTION MONITORING IN FINANCIAL CRIME PREVENTION 20%
1.1 Types of financial crime related risk (e.g.,
regulatory, legal, financial, and reputational risk;
customer, jurisdiction, geography, and channel
risk)

1.2 The purpose of transaction monitoring in
the context of the risk-based approach, risk
assessment, and risk appetite of an institution

1.3 Specific risks associated with customer types
(e.g., non-bank financial institutions, money
service bureaus, cash-intensive small businesses,
vehicle sellers, etc.), and products (e.g.,
correspondent banking, money orders, thirdparty payment processors, pre-paid cards)

1.4 The beneficial ownership and counter-party
checks required in transaction monitoring

1.5 The relationship between transaction monitoring
and ongoing due diligence, including KYC-CDD,
customer profiles, customer risk scores, and
anticipated customer behavior

1.6 Screening transactions versus post-transaction
alerts, including how sanctions and fraud risk are
managed

1.7 How the effectiveness of transaction monitoring
processes is measured and quality is assured
(e.g., false-positive rates)

1.8 The difference between unusual and suspicious
activity

TRANSACTION MONITORING ALERT GENERATION 15%
2.1 How alerts are generated and different alert
sources (e.g. manually prepared reports/human
referrals and automated transaction monitoring
programs)

2.2 How to determine if an alert is valid, including
differentiating between valid alerts, false
positives, and non-productive alerts

2.3 Why the volume of alerts may change over time
and how/when to report changes to higher level
managers

2.4 The purpose of scenarios, rules, patterns,
behavior bases, and thresholds

2.5 The purpose of tuning, the responsible parties
(e.g. governance structure) and when it
should be conducted, as well as how the alert
monitoring process informs tuning activities in
the organization

ALERT INVESTIGATION 40%
3.1 Money laundering typologies/red flags and
associated unusual transaction activity (e.g.,
structuring, transaction with no apparent
economic, business, or lawful purpose, suspicious
wire transfers)

3.2 Terrorist financing typologies/red flags and
associated unusual transaction activity (e.g.,
charities and non-profits, diamonds, precious
metals, antiquities)

3.3 Non-AML financial crime typologies/red flags
and associated unusual transaction activity
(e.g., fraud, sanctions, tax evasion, and bribery/
corruption)

3.4 How to investigate multiple alerts by an individual customer (e.g., multiple alerts generated for one transaction monitoring period related to the
same customer)

3.5 The research steps involved in transaction
monitoring investigations (e.g., obtaining and
reviewing KYC-CDD information, reviewing the
case management system, checking internal
sources, looking at transaction data related to
the alerts, and reviewing linked counter-parties
and accounts)

3.6 Best practices for gathering additional
information (e.g., contacting a customer as
part of an investigation, submitting a request
for information (RFI), and conducting public
searches)

3.7 Common mistakes in transaction monitoring
(e.g., not considering the source of the data and
using out of date records in the review process)

3.8 How to identify new risks during transaction
monitoring investigations

OUTCOMES OF TRANSACTION MONITORING INVESTIGATIONS 25%
4.1 Outcomes of the transaction monitoring
investigation (e.g., alert closure, alert closure
with CDD update or other recommendation,
escalation, recommended SAR filing)

4.2 How to document rationales for decisions and
create an audit trail (e.g. for regulators, future
law enforcement inquiries, assurance and audit
teams)

4.3 Regulatory requirements associated with
reporting suspicious and/or unusual activity
(e.g., MLRO responsibility, when process begins,
time period for filing, agency for reporting) and
criteria for manually escalating an alert to a case

4.4 The reasons for which activity should be
escalated for a potential SAR filing, the
confidentiality of SARs (e.g., tipping off), and
what occurs after a SAR is filed

4.5 Notifications from FIU/law enforcement,
including requests to close account or maintain
normal business activity, dealing with repeat
SARs, etc.