Series 24 AML Supervision Practice Questions
Question 1
An examiner reviewing a firm's AML program finds it has written policies and procedures, a designated AML compliance officer, and ongoing employee training, but has never had the program evaluated by anyone other than the compliance officer who designed it. This is most likely a deficiency because a firm's AML program must also include:
- A. Senior management sign-off on the program obtained each year from the firm's CEO and board, which serves in place of independent testing of its effectiveness
- B. Prior approval of the AML program by FinCEN before the firm may begin implementing it and accepting new customer accounts
- C. A separate SAR filing generated automatically for every new account opened, whether or not any suspicious activity is identified
- D. Independent testing of the program, conducted by firm personnel or a qualified outside party not involved in its day-to-day operation
Show answer and explanation
Correct answer: D. Independent testing of the program, conducted by firm personnel or a qualified outside party not involved in its day-to-day operation
A compliant AML program rests on four core pillars: (1) written policies and procedures, (2) a designated AML compliance officer, (3) ongoing employee training, and (4) independent testing for compliance, performed by firm personnel or a qualified outside party who is not the person who designed or administers the program day-to-day. The facts describe a program missing the fourth pillar.
- A. Annual sign-off by the CEO and board is not one of the required AML program pillars and does not substitute for independent testing.
- B. Incorrect. FinCEN does not pre-approve individual firms' AML programs before implementation or before the firm accepts accounts.
- C. Incorrect. SARs are filed based on analysis of suspicious activity, not generated automatically for each new account.
- D. Correct. Independent testing by someone not involved in day-to-day AML operations is the missing required pillar.
Question 2
Under FinCEN's rules, for how long must a broker-dealer retain copies of filed Suspicious Activity Reports and their supporting documentation?
- A. 3 years
- B. 7 years
- C. 6 years
- D. 5 years
Show answer and explanation
Correct answer: D. 5 years
FinCEN's SAR rules require broker-dealers to retain copies of filed SARs and all supporting documentation for five years from the date of filing. This is distinct from the general SEC/FINRA books-and-records retention period of six years for many other records, which is a common source of confusion.
- A. Three years is shorter than the actual FinCEN retention period for SARs and supporting documentation.
- B. Seven years overstates the required SAR retention period.
- C. Six years is longer than the SAR-specific retention period (though it matches some other books-and-records categories, it is not correct here).
- D. FinCEN's rules require broker-dealers to retain copies of filed SARs and their supporting documentation for five years from the date of filing.
Question 3
Before sharing information with another financial institution regarding suspected money laundering or terrorist financing under the Section 314(b) safe harbor, what must a broker-dealer first do?
- A. The firm must first obtain the customer's written consent to share the information
- B. The firm may only share information after it has already filed a SAR concerning the same activity
- C. The firm must obtain approval from its state securities regulator before each disclosure and then report the disclosure to FinCEN
- D. The firm must file an annual notice with FinCEN of its intent to share information under Section 314(b)
Show answer and explanation
Correct answer: D. The firm must file an annual notice with FinCEN of its intent to share information under Section 314(b)
Section 314(b) provides a safe harbor from liability for financial institutions that voluntarily share information with one another regarding suspected money laundering or terrorist financing, but the safe harbor is only available to institutions that have filed the required annual notice with FinCEN certifying their intent to share information under this provision. Customer consent is not required (and would defeat the purpose, since the customer is often the subject of the concern), there is no state-regulator pre-approval step, and sharing is not contingent on a SAR having already been filed — 314(b) sharing can occur independent of, and often before, any SAR filing.
- A. No customer consent is required or even permitted as a precondition -- 314(b) sharing occurs specifically because alerting the customer could tip off suspected illicit activity.
- B. 314(b) sharing is not contingent on first filing a SAR; the two are independent tools, and firms are not permitted to disclose SAR filing status to the receiving institution.
- C. State securities regulators play no role in authorizing 314(b) sharing, and there is no per-disclosure approval or after-the-fact report to FinCEN; the requirement is an annual notice of intent to FinCEN.
- D. Correct -- before relying on the safe harbor, a firm must file an annual notice with FinCEN indicating its intent to share information with other financial institutions under Section 314(b).
Considering a career as an advisor?
Explore careers at ParsonexQuestion 4
Under FinCEN's Customer Due Diligence (CDD) rule, when a legal entity customer opens a new account, the firm must identify and verify the identity of any individual who owns, directly or indirectly, what minimum percentage of the entity's equity interests, in addition to one individual with significant managerial control?
- A. 10% or more
- B. 20% or more
- C. 25% or more
- D. 50% or more
Show answer and explanation
Correct answer: C. 25% or more
The CDD rule's beneficial ownership requirement uses a two-pronged test: an 'ownership prong' requiring identification of each individual who owns 25% or more of the entity's equity interests, and a 'control prong' requiring identification of a single individual with significant responsibility to control, manage, or direct the entity. Both prongs must be satisfied when applicable.
- A. 10% is not the CDD beneficial ownership threshold; it's a lower bar than the rule requires.
- B. 20% is a plausible-sounding round number but not the actual regulatory threshold.
- C. Correct — 25% or more ownership triggers beneficial-owner identification under the CDD rule's ownership prong.
- D. 50% is too high; it would exclude beneficial owners the rule intends to capture at the 25% level.