Free CISI Combating Financial Crime mock exam

Not quite. The answer is D.

Money laundering and other financial crime risk has to be built into day-to-day operations, and the syllabus names three moments in particular: new product development, customer take-on and changes in the business profile. Dividend policy is a capital and shareholder question that sits outside this list. The three named points matter because they are precisely where a firm's exposure changes, so controls reviewed only on an annual cycle will always lag the business.

Not quite. The answer is D.

IMF staff have participated since 2020 in the anti-money laundering and counter-terrorist-financing assessments run by other assessor bodies, the FATF-style regional bodies among them, and the Fund also cooperates on peer evaluations, technical assistance and policy development. Regulators authorising banks is the strongest distractor. Authorisation is a supervisory function, not assessment work, and the IMF has no part in it. Maintaining designation lists and investigating offences sit with sanctions authorities and law enforcement respectively.

Not quite. The answer is B.

The regulations were amended to bring cryptoassets and prepayment cards within the anti-money laundering perimeter, closing two channels that allowed value to move with little identification. Insurance products are the closest distractor because life policies have long been recognised as a laundering vehicle, but they were already covered as regulated products, so no extension was needed for them.

Not quite. The answer is B.

The corporate offence reaches bribery by anyone associated with the organisation who bribes on its behalf, and employees, agents and other representatives are all named to make the breadth plain. Confining it to payroll employees is the closest wrong answer and the most dangerous one commercially, because agents and intermediaries are where this risk usually sits. Shareholding and board membership describe ownership and governance, neither of which is the same as performing services for the organisation.

Not quite. The answer is D.

Ransomware, also described as file hijacking, denies the victim the use of their own machine or files until a ransom is paid, and it is the form of malware most often associated with crypto asset payments. A denial of service attack is the closest neighbour because it also denies access, but it does so by making a website unreachable from outside rather than by locking the victim's own device. Key logging and the ad-clicker steal information rather than extort payment.

Not quite. The answer is B.

The corporate offence does not transfer the client's tax debt: the tax stays owed by the taxpayer to the revenue authority, and confusing the firm's criminal exposure with the client's bill is the classic error. The 2017 Act grafts two further offences onto POCA rather than replacing it, so the established offences survive intact, which is why concealing and tipping off, and equally acquisition and failure to disclose, all remain fully in force. A relevant body convicted of the new offence is liable to an unlimited fine, so the statement about the penalty is accurate as well.

Not quite. The answer is A.

A freeze prevents the use and the movement of the money and leaves it immobilised where it sits, for as long as the designation lasts. Ownership does not change. This is what separates a freeze from confiscation, and it is why funds can be released intact if a designation is later lifted.

Not quite. The answer is B.

Country risk before onboarding asks where the customer is based, where its business is conducted and through which jurisdictions its funds are routed, and whether the firm can deliver the extra diligence a weak jurisdiction makes necessary. A product's appeal to an age group is the strongest distractor because it reads like a customer characteristic. It is a commercial question owed to the customer rather than one asked about the customer, and it measures no exposure to crime at all.