Study guide
1.1 CAFCA Exam Format, Official Domains, and Study Strategy
ACAMS Certified AML FinTech Compliance Associate CAFCA
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CAFCA Exam Overview and Study Strategy
1.1 CAFCA Exam Format, Official Domains, and Study Strategy
2 Chapter 2: Domain 1: FinTech Business Models and Their Vulnerabilities
2.1 Neobanks, Challenger Banks, and Digital Banking Models 2.2 Payment Processors, Gateways, and Merchant Acquirers 2.3 Buy Now, Pay Later (BNPL) and Alternative Credit 2.4 BaaS Architecture, Embedded Finance, and Program Structures
3 Chapter 3: Domain 1: Financial Crime Types and the Regulatory Perimeter
3.1 Types of Financial Crime and Predicate Offences 3.2 Licensing, Registration, Charters, and Regulatory Sandboxes 3.3 Virtual Asset Service Provider (VASP) Framework & FinCEN MSB Rules
4 Chapter 4: Domain 1: Global AML Frameworks and Sources of Guidance
4.1 U.S. Regulatory Architecture: BSA, PATRIOT Act, and AMLA 2020 4.2 European Union Regulatory Framework: AMLD6, the AML Package, and MiCA 4.3 International Standards: UK FCA, Singapore MAS, and Hong Kong HKMA 4.4 Sources of Guidance for Building Anti-Financial Crime Processes
5 Chapter 5: Domain 1: Risk Management Framework, Risk-Based Approach, and Data Protection
5.1 Risk Management Framework: Lines of Defence, Policies, Assurance, and the MLRO 5.2 Risk-Based Approach, Risk Assessment, Risk Appetite, and Types of Risk 5.3 Handling Sensitive Information: PII, SPII, Privacy Laws, and Breach Reporting
6 Chapter 6: Domain 1: Bank Partners and Internal Threats
6.1 Regulatory Expectations and Enforcement on Sponsor Banks 6.2 How Banks Risk-Rate FinTechs: Onboarding, Ongoing Oversight, and De-Risking 6.3 Controlling Internal Threats: Insider Fraud, Collusion, and Data Misuse
7 Chapter 7: Domain 2: CIP, KYC, CDD, and EDD
7.1 Customer Identification Program (CIP) Under USA PATRIOT Act §326 7.2 The FinCEN CDD Rule & Beneficial Ownership Standards 7.3 KYC to EDD: Applying CDD and Enhanced Due Diligence Across Customer Types
8 Chapter 8: Domain 2: Identity Verification, Data Sources, and Device Data
8.1 Digital Onboarding & Electronic KYC (eKYC) Foundations 8.2 Biometric Face Matching and Liveness Detection 8.3 Verification Data Sources and How to Judge Their Reliability 8.4 Device Fingerprinting, Geolocation, and Behavioral Biometrics
9 Chapter 9: Domain 2: Onboarding Screening, Risk Ratings, and Fraud Red Flags
9.1 Screening at Onboarding: Sanctions Lists, PEPs, and Known Fraudsters 9.2 Customer Risk Ratings: Factors, Data Sources, and How Scoring Models Work 9.3 Detecting Synthetic Identity Fraud and Ineligible Applicants 9.4 Deepfakes, Generative AI Threats, and Scam Typologies
10 Chapter 10: Domain 3: Payment Screening
10.1 OFAC Sanctions Regimes & the 50 Percent Rule 10.2 Real-Time vs. Batch Screening Architecture in High-Velocity Rails 10.3 Screening Logic: Fuzzy Matching, Phonetics, and PEP Controls
11 Chapter 11: Domain 3: Transaction Monitoring Systems and Red Flags
11.1 Hybrid Transaction Monitoring: Rules Engines vs. Machine Learning 11.2 FinTech Typologies: Mule Networks, Funnel Accounts, and Rapid Pass-Through 11.3 Fraud-AML Convergence: BIN Attacks, ATO, and Credential Stuffing 11.4 Model Risk Management Under SR 11-7 & System Optimization
12 Chapter 12: Domain 3: Payment Methods and Transaction Risk Characteristics
12.1 Common Payment Methods, Crypto, and High-Risk Transactions Such as Aggregation 12.2 Transaction Risk Characteristics: Reversibility, Convertibility, Fund Integrity, and Privacy Coins 12.3 Wallet Types, Custody Architectures, and Counterparty Risks 12.4 Stablecoins, On/Off Ramps, and Asset-Referenced Tokens
13 Chapter 13: Domain 3: Monitoring Crypto Transactions
13.1 Blockchain Analytics & Transaction Tracing 13.2 The FATF Travel Rule for Virtual Assets 13.3 DeFi, Mixers, and Smart Contract Sanctions
14 Chapter 14: Domain 3: Alert Investigation, Audit Trails, and Monitoring MI
14.1 The Alert Investigation Process: From Unusual to Suspicious and When to Escalate 14.2 Building an Audit Trail for Suspicious Activity Reviews 14.3 Communicating Monitoring Results: KPIs, KRIs, OKRs, and Management Information
15 Chapter 15: Domain 4: Investigations and Customer Communication
15.1 Talking to Customers During Investigations and Offboarding: Financial Crime Risk vs Policy Breach 15.2 Reviewing KYC, Transactions, Open Sources, and Documents to Build an Investigation 15.3 Analytical Principles in Investigations: Avoiding Confirmation Bias and Other Traps
16 Chapter 16: Domain 4: SARs and STRs
16.1 SARs and STRs: What They Are, When and Where to File, and Why They Matter 16.2 Writing Effective SAR and STR Narratives
17 Chapter 17: Domain 4: Law Enforcement, Regulators, and Banking Partners
17.1 Operational AML Governance and Third-Party Risk Management 17.2 Working With Law Enforcement, Banking Partners, Regulators, and Other Third Parties 17.3 Types of Law Enforcement Requests: Subpoenas, Court Orders, 314(a), and International Requests 17.4 How Banking Partners' Terms of Service Relate to the FinTech's Own Terms
18 Chapter 18: Domain 5: Scaling Anti-Financial Crime Strategies
18.1 Assessing New Products and Features Before Launch 18.2 Refreshing the Financial Crime Risk Assessment as the Business Scales 18.3 Changes That Should Trigger a Financial Crime Risk Assessment Review 18.4 Record Retention Rules and Secure Data Storage 18.5 Outsourcing Controls: Surge Capacity, RegTech, and Independent Testing
1.1 CAFCA Exam Format, Official Domains, and Study Strategy
Key Takeaways Explain This Topic AI
The CAFCA exam has 60 multiple-choice questions, some of them unscored pretest items, and a 90-minute time limit (ACAMS Candidate Handbook).
ACAMS requires CAFCA candidates to answer at least 70% of the scored questions correctly, with no penalty for guessing.
The five CAFCA domains are weighted 20% governance, 20% due diligence, 25% payment screening and monitoring, 20% investigations, and 15% scaling.
The CAFCA credential is valid for one year and is renewed free each year with active ACAMS membership and two recertification credits.
Last updated: October 2026
CAFCA, the Certified AML FinTech Compliance Associate , is the FinTech certification in the ACAMS associate-level family. ACAMS launched it in December 2020 with the specialist consultancy FINTRAIL, and testing began in 2021. The programme pairs an eight-hour digital course with a proctored 90-minute exam. This guide is independent CAFCA practice by ExamFinch. It follows the five domains published in the ACAMS CAFCA Candidate Handbook, and every chapter maps to one or more of the handbook's numbered sub-topics.
Current exam facts
- Item CAFCA detail (ACAMS sources)
- Questions 60 multiple-choice items; some are unscored pretest items that are not identified
- Time 90 minutes
- Passing standard At least 70% of the scored questions answered correctly
- Guessing No penalty; answer every item
- Delivery Pearson VUE test centre or Pearson VUE online proctoring
- Language English
- Eligibility No formal eligibility requirements
- Scheduling window Schedule and sit the exam within six months of ACAMS accepting the application
- Standard package (private sector) US$1,045; ACAMS membership is required to obtain and keep the credential
- Retake US$199; associate exams can be retaken after a 30-day wait
- Validity One year; recertify free each year with an active membership and two recertification credits
Two details catch candidates out. First, the 70% applies to scored items only, so you cannot tell which questions count. Treat every item as live. Second, the practice exam runs on the ACAMS learning management system, while the real exam runs at Pearson VUE. Expect a different interface on exam day. Course materials are removed from the LMS once you sit the exam, so finish your notes beforehand.
The five official domains
Domain Weight Approximate items out of 60 What it tests
1. Governance, Guidance, and Regulation 20% about 12 FinTech types and vulnerabilities, crime types, licensing and sandboxes, risk management framework, data privacy, risk-based approach, guidance sources, bank relationships, insider threat, risk types
2. Due Diligence Across Customer Types 20% about 12 CIP, KYC, eKYC, CDD and EDD; ID verification; data sources and their reliability; device data; sanctions, PEP and fraud screening; risk ratings; onboarding fraud red flags
3. Payment Screening and Transaction Monitoring 25% about 15 Purpose of monitoring; payment screening; red flags; payment methods including crypto; alert investigation; audit trails; transaction risk characteristics; systems and thresholds; KPIs and OKRs
4. Investigations, Inquiries, and Reporting 20% about 12 Customer communication; evidence review; analytical bias; SARs and STRs; working with law enforcement, partners and regulators; law enforcement requests; partner terms of service
5. Scaling Anti-Financial Crime Strategies 15% about 9 New products and features; refreshing the risk assessment; triggers for review; record retention and data storage; outsourcing, RegTech and independent testing
Because some items are unscored, the item counts are estimates only. Domain 3 carries the most weight, so payment screening and monitoring deserve the most practice time. Domains 4 and 5 together account for 35% of the exam. Candidates who only study onboarding and crypto often lose marks there.
How the exam asks questions
CAFCA is written for practitioners at an earlier career stage than CAMS. The questions are mainly scenarios. A FinTech product team wants to remove a control, a partner bank asks for data, an alert shows rapid pass-through, or a customer asks why a payment is held. The best answer is usually the one that:
Applies a risk-based control rather than an absolute ban or no control at all.
Keeps the firm's legal obligations intact. Outsourcing a task never outsources the responsibility for it.
Records the decision so that an auditor or regulator can follow it later.
Protects confidentiality. Suspicion and reporting are never disclosed to the customer.
Escalates through the right owner, such as the MLRO, the bank partner, or law enforcement through proper channels.
The outline is jurisdiction-neutral, but it names real regimes, such as GDPR and CCPA in the privacy topic. This guide uses US, EU, UK and Asian rules as worked examples. On the exam, choose the principle the rules share, unless the question names a jurisdiction.
Building a study plan
Read the chapters in domain order. Then reread Chapters 14 to 18, which cover alerts, investigations, reporting and scaling, because these are the most procedural topics.
For every section, write one sentence explaining why the control exists. Associate exams reward understanding of purpose.
Practise timing. Ninety minutes for 60 items is 1.5 minutes per question. Flag long scenarios and come back to them.
Use the end-of-section quizzes, then the ExamFinch CAFCA practice bank, and then the ACAMS practice exam in the LMS.
Realistic exam scenario
A candidate who scored 64% on a practice test notices that most misses came from questions about customer offboarding calls and law enforcement production orders. Those topics sit in Domain 4, worth about 12 items. The best remedy is targeted review of investigations and reporting, not more reading on FinTech business models, which is already a strength.
Common exam traps
Assuming a scaled score. ACAMS publishes the CAFCA standard as 70% of scored questions, not a scaled score.
Studying an unofficial outline. Some third-party outlines invent domains such as "ethics" or "crypto 20%". Use the five handbook domains.
Treating CAFCA as a crypto exam. Crypto appears inside payment methods and transaction risk, alongside cards, wallets, instant payments and aggregation.