Study guide
5.1 Risk Management Framework: Lines of Defence, Policies, Assurance, and the MLRO
ACAMS Certified AML FinTech Compliance Associate CAFCA
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CAFCA Exam Overview and Study Strategy
1.1 CAFCA Exam Format, Official Domains, and Study Strategy
2 Chapter 2: Domain 1: FinTech Business Models and Their Vulnerabilities
2.1 Neobanks, Challenger Banks, and Digital Banking Models 2.2 Payment Processors, Gateways, and Merchant Acquirers 2.3 Buy Now, Pay Later (BNPL) and Alternative Credit 2.4 BaaS Architecture, Embedded Finance, and Program Structures
3 Chapter 3: Domain 1: Financial Crime Types and the Regulatory Perimeter
3.1 Types of Financial Crime and Predicate Offences 3.2 Licensing, Registration, Charters, and Regulatory Sandboxes 3.3 Virtual Asset Service Provider (VASP) Framework & FinCEN MSB Rules
4 Chapter 4: Domain 1: Global AML Frameworks and Sources of Guidance
4.1 U.S. Regulatory Architecture: BSA, PATRIOT Act, and AMLA 2020 4.2 European Union Regulatory Framework: AMLD6, the AML Package, and MiCA 4.3 International Standards: UK FCA, Singapore MAS, and Hong Kong HKMA 4.4 Sources of Guidance for Building Anti-Financial Crime Processes
5 Chapter 5: Domain 1: Risk Management Framework, Risk-Based Approach, and Data Protection
5.1 Risk Management Framework: Lines of Defence, Policies, Assurance, and the MLRO 5.2 Risk-Based Approach, Risk Assessment, Risk Appetite, and Types of Risk 5.3 Handling Sensitive Information: PII, SPII, Privacy Laws, and Breach Reporting
6 Chapter 6: Domain 1: Bank Partners and Internal Threats
6.1 Regulatory Expectations and Enforcement on Sponsor Banks 6.2 How Banks Risk-Rate FinTechs: Onboarding, Ongoing Oversight, and De-Risking 6.3 Controlling Internal Threats: Insider Fraud, Collusion, and Data Misuse
7 Chapter 7: Domain 2: CIP, KYC, CDD, and EDD
7.1 Customer Identification Program (CIP) Under USA PATRIOT Act §326 7.2 The FinCEN CDD Rule & Beneficial Ownership Standards 7.3 KYC to EDD: Applying CDD and Enhanced Due Diligence Across Customer Types
8 Chapter 8: Domain 2: Identity Verification, Data Sources, and Device Data
8.1 Digital Onboarding & Electronic KYC (eKYC) Foundations 8.2 Biometric Face Matching and Liveness Detection 8.3 Verification Data Sources and How to Judge Their Reliability 8.4 Device Fingerprinting, Geolocation, and Behavioral Biometrics
9 Chapter 9: Domain 2: Onboarding Screening, Risk Ratings, and Fraud Red Flags
9.1 Screening at Onboarding: Sanctions Lists, PEPs, and Known Fraudsters 9.2 Customer Risk Ratings: Factors, Data Sources, and How Scoring Models Work 9.3 Detecting Synthetic Identity Fraud and Ineligible Applicants 9.4 Deepfakes, Generative AI Threats, and Scam Typologies
10 Chapter 10: Domain 3: Payment Screening
10.1 OFAC Sanctions Regimes & the 50 Percent Rule 10.2 Real-Time vs. Batch Screening Architecture in High-Velocity Rails 10.3 Screening Logic: Fuzzy Matching, Phonetics, and PEP Controls
11 Chapter 11: Domain 3: Transaction Monitoring Systems and Red Flags
11.1 Hybrid Transaction Monitoring: Rules Engines vs. Machine Learning 11.2 FinTech Typologies: Mule Networks, Funnel Accounts, and Rapid Pass-Through 11.3 Fraud-AML Convergence: BIN Attacks, ATO, and Credential Stuffing 11.4 Model Risk Management Under SR 11-7 & System Optimization
12 Chapter 12: Domain 3: Payment Methods and Transaction Risk Characteristics
12.1 Common Payment Methods, Crypto, and High-Risk Transactions Such as Aggregation 12.2 Transaction Risk Characteristics: Reversibility, Convertibility, Fund Integrity, and Privacy Coins 12.3 Wallet Types, Custody Architectures, and Counterparty Risks 12.4 Stablecoins, On/Off Ramps, and Asset-Referenced Tokens
13 Chapter 13: Domain 3: Monitoring Crypto Transactions
13.1 Blockchain Analytics & Transaction Tracing 13.2 The FATF Travel Rule for Virtual Assets 13.3 DeFi, Mixers, and Smart Contract Sanctions
14 Chapter 14: Domain 3: Alert Investigation, Audit Trails, and Monitoring MI
14.1 The Alert Investigation Process: From Unusual to Suspicious and When to Escalate 14.2 Building an Audit Trail for Suspicious Activity Reviews 14.3 Communicating Monitoring Results: KPIs, KRIs, OKRs, and Management Information
15 Chapter 15: Domain 4: Investigations and Customer Communication
15.1 Talking to Customers During Investigations and Offboarding: Financial Crime Risk vs Policy Breach 15.2 Reviewing KYC, Transactions, Open Sources, and Documents to Build an Investigation 15.3 Analytical Principles in Investigations: Avoiding Confirmation Bias and Other Traps
16 Chapter 16: Domain 4: SARs and STRs
16.1 SARs and STRs: What They Are, When and Where to File, and Why They Matter 16.2 Writing Effective SAR and STR Narratives
17 Chapter 17: Domain 4: Law Enforcement, Regulators, and Banking Partners
17.1 Operational AML Governance and Third-Party Risk Management 17.2 Working With Law Enforcement, Banking Partners, Regulators, and Other Third Parties 17.3 Types of Law Enforcement Requests: Subpoenas, Court Orders, 314(a), and International Requests 17.4 How Banking Partners' Terms of Service Relate to the FinTech's Own Terms
18 Chapter 18: Domain 5: Scaling Anti-Financial Crime Strategies
18.1 Assessing New Products and Features Before Launch 18.2 Refreshing the Financial Crime Risk Assessment as the Business Scales 18.3 Changes That Should Trigger a Financial Crime Risk Assessment Review 18.4 Record Retention Rules and Secure Data Storage 18.5 Outsourcing Controls: Surge Capacity, RegTech, and Independent Testing
5.1 Risk Management Framework: Lines of Defence, Policies, Assurance, and the MLRO
Key Takeaways Explain This Topic AI
In the three lines model, operations own and run controls, compliance and risk set policy and challenge, and internal audit gives independent assurance to the board.
Quality control checks individual pieces of work in the first line, while assurance tests whether the control framework works as a whole.
UK firms appoint a nominated officer, usually the MLRO, to receive internal suspicion reports and decide whether to submit SARs to the National Crime Agency.
Since the 2022 Whistleblower Improvement Act, US AML whistleblower awards are 10% to 30% of sanctions collected in actions exceeding US$1 million.
Last updated: October 2026
CAFCA sub-topic 1.4 covers the risk management framework : lines of defence, policies and procedures, the principles of assurance and quality control, and the responsible party , such as the MLRO. The exam favours answers that keep ownership, challenge and independent assurance separate, even at a small FinTech where one person may hold several roles.
The three lines model
The Institute of Internal Auditors updated the familiar "three lines of defence" in 2020 as the Three Lines Model . The idea is the same: separate the people who run controls, the people who oversee them, and the people who independently assure them.
Line Who it is in a FinTech What it does Evidence an examiner will ask for
First line Product, onboarding operations, payments operations, customer support, alert analysts in operations Owns risks and runs day-to-day controls: CDD checks, screening reviews, alert handling, escalation Procedures, completed checklists, QC results, escalation logs
Second line Compliance, financial crime risk, MLRO or BSA officer team Writes policy, sets risk appetite, advises, monitors and tests the first line, challenges product decisions, reports to the board Policies, risk assessment, monitoring and testing reports, MI packs
Third line Internal audit (often outsourced at smaller firms) Gives independent, objective assurance to the board on how well the first two lines work Audit plans, reports, issue tracking, follow-up
A common weakness at fast-growing FinTechs is a compliance team that runs operations . If compliance reviews every alert and also writes the policy, there is no independent challenge. Combining roles may be unavoidable early on. In that case, record it, compensate with external testing, and plan to separate the roles as the firm grows.
Policies, standards and procedures
Policy : approved by the board or a board committee. Says what the firm commits to and why , for example "We will not onboard unlicensed money transmitters."
Standards : minimum requirements that apply across products, such as required CDD data fields, review frequencies and escalation thresholds.
Procedures and desk instructions : how staff carry out a task, step by step, with screenshots, decision trees and service levels.
Each document needs an owner, a version history, a review date and a link to the obligation it implements (Chapter 4). Product changes often outpace procedure updates. That is a classic examination finding, because staff end up following practices that no approved document describes.
Quality control versus assurance
- Quality control (QC) Assurance
- Performed by First line (team leads, peer checkers) Second line monitoring and testing; third line audit
Focus Individual items: was this onboarding file or alert closure correct? The framework: does the control work across the population and over time?
Timing Before or soon after the work (pre- or post-checks, four-eyes) Periodic, thematic, risk-based
Output Error rates, rework, coaching Findings, ratings, remediation plans reported to senior management and the board
US BSA programmes must include independent testing . The UK Money Laundering Regulations require an independent audit function where appropriate to the firm's size and nature. QC results are useful inputs to assurance, but QC is never a substitute for it.
The responsible party: MLRO, nominated officer and BSA officer
UK : the nominated officer receives internal suspicion reports and decides whether to submit a SAR to the National Crime Agency. In most firms this is the MLRO . Firms must also appoint a board member or senior manager responsible for compliance with the Money Laundering Regulations, where appropriate to their size. In larger FSMA-authorised firms the MLRO role is a senior management function (SMF17) under the Senior Managers and Certification Regime.
US : each programme designates a BSA/AML officer with the authority, independence and resources to manage the programme. The officer reports regularly to the board and senior management.
EU : the AML Regulation, which applies from July 2027, requires a member of the management body to be responsible for AML compliance and a compliance manager to run the day-to-day programme.
Whatever the title, the responsible officer needs stature (able to challenge executives), independence (not reporting to a revenue owner whose pay depends on growth), resources (staff and systems in line with risk) and access to the board.
Escalation when the business pushes back
FinTech growth targets create pressure: "close these alerts before the funding round", "skip address checks to improve conversion". A defensible response is to:
Put the request and the objection in writing at the time it happens.
Explain the obligation, the risk and the options, such as a compensating control, a phased rollout or a restricted launch.
Escalate through the governance route, for example the risk committee or the board audit committee, if the issue is not resolved.
Never falsify records or certifications, and never suppress a required report.
Many jurisdictions protect whistleblowers. In the US, the Anti-Money Laundering Act of 2020 expanded the BSA whistleblower programme, and the 2022 Anti-Money Laundering Whistleblower Improvement Act set awards at 10% to 30% of monetary sanctions collected in actions above US$1 million, extended the programme to sanctions violations, and provides anti-retaliation remedies. In the UK, the Public Interest Disclosure Act protects workers who make protected disclosures.
Realistic exam scenario
A neobank's head of growth asks the alert operations lead to bulk-close 6,000 aged alerts before a partner-bank audit. The operations team sits in the first line and reports to the head of growth. The right answer is to refuse bulk closure and escalate to the MLRO. Then agree a risk-based backlog plan (prioritise by risk, add trained staff, report to the board) and inform the partner bank honestly. Bulk closure without review would breach the policy and create a false record.
Common exam traps
QA is not audit. Second-line testing does not replace independent third-line assurance.
The MLRO should not report to sales or growth.
Outsourcing internal audit is acceptable; outsourcing accountability is not.
Policies without procedures fail in practice. Examiners test what staff actually do.