Effective Program Pillars

CAMS Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: CAMS Orientation and Exam Facts

Current CAMS Exam Format Eligibility Credits and ACAMS Membership Package Pricing and Study Materials Pearson VUE Scheduling Window Passing Score and Result Reporting Exam Non-Disclosure and Practice Ethics

2 Chapter 2: Financial Crime Risks and Methods

AML, CFT, Sanctions, Fraud, ABC, and Tax Evasion Financial Systems and AFC Consequences Predicate Crimes and Financial Crime Exposure Sector, Product, Customer, Jurisdiction, and Channel Risk Banking Products and High-Risk Sectors Politically Exposed Persons and High-Risk Customers

3 Chapter 3: High-Risk Sectors and Structures

MSBs, PSPs, and E-commerce Platforms Insurance Product Risk VASPs, Cryptoassets, and Related Products Gaming, Gambling, and Real Estate Gatekeepers, Trusts, and Company Service Providers Accountants and Other High-Risk Structures

4 Chapter 4: Global AFC Frameworks

FATF Role and Recommendations United Nations Sanctions Regimes Regulators, Law Enforcement, and FIUs Public Sector, Private Sector, and NGO Objectives Cross-Border Cooperation Authority Reports, Trends, and Typologies

5 Chapter 5: Governance Regulations and Information Sharing

Risk-Based Regulatory Expectations Regulatory Examinations and Enforcement Public-Private Partnerships Information Sharing Mechanisms De-Risking and Financial Inclusion RFIs, Tipping Off, and Customer Communication

6 Chapter 6: AFC Compliance Program Design

Effective Program Pillars Three Lines of Defense and MLRO Role Risk Appetite Statement Enterprise Risk Assessment Risk-Based Controls Policies Standards and Procedures

7 Chapter 7: Program Governance and Operating Model

Horizon Scanning and Regulatory Guidance Governance Committees and Terms of Reference AFC Team Structure and Responsibilities Front Office Interaction Supporting Functions and Risk Partners Training, Awareness, and Staff Risk Culture

8 Chapter 8: Customer Lifecycle Controls

Control Tools Across the Customer Lifecycle Data Quality, Integrity, Access, and Taxonomy Customer Experience and Friction Digital Onboarding and Electronic KYC (e-KYC) External Data Sources and Beneficial Ownership Customer Screening and Sanctions Lists

9 Chapter 9: Ongoing Controls and Monitoring

Periodic Refresh and Perpetual KYC Adverse Media Screening Batch Screening and Fuzzy Logic Transaction and Payment Screening Rules-Based Transaction Monitoring Model Risk Management and Tuning

10 Chapter 10: Investigations and Case Support

Investigation Triggers and Case Triage Open Source Tools and Investigator Support Escalation and Suspicious Activity Decisions Documentation and Evidence Quality Law Enforcement and FIU Requests Post-Investigation Feedback Loops

11 Chapter 11: Technology and Emerging AFC Practice

AI and Machine Learning in AFC Controls Blockchain Transaction Screening Automation to Support Investigators Scenario Coverage and Threshold Setting Data Privacy, Cybersecurity, and Other Risk Functions Technology Governance for AFC Tools

12 Chapter 12: Final CAMS Review and Exam Day

Domain-Weighted Study Allocation Simulator Practice Without Actual Exam Claims Pearson VUE Identification and Test Rules Time Management and Guessing Strategy Retake Extension and Appeal Boundaries Recertification and Ongoing Membership

Effective Program Pillars

Key Takeaways Explain This Topic AI

The BSA "five pillars" are internal controls, a designated BSA/AML officer, ongoing training, independent testing/audit, and risk-based customer due diligence (CDD).

The fifth pillar (CDD, including beneficial ownership) was added by FinCEN's 2018 CDD Final Rule; programs predating it must be updated.

Building an AFC Compliance Program is 30% of the CAMS 6th-edition blueprint, the joint-largest domain.

Scenario items reward proportionality, documented process, and clear ownership over the most aggressive action.

Last updated: June 2026

Effective Program Pillars

A written, board-approved Anti-Financial-Crime (AFC) program rests on the BSA five pillars , codified in the Bank Secrecy Act (BSA) and expanded by the Financial Crimes Enforcement Network (FinCEN). On the CAMS exam, "Building an AFC Compliance Program" carries 30% of the 6th-edition blueprint (tied with "Understanding the Risks and Methods of Financial Crime" as the largest domain), so expect roughly 36 of 120 items here. The four-domain split is 30/20/30/20.

The five pillars are not interchangeable. Each has a distinct owner, statutory basis, and failure mode that examiners probe.

Pillar Core requirement Typical owner Common failure tested

Internal controls Written policies, procedures, and processes sized to risk Compliance / business lines Controls not updated after a new product launch

Designated officer A named, qualified BSA/AML (or MLRO) officer with authority and resources Board appoints Officer lacks seniority or budget to act

Ongoing training Role-based, recurring, documented training Compliance + HR Front-line staff trained generically, not by role

Independent testing Periodic audit by a party independent of the function tested Internal audit / external firm Tester reports to the head of the function audited

Risk-based CDD Customer due diligence, including beneficial ownership and ongoing monitoring Onboarding / relationship managers No beneficial-ownership collection at 25% threshold

The fifth pillar and the CDD Rule

For years AML programs cited four pillars. FinCEN's 2018 Customer Due Diligence (CDD) Final Rule formalized a fifth: risk-based CDD, including the requirement to identify and verify beneficial owners of legal-entity customers. A natural-person beneficial owner is anyone owning 25% or more of equity, plus at least one individual with significant managerial control . A CAMS item that says a bank "completed all four pillars" is signaling a stale program — the best answer flags the missing CDD/beneficial-ownership pillar.

How examiners judge "effective"

Regulators evaluate a program against the institution's own risk profile , not a checklist. A small rural bank and a global correspondent bank can each have an "effective" program at very different intensities. The exam frame is: a control is adequate when it is commensurate with risk , documented, owned, monitored, and tested.

When you face a scenario, run this workflow:

Identify which pillar the fact pattern stresses (a training gap? a control gap?).

Name the owner and whether escalation is required.

Ask whether the response is proportional to the assessed risk.

Confirm the action is documented and supports an audit trail.

The correct CAMS answer is rarely the most dramatic step (e.g., "close all accounts immediately"). It usually reflects measured remediation, clear ownership, and evidence that the decision is defensible to an examiner. Watch the common trap where an option ignores documentation because an alert "looks obvious" — undocumented action is itself a control failure.

Worked example

A mid-size bank launches a new prepaid-card product targeting unbanked customers. Marketing ships it before compliance updates monitoring rules. Map this to the pillars: the internal-controls pillar failed (controls were not sized to the new product), and the CDD pillar is strained (anonymous prepaid products obscure beneficial ownership). The exam-preferred response is not to scrap the product but to (1) pause new issuance, (2) build product-specific monitoring and load/spend limits, (3) document a refreshed risk assessment, and (4) report the gap to the AML committee. Each step ties a pillar to an owner and leaves an audit trail.

Statutory anchors to remember

The Bank Secrecy Act (BSA) , 1970, is the foundational US AML statute requiring recordkeeping and reporting.

The USA PATRIOT Act (2001) expanded the program requirement, mandated a customer identification program (CIP), and prohibited correspondent relationships with shell banks .

The Anti-Money Laundering Act (AMLA) of 2020 created the beneficial-ownership reporting regime and strengthened FinCEN's authority and whistleblower protections.

The 2018 CDD Final Rule added the fifth pillar.

When a scenario references any of these, anchor the obligation to the statute rather than guessing. Each pillar must be written , board-approved , and proportional to risk — three attributes examiners test repeatedly. A pillar that exists only informally, or that the board never approved, will not satisfy an examiner even if the underlying activity is performed in practice.

Independent testing: scope and frequency

The independent-testing pillar deserves extra attention because candidates underestimate it. The testing must be risk-based in scope and performed often enough to catch drift — for many institutions this means an annual review, with higher-risk areas tested more frequently. The tester evaluates whether the program is not just documented but operating effectively : are alerts worked within deadlines, is training completed, are CDD files current, are SARs filed on time? A clean policy binder with broken execution still fails.

Critically, the testers must be independent of the functions they review — internal audit reporting to the audit committee, or a qualified external firm. If the same compliance team that built monitoring also "tests" it, the pillar is not satisfied.

Finally, remember the program must be approved by the board of directors (or a designated committee) and that approval must be documented in the minutes . "Senior management knew about it informally" is not board approval. Tie every pillar back to three questions an examiner will ask: Is it written? Is it approved? Is it proportional to and effective against the institution's assessed risk? Answer all three and the program is defensible.