Risk Appetite Statement

CAMS Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: CAMS Orientation and Exam Facts

Current CAMS Exam Format Eligibility Credits and ACAMS Membership Package Pricing and Study Materials Pearson VUE Scheduling Window Passing Score and Result Reporting Exam Non-Disclosure and Practice Ethics

2 Chapter 2: Financial Crime Risks and Methods

AML, CFT, Sanctions, Fraud, ABC, and Tax Evasion Financial Systems and AFC Consequences Predicate Crimes and Financial Crime Exposure Sector, Product, Customer, Jurisdiction, and Channel Risk Banking Products and High-Risk Sectors Politically Exposed Persons and High-Risk Customers

3 Chapter 3: High-Risk Sectors and Structures

MSBs, PSPs, and E-commerce Platforms Insurance Product Risk VASPs, Cryptoassets, and Related Products Gaming, Gambling, and Real Estate Gatekeepers, Trusts, and Company Service Providers Accountants and Other High-Risk Structures

4 Chapter 4: Global AFC Frameworks

FATF Role and Recommendations United Nations Sanctions Regimes Regulators, Law Enforcement, and FIUs Public Sector, Private Sector, and NGO Objectives Cross-Border Cooperation Authority Reports, Trends, and Typologies

5 Chapter 5: Governance Regulations and Information Sharing

Risk-Based Regulatory Expectations Regulatory Examinations and Enforcement Public-Private Partnerships Information Sharing Mechanisms De-Risking and Financial Inclusion RFIs, Tipping Off, and Customer Communication

6 Chapter 6: AFC Compliance Program Design

Effective Program Pillars Three Lines of Defense and MLRO Role Risk Appetite Statement Enterprise Risk Assessment Risk-Based Controls Policies Standards and Procedures

7 Chapter 7: Program Governance and Operating Model

Horizon Scanning and Regulatory Guidance Governance Committees and Terms of Reference AFC Team Structure and Responsibilities Front Office Interaction Supporting Functions and Risk Partners Training, Awareness, and Staff Risk Culture

8 Chapter 8: Customer Lifecycle Controls

Control Tools Across the Customer Lifecycle Data Quality, Integrity, Access, and Taxonomy Customer Experience and Friction Digital Onboarding and Electronic KYC (e-KYC) External Data Sources and Beneficial Ownership Customer Screening and Sanctions Lists

9 Chapter 9: Ongoing Controls and Monitoring

Periodic Refresh and Perpetual KYC Adverse Media Screening Batch Screening and Fuzzy Logic Transaction and Payment Screening Rules-Based Transaction Monitoring Model Risk Management and Tuning

10 Chapter 10: Investigations and Case Support

Investigation Triggers and Case Triage Open Source Tools and Investigator Support Escalation and Suspicious Activity Decisions Documentation and Evidence Quality Law Enforcement and FIU Requests Post-Investigation Feedback Loops

11 Chapter 11: Technology and Emerging AFC Practice

AI and Machine Learning in AFC Controls Blockchain Transaction Screening Automation to Support Investigators Scenario Coverage and Threshold Setting Data Privacy, Cybersecurity, and Other Risk Functions Technology Governance for AFC Tools

12 Chapter 12: Final CAMS Review and Exam Day

Domain-Weighted Study Allocation Simulator Practice Without Actual Exam Claims Pearson VUE Identification and Test Rules Time Management and Guessing Strategy Retake Extension and Appeal Boundaries Recertification and Ongoing Membership

Risk Appetite Statement

Key Takeaways Explain This Topic AI

A risk appetite statement defines how much financial-crime risk the board is willing to accept and where the institution will not do business.

Risk appetite is set by the board; risk tolerance and limits operationalize it for each product, customer type, and geography.

De-risking — exiting whole categories rather than managing risk — is discouraged by FATF and regulators when it harms financial inclusion.

Breaches of appetite (e.g., onboarding a prohibited customer type) require escalation, not quiet exception-making.

Last updated: June 2026

Risk Appetite Statement

A risk appetite statement (RAS) is a board-approved document declaring how much financial-crime risk an institution is willing to take to pursue its strategy, and — just as important — which business it will not accept at any price. It is the bridge between high-level strategy and the day-to-day limits that the first line operates within.

Appetite, tolerance, and limits

These three terms are tested as a hierarchy, and candidates routinely confuse them.

Term Meaning Example

Risk appetite The total amount and type of risk the board chooses to accept "We accept moderate AML risk in retail banking."

Risk tolerance The acceptable variation around appetite for a specific area "No more than 5% of new accounts may be high-risk per quarter."

Risk limit / threshold The hard operational ceiling that triggers action "Block any cash deposit structuring pattern over a set value."

Appetite is strategic and qualitative ; tolerance and limits make it measurable and enforceable . A RAS that says only "we have a low appetite for AML risk" without limits is non-operational — examiners view it as window dressing.

Prohibited business and exclusions

A strong RAS names categories the institution refuses outright: for example, customers in sanctioned jurisdictions , shell banks (prohibited as correspondents under the USA PATRIOT Act Section 313), anonymous "payable-through" arrangements, or unlicensed money-services businesses. When a CAMS scenario describes onboarding a customer that falls in a stated exclusion, the appetite is breached , and the correct response is escalation and decline — not an undocumented exception.

De-risking versus risk management

The Financial Action Task Force (FATF) warns against de-risking : wholesale exit from entire customer segments (e.g., all money-services businesses, all charities, or all correspondents in a region) to avoid the cost of managing them. De-risking can push activity into less-transparent channels and harm financial inclusion. The exam-preferred answer favors risk-based management — enhanced due diligence, tighter monitoring, controlled limits — over blanket exit, unless the residual risk genuinely exceeds appetite.

Scenario workflow

When an item gives a RAS and a proposed relationship, ask:

Does the customer fall in a stated prohibition or exclusion ? If yes, decline and document.

Does it sit within tolerance but at the high end? If so, apply enhanced controls and monitor against limits.

Is the proposed action a blanket de-risking exit where managed risk would suffice? Prefer management.

Was any breach of appetite escalated to the board or its committee?

The best answer keeps the institution inside its stated appetite, escalates breaches rather than hiding them, and avoids both reckless growth and reflexive de-risking. A common distractor lets a senior business leader "override" the RAS for a profitable client; overrides must go through governance, not personal authority.

Worked example

A commercial bank's RAS prohibits relationships with unlicensed money-services businesses (MSBs) and caps high-risk clients at 8% of the portfolio. A regional manager wants to onboard a remittance business that has applied for — but not yet received — a state license, arguing the revenue is significant. Walk the analysis: the customer falls in a stated prohibition (unlicensed MSB), so the appetite is breached. The correct response is to decline until the license is granted and document the decision; if the bank still wants the relationship, the exception must be escalated to the AML committee, not approved by the manager alone.

Onboarding now would also push toward the 8% tolerance cap, a second control signal.

Connecting appetite to the program

The RAS is not a standalone document — it must flow down into the enterprise risk assessment, the customer-risk-rating model, and product-approval gates.

• RAS element How it operationalizes
• Prohibited customers Hard-coded as decline rules in onboarding screening
• Geographic limits Mapped to high-risk jurisdiction lists and EDD triggers
• Tolerance percentages Tracked as key risk indicators reported to the committee
• Product appetite Enforced through new-product-approval risk reviews

Regulators expect the board to review and re-approve the RAS at least annually and after material strategy shifts. A RAS that is written once and never revisited — or one that the front line has never seen — is a governance weakness. Equally, an institution whose actual book of business drifts well outside its stated appetite without escalation has a monitoring failure: the limits exist but nothing enforces them. The exam consistently rewards answers that keep stated appetite, operational limits, and actual practice aligned, with breaches escalated through documented governance rather than quietly absorbed.

Common appetite categories tested

A mature RAS typically draws bright lines around several recurring categories. Expect scenarios built on each:

Sanctioned jurisdictions and persons — zero appetite; any nexus triggers immediate escalation and likely decline.

Shell banks — prohibited as correspondents (USA PATRIOT Act Section 313); not a high-risk item to manage but a flat no.

Cash-intensive businesses (casinos, MSBs, cannabis where applicable) — limited appetite with mandatory EDD and caps.

Virtual-asset service providers — increasingly addressed explicitly given the 6th-edition emphasis; many institutions set tight conditions or exclusions.

High-net-worth and PEP relationships — accepted within limits, always with senior approval and source-of-wealth documentation.

The distinction between prohibited (never, regardless of profit) and restricted/high-risk (allowed with enhanced controls and within limits) is the single most testable idea here. When a scenario tempts you to "manage" a shell-bank or sanctioned relationship, recognize it as prohibited and decline; when it presents a cash-intensive but lawful business, the answer is enhanced management within tolerance, not reflexive exit. Keeping that line clear — and routing every exception through the board or AML committee rather than an individual executive — is the behavior the RAS exists to enforce and the behavior the exam rewards.