Study guide
Risk-Based Controls
CAMS Study Guide Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CAMS Orientation and Exam Facts
Current CAMS Exam Format Eligibility Credits and ACAMS Membership Package Pricing and Study Materials Pearson VUE Scheduling Window Passing Score and Result Reporting Exam Non-Disclosure and Practice Ethics
2 Chapter 2: Financial Crime Risks and Methods
AML, CFT, Sanctions, Fraud, ABC, and Tax Evasion Financial Systems and AFC Consequences Predicate Crimes and Financial Crime Exposure Sector, Product, Customer, Jurisdiction, and Channel Risk Banking Products and High-Risk Sectors Politically Exposed Persons and High-Risk Customers
3 Chapter 3: High-Risk Sectors and Structures
MSBs, PSPs, and E-commerce Platforms Insurance Product Risk VASPs, Cryptoassets, and Related Products Gaming, Gambling, and Real Estate Gatekeepers, Trusts, and Company Service Providers Accountants and Other High-Risk Structures
4 Chapter 4: Global AFC Frameworks
FATF Role and Recommendations United Nations Sanctions Regimes Regulators, Law Enforcement, and FIUs Public Sector, Private Sector, and NGO Objectives Cross-Border Cooperation Authority Reports, Trends, and Typologies
5 Chapter 5: Governance Regulations and Information Sharing
Risk-Based Regulatory Expectations Regulatory Examinations and Enforcement Public-Private Partnerships Information Sharing Mechanisms De-Risking and Financial Inclusion RFIs, Tipping Off, and Customer Communication
6 Chapter 6: AFC Compliance Program Design
Effective Program Pillars Three Lines of Defense and MLRO Role Risk Appetite Statement Enterprise Risk Assessment Risk-Based Controls Policies Standards and Procedures
7 Chapter 7: Program Governance and Operating Model
Horizon Scanning and Regulatory Guidance Governance Committees and Terms of Reference AFC Team Structure and Responsibilities Front Office Interaction Supporting Functions and Risk Partners Training, Awareness, and Staff Risk Culture
8 Chapter 8: Customer Lifecycle Controls
Control Tools Across the Customer Lifecycle Data Quality, Integrity, Access, and Taxonomy Customer Experience and Friction Digital Onboarding and Electronic KYC (e-KYC) External Data Sources and Beneficial Ownership Customer Screening and Sanctions Lists
9 Chapter 9: Ongoing Controls and Monitoring
Periodic Refresh and Perpetual KYC Adverse Media Screening Batch Screening and Fuzzy Logic Transaction and Payment Screening Rules-Based Transaction Monitoring Model Risk Management and Tuning
10 Chapter 10: Investigations and Case Support
Investigation Triggers and Case Triage Open Source Tools and Investigator Support Escalation and Suspicious Activity Decisions Documentation and Evidence Quality Law Enforcement and FIU Requests Post-Investigation Feedback Loops
11 Chapter 11: Technology and Emerging AFC Practice
AI and Machine Learning in AFC Controls Blockchain Transaction Screening Automation to Support Investigators Scenario Coverage and Threshold Setting Data Privacy, Cybersecurity, and Other Risk Functions Technology Governance for AFC Tools
12 Chapter 12: Final CAMS Review and Exam Day
Domain-Weighted Study Allocation Simulator Practice Without Actual Exam Claims Pearson VUE Identification and Test Rules Time Management and Guessing Strategy Retake Extension and Appeal Boundaries Recertification and Ongoing Membership
Risk-Based Controls
Key Takeaways Explain This Topic AI
The risk-based approach applies simplified due diligence (SDD) to low risk, standard CDD to normal risk, and enhanced due diligence (EDD) to high risk.
EDD triggers include PEPs, correspondent banking, high-risk jurisdictions, and unusual or complex transactions.
Controls must be commensurate with risk — neither under-controlling high risk nor wasting effort on low risk.
Ongoing monitoring and periodic CDD refresh keep risk ratings current as customer behavior changes.
Last updated: June 2026
Risk-Based Controls
The risk-based approach (RBA) is the organizing principle of modern AFC, endorsed by FATF and embedded in the US CDD Rule and the EU AML directives. It requires institutions to apply more scrutiny where financial-crime risk is high and less where it is low, rather than treating every customer identically. CAMS tests whether you can match the right intensity of control to a given risk rating.
The due-diligence ladder
Due diligence scales across three tiers. Misapplying a tier — for example, granting simplified diligence to a politically exposed person — is one of the most common scenario errors.
Tier When applied What it requires
Simplified due diligence (SDD) Demonstrably low-risk customers (e.g., regulated domestic entities, certain government bodies) Reduced verification; never no diligence
Standard CDD Normal-risk customers Identify and verify the customer, understand purpose, identify beneficial owners, ongoing monitoring
Enhanced due diligence (EDD) High-risk customers and relationships Senior-management approval, source-of-funds/wealth checks, deeper monitoring, more frequent review
A key nuance: SDD is reduced, never zero . An option saying a low-risk customer needs "no due diligence" is wrong.
EDD triggers
Memorize the relationships that mandate EDD:
Politically Exposed Persons (PEPs) — and often their family members and close associates; foreign PEPs are generally always high risk.
Correspondent banking , especially cross-border and with respondents in weak-AML jurisdictions; shell banks are prohibited , not merely high risk.
High-risk geographies — FATF-listed and sanctioned jurisdictions.
Unusual, complex, or unusually large transactions with no clear economic or lawful purpose.
Private banking and high-net-worth relationships, where source of wealth is central.
For a PEP, the program typically needs senior-management sign-off to open or continue the relationship, plus a documented source-of-wealth rationale. A scenario where a junior officer approves a foreign PEP alone is testing this control gap.
Ongoing monitoring and refresh
A risk rating set at onboarding is not permanent. Ongoing monitoring watches transactions against the expected profile, and periodic CDD refresh re-verifies information on a schedule keyed to risk — high-risk customers reviewed most frequently. A sudden change (a retail customer suddenly receiving large foreign wires) should re-trigger diligence and possibly reclassify the customer.
Scenario workflow
For a controls scenario, ask:
What is the customer's risk rating , and does the proposed control match it?
Does any EDD trigger apply (PEP, correspondent, high-risk geography, unusual activity)?
Was senior-management approval obtained where required?
Has monitoring detected a change that should re-rate the relationship?
The best answer is proportional: it neither under-controls a high-risk PEP nor buries a low-risk domestic account in unnecessary checks. Beware the distractor that applies the same control to every customer regardless of risk — that defeats the entire risk-based approach.
Worked example
A retail customer opened a personal account two years ago with a stable salary profile. Monitoring now flags three incoming international wires of $9,500 each within a week from unrelated senders, just under the $10,000 currency-transaction-report threshold. This pattern suggests structuring and is inconsistent with the customer's profile. The risk-based response: the relationship manager (first line) reports the anomaly, the AFC analyst re-rates the customer upward and applies EDD-style scrutiny (source-of-funds inquiry, enhanced monitoring), and the MLRO evaluates a SAR.
The customer's original low rating does not freeze in place — a behavior change re-triggers diligence.
Calibrating control intensity
The practical question on the exam is always "how much is enough?" The answer is: enough to match the residual risk, with the heaviest controls reserved for the relationships that warrant them.
- Risk level Verification depth Approval Review frequency
- Low (SDD) Reduced, but identity still confirmed Standard Less frequent
- Normal (CDD) Full identity, purpose, beneficial owners Standard Periodic
- High (EDD) Source of funds and wealth, adverse-media checks Senior management Most frequent
Two durable rules: SDD is reduced, never absent , and EDD for foreign PEPs requires senior-management approval plus a documented source-of-wealth basis. Controls also include negative-news / adverse-media screening and sanctions screening that run continuously, not only at onboarding. A relationship that was low risk can become high risk overnight if the customer is sanctioned or named in adverse media.
The exam rewards candidates who keep ratings dynamic, escalate when triggers fire, and resist both the under-control trap (treating a PEP like a retail account) and the over-control trap (drowning a low-risk account in EDD it does not need).
Specific control types and their thresholds
Risk-based controls are not abstract — they map to concrete mechanisms with testable parameters:
Customer Identification Program (CIP) — verify identity at onboarding; for legal entities, collect beneficial owners at the 25% ownership threshold plus one control person.
Sanctions/watchlist screening — run against OFAC and other lists at onboarding and continuously thereafter; a true match generally requires blocking or rejecting, not just review.
Transaction monitoring — automated rules detect structuring, rapid movement, and profile deviations; alerts must be worked within policy timelines.
Adverse-media (negative-news) screening — periodic for high-risk customers, recalibrating ratings on derogatory findings.
A correspondent-banking relationship layers several of these and adds a prohibition: no shell banks , and reasonable steps to ensure the respondent does not let shell banks use the account either. The exam often hides the trap inside a control choice — for example, an option that says low-risk customers need no ongoing monitoring (wrong; monitoring continues for all), or that a single sanctions hit can be cleared by the relationship manager (wrong; hits route to compliance).
Keep the through-line: match control intensity to residual risk, never drop below the floor of standard CDD, escalate triggers, and let monitoring re-rate customers as their behavior changes.