Free CTMA sample questions

Correct answer: Structuring

Structuring (also known as smurfing) involves breaking down large amounts of cash into smaller deposits to avoid regulatory reporting thresholds (such as the $10,000 CTR limit in many jurisdictions). Consistently depositing amounts just below the threshold is a classic red flag for structuring.

Correct answer: The enterprise-wide risk assessment (EWRA)

The enterprise-wide risk assessment (EWRA) identifies the specific financial crime risks inherent to the institution's customers, products, and geographies. A risk-based TM program must map its scenarios and rules directly to the high-risk areas identified in the EWRA to demonstrate coverage aligned with risk appetite.

Correct answers: It compares current activity against a customer's historical profile; It is better suited for detecting unknown or evolving typologies

Behavior-based monitoring establishes a baseline of 'normal' activity for a customer (or peer group) and generates alerts when deviations from this baseline occur (e.g., a sudden spike in wire volume).

Because it looks for anomalies rather than specific known patterns, behavior-based monitoring is effective at catching new or evolving financial crime typologies that static rules might miss.

Correct answer: False

False. High false positive rates are common in TM systems and do not necessarily mean the system is broken. They often indicate a need for tuning thresholds or segmenting customers more effectively. Replacing the system is a last resort; optimization/tuning is the standard response.

Correct answer: Conduct enhanced due diligence on the counterparty to confirm or rule out a sanctions match

Before taking drastic action like closing the account or filing a SAR, the investigator must determine if the partial match is a true positive. This involves gathering additional information (EDD) on the counterparty's address, ownership, and business activities to verify if it is indeed the sanctioned entity.

Correct answer: An alert generated by a system error that flags internal bank transfers as customer transactions

Non-productive alerts are those that provide no value to the investigation process, often caused by data errors, system glitches, or poor configuration (like flagging internal transfers). A 'false positive' usually refers to activity that correctly met the rule criteria but turned out to be benign after investigation.