Apply AML And Cybersecurity Rules - Series 65
- What is the primary objective of a Business Continuity Plan (BCP)?
- Maintain critical operations during and after a disruption. BCPs ensure operational resilience by planning for emergencies, minimizing downtime and financial losses.
- What is the primary purpose of an AML program at an investment adviser or broker-dealer?
- To detect and report suspicious activity and deter money laundering. AML programs are mandated to monitor transactions, identify red flags, and file reports to prevent illicit funds from entering the financial system.
- What is multi-factor authentication (MFA)?
- Authentication using two or more independent verification factors. MFA enhances security by requiring multiple credentials, reducing risks from compromised passwords.
- What is a SAR in AML compliance?
- Suspicious Activity Report filed with FinCEN. SARs are confidential reports submitted when transactions suggest potential money laundering or other illegal activities.
- What is the purpose of ongoing AML training for personnel?
- Ensure staff can identify red flags and follow reporting procedures. Training equips employees with knowledge of AML laws, enabling proper escalation of suspicious activities.
- What is the confidentiality rule for SARs?
- SARs and their existence must not be disclosed to the subject. Confidentiality protects ongoing investigations and prevents tipping off suspects, as required by federal law.
- What is "structuring" in an AML context?
- Breaking transactions into smaller amounts to evade reporting rules. Structuring is illegal under AML laws as it intentionally avoids triggering currency transaction reporting thresholds like $10,000.
- Which U.S. law is the primary federal statute establishing AML duties for financial firms?
- Bank Secrecy Act (BSA). Enacted in 1970, it mandates financial institutions to maintain records and report transactions to combat money laundering and terrorist financing.
- Under Regulation S-P, what is "nonpublic personal information" (NPI)?
- Personally identifiable financial info not publicly available. NPI includes sensitive data like account numbers or income, protected to prevent identity theft and unauthorized access.
- What is the purpose of a firm's written cybersecurity policies and procedures?
- Protect systems/data and manage cyber risks and incidents. Cybersecurity policies outline controls to safeguard assets, detect threats, and respond to incidents per regulatory expectations.
- What does CDD stand for in an AML context?
- Customer Due Diligence. CDD involves gathering information on customer relationships to assess money laundering risks beyond initial identification.
- What is OFAC, and what is the firm's basic compliance obligation?
- Treasury sanctions office; screen and block/reject prohibited parties. OFAC administers economic sanctions, requiring firms to check clients against lists to prevent dealings with prohibited entities.
- What does EDD stand for, and when is it used in AML compliance?
- Enhanced Due Diligence; used for higher-risk customers/activities. EDD applies additional scrutiny, such as source of funds verification, to mitigate elevated risks from certain clients or jurisdictions.
- What is the main requirement of the Regulation S-P Disposal Rule?
- Properly dispose of consumer report information to prevent access. The Disposal Rule ensures secure destruction of sensitive data to comply with privacy laws and reduce breach risks.
- What does CIP stand for in an AML context?
- Customer Identification Program. CIP is a key component of AML compliance requiring firms to verify client identities to prevent identity theft and money laundering.
- What is the main requirement of the Regulation S-P Safeguards Rule?
- Adopt written policies to protect customer records and information. The Safeguards Rule requires administrative, technical, and physical measures to secure client data from breaches.
- Which entity receives SAR filings in the United States?
- FinCEN. As part of the U.S. Treasury, FinCEN collects and analyzes financial intelligence to combat money laundering and terrorism financing.
- Which activity is required if a client matches an OFAC-sanctioned person?
- Block (or reject) the transaction and report per OFAC rules. OFAC compliance mandates freezing assets and notifying authorities to enforce U.S. foreign policy and national security goals.
- Which control best addresses the "least privilege" principle in cybersecurity?
- Limit user access to only what is needed for job duties. Least privilege minimizes insider threats and data breaches by restricting access rights based on role necessities.
- Which document focuses on restoring IT systems and data after an outage?
- Disaster Recovery (DR) plan. DR plans are essential for BCP, focusing on data backup and system restoration to resume operations post-disruption.
- What is the main goal of CDD beyond basic identity verification?
- Understand customer risk and expected account activity. CDD helps firms develop a customer risk profile by evaluating the nature of the relationship and anticipated transactions.
- What is the purpose of independent testing in an AML program?
- Assess AML program effectiveness and compliance. Independent audits verify that the AML program meets legal standards and effectively identifies risks.
- Which SEC regulation is commonly tested for safeguarding customer records and information?
- Regulation S-P. Regulation S-P implements privacy protections under the Gramm-Leach-Bliley Act for investment firms.
- What is the core CIP requirement regarding a new customer before opening an account?
- Verify the customer's identity using risk-based procedures. CIP ensures firms collect and verify identifying information like name, address, and ID number to mitigate risks of fraudulent accounts.
- What is the required AML governance element that assigns program responsibility?
- Designation of an AML compliance officer. A designated officer oversees the AML program's implementation, ensuring accountability and regulatory compliance.