FRM Exam Part II · Case Study: Financial Crime and Fraud

AML, KYC and Sanctions Compliance Frameworks Explained

Updated 11 October 2026 · Fact-checked

AML is the set of controls that stops criminals from moving dirty money through banks. It runs on three stages (placement, layering, integration), KYC and customer due diligence at onboarding, transaction monitoring, suspicious activity reporting, and sanctions screening. In exams, match each control to the risk it addresses.

Understand AML, KYC and Sanctions Compliance Frameworks

Money laundering is making illegal proceeds look legitimate. It follows three classic stages. Placement puts cash into the financial system, for example many small deposits. Layering hides the source through complex transfers, shell companies, wire chains and trades. Integration returns the money to the criminal as apparently clean wealth, such as property, investments or business income.

KYC (know your customer) is the overall programme for knowing who your customer is and what they do. Customer due diligence (CDD) is the core part of it: identify the customer, verify identity from reliable sources, identify the beneficial owner (the natural person who ultimately owns or controls a legal entity), understand the purpose of the relationship, and monitor it on an ongoing basis. KYC is the wider programme; CDD is the process within it. Many sources use the terms loosely, so read the question wording.

CDD is risk-based. Low-risk customers may get simplified due diligence. Higher-risk customers, such as politically exposed persons (PEPs), complex ownership structures, high-risk jurisdictions and correspondent banking, need enhanced due diligence (EDD). This includes senior management approval, source-of-wealth checks and closer monitoring. Basel Committee guidance on sound management of ML/FT risk expects a risk assessment, clear governance and three lines of defence.

Transaction monitoring compares activity with the customer's expected profile and with known typologies. Rules generate alerts, for example cash just below a reporting threshold (structuring), rapid in-and-out movements or activity with high-risk countries. Analysts review alerts. If suspicion remains, the bank files a suspicious activity report (SAR), also called a suspicious transaction report, with the financial intelligence unit. Staff must not tip off the customer.

Sanctions screening is different from AML. It checks customers, beneficial owners and payments against lists issued by authorities such as the UN, OFAC, the EU and the UK. A true match usually means the bank must block or freeze the funds or reject the transaction as the law requires. AML is about suspicion of criminal funds. Sanctions is about prohibited parties and is rule-based. Failures lead to fines, enforcement action and reputational damage.

Key formulas to remember

Stages of money laundering: Placement → Layering → Integration; Placement enters cash into the system, layering hides the trail, integration returns funds as apparently legitimate.
KYC and CDD relationship: KYC programme ⊃ CDD (identify, verify, beneficial owner, purpose, ongoing monitoring); CDD is a core component of KYC. Add EDD for higher-risk customers.
Risk-based approach: Higher ML/FT risk → enhanced due diligence and closer monitoring; lower risk → simplified measures; Simplified measures are never an exemption from monitoring and reporting suspicion.
Alert funnel: Alerts → Investigation → Escalation → SAR filed (if suspicion remains); Most alerts are false positives. Filing needs suspicion, not proof of crime.
Alert precision: Precision = alerts leading to SARs ÷ total alerts; Low precision means high false positives and heavy workload.

How to solve AML, KYC and Sanctions Compliance Frameworks questions

Use this method for any AML, KYC or sanctions question.

1Identify the control or stage in the scenario: onboarding, monitoring, reporting or screening.
2Decide whether the issue is AML (suspicion of criminal funds) or sanctions (prohibited party). They need different responses.
3If a laundering stage is asked, match the behaviour: cash in is placement, movement and obscuring is layering, apparently clean use is integration.
4Assess customer risk: PEP, ownership complexity, jurisdiction, product and channel. High risk means EDD.
5Check beneficial ownership was identified and verified, not just the legal entity.
6Choose the response: investigate alerts, file a SAR if suspicion remains, block or freeze for a true sanctions match, and avoid tipping off.
7Eliminate options that overstate, such as 'proof of crime is needed to file a SAR' or 'simplified due diligence removes monitoring'.

Quickest way: Match the behaviour to the control

When to use it: Use when you have about a minute per question and the scenario is short.

Underline the trigger: cash deposits, layered transfers, PEP, list hit, unusual activity.
Map it: deposits to placement, transfers to layering, PEP to EDD, list hit to sanctions block, unusual activity to monitoring and SAR.
Pick the option that applies the risk-based approach and keeps the customer uninformed of any report.
Reject absolute words like always, never or proof unless the rule truly is absolute.

Common mistakes in AML, KYC and Sanctions Compliance Frameworks

Treating KYC and CDD as identical in every case.
Textbooks and practitioners use the terms interchangeably.
Fix: Remember KYC is the wider programme and CDD is its core process. If the question forces a distinction, KYC contains CDD.
Mixing up layering and integration.
Both involve moving money after it enters the system.
Fix: Layering obscures the trail through complexity. Integration is when funds re-emerge as legitimate assets or income.
Thinking a SAR needs proof of a crime.
Filing feels like an accusation.
Fix: The test is suspicion based on facts. The bank reports and the authorities investigate.
Treating sanctions screening as part of transaction monitoring suspicion.
Both generate alerts.
Fix: Sanctions is a legal prohibition on dealing with listed parties. A true match requires blocking, freezing or rejecting, not just a SAR decision.
Ignoring beneficial owners behind companies.
Verifying the company seems enough.
Fix: Identify and verify the natural persons who ultimately own or control it. Opaque structures raise risk.
Assuming simplified due diligence means no monitoring.
The word simplified suggests exemption.
Fix: Ongoing monitoring and suspicion reporting always apply.

Worked examples

Example 1

A customer deposits cash in many small amounts across branches, then wires the balance through three shell companies in different countries, and finally buys a commercial property. Identify the stage of each action and the best control response.

Show the solution

Small cash deposits across branches put cash into the system: placement, and a structuring pattern.
Wiring through shell companies in several countries obscures the origin: layering.
Buying property makes the funds look like legitimate wealth: integration.
Control response: transaction monitoring should flag the structuring and rapid movement, analysts investigate, and a SAR is filed if suspicion remains, with no tipping off.

Answer: Placement, layering, integration respectively; escalate through monitoring and investigation to a SAR without tipping off the customer.

Example 2

A bank onboards a company owned through two holding companies in a high-risk jurisdiction. One ultimate owner is a senior government official. Which is the most appropriate approach: (A) standard CDD on the company only, (B) simplified due diligence, (C) EDD including beneficial owner identification, PEP status, source of wealth and senior management approval, or (D) reject all such customers automatically?

Show the solution

The complex ownership means the beneficial owner must be identified and verified, so A is insufficient.
A PEP owner and a high-risk jurisdiction indicate higher risk, so simplified measures in B are inappropriate.
A risk-based approach does not require automatic rejection of all such customers, so D is too absolute.
C applies enhanced measures proportionate to the risk, including approval and closer ongoing monitoring.

Answer: C: enhanced due diligence with beneficial owner identification, PEP and source-of-wealth checks, senior management approval and ongoing monitoring.

Exam tips

Expect scenario questions: name the stage or the right control, not just a definition.
Watch for absolutes. Risk-based approach answers usually beat 'always' or 'never' options.
Separate AML suspicion reporting from sanctions blocking in every scenario.
Know beneficial ownership, PEPs and correspondent banking as typical EDD triggers, in line with Basel ML/FT guidance.
Remember tipping off is prohibited once a SAR is considered or filed.

Practice questions from Case Study: Financial Crime and Fraud

AML, KYC and Sanctions Compliance Frameworks: frequently asked questions

What is the difference between KYC and customer due diligence?

KYC is the broad programme for knowing your customer, including policies, onboarding and updates. CDD is its core process: identify, verify, find the beneficial owner, understand purpose and monitor. Some sources use them as synonyms, so read the question carefully.

What are the stages of money laundering?

Placement puts illegal cash into the financial system. Layering moves and disguises it through complex transactions. Integration returns it as seemingly legitimate wealth, such as property or investments.

How does transaction monitoring work in banks?

Systems compare customer activity with expected behaviour and known typologies, then raise alerts. Analysts review alerts, investigate and escalate. If suspicion remains, the bank files a SAR with the financial intelligence unit.

How is sanctions screening different from AML?

AML looks for suspicion of criminal funds using judgement. Sanctions screening checks parties and payments against official lists. A confirmed match usually means blocking, freezing or rejecting, as the law requires.