An institution should focus on the appropriateness of having a centralized review of suspicious transactions and recommendations to file an STR to ensure consistency. This is because a centralized review process can help to avoid duplication, inconsistency, or omission of STRs, as well as to ensure compliance with regulatory requirements and internal policies. A centralized review process can also facilitate the analysis of trends, patterns, and typologies of suspicious transactions across the institution, and enable the communication and coordination with relevant stakeholders, such as law enforcement, regulators, or other financial institutions.
References: =
* ACAMS Study Guide for the CAMS Certification Examination, 6th Edition, Chapter 5, Section 5.3.1, page 1911
* ACAMS CAMS Certification Video Training Course, Module 5, Lesson 5.3, video time 2:30-4:002
* ACAMS CAMS Certification Practice Exam, Question 124, page 2843

According to the Basel Committee on Banking Supervision guidelines, the internal audit function should evaluate the adequacy and effectiveness of the bank's compliance function and its compliance risk management framework1. This includes assessing the compliance risk inherent in the bank's activities, products, services, and systems, as well as the compliance policies, procedures, controls, and reporting mechanisms2. The internal audit function should also review the transactions and records of the bank to ensure compliance with applicable laws, regulations, and internal standards3.
The other statements are incorrect because:
* B. An internal audit program of adequacy of the bank's compliance function should be established, but should not include review of transactions. This statement is false because the internal audit function should review the transactions and records of the bank to ensure compliance, as mentioned above3.
* C. The compliance function and internal audit function should be combined. This statement is false because the compliance function and the internal audit function should be separate and independent from each other, to avoid conflicts of interest and ensure objectivity and credibility.
* D. The auditors should not discuss internal audit findings with compliance management to maintain
* independence. This statement is false because the internal audit function should communicate and coordinate with the compliance function on a regular basis, to share information, insights, and recommendations, and to avoid duplication of work. However, the internal audit function should maintain its independence and report directly to the board of directors or the audit committee.
References:
* 1: The internal audit function in banks, Principle 10, p. 9
* 2: The internal audit function in banks, Principle 10, p. 10
* 3: The internal audit function in banks, Principle 10, p. 11
* : The internal audit function in banks, Principle 2, p. 4
* : The internal audit function in banks, Principle 10, p. 11

The compliance officer should provide a high level summary of the activity and the interactions with law enforcement to the board of directors, as this would be the most appropriate way to escalate the information without compromising the confidentiality of the STR or the ongoing investigation. Providing a copy of the STR or the letter from law enforcement could expose the bank to legal risks or jeopardize the investigation.
Informing the regulator to bring it up with the board would not be sufficient, as the compliance officer has the responsibility to report directly to the board on significant compliance issues.
References:
ACAMS CAMS Certification Video Training Course, Module 5: Risk Management, Lesson 5.3:
Reporting to Senior Management and the Board1
ACAMS CAMS Certification Study Guide, 6th Edition, Chapter 5: Risk Management, Section 5.3:
Reporting to Senior Management and the Board2

The customer's relocation and expansion to different jurisdictions constitutes a triggering event that requires ongoing due diligence on this client, as it may indicate changes in the customer's risk profile, business activities, or beneficial ownership. The bank should update the customer's information, verify the identity and legitimacy of the new entities, and assess the level of money laundering and sanctions risks associated with the new locations12. The other options are not triggering events, as they are either consistent with the customer's normal business operations or do not affect the customer's risk profile.
References:
ACAMS CAMS Certification Study Guide, 6th Edition, Chapter 4, page 931
ACAMS CAMS Certification Video Training Course, Module 4, Lesson 22

the Office of Foreign Assets Control (OFAC) has the authority to prohibit or reject any trade or financial transactions involving specified countries, entities, and individuals that are subject to U.S. economic sanctions, unless such transactions are authorized by a general or specific license issued by OFAC. This applies to transactions that occur within the U.S. territory, as well as transactions that involve U.S. persons, U.S. goods, or the U.S. financial system, regardless of where they take place. This is one of the key aspects of OFAC's extraterritorial reach, which means that OFAC can enforce its sanctions programs beyond the U.S. borders.
References:
* Home | Office of Foreign Assets Control, section "Mission": "The Office of Foreign Assets Control ("OFAC") of the US Department of the Treasury administers and enforces economic and trade sanctions based on US foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States."
* The Aggressive Extraterritorial Reach of U.S. Economic Sanctions: Foreign Company Exposure to OFAC Enforcement, section "A. Bases for OFAC jurisdiction over foreign parties", paragraph 1: "One key aspect of the Office of Foreign Assets Control's extraterritorial reach includes the blocking of certain non-United States initiated transactions for or through the United States (U.S.) for benefit of a restricted person or entity."
* The global reach of OFAC sanctions, section "The global reach of OFAC sanctions", paragraph 1:
"OFAC sanctions are trade and economic sanctions administered by The U.S. Treasury Department's Office of Foreign Asset Control (OFAC). They are often intended to have extra-territorial effect, meaning that they apply outside the U.S. territory. In some instances a connection with the U.S. territory is required."
"Prohibit or reject unlicensed trade and financial transactions with specified countries, entities, and individuals. "