AML compliancemust balance financial crime prevention with data privacy regulationssuch asGDPR (EU) and CCPA (U.S.).
* Option B (Correct):Data minimization ensures that only essential data is collected and processed, reducing privacy risks.
* Option C (Correct):Regularly updating policies helps organizations align with evolving privacy laws and AML requirements.
Why Other Options Are Incorrect:
* Option A (Incorrect):Unrestricted access to customer data increases the risk of data breaches and privacy violations.
* Option D (Incorrect):Repurposing data beyond AML purposescan violatedata protection laws (e.
g., GDPR's purpose limitation principle).
Key Data Privacy Considerations for AML Compliance:
* Data minimization:Only collect data necessary for risk assessment.
* Access controls:Limit employee access to customer data based on job role.
* Transparency:Inform customers about how their data is used for AML compliance.
Reference:
FATF Recommendation 10 (Customer Due Diligence)
General Data Protection Regulation (GDPR), Article 5
Wolfsberg Group Data Privacy in AML Guidelines

AML controls should bemeasured for effectivenessusingquantifiable metrics.
* Option D (Correct):Thetrue positive/false positive ratioassesses theefficiencyof AML detection.
* Option A (Incorrect):Thenumber of alerts alonedoes not measureeffectiveness, as many could be false positives.
* Option B (Incorrect):Client exitsdo not indicate whether an AML program isworking properly.
* Option C (Incorrect):High-risk customer onboardingmust bemonitored, but it does not indicate AML effectiveness.
Reference:FATF Guidance on AML Risk Management, Wolfsberg Group AML Effectiveness Indicators, FinCEN SAR Filing Effectiveness Reports.

A subpoena is a legal order that requires a person or an entity to produce documents, information, or testimony related to a legal matter. A financial intelligence unit (FIU) is a specialized unit within a financial institution that is responsible for detecting, analyzing, and reporting suspicious activities and transactions.
When a bank receives a subpoena regarding one of its clients, the FIU should review the subpoena and perform a transaction review to determine if there is any evidence of money laundering, terrorist financing, fraud, or other criminal activity involving the client. The FIU should also respond fully to the subpoena by providing the requested information and documents, unless there is a valid reason to object or seek a protective order. The FIU should not adjust the client's risk score, file a SAR, or close the client's account based solely on the receipt of the subpoena, as these actions may be premature, inappropriate, or illegal.
Adjusting the client's risk score may require further investigation and due diligence. Filing a SAR may be unnecessary or misleading if the subpoena does not indicate any suspicious activity. Closing the client's account may violate the bank's contractual obligations, customer service standards, or anti-discrimination laws. Moreover, these actions may alert the client or the subject of the investigation to the existence of the subpoena, which may interfere with the legal process or jeopardize the safety of the bank or its employees.
References:
Subpoena Responses for Financial Institutions
Requests by Law Enforcement for Financial Institutions to Maintain Accounts SUBPOENA COMPLIANCE UPDATE
[ACAMS Study Guide, 6th Edition, Chapter 5, p. 140]

Under the Egmont Group Principles, information exchange among financial intelligence units (FIUs) should be conducted freely, spontaneously, and upon request, on the basis of reciprocity. This means that FIUs should be willing to share information without the expectation of reciprocity on how the information will be used. The goal is to facilitate the cooperation and exchange of information among FIUs to combat money laundering, terrorist financing, and other financial crimes.

as there's NO mitigating control, the temporary control system must be developed and implemented until the permanent mitigating control is developed and implemented.