Section 313 of the USA PATRIOT Act prohibits U.S. financial institutions from establishing, maintaining, administrating or managing correspondent accounts for foreign shell banks. A foreign shell bank is a foreign bank that does not have a physical presence in any country. To ensure compliance with this prohibition, U.S.
financial institutions must obtain from each foreign bank that maintains a correspondent account the identity of each owner of the foreign bank and the nature and extent of each owner's ownership interest. This information must be updated within 30 days of any change.
:
USA PATRIOT Act | FinCEN.gov, Section 313
US PATRIOT ACT | State Street

When investigating unusual transactions, financial institutions must focus on data-driven risk assessment and internal review first.
Option A (Correct): Assessing business ownership and control structures helps determine if multiple businesses are connected through hidden links (e.g., shell companies or common ownership).
Option C (Correct): The account manager may provide valuable insight on whether the customer's activity aligns with their expected profile.
Option B (Incorrect): Law enforcement should only be contacted after internal review confirms suspicious activity.
Option D (Incorrect): Declining transactions without thorough investigation could lead to missed SAR filings or improper risk assessment.
Option E (Incorrect): Social media is not a reliable investigative tool for AML casework.
Key Red Flags in Business AML Investigations:
Frequent transactions between businesses with no clear commercial relationship.
Ownership structures that obscure beneficial owners.
Rapid movement of funds through multiple accounts without economic justification.
Best Practices for Investigating Complex Cases:
Verify ownership and control through official company registries.
Conduct negative news screening and PEP/sanctions screening.
Request supporting documentation from the customer.
Reference:
FATF Recommendation 10 (Customer Due Diligence)
Wolfsberg Group Guidance on Transaction Monitoring and Investigations
FinCEN Red Flags for Business Money Laundering Investigations

AML compliancemust be balanced with data protection lawssuch asGDPR (EU), CCPA (U.S.), and local banking secrecy laws.
* Option B (Correct):Data minimization ensures financial institutions only collect and retain essential customer dataneeded for AML compliance.
* Option C (Correct):Regularly updating data processing policies ensures compliance with evolving data protection regulations.
Why Other Options Are Incorrect:
* Option A (Incorrect):Unrestricted access to customer data increases privacy risksand canviolate GDPR and other data protection laws.
* Option D (Incorrect):AML data must not be repurposed without regulatory justification, as GDPR requires data usage to align with its original collection purpose.
Best Practices for Managing Data Privacy in AML Compliance:
* Restrict access to AML data on a need-to-know basis.
* Implement strong encryption and security controls for customer data.
* Ensure all AML-related data collection aligns with privacy regulations.
Reference:
General Data Protection Regulation (GDPR), Article 5 (Principles for Data Processing) FATF Recommendation 2 (National AML Cooperation & Data Sharing)
6th EU AML Directive (6AMLD) on Data Protection and AML Compliance

Application Programming Interfaces (APIs)are tools that enableinterconnectivity and data exchange between different software applications. In AML contexts, APIs are commonly used tointegrate third-party systems, such as screening tools, customer databases, and transaction monitoring platforms, ensuring real- time and accurate flow of information.
This technological capability supports enhancedautomation, agility, and efficiencyin AML processes.
Reference: ACAMS CAMS Study Guide - 6th Edition, Chapter:Technology and AML- Section:Emerging Technologies and APIs in Compliance

Banks must adhere to strictprivacy lawsandSAR confidentiality ruleswhen handling customer information, especially in cross-border investigations.
* Option A (Correct):Banks must consider privacy laws such as theUS Bank Secrecy Act (BSA), the EU General Data Protection Regulation (GDPR), and their internal policies before sharing data.
* Option B (Correct):Information should beshared only on a need-to-know basis, ensuring compliance withAML regulations and internal procedures.
* Option C (Incorrect):While FinCEN provides SAR guidance, banks do not need to seek FinCEN's permission for every internal information request.
* Option D (Incorrect):International requests must comply with legal frameworks, but there is no universal requirement for approval by national authorities.
Reference:US Bank Secrecy Act (BSA), FATF Recommendation 40 (International Cooperation), and GDPR Rules on Data Sharing.