Red flags include using personal accounts for business transactions (which can obscure fund tracing), preferring minimal direct interaction (potentially avoiding scrutiny), and unclear ultimate beneficial ownership (which can conceal the true controllers of the entity and facilitate illicit activity).

Effective AML programs promote aculture of compliance, which includes an environment where staff are empowered to raise concerns, challenge decisions, and continuously improve through cross-functional learning.Providing effective challengeis a supervisory expectation and best practice in institutions that value AML governance integrity.
While AML officer authority (option B) supports oversight, it is not as impactful on daily operational effectiveness as fostering a challenging and adaptive compliance culture.

Cryptocurrencies and convertible virtual currencies present several well-documented money laundering and terrorist financing risks, as identified in FATF guidance and national AML frameworks. These risks largely stem from the pseudonymous nature, speed, and borderless design of virtual asset transactions.
One key risk is the ability to obscure the source of illicit funds. Criminals can move value through wallets and exchanges in ways that make tracing the origin of funds more difficult, particularly when using privacy- enhancing technologies or poorly regulated platforms.
Another significant risk is the facilitation of payments for illicit goods and activities, including drugs, cybercrime services, ransomware, and sanctions evasion. Virtual currencies can be used to settle transactions outside the traditional financial system.
Additionally, criminals frequently engage in layering transactions, rapidly transferring funds across multiple wallets, platforms, or blockchains to hide the origin of illicit proceeds.
Difficulty converting into physical currency is not a recognized AML risk, as most convertible virtual currencies can be exchanged through regulated platforms. Theft of funds is a cybersecurity concern but is not itself a core AML risk indicator.

Failure to provide beneficial ownership information prevents institutions from meeting AML obligations and understanding who ultimately controls the customer relationship. Institutions may need to decline onboarding, restrict services, or terminate relationships when transparency requirements are not satisfied.

After identifying and rating inherent risks, the next key step in the risk assessment process is to evaluate the effectiveness of existing controls. This allows the organization to calculate the residual risk - i.e., the level of risk remaining after controls are applied.