2025/26 CFCI STUDY GUIDE QUESTIONS WITH
COMPLETE ANSWERS.
Introduction
This 150-item simulation mirrors the 2025-2026 Certified Financial Crime Investigator
(CFCI) certification examination developed by ACFCS.
The bank covers seven weighted domains: fraud detection & prevention, AML
compliance, investigation techniques, regulatory frameworks & reporting, digital
currency & cyber-crime, evidence collection & documentation, and ethical/legal
standards.
Every question is original, scenario-based, and aligned with current FATF, FinCEN, EU-
AML, and ACFCS guidance to support mastery-level performance on the live exam.
Examination-length set: 150 original questions
Question 1:
A mid-size US bank detects that a corporate client’s weekly cash deposits suddenly jump
from USD 80 k to USD 450 k for four consecutive weeks. The deposits are structured just
below CTR thresholds and are accompanied by multiple LBCs listing slightly different
addresses. Which red-flag category is MOST prominent?
A. Rapid account-closure requests
B. Layering through complex derivatives
C. Structuring and identity vagueness
D. Trade-based value manipulation
Answer: C. Structuring and identity vagueness
Solution: 31 USC 5324 prohibits structuring; vague LBC addresses support suspicion of
evading identification. Options A, B, and D describe different typologies not evidenced
here.
Question 2:
A FI files a SAR on a customer whose wire transfers to a high-risk jurisdiction average
USD 9 800—just below the USD 10 k record-keeping threshold. The customer claims the
purpose is “family support.” Which investigative step BEST corroborates or disproves
the claim?
A. Request notarised family-tree affidavit
B. Compare stated income to transfer volume via open-source employment records
C. Immediately freeze the account per 31 CFR 1010.311
D. File a second “family-support” SAR using a different narrative
pg. 1
,Answer: B. Compare stated income to transfer volume via open-source
employment records
Solution: Income-to-transfer mismatch is objective and admissible. Freezing (C)
requires stronger evidence; duplicate SAR (D) adds no value.
Question 3:
Under FATF Recommendation 16 (Wire-Fund Transfer Rule), which data element MUST
accompany a cross-border wire exceeding EUR 1 000 originating from an intermediary
bank?
A. Originator’s utility bill
B. Originator’s account number
C. Beneficiary’s passport expiry date
D. Purpose code selected from ISO 20022 list
Answer: B. Originator’s account number
Solution: FATF R.16 mandates account number (or unique reference). Utility bills (A)
and passport expiry (C) exceed requirements; purpose codes (D) are best practice, not
mandatory.
Question 4:
A fintech registers as a money-services business in Wyoming but on-boards 85 % of
clients via mobile apps with Delaware IP addresses. FinCEN’s 2025 MSB registration
renewal asks for “principal state of operations.” Which entry is CORRECT?
A. Wyoming—registration state
B. Delaware—majority transaction jurisdiction
C. California—largest investor base
D. New York—strictest regulator for safety
Answer: B. Delaware—majority transaction jurisdiction
Solution: FinCEN expects the state where most transactions occur. Registration state
(A) is irrelevant if activity lies elsewhere.
Question 5:
A cryptocurrency exchange identifies a user depositing 150 separate incoming
transactions of 0.05 BTC each within one hour, all from different wallets, then
immediately withdrawing the aggregate to a single new wallet. This pattern is MOST
consistent with
A. trade-based laundering
B. chain-hopping
C. peel-chain structuring
D. pump-and-dump manipulation
Answer: C. peel-chain structuring
pg. 2
,Solution: Peel-chain splits and re-aggregates value to obfuscate origin. Trade-based (A)
involves invoices; pump-and-dump (D) is price manipulation.
Question 6:
While investigating invoice fraud, an analyst finds the same PDF invoice hash submitted
by two different vendors six months apart. Hash duplication BEST supports which
inference?
A. Collusion or document reuse
B. Encryption-key theft
C. Ransomware deployment
D. Supply-chain disruption
Answer: A. Collusion or document reuse
Solution: Identical hashes prove the same digital object, suggesting common authorship
or recycling. Other options are unrelated to hash identity.
Question 7:
A FI’s model flags customers whose cumulative cash deposits exceed the 95th percentile
of peer income brackets. Which bias risk arises?
A. Geographic bias against rural customers
B. Racial profiling because income proxies demographics
C. Temporal bias due to inflation
D. Selection bias from voluntary data
Answer: B. Racial profiling because income proxies demographics
Solution: Using income percentiles without demographic neutrality can create
disparate impact. Other biases are less direct.
Question 8:
A corporate customer provides invoices showing the sale of 200 laptops to a school, but
shipping documents list only 50 units. The unit price on the invoice is 20 % above
market. This scenario MOST likely indicates
A. trade-based money laundering (TBML)
B. advance-fee fraud
C. phishing for vendor credentials
D. market-cornering strategy
Answer: A. trade-based money laundering (TBML)
Solution: Over-invoicing plus quantity mismatch moves value offshore; classic TBML
red flag.
pg. 3
, Question 9:
A FI files a SAR 25 calendar days after initial detection. Which statement is TRUE?
A. Filing is timely under 31 CFR 1020.320
B. Filing is late; 30-day limit starts from detection
C. Filing is timely because weekends are excluded
D. Filing is optional for corporate customers
Answer: A. Filing is timely under 31 CFR 1020.320
Solution: Regs allow 30 days from detection; 25 ≤ 30. Weekends (C) are calendar days
and count.
Question 10:
Which evidence type is MOST persuasive in proving beneficial ownership beyond 25 %
for a private trust?
A. Notarised letter from family attorney
B. Trust deed naming beneficiaries and share percentages
C. Bank reference letter
D. Self-certification form signed by trustee
Answer: B. Trust deed naming beneficiaries and share percentages
Solution: Primary document prevails over attestations (A, C) or self-cert (D) which may
be incomplete.
Question 11:
A FI’s 2025 risk assessment weights PEP exposure at 20 %, cash intensity 30 %, and
sector 50 %. A new client scores low on cash but is a foreign PEP in the construction
sector. Under the bank’s model the overall score is MEDIUM. Which action BEST aligns
with Wolfsberg guidance?
A. Decline relationship due to PEP status
B. Apply simplified due diligence because cash score is low
C. Escalate to senior management for enhanced monitoring
D. Reduce weighting on PEP factor to avoid bias
Answer: C. Escalate to senior management for enhanced monitoring
Solution: Wolfsberg requires senior approval for high-risk PEPs, regardless of
algorithmic score.
Question 12:
A FI receives a subpoena for account records of a local politician. The compliance officer
notices the subject is also under adverse-media coverage for bribery. Prior to
responding, the officer should
A. freeze the account immediately
B. file a SAR and then respond
pg. 4
COMPLETE ANSWERS.
Introduction
This 150-item simulation mirrors the 2025-2026 Certified Financial Crime Investigator
(CFCI) certification examination developed by ACFCS.
The bank covers seven weighted domains: fraud detection & prevention, AML
compliance, investigation techniques, regulatory frameworks & reporting, digital
currency & cyber-crime, evidence collection & documentation, and ethical/legal
standards.
Every question is original, scenario-based, and aligned with current FATF, FinCEN, EU-
AML, and ACFCS guidance to support mastery-level performance on the live exam.
Examination-length set: 150 original questions
Question 1:
A mid-size US bank detects that a corporate client’s weekly cash deposits suddenly jump
from USD 80 k to USD 450 k for four consecutive weeks. The deposits are structured just
below CTR thresholds and are accompanied by multiple LBCs listing slightly different
addresses. Which red-flag category is MOST prominent?
A. Rapid account-closure requests
B. Layering through complex derivatives
C. Structuring and identity vagueness
D. Trade-based value manipulation
Answer: C. Structuring and identity vagueness
Solution: 31 USC 5324 prohibits structuring; vague LBC addresses support suspicion of
evading identification. Options A, B, and D describe different typologies not evidenced
here.
Question 2:
A FI files a SAR on a customer whose wire transfers to a high-risk jurisdiction average
USD 9 800—just below the USD 10 k record-keeping threshold. The customer claims the
purpose is “family support.” Which investigative step BEST corroborates or disproves
the claim?
A. Request notarised family-tree affidavit
B. Compare stated income to transfer volume via open-source employment records
C. Immediately freeze the account per 31 CFR 1010.311
D. File a second “family-support” SAR using a different narrative
pg. 1
,Answer: B. Compare stated income to transfer volume via open-source
employment records
Solution: Income-to-transfer mismatch is objective and admissible. Freezing (C)
requires stronger evidence; duplicate SAR (D) adds no value.
Question 3:
Under FATF Recommendation 16 (Wire-Fund Transfer Rule), which data element MUST
accompany a cross-border wire exceeding EUR 1 000 originating from an intermediary
bank?
A. Originator’s utility bill
B. Originator’s account number
C. Beneficiary’s passport expiry date
D. Purpose code selected from ISO 20022 list
Answer: B. Originator’s account number
Solution: FATF R.16 mandates account number (or unique reference). Utility bills (A)
and passport expiry (C) exceed requirements; purpose codes (D) are best practice, not
mandatory.
Question 4:
A fintech registers as a money-services business in Wyoming but on-boards 85 % of
clients via mobile apps with Delaware IP addresses. FinCEN’s 2025 MSB registration
renewal asks for “principal state of operations.” Which entry is CORRECT?
A. Wyoming—registration state
B. Delaware—majority transaction jurisdiction
C. California—largest investor base
D. New York—strictest regulator for safety
Answer: B. Delaware—majority transaction jurisdiction
Solution: FinCEN expects the state where most transactions occur. Registration state
(A) is irrelevant if activity lies elsewhere.
Question 5:
A cryptocurrency exchange identifies a user depositing 150 separate incoming
transactions of 0.05 BTC each within one hour, all from different wallets, then
immediately withdrawing the aggregate to a single new wallet. This pattern is MOST
consistent with
A. trade-based laundering
B. chain-hopping
C. peel-chain structuring
D. pump-and-dump manipulation
Answer: C. peel-chain structuring
pg. 2
,Solution: Peel-chain splits and re-aggregates value to obfuscate origin. Trade-based (A)
involves invoices; pump-and-dump (D) is price manipulation.
Question 6:
While investigating invoice fraud, an analyst finds the same PDF invoice hash submitted
by two different vendors six months apart. Hash duplication BEST supports which
inference?
A. Collusion or document reuse
B. Encryption-key theft
C. Ransomware deployment
D. Supply-chain disruption
Answer: A. Collusion or document reuse
Solution: Identical hashes prove the same digital object, suggesting common authorship
or recycling. Other options are unrelated to hash identity.
Question 7:
A FI’s model flags customers whose cumulative cash deposits exceed the 95th percentile
of peer income brackets. Which bias risk arises?
A. Geographic bias against rural customers
B. Racial profiling because income proxies demographics
C. Temporal bias due to inflation
D. Selection bias from voluntary data
Answer: B. Racial profiling because income proxies demographics
Solution: Using income percentiles without demographic neutrality can create
disparate impact. Other biases are less direct.
Question 8:
A corporate customer provides invoices showing the sale of 200 laptops to a school, but
shipping documents list only 50 units. The unit price on the invoice is 20 % above
market. This scenario MOST likely indicates
A. trade-based money laundering (TBML)
B. advance-fee fraud
C. phishing for vendor credentials
D. market-cornering strategy
Answer: A. trade-based money laundering (TBML)
Solution: Over-invoicing plus quantity mismatch moves value offshore; classic TBML
red flag.
pg. 3
, Question 9:
A FI files a SAR 25 calendar days after initial detection. Which statement is TRUE?
A. Filing is timely under 31 CFR 1020.320
B. Filing is late; 30-day limit starts from detection
C. Filing is timely because weekends are excluded
D. Filing is optional for corporate customers
Answer: A. Filing is timely under 31 CFR 1020.320
Solution: Regs allow 30 days from detection; 25 ≤ 30. Weekends (C) are calendar days
and count.
Question 10:
Which evidence type is MOST persuasive in proving beneficial ownership beyond 25 %
for a private trust?
A. Notarised letter from family attorney
B. Trust deed naming beneficiaries and share percentages
C. Bank reference letter
D. Self-certification form signed by trustee
Answer: B. Trust deed naming beneficiaries and share percentages
Solution: Primary document prevails over attestations (A, C) or self-cert (D) which may
be incomplete.
Question 11:
A FI’s 2025 risk assessment weights PEP exposure at 20 %, cash intensity 30 %, and
sector 50 %. A new client scores low on cash but is a foreign PEP in the construction
sector. Under the bank’s model the overall score is MEDIUM. Which action BEST aligns
with Wolfsberg guidance?
A. Decline relationship due to PEP status
B. Apply simplified due diligence because cash score is low
C. Escalate to senior management for enhanced monitoring
D. Reduce weighting on PEP factor to avoid bias
Answer: C. Escalate to senior management for enhanced monitoring
Solution: Wolfsberg requires senior approval for high-risk PEPs, regardless of
algorithmic score.
Question 12:
A FI receives a subpoena for account records of a local politician. The compliance officer
notices the subject is also under adverse-media coverage for bribery. Prior to
responding, the officer should
A. freeze the account immediately
B. file a SAR and then respond
pg. 4
