Certified Cryptoasset AFC
Specialist
FLASHCARDS
Version 1.02
acams.org
Instructions
1. Fold flashcards along vertical edges.
2. Cut flashcards along horizontal edges.
acams.org
1-1
A structure of cryptocurrency
transaction data on the blockchain
1-1
What is a block?
1-2
A restricted blockchain that
operates within a closed network
1-2
Private blockchain
1-3
A non-restrictive and
permissionless blockchain that is
accessible to anyone
Public blockchain
Version 1.02 © ACAMS. All rights reserved.
1-3
1-4
No one can remove or alter
transaction data
1-4
Immutability
1-5
No single authority has entire
control
1-5
Decentralization
1-6
Blockchain consensus mechanism
that allows miners to compete to
verify transactions
Proof of work
Version 1.02 © ACAMS. All rights reserved.
1-6
1-7
Blockchain consensus mechanism
that randomly selects miners
based on their stake
1-7
Proof of stake
1-8
The secure codes needed to
access your cryptoassets
1-8
Private key
1-9
Any change to a block would
require changes for all blocks that
follow
Why is it difficult to change a validated block?
Version 1.02 © ACAMS. All rights reserved.
1-9
1-10
A form of digitally stored value that
uses distributed ledger technology
and encryption
1-10
Cryptoasset
1-11
By the extent to which it is issued,
operated, managed, and regulated
by a central party
1-11
How is cryptoasset centralization measured?
1-12
Low fees, fast processing times,
and ability to purchase with any
currency worldwide
Advantages of cryptoassets over fiat currency
Version 1.02 © ACAMS. All rights reserved.
1-12
1-13
Sophisticated technological
equipment and a lot of
computational power
1-13
What is needed to mine cryptoassets?
1-14
Shared computing resources and
the ability to earn rewards more
quickly
1-14
Benefits of mining pools
1-15
Use green energies such as solar,
wind, and hydroelectric energy
Ways to reduce environmental impacts of
mining
Version 1.02 © ACAMS. All rights reserved.
1-15
1-16
Each Bitcoin can be divided into
100 million satoshis, which can be
purchased individually.
1-16
How can a single Bitcoin be divided?
1-17
Any cryptocurrency that is not
Bitcoin
1-17
Altcoin
1-18
Token sale that allows a new
venture to raise funds to develop
new projects
Initial coin offering (ICO)
Version 1.02 © ACAMS. All rights reserved.
1-18
1-19
A decentralized blockchain
platform with a native
cryptocurrency called ether (ETH)
1-19
Ethereum
1-20
A virtual currency or denomination
of cryptocurrency
1-20
Token
1-21
A unique cryptographic blockchain
asset, often in the form of an image
or video
Non-fungible token (NFT)
Version 1.02 © ACAMS. All rights reserved.
1-21
1-22
A digital asset form of money
issued by a country's central bank,
often using blockchain
1-22
Central bank digital currency (CBDC)
1-23
A natural or legal person who
provides financial services for or on
behalf of others
1-23
Virtual asset service provider (VASP)
1-24
Physical kiosks that allow anyone to
purchase cryptocurrencies using
cash or a bank card
Crypto ATMs
Version 1.02 © ACAMS. All rights reserved.
1-24
1-25
Allow cryptocurrency buyers and
sellers to trade on their platforms in
exchange for fees
1-25
Centralized exchanges
1-26
Allow cryptocurrency buyers and
sellers to connect through peerto-peer (P2P) trading
1-26
Decentralized exchanges
1-27
Hiding the source of cryptoasset
funds to make transaction tracing
nearly impossible
What are mixers and tumblers used for?
Version 1.02 © ACAMS. All rights reserved.
1-27
1-28
A system that offers financial
products and services using smart
contracts on a blockchain
1-28
Decentralized finance (DeFi)
1-29
Freedom from censorship by
government or others and data
protection via a blockchain
1-29
Benefit of decentralized application (dApp)
1-30
A group that chooses a set of rules
and codes them into a computer
program
Decentralized autonomous organization (DAO)
Version 1.02 © ACAMS. All rights reserved.
1-30
1-31
The transaction is broadcast across
the blockchain network, validated,
and confirmed.
1-31
What happens in a blockchain transaction?
1-32
Incentivizing the computers on the
network with a higher fee
1-32
How to speed up a transaction
1-33
Virtual asset service provider
(VASP)
The most common way to buy a cryptoasset
Version 1.02 © ACAMS. All rights reserved.
1-33
1-34
Allows digital transactions to take
place when the amount includes a
fraction
1-34
The function of unspent transaction output
(UTXO)
1-35
Without the need for a bank,
government, or intermediary to
process a payment
1-35
Peer-to-peer (P2P) transactions
1-36
Media activity, technology changes,
government regulation, economic
changes, etc.
Market forces affecting prices of cryptoassets
Version 1.02 © ACAMS. All rights reserved.
1-36
1-37
Exchanges that offer their services
24 hours a day, 7 days a week
1-37
Cryptoasset markets
1-38
Identity management, supply
chains, insurance, real estate
ownership, etc.
1-38
Examples of applications of blockchain
technology
1-39
21 million
Maximum number of Bitcoin to be produced
Version 1.02 © ACAMS. All rights reserved.
1-39
1-40
In wallets that users control or
within virtual asset service
providers (VASPs)
1-40
How are cryptoassets stored?
1-41
A string of characters representing
a wallet to send and receive funds
1-41
Cryptocurrency address
1-42
Users control the private keys and
the assets.
Unhosted wallets
Version 1.02 © ACAMS. All rights reserved.
1-42
1-43
Virtual asset service provider
wallets
1-43
Hosted wallets
1-44
A login ID and password allow the
user to control the wallet key pairs.
1-44
Cloud wallets
1-45
Portable devices allowing users to
securely manage their
cryptocurrency assets
Hardware wallets
Version 1.02 © ACAMS. All rights reserved.
1-45
1-46
Miners control more than 50% of
the network's validating and mining
power.
1-46
51% attacks
1-47
A radical change to the network
that effectively results in two
branches.
1-47
Hard forks
1-48
A minor change to the blockchain
software, such as an upgrade
Soft forks
Version 1.02 © ACAMS. All rights reserved.
1-48
1-49
1-49
Self-executing transaction
protocols stored on a blockchain
that run when predetermined conditions are
met.
Smart contracts
1-50
The mining reward is cut in half.
1-50
Block halving
1-51
Individuals and entities can be
tracked and potentially identified.
Pseudonymous cryptocurrency
Version 1.02 © ACAMS. All rights reserved.
1-51
1-52
Monero, ZCash, and Dash
1-52
Examples of cryptoassets that offer enhanced
anonymity
1-53
Used to identify patterns within
transactions.
1-53
Blockchain analytics
1-54
Immutable and publicly available
Benefits of information on a blockchain
Version 1.02 © ACAMS. All rights reserved.
1-54
1-55
Finding and evaluating publicly
available cryptoasset transaction
activity
1-55
Functions of blockchain monitoring software
1-56
Using paid blockchain analytic
software
1-56
You can visually trace transactional information
by...
1-57
Open source intelligence and paid
blockchain explorers
Methods of attributing data to activity
Version 1.02 © ACAMS. All rights reserved.
1-57
1-58
Data, a hash, the previous hash, and
metadata
1-58
What does a block contain?
1-59
A process of using blockchain data
to group multiple addresses into a
wallet
1-59
Clustering
1-60
Tracking ownership of all portions
of cryptocurrency
Benefits of unspent transaction output (UTXO)
tracing
Version 1.02 © ACAMS. All rights reserved.
1-60
2-1
Money laundering, terrorist
financing, sanctions, fraud, bribery,
tax evasion, etc.
2-1
Examples of financial crime
2-2
Placement, layering, integration
2-2
Three stages of money laundering
2-3
A money laundering technique to
evade triggering a reporting or
recordkeeping requirement
What is structuring?
Version 1.02 © ACAMS. All rights reserved.
2-3
2-4
The use of funds for an illegal
political purpose to support
terrorist activities
2-4
What is terrorist financing?
2-5
Penalties imposed by one entity on
another to provoke a change in
behavior or policy
2-5
Sanctions definition
2-6
Payment-related, trade-related,
ownership-related
Methods of sanctions evasion
Version 1.02 © ACAMS. All rights reserved.
2-6
2-7
Payments are often processed
through third-party banks that do
not know beneficiaries' identities.
2-7
Correspondent banking risk for sanctions
2-8
An intentional act of criminal
deception to obtain an unjust or
illegal advantage
2-8
Fraud definition
2-9
Unrealistic claims for returns;
companies not registered with a
regulator
Indicators of smart contract exploitation
Version 1.02 © ACAMS. All rights reserved.
2-9
2-10
Giving or receiving an advantage
connected to improper
performance of a position of trust
2-10
Bribery definition
2-11
Legitimately reducing the amount
of tax owed to a government by
legal or natural persons
2-11
What is tax avoidance?
2-12
The use of illegal practices to avoid
paying a tax liability
What is tax evasion?
Version 1.02 © ACAMS. All rights reserved.
2-12
2-13
By keeping their cryptoassets in a
third-party account and failing to
report
2-13
How might criminals evade taxes on
cryptoassets?
2-14
Criminal activity committed using a
computer or the internet, often to
access data
2-14
What is cybercrime?
2-15
A form of malware that encrypts
the users’ files and data and the
victim must pay a ransom
What is ransomware?
Version 1.02 © ACAMS. All rights reserved.
2-15
2-16
Regulatory, legal, financial, and
reputational risk
2-16
Key risks in financial crime prevention controls
2-17
Customer, jurisdiction, product,
and channel
2-17
Money laundering prevention categories of risk
2-18
Person or persons (natural or legal)
with ultimate control over the
funds in an account
Beneficial owner definition
Version 1.02 © ACAMS. All rights reserved.
2-18
2-19
Natural persons who benefit from
the activities of a legal person or a
group of legal persons
2-19
Ultimate beneficial owner definition
2-20
Foreign PEPs and domestic PEPs
2-20
Two types of politically exposed persons (PEPs)
2-21
Can be used to claim the proceeds
of crime as legitimate revenue
Risk of shell companies
Version 1.02 © ACAMS. All rights reserved.
2-21
2-22
To combine illegally obtained funds
with cash legally generated by the
business
2-22
How might criminals use cash-based
businesses?
2-23
Laundering illicit funds; breaching
sanctions requirements; funding
terrorism
2-23
Charity and non-governmental
organizations risk
2-24
Disguising criminal proceeds by
moving value through the use of
trade transactions
Trade-based money laundering is the
process of...
Version 1.02 © ACAMS. All rights reserved.
2-24
2-25
The inherent risk posed by the
method in which an institution’s
products are delivered
2-25
Channel risk definition
2-26
To change the amount of funds
sent or to keep the amount under
reporting thresholds
2-26
How might criminals use electronic transfer?
2-27
A bank service allowing users to
scan a check and transmit the
digital image for deposit
Remote deposit capture (RDC)
Version 1.02 © ACAMS. All rights reserved.
2-27
2-28
Website that sells illegal goods and
services and is accessed by
specialized software
2-28
What is a dark market?
2-29
Obscure transaction history and
disguise movements of illegally
obtained cryptocurrency.
2-29
Illicit cryptocurrency holders can use
mixers to...
2-30
Different global compliance
requirements; the historical use of
gaming to launder money
Why does gaming with cryptoassets carry risks?
Version 1.02 © ACAMS. All rights reserved.
2-30
2-31
Using business resources by
classifying customers based on the
level of perceived risk
2-31
Risk-based approach to business
2-32
Preventive, detective, and
corrective
2-32
Three categories of control strategies
2-33
Inherent risk – controlled risk =
residual risk
Residual risk equation
Version 1.02 © ACAMS. All rights reserved.
2-33
2-34
Front line or customer-facing
employees
2-34
What is the first line of defense?
2-35
When files are reviewed by a
second person to ensure proper
checks are performed
2-35
What is a four eyes check?
2-36
Identify and mitigate risks to an
organization and clearly document
functions.
Role of the second line of defense
Version 1.02 © ACAMS. All rights reserved.
2-36
2-37
Oversee an organization’s antimoney laundering program and file
a SAR.
2-37
Responsibility of the MLRO
2-38
Develops and maintains an audit
risk assessment to determine audit
priorities.
2-38
What does an effective internal audit
department do?
2-39
Know your customer (KYC),
transaction monitoring, and
investigations
Phases of customer research
Version 1.02 © ACAMS. All rights reserved.
2-39
2-40
Low, medium, and high
2-40
Three risk classification levels for customers
2-41
Type of risk an organization is
willing to accept when it does
business
2-41
What is an organization's risk appetite?
2-42
Identify transactions to assess the
possibility of financial crimes.
Transaction monitoring process
Version 1.02 © ACAMS. All rights reserved.
2-42
2-43
The UN Security Council, the EU,
and individual nations or states
2-43
Who imposes sanctions?
2-44
Checking information obtained
about a person, entity, goods, or
services against sanctions lists
2-44
What is sanctions screening?
2-45
Determining if there is any risk
related to the customer, including
sanctions.
What is name screening?
Version 1.02 © ACAMS. All rights reserved.
2-45
2-46
The ability to be suspicious, keep an
open mind, and stay up to date
with training and research
2-46
What are the traits of an investigative mindset?
2-47
Assess, explore, organize, present
2-47
Four research steps
2-48
Collect information to understand
the nature and purpose of the
customer’s account
CDD for a natural person
Version 1.02 © ACAMS. All rights reserved.
2-48
2-49
Identify the natural person who
ultimately owns and controls a legal
person
2-49
CDD for a legal person
2-50
2-50
When a person discloses
information that is likely to
prejudice a money laundering investigation
What is tipping off?
2-51
Legal obligation to store data
securely
Data security and privacy
Version 1.02 © ACAMS. All rights reserved.
2-51
2-52
To demonstrate compliance
efforts to auditors and the
supervisory authorities
2-52
Why is it important to document your research?
2-53
Summary, basic information, the
nature of business, red flags, issues
of concern
2-53
A common customer profile structure
includes...
2-54
Failure to report can result in fines
and imprisonment
Duty to report
Version 1.02 © ACAMS. All rights reserved.
2-54
2-55
Internal review group, internal
escalation report, file a SAR or UAR
with law enforcement
2-55
Suspicious activity escalation process
2-56
Alert law enforcement to potential
instances of money laundering or
terrorist financing.
2-56
Suspicious activity reports
2-57
Money laundering reporting officer
or other financial crime compliance
leadership
Who writes a SAR?
Version 1.02 © ACAMS. All rights reserved.
2-57
2-58
Scanning and analysis of historic
transactional data for potential
money laundering or sanctions
2-58
Transaction monitoring
2-59
Regular review and enhanced
monitoring, legal restrictions, and
changes in the relationship
2-59
What happens after a SAR filing?
2-60
Follow your organization's policies
and procedures.
What should you do if you reject a customer
because of suspicious activity?
Version 1.02 © ACAMS. All rights reserved.
2-60
3-1
Regulatory, legal, financial, and
reputational risk
3-1
Key risks in financial crime prevention controls
3-2
Types of information, how it should
be shared, protocols for sharing
3-2
FATF standards on information sharing include:
3-3
Risk-based AML standards for
member states
What do the FATF 40 provide?
Version 1.02 © ACAMS. All rights reserved.
3-3
3-4
Requires VASPs to share originator,
beneficiary information for virtual
asset-related transactions
3-4
Travel Rule definition
3-5
Analysis and recommendations for
preventing criminal abuse of
financial system
3-5
FATF mutual evaluations provide:
3-6
Agreements between countries to
obtain information and evidence;
not shared between law enforcement
Mutual legal assistance
Version 1.02 © ACAMS. All rights reserved.
3-6
3-7
Ability of a state to enforce
sanctions beyond its territory
3-7
Extraterritoriality definition
3-8
Obliged entity required to follow EU
AML regulations and register with
local authorities
3-8
EU 5AMLD VASP definition
3-9
Exchange providers; custodian
wallet providers
Two types of UK cryptoasset companies
Version 1.02 © ACAMS. All rights reserved.
3-9
3-10
Rapid, illicit fund transfers; AML laws
enforced against both
3-10
Cryptoassets, fiat money laundering similarities
3-11
Bank Secrecy Act (BSA)
3-11
Most important US AML regulation
3-12
Strengthen AML laws beyond the
Bank Secrecy Act, Money
Laundering Control Act
USA PATRIOT Act purpose
Version 1.02 © ACAMS. All rights reserved.
3-12
3-13
Anti-Money Laundering Act (AMLA)
of 2020
3-13
US Act that updated AML cryptoasset
regulations
3-14
Develop, implement, maintain an
effective AML program
3-14
Bank Secrecy Act requires entities to:
3-15
3-15
Assists member states to develop
robust AML programs, legal
frameworks, institutional infrastructure, technical
skills
Purpose of UN's GPML initiative
Version 1.02 © ACAMS. All rights reserved.
3-16
Level of acceptable financial crime
risk within business and goal
parameters
3-16
Risk appetite
3-17
Level of AML risk in place before
applying mitigation controls
3-17
Inherent risk
3-18
Customer, jurisdiction, product,
channel
Categories that determine customer risk
Version 1.02 © ACAMS. All rights reserved.
3-18
3-19
Quickly upload data, verify
accuracy, look for gaps, calculate
final scoring
3-19
Benefits of third-party risk-rating tools
3-20
3-20
Source of funds, VASP AML
controls, negative news, funds
destination, interaction with high-risk services
What should a crypto risk assessment consider?
3-21
Hidden ownership; fast, irreversible
transactions; pseudonymous;
transfer ownership
Cryptoasset inherent risks
Version 1.02 © ACAMS. All rights reserved.
3-21
3-22
PEP status, high-risk entities,
jurisdictions, negative customer
information, AML red flags
3-22
What factors can make customers high-risk?
3-23
Built-in technical measures
obscure the link between sending
and receiving addresses
3-23
Why are privacy-centered cryptoassets
different?
3-24
Supply-based risks, regulations,
technology, market abuse,
reputation, negative news
VASP risk factors
Version 1.02 © ACAMS. All rights reserved.
3-24
3-25
Internal policies, designated
compliance officer, employee
training, audit, CDD
3-25
Pillars of an AML compliance program
3-26
High-level steps to ensure
compliance with AML, sanctions
and other relevant regulations
3-26
Compliance procedures definition
3-27
Test adequacy of AML, sanctions,
and consumer controls to
determine appropriateness
Role of independent audits
Version 1.02 © ACAMS. All rights reserved.
3-27
3-28
Robust due diligence and
monitoring programs at
onboarding, throughout the relationship
3-28
How do you mitigate employee or vendor risk?
3-29
Risk-management practices,
internal controls, CDD, reporting,
recordkeeping, compliance monitoring
3-29
What should AML policies and procedures
cover?
3-30
Present report; ensure it is clear,
understandable; respond to
questions, challenges
Responsibilities of risk assessment teams
Version 1.02 © ACAMS. All rights reserved.
3-30
3-31
Customer risk of money laundering
or terrorist financing
3-31
The extent of due diligence depends on:
3-32
Reduce costs, enhance efficiency,
generate possible solutions
3-32
Benefits of machine learning
3-33
Improve risk management,
efficiency, client experience, work
quality
How do new technologies help banks?
Version 1.02 © ACAMS. All rights reserved.
3-33
3-34
Links to PEPs, litigation, regulatory,
reputation, SOW
3-34
Examples of EDD for a natural person
3-35
Process of adding real-world
entities to nondescript addresses
used on the blockchain
3-35
Attribution definition
3-36
Information source, format, date,
number of correlated sources
Factors that impact cryptoasset sources
Version 1.02 © ACAMS. All rights reserved.
3-36
3-37
In real-time, prior to onboarding
3-37
When is name screening performed?
3-38
Centralized or decentralized, AML
controls, products, exposure to risk,
jurisdiction
3-38
Factors to know when assessing a VASP
3-39
Prior customer transactions,
blockchain activity
Information found on the blockchain
Version 1.02 © ACAMS. All rights reserved.
3-39
3-40
Recent pay stub, bank statement,
tax return
3-40
Ways to determine source of funds (SOF)
3-41
Complete wallet view, wallet
transaction history, other known
entities, past transactions
3-41
Purchased blockchain monitoring services
include:
3-42
Designed to hide transaction
information such as addresses,
amounts, history
Anonymity-enhanced cryptocurrency (AEC)
definition
Version 1.02 © ACAMS. All rights reserved.
3-42
3-43
After the customer has been
accepted and completed
transactions
3-43
When is transaction monitoring performed?
3-44
Centralized, senior leaders make
decisions; Decentralized, all levels
have decision authority
3-44
Differences between centralized and
decentralized VASPs:
3-45
Total current wealth of customer
Source of wealth (SOW) definition
Version 1.02 © ACAMS. All rights reserved.
3-45
3-46
Court proceedings, media from
reliable outlets, definite facts
(screenshots), court cases
3-46
Valid research findings include:
3-47
Who, what, where, when, why, how
of the case
3-47
A SAR narrative answers:
3-48
KYC, transaction monitoring,
investigations
Phases of customer research
Version 1.02 © ACAMS. All rights reserved.
3-48
3-49
Send to review group, internal
escalation report, file SAR with law
enforcement
3-49
Escalation steps for potential suspicious activity:
3-50
Investigator’s thought process;
back up suspicion with facts;
question everything
3-50
Investigative mindset definition
3-51
Identify roles, responsibilities;
protect organization; mitigate risks
Investigations: Purpose of policies, procedures
Version 1.02 © ACAMS. All rights reserved.
3-51
3-52
Assess, Explore, Organize, Present
3-52
Four research steps
3-53
Online interface to view
cryptoasset transactions
3-53
What is a blockchain explorer?
3-54
Trail of data created while using the
internet; websites, emails, online
information
Digital footprint definition
Version 1.02 © ACAMS. All rights reserved.
3-54
3-55
Conclusions are justifiable by
others based on content,
documentation, steps followed
3-55
How much research is “reasonable”?
3-56
Clear, concise, fully documented;
maintain records; follow
organization's policy
3-56
Communication best practices
3-57
Acknowledge request, be concise,
timely, factual, clarify any points not
understood
Responding to law enforcement requests:
Version 1.02 © ACAMS. All rights reserved.
3-57
3-58
Narrative that describes details of
who, what, when, where
3-58
Most important part of the SAR
3-59
Assist in collecting information,
intelligence on potential illegal
activity
3-59
Purpose of a SAR
3-60
Customer engages in suspicious
activities; change in firm’s risk
appetite
Reasons for rejecting an existing customer
Version 1.02 © ACAMS. All rights reserved.
3-60