Which information is it best practice to share at the very beginning of a well-written SAR/STR narrative?

• A. Information about any follow-up actions conducted by the financial institution on the account
• B. Any and all relevant facts about the parties who facilitated the suspicious activity or transactions
• C. A specific description of the involved accounts and transactions, including the origination and application of funds
• D. The purpose of the SAR/STR narrative and a general description of the known or alleged violation

Which most likely indicates that a business email compromise attack has occurred?

• A. A company sends a recurring payment to a new account number.
• B. A company sends a larger-than-normal check to an existing supplier.
• C. A company has a new beneficial owner.
• D. A company adds a new employee as an authorized signer.

A financial regulator is evaluating the effectiveness of a financial institution's (Fl) anti-financial crime program. Which condition should be met to satisfy the regulator?

• A. The program is drafted using a risk-based approach to avoid the Fl being used as a conduit for criminal activities.
• B. The program meets the minimum requirements of anti-financial crime standards, which are published by a financial industry association.
• C. The program is aligned with the financial industry's anti-financial crime priorities.
• D. In the past 3 years, internal auditing results show no high-severity issues and a maximum of three medium-seventy and four low-severity issues.

Which is the first valid step in the Mutual Legal Assistance Treaties international cooperation process?

• A. An investigator from the requesting country visits the country where the information is sought and takes statements from the identified witnesses or suspects.
• B. The central authority of the requesting country sends a letter of request to the central authority of the other country.
• C. The central authority that receives the request sends it to a local judicial officer to find out if the information is available.
• D. The investigator may remove the evidence collected without asking permission to do so.

An analyst reviews an alert for high volume Automated Clearing House (ACH) activity in an account. The analyst's initial research finds the account is for a commercial daycare account that receives high volumes of large government-funded ACH transactions to support the programs. The account activity consists of checks (cheques) made payable to individual names in varying dollar amounts. One check indicates rent to another business.
An Internet search finds that the daycare company owner has previous government-issued violations for safety and classroom size needs, such as not having enough chairs and tables per enrollee. These violations were issued to a different daycare name.
Simultaneous to this investigation, another analyst sends an email about negative news articles referencing local child/adult daycare companies misusing governmental grants. This prompts the financial institution (Fl) to search all businesses for names containing daycare' or care*. Text searches return a number of facilities as customers at the Fl and detects that three of these businesses have a similar transaction flow of high volume government ACH funding with little to no daycare expenses.
The analyst determines that site visits should be conducted for the three daycare businesses. Which observations at the on-site visits would justify writing a SAR/STR? (Select Three.)

• A. A full parking lot of cars with no staff at the site
• B. A site located in a commercial building
• C. Lights turned off at the site during operational hours
• D. Visible signage indicating the purpose of the building
• E. Visible attendance with children being dropped off by parents
• F. Signs of severe wear and poor maintenance at the site