Transaction Monitoring and Suspicious Reporting
15 free CySEC AML Chapter 7 flashcards. Tap a card to flip, or use the arrow keys to move through the deck.
Card 1 of 15Suspicion
1 / 15
Tap the card to flip · use ← → arrow keys to navigate
Know the numbers? Now learn the why.Read the Transaction Monitoring & Suspicious Reporting study notes: short answers, key numbers and the law behind each rule.
- What makes a transaction suspicious?
- How are suspicious transactions reported internally and to MOKAS?
- How are reporters protected, and should a suspicious transaction be carried out?
Ready to test yourself? 10 free CySEC AML questions
All 15 cards in this deck
Suspicion
- What makes a transaction suspicious?
- Inconsistency: it does not fit the customer's known legitimate activities or economic profile. Size alone does not decide it, but unusually large or complex transactions must always be examined.
Internal reporting
- What is the first step when a staff member spots something suspicious?
- An internal report to the AML Compliance Officer (the 'Internal Suspicion Report'), who evaluates it and decides whether to escalate to MOKAS.
- What documents the AMLCO's assessment, and what if they decide not to escalate?
- The 'Internal Evaluation Report'; a decision not to escalate must be fully justified in writing on that report.
External reporting
- How and when are external SARs filed with MOKAS?
- Via the GoAML electronic platform, immediately and on the firm's own initiative, irrespective of the amount — including attempted transactions.
The AMLCO
- Who must the AML Compliance Officer be?
- A senior management member with the ability, knowledge and expertise to evaluate reports and liaise with the Unit.
- What is the AMLCO's role once an investigation starts?
- The firm's first point of contact and liaison with the Unit throughout the investigation.
Protection
- What protection does a good-faith disclosure carry?
- It is not a breach of any confidentiality restriction and implies no liability — even if the reporter was unsure of the underlying crime.
- What does whistle-blower protection (Article 69B) cover?
- It shields reporters from threats, retaliation, hostility and workplace discrimination; since 2021 they can also complain securely to the supervisory authority and have a right to an effective remedy.
Handling
- What should a firm do with a suspected transaction before reporting?
- Refrain from conducting it until the suspicion has been reported to MOKAS.
- What if a suspicious transaction cannot be held back, or holding it back could frustrate the prosecution?
- Carry it out, then inform MOKAS immediately afterwards (Article 70).
Red flags
- What is 'churning'?
- Repeated, purposeless trading in the same instrument — a pattern used to layer funds or manufacture the appearance of activity.
- Give an example of a structuring red flag.
- Depositing cash in several accounts in amounts kept below thresholds, then consolidating and wiring the funds abroad.
- What are common employee red flags?
- A lavish lifestyle beyond their salary, never taking leave (preventing review of their work), and overriding controls.
- What does rapid pass-through of funds through an account suggest?
- Money in and straight back out, leaving little balance, is a hallmark of layering rather than genuine account use.
Non-execution
- Is refusing or delaying a transaction a breach of duty to the customer?
- No. Not carrying out or delaying a transaction is not a breach of contract where the customer has not given enough information, or where the firm knows the funds or transaction are likely linked to ML/TF or another crime (Article 71).