Combating Financial Crime Cheat Sheet — High-Yield Concepts, UK Terms, and Common Traps

April 12, 2026

High-yield CISI Combating Financial Crime reference covering format, weighted topics, UK-specific distinctions, and fast review cues.

Use this as a saved recall page after the guide structure is already clear. It works best once you know where each chapter sits inside the paper.

Quick links:

At a glance

Exam role: a focused compliance and financial-crime paper with UK and international relevance
Official format: 50 multiple choice questions in 1 hour
Award structure: can be taken as the stand-alone Level 3 Award or combined with a regulatory paper for the wider certificate route
Best fit: compliance, AML, financial-crime, surveillance, onboarding, and risk candidates who need a differentiated anti-financial-crime guide rather than a broad advice or markets route
Common mistake: turning a UK CISI paper into generic finance revision with nicer spelling

Weighted coverage buckets

Topic	Official weighting	What it is really doing
Money Laundering	8%	expect crime-type classification, control design, and escalation-route logic
Financial Crime Risk Management	8%	expect UK body, rule, permission, or escalation-route distinctions rather than product recall only
The Role of the Financial Services Sector	7%	expect the exam to test the decisive distinction in this section rather than every detail equally
Bribery and Corruption	6%	expect crime-type classification, control design, and escalation-route logic
The Background and Nature of Financial Crime	5%	expect UK body, rule, permission, or escalation-route distinctions rather than product recall only

Fast route check

If your role sounds most like…	Better first CISI instinct
AML, sanctions, monitoring, onboarding, MLRO support, or financial-crime controls	Combating Financial Crime can fit well
broad enterprise risk, governance, limits, and oversight	Risk in Financial Services may fit better first
UK retail-advice conduct and regulatory permissions	UK Regulation and Professional Integrity is usually the better first move
operations career with a wider qualification wrapper	IOC may be the better route if you need the broader operations structure

Better first instinct

If the prompt feels most like…	Better first instinct
suspicious funds, source of wealth, layering, unusual transfers, or criminal property	classify money laundering and then decide whether onboarding, monitoring, reporting, or record evidence is weak
extremist purpose, small-value movement, charity misuse, or cross-border support network	classify terrorist financing and focus on purpose, destination, and escalation rather than transaction size alone
gifts, facilitation payments, public officials, agents, or procurement	classify bribery or corruption and assess adequate procedures, third-party controls, and senior accountability
false statements, account takeover, scams, internal dishonesty, or market manipulation	separate fraud, market abuse, and insider dealing before choosing the control response
sanctioned person, country, sector, ownership link, or asset freeze	classify sanctions risk and check screening, escalation, freeze, and reporting logic
weak governance, ignored alerts, poor MI, or under-resourced compliance	treat it as financial-crime risk management, not as a single transaction problem

Financial-crime classifier

Threat family	Fast recognition cue	Strong control response
Money laundering	criminal property enters or moves through the system	CDD, EDD, monitoring, suspicious activity escalation, records
Terrorist financing	value supports terrorist purpose, sometimes in small or legitimate-looking amounts	purpose-focused due diligence, sanctions screening, escalation, information sharing
Bribery and corruption	improper advantage, inducement, facilitation, agent or public-official risk	gifts and hospitality controls, third-party due diligence, training, senior tone
Fraud	deception for gain or loss avoidance	prevention controls, verification, investigation, reporting, remediation
Market abuse	inside information, manipulation, improper disclosure, misleading behaviour	surveillance, restricted lists, wall-crossing controls, escalation
Tax evasion facilitation	helping another party evade tax or hide taxable assets	prevention procedures, staff training, risk assessment, escalation
Sanctions breach	prohibited party, ownership, control, geography, sector, or asset dealing	screening, freeze, reject or block logic, licensing check, reporting

Red-flag pattern map

Pattern	Why it matters
complex structure with unclear beneficial owner	may hide control, source of wealth, or sanctioned ownership
transactions inconsistent with customer profile	may indicate laundering, fraud, mule activity, or sanctions evasion
urgency plus secrecy	often appears in bribery, fraud, or suspicious transfer cases
third-party payment with weak rationale	can indicate layering, corruption, or fraud
politically exposed person plus unusual funds	increases bribery, corruption, and source-of-wealth risk
payment routed through high-risk jurisdiction	may increase AML, sanctions, tax, or terrorist-financing concern
employee overrides alerts without evidence	turns a customer risk into a governance and culture problem

Money laundering stage sorter

Stage or pattern	What the criminal is trying to do	Exam control cue
Placement	introduce criminal value into a financial channel	source of funds, cash activity, unusual account opening, onboarding checks
Layering	distance funds from source or owner	rapid transfers, circular flows, shell companies, securities trades without rationale
Integration	make proceeds look like legitimate wealth	property, investments, business revenue, loan repayment, apparent sale proceeds
Predicate offence	generate the criminal property	fraud, bribery, tax evasion, corruption, trafficking, cybercrime
Professional facilitation	design or legitimise the scheme	lawyer, accountant, adviser, agent, introducer, trust or company service provider

Authority and body role sorter

Body or role	What it does	Do not confuse with
FATF	international standard setting, typologies, mutual evaluations	receiving a firm’s SAR or prosecuting a customer
FIU / NCA-style role	receives and analyses suspicious activity information	the firm’s own MLRO decision process
FCA	supervises regulated firms’ systems, controls, governance, and conduct	criminal prosecution of every underlying offence
OFSI-style sanctions authority	sanctions implementation, asset-freeze discipline, reporting or licensing issues	ordinary AML suspicion review
HMRC or tax authority	tax enforcement and tax-evasion context	generic money-laundering-only analysis
Law enforcement	investigates crime and gathers evidence	day-to-day firm screening or onboarding
Firm / MLRO	operates controls, assesses suspicion, preserves records, escalates and reports where appropriate	public authority investigation powers

Sanctions decision cues

Stem clue	Stronger response
name match with designated person	investigate match quality, escalate, and avoid release until resolved
ownership or control by listed person	assess control, not just direct name match
asset freeze	stop dealing with funds or economic resources and preserve evidence
licence possibility	route to sanctions/legal process; do not improvise permission
sectoral or jurisdictional restriction	check activity, goods, services, counterparties, and geography
stale screening data	update lists, re-screen, and review process weakness

Bribery and corruption cues

Cue	What to test
public official or state-owned enterprise	official-risk exposure and approval controls
agent or introducer	due diligence, beneficial ownership, fee rationale, contract, monitoring
facilitation payment	do not assume local custom makes it acceptable
gifts or hospitality	value, timing, recipient, purpose, approvals, register
procurement or licence decision	possible improper influence
vague invoice or success fee	hidden value transfer and books-and-records concern
adequate procedures	proportionate controls, top-level commitment, risk assessment, due diligence, training, monitoring

Tax evasion and facilitation cues

Cue	First question
offshore transfer before disclosure deadline	is the customer hiding taxable assets or income?
request not to document tax purpose	is there dishonest concealment or facilitation risk?
false invoice	is the record designed to disguise income, expense, or ownership?
adviser or employee helps conceal ownership	could an associated person be facilitating evasion?
tax-efficient wrapper	is it legal planning or is there concealment, sham purpose, or false information?
foreign tax issue	do not dismiss automatically; assess cross-border facilitation and escalation needs

Suspicious activity handling

If the firm has…	Better next step
unusual facts but no suspicion yet	gather available information through normal controls and document rationale
knowledge or suspicion of laundering	escalate internally to MLRO / financial-crime route
customer asks why activity is delayed	avoid tipping off; use authorised internal guidance
planned activity involving possible criminal property	preserve facts and consider DAML / consent route where relevant
poor records supporting the decision	remediate evidence weakness before closing the case
repeated similar alerts	treat as possible control or typology issue, not isolated noise

Firm-control failure cues

Failure	Why it matters
generic CDD with no beneficial-owner evidence	ownership, control, and sanctions/AML risks may be missed
alerts closed without rationale	monitoring cannot be defended to compliance, audit, or regulator
high-risk customers reviewed on ordinary cycle	risk-based approach is not operating
sales override compliance challenge	culture and governance weakness
outsourced screening not tested	accountability remains with the firm
no lessons learned after incidents	remediation is incomplete
management information hides backlogs	senior oversight cannot function

Control-response ladder

Use this when the stem asks what the firm should do next:

classify the threat family before choosing the control
identify whether the issue is onboarding, monitoring, screening, investigation, reporting, or remediation
preserve evidence and records before closing the file
escalate through the appropriate internal route, such as MLRO or financial-crime compliance where relevant
avoid tipping off or prejudicing an investigation where suspicious activity rules apply
fix the root control weakness if the problem reflects more than one customer or transaction

Scenario mini-drills

Mini stem	First classification
Client sells low-risk securities after two weeks and wires proceeds to unrelated third party	possible layering / money laundering
Charity receives small payments then sends funds to conflict region	terrorist-financing risk despite low values
Local consultant requests offshore success fee before licence approval	bribery, corruption, and records-control risk
Name is not listed but entity is controlled by listed person	sanctions ownership/control issue
Staff member helps client hide tax residency	tax-evasion facilitation and firm-control risk
Insider information is shared before a trade	market abuse and unlawful disclosure
AML system suppresses alerts with no validation	technology/model governance weakness
Regulator asks for evidence of alert closure but records are missing	record-keeping and defensibility failure

Section lesson map

Use these lessons when a quick-check line needs full explanation.

Topic	Lessons
The Background and Nature of Financial Crime	4
Money Laundering	4
Terrorist Financing	3
Bribery and Corruption	6
Fraud and Market Abuse	4
Tax Evasion	2
Financial Sanctions	3
Financial Crime Risk Management	3
The Role of the Financial Services Sector	8

Five things to remember under pressure

keep the UK frame active, but remember CISI also expects cross-border crime vocabulary and institutional response
classify the topic before you chase detail
use the official topic weightings to control where your time goes
do not let a familiar nearby term pull you into the wrong chapter
verify live rules and thresholds in the official sources instead of trusting memory for moving details

What stronger answers usually do

identify the right chapter before comparing the options
keep the UK body, wrapper, or route aligned with the fact pattern
use the correct level of CISI depth instead of overcomplicating a clean exam question
choose the decisive distinction and ignore decorative facts
stay within the official paper scope rather than importing specialist material from a different route
classify the threat family before selecting the reporting or control response
distinguish suspicious activity handling from ordinary customer-service escalation
connect individual red flags to governance, evidence, and remediation where the stem shows a pattern
separate sanctions freezes from AML suspicion and tax facilitation from ordinary tax planning
identify the role of the body named in the question before assigning an action
preserve records and avoid tipping off before trying to satisfy a customer’s explanation request

Common traps

revising all topics equally when the weightings clearly say otherwise
knowing the right concept but choosing the wrong threat family or reporting route
treating the paper as a definitions test instead of a classification-and-judgment paper
opening timed practice before the structure of the guide is stable
assuming a small transaction cannot matter because the value is low
choosing to contact the customer for an explanation when the facts suggest tipping-off risk
treating sanctions, AML, bribery, fraud, and market abuse as interchangeable financial-crime labels
ignoring third-party and employee-conduct risk when the case facts point beyond the customer
assuming a regulator, standard setter, FIU, MLRO, and law-enforcement body all do the same thing
relying on customer explanations when the facts require independent evidence
treating a technology tool or outsourced provider as a substitute for firm accountability

Pressure checklist

Can I restate the heaviest topics from memory?
Do I know which UK body, wrapper, route, or metric is actually being tested?
Am I answering at the right CISI depth for this paper?
Did I classify the threat family before selecting the control?
Did I separate firm responsibility from public-authority responsibility?
Did I check for tipping-off, sanctions freeze, record preservation, and escalation issues?
If money appears, am I reading the question in GBP unless it clearly says otherwise?
If the rule could change, have I checked the official source recently?

If you are using this as a saved page

reread the weighted coverage table before mixed practice
use the Study Plan if your revision still feels random
use the FAQ when the real problem is route fit or paper structure
use Resources whenever the question turns on live official wording

Practice this exam

Use this free guide for review, then Start CISI Combating Financial Crime Practice on Finance Prep for timed questions, topic drills, and detailed explanations.

Revised on Friday, May 29, 2026

Study Plan

FAQ

Browse CISI Exam Guides: UK RPI, IRT, Risk, CFC & Investment Management