Browse CISI Exam Guides: UK RPI, IRT, Risk, CFC & Investment Management

CISI CFC Background and risk characteristics Guide

CISI Combating Financial Crime study guide for background and risk characteristics, with learning objectives, UK control cues, and exam traps.

Background and risk characteristics belongs to the CISI Combating Financial Crime Terrorist Financing exam topic, weighted at 4%. Study it as the concept foundation for the terrorist-financing chapter. The exam often tests whether you can stop thinking only about large criminal proceeds and instead focus on purpose, destination, beneficiary, network, connected parties, and the harm that even small payments can support.

Learning Objectives

  • Distinguish terrorist financing from conventional money laundering, including the fact that terrorist funds may originate from legitimate or illegitimate sources.
  • Recognize why terrorist financing can involve relatively small payments that still carry high harm potential.
  • Identify common channels through which terrorist financing may move, such as charities, cash couriers, trade flows, remittance-style channels, or digital transfer routes.
  • Understand why customer profile, geographic exposure, and transaction purpose may matter more than transaction size alone in terrorist-financing detection.
  • Explain why similarities between AML and CFT controls exist, while also recognizing the need for threat-specific judgment.

Key Concepts

ConceptWhat to know for CISI CFC review
Terrorist financingProviding, collecting, moving, or making funds available where there is a terrorist purpose or terrorist connection. The funds may be clean, criminal, or mixed.
Predicate-source trapMoney laundering normally starts with criminal proceeds. Terrorist financing can start with legitimate donations, business income, or family support that is diverted to terrorist use.
Low-value riskA small transfer can be material if it supports travel, equipment, communications, logistics, propaganda, or a designated person.
Channel riskCharities, non-profit organizations, informal value transfer, prepaid products, cash couriers, cryptoasset services, and trade flows can be misused when controls are weak.
Context over sizeGeography, counterparties, purpose, adverse media, ownership links, and customer behaviour may matter more than transaction amount.
Connected-party riskThe direct customer may appear low risk while the controller, beneficiary, local partner, signatory, trustee, or counterparty creates the concern.

How Terrorist Financing Differs from Money Laundering

The exam commonly tests the difference between hiding proceeds and enabling harm. In a conventional laundering question, the starting point is usually criminal property: the customer is trying to place, layer, integrate, disguise, or enjoy proceeds. In a terrorist-financing question, the starting point may be lawful money, but the destination, beneficiary, control person, geography, or stated purpose makes the risk unacceptable.

That distinction changes the answer. Do not look only for large unexplained wealth. A modest series of transfers to a higher-risk area, donations routed through opaque intermediaries, unusual urgency, or a link to a designated individual can be more important than the absolute value of the payment.

IssueMoney laundering emphasisTerrorist-financing emphasis
starting pointcriminal proceeds or suspected criminal propertylawful, unlawful, or mixed funds
main questionwhere did the money come from and how is it disguised?where is the money going and what will it support?
valuemay involve large proceeds or structured activitymay involve small repeated amounts
harmlegitimising or enjoying criminal propertysupporting terrorist activity, networks, travel, propaganda, or logistics
key evidencesource of funds, source of wealth, layering, beneficial ownershipdestination, purpose, beneficiary, route, connected parties, adverse information
controlsCDD, monitoring, suspicion escalation, recordsCDD, sanctions screening, connected-party review, CFT escalation, records

AML and CFT controls overlap because both require customer understanding, monitoring, escalation, and record keeping. The judgment differs because CFT may be destination-led or purpose-led rather than proceeds-led.

Lawful-Source Funds Can Still Be High Risk

One of the most important exam traps is assuming that clean-source money cannot fund terrorism. A salary, legitimate business income, donations, or family support may still be used for terrorist purposes. The firm should not clear a concern solely because the source appears lawful.

Lawful-source exampleWhy CFT risk may still arise
wages or salaryfunds may be sent repeatedly to a concerning beneficiary or location
community donationscollections may be diverted from stated humanitarian purpose
business incomelegitimate revenue may be used to support a prohibited network
family supportstated personal support may hide travel, logistics, or equipment funding
charity fundraisingend-use, governance, and local partner controls may be weak
investment proceedsliquid assets can be moved quickly to unclear recipients

The better exam answer asks whether the purpose, beneficiary, route, and connected parties make sense. It does not stop at source-of-funds evidence.

Why Small Payments Matter

Terrorist financing can involve modest amounts because the immediate objective may be logistics rather than profit. Funds may support travel, documents, communications, accommodation, equipment, online activity, recruitment, propaganda, or small operational expenses.

Low-value patternWhy it matters
repeated small payments to one corridorcumulative pattern may show support route
small donations to changing overseas partnersend-use and beneficiary may be unclear
many senders to one recipientpooled support may be hidden across individual transfers
small payments followed by cash withdrawalsfunds may be passed onward outside traceable systems
low-value cryptoasset transfersvalue can move quickly through hard-to-identify wallets
prepaid or stored-value useportability can matter more than transaction size

The exam may include a statement such as “the amounts are too small to matter.” That is a cue to reject value-only reasoning. Size is a factor, but purpose, pattern, and destination can override it.

Risk Characteristics to Recognize

Risk characteristicWhy it matters
Legitimate-source fundsCustomer wealth or donation history does not eliminate the need to test purpose and destination.
Small repeated transfersRepetition, routing, and beneficiary pattern can create a stronger alert than a single large payment.
Charitable or humanitarian narrativeGenuine charitable activity exists, so the control question is evidence, governance, and end-use assurance, not automatic suspicion.
Cross-border exposureJurisdiction, conflict zone, sanctions exposure, weak supervision, or correspondent-bank route can raise the risk profile.
Connected-party opacityUnclear beneficial ownership, trustees, controllers, signatories, or intermediaries can hide the real destination of funds.
Urgency and secrecyPressure to bypass checks, reluctance to explain purpose, or resistance to documentation can support escalation.
Adverse informationMedia, public notices, or typology alerts can make a weak fact pattern more serious.
Unusual purposePayment purpose does not fit the customer, charity mandate, product, or documented relationship.

The strongest answer usually combines indicators. One weak signal may require inquiry; several weak signals can require enhanced review, escalation, and a decision not to process until the issue is resolved.

Channels and Typologies

CFT typologies overlap with AML typologies but the exam emphasis is different. The risk is not only that proceeds are disguised; it is that funds, value, or services reach a terrorist actor or supporting network.

ChannelCFT risk cueControl response
bank transfersdestination, beneficiary, purpose, or frequency is inconsistentreview purpose, screen parties, and escalate unresolved concern
correspondent or payment routespayment passes through higher-risk corridorsassess route, intermediary, and sanctions/CFT exposure
money-service or remittance-style channelsvalue moves quickly across borderstest sender, recipient, purpose, and pattern
charities and NPOslocal partner, beneficiary, or end use is unclearreview governance, project evidence, and screening results
cash couriersfunds move outside normal account transparencyassess source, destination, and law-enforcement indicators
prepaid or stored-value productsportability and anonymity may be higherstrengthen monitoring and customer understanding
cryptoasset serviceswallet ownership, counterparties, and destination may be unclearassess blockchain, sanctions, and customer-risk evidence where available
trade flowsinvoices, goods, values, or counterparties do not fitreview trade documentation and possible diversion risk

The firm should avoid a channel-only conclusion. Charities, remittances, trade, and digital transfers are legitimate in many cases. The exam asks whether the facts show enough risk to require stronger evidence or escalation.

Charities, NPOs, and Humanitarian Activity

Charities and non-profit organizations deserve careful analysis. They may operate in conflict zones or high-risk areas because that is where relief is needed. That legitimate role does not remove the risk of diversion, abuse of local partners, pressure from armed groups, or weak end-use evidence.

Review areaWhat the firm should understand
governancewho controls the charity and approves payments
purposewhat project, relief effort, or beneficiary is being funded
local partnerwho receives, distributes, or implements activity on the ground
payment routewhy this bank, corridor, intermediary, or method is used
end-use evidenceinvoices, project reports, beneficiary records, or credible activity evidence
screeningnames of trustees, controllers, signatories, partners, and beneficiaries where relevant
adverse mediawhether information is credible, current, and connected to the transaction

The stronger response is evidence-sensitive. Do not assume a charity is suspicious merely because of sector type. Do not process automatically because the stated purpose is humanitarian. Ask what evidence supports the purpose and whether unresolved CFT or sanctions concerns remain.

Geography and Destination Risk

Geography matters because terrorist groups, conflict zones, sanctions exposure, weak supervision, corruption, and fragile banking systems can increase CFT risk. Geography alone is not proof. It is a risk driver that changes the level of evidence and monitoring required.

Geographic cueExam implication
conflict-affected destinationstronger review of beneficiary, purpose, and end use
high-risk jurisdiction identified by external bodyupdate risk assessment and consider EDD
payment corridor inconsistent with customer profilereview rationale and transaction history
sanctioned territory or listed group nearbysanctions and CFT analysis may overlap
correspondent route through weak controlsassess intermediary and payment-message information
rapid change in destination patternreview whether customer purpose has changed

When geography, unclear beneficiaries, weak records, and urgency combine, the answer should usually escalate rather than process routinely.

Connected Parties and Network Thinking

CFT analysis often requires network thinking. The direct customer may be only one part of the risk picture. The relevant concern may sit with the controller, signatory, donor, beneficiary, local partner, intermediary, recipient, or related account.

Connected partyWhy it matters
beneficial owner or controllermay be linked to a designated or high-risk network
trustee or signatorymay control the movement of funds
overseas partnermay receive or distribute funds on the ground
beneficiarymay be the real recipient of value
donor or fundraisermay be collecting for a hidden purpose
intermediary bank or payment servicemay create route or sanctions exposure
related accountmay reveal pooling, splitting, or onward movement

The exam may reward the answer that says “screen and review relevant connected parties,” not only “screen the customer.”

Control Response

Start with classification. If the facts point to terrorist financing, the answer should not drift into generic fraud or ordinary money-laundering language. Then decide what the firm can do immediately: gather missing information, apply enhanced due diligence, screen relevant names, review connected parties, stop or delay activity where required, escalate internally, and preserve records.

The strongest response usually combines controls. For example, a payment by a charity to a supplier in a higher-risk region may require purpose evidence, beneficiary understanding, screening of controllers and counterparties, adverse-media review, and MLRO escalation if suspicion remains. A blanket refusal without analysis may be weak; so is processing the payment because the amount is small.

StepPractical action
classifydecide whether the issue is CFT, sanctions, AML, fraud, or combined risk
evidencecollect purpose, beneficiary, route, ownership, and communication records
screencheck customer, owners, controllers, signatories, beneficiaries, and counterparties where relevant
assesscompare activity with customer profile, geography, and expected purpose
pause where neededdo not release funds while a serious unresolved CFT or sanctions issue remains
escalateroute to financial crime, sanctions, MLRO, legal, or senior management as appropriate
recordpreserve rationale, evidence reviewed, decisions, and next steps

Exam Application

Fact pattern clueBetter exam response
Small transfers to a higher-risk areaDo not dismiss by value; assess destination, purpose, frequency, and connected parties.
Charity account with weak end-use evidenceSeek evidence of governance, beneficiaries, project purpose, and payment route.
Customer linked to adverse media or designated namesEscalate quickly, screen all relevant names, and consider sanctions or reporting obligations.
Transaction purpose is vague or inconsistentDo not process routinely; obtain explanation and evidence, then escalate if unresolved.
Staff believe the payment is harmless because funds came from wagesRemember that lawful-source funds can still finance terrorism.
Payment is urgent and customer resists questionsTreat urgency and reluctance as behavioural risk indicators.

Common Pitfalls

  • assuming terrorist-financing funds must be criminal proceeds
  • treating low-value payments as low risk without checking purpose and destination
  • assuming charities or non-profit organizations are suspicious merely because of sector type
  • failing to screen controllers, signatories, beneficial owners, trustees, and connected parties where relevant
  • choosing a generic AML answer when the stem gives a clear terrorism, sanctions, or designation clue
  • ignoring adverse media because the customer name itself is not listed
  • processing first and asking questions later because the payment is urgent
  • focusing only on source of funds and ignoring destination, beneficiary, and end use
  • treating geography as proof of wrongdoing rather than a risk driver requiring proportionate evidence

Sample Exam Question

A small charity customer asks a firm to send several modest payments to a new overseas partner in a region associated with terrorist activity. The charity says the funds are for relief work but cannot explain the end beneficiary or provide project records. Which response is most consistent with a sound CFT control approach?

A. Process the payments because terrorist financing usually involves large criminal proceeds. B. Decline all charity customers in higher-risk regions without further review. C. Treat the amount as the main risk factor and process the payments if each one is below the firm’s normal monitoring threshold. D. Obtain purpose and beneficiary evidence, screen relevant parties, apply enhanced scrutiny, and escalate if the concern remains unresolved.

Answer: D. Terrorist-financing risk often depends on purpose, destination, connected parties, and end-use evidence rather than transaction size alone. The firm should not assume wrongdoing, but it should not process blindly when the facts create unresolved CFT concern.

Study Notes

For revision, build a two-column distinction between money laundering and terrorist financing. Put “criminal proceeds” under laundering, “lawful or unlawful funds” under terrorist financing, and then list the facts that make a small payment high risk: destination, beneficiary, purpose, ownership, adverse media, urgency, and missing evidence.

Use this quick distinction:

If the facts show…Think first about…
lawful-source fundsstill test destination, purpose, and beneficiary
small repeated transferspattern and route may matter more than value
charity or humanitarian explanationevidence-sensitive review, not automatic clearance
high-risk destinationEDD and connected-party review
possible designated or conflict-linked partysanctions/CFT escalation before release
vague beneficiary or project recordsunresolved end-use risk

Key Takeaways

  • Terrorist financing may involve lawful-source funds, not only criminal proceeds.
  • Small values can still be high risk when destination, purpose, or connected parties are concerning.
  • Charities and non-profit organizations require evidence-sensitive review, not automatic suspicion.
  • Strong CFT answers combine CDD, screening, monitoring, escalation, and record preservation.
  • Context matters more than value alone: geography, beneficiary, route, ownership, and adverse information can drive the answer.
  • The direct customer may be less important than the connected party or ultimate beneficiary.

Continue Review

Return to the CISI Combating Financial Crime guide for the full exam-topic table, or use the CFC Cheat Sheet for threat classification, UK authority cues, and final review prompts.

Revised on Friday, May 29, 2026