An analyst reviews an alert for high volume Automated Clearing House (ACH) activity in an account. The analyst's initial research finds the account is for a commercial daycare account that receives high volumes of large government-funded ACH transactions to support the programs. The account activity consists of checks (cheques) made payable to individual names in varying dollar amounts. One check indicates rent to another business.
An Internet search finds that the daycare company owner has previous government-issued violations for safety and classroom size needs, such as not having enough chairs and tables per enrollee. These violations were issued to a different daycare name.
Simultaneous to this investigation, another analyst sends an email about negative news articles referencing local child/adult daycare companies misusing governmental grants. This prompts the financial institution (Fl) to search all businesses for names containing 'daycare' or *care'. Text searches return a number of facilities as customers at the Fl and detects that three of these businesses have a similar transaction flow of high volume government ACH funding with little to no daycare expenses.
Which red flags would be an indicator that activity is connected to a corruption/bribery typology? (Select Two.)

• A. Large checks issued to various individuals with the memos noting "gift", "thank you", "favor"
• B. Negative news found on the customer related to government-issued violations for safety
• C. Multiple daycare locations with no active business operations or related account activity
• D. The same beneficial owner owning several daycare centers in different locations
• E. Checks issued to an unrelated entity referencing "rent" and "utilities" in the memos

An investigator is reviewing a case generated from the transaction monitoring system, with two large amounts of incoming remittance (IR) to an individual customer. Based on the KYC profile, the customer is a plant manager of a famous multi-national electronics manufacturing firm. As the customer has no similarly large transaction patterns for the past 2 years, the investigator sends an inquiry to the relationship manager (RM) about the nature of the transaction. The RM replies that the transaction is a consultancy fee provided from two different electronics companies with a debit note provided However, there is no detail of service provided on the debit note, and the remitters are two individuals.
Which actions should the investigator recommend to mitigate risk? (Select Two.)

• A. Re-evaluate the customer risk profile.
• B. Exit the relationship with the customer.
• C. Conduct enhanced due diligence.
• D. Document and maintain a file with the investigative findings.
• E. Discuss the investigation findings with the customer.

Which is the first valid step in the Mutual Legal Assistance Treaties international cooperation process?

• A. The investigator may remove the evidence collected without asking permission to do so.
• B. The central authority of the requesting country sends a letter of request to the central authority of the other country.
• C. An investigator from the requesting country visits the country where the information is sought and takes statements from the identified witnesses or suspects.
• D. The central authority that receives the request sends it to a local judicial officer to find out if the information is available.

An investigator is reviewing an alert for unusual activity. System scanning detected a text string within a company customer's account transactions that indicates the account may have been used for a drug or drug paraphernalia purchase. Based on the KYC profile, the investigator determines the customer's company name and business type are marketed as a gardening supplies company. The investigator reviews the account activity and notes an online purchase transaction that leads the investigator to a website that sells various strains of marijuana. Additional account review detects cash deposits into the account at the branch teller lines, so the investigator reaches out to the teller staff regarding the transactions. The teller staff member reports that the business customers have frequently deposited cash in lower amounts. The teller, without prompting, adds that one of the transactors would occasionally smell of a distinct scent of marijuana smoke.
Which information should be included in the SAR/STR?

• A. Details of the transactor's social media accounts
• B. The customer information, including KYC background
• C. The fact that one of the transactors occasionally smelled of marijuana smoke
• D. A transaction that is commensurate with the customer's background