Series 24 AML Supervision Practice Questions

Correct answer: D. Independent testing of the program, conducted by firm personnel or a qualified outside party not involved in its day-to-day operation

A compliant AML program rests on four core pillars: (1) written policies and procedures, (2) a designated AML compliance officer, (3) ongoing employee training, and (4) independent testing for compliance, performed by firm personnel or a qualified outside party who is not the person who designed or administers the program day-to-day. The facts describe a program missing the fourth pillar.

• AA. Incorrect. Management or board approval of the program is good governance, but it is not a separate required pillar and does not test whether the program works. The gap in the stem is the lack of any independent review.
• BB. Incorrect. A financial statement audit by a CPA firm examines the firm's financial reporting, not the effectiveness of its AML controls. Nothing in the AML program rule requires it to be filed with FinCEN.
• CC. Incorrect. Customer identification must be performed at account opening, and ongoing due diligence is risk-based. The rule does not require a blanket yearly refresh of identification for every account, and this does not address the missing independent review.
• DD. Correct. Independent testing by someone not involved in day-to-day AML operations is the missing required pillar.

• Source: 31 CFR 1023.210 (AML program for broker-dealers), accessed October 2026
• Source: FINRA Rule 3310 (Anti-Money Laundering Compliance Program), accessed October 2026

Correct answer: D. 5 years

FinCEN's SAR rules require broker-dealers to retain copies of filed SARs and all supporting documentation for five years from the date of filing. This is distinct from the general SEC/FINRA books-and-records retention period of six years for many other records, which is a common source of confusion.

• AA. Three years is shorter than the actual FinCEN retention period for SARs and supporting documentation.
• BB. Seven years overstates the required SAR retention period.
• CC. Six years is longer than the SAR-specific retention period (though it matches some other books-and-records categories, it is not correct here).
• DD. FinCEN's rules require broker-dealers to retain copies of filed SARs and their supporting documentation for five years from the date of filing.

• Source: 31 CFR 1023.320 (SARs by broker-dealers), accessed October 2026

Correct answer: D. The firm must file an annual notice with FinCEN of its intent to share information under Section 314(b)

Section 314(b) provides a safe harbor from liability for financial institutions that voluntarily share information with one another regarding suspected money laundering or terrorist financing, but the safe harbor is only available to institutions that have filed the required annual notice with FinCEN certifying their intent to share information under this provision. Customer consent is not required (and would defeat the purpose, since the customer is often the subject of the concern), there is no state-regulator pre-approval step, and sharing is not contingent on a SAR having already been filed. 314(b) sharing can occur independent of, and often before, any SAR filing.

• AA. No customer consent is required or even permitted as a precondition. 314(b) sharing occurs specifically because alerting the customer could tip off suspected illicit activity.
• BB. 314(b) sharing is not contingent on first filing a SAR; the two are independent tools, and firms are not permitted to disclose SAR filing status to the receiving institution.
• CC. State securities regulators play no role in authorizing 314(b) sharing, and there is no per-disclosure approval or after-the-fact report to FinCEN; the requirement is an annual notice of intent to FinCEN.
• DD. Correct. Before relying on the safe harbor, a firm must file an annual notice with FinCEN indicating its intent to share information with other financial institutions under Section 314(b).

• Source: 31 CFR § 1010.540, accessed October 2026

Correct answer: C. 25% or more

The CDD rule's beneficial ownership requirement uses a two-pronged test: an 'ownership prong' requiring identification of each individual who owns 25% or more of the entity's equity interests, and a 'control prong' requiring identification of a single individual with significant responsibility to control, manage, or direct the entity. Both prongs must be satisfied when applicable.

• AA. 10% is not the CDD beneficial ownership threshold; it's a lower bar than the rule requires.
• BB. 20% is a plausible-sounding round number but not the actual regulatory threshold.
• CC. Correct. 25% or more ownership triggers beneficial-owner identification under the CDD rule's ownership prong.
• DD. 50% is too high; it would exclude beneficial owners the rule intends to capture at the 25% level.

• Source: 31 CFR 1010.230 (beneficial ownership of legal entity customers), accessed October 2026

Correct answer: C. Decline to establish or maintain a correspondent account and take reasonable steps to avoid indirect service

Section 313 prohibits a covered financial institution, including a broker-dealer, from establishing, maintaining, administering, or managing a correspondent account for a foreign shell bank, and requires reasonable steps to ensure it does not provide indirect access. Enhanced due diligence does not cure the prohibition.

• AA. Enhanced due diligence, a cap and internal approval do not make a shell bank correspondent account permissible.
• BB. A home regulator's letter does not change the status of a shell bank.
• CC. Correct: shell bank correspondent accounts are barred, and the firm must guard against indirect use.
• DD. Monitoring and wire limits are not a substitute for the prohibition.

• Source: 31 CFR § 1010.630, accessed October 2026

Correct answer: C. $1,000,000

A private banking account under Section 312 is established for a non-U.S. person, requires a minimum aggregate deposit of funds or assets of not less than $1,000,000, and is assigned to a liaison officer. Such accounts require enhanced due diligence, including scrutiny of senior foreign political figures.

• AA. A $250,000 minimum is below the statutory definition.
• BB. A $500,000 minimum is below the statutory definition.
• CC. Correct: the minimum aggregate deposit is $1,000,000.
• DD. A $5,000,000 minimum is above the definition, so lower-balance accounts could be missed.

• Source: 31 CFR § 1010.605, accessed October 2026