Chartered Banker Institute Qualifications Regulation, Compliance and Financial Crime Syllabus

What does the Public Interest Disclosure Act 1998 require for a disclosure to be a protected 'qualifying disclosure'?

The disclosure must, in the worker's reasonable belief, be made in the public interest and tend to show a 'relevant failure' (e.g. a criminal offence, breach of legal obligation, miscarriage of justice, danger to health and safety, environmental damage, or concealment of any of these).

Outline the evolution of the Basel framework from Basel I to Basel III/3.1.

Basel I (1988): first international minimum capital ratio (8%) based on credit risk. Basel II (2004): three pillars and more risk-sensitive capital. Basel III (post-2008): higher and better-quality capital, capital buffers, leverage ratio, and liquidity standards (LCR, NSFR). Basel 3.1 ('Basel IV', finalising reforms): revised standardised approaches and an output floor.

What are the three pillars of Basel II/III?

Pillar 1: minimum capital requirements (credit, market and operational risk). Pillar 2: supervisory review process (firm's own assessment of risks/capital - ICAAP - and supervisory review). Pillar 3: market discipline through public disclosure.

Define a bank's risk-based capital ratio and state the minimum total capital requirement under Basel III.

The capital ratio is $\text{Capital Ratio} = \frac{\text{Eligible Capital}}{\text{Risk-Weighted Assets (RWA)}}$. The Pillar 1 minimum total capital requirement is $8\%$ of RWAs.

What are the components of regulatory capital tiers under Basel III?

Tier 1 (going-concern capital): Common Equity Tier 1 (CET1 - ordinary shares + retained earnings) and Additional Tier 1 (AT1 - e.g. perpetual instruments/CoCos). Tier 2 (gone-concern capital): subordinated debt and similar instruments that absorb losses on insolvency.

State the Basel III minimum ratios for CET1, Tier 1, and the role of the capital conservation buffer.

CET1 minimum $4.5\%$ of RWAs; Tier 1 minimum $6\%$; Total capital $8\%$. On top, a Capital Conservation Buffer of $2.5\%$ CET1 must be held, bringing the effective CET1 requirement (with buffer) to $7\%$.

What is the Basel III leverage ratio and why was it introduced?

A non-risk-based backstop: $\text{Leverage Ratio} = \frac{\text{Tier 1 Capital}}{\text{Total Exposure Measure}}$, with a minimum of $3\%$. It was introduced to constrain the build-up of excessive on- and off-balance-sheet leverage that risk-weighting alone failed to capture.

Define the Basel III Liquidity Coverage Ratio (LCR), its formula, and its minimum.

The LCR ensures short-term resilience: $\text{LCR} = \frac{\text{Stock of High-Quality Liquid Assets (HQLA)}}{\text{Total net cash outflows over 30 days}} \geq 100\%$. It requires enough HQLA to survive a 30-day stress scenario.

Define the Basel III Net Stable Funding Ratio (NSFR), its formula, and its minimum.

The NSFR promotes longer-term funding stability: $\text{NSFR} = \frac{\text{Available Stable Funding (ASF)}}{\text{Required Stable Funding (RSF)}} \geq 100\%$, measured over a one-year horizon.

What is stress testing in a banking context and what is its purpose?

A forward-looking analysis that estimates the impact of severe but plausible adverse scenarios (e.g. recession, market shock) on a bank's capital, liquidity and earnings. It is used to assess resilience, set capital buffers, and inform management actions; the Bank of England runs regular system-wide stress tests.

Contrast the ICAAP and the ILAAP.

ICAAP (Internal Capital Adequacy Assessment Process): a firm's own assessment of the capital it needs to hold against all material risks (Pillar 2). ILAAP (Internal Liquidity Adequacy Assessment Process): the equivalent self-assessment for liquidity resources and funding adequacy.

What is the supervisory output of the ICAAP/ILAAP review, and what is Pillar 2A vs Pillar 2B?

The regulator conducts a Supervisory Review and Evaluation Process (SREP) and issues Individual Capital/Liquidity guidance. Pillar 2A covers risks not (or not fully) captured in Pillar 1; Pillar 2B (the 'PRA buffer') covers losses that could arise under stress.

What is the purpose of bank recovery and resolution regimes?

To enable a failing bank to be stabilised or wound down in an orderly way without taxpayer bailout and while preserving critical functions and financial stability. Firms must prepare recovery plans (own actions to restore viability) and resolution packs/plans (used by the resolution authority).

What is 'bail-in' as a resolution tool?

A statutory power allowing the resolution authority to write down or convert a failing bank's liabilities (e.g. shares, subordinated and senior debt) into equity to absorb losses and recapitalise the bank, so losses fall on shareholders and creditors rather than taxpayers. It supports MREL (Minimum Requirement for own funds and Eligible Liabilities).

Name and describe the three stages of the money laundering process.

(1) Placement: introducing illicit cash into the financial system. (2) Layering: moving funds through complex transactions/transfers to disguise their origin. (3) Integration: returning the now 'cleaned' funds to the criminal as apparently legitimate wealth.

What are the primary money laundering offences under the Proceeds of Crime Act 2002 (POCA)?

Section 327 concealing/disguising/converting/transferring/removing criminal property; Section 328 arrangements (becoming concerned in an arrangement facilitating acquisition/retention/use/control of criminal property); Section 329 acquisition, use and possession of criminal property. Plus failure-to-disclose and tipping-off offences.

Which UK instruments form the core legal framework for anti-money laundering, alongside POCA?

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the 'MLRs 2017', as amended); the Terrorism Act 2000; the Sanctions and Anti-Money Laundering Act 2018; and the Criminal Finances Act 2017 (which introduced Unexplained Wealth Orders and corporate failure-to-prevent-tax-evasion offences).

What are the standard Customer Due Diligence (CDD) measures required under the MLRs 2017?

(1) Identify the customer and verify identity from reliable, independent sources; (2) identify and verify any beneficial owner; (3) understand the purpose and intended nature of the business relationship; and (4) conduct ongoing monitoring of the relationship and transactions.

Contrast Simplified, Standard and Enhanced Due Diligence (SDD/CDD/EDD).

SDD: reduced measures permitted where the ML/TF risk is demonstrably low. Standard CDD: the default identify-and-verify measures. EDD: extra scrutiny required for higher-risk situations, e.g. Politically Exposed Persons (PEPs), high-risk third countries, or unusual/complex transactions.

What is the 'risk-based approach' to AML, and what assessments underpin it?

Directing resources and the intensity of CDD/monitoring in proportion to assessed ML/TF risk rather than applying identical checks to all. It is underpinned by a firm-wide business risk assessment and customer/relationship risk assessments, informed by national risk assessments and FATF guidance.

What is a Suspicious Activity Report (SAR) and to whom is it submitted?

A report disclosing knowledge or suspicion (or reasonable grounds to suspect) of money laundering or terrorist financing. Internally it goes to the firm's MLRO/nominated officer; externally it is submitted to the National Crime Agency (NCA)'s UK Financial Intelligence Unit (UKFIU).

What is the role of the Money Laundering Reporting Officer (MLRO / nominated officer)?

The individual responsible for receiving internal suspicion reports, deciding whether to submit an external SAR to the NCA, acting as the firm's AML point of contact with authorities, and (with the Money Laundering Compliance Officer) overseeing the firm's AML framework. A required SM&CR function in scope firms.

What is a Defence Against Money Laundering (DAML, formerly 'consent') request, and what are the related statutory periods?

A SAR seeking NCA consent to proceed with a transaction that might otherwise be a POCA offence. After submission there is a 7-working-day 'notice period' for the NCA to refuse; if consent is refused there is a 31-calendar-day 'moratorium period' (extendable by court order) during which the transaction must not proceed.

What is the 'tipping off' offence and to whom does it apply?

Under POCA s.333A, it is an offence (in the regulated sector) to disclose to a third party that a SAR has been made or that a money laundering investigation is being contemplated/carried out, where that disclosure is likely to prejudice the investigation.

What is sanctions screening and what is OFSI's role in the UK?

Screening customers, transactions and counterparties against sanctions lists to detect designated persons/entities. The Office of Financial Sanctions Implementation (OFSI), part of HM Treasury, maintains the UK consolidated list, issues licences, and enforces financial sanctions, including civil monetary penalties on a strict-liability basis.

What are a firm's key obligations when a sanctions match is identified (an 'asset freeze' target)?

Freeze the funds/economic resources of the designated person, not make funds available to or for their benefit, and report to OFSI. Dealing with frozen assets or making funds available without a licence is a criminal offence; firms must also report relevant knowledge/suspicion to OFSI.

Distinguish authorised push payment (APP) fraud from unauthorised fraud.

Unauthorised fraud: a transaction made without the customer's consent (e.g. stolen card/account takeover), generally refundable by the bank. APP (authorised push payment) fraud: the customer is deceived into authorising a payment to a fraudster (e.g. impersonation, purchase or romance scams), so the payment is technically 'authorised' by the victim.

What is the Contingent Reimbursement Model (CRM) Code and what has succeeded it for APP scams?

A voluntary industry code (effective 28 May 2019) under which signatory firms reimburse victims of APP scams who met required standards of caution. From 7 October 2024 it is largely superseded by the PSR's mandatory APP fraud reimbursement requirement, splitting liability 50/50 between sending and receiving PSPs for in-scope Faster Payments.

Summarise the Bribery Act 2010's main offences, including the corporate 'failure to prevent' offence.

Section 1 offering/giving a bribe; Section 2 requesting/receiving a bribe; Section 6 bribing a foreign public official; Section 7 the corporate offence of failure of a commercial organisation to prevent bribery by an associated person. The only defence to s.7 is having 'adequate procedures' designed to prevent bribery (guided by six principles, e.g. proportionate procedures, top-level commitment, risk assessment, due diligence).

Under UK GDPR/Data Protection Act 2018, name the data protection principles and the maximum fine.

Principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); plus the overarching accountability principle. The maximum fine is the higher of £17.5 million or 4% of total annual worldwide turnover, enforced by the ICO.