You’re on a roll
Create a free account to save your FRM progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › FRM › Operational Risk and Resilience
Free FRM Operational Risk and Resilience Practice Questions & Answers
400 exam-style Operational Risk and Resilience questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 151
What is 'operational risk appetite' and how does it link to strategic planning?
Select an option first.
Correct answer: B — A forward-looking expression of the level of operational risk the organisation is prepared to accept in pursuit of its strategic objectives — links to strategy because: business growth requires new processes and systems that increase operational risk; risk appetite should constrain strategies that would push operational risk beyond acceptable limits; and trade-off decisions (efficiency vs control investment) are guided by the risk appetite
Explanation: B is correct. OpRisk appetite and strategy: when a bank enters a new market (higher OpRisk), or launches a digital platform (technology and cyber risk), the risk appetite should guide: minimum control investment required, acceptable timeline for risk reduction, and whether the strategy should be modified if OpRisk would be excessive. Risk appetite is not set to be zero — some operational risk is acceptable in pursuit of commercial objectives. A is a risk register. C is a regulatory limit. D is the loss distribution.
Question 152
What is 'key control indicator' (KCI) and how does it relate to KRIs?
Select an option first.
Correct answer: B — A metric that measures the performance and effectiveness of a specific control — while KRIs measure the level of risk exposure, KCIs measure whether controls are functioning properly. Example: reconciliation completion rate (KCI) measures whether a detective control is operating; the number of unreconciled items (KRI) measures the risk level. Both together give a comprehensive picture of risk and control health
Explanation: B is correct. KCI vs KRI: KCI = how well is the control performing? (e.g., % of transactions with dual authorisation completed correctly). KRI = what is the level of risk exposure? (e.g., transaction error rate). A high KRI with a low KCI (many errors AND the control isn't catching them) is the most dangerous combination — high exposure with weak detection. Together they enable early warning: KCI degradation predicts future KRI deterioration. A describes an output metric. C conflates them. D is a regulatory metric.
Question 153
What is 'risk quantification' in operational risk and what are the approaches?
Select an option first.
Correct answer: B — The process of expressing operational risk in financial terms to support decision-making and capital allocation — approaches: (1) Statistical (LDA — frequency × severity distributions); (2) Scenario-based (expert judgement on probability and impact); (3) Risk indicator-based (translate KRI levels into risk estimates); (4) Actuarial (for insurance-like risks). No single approach works for all risk types; different approaches are combined
Explanation: B is correct. Risk quantification methods: LDA: good for high-frequency/lower-severity risks with data (e.g., payment processing errors). Scenario: good for low-frequency/high-severity risks (e.g., major fraud, cyber attack — not in the historical data). Indicator-based: translates KRI degradation into estimated loss ranges. Actuarial: good for insurance-type risks (credit card fraud). Combining methods: the capital model often uses LDA for the body and scenarios for the tail. A is event counting. C is a qualitative register count. D is the Basel formula.
Question 154
What is 'sensitivity analysis' in the context of operational risk capital modelling?
Select an option first.
Correct answer: B — Testing how the capital estimate changes when specific model inputs or assumptions are varied — examples: how does 99.9th percentile capital change if the GPD shape parameter increases by 10%? If the Poisson frequency parameter doubles? If external data scaling changes? This reveals model uncertainty and helps management understand which assumptions drive the capital
Explanation: B is correct. Sensitivity analysis in LDA: operational risk capital is notoriously sensitive to model parameters — a small change in the GPD tail parameter (ξ) can change capital by 50%+. Parameter uncertainty should be communicated to management. Sensitivity analysis: run the model with parameter values across a plausible range; report the resulting capital range (e.g., capital could be €50M-€150M depending on tail parameter). This prevents false precision and informs capital buffer decisions. A is a BI-sensitivity test. C and D are risk management, not capital modelling.
Question 155
What is 'parameter uncertainty' in operational risk modelling and how is it addressed?
Select an option first.
Correct answer: B — The imprecision in the estimated parameters of the severity and frequency distributions, arising from limited data — for heavy-tailed distributions, parameter estimates from small samples are highly imprecise. Addressed through: Bayesian estimation (incorporating prior information), bootstrapping (resampling to assess parameter variability), reporting confidence intervals for capital estimates, and using conservative assumptions where data is limited
Explanation: B is correct. Parameter uncertainty: with 50 data points above the GPD threshold, the 95% confidence interval for the shape parameter ξ might be (0.4, 0.9) — implying capital between €80M and €400M. This range should be communicated to management and boards. Bayesian methods: incorporate prior knowledge (e.g., from industry data) to stabilise parameter estimates with limited data. Bootstrapping: repeatedly resample the observed data to generate a distribution of parameter estimates. A is model selection. C is regulatory uncertainty. D is different.
Get the full FRM question bank — free
Drop your email and we'll send you fresh FRM practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 156
What is 'model governance' in operational risk and what does it require?
Select an option first.
Correct answer: B — The policies, processes, and controls overseeing the development, validation, approval, use, and monitoring of operational risk quantitative models — requires: a model inventory, model risk rating (materialityassessment), independent model validation, model approval process (senior management or model risk committee), ongoing performance monitoring, and documentation standards
Explanation: B is correct. Model governance (Fed SR 11-7, EBA on Internal Models): model lifecycle — development → validation → approval → use → monitoring → change management → retirement. For OpRisk LDA models: (1) Model inventory: all models documented with purpose, inputs, outputs, limitations; (2) Independent validation: separate team reviews conceptual soundness, testing, data quality; (3) Approval: model risk committee approves before use in capital; (4) Monitoring: regular backtesting and performance reporting. A is organisational governance. C: vendors are one source; internal development is common. D: Basel specifies approaches, not exact models.
Question 157
What is 'model validation' for an operational risk LDA model and what does it examine?
Select an option first.
Correct answer: B — An independent review of the LDA model evaluating: (1) Conceptual soundness (are the distributional assumptions defensible?); (2) Data quality (is the loss database complete, accurate, and representative?); (3) Parameter estimation (is MLE correctly applied? truncation handled?); (4) Tail behaviour (does the fitted distribution produce plausible tail values?); (5) Backtesting (do model predictions align with actual loss experience over time?); (6) Sensitivity analysis (how stable are outputs to input changes?)
Explanation: B is correct. LDA model validation: covers the full model — data, statistical methods, software implementation, and appropriateness for use. Key validation tests: density plot (does the fitted distribution match the empirical histogram?), QQ-plot (tail fit?), K-S/Anderson-Darling tests (overall fit), PP-plot, and sensitivity to assumptions. The validator must have adequate independence from the model development team. A is market model validation. C is model maintenance. D is supervisory model review.
Question 158
What is 'backtesting' in the context of operational risk models and what challenge does it present?
Select an option first.
Correct answer: B — Comparing the model's predicted loss distribution against actual loss experience over time — the fundamental challenge: the model is calibrated to the 99.9th percentile (a 1-in-1000-year event), but a typical bank only has 5-10 years of data. You can never directly observe whether the tail estimate is correct. Backtesting is therefore limited to testing frequency predictions and the body/moderate tail of the distribution
Explanation: B is correct. Backtesting challenge for OpRisk: unlike VaR backtesting for market risk (250 trading days per year allows reasonable frequency of testing), the 99.9th percentile OpRisk capital is estimated to be exceeded once in 1000 years. A bank would need 1000 years of data to directly test this. Alternative approaches: test frequency distribution against actual event counts (tractable), test moderate quantiles (95th, 99th) where more data exists, and use predictive distribution testing (probability integral transform methods). A is only part of backtesting. C is wrong — direct 99.9th percentile testing is impossible.
Question 159
What is a 'scoreboard approach' in qualitative operational risk assessment?
Select an option first.
Correct answer: B — An operational risk assessment method that uses scores assigned to various risk indicators (control quality, RCSA scores, KRI levels, audit findings, management quality) to produce an overall risk score for a business unit or risk category — used as a complement to quantitative modelling where data is insufficient
Explanation: B is correct. Scoreboard approach: particularly useful for OpRisk categories where quantitative data is sparse (e.g., strategic alignment risk, management quality). The scorecard aggregates qualitative assessments into a numeric score that can be used to: allocate risk capital, identify poorly controlled areas, and track risk trends over time. Challenges: subjectivity in scoring, gaming (business units give themselves high scores), and lack of direct linkage to financial loss. Used alongside quantitative models. A is an HR concept. C is benchmarking. D is supervisory scoring.
Question 160
What is a 'causal model' in operational risk and how does it differ from statistical modelling?
Select an option first.
Correct answer: B — A model that explicitly incorporates the causal mechanisms generating operational losses — using causal chains (risk driver → control → loss event → financial impact). Unlike statistical LDA models (which fit distributions to historical data), causal models link loss outcomes to specific drivers and controls, enabling 'what-if' analysis (e.g., 'if we improve this control, how does capital change?')
Explanation: B is correct. Causal modelling (Bayesian networks are a common implementation): nodes represent risk drivers (transaction volume), controls (error detection rate), and outcomes (financial loss). The network captures conditional probabilities between nodes. Advantages over LDA: forward-looking (not just historical), explicitly incorporates control effectiveness, and enables scenario analysis. Challenges: complex to build, requires expert elicitation for probabilities, and may not capture all dependencies. A is a market risk concept. C is regression modelling. D is macroeconomic modelling.
Question 161
What is 'Bayesian network' in operational risk modelling?
Select an option first.
Correct answer: B — A probabilistic graphical model representing conditional dependencies between risk factors (causes), controls, and loss outcomes as a directed acyclic graph — each node has a probability distribution, and the network can propagate the effect of changes in driver variables (e.g., transaction volume, control quality) through to estimated loss distributions. Allows forward-looking risk quantification incorporating expert judgment
Explanation: B is correct. Bayesian network: structured representation of causal relationships. Example: Transaction Volume → Error Rate (conditional on control quality) → Loss per Error → Aggregate Loss. Updating the network: if transaction volume increases by 20%, the model propagates this to estimate the new loss distribution. Limitation: requires significant expert input to define the network structure and conditional probabilities. Strong when data is scarce (common in OpRisk). A is a loss distribution. C is an ML technique. D is a copula (aggregation model).
Question 162
What is 'operational resilience testing' and what types of tests are conducted?
Select an option first.
Correct answer: B — Structured exercises to verify that an organisation can maintain important business services within impact tolerances under severe disruptions — types: (1) Tabletop exercises (discussion-based — teams walk through a scenario without activating recovery systems); (2) Simulation exercises (partial activation of recovery procedures); (3) Live tests (full activation of alternate systems/locations); (4) Threat-led penetration testing (TLPT) for cyber resilience
Explanation: B is correct. Resilience testing (FCA/PRA, DORA): testing must be proportionate to the importance of the business service and the severity of the assumed disruption. Tabletop: cheapest, good for validating plans and identifying gaps. Simulation: more realistic, tests technology and people in a controlled way. Live: most realistic, highest cost and risk. TLPT (DORA): intelligence-led cyber test by certified external testers — the most sophisticated test, required for systemically important entities. A is regulatory capital stress testing. C is control testing. D is supervisory inspection.
Question 163
What is a 'post-incident review' (PIR) or 'lessons learned' process after an operational risk event?
Select an option first.
Correct answer: B — A structured analysis conducted after an operational risk event (or near miss) to: identify root causes, assess the adequacy of the response, identify control failures and process weaknesses, and develop specific action plans to prevent recurrence — part of a continuous improvement cycle
Explanation: B is correct. PIR/lessons learned: 5 Whys technique — ask 'why?' five times to get beyond symptoms to root causes. Root Cause Analysis (RCA): identify the fundamental failure (not just the immediate cause). Output: specific actions (control improvements, process changes, training needs) with clear ownership and timelines. Culture: PIRs should be conducted in a blame-free, learning-oriented way — otherwise people hide information. PIR reports should be shared across the organisation to prevent similar events elsewhere. A is regulatory investigation. C is remediation/restitution. D: PIRs should be shared broadly, not just with the board.
Question 164
What is 'root cause analysis' (RCA) in operational risk management?
Select an option first.
Correct answer: B — A systematic process for identifying the fundamental underlying cause of an operational risk event, rather than treating only the symptoms — methods include: the '5 Whys' (repeatedly asking why until the root cause is identified), fishbone/Ishikawa diagrams (mapping potential causes by category: people, process, technology, environment), and fault tree analysis (logical diagrams of failure modes)
Explanation: B is correct. RCA techniques: 5 Whys — 'The payment was sent to the wrong account' → Why? 'The account number was input incorrectly' → Why? 'There is no validation check on account numbers' → Why? 'The system was never designed with validation' → Root cause: inadequate system design. Fishbone: visualises multiple contributing causes across people, process, technology, environment, management, and measurement categories. Fault tree: logical 'AND'/'OR' gates showing how combinations of failures lead to the event. A is a timeline, not RCA. C is regulatory analysis. D is statistical modelling.
Question 165
What is 'risk culture assessment' and what methodologies do supervisors use?
Select an option first.
Correct answer: B — A supervisor-led evaluation of the attitudes, values, and behaviours toward risk across all levels of a financial organisation — supervisory methodologies: structured interviews with staff at multiple levels (testing consistency between stated values and actual behaviour), behavioural observation during board and senior management meetings, analysis of escalation and whistleblowing data, review of incentive structures, and review of how risk concerns are treated when raised
Explanation: B is correct. Supervisory culture assessments (FSB Guidance 2014, PRA/FCA supervisory reviews): regulators recognise that 'paper' risk culture (written policies) can differ from lived culture (actual behaviour). Indicators of weak culture: low near-miss reporting rates (people afraid to report), inconsistency between what management says and what is rewarded, recent major incidents with cultural dimensions, and high staff turnover in risk and compliance. A is an employee survey (one input, not the full methodology). C is a quantitative metric. D is policy review (necessary but insufficient).
Question 166
What is 'Solvency II' operational risk capital requirement for insurance companies?
Select an option first.
Correct answer: B — The Solvency Capital Requirement (SCR) for operational risk under Solvency II is calculated using either a standard formula (equal to the higher of: 3% × net earned premiums, or 0.3% × net technical provisions, subject to a cap of 30% of total net SCR) or an internal model — reflecting the unique operational risks of insurance (claims processing, policy administration, investment operations)
Explanation: B is correct. Solvency II (EU Directive 2009/138/EC): standard formula operational SCR uses premium/provision-based proxies rather than the banking BI-based approach. The maximum is 30% of total Basic SCR — preventing operational risk from dominating capital. Internal models: insurers can apply for regulatory approval of their own OpRisk capital model. Differences from Basel: insurance OpRisk is driven by claims-related errors, product mis-pricing, and policyholder service failures. A uses premiums as a proxy but the formula is different. C: different from the banking approach. D: explicit operational SCR exists.
Question 167
What is the difference between 'gross loss' and 'net loss' in operational risk measurement?
Select an option first.
Correct answer: B — Gross loss is the total financial impact of an operational event before any recovery — net loss is the actual financial impact after recoveries (insurance payouts, legal recoveries, reversal of erroneous transactions). The regulatory loss database under Basel IV must capture gross loss amounts, but net losses represent the actual economic impact
Explanation: B is correct. Gross vs net: a payment error causing $5M gross loss may be recovered $4M through insurance → $1M net loss. Under Basel: the capital model uses gross losses (to ensure capital covers the full potential impact regardless of recovery). Insurance recovery appears as a separate line — regulators can assess recovery rates. Net losses are more relevant for P&L reporting and management information. A: tax is separate (pre-tax vs post-tax). C and D are not standard definitions.
Question 168
What is 'incident management' and how should large operational failures be escalated?
Select an option first.
Correct answer: B — A structured process for detecting, classifying, containing, and resolving operational incidents — escalation should be: rapid (major incidents immediately to senior management and CRO), proportionate (minor incidents handled by business, major ones involve executive and board), multi-functional (IT, risk, legal, communications, compliance all involved for significant events), and documented (incident log for each event with timeline, decisions, and actions)
Explanation: B is correct. Incident management framework: detection (monitoring systems, staff reports, customer complaints) → classification (minor, significant, major, critical — based on financial impact, customer harm, regulatory implications, reputational risk) → escalation (proportional to severity) → response (containment, eradication) → communication (regulators, customers, press if material) → recovery → review. Major cyber or fraud incidents: immediate CRO, CEO, and board notification. DORA: ICT-related major incidents must be reported to regulators within 4 hours of classification. A is a financial calculation. C is too narrow. D is a regulatory reporting process.
Question 169
What is 'operational risk reporting' to the board and what information should be included?
Select an option first.
Correct answer: B — Regular, structured communication to the board and senior management covering: current risk profile vs risk appetite, major loss events and root causes, KRI trends (deteriorating indicators), RCSA update (changes in residual risk assessments), capital model results and changes, regulatory and audit findings, emerging risks, and management actions. The board needs to understand the firm's operational risk position to provide effective oversight
Explanation: B is correct. Board OpRisk reporting: key principles — materiality (report what matters, not everything), timeliness (regular cadence plus ad-hoc for emerging issues), clarity (accessible to non-technical board members), actionability (what decisions are needed?), and forward-looking (emerging risks, trend indicators). BCBS 239: risk reports must be accurate, comprehensive, clear, useful, timely, and adaptable. A is financial reporting. C is operational KRI reporting. D is overly technical for board level.
Question 170
What is 'process mapping' and how is it used in operational risk identification?
Select an option first.
Correct answer: B — A systematic documentation of the steps in a business process, identifying the inputs, outputs, decision points, systems involved, and personnel — used in operational risk management to: identify where errors or failures could occur at each step, link risk events to specific process steps, design targeted controls, and support BCP planning by identifying critical process dependencies
Explanation: B is correct. Process mapping for OpRisk: by mapping each step of a process (e.g., trade execution → confirmation → settlement → reconciliation → accounting), the risk team can identify: Where are the manual steps? (human error risk). Where are the system interfaces? (technology failure risk). What data inputs come from external sources? (dependency risk). This provides a structured basis for RCSA and control design. A is geographic mapping. C is IT documentation. D: process mapping is also used for risk identification, not just efficiency.
Question 171
What is the 'Operational Riskdata eXchange Association' (ORX) and what does it provide?
Select an option first.
Correct answer: B — An industry consortium of major financial institutions that pools anonymised operational loss data — providing members with: access to a global database of operational loss events (over 600,000 loss events totalling €400B+), benchmarking of own loss profiles against peers, and research reports on industry loss trends. Used by banks to supplement their internal data for LDA tail modelling
Explanation: B is correct. ORX (Operational Riskdata eXchange): the leading industry consortium for operational loss data sharing. Members: major global banks (currently 100+ members across 30+ countries). Data sharing: members submit anonymised loss data above specified thresholds; receive pooled data and benchmarks in return. Key benefit for capital models: ORX data provides external data for tail modelling (the rare, large events not in any single bank's history). A is a standard-setting body. C is a technology vendor. D is a consultancy.
Question 172
What is 'key risk indicator' (KRI) design best practice and what makes a good KRI?
Select an option first.
Correct answer: B — A good KRI is: leading (predicts future risk before losses occur), measurable (can be tracked objectively over time), relevant (directly linked to a specific material operational risk), threshold-driven (has clear green/amber/red thresholds that trigger management action), actionable (when the KRI deteriorates, there is a clear remedial response), and economical (cost of measurement is proportional to the insight gained)
Explanation: B is correct. KRI best practice: leading vs lagging — some 'KRIs' are actually lagging indicators (reporting past losses after they occur). True KRIs are leading. Example: staff turnover rate (leading KRI for internal fraud/process risk) vs number of fraud incidents (lagging KRI — already occurred). Threshold setting: green (normal), amber (elevated — management attention), red (action required). Number of KRIs: focused set (10-20 per business unit) rather than hundreds — 'KRI fatigue' reduces their usefulness. A is too narrow. C creates an unmanageable number. D: KRIs should be tailored to specific risks.
Question 173
What is the 'FATF' (Financial Action Task Force) and what does it produce?
Select an option first.
Correct answer: B — An intergovernmental body that sets international standards to combat money laundering, terrorist financing, and proliferation financing — produces: the FATF Recommendations (40 Recommendations: the global AML/CFT/CPF standards), grey lists and blacklists (countries with strategic deficiencies), and mutual evaluation reports (assessments of country compliance). Adopted by 200+ jurisdictions
Explanation: B is correct. FATF: the global standard-setter for AML/CFT. FATF Recommendations: R1-R2 (risk assessment), R3-R11 (policies and coordination), R9-R23 (financial institution measures including CDD), R36-R40 (international cooperation). Grey list: countries requiring enhanced monitoring (applies pressure to improve). Blacklist (FATF high-risk jurisdictions): countries calling for countermeasures. Banks must comply with FATF standards, which are transposed into national law (EU AML Directives, Bank Secrecy Act). A is the Basel Committee. B has the answer. C is FATF research. D is the BIS/central bank coordination.
Question 174
What is 'transaction monitoring' in the context of AML compliance and how does it work?
Select an option first.
Correct answer: B — Automated screening of customer transactions against defined rules and statistical models to identify potentially suspicious activity — rules-based systems flag: large cash transactions (above reporting thresholds), rapid movement of funds through accounts (layering), unusual transaction patterns (inconsistent with customer profile), transactions to high-risk jurisdictions, and structuring (just below reporting threshold)
Explanation: B is correct. Transaction monitoring: the bank sets rules (e.g., 'flag any cash deposit > £10,000 or any wire transfer to Iran'). Suspicious transactions generate an alert, which is reviewed by AML analysts. If suspicious: escalate to MLRO for SAR decision. Challenge: high false positive rates (many alerts are legitimate transactions) — banks spend enormous resources on alert review. Advanced analytics: machine learning models can reduce false positives by better distinguishing genuine from suspicious patterns. A: manual review at scale is impossible. C is trade execution analysis. D is customer service.
Question 175
What is 'beneficial ownership' in the context of KYC and why is it important?
Select an option first.
Correct answer: B — The identification of the natural person(s) who ultimately own or control a legal entity (company, trust, foundation) — a person who directly or indirectly owns more than 25% of a company's shares is typically a beneficial owner (EU 5th AML Directive threshold). Important because: shell companies, trusts, and complex ownership structures can conceal the true ownership of funds, facilitating money laundering and sanctions evasion
Explanation: B is correct. Beneficial owner vs legal owner: a company may be owned by another company, which is owned by a trust, which is held by a foundation. The 'legal' owner is the entity on the share register; the 'beneficial' owner is the person who ultimately benefits. Banks must identify and verify beneficial owners as part of EDD for legal entities. Registers of beneficial ownership: EU requires member states to maintain central registers. UK Companies House: beneficial ownership register (PSC — Person with Significant Control). A is the named account holder. C and D are too narrow.
Question 176
What is a 'politically exposed person' (PEP) and what enhanced due diligence does this require?
Select an option first.
Correct answer: B — An individual who holds or has recently held a prominent public function — heads of state, government ministers, senior politicians, senior judiciary, senior military officers, senior state-owned enterprise executives. PEPs pose higher money laundering risk due to potential for bribery and corruption. Enhanced Due Diligence (EDD) required: approval of senior management to establish relationship, establish source of wealth and funds, conduct enhanced ongoing monitoring
Explanation: B is correct. PEP classifications: domestic PEPs (holders of prominent domestic public positions), foreign PEPs (foreign nationals), and PEPs at international organisations. EDD for PEPs: understand the nature and purpose of the relationship, obtain senior management approval, verify source of wealth (where did their money come from?) and source of funds (what funded this specific transaction?). A: political activity alone doesn't make someone a PEP. C is not a standard definition. D: domestic PEPs are also covered.
Question 177
What is 'sanctions compliance' and what are the main sanctions programmes?
Select an option first.
Correct answer: B — Legal and regulatory requirements prohibiting transactions with sanctioned individuals, entities, and jurisdictions — main programmes: OFAC (US Office of Foreign Assets Control: SDN list), OFSI (UK Office of Financial Sanctions Implementation), EU Consolidated Financial Sanctions List, UN Security Council sanctions. Banks must screen all customers, counterparties, and transactions against these lists — violations result in massive fines ($14B BNP Paribas fine, 2014)
Explanation: B is correct. Sanctions screening: real-time screening of transactions and periodic rescreening of customers against updated sanctions lists. Challenges: name matching (same name as sanctioned individual — false positives), beneficial ownership (sanctioned person owns a company — concealed ownership), and rapidly changing lists (Russia sanctions 2022 required immediate updates). Banks must have processes to: block prohibited transactions, escalate for review, and report to authorities. A is voluntary (incorrect — mandatory). C and D are not sanctions concepts.
Question 178
What is 'de-risking' in the AML context and why is it a concern?
Select an option first.
Correct answer: B — The practice of financial institutions refusing to provide services to entire categories of customers, regions, or businesses (e.g., money services businesses, correspondent banks in high-risk jurisdictions, charities in conflict regions) to avoid AML compliance costs and regulatory risk — a concern because it excludes legitimate customers from financial services and pushes activity into less regulated channels
Explanation: B is correct. De-risking: emerged post-2008 as regulatory fines for AML failures increased dramatically. Banks exited entire markets (e.g., correspondent banking in Caribbean, Africa) rather than managing the risk. FATF, FSB, and IMF have criticised de-risking as: harming financial inclusion, reducing economic development in affected regions, and potentially undermining anti-money laundering effectiveness (activity moves to unregulated channels). Regulators clarify: the goal is risk management, not de-risking. A is portfolio management. C is capital management. D is a regulatory penalty.
Question 179
What is 'correspondent banking' and what AML risks does it present?
Select an option first.
Correct answer: B — A relationship where one bank (correspondent) provides services on behalf of another bank (respondent) — typically involving: clearing and settlement of international payments, foreign currency transactions, and trade finance. AML risk: the correspondent bank processes transactions for the respondent bank's customers, whom it has not directly KYC'd — creating the risk of unknowingly processing transactions for money launderers or sanctioned parties
Explanation: B is correct. Correspondent banking risk: the correspondent has limited visibility into who the ultimate beneficial senders and recipients are — it relies on the respondent bank's KYC. Correspondent bank AML obligations: conduct due diligence on the respondent bank (not just the transactions), assess the respondent's AML programme quality, avoid processing transactions from jurisdictions or relationships with inadequate controls. FATF R13: special due diligence requirements for correspondent banking. A is retail banking. C is private banking. D is credit facility.
Question 180
What is 'regulatory risk' for financial institutions and how is it different from compliance risk?
Select an option first.
Correct answer: B — The risk that regulatory changes (new laws, regulatory interpretations, supervisory expectations) will require costly operational changes, restrict business activities, or impose unexpected compliance costs. Compliance risk: the risk of violating existing regulations. Regulatory risk: the risk that the regulatory environment itself changes. Example: GDPR (2018) created massive operational change costs for all financial institutions handling EU personal data
Explanation: B is correct. Regulatory risk vs compliance risk: Compliance: failing to follow existing rules. Regulatory: the rules themselves change. Sources of regulatory risk: new legislation (GDPR, DORA, Consumer Duty), new supervisory guidance (EBA guidelines), court rulings changing interpretation of existing laws, and changes in supervisory priorities. Management: regulatory change tracking (monitoring legislative pipelines), impact assessments (how would proposed changes affect the bank), and proactive regulatory engagement. A is compliance risk. C conflates them. D: applies globally.
More free FRM topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.