ACAMS CCAS - Certified Cryptoasset Anti-Financial Crime Specialist Examination

Proof of Work (PoW) consensus achieves network consensus by requiring participants (miners) to solve complex cryptographic puzzles, which verifies transactions and secures the blockchain. This computational work makes it difficult and costly to alter the blockchain.

Dependency on electricity (A) is a criticism rather than an advantage. PoW promotes decentralization rather than centralization (B). It provides strong security for large networks rather than small ones (D).

This principle is fundamental in Bitcoin and many other cryptocurrencies and is frequently referenced in AML/CFT guidance to understand the transaction validation process and network security.

The primary purpose of a security audit for smart contracts is to protect investors’ funds by identifying vulnerabilities, coding errors, and weaknesses in the smart contract or underlying protocol that could be exploited. This proactive approach helps prevent hacks, exploits, and financial loss.

While performance issues (B) may be noted, the critical concern is security. Identifying bad actors (C) is not within the scope of a code audit but is a broader operational issue. Copyright concerns (A) are unrelated.

AML and crypto governance frameworks underline the importance of security audits to mitigate operational risks in DeFi and other smart contract-based applications.

FATF Recommendation 15 requires countries to regulate VASPs for AML/CFT purposes, applying the same preventive measures as financial institutions.

Standard due diligence typically involves reviewing negative news and verifying beneficial ownership to understand the customer’s background and potential risk factors.

Dark web forums (B) and blockchain exposure (D) are more advanced or enhanced due diligence techniques, used when higher risk is identified.

The risks posed by different payment methods fall under the products and services risk category because payment methods are specific services and products offered by financial institutions or businesses. This category assesses inherent risks linked to how products are designed and used.

Geographical (A) relates to location risks; customers (B) relates to the nature of customers; new technologies (C) covers emerging tools but payment methods are classified under products/services.

Code uniqueness is critical because reuse or replication of vulnerable code exposes protocols to known exploits. Unique, well-audited, and secure code minimizes compromise risk in decentralized finance (DeFi) and smart contracts.

Security standards (A), authentication (B), and regulation (C) are important but secondary to the fundamental security of the code itself.

Hash immutability means that altering any transaction would require changing all subsequent blocks and achieving majority consensus. This security property underpins blockchain integrity and forensic traceability, crucial in AML investigations.

An effective AML CDD program must include:

Staff training on gathering CDD (A)

Maintaining complete information to support risk profiling (B)

Procedures to address situations where the customer's true identity is unclear or questionable (F)

Annual client reviews (D) and IP address monitoring (E) may be part of broader AML controls but are not fundamental CDD requirements. Maintaining a list of high-risk virtual assets (C) is important but relates more to product risk management than direct CDD.

Indirect exposure occurs when funds pass through one or more intermediary wallets before reaching a known illicit destination. This requires enhanced monitoring to capture risks that are not directly linked but are part of the transaction chain.

Sanctions breaches require immediate reporting to competent authorities and freezing of assets where legally mandated.