CCAS Exam Questions & Answers

Model risk management is the discipline focused on managing risks arising from the use of models, including those based on algorithms, machine learning, and AI in transaction monitoring and screening software.

DFSA and global AML frameworks highlight the need for strong model risk governance to ensure accurate detection and compliance.

Effective risk mitigation requires VASPs to obtain sufficient information about counterpart VASPs to assess the quality of their regulatory supervision and controls. This helps determine the risk of transactions and build a risk-based framework for correspondent relationships.

Having no requirements (A) or engaging with poorly regulated jurisdictions (B) increases risk. Blanket high-risk classification (C) without proper assessment is inefficient.

FATF Recommendation 15 and DFSA guidance emphasize due diligence on counterparties as a critical control.

The primary purpose of a security audit for smart contracts is to protect investors' funds by identifying vulnerabilities, coding errors, and weaknesses in the smart contract or underlying protocol that could be exploited. This proactive approach helps prevent hacks, exploits, and financial loss.

While performance issues (B) may be noted, the critical concern is security. Identifying bad actors (C) is not within the scope of a code audit but is a broader operational issue. Copyright concerns (A) are unrelated.

AML and crypto governance frameworks underline the importance of security audits to mitigate operational risks in DeFi and other smart contract-based applications.

Sanctions breaches require immediate reporting to competent authorities and freezing of assets where legally mandated.

The FinCEN 2019 guidance clarifies that money transmitters include entities that exchange digital tokens or convertible virtual currencies as part of their business activities. This includes exchanges and platforms that transfer virtual currencies.

Providing infrastructure services (B), operating clearance systems solely among regulated institutions (C), or acting as payment processors for goods/services (D) without handling value transfer do not fall under the money transmitter definition per this guidance.