Securities, Capital Markets and Asset Management Financial Crime

Securities and asset-management activity can move value through trading accounts, custody, funds, intermediaries and settlement systems. Financial-crime risk concerns who owns or controls assets, where funding comes from, why transactions occur and how value ultimately leaves. A regulated exchange or custodian does not make every transaction legitimate.

Trading, settlement and custody are different functions. An order can be executed before final settlement, and a portfolio transfer can move assets without a sale. Investment subscriptions and redemptions involve another lifecycle. A bank's monitoring model must understand these distinctions rather than treating every movement as an ordinary deposit payment.

Money laundering and market abuse can overlap but have different analytical and reporting frameworks. Wash-like trading, matched transfers, unexplained losses or off-market prices can indicate concerns, but do not automatically prove manipulation or laundering. Market-abuse surveillance and AML investigations should share relevant facts lawfully while making their own applicable reporting decisions.

The FATF securities-sector guidance supports risk-based controls; national law defines binding duties. In the US, FinCEN postponed the investment-adviser AML rule's effective date to 1 January 2028. As at 2 October 2026, do not present that delayed rule as already imposing its new duties on all advisers. Other currently applicable obligations and banks' own CDD duties remain separate.

Establish the activity and the institution's role

A bank can participate in securities activity as account provider, custodian, settlement bank, broker, fund distributor, investment manager, trustee or lender. Those roles can sit in different legal entities within a group. Identify which entity contracts with the customer, which holds assets, which receives money, which accepts orders and which executes settlement. A group brand is not a substitute for this legal and operational map.

Consider fictional investor Lumen Holdings. Lumen maintains a custody account at North Bank, receives investment advice from an external manager and subscribes to a fund administered elsewhere. A cash transfer to North Bank, a security received into custody and a redemption instruction from the fund represent different events. The bank's controls should understand the relevant party roles and value movement for each event rather than labelling them all “investment activity.”

Customer identity and ownership should be established for the actual relationship. An individual investor, corporate account, fund, trustee, intermediary and omnibus account can require different analysis under applicable rules. Do not assume that every underlying investor is automatically the direct customer of every institution in the chain. Equally, absence of a direct customer relationship does not make visible suspicious underlying activity irrelevant.

The US SEC's source tools provide jurisdiction-specific materials for broker-dealers and mutual funds. They should be used to identify applicable rules for those institutions rather than applying one regime to every bank, adviser and fund worldwide. FinCEN's delayed investment-adviser rule is a separate example of why institution type and effective date matter. A future obligation does not replace existing duties applicable to another regulated role.

The FATF securities guidance was published in 2018. Its current landing page explicitly cautions that it does not incorporate subsequent standards revisions, including the 2025 risk-based-approach changes. Read it alongside current Recommendations and newer relevant material. Historical product examples can remain useful without presenting the document as a complete current legal code.

Follow cash, securities and contractual exposure

Cash is only one way value moves. A customer can deposit securities, transfer holdings to another custodian, lend assets, pledge collateral, subscribe using an in-kind contribution where permitted, or receive securities through a corporate action. Some events have no simultaneous cash payment. A monitoring feed limited to cash entries can therefore miss material movement of value or ownership.

An order, execution, booking and settlement are separate states. An order may be cancelled, partially filled or rejected. An execution creates an agreed trade, while settlement delivers the relevant cash and assets under the market arrangement. A customer-facing confirmation and a message acknowledgement describe particular states; neither should be assumed to establish final settlement without the relevant evidence.

Delivery-versus-payment and free-of-payment transfers have different mechanics. DvP connects delivery with payment under the applicable settlement arrangement. FoP moves securities without a simultaneous cash leg in that system. FoP is not inherently illicit: a portfolio migration or a legitimate gift can explain it. The bank still needs the ownership, authority and economic context relevant to its service and risk.

Corporate actions can create or change holdings without an ordinary buy order. A stock split changes quantity and price presentation; a dividend creates income; a merger or conversion can replace an instrument; rights or other events may create entitlements. Monitoring needs the relevant event type and instrument history so legitimate mechanics are not mistaken for unexplained customer trading.

Derivatives and financing add contractual exposures, margin and collateral. The value of an instrument is not always the same as its notional amount, cash settlement or collateral posted. Product specialists should explain the measures needed for a scenario. A large notional figure should not be recorded as a cash movement when no such movement occurred.

Connect economic purpose to the value path

Understand the customer's investment purpose, funding, strategy and expected use of services. A long-term diversified investor, an active trader, an institutional treasury and a fund intermediary can have very different activity. The profile need not predict every order, but should provide enough context to identify unexplained funding, ownership changes or payouts.

For Lumen, the bank expects a diversified portfolio funded by documented company investment proceeds. If Lumen suddenly receives a concentrated block of unfamiliar low-priced securities, sells them quickly and sends proceeds to an unrelated company, several questions arise. How did Lumen acquire the assets? Who beneficially owns them? Why is the sale and payout consistent with the relationship? Are there separate market-conduct concerns? Each question needs evidence rather than an automatic allegation.

A sale realises value but does not cleanse the origin of the asset. Exchange execution shows a trade occurred through a particular market mechanism; it does not establish that the customer lawfully acquired the securities or that a payout recipient is entitled to the proceeds. A regulated custodian or fund administrator can provide useful evidence, but its presence does not make every downstream transaction legitimate.

Losses require context too. A customer may accept an economic loss for liquidity, portfolio rebalancing or a changed investment view. Repeated transactions transferring value through implausible prices or linked parties can warrant inquiry. The analyst should examine instrument liquidity, valuation, execution and counterparty relationships before concluding that an apparent loss is unusual or intentional value transfer.

AML, market abuse and fraud can share facts

AML analysis concerns relevant source, ownership, purpose and movement of value and applies the applicable suspicious-activity framework. Market-abuse surveillance assesses trading conduct under its own rules. Fraud teams assess deception, unauthorised instructions and victim harm. The same event can matter to more than one team, but a shared alert does not make the legal tests identical.

For example, matched orders between linked accounts may raise a market-surveillance concern. If the pattern also transfers value without a plausible purpose, AML may need to examine funding and ownership. A compromised account used to sell assets and redirect proceeds raises fraud concerns and can create additional financial-crime questions. Preserve the facts and route them to the appropriate owners.

Do not require a confirmed market-abuse finding before assessing AML suspicion when the relevant facts are already present. Conversely, do not file a market-abuse report solely because an AML analyst cannot explain an unrelated cash deposit. Each team should document its own threshold, decision and channel, coordinating lawfully with the others.

Information-sharing boundaries remain relevant. Underlying trade facts can often be useful across teams, while protected reporting information may require restricted handling. A common case record should separate ordinary facts, specialist assessments and confidential report records. The bank should not disclose report existence or contents to a customer in an explanation of a trading restriction.

Intermediaries and omnibus services

An omnibus account can aggregate assets or activity for underlying clients. The account name identifies the intermediary, not necessarily every person receiving economic benefit. Establish what underlying information is available, which party performs customer measures, whether reliance is permitted and how targeted inquiries are answered. An intermediary's regulated status does not answer all these questions.

The SEC's statement on omnibus accounts transacting in low-priced securities illustrates a US-specific boundary: relevant due diligence and reporting can remain applicable even where an underlying person is not the broker-dealer's customer for particular identification rules. This example should prompt precise legal mapping, not a universal demand that every custodian obtain all underlying-client files.

Operational visibility matters. If transactions are aggregated or netted before reaching monitoring, identify what detail remains accessible. A daily net cash movement may conceal large gross subscriptions, redemptions or transfers among underlying parties. The bank should understand the information loss and decide whether the service's control model is adequate.

Where information is missing, assess the material question and the appropriate restriction or inquiry. Missing data can be an operational defect, a legitimate limitation of the service or a control gap requiring change. The bank should not silently interpret an unknown beneficial owner as a verified clean owner, nor equate every data limitation with proven misconduct.

The rest of this chapter develops product-aware controls from onboarding through trading, custody, settlement and payout. The operating cases and numerical examples are fictional. Specific duties, thresholds and report channels must be mapped to the legal entity and jurisdiction before implementation.

Following value across the investment lifecycle

Identify the contracting customer, beneficial owners, intermediaries, fund or security, custodian and settlement accounts. Establish whether an account is omnibus and what information is available about underlying investors. Permitted reliance and intermediary arrangements need their own legal and evidence assessment.

At subscription or funding, understand the payer, account ownership and economic source. During trading, analyse whether transactions fit the strategy and customer profile. At redemption or asset transfer, examine who receives value, whether instructions changed and whether the exit path is consistent with the original arrangement. A clean initial subscription does not explain a later third-party payout.

Monitoring requires product context: quantities, prices, currencies, instruments, settlement dates, corporate actions and transfer type. Apparent volume spikes may reflect a stock split or portfolio migration; unexplained repeated trades producing losses may require a different inquiry. Retain both trade and cash legs so value movement can be reconstructed.

Investigators should coordinate with fraud, trading surveillance and custody operations without conflating their legal tests. A failed settlement can be an operational issue, a risk signal or both. Distinguish attempted activity, executed trade, booked cash and final settlement in the case chronology.

Customer, mandate and investment profile

Identify the contracting customer, relevant owners or controllers, authorised instructing parties and the service mandate. The external manager may have discretion to trade but not to withdraw money. A custodian may hold assets without choosing investments. A fund distributor may transmit instructions while another institution maintains the investor register. Capture these differences before defining normal activity.

Expected activity should reflect the customer's purpose, experience, strategy and funding. Financial-crime assessment does not replace suitability or investment-risk analysis, but strategy context can explain transactions. A buy-and-hold corporate investor making occasional reallocations differs from a market maker with frequent positions and settlement activity. A simplistic volume rule can produce misleading conclusions if the two are evaluated identically.

Record relevant funding and payout expectations. Which bank accounts normally supply money? Who owns them? Where are redemptions or sale proceeds normally paid? Are third-party payments allowed by the product and applicable framework? A default same-name account rule may be a useful design choice, but a named-account match alone does not establish the economic origin of funds.

Mandate controls should distinguish trading, transfers, pledging, borrowing and withdrawals. If Lumen's manager can trade within an approved mandate, that permission does not automatically authorise moving the portfolio to an unrelated account. Operations needs evidence of the actual authority for the event. A role labelled “investment adviser” should not be treated as an unrestricted account signatory.

Subscription and redemption mechanics

For a fund subscription, follow the investor instruction, payer, receiving account, units or shares allotted and investor-register entry. Identify which institution accepts the investor and which receives funds. A payment can arrive before allotment or be returned if the subscription is not accepted. These states should remain distinct in monitoring and investigation records.

Third-party funding needs explanation appropriate to the service and risk. It may involve a parent company, trustee, authorised nominee or another legitimate arrangement. Establish the relationship and entitlement rather than assuming every payer mismatch is illicit. Where the product prohibits the route, operations should enforce the relevant condition independently of whether suspicion is established.

At redemption, check the authorised investor, units, request, valuation basis, settlement and payout destination. A changed bank account can be legitimate, but can also create fraud or value-transfer risk. Verify material instruction changes and retain the history. The initial payer and final recipient should be connected in the case without assuming that a same-name original deposit validates every later destination.

Frequent subscription and redemption with little investment exposure may warrant inquiry. Fees, market movement and liquidity needs matter to interpretation. The analyst should ask why the customer uses the fund and whether the value path fits the purpose. A small realised gain or loss does not settle the origin or recipient question.

Trading: instrument context before inference

Trades require instrument identity, quantity, price, currency, execution time, venue or method, counterparties where available and settlement state. Security identifiers can change after corporate actions or migrations. Preserve mappings rather than treating the new identifier as an unrelated asset automatically.

Price analysis needs an appropriate comparison. A thinly traded security may have a wide spread and unreliable last price; a bond can include accrued interest and different quotation conventions; a derivative can have product-specific valuation. Product specialists should explain the relevant economic measures. Do not compare unlike values and call the difference unexplained value transfer.

Linked parties and repeated patterns can strengthen a concern, but linkage itself needs evidence. A common adviser or registered address may be a legitimate service arrangement. Shared control, coordinated instructions or corroborated connections can have different significance. Preserve the basis and confidence of any relationship inference.

Examine both successful and attempted activity where relevant. Cancelled orders, failed settlement or a withdrawn transfer can still reveal intent, authority problems or control evasion. They should not be presented as completed movement of assets if they were not completed. The chronology should state what actually happened.

Custody and free-of-payment movement

When securities enter custody, identify the delivering institution, account, asset, quantity, date and ownership context available. The bank may need to understand why the customer owns the position and how it fits the relationship. Custody receipt establishes possession in the relevant account; it does not independently prove the original economic acquisition.

A portfolio transfer between accounts of the same beneficial owner can be legitimate, such as a change of custodian. Confirm the relevant identity, authority and route. An asset transfer to a different owner creates another question, even without a cash sale. Gifts, distributions or restructuring can explain it, but the bank should retain the basis and parties.

FoP movements should not disappear from AML simply because there is no cash amount. A valuation can support analysis, with the basis and date recorded. An unreliable market price should remain visibly uncertain. Do not convert a missing value to zero and thereby exclude a potentially material transfer from every scenario.

Corporate actions can also move value. A dividend paid to a changed destination, a merger distribution or a rights sale can generate a payout requiring relevant controls. The event may be automated by custody, but automation does not remove the need for correct parties, entitlement and restriction handling.

Settlement, financing and collateral

Keep the trade-date instruction, execution, contractual settlement date and actual settlement separate. A fail can result from operational mismatch, unavailable securities, funding problems or other causes. The bank should investigate the relevant facts rather than label every fail as suspicious. Repeated unusual fails associated with unclear ownership or changed counterparties can nevertheless merit financial-crime attention.

Margin and collateral flows belong to the product lifecycle. Initial or variation margin, substitutions, releases and close-out can create cash and asset movements. The contract determines their mechanics. Record the payer, recipient, owner, reason and linked exposure. A collateral release should not appear as an unexplained investment redemption merely because both create a cash entry.

Securities lending and repo arrangements involve asset and collateral transfers under their contracts. Legal and product specialists should explain title, obligations and return mechanics for the relevant arrangement. The financial-crime analyst follows the actual parties and movement rather than assuming the event is an outright sale or an ordinary loan payment.

Netting can reduce settlement movements while gross activity remains relevant. A small net payable does not establish that little trading occurred. Retain the detail needed for the control purpose and explain aggregation. Different analytical views may use gross trades, net settlement and current holdings; none should silently replace the others.

Omnibus visibility and targeted inquiry

For an intermediary relationship, understand the type of underlying investors, services, jurisdictions and available data. Establish how the intermediary performs relevant measures and how the bank can obtain information when a particular transaction or risk requires it. The due-diligence depth should follow the actual exposure and applicable rules.

A low-priced-securities concentration may require inquiry different from ordinary diversified custody. An intermediary processing frequent third-party transfers may need stronger visibility than one providing a tightly bounded institutional service. Explain why the control model is adequate for the intended population rather than relying only on a licence and generic questionnaire.

Targeted requests should identify the asset, transaction, relevant parties and unanswered question. An attestation that all underlying customers are legitimate does not necessarily resolve a specific unexplained transfer. The case should assess sufficiency and preserve limitations. The bank should also respect lawful disclosure and confidentiality boundaries when requesting or receiving data.

If required information remains unavailable, consider a restriction, changed service model, remediation or exit under the relevant framework. A bank should not claim that every underlying person has been verified where it has only an intermediary-level assessment. It should state what it knows and why that knowledge supports or does not support the service.

Reporting and coordinated investigation

Prepare a common factual chronology covering funds, assets, orders, execution, settlement and payout. Separate it from specialist conclusions. AML, market surveillance and fraud can use the lawful underlying facts while documenting their own assessment and reporting. External channels, thresholds and timelines depend on the applicable regime.

Do not wait for another team to finish when the bank's own relevant obligation requires action. Equally, do not claim that an AML report fulfils a separate market-abuse duty automatically. The case owner should identify parallel work, responsible officers and any coordination necessary to avoid contradictory operational actions.

A final narrative should explain who moved value, what instruments and accounts were involved, when events occurred, why the activity is concerning or explained, and what evidence supports that conclusion. It should distinguish attempted activity from completed settlement and inference from corroborated fact. That is more useful than attaching a trade spreadsheet without explaining the value path.

Primary-market funding and investor allocations

Primary-market activity creates or distributes securities and can generate a funding path different from secondary trading. Identify the issuer, subscriber, intermediary, allotment, receiving account and use of proceeds relevant to the bank's role. A subscription payment may pass through an escrow or collection account before the issue completes. The bank should preserve that lifecycle rather than interpreting every collection-account credit as an ordinary issuer deposit.

An allocation can change after an initial order. An institutional manager may distribute an executed investment among funds or client accounts under the permitted arrangement. The financial-crime record should identify the final relevant investor or account where available and the authority for the allocation. A temporary block order should not be mistaken for the final beneficial ownership of every security. Conversely, a late unexplained allocation to a different party may require inquiry.

Suppose a fictional issuer raises capital through a placement coordinated by a broker. North Bank provides the collection account. One subscriber's funds arrive from a company unrelated to the registered investor. The bank needs the payer and entitlement explanation appropriate to its role, product and applicable framework. The broker's participation is relevant context, but does not establish that North Bank has no own obligation concerning activity visible in its account.

If the placement is cancelled, refunds create another control event. Establish who is entitled to receive the money and whether the refund route matches the documented arrangement. Returning funds to a substituted account can create fraud and value-transfer concerns even when the original subscription appeared coherent. Record the reason for cancellation, refund authority, destination and actual settlement.

Use of proceeds can also affect the relationship explanation. An issuer that described equipment investment but promptly transfers funds to an unrelated offshore entity may have a legitimate acquisition or treasury rationale, or may present an inconsistency. The bank should request relevant facts and avoid asserting misuse without evidence. AML analysis does not certify securities-disclosure compliance; route potential disclosure or conduct questions to the relevant specialist.

Asset restrictions need issuer and holding context

Sanctions can affect people, entities, property, instruments, transactions or services according to the applicable regime. A name-screening pass on the account holder does not establish that every security or activity is permitted. The bank's legal and sanctions owners should identify which restrictions apply to the relevant parties, issuer, asset and service, including their effective scope. Do not assume every restriction requires the same asset action.

For custody operations, the instruction must be executable. State which holding, quantity, account and activity are restricted, whether trading, transfer or payout is affected and what remaining actions are permitted. Preserve the legal source, interpretation, effective time and authorisation. A general case note saying “sanctions concern” leaves operations unable to distinguish a temporary review hold from a legally required asset restriction.

Corporate actions can occur while a holding is restricted. Dividends, coupons, conversions or distributions may require specific treatment under the applicable framework. The bank should route them through the relevant control rather than allow an automated custody event to bypass restrictions. Equally, it should not invent a universal prohibition on every corporate action without a legal basis.

Test a restriction introduced between order execution and settlement. The legal and operational analysis must consider the actual state and applicable requirements. The bank should not describe a pre-trade control as sufficient when the source changed later. Preserve when the restriction became effective, when the bank received it and what events occurred before and after the update.

Prime-service exposures and the final recipient

Some institutional services combine trading, financing, custody and cash management. The bank should map the customer, executing brokers, financing counterparty, collateral provider and authorised payout accounts. Product labels can conceal several value paths. A funding inflow, margin movement, security loan and investor redemption may appear in the same relationship while answering different economic purposes.

Suppose Lumen expands into a financed trading strategy. Cash movements become more frequent and holdings turn over rapidly. The change may be expected under the new service, but it should be reflected in the approved profile and control design. The bank should not retain the old long-term-investment explanation while exempting the new activity as “normal prime business.” Product context improves analysis only when the context is accurate and current.

A third-party collateral supplier or payout recipient adds another relationship question. Establish the contractual basis, ownership, authority and relevant checks. A financing agreement may explain why collateral moves, but a collateral value or haircut does not by itself explain the supplier's economic origin or the recipient's entitlement. Product, credit and financial-crime assessments should remain connected and distinct.

At close-out, several accounts and obligations may be netted or settled under the contract. The case should preserve the gross relevant movements and final recipients where needed, while explaining the net result. A zero closing exposure does not demonstrate that no value moved. Investigators may need the sequence to understand how assets or money reached a particular party.

Acceptance tests should include changed allocations, cancelled issues, substituted refund accounts, restricted corporate-action proceeds and a financed relationship's final payout. For each, verify the relevant source data, control owner and disposition. These tests extend beyond ordinary buy-and-sell examples and expose whether the bank actually understands the investment services it offers.

Product-aware assurance

Test a third-party subscription, changed redemption account, off-market asset transfer, omnibus relationship and an unsettled trade. Check that evidence includes the actual party roles and value movement, not only an account-level alert.

Review coverage for transfers of securities as well as cash. A monitoring feed containing only cash balances can miss movement through holdings. Reconcile transaction populations with custody and trading systems and explain exclusions.

For regulatory changes, record adoption and effective dates, affected adviser categories and transition arrangements. Preparation for a future duty should not be represented as proof that it currently applies.

Product-aware acceptance tests

Each test uses fictional records and requires predefined expected results. Test the actual data population and decision route rather than merely verifying that an alert can be created manually.

Test 1: Securities transfer absent from a cash-only feed

Move a material position free of payment between custody accounts. The control population should include the relevant asset movement and ownership context where required by design. If no cash entry exists, the event must not be discarded as zero activity. Record the valuation basis used for analysis and any uncertainty.

Repeat with a legitimate same-owner portfolio migration and with a transfer to an unrelated entity. The process should distinguish the circumstances rather than making FoP inherently suspicious. A control fails if it cannot identify the receiving owner or if it treats both events as ordinary cash withdrawals.

Test 2: Corporate action creates an apparent volume spike

Apply a stock split to a holding, then run the quantity-based scenario. The system should preserve the corporate-action event and instrument mapping so a legitimate quantity change is not interpreted as unexplained customer trading. Test a real customer purchase on the same day to ensure the exemption does not suppress unrelated trades.

Check derived prices and valuations. A quantity adjustment without the corresponding economic context can create artificial profit or loss. Analysts should see the source event and explanation, not only a changed holding balance.

Test 3: Redemption destination changes after approval

Approve a fund redemption to the documented investor account, then replace the payout destination with an unrelated company. The material change should reach the relevant instruction, fraud and financial-crime controls. A transaction approval should not authorise any destination entered later by an operator.

Provide a legitimate supported nominee or restructuring explanation in a second run. The bank should be able to assess and resolve it according to the product and applicable framework. The expected outcome is an evidence-based decision, not a permanent automatic ban on every account-name mismatch.

Test 4: Adviser trades but cannot withdraw

Give an external manager a trading mandate without payment or asset-transfer authority. Submit an investment order, a cash withdrawal and a portfolio transfer. The system should apply the mandate's actual scope. Personal familiarity or a correct adviser password does not expand contractual authority.

Revoke the mandate and test every supported channel, including batch instructions and relationship-assisted requests. A revoked role in the customer database is ineffective if the order platform still accepts instructions. Record propagation time and the handling of instructions already in flight.

Test 5: Attempted activity collapsed into settled transactions

Create an order that is cancelled before execution, a partial execution, a settlement fail and a completed settlement. The case chronology should represent each state accurately. A monitoring system may analyse attempted activity, but it must not describe the full order quantity as settled when only a portion completed.

Test correction messages and replay. Duplicate control should preserve genuine new states without double-counting one movement. An incorrect chronology can undermine both risk analysis and external reporting even if the customer and amount fields are correct.

Test 6: Omnibus account with an unanswered underlying-party question

Create a transaction whose relevant underlying information is unavailable in the normal feed. Send a targeted request to the intermediary and return a generic policy document. The case should remain unresolved where the material question has not been answered. On-time document receipt does not establish sufficiency.

Then supply relevant lawful evidence and test closure. Record whether the evidence is an attestation, a source document or independent corroboration. The conclusion should not claim that all underlying investors were reviewed because one transaction was resolved.

Test 7: Matched trading routed only to one team

Create linked-account activity raising both trading-conduct and unexplained-value concerns. Market surveillance and AML should receive the relevant facts through authorised processes, apply their own assessments and record outcomes. A market-surveillance closure should not automatically close the AML question if funding or ownership remains unexplained.

Repeat with legitimate coordinated trading supported by a mandate and economic purpose. The teams should be able to resolve the facts without an unsupported criminal allegation. Shared evidence should improve decision quality rather than force identical conclusions.

Test 8: Settlement netting hides gross movement

Create several large trades producing a small net settlement. Monitoring views should retain the gross activity needed for the scenario and distinguish it from settlement amount. A rule using only net cash should not be described as covering the underlying trading pattern.

Test reconciliation from order and execution populations to settlement and holdings. Differences can be legitimate, but require event-aware explanations. A daily total that balances while one instrument class is omitted does not establish complete coverage.

Test 9: Collateral substitution changes parties

Replace collateral in a financing arrangement with assets supplied by a different entity. The bank should identify the owner, authority, contractual basis and relevant screening or risk requirements. Credit approval of the replacement value does not settle all financial-crime questions about the new party.

Follow later collateral release and close-out. The system should preserve the linked contract and recipients. If it labels all collateral flows “internal,” test whether external value movement is incorrectly excluded from controls.

Test 10: Future adviser rule represented as current law

Create a regulatory-change entry for FinCEN's investment-adviser rule with its postponed 1 January 2028 effective date. The obligation catalogue should distinguish adoption, current effectiveness, affected institution categories and preparation tasks. It should not mark every adviser as presently subject to the delayed new rule.

Test an existing regulated bank or broker-dealer relationship separately. Future adviser treatment does not remove its current applicable duties. The system should support both current obligations and future readiness without one status overwriting the other.

Assurance of complete populations

Reconcile monitoring populations to custody, trading, fund and cash sources by event type and instrument class. Include cash deposits, withdrawals, securities receipts and deliveries, subscriptions, redemptions, corporate actions and relevant collateral events. Document intentional exclusions and their rationale. Aggregate value alone cannot show whether non-cash assets reached the control.

Review data transformations. Price conventions, currencies, quantities, signs and effective dates can change the meaning of a record. A sale proceeds field may be gross or net of fees; a bond quantity may represent nominal units; a derivative notional may not be its cash value. The dictionary should prevent analysts from comparing unlike measures without context.

Assess scenario outcomes using representative products. A good equity example does not establish bond, fund or derivatives coverage. Ask product specialists to challenge the interpretation of difficult events. Preserve their explanation within scope rather than letting a specialist sign-off become a generic exemption for all activity in that product.

Sample cases from alerts, manual referrals and low-activity populations. Examine whether a lack of alerts reflects normal activity or unavailable data. Review settled and attempted events. If the system cannot reconstruct a transfer that never generated cash, the assurance report should identify that limitation directly.

Finally, assess decision ownership and report confidentiality. Check that teams can coordinate underlying facts while preserving protected report access and customer communication boundaries. A common case platform should not turn every commercial or support user into an authorised recipient of confidential reporting information.

A negative control for a valuation-driven scenario

Create two otherwise identical asset transfers. The first uses a current reliable valuation; the second has a stale price after a material corporate action. The scenario should expose the valuation limitation in the second record rather than communicate a precise unexplained loss. An analyst should be able to trace the price source, date and event adjustment. The control fails if it silently substitutes today's unrelated instrument price or uses a missing value as zero.

Then correct the valuation while retaining the original input and calculation. Verify whether the alert and case require review, and preserve the reason for any revised conclusion. A data correction should not erase evidence of what the control originally produced. This negative control checks analytical honesty: the bank can distinguish an economic concern from a defective comparison and can explain why its assessment changed.

Worked redemption case

A fictional investor funds a subscription from an account in its own name, then shortly requests redemption to an unrelated company after minimal investment activity. Investigate the relationship, explanation and authority for the new destination. The investment's small gain or loss does not settle the source or destination question.

Explain which evidence belongs to AML analysis and which facts might also require a separate market-abuse or fraud review.

Worked case: Lumen's concentrated position and payout

This case uses fictional entities, dates and values. Lumen Holdings opens a custody and trading relationship with North Bank. Its stated purpose is long-term investment of company surplus. Expected funding comes from its own operating account, and normal withdrawals return to that account. An external manager may trade under a defined mandate but cannot instruct third-party payments.

The initial subscription is coherent

Lumen funds a diversified investment from its named company account. The bank understands ownership, authorised representatives and the stated funding source. The first transactions align with the profile. This supports the initial relationship decision; it does not provide permanent proof that every later asset or payout is explained.

The bank records account, beneficial-owner and mandate data separately. Custody maintains holdings, trading maintains orders and executions, and payments maintains cash movements. Stable links allow an investigator to connect these records without treating the manager as the owner or the custody account as evidence of original asset acquisition.

A free-of-payment securities receipt

Lumen later receives a concentrated block of unfamiliar securities from another custodian. No cash deposit accompanies the movement. A cash-only scenario therefore produces no alert. A custody-event control identifies the material new asset and asks whether it fits the relationship. The bank should not record the receipt as suspicious merely because it is FoP, but needs relevant ownership and acquisition context.

Lumen says the shares were received from an affiliate after a restructuring. The initial document names another entity and lacks an explanation of Lumen's entitlement. The analyst requests the relevant structure and transfer basis. Legal and product specialists help interpret the documents. The case distinguishes an unsupported entitlement from a conclusion that the shares are stolen or unlawfully acquired.

In one version, the evidence shows a legitimate distribution within a documented group arrangement. The bank updates the asset and activity explanation and proceeds under its controls. In another, ownership remains unclear and the customer changes its explanation. The unresolved facts support a different risk and reporting assessment. The conclusion follows evidence, not the transaction label.

Rapid sale and apparent losses

Lumen sells much of the position over a short period. The execution prices differ markedly from a reference price in the monitoring feed. A first alert describes a large economic loss. Product review discovers that the reference used an inappropriate price point for a thinly traded instrument and did not reflect the actual liquidity available. The analyst corrects the valuation interpretation while retaining any other concerns.

This demonstrates why a flawed price comparison should not become a laundering conclusion. The sales can still merit inquiry because of the new asset's origin and rapid monetisation. Market surveillance separately reviews trading conduct if the facts meet its analytical criteria. A valuation correction resolves one issue, not every question in the case.

If executions appear coordinated with related accounts, establish the linkage and order sequence. A shared adviser can explain some relationships but is not proof of coordinated misconduct. Preserve order, execution and counterparty evidence. AML asks about unexplained value movement and economic purpose; market surveillance assesses the relevant trading-conduct framework.

A changed payout instruction

After sale, the external manager requests payment of proceeds to Orion Services Ltd overseas. The mandate permits trading but excludes withdrawals. Operations verifies authority and contacts the authorised Lumen representative through the established process. Fraud staff consider possible instruction compromise. Financial crime asks why Orion should receive the proceeds.

Lumen describes an acquisition payment, but the first agreement has a different purchaser. The bank identifies the precise inconsistency. If a documented assignment or group arrangement explains entitlement and authority, the case may be resolved proportionately. If no credible explanation is provided, the bank follows the applicable restriction and escalation. The fact that securities were sold on a recognised venue does not answer the payout question.

The payment's operational state matters. If it is queued but not executed, an authorised hold or cancellation may be available under the framework. If already settled, the bank needs a different investigation and possible recovery process. The case should not claim that a hold prevented movement when settlement occurred before the control.

A parallel subscription and redemption pattern

The review also finds that Lumen subscribed to a fund and requested redemption soon afterward with little market exposure. The redemption destination differs from the initial funding account. The bank reconstructs the investor, payer, units, valuation, fees and payout. A small investment loss does not establish innocence or guilt; it is part of the economic context.

Lumen provides a legitimate cash-management explanation in one version. The evidence supports the temporary investment purpose and recipient. In another, funds repeatedly enter from one unrelated party and leave to another with inconsistent instructions. The relevant concern is the unexplained value path and use of the product, not a rule that all early redemptions are criminal.

The fund administrator's involvement does not automatically complete North Bank's own assessment. Determine which institution holds the relevant investor information and how lawful targeted requests are handled. The bank should not claim full underlying-investor verification if its evidence consists only of a general intermediary attestation.

Investigation and reporting conclusions

The common chronology links funding, securities receipt, sales, fund activity and proposed payout. It states which transactions settled, which were attempted and which remain pending. AML, fraud and market-surveillance teams make their own assessments. They coordinate lawful underlying facts and preserve confidential reporting records separately.

An external report, if required, should communicate the material facts and why the activity is concerning under the applicable framework. A table of thousands of trades without a clear value path can obscure the narrative. If a concern is resolved, the file should explain the supporting evidence and any remaining limitation rather than merely switching the status to green.

Remediation of the bank's cash-only gap

Assurance identifies that custody transfers did not reach the AML population. The bank scopes affected event types, instruments and period. It adds role-aware custody data, defines valuations and reconciles to source. Historical replay includes the missed asset events without double-counting later sale proceeds. Analysts review the resulting cases according to their facts.

The remediation record distinguishes technical delivery from financial-crime completion. A feed restored today does not prove the past exposure was assessed. It also identifies intentional exclusions and why they are acceptable. If a valuation is unavailable for a particular asset, the event remains visible with uncertainty instead of becoming zero activity.

Further cases with product-specific reasoning

A portfolio migration between same-owner accounts. Establish identities, authority, delivering and receiving institutions and the purpose. A FoP migration can be ordinary. Preserve the evidence connecting ownership rather than automatically flagging the lack of cash or exempting every transfer described as a migration.

A merger changes an instrument identifier. Follow the corporate-action mapping and entitlement. A new security record may represent a legitimate replacement, not a new unexplained purchase. Ensure unrelated trades on the same day remain visible. An event exemption should not hide the whole day's customer activity.

A bond sale appears far from a displayed price. Ask product specialists about quotation, accrued interest, liquidity, size and valuation source. Correct comparisons before inference. If the economic difference remains unexplained after appropriate context, preserve the actual evidence supporting further inquiry.

A margin payment comes from an unfamiliar affiliate. Identify the payer, contractual exposure, authority and relationship. Margin mechanics can explain timing and amount; they do not explain every third-party payer automatically. Credit and product teams provide context while financial crime assesses the relevant value path.

An omnibus intermediary refuses a targeted request. Establish the precise information needed, legal route and contractual arrangement. A general privacy assertion may need clarification. If material information cannot lawfully or practically be supplied, assess whether the service can continue under a suitable model. Do not record unknown underlying facts as verified.

A trade fails without suspicious circumstances. An operational mismatch or unavailable security can explain a fail. Correct the issue and preserve status. Repeated unexplained failures may add risk, but an isolated fail is not itself evidence of money laundering or market manipulation.

Knowledge checks with worked answers

1. Why monitor securities as well as cash? Assets can move ownership or custody without a cash entry, so cash-only analysis can omit material value movement.
2. What does a trade execution establish? It supports an agreed transaction at an execution point; actual settlement and the customer's original entitlement require separate evidence.
3. Why retain the cancelled order? Attempted activity can be relevant, but it should remain accurately distinguished from executed and settled movement.
4. Does an exchange sale establish clean proceeds? No. It evidences the sale mechanism, not the original lawful asset acquisition or a later recipient's entitlement.
5. Why separate AML and market-abuse decisions? Their legal tests and reporting channels differ, even where the same facts support parallel inquiries.
6. Can a trading mandate authorise withdrawals? Only if the actual authority includes that function; a role name or personal familiarity does not expand it.
7. Why can a small net settlement hide risk? Large gross activity can net to a small amount. The relevant trading and party information may be lost if only the net movement is analysed.
8. How should unavailable asset valuations be treated? Preserve the movement and uncertainty, use appropriate evidence and avoid converting missing value into a misleading zero.
9. Why label the 2018 FATF guidance historically? Its product guidance remains useful, but the official page warns it does not incorporate later standards revisions; current Recommendations and local law must also be considered.
10. What does the delayed US adviser rule change today? It changes the effective date of that specific new regime; it does not eliminate currently applicable duties of banks, broker-dealers or other institutions in their existing roles.

Data requirements and acceptance evidence

Link customer, beneficial owner, order, execution, settlement, holding and cash records with stable identifiers. Preserve prices, quantities and timestamps without collapsing all events into a single transaction date. Cases should expose the complete value path and unresolved settlement status.

Test corporate actions, portfolio transfers, duplicate feeds, changed payout instructions and missing underlying-party data. Control owners should agree expected results before execution. A provider's transaction count cannot prove that every relevant instrument or transfer type reached monitoring.

Product-aware controls distinguish legitimate investment mechanics from unexplained movement of value and preserve each applicable reporting boundary.

An event model that preserves economic meaning

Create separate event types for funding, order, execution, cancellation, settlement, asset receipt, asset delivery, corporate action, subscription, redemption, margin, collateral and payout. Link them through stable customer, account, instrument, instruction and contract identifiers. A single generic transaction table can be used operationally, but its fields must retain the distinctions necessary for analysis.

Store quantity, amount, price, currency and valuation basis with explicit meaning. A derivative notional, market value, settlement cash amount and collateral amount should not occupy one undifferentiated “value” field. A bond quotation may need conventions understood by the product. Document conversions and retain source values so an analyst can reconstruct the result.

Preserve several dates where relevant: instruction, execution, contractual settlement, actual settlement, effective ownership and bank knowledge. A late feed should not move the actual event date to ingestion time. A corrected trade should preserve the original and reason. These distinctions matter when reconstructing what the bank knew and what value had moved when it made a decision.

Instrument identity should support changes and relationships. Corporate actions can replace securities or alter quantities. A fund share class may differ in currency or distribution treatment. A derivative references an underlying instrument without necessarily transferring it. Preserve relevant mappings without assuming every related identifier denotes the same economic asset.

Role-aware party data

Identify investor, account holder, beneficial owner where relevant, authorised manager, custodian, broker, settlement agent, payer and payout recipient. Parties can legitimately occupy more than one role, but the system should show which role applies to each event. An adviser identifier should not substitute for an investor identity in a customer-level assessment.

For omnibus services, store the intermediary and available underlying references with their source and scope. A unique underlying identifier can support targeted tracking without implying that the bank has a full direct customer relationship. The legal catalogue should explain which obligations attach to the institution and service and which underlying facts are needed for the specific control.

Keep relationship confidence visible. A common address or manager can suggest a link; corroborated ownership can establish a stronger connection. Analytics should not convert every weak association into proven shared control. Review and correction processes should preserve why a link was created or rejected.

Data lineage and reconciliation

Reconcile each relevant source population to ingestion and monitoring. Use counts and meaningful totals by event type, channel, product and date. A balanced cash ledger cannot establish that custody transfers or cancelled orders reached the intended control. Explain transformations and intentional exclusions so assurance can challenge their appropriateness.

Data replay requires event-aware duplicate handling. The same trade may appear in an order feed, execution feed, settlement feed and correction feed. Those records are related facts, not necessarily duplicates. A duplicate key that retains only one may destroy the chronology. Conversely, repeated copies of the same event should not create artificial activity.

Monitoring features should have documented inputs. A “rapid exit” feature needs to define when funds or assets entered, whether positions were established, which payout counts and how unsettled events are handled. A “large loss” feature needs an appropriate price comparison and economic basis. The feature name alone does not explain its accuracy.

A release incident involving a corporate-action mapping

A fictional technology change maps a merger's replacement security as an unrelated new instrument. Monitoring interprets thousands of legitimate custody updates as unusual new asset receipts. Cases rise sharply and analysts struggle to identify the cause. The incident owner should establish the affected population and distinguish false-alert workload from genuine uncovered exposure.

Product specialists explain the corporate action and expected accounting. Data staff examine the mapping and source event. Financial crime assesses which scenarios and cases are affected. Operations considers customer impact. The correction should preserve relevant original records and connect the replacement asset without suppressing unrelated purchases or transfers.

Replay the affected population with the corrected mapping. Compare expected and actual outputs, inspect boundary cases and reconcile totals. Closing the incident requires evidence that relevant cases were corrected or reviewed and that future events behave as intended. A code fix alone does not show that the backlog was assessed.

The release review should ask why representative corporate actions were missing from testing. Add meaningful coverage for event types and instrument conventions, not a test that simply reproduces the faulty mapping. The aim is to verify economic interpretation and control outcomes.

Coordinated cases without one universal report status

A common factual case can support several workstreams. Maintain a chronology and source evidence that authorised teams can use. Store separate AML, market-surveillance and fraud assessments, with applicable reporting decisions and access controls. One team's conclusion may resolve its concern while another retains an unanswered question.

For Lumen, market surveillance may conclude that the execution pattern has a legitimate explanation while AML still lacks evidence of asset entitlement. Fraud may verify the customer instruction while the payout recipient remains unexplained. The platform should support these combinations. A single global “cleared” state can close material work accidentally.

Customer restrictions also require precise ownership. Trading may be limited while custody continues, a payout may be held while existing positions settle, or a legal asset restriction may apply across services. The record should state scope, authority, effective time and permitted remaining activity. Operations needs an executable instruction, not a general note to “restrict client.”

Protected reporting information belongs in the authorised record and should not be exported with ordinary case facts automatically. Test access, templates, attachments and support procedures. A trading restriction letter should not reveal confidential report existence or contents unless lawful and authorised under the applicable framework.

Regulatory change and legal perimeter

Classify each source by institution, service, jurisdiction and status. International guidance, national enacted rules, supervisory expectations and proposals have different effects. A legal entity acting as custodian may be subject to a framework different from an external adviser. A fund distribution service can differ from the fund's own administration obligations.

For the US adviser rule, record the postponed 1 January 2028 effective date and the affected categories from the official source. Readiness tasks can still be planned. They should be labelled preparation for future requirements, while current bank or broker-dealer duties remain in the active catalogue. Do not describe the postponement as an exemption from all AML controls in the investment chain.

For historical guidance, record its publication date and later changes relevant to use. FATF's 2018 securities document gives product-specific examples, but its current notice calls for reading it alongside newer standards. A references list should communicate this limitation to learners rather than treating every official document as equally current.

Translate legal requirements into service-specific controls and tests. Identification may need role data; reporting may need an attempted-versus-settled chronology; asset restrictions may need custody and collateral states; information sharing may need a secure targeted request process. A policy update without these operational effects does not complete implementation.

Meaningful management information

Report customer and service populations with material intermediary and product attributes. Show omnibus activity, relevant low-priced-security exposure, third-party funding and FoP movement where meaningful to the business. Avoid implying that a broad category itself proves wrongdoing. The purpose is to understand exposure and control coverage.

Coverage information should include missing event types, unavailable party fields, unsupported valuation conventions, delayed feeds and unresolved reconciliation. Alert volume alone cannot demonstrate completeness. A quarter with fewer cases may reflect lower activity, better controls or a broken feed; management needs evidence to distinguish these explanations.

Case metrics should distinguish open identity questions, unexplained entitlement, changed destination, trading-conduct work, fraud assessment and reporting decisions. Measure overdue material questions and response sufficiency, not only case closure speed. A process rewarded solely for fast closure can conceal unresolved value paths.

For remediation, show affected historical populations, technical fixes, replay and substantive review completion separately. A system change can be live while past cases remain unassessed. Management should see the residual exposure and owner rather than a blanket “issue resolved” label.

Controlled relationship exit in investment services

Exit requires an inventory of cash, holdings, unsettled trades, fund positions, financing, collateral and pending corporate actions. A bank should not close access in a way that loses the ability to settle lawful existing obligations. Legal, operations and product teams identify the permitted treatment, including any restrictions on assets.

Verify the receiving account and authority for asset transfers. A relationship exit does not authorise moving securities to an unrelated owner or returning restricted property. FoP closure transfers still need the relevant party and entitlement checks. Preserve the transfer instructions, approvals and settlement evidence.

Distinguish account status from completed closure. A trading account can be inactive while custody holds assets; a fund redemption can be pending after the request; a collateral obligation can survive service withdrawal. Track remaining items with owners and lawful handling. A customer system marked “closed” is not proof that all value has left or every obligation has ended.

After closure, maintain relevant records under the applicable retention framework and authorised access. A later authority request may need the original ownership, trade and payout chain. The bank should be able to reconstruct events without treating today's absence of a holding as evidence that no historical asset existed.

Effective securities financial-crime control joins customer understanding with product mechanics, complete value events and precise decision ownership. It keeps cash and assets visible, distinguishes operational states and allows coordinated investigation without collapsing different legal frameworks into one conclusion.

References and further reading

Reviewed 2 October 2026. FATF provides international standards; applicable national law determines binding duties. The operating examples are fictional teaching cases.

• FATF Recommendations, updated June 2026 — relevant anchors: 10, 20 and relevant FATF securities-sector risk-based guidance.
• FATF securities-sector guidance
• FinCEN investment-adviser effective-date postponement

The FATF securities guidance dates from 2018. Its official page warns that it does not reflect subsequent standards changes, including the 2025 Recommendation 1 revisions; read it alongside current Recommendations and relevant newer guidance.

• SEC AML source tool for broker-dealers — US institution-specific legal and guidance links.
• SEC AML source tool for mutual funds — US mutual-fund materials; distinguish from adviser, broker and bank regimes.
• SEC risks associated with omnibus accounts transacting in low-priced securities — role-specific underlying activity, due diligence and reporting considerations.