AFC Risk Manager Exam Study Guide (2026)
Everything the ACAMS Certified AFC Risk Manager Exam (formerly Advanced CAMS-RM) tests, topic by topic: what each section covers, the facts that come up most, and how to study it. Pair it with the free 15-question practice test.
The exam at a glance
| Questions | 90 multiple-choice questions (knowledge and scenario-based) |
|---|---|
| Time | 3 hours |
| Passing score | Set by ACAMS (see the Candidate Handbook) |
| Format | Closed book, computer-based |
| Certifying body | ACAMS (Association of Certified Anti-Money Laundering Specialists) |
| Test provider | Pearson VUE (test center or online proctored) |
Mind map: the whole exam on one screen
1. Navigating Financial Crime Risks and Threats
This topic covers the threat landscape a senior AFC risk manager must track: typologies, national and supranational risk assessments, and emerging risks.
Key facts
- Threats are the criminal activities and actors; vulnerabilities are weaknesses that let threats succeed; risk combines both with impact.
- National risk assessments (FATF Recommendation 1) identify a country's main ML/TF threats and should inform firms' assessments.
- The EU supranational risk assessment and FATF typology reports are key external inputs.
- Emerging risks include instant payment scams, AI-enabled fraud and deepfakes, crypto and stablecoin misuse, and sanctions evasion networks.
- Indiscriminate de-risking can push activity into less transparent channels; supervisors expect case-by-case risk management.
- Horizon scanning tracks regulatory change, enforcement actions and new typologies.
- Public-private partnerships share threat intelligence between government and the private sector.
Flashcards
Exam tip: On de-risking questions, choose case-by-case risk management over blanket exits.
2. Conducting a Financial Crime Risk Assessment
The core technical topic. Know the methodology for an enterprise-wide risk assessment from inherent risk to residual risk and action plans.
Key facts
- Inherent risk is assessed across customers, products and services, geographies, delivery channels and transaction types.
- Control effectiveness is assessed by design and operation, using testing, audit and quality assurance evidence.
- Residual risk is inherent risk adjusted for control effectiveness and compared against risk appetite.
- Quantitative data (customer counts, volumes, high-risk exposure) should be combined with qualitative judgment.
- Results must be approved by senior management and the board and drive action plans.
- The assessment is updated regularly (often yearly) and when trigger events happen, such as new products, markets or acquisitions.
- Separate assessments may be needed for sanctions, fraud, bribery and corruption, and tax evasion facilitation.
Flashcards
Exam tip: If residual risk is above appetite, the answer involves action: strengthen controls or reduce exposure, and track it.
3. Building a Sustainable AFC Risk Management Program
This topic covers the structure that keeps AFC risk management working over time: risk appetite, policies, the three lines, resourcing and change management.
Key facts
- A risk appetite statement sets the type and level of risk the board accepts, with measurable limits and indicators.
- No firm can claim zero financial crime risk, but it can have zero tolerance for knowingly facilitating crime.
- The first line owns risk, the second line sets standards and challenges, the third line gives independent assurance.
- New product and business approval processes assess financial crime risk before launch.
- Resourcing must match risk and growth; growth that outpaces controls is a common root cause of failures.
- Model risk management applies to screening and monitoring models (for example US SR 11-7).
- Remediation programs need clear ownership, milestones, validation and board reporting.
Flashcards
Exam tip: 'Sustainable' is the key word: the best answers build processes and ownership, not one-off fixes.
Test yourself on these topics
Take the free 15-question AFC Risk Manager test, then save your results to unlock your Readiness Score and the mistakes bank.
4. Governance, Metrics and Reporting
Know how AFC risk information is measured and reported so senior management and the board can oversee it.
Key facts
- KRIs measure risk exposure and control health; KPIs measure performance against goals.
- Examples of AFC KRIs: overdue high-risk KYC reviews, alert backlogs, screening gaps, high-risk customer growth.
Flashcards
Exam tip: If an option measures activity (training sessions, policies written), it's a KPI. KRIs measure risk.
5. AFC Risk Management Case Studies
Case studies test judgment. Learn the recurring lessons from enforcement actions and major failures.
Key facts
- Repeated root causes: weak tone at the top, under-resourced compliance and growth outpacing controls.
- Ignoring internal audit findings and red flags escalated by staff makes failures worse.
Flashcards
Exam tip: In case-study questions, look past the symptom (missed alerts) to the root cause (governance, resources, culture).
How to pass
- This is a senior-level exam. Expect 'best approach' questions where several answers are partly right; choose the most risk-based and sustainable one.
- Master the risk assessment chain: inherent risk, control effectiveness, residual risk, risk appetite and action plans.
- Know the difference between KRIs and KPIs, and how risk information should reach the board.
- 90 questions in 3 hours. Case-study questions are long; read the question stem first.
Frequently asked questions
How long should I study for the AFC Risk Manager exam?
Most working candidates need 4 to 8 weeks at 45 to 60 minutes a day. Book your exam once your Readiness Score has stayed at 80 or higher for about a week.
Can I take the AFC Risk Manager exam online?
Yes. ACAMS exams are delivered by Pearson VUE at test centers or online with a remote proctor. Format: closed book, computer-based. Check the current Candidate Handbook from ACAMS for the rules.
What score do I need to pass the AFC Risk Manager exam?
Set by ACAMS (see the Candidate Handbook). The exam has 90 multiple-choice questions (knowledge and scenario-based) and a time limit of 3 hours.
What are the most tested topics?
The outline covers navigating financial crime risks and threats, conducting a financial crime risk assessment, building a sustainable afc risk management program, governance, metrics and reporting, afc risk management case studies. Use the free practice test to see which ones you need most.
Get every note, flashcard and question
All-Access Monthly
- All 10 ACAMS exams, from CKYCA to CAMS and the advanced certifications
- Full question banks + timed simulations
- Study notes, flashcards & mind maps
- Spaced repetition + mistakes bank
- Readiness Score & detailed reports
- Video lessons as they release
- New exams added during your access
- 5 bonuses: red flags cheat sheet, key numbers sheet, study planner and more
- Pass Guarantee: complete the prep, pass or 100% back
Renews monthly until you cancel. Cancel in two clicks from your account; you keep access until the end of the month you've paid for. No minimum term.
All-Access Yearly
- All 10 ACAMS exams, from CKYCA to CAMS and the advanced certifications
- Full question banks + timed simulations
- Study notes, flashcards & mind maps
- Spaced repetition + mistakes bank
- Readiness Score & detailed reports
- Video lessons as they release
- New exams added during your access
- 5 bonuses: red flags cheat sheet, key numbers sheet, study planner and more
- Pass Guarantee: complete the prep, pass or 100% back
Renews once a year until you cancel. We email you before each renewal. Cancel any time from your account; you keep access until the end of the year you've paid for.
Summarized from ACAMS' official candidate information and the standards and regulations cited, checked October 2026. Confirm current requirements with ACAMS (Association of Certified Anti-Money Laundering Specialists).