{ "moduleCode": "IFF718", "title": "Programme design, metrics, and institutional integrity", "levelCode": "L-04", "levelName": "Mastery", "nqf": 7, "credits": 12, "notionalHours": 120, "lessons": [ { "id": "l4m4-1", "title": "Designing the analytics function: risk-scoring models and their failure modes", "readingMinutes": 43, "objectives": [ "Distinguish rule-based from machine-learning risk-scoring approaches and their respective transparency trade-offs.", "Identify how historical bias in training data can be reproduced and amplified by predictive models.", "Diagnose the 'scoring without capacity' failure mode and its accountability consequences.", "Sequence a responsible analytics build-out from data-quality foundation through to advanced modelling." ], "keyTakeaways": [ "Predictive models inherit the biases of their training data; mathematical form does not confer neutrality.", "Automated scoring should remain a triage tool feeding human review, not a replacement for open-ended investigation.", "Scoring cut-offs should be sized to actual investigative capacity, not simply to maximise the number of true positives identified." ], "keyTerms": [ { "term": "Rule-based scoring", "definition": "A risk-scoring approach using explicit, legible indicators (e.g. structuring patterns, PEP status) that can be individually explained and audited." }, { "term": "Overfitting to known typologies", "definition": "A model's weakness in detecting genuinely novel schemes because it was trained only on previously identified and caught patterns." }, { "term": "Scoring without capacity", "definition": "The failure mode of generating more correctly flagged high-risk cases than an institution has resources to investigate, creating an accountability exposure." }, { "term": "Identity resolution", "definition": "The data-quality process of reliably matching records referring to the same individual or entity across disparate datasets and registries." } ] }, { "id": "l4m4-2", "title": "Data protection, CJEU proportionality, and measuring effectiveness against FATF's 11 Immediate Outcomes", "readingMinutes": 42, "objectives": [ "Explain the CJEU's reasoning in C-37/20 & C-601/20 and its consequences for BO-register design.", "Apply the suitability/necessity/proportionality-stricto-sensu test to an AML data-policy design choice.", "Distinguish FATF Technical Compliance ratings from Effectiveness (Immediate Outcome) ratings.", "Design an internal annual self-assessment against IO6 and IO7 independent of the formal Mutual Evaluation cycle." ], "keyTakeaways": [ "Unrestricted public BO-register access was found disproportionate to the AML objective by the CJEU in November 2022.", "The AML Package's legitimate-interest access model for BO registers is a direct response to that ruling.", "Countries can and do diverge sharply between strong Technical Compliance and weak Effectiveness ratings.", "Internal annual self-assessment against IO6/IO7 surfaces implementation gaps years before the next formal Mutual Evaluation." ], "keyTerms": [ { "term": "CJEU C-37/20 & C-601/20", "definition": "The 22 November 2022 CJEU judgment invalidating unrestricted public access to EU beneficial-ownership registers on fundamental-rights proportionality grounds." }, { "term": "Proportionality test (suitability, necessity, proportionality stricto sensu)", "definition": "The CJEU's three-part analytical framework for assessing whether an interference with a fundamental right is lawful." }, { "term": "FATF Immediate Outcomes (IOs)", "definition": "The 11 effectiveness measures used in FATF Mutual Evaluations to assess whether an AML/CFT system produces real-world outcomes, rated High/Substantial/Moderate/Low." }, { "term": "Technical Compliance vs. Effectiveness", "definition": "The two distinct FATF assessment scales; whether laws match the standards on paper, versus whether the system actually works in practice." } ] }, { "id": "l4m4-3", "title": "Greylisting dynamics, corruption of the enforcement function, and protecting the people who speak up", "readingMinutes": 41, "objectives": [ "Explain why FATF greylisting functions today primarily as an Effectiveness-gap instrument.", "Compare the South Africa, Nigeria and Kenya greylisting action plans and their underlying Mutual Evaluation findings.", "Diagnose how capture of the enforcement function undermines an otherwise technically compliant AML/CFT system.", "Design a whistleblower and investigator protection framework addressing retaliation, physical safety, reporting-channel independence, and career protection." ], "keyTakeaways": [ "South Africa was grey-listed in February 2023 and delisted in October 2025 following demonstrated Effectiveness improvements.", "Nigeria (2023) and Kenya (2024) greylistings followed the same Effectiveness-gap pattern as South Africa's.", "A captured enforcement function is worse than an absent one because it provides legitimating cover for continued abuse.", "Whistleblower protection must address retaliation, physical safety, reporting-channel independence and career marginalisation together." ], "keyTerms": [ { "term": "FATF grey list (increased monitoring)", "definition": "FATF's public list of jurisdictions with strategic AML/CFT deficiencies under an agreed action plan, distinct from the more severe 'Call for Action' black list." }, { "term": "De-risking", "definition": "Correspondent banks and counterparties withdrawing or restricting relationships with entities in listed or high-risk jurisdictions, often disproportionate to the specific deficiencies identified." }, { "term": "Capture of the enforcement function", "definition": "The corruption of AML/CFT institutions themselves such that they provide legitimating cover for, rather than genuine prevention of, illicit conduct." }, { "term": "Reversed-burden retaliation protection", "definition": "A whistleblower-protection design in which the employer must justify any adverse action against a report-linked employee, rather than the employee bearing the burden of proving retaliation." } ] } ], "caseStudy": { "title": "South Africa: from 2023 grey-listing to 2025 delisting", "jurisdiction": "South Africa", "summary": "South Africa's February 2023 FATF grey-listing followed a 2021 Mutual Evaluation Report exposing Effectiveness gaps closely linked to state-capture-era institutional weakening. Its October 2025 delisting followed a structured action plan focused on demonstrable enforcement outcomes rather than legislative amendment alone.", "facts": [ "The 2021 ESAAMLG Mutual Evaluation Report found South Africa Largely Compliant or Compliant on most Technical Compliance items but Low or Moderate on several Immediate Outcomes, including investigation/prosecution of money laundering and beneficial-ownership transparency.", "FATF placed South Africa on the increased-monitoring (grey) list in February 2023, citing deficiencies including insufficient investigation and prosecution of serious and complex money laundering, notably state-capture-linked cases.", "The Zondo Commission's findings, published in stages through 2022, documented how key institutions including SARS and elements of the National Prosecuting Authority had been deliberately weakened during the state-capture period.", "South Africa's action plan included strengthening beneficial-ownership data at CIPC, improving risk-based supervision, and, centrally — demonstrating an increased volume and quality of money-laundering investigations, prosecutions and confiscations.", "Over the listing period, National Treasury and law-enforcement agencies published periodic progress reports tracking action-plan items against ICRG review cycles.", "FATF removed South Africa from the grey list in October 2025, citing substantial completion of the action plan's items, though correspondent-banking and reputational effects of the roughly two-and-a-half-year listing period had already been incurred." ], "investigativeQuestions": [ "Why did South Africa's reasonable Technical Compliance ratings not prevent grey-listing, and what does this confirm about the primacy of Effectiveness in the modern FATF process?", "What specific link exists between the Zondo Commission's institutional-capture findings and the Effectiveness deficiencies cited in the 2021 Mutual Evaluation?", "What evidence would FATF's ICRG process realistically require to be satisfied that investigation and prosecution capacity had genuinely improved, rather than merely that new legislation had been passed?", "What lessons does the roughly two-and-a-half-year listing-to-delisting timeline offer other grey-listed jurisdictions (e.g. Nigeria, Kenya) about realistic delisting horizons?" ], "learningPoints": [ "Greylisting decisions turn substantially on Effectiveness (Immediate Outcome) findings, not primarily on Technical Compliance.", "Institutional capture directly produces the enforcement-outcome gaps that trigger and prolong greylisting.", "Delisting requires demonstrated real-world enforcement outcomes sustained across multiple ICRG review cycles, not a single legislative reform package.", "The economic cost of de-risking during a listing period accrues regardless of the eventual delisting outcome, reinforcing the value of front-loaded institutional reform." ] }, "quiz": [ { "number": 1, "type": "multiple_choice", "points": 1, "question": "A predictive risk-scoring model trained on historically biased case-selection data will typically:", "options": [ "Automatically correct the historical bias", "Reproduce and potentially amplify the historical bias, dressed in statistical objectivity", "Have no relationship to prior case selection", "Only affect cases involving crypto-assets" ], "correctIndex": 1, "correctAnswer": "Reproduce and potentially amplify the historical bias, dressed in statistical objectivity", "rationale": "Models inherit biases present in their training data; mathematical form does not confer neutrality." }, { "number": 2, "type": "multiple_choice", "points": 1, "question": "'Scoring without capacity' describes a failure mode in which:", "options": [ "A model produces no flagged cases at all", "An institution generates more correctly flagged high-risk cases than it can investigate, creating a documented accountability exposure", "Data quality is too poor to run any model", "A model is retired before deployment" ], "correctIndex": 1, "correctAnswer": "An institution generates more correctly flagged high-risk cases than it can investigate, creating a documented accountability exposure", "rationale": "A backlog of correctly flagged but unactioned cases creates a discoverable record that the institution knew of the risk and failed to act." }, { "number": 3, "type": "multiple_choice", "points": 1, "question": "The CJEU's ruling in C-37/20 & C-601/20 (22 November 2022) held that:", "options": [ "Beneficial-ownership registers must be entirely private", "Unrestricted public access to BO registers was a disproportionate interference with EU Charter rights to private life and data protection", "FATF Recommendation 24 is invalid", "CRS reporting violates EU law" ], "correctIndex": 1, "correctAnswer": "Unrestricted public access to BO registers was a disproportionate interference with EU Charter rights to private life and data protection", "rationale": "The Court found unrestricted public access disproportionate under Articles 7 and 8 of the EU Charter, prompting a legitimate-interest-based access model in the later AML Package." }, { "number": 4, "type": "multiple_choice", "points": 1, "question": "FATF's Immediate Outcomes (IOs) are rated on which scale?", "options": [ "Compliant / Largely Compliant / Partially Compliant / Non-Compliant", "High / Substantial / Moderate / Low", "Pass / Fail", "Green / Amber / Red" ], "correctIndex": 1, "correctAnswer": "High / Substantial / Moderate / Low", "rationale": "Effectiveness under the IOs is rated High, Substantial, Moderate or Low, distinct from the Technical Compliance four-point scale." }, { "number": 5, "type": "multiple_choice", "points": 1, "question": "South Africa was placed on the FATF grey list in:", "options": [ "February 2021", "February 2023", "October 2025", "February 2024" ], "correctIndex": 1, "correctAnswer": "February 2023", "rationale": "South Africa was added to the FATF increased-monitoring list in February 2023, and removed in October 2025." }, { "number": 6, "type": "multiple_choice", "points": 1, "question": "Kenya's FATF grey-listing occurred in:", "options": [ "February 2023", "February 2024", "October 2025", "February 2022" ], "correctIndex": 1, "correctAnswer": "February 2024", "rationale": "Kenya was placed on the FATF grey list in February 2024." }, { "number": 7, "type": "multiple_choice", "points": 1, "question": "Capture of the enforcement function is described in this module as particularly harmful because:", "options": [ "It has no effect on FATF ratings", "It provides a legitimating appearance of a functioning system while actively shielding the conduct the system purports to prevent", "It only affects private-sector compliance officers", "It is limited to customs administrations" ], "correctIndex": 1, "correctAnswer": "It provides a legitimating appearance of a functioning system while actively shielding the conduct the system purports to prevent", "rationale": "A captured enforcement function retains the appearance of legitimacy while providing cover for continued abuse, making it worse than having no system at all." }, { "number": 8, "type": "multiple_choice", "points": 1, "question": "An effective whistleblower-protection framework, per this lesson, must address:", "options": [ "Retaliation protection only", "Retaliation, physical safety, independent reporting channels, and career-marginalisation risk together", "Only anonymous online reporting portals", "Compensation for lost bonuses only" ], "correctIndex": 1, "correctAnswer": "Retaliation, physical safety, independent reporting channels, and career-marginalisation risk together", "rationale": "The lesson identifies four distinct risks — retaliatory action, physical threat, reporting-channel independence, and career marginalisation, that must all be addressed." } ], "essayPrompts": [ { "number": 1, "prompt": "Assess whether the CJEU's proportionality reasoning in C-37/20 & C-601/20 offers a transferable framework for non-EU jurisdictions designing beneficial-ownership access regimes, weighing transparency objectives against genuine personal-security and data-protection concerns.", "wordGuide": "1200-1500", "weightingPercent": 30 }, { "number": 2, "prompt": "Compare South Africa's 2023-2025 greylisting trajectory with Nigeria's and Kenya's ongoing action plans, and assess what each case demonstrates about the relationship between institutional capture and FATF Effectiveness ratings.", "wordGuide": "1200-1500", "weightingPercent": 30 }, { "number": 3, "prompt": "Argue for or against the proposition that no risk-scoring or analytics system should be deployed in a fragile-institutional-trust environment without a mandatory, externally-audited bias and capacity-sizing review prior to live deployment.", "wordGuide": "1200-1500", "weightingPercent": 30 } ], "assignment": { "prompt": "Design a complete institutional-integrity annex (1,000-1,400 words) for a national AML/CFT reform programme, covering: (1) a risk-scoring governance checklist addressing bias, capacity-sizing and appeal rights; (2) a BO-register access-tier design informed by CJEU proportionality reasoning; (3) an internal annual self-assessment protocol against IO6 and IO7, and (4) a whistleblower and investigator protection framework addressing all four risk categories identified in this module.", "wordGuide": "2000-2500", "weightingPercent": 35 }, "rubric": { "criteria": [ { "criterion": "Legal and regulatory accuracy", "weight": 25 }, { "criterion": "Typology and mechanism analysis", "weight": 25 }, { "criterion": "Evidence and application to the facts", "weight": 20 }, { "criterion": "Investigative or policy judgement", "weight": 15 }, { "criterion": "Structure, referencing and professional expression", "weight": 15 } ], "bands": [ { "band": "Distinction", "range": "75-100" }, { "band": "Meritorious", "range": "65-74" }, { "band": "Competent", "range": "50-64" }, { "band": "Marginal", "range": "40-49" }, { "band": "Not competent", "range": "0-39" } ], "subMinimum": "40% in the assignment component" }, "exportedAt": "2026-08-14T13:05:13.196Z" }