Swift Risk Assessment & Management 4 — Questions and Answers
Question 1: In the context of SWIFT security, what is Relationship Management Application (RMA) used for?
- Managing nostro account reconciliation schedules
- Controlling which institutions can exchange messages with each other (Correct answer)
- Encrypting message content end-to-end
- Monitoring daily payment volume limits
Correct answer: Controlling which institutions can exchange messages with each other
RMA is a bilateral authorization mechanism that requires both counterparties to explicitly authorize message exchange, preventing unsolicited message flows.
Question 2: Which regulatory framework specifically introduced requirements for banks to identify and assess de-risking impacts caused by withdrawing correspondent banking relationships?
- Basel III Pillar 2
- FATF Guidance on Correspondent Banking (Correct answer)
- MiFID II
- PSD2
Correct answer: FATF Guidance on Correspondent Banking
FATF's guidance on correspondent banking explicitly addresses de-risking, urging banks to manage risk proportionately rather than wholesale exit relationships.
Question 3: A bank's SWIFT back-office system is compromised via a malicious PDF attachment. Under CSP, which mandatory control should have mitigated this attack?
- Internet isolation of the SWIFT infrastructure (Correct answer)
- Quarterly penetration testing
- Annual staff security awareness training
- Encryption of all outbound SWIFT messages
Correct answer: Internet isolation of the SWIFT infrastructure
Mandatory Control 1.1 requires SWIFT-related infrastructure to be segregated from the internet and general IT environment to limit malware infection pathways.
Question 4: What does a SWIFT Business Continuity (BC) plan specifically need to address for messaging infrastructure?
- Redundant SWIFT connectivity and failover procedures for service restoration (Correct answer)
- Staff succession planning for compliance officers
- Currency hedging strategies during outages
- Regulatory capital buffers during system downtime
Correct answer: Redundant SWIFT connectivity and failover procedures for service restoration
BC plans must ensure redundant SWIFT connections and documented failover so payment flows can resume quickly after an outage.
Question 5: A correspondent bank notices that an MT 910 confirmation was received but the corresponding MT 103 was never sent by their institution. What risk event does this most likely indicate?
- Nostro reconciliation break caused by timing differences
- Potential fraud — an unauthorized payment may have been sent in their name (Correct answer)
- Duplicate message due to SWIFT network retry logic
- FX conversion error in the payment chain
Correct answer: Potential fraud — an unauthorized payment may have been sent in their name
An unexpected MT 910 confirmation with no matching outgoing MT 103 is a red flag indicating an unauthorized payment may have been executed using the institution's credentials.
Question 6: Which metric is used in SWIFT gpi to measure the speed and transparency of cross-border payments?
- Value-at-Risk (VaR)
- Service Level Agreement (SLA) adherence rate (Correct answer)
- SWIFT Availability Index (SAI)
- Correspondent Banking Efficiency Ratio (CBER)
Correct answer: Service Level Agreement (SLA) adherence rate
SWIFT gpi measures bank performance against SLA commitments for payment speed, end-to-end tracking, and fee transparency.
Question 7: When assessing a new correspondent banking relationship, which factor in the Wolfsberg Questionnaire (CBDDQ) is most critical for evaluating AML risk?
- The respondent's SWIFT BIC code format
- The respondent's AML/CTF program maturity and governance (Correct answer)
- The number of currencies the respondent supports
- The respondent's IT infrastructure vendor
Correct answer: The respondent's AML/CTF program maturity and governance
The CBDDQ prioritizes understanding the respondent's AML/CTF program, including policies, controls, training, and independent testing, as the core risk indicator.
Swift Risk Assessment & Management 4
In the context of SWIFT security, what is Relationship Management Application (RMA) used for?