The vendor you didn't check.
The worst surprises arrive through a counterparty nobody vetted. One ten-minute habit prevents most of them.
Pass the exam before it's scheduled.
AML, KYC, BSA — the alphabet only matters if it's translated into things your people actually do on a Tuesday.