Goldman Sachs Compliance / Risk Analyst Interview Questions

1.Tell me about a compliance or risk issue that required you to pull in teams outside your own — legal, front office, operations — to actually close it out. How did you manage competing priorities across those groups?

2.Tell me about a time you coached a junior analyst or associate on a compliance or risk concept they were struggling with. What approach did you take, and how did you know it worked?

3.Describe a time you made a risk or compliance call that turned out to be wrong. What did you miss, and how did it change the way you work?

4.Tell me about a compliance or risk monitoring process you owned that wasn't working well. How did you figure out it was broken, and what did you change?

5.Walk me through a time you had to tell a business line, client, or senior stakeholder something they really didn't want to hear on a risk or compliance matter. How did you frame it and what happened?

6.Tell me about a time when a regulatory deadline or risk escalation required you to align multiple teams who weren't naturally working together — say, legal, a trading desk, and operations. What broke down, and how did you get it back on track?

7.Estimate the number of Suspicious Activity Reports Goldman Sachs's AML team might file in a given year across its U.S. operations. Walk me through how you'd build that estimate.

8.A key risk dashboard used by a trading desk shows a metric that's been flat for six months — then it drops 20% in a single week. Nothing obvious changed. How do you figure out whether this is a real risk signal or a data problem?

9.Marquee provides institutional clients with analytics and execution tools. If Goldman Sachs wanted to assess the operational risk exposure created by having a large number of clients directly integrated into internal systems via the platform, how would you frame and size that risk?

10.Goldman Sachs's Transaction Banking platform onboards corporate treasury clients who execute high volumes of cross-border payments. Walk me through how you'd build a risk-tiering model to decide which clients get enhanced due diligence and how often.

11.You're asked to assess whether Goldman Sachs's equities prime brokerage business has adequate concentration risk controls in place. You have access to position data, client agreements, and historical margin call records. How do you structure the analysis, and what would concern you most?

12.A mid-sized sovereign wealth fund that is a significant Goldman Sachs client is flagged by a new third-party adverse media screening tool — the tool has surfaced allegations of links to a government official under corruption investigation in their home country. The relationship generates $50 million in annual revenue and the business is pushing back hard. How do you structure your analysis and what does your recommendation look like?

13.Walk me through how you'd perform a KYC review for a new institutional client onboarding onto a platform like Transaction Banking. What are the key data points you're verifying, and where do the common failure points tend to be?

14.You're reviewing a trading desk's limit utilization report and you notice a position is consistently sitting at 95–98% of its VaR limit every day for three weeks, but never breaching. How do you think about that pattern, and what do you do with it?

15.How would you design a surveillance alert framework for detecting potential insider trading on the equities desk — what signals would you monitor, and how would you reduce false positives without reducing true positive catch rates?

16.Marcus by Goldman Sachs is expanding its personal loan product. Regulators are increasingly scrutinizing fair lending compliance — walk me through how you'd run a disparate impact analysis on the loan approval model, and what you'd do if you found a statistically significant adverse impact on a protected class.

17.FINRA just issued a new exam finding letter to Goldman Sachs citing deficiencies in your best execution monitoring for equities. You have 90 days to respond. How do you scope the remediation, and how do you decide what to fix first?

18.A new EU regulation — say, a DORA-style operational resilience requirement — is coming into force in 18 months and will affect how Goldman Sachs manages third-party technology vendors across its European operations. How do you build a compliance program for it from scratch when you don't yet have an authoritative regulatory text?

19.You're reviewing client onboarding documentation for a mid-sized hedge fund and you notice their stated investment strategy doesn't quite match the trading activity in their existing accounts with us. Nothing is flagged by the system. What do you do?

20.You're doing a routine review of employee personal account trading disclosures and you notice a VP on the equities desk submitted a pre-clearance request for a stock, was denied, and then didn't trade — but three days later their spouse's account shows a purchase of the same stock. How do you handle that?

21.A business line wants to launch a new structured product for private wealth clients in six weeks. Legal and compliance haven't been looped in yet, and the product has embedded derivatives features that might trigger additional suitability and disclosure obligations. How do you approach this?

22.You're running a third-party vendor risk review and you discover that a critical data vendor — one whose feeds go directly into real-time risk systems — has a SOC 2 report with multiple exceptions and hasn't remediated them in two review cycles. The business unit says they can't replace this vendor for at least 12 months. What's your move?

23.You find out through an informal conversation that a senior relationship manager has been sharing draft Goldman Sachs research with a buy-side client before it's published — not through any official channel — apparently to maintain the relationship. The RM dismisses it as 'relationship management.' What do you do, and how do you do it?

24.During a routine model validation review, you find that the credit risk model used to approve limits for corporate counterparties in Transaction Banking was recalibrated 18 months ago by a quant team — but no compliance or model risk sign-off was obtained for the recalibration. The model has been live ever since, and the business is now sitting on $4 billion in approved limits. How do you handle this?

25.Tell me about a time a business line or desk came to you with a request that seemed straightforward, but once you dug in, it turned out to be more complicated than anyone realized. How did you manage their expectations once you knew more?

26.Have you ever had to represent compliance or risk's position in a room where you were clearly the most junior person? How did you hold your ground without undermining the relationship?

27.You're three weeks into a compliance initiative and you realize the project plan you agreed to with the business is no longer realistic — new regulatory guidance just landed and it changes the scope significantly. How do you handle the conversation with the business sponsor?

28.Describe a time when two senior stakeholders — say, a business head and a control function like legal or finance — had genuinely competing views on the right risk or compliance posture for something you owned. How did you navigate being in the middle?

29.You've identified a control gap that affects a revenue-generating product — fixing it properly will require the business to pause new client onboarding for two weeks. The business head says they'll accept the risk and keep running. How do you respond, and what do you do next?

30.A trading desk MD comes to you informally — not through any official channel — and asks you to 'pre-clear' a new product structure before he brings it to the formal new product approval process, because he wants to know if there are any 'showstoppers' before he invests more time. How do you handle that conversation?