Common pitfalls include ineffective transaction monitoring systems (high false positives), insufficient staffing/training, lack of true Risk-Based Approach application, and a failure to update policies promptly with regulatory changes.