Banks and Other Depository Institutions

Banks and Other Depository Institutions Electronic Transfer of Funds Banks have historically been and continue to be important mechanisms in all three stages of money laundering. This section outlines some specific areas of interest and concern for money laundering through banks and other depository institutions. An electronic transfer of funds is any transfer of funds that is initiated by electronic means, such as internet-based transfers, an automated clearing house (ACH), an automated teller machine (ATM), mobile telephones, and other devices. Electronic funds transfers can happen within a country and across borders. Trillions of dollars are transferred in millions of transactions each day, because it is one of the fastest ways to move money. Systems such as the US Federal Reserve wire network, or Fedwire, the Society for Worldwide Interbank Financial Telecommunication (SWIFT), and the Clearing House Interbank Payments System (CHIPS) move millions of wires and transfer messages daily. As such, illicit fund transfers can be easily hidden among the millions of legitimate transfers that occur each day. For example, money launderers might initiate unauthorized domestic or international electronic transfers of funds—such as ACH debits or cash advances on a stolen credit card—and place the funds into an account established to receive the transfers. Another example is stealing credit cards and using the funds to purchase merchandise that can be resold to provide the criminal with cash. Money launderers also use electronic transfers of funds in the layering stage of the laundering process. The goal is to move the funds from one account to another, from one bank to another, and from one jurisdiction to another with each layer of transactions—making it more difficult for law enforcement and investigative agencies to trace the origin of the funds. To avoid detection at any stage, money launderers can take basic precautions, such as varying the amounts sent, keeping the transfers relatively small and under reporting thresholds, and, when possible, using reputable organizations. The processes in place to verify electronic transfers of funds have been tightened. Transaction monitoring software providers have developed sophisticated algorithms to help detect and trigger alerts that might indicate money laundering or other suspicious activity using electronic transfers of funds. However, no system is foolproof. Following are some indicators of money laundering using electronic transfers of funds: • Funds transfers occur to or from a financial secrecy haven or high-risk geographic location without an apparent business reason or when the activity is inconsistent with the customer’s business or history. • Large incoming funds transfers are received on behalf of a foreign client, with little or no explanation or apparent reason. • Checks and money orders are used to receive many small, incoming transfers of funds or to make deposits. Upon credit to the account, all or most of the transfers or deposits are wired to another account in a different geographic location in a manner inconsistent with the customer’s business or history. • Funds activity is unexplained, repetitive, or reveals unusual patterns. • Payments or receipts are received that have no apparent link to legitimate contracts, goods, or services. • Funds transfers are sent or received from the same person to or from different accounts. Remote Deposit Capture Remote deposit capture (RDC) is a product offered by banks that allows customers to scan a check and transmit an electronic image to the bank for deposit. This product offers increased convenience for customers because they no longer need to make a trip to the bank or an ATM to deposit checks. It is common for banks to allow individuals to deposit photos of checks taken with mobile phones. RDC decreases the cost to process checks for banks and is part of a gradual transition away from paper-based transactions. RDC is also increasingly used in correspondent banking, because it streamlines the deposit and clearing process. Correspondent banking is the provision of banking services by one bank to another bank. The convenience provided by RDC can be abused by money launderers because they no longer need to go into the bank and risk detection. Money launderers who have RDC capabilities can move checks with ease through an account and possibly set up multiple imaging devices (e.g., multiple scanners and permitted mobile phones), enabling them to allow other criminals to process checks through the system. A money launderer might even arrange for someone else to set up an account and provide him with the ability to deposit checks. Without proper controls, RDC can also be misused to facilitate violations of sanctions requirements, for example, by processing transactions in a sanctioned country. Although RDC can be used for money laundering, the more prominent risk relates to fraud. Because RDC minimizes human intervention in reviewing cleared items, it decreases the ability to identify potential fraud indicators, such as an altered check and multiple deposits of the same item. Often, the resulting fraud is not prevented but rather detected after it has already occurred. To control the risks associated with RDC, efforts must be made to integrate RDC processing into other controls, such as monitoring and fraud-prevention systems. In fact, this integration should occur with any new product offered by an organization. This includes ensuring that items submitted via RDC are reviewed for sequentially numbered checks and money orders without payees, that the total volume of activity processed for an account via RDC is incorporated into the overall transaction monitoring system, that appropriate limits are placed on a customer’s ability to deposit checks via RDC, that the product is offered to customers to whom it is appropriate, and that appropriate action is taken quickly when fraud is detected via RDC items. Correspondent Banking Correspondent banking is an arrangement whereby one bank acts as the agent of another bank in a foreign country. A local, or respondent, bank has customers who want banking services in a foreign country, so it contracts with a foreign correspondent bank to provide those services. By establishing multiple correspondent relationships, a local bank can undertake international financial transactions for itself and its customers in jurisdictions where it has no physical presence. Large international banks often act as correspondents for thousands of other banks. The indirect nature of correspondent banking relationships means that the correspondent bank provides services for individuals and entities for which it has neither verified the identities nor obtained any firsthand knowledge. The amount of money that flows through correspondent accounts can pose a significant threat, because the correspondent processes large volumes of transactions for the respondent's customers. Correspondent banking is vulnerable to financial crime, especially because correspondent banks do not know the customers of the respondent directly and rely on the respondent bank’s internal controls. In addition, less information is available to help the correspondent recognize suspicious activity. Before establishing correspondent accounts, a bank should identify the respondent bank’s owners and understand the nature of its regulatory oversight. According to the Wolfsberg Group, a bank’s due diligence on a respondent bank should be based on the respondent’s risk profile and the nature of the business relationship with that respondent bank. Due diligence should address specific risk indicators, such as the respondent bank’s geographic risk, ownership and management structures, customer base, and products and services offered. Furthermore, the determination of the level and scope of due diligence that is required on a respondent bank should be made after considering the relationship between the respondent bank and its ultimate parent (if any). If the parent does not exercise substantial and effective control, due diligence should be conducted on both the respondent and the parent. The Wolfsberg Group has a Correspondent Banking Due Diligence Questionnaire that provides a standardized set of questions that can be used to perform due diligence. Low-risk respondent banks might be offered a broad range of services, such as cash management—for example, interest-bearing accounts in a variety of currencies, international funds transfers, check clearing, payable-through accounts, and foreign exchange. High-risk respondent banks might be restricted to noncredit cash-management services. The risks of correspondent banking include: • The correspondent does not or cannot conduct typical due diligence to know the customers of the respondent (Know Your Customer’s Customer). • The correspondent does not have data on respondent transactions that typically enable transaction monitoring controls to identify unusual patterns. • The correspondent can identify the respondent’s regulators, but not always the degree of supervision to which the respondent is subject. • The correspondent might have limited information on the respondent’s anti-financial crime controls—perhaps through a questionnaire—yet still needs to rely on the respondent to have and use sufficient, effective controls on its customers. • Some respondents are, themselves, correspondents to third banks, a practice called “nesting.” Nested accounts further shield correspondent banks from knowing the parties involved. Correspondent banking (Case example: Methods of money laundering) In July 2020, the New York State Department of Financial Services (DFS) issued Deutsche Bank AG, its New York branch, and Deutsche Bank Trust Company Americas (collectively Deutsche Bank) a US$150 million penalty. DFS cited significant compliance failures in connection with the bank’s relationship with disgraced American financier Jeffrey Epstein and its correspondent banking relationships, including those with Danske Bank Estonia (Danske) and FBME Bank. In the case of Danske Bank Estonia and FBME bank, Deutsche Bank was found to have failed to monitor these banking clients, despite rating its correspondent banking relationships with them both as high risk. Billions of dollars in suspicious transactions passed through Deutsche Bank’s accounts and, in the case of Danske, significant flows were linked to money laundering by Russian oligarchs. Deutsche Bank’s internal compliance controls had flagged concerns with FBME as early as 2005 and with Danske Bank Estonia from the start of the relationship in 2007. However, these concerns did not result in timely actions to address the identified risks. In 2005 Deutsche Bank rated FBME bank as high risk, yet Deutsche Bank identified 826 suspicious transactions associated with FBME Bank after that rating. FBME Bank declined to respond to Deutsche Bank’s queries regarding the ultimate beneficial owners (UBOs) of FBME Bank’s corporate clients. In one instance, the US authorities determined that the UBO was a Russian businessman associated with a Syrian military research and development organization. Deutsche Bank exited the relationship in 2014 after the Financial Crimes Enforcement Network (FinCEN) mandated all banks in the US to cease relationships with the bank. Deutsche Bank was repeatedly warned of AML issues linked to nonresident accounts at Danske Estonia, including those with links to Russia. In 2010 Deutsche Bank increased the risk score for the relationship with Danske Estonia to the highest level because it continued to see no improvements in the bank’s nonresident portfolio. In 2013 and 2014, Deutsche Bank compliance staff recommended that the relationship be exited, but no action was taken until 2015. Over US$150 billion was routed from Danske Bank Estonia through Deutsche Bank. Deutsche Bank identified 340 suspicious transactions linked to Danske Bank Estonia’s US correspondent accounts with Deutsche Bank. The DFS determined that Deutsche Bank’s failures were caused by inadequate AML/CTF policies and procedures for its correspondent banking accounts. The correspondents failed to establish sufficiently specific criteria to trigger termination of relationships, provide practical guidance to staff on how to implement verification of respondents’ UBOs, and act on identified red flags. Key takeaways • Senior management support is essential for compliance officers to effectively execute their duties. • Organizations that ignore red flags associated with a customer relationship can suffer significant reputational, regulatory, and financial consequences. • Nested accounts are high-risk because o Correspondent banks should include periodic reviews of their respondent bank’s AML/CFT framework as part of their larger AML/CFT framework. o Correspondent banks need to undertake risk assessments and ensure that their policies and procedures regarding respondent bank relationships and their transactions are adequate to mitigate against identified risks, especially in high-risk relationships. Payable-Through Accounts In some correspondent relationships, the respondent bank’s customers are permitted to conduct their own transactions—including sending wire transfers, making and withdrawing deposits, and maintaining checking accounts— through the respondent bank’s correspondent account without first clearing the transactions through the respondent bank. Those arrangements are called payable-through accounts (PTAs). In a traditional correspondent relationship, the respondent bank takes orders from its customers and passes them on to the correspondent bank. In these cases, the respondent bank has the ability to perform some level of oversight prior to executing the transaction. PTAs differ from typical correspondent accounts in that the foreign bank’s customers have the ability to directly control funds at the correspondent bank. PTAs can have a virtually unlimited number of subaccount holders, including individuals; commercial businesses; finance companies; exchange houses, or casas de cambio; and even other foreign banks. The services offered to subaccount holders and the terms of the PTAs are specified in the agreement signed by the correspondent and respondent banks. PTAs held in the names of respondent banks often involve checks encoded with the bank’s account number and a numeric code to identify the subaccount, which is the account of the respondent bank’s customer. Sometimes, however, the identification of the subaccount holders is not given to the correspondent bank. Elements of a PTA relationship that can threaten a correspondent bank’s AML/CFT defenses include the following: • PTAs with foreign institutions licensed in offshore financial service centers with weak or under-developed bank supervision and licensing laws • PTA arrangements in which the correspondent bank regards the respondent bank as its sole customer and fails to apply its customer due diligence (CDD) policies and procedures to the customers of the respondent bank • PTA arrangements in which subaccount holders have currency deposit and withdrawal privileges • PTAs used in conjunction with a subsidiary, representative, or other office of the respondent bank, which might enable the respondent bank to offer the same services as a branch without being subject to supervision Use of payable-through accounts (Case example: Methods of money laundering) Payable-through accounts (PTA) are considered high risk because they can be used to facilitate money laundering, terrorist financing, and sanctions evasion. The misuse of PTAs significantly declined after many financial institutions implemented strict controls regarding their use by correspondent banking customers, based on individual and country risk. Organizations also established stringent processes and procedures concerning the scope and nature of permitted PTA activities, due diligence requirements, and associated disclosures. Recent cases of PTA misuse are rare, but an historical case provides a clear example. Lombard Bank Ltd, a bank licensed by the South Pacific island of Vanuatu, opened a correspondent PTA at American Express Bank International (AEBI) in Miami, Florida. AEBI permitted the bank to have multiple authorized signatures on the account. Lombard customers had no relationship with AEBI. However, Lombard offered its Central American customers nearly full banking services through its PTA at AEBI. The customers were even given checkbooks that allowed them to deposit and withdraw funds from Lombard’s PTA. This is how the misuse of PTAs worked: Lombard’s PTA subaccount holders brought cash deposits to Lombard representatives in four Central American countries. Lombard couriers would then transport the cash to the bank’s Miami affiliate, Lombard Credit Corporation, for deposit in the PTA at AEBI. Lombard customers also brought cash to the Lombard office in Miami, which was located in the same building as AEBI. That cash was also deposited in AEBI’s PTA. For two years, ending in June 1993, as much as US$200,000 in cash was received by Lombard’s Miami affiliate on 104 occasions. AEBI did not know the source of the cash being deposited by Lombard’s customers into the PTA. This fact raised significant AML/CFT compliance concerns related to KYC, due diligence, recordkeeping, and regulatory filing requirements. In 1994, AEBI paid a multi-million-dollar fine for its connection to money laundering by a Mexican drug cartel. The organized crime group imported significant volumes of Colombian-origin drugs into the US and used AEBI's PTAs to launder the money. Key takeaways • PTAs often do not know the source of funds and customers’ identities. • Because PTAs can be offered to an unlimited number of subaccount holders, the exposure of correspondent banks to financial crime is very high. • When correspondent banks offer PTAs, they should set clear limits on their use, depending on internal policies and the risk profile of the respondent. Concentration Accounts Concentration accounts are internal accounts established to facilitate the processing and settlement of multiple or individual customer transactions within the bank, usually on the same day. They do this by aggregating funds from several locations into one centralized account (i.e., the concentration account). Concentration accounts are also known as special-use, omnibus, settlement, suspense, intraday, sweep, and collection accounts. They are frequently used to facilitate transactions for private banking, trust and custody accounts, funds transfers, and international affiliates. Money laundering risks can arise in concentration accounts when the customer-identifying information, such as name, transaction amount, and account number, is separated from the financial transaction. When separation occurs, the audit trail is lost, and accounts can be misused or administered improperly. Banks that use concentration accounts should implement adequate policies, procedures, and processes covering operation and recordkeeping for these accounts, including: • Requiring dual signatures on general ledger tickets • Prohibiting direct customer access to concentration accounts • Capturing customer transactions in the customers’ account statements • Prohibiting customers’ knowledge of concentration accounts and their ability to direct employees to conduct transactions through these accounts • Retaining appropriate transaction and customer identification information • Frequently reconciling accounts by an individual who is independent of the transactions • Establishing a timely discrepancy-resolution process • Identifying and monitoring recurring customer names Private Banking Private banking is an extremely lucrative and competitive global industry. Since the 2008 financial crisis, global regulators have placed greater scrutiny on private banks and their services. Private banking provides highly personalized and confidential products and services to wealthy clients at fees that are often based on “assets under management.” Private banking often operates semi-autonomously from other parts of a bank. Fierce competition among private bankers for the high-net-worth individuals who are their main clientele has given rise to the need for tighter government controls worldwide. Competition brings increased pressures on relationship managers and marketing officers to obtain new clients, increase their assets under management, and contribute a greater percentage to the net income of their organizations. In addition, the compensation paid to most relationship managers in private banking is based largely on the assets under management that they bring to their organizations. The following factors can contribute to the vulnerabilities of private banking to money laundering: • Perceived high profitability • Intense competition • Powerful clientele • High level of confidentiality • Close trust developed between relationship managers and their clients • Commission-based compensation for relationship managers • Culture of secrecy and discretion developed by the relationship managers for their clients • Role of relationship managers as client advocates to protect their clients • Use of private investment companies by clients to reduce transparency of their beneficial owners • Clients maintaining personal and business wealth in numerous jurisdictions, including offshore jurisdictions • Clients’ ability to utilize and control numerous legal entities for personal and family estate planning purposes Private banking (Case example) In 2015, the British regulator, the Financial Conduct Authority (FCA), fined Barclays global bank for AML/CFT violations. These regulatory breaches related to a £1.88 billion transaction that Barclays arranged and executed in 2011 and 2012 for several ultra-high net-worth customers. The customers involved were politically exposed persons (PEPs) and should therefore have been subjected to enhanced levels of due diligence and monitoring by Barclays. However, Barclays did not follow its standard policies and procedures. In fact, it applied a lower level of due diligence than was required for customers with lower risk profiles. The FCA fined Barclays more than £72 million, which included the amount of revenue that Barclays generated from the transaction (£52 million) and penalties. On the date of the fine, it was the highest AML-related fine the FCA had ever issued. Although the FCA concluded that the transaction was not linked to financial crime activity, it assessed the transaction as high risk due to the involvement of private banking, ultra-high net-worth customers, and PEPs, among other factors. High-risk transactions and customers require EDD measures, which Barclays failed to conduct. Barclays’ policies and procedures required EDD. However, staff linked to the transaction did not follow them, and senior management failed to oversee the handling of the associated financial crime risks. Investigators claimed Barclay’s sought profit over compliance, onboarding the clients as quickly as possible to generate £52.3 million in revenue. Barclays did not obtain the necessary information from the customers to comply with financial crime requirements. Staff failed to establish the purpose and nature of the transaction and did not sufficiently corroborate the source of wealth and funds for the customers and transaction. Barclays agreed to keep details of the transactions strictly confidential, even within the firm, and to compensate the customers up to £37.7 million if it failed to comply with these confidentiality restrictions. Few people knew of the existence and location of the firm's due diligence records, which were maintained in hard copy and not on Barclays' digital systems. This impacted how the customer relationship could be monitored on an ongoing basis and meant that Barclays could not respond promptly to the FCA’s request for information. The Barclays case exemplifies the fact that business interests should never take precedence over compliance with laws and regulations. The close relationships established in private banking often require a high degree of confidentiality. However, compliance checks should not be reduced or minimized. Strong AML/CFT compliance programs are successful only if organizations follow the policies and procedures that support them. Failure to follow regulations can lead to fines, even if no actual financial crime event occurred. Key takeaways • Business interests should never take precedence over compliance with laws and regulations. • The close relationships established in private banking often require a higher degree of confidentiality, but this should not reduce or minimize the required compliance checks. • Strong AML/CFT compliance programs need organizations to follow the policies and procedures that support them. • Failure to follow a robust compliance plan can lead to fines, even if no actual financial crime event occurred. Use of Private Investment Companies in Private Banking In offshore and international financial centers, private banking customers are often nonresidents; that is, they conduct their banking in a country other than the one in which they reside. Their assets might move overseas, where they are held in the name of corporate vehicles such as private investment companies (PICs) established in secrecy havens. PICs are corporations established by individual bank customers and others in offshore jurisdictions to hold assets. They are shell companies formed to maintain clients’ confidentiality and serve various tax- and trust-related purposes. PICs have been an element of many high-profile laundering cases because they are effective laundering vehicles. The secrecy laws of the offshore havens where PICs are often established can conceal the true identities of customers’ beneficial owners. As an additional layer of secrecy, some PICs are established by company formation agents with nominee directors who hold titles to companies for the benefit of individuals. These beneficial owners could remain undisclosed and sometimes are subject to attorney-client privilege and other similar legal safeguards. Many private banks establish PICs for their clients, often through an affiliated trust company in an offshore secrecy haven. Criminals can establish complex shell company networks in which a company registered in one offshore jurisdiction might be linked to companies and accounts in other jurisdictions. Use of PICs in private banking (Case example: Methods of money laundering) In 2014, Israeli-based Bank Leumi admitted that it had assisted more than 1,500 US taxpayers in hiding their assets in Bank Leumi’s offshore affiliates in Switzerland and Luxembourg. According to reports, for several years Bank Leumi sent private bankers to the United States to meet with its US clients to discuss their offshore portfolio and tax-mitigation strategies. As part of this strategy, the bank assisted in organizing nominee corporate entities registered in Belize and other offshore jurisdictions to hide their clients’ private offshore accounts and maintained several US clients’ accounts under assumed names or numbered accounts. Bank Leumi also provided “hold mail” services and offered loans to its US clients that were collateralized by their offshore assets, which were not declared to US tax authorities. As a result of the settlement, Bank Leumi was assessed US$270 million in fines and ordered to cease providing private banking and investment services for all US clients and accounts with US beneficial owners. This settlement led to Bank Leumi selling its affiliates Bank Leumi Private Bank and Bank Leumi (Luxembourg). Key takeaways • Nominee corporate entities registered in high-risk offshore jurisdictions are an attractive vehicle for evading tax obligations. • Care should be taken when dealing with assets associated with nonnationals to reduce the risk of them being moved or placed to deliberately avoid tax. • Facilitating tax evasion is a serious offense that can lead to large fines and negatively impact a regulated firm’s ability to do business with certain customers and jurisdictions. Politically Exposed Persons According to FATF, there are three types of politically exposed persons (PEPs). 1. Foreign PEPs: Individuals who are or have in the past been entrusted with prominent public functions by a foreign country (e.g., heads of state or of government; senior politicians; senior government, judicial, and military officials; senior executives of state-owned corporations; and important political party officials). 2. Domestic PEPs: Individuals who are or have in the past been entrusted domestically with prominent public functions (e.g., heads of state or of government; senior politicians; senior government, judicial, and military officials; senior executives of state-owned corporations; and important political party officials). 3. International organization PEPs: Individuals who are or have in the past been entrusted with a prominent function (e.g., managing director, secretary general, executive director, chairperson, and president) by an international organization, such as the United Nations’ six principal organs and multiple specialized agencies, the IMF, the World Bank, the North Atlantic Treaty Organization, and the Organization of American States (OAS), among many others. Relatives and close associates of PEPs are also considered to be PEPs. The definition of PEPs is not intended to cover middle ranking and more junior individuals in the above categories. PEPs have been the source of problems for several regulated organizations, particularly with regard to reputational risk, as the following examples show: • Eldar Mahmudov: The former minister of national security of Azerbaijan from 2004 to 2015, Mahmudov accumulated substantial real estate holdings in the UK, Spain, Luxembourg, Lithuania, and Cyprus, many of them in his children's names. Investigative journalists estimate his total worth at over €100 million. The majority of his assets are held by the exofficial’s son and daughter. • ABLV Bank: In 2018, the Latvian bank was identified by FINCEN as a financial institution of primary money laundering concern, pursuant to Section 311 of the USA PATRIOT Act. According to FINCEN, it had facilitated money laundering for years on behalf of corrupt government officials and other PEPs from Azerbaijan, Russia, and Ukraine, namely by funneling billions of dollars in the proceeds of corruption and asset stripping through shell company accounts. • Najib Razak: The former prime minister of Malaysia (2009-2018) was convicted of abuse of power and money laundering in July 2020 and sentenced to 12 years in prison. He was found guilty of having been the primary beneficiary of large-scale embezzlement at 1Malaysia Development Berhad (1MDB), a state-owned development bank. Billions of dollars were fraudulently withdrawn from 1MDB to fund purchases of highend real estate and luxury goods, and to make investments through various shell firms. • Diezani Alison-Madueke: The former Nigerian minister of petroleum resources was accused of siphoning off billions of dollars from Nigerian states' coffers. In 2017, the US Department of Justice seized US$145 million worth of properties controlled by Alison-Madueke, including a US$50 million apartment in New York City and an US$80 million yacht. • Riad Salameh: In 2021, Switzerland, France, and Luxembourg opened criminal investigations into Lebanon’s long-standing central bank governor. In 2020, investigative media reported on Salameh’s more than US$100 million worth of domestic and overseas assets. In one example, a company tied to the governor bought a stake in his son’s wealth-management business and later sold it for a profit to a Lebanese bank under Salameh’s supervision. • Lai Xiaomin: In 2021, former chairman (2012-2018) of Huarong, one of China’s largest state-controlled asset-management firms, was sentenced to death by a Chinese court for accepting US$227 million in bribes and associated money laundering. He had allegedly invested a portion of the proceeds in gold bars and luxury cars, and made large deposits into his mother’s bank account. • Petrobras: A global commodities trader agreed in 2020 to pay US$135 million to resolve a US Department of Justice investigation into a longrunning bribery scheme in Latin America. The scheme involved kickbacks to senior executives at Petrobras, Brazil’s national oil company, in exchange for confidential pricing and competitor information. Bribes were paid under fraudulent consulting agreements by and to shell companies, using fake invoices and offshore accounts. • Alexander Shestun: A Russian court in 2020 sentenced the former head of Serpukhov District in the Moscow region to 15 years in prison. The court seized 106 real estate properties, 642 land plots, seven vehicles, precious metals, collection coins, and cash from bribes paid to Shestun by the local business community. Structuring Designing a transaction to evade triggering a reporting or recordkeeping requirement is called structuring. Structuring is one of the most common money laundering methods. It is a crime in many countries and must be reported by filing a suspicious activity report (SAR). The individuals engaged in structuring may be “runners” hired by the launderers, that is, individuals who travel from bank to bank depositing cash and purchasing monetary instruments in amounts under reporting thresholds. Structuring can be done in many settings and industries, including banking, money services businesses, and casinos. “Smurfing” is a common structuring technique that involves multiple individuals making multiple cash deposits and/or buying multiple monetary instruments or bank drafts in amounts under the reporting threshold to evade detection. Cash structuring example Structuring is one of the most commonly reported forms of unusual activity. Well-known examples of structure include: • A customer breaks a large transaction into two or more smaller transactions. Henri wants to conduct a transaction involving $18,000 in cash. However, knowing that depositing it all at once would exceed his country’s cashreporting threshold of $10,000 and trigger the filing of a currency transaction report, he goes to three different banks and deposits $6,000 in each. • A large transaction is broken into two or more smaller transactions that are conducted by two or more people. Jennifer wants to send a $5,000 money transfer. Knowing that in her country there is a threshold of $3,000 for the recording of funds transfers, she sends a $2,500 money transfer and asks her friend to send another $2,500 money transfer. • An individual sends his fortune to another country. Mr. Lee, a wealthy Chinese businessman, sends his gained wealth of US$1 million in sums of US$40,000 via friends and business contacts to a British bank in London. The reason he does not deposit it into his own bank account in London is that the Chinese government has currency controls in place for transactions over US$50,000 abroad. Foreign money brokers structure transactions by following these steps: 1. A structurer, who is acting for a foreign money broker, opens several checking accounts in country A using real and fictitious names. Sometimes the structurer uses identification documents of deceased people supplied by the money brokers. 2. With funds supplied by the money brokers, the structurer opens the accounts with inconspicuous amounts, usually in the low four figures. 3. To allay bank suspicions, the money brokers sometimes deposit extra funds to cover their living expenses and make the accounts appear legitimate. 4. Once the accounts are opened, the structurer signs the newly issued checks, leaving the payee, date, and amount lines blank. 5. The structurer sends the signed blank checks to the money broker in country B, usually by courier. 6. A structurer might open as many as two dozen checking accounts in this fashion. It is not uncommon for brokers to have more than 20 of these checking accounts in country A available at any given time. 7. The checking accounts usually accumulate only a few thousand dollars before they are cleared out by checks drawn by the money brokers to pay for exports from country A to country B’s money brokerage customers. 8. The availability of hundreds of these accounts to country B’s money brokers leaves open the possibility that tens of millions of dollars could pass through them each year. Structuring (Case example: Methods of money laundering) In June 2018, Commonwealth Bank (CBA) agreed to pay a AUD700 million settlement plus legal costs. At the time, this was the highest penalty in Australian corporate history for breaches of AML/CFT laws. The Australian Transaction Reports and Analysis Centre (AUSTRAC) accused the bank of serious systemic failures to report suspicious deposits, transfers, and accounts. Those failures allowed millions of dollars to be laundered on behalf of drug importers through a method known as structuring. Structuring is the illegal act of splitting cash deposits or withdrawals into smaller amounts, or purchasing monetary instruments, to stay under a currency reporting threshold. Money launderers use structuring to avoid triggering a filing by a financial institution. In Australia, banks are required to file threshold transaction reports (TTRs) to AUSTRAC for transactions of AUD10,000 or more within 10 business days. CBA failed to report over 53,000 transactions that were run through intelligent deposit machines (IDMs) from 2012 to 2015. IDMs are a form of ATM that accepts cash and check deposits. These deposits are automatically counted, credited into CBA accounts, and made available for immediate transfer, domestically and internationally. AUSTRAC alleged that CBA did not limit the number of transactions a customer could make per day; its IDMs allowed up to 200 bills per transaction. A criminal who inserted AUD100 bills could deposit up to AUD20,000 in one transaction, which is well above the mandatory reporting limit. IDMs also allow anonymous cash deposits. A card from any financial institution could deposit funds into a CBA account. That means a criminal could potentially deposit millions of dollars through a machine in one day anonymously. Because the money appears instantly, a user could immediately transfer the money to another account, including an offshore account. In May and June 2016, more than AUD1 billion in cash moved through CBA's IDMs. Many of the transactions were deposited in amounts that fell below the threshold transaction limit. Prior to using IDMs, CBA did not carry out an AML/CFT risk assessment. Despite an exponential rise in cash deposits and alerts raised by its internal transactional monitoring system, CBA did not conduct a subsequent risk assessment. In addition, CBA breached its obligation to perform checks on 80 suspicious customers. Even when structuring was suspected on CBA accounts, the institution failed to monitor these customers and conduct EDD, as required when a suspicion is formed. Key takeaways • Structuring can involve many channels, such as IDMs. • Adequate controls must be in place to ensure proper monitoring and reporting. • New technologies need to be critically assessed for AML/CFT risks. • Organizations need to limit the number of customers’ daily transactions and the number of bills per transaction. Microstructuring Microstructuring is another method of placing large amounts of illicit cash into the financial system. It is essentially the same concept as structuring, although it is done at a much smaller level. Instead of taking $18,000 and breaking it into two deposits to evade reporting requirements, the microstructurer breaks it into 20 deposits of approximately $900 each, making the suspicious activity extremely difficult to detect. In the case of a Colombian drug cartel, the cash proceeds of US drug sales were deposited into accounts in New York with linked ATM cards, which were provided to associates in Colombia. Deposits were made on a regular schedule, with the Colombian associates withdrawing the funds as they were deposited and giving them to the drug lords. In one case in New York, an individual was trailed by law enforcement authorities as he went from bank to bank in Manhattan. When they stopped him, he had US$165,000 in cash. Microstructuring red flags include: • The use of counter deposit slips instead of preprinted deposit slips • Frequent activity in an account immediately following the opening of the account with only preliminary and incomplete documentation • Frequent visits to make cash deposits of nominal amounts that are inconsistent with typical business or personal banking activity • Cash deposits followed by ATM withdrawals, particularly in high-risk countries • Cash deposits made into business accounts by third parties with no apparent connection to the company Credit Unions and Building Societies Credit unions, which are also known as building societies in some jurisdictions, are not-for-profit member-owned-and-operated democratic financial cooperatives. Credit unions do not have clients or customers; rather, they have members who are also owners. Credit unions serve only the financial needs of their members and are governed by a “one-member, one-vote” philosophy. A member must purchase an initial capital share of the credit union, permitting him to access the products and services offered by the credit union. Credit union membership is based on a common bond, a linkage shared by savers and borrowers who belong to a specific community, organization, religion, or place of employment. Credit unions can vary significantly in both size and complexity. Some credit unions have a few hundred members, and others have hundreds of thousands of members with tens of billions of dollars in assets under management. Some credit unions focus on meeting only a few niche needs of their members, while others offer a full suite of products and services to rival most retail banks. Most credit unions focus primarily on servicing personal banking relationships from within their community. Depending on their member eligibility model, some also facilitate memberships for small-to-medium-sized corporate and entity account holders, although credit unions are prohibited from doing so in some jurisdictions. Generally, credit unions do not participate in trade-based financing, facilitate correspondent banking relationships, or maintain large corporate relationships, particularly those with international banking needs. In many jurisdictions, credit unions rely on credit union centrals for a variety of services. A credit union central is best defined as a trade association for credit unions; it is owned by its member credit unions and helps to serve many of their financial needs. Services might include those related to capital liquidity; research, training, and advocacy with respect to regulatory obligations; shared operational and back-office processes, such as check clearing; and electronic funds transfer (EFT) processing. In general, they help to negotiate shared contracts for common services, allowing many smaller credit unions to leverage economies of scale that they would not otherwise be able to do. With respect to regulatory requirements and oversight, credit unions operate very similarly to banks in most jurisdictions. They have capital, liquidity, riskmanagement, recordkeeping, and reporting obligations similar to banks, although there might be minor differences between institutions that are subject to the oversight of regional versus federal regulators and regulations. Because credit unions are included under FATF’s definition of a financial institution, national AML/CFT regimes that follow FATF’s recommendations treat credit unions similarly to banks. The United Kingdom’s Joint Money Laundering Steering Group (JMLSG) states in its sectoral guidance that credit unions potentially pose lower money laundering and terrorist financing risks, because they typically have a restricted or localized customer base and offer fewer products and services, with more limitations, than retail banks. Credit unions are also less exposed to third-party transfers. However, the guidance notes that, while their limited functionality and flexibility makes them lower risk for money laundering, these restrictions might not fully deter potential terrorist financiers. The guidance elaborates on how a risk-based approach should be considered for credit unions and lists potential risk indicators to take into consideration. One risk factor highlighted is adult parents or guardians who use a child’s account to launder funds. Other risk factors include allowing transfers to or from third parties; frequent cash payments; customers engaging in large one-time transactions; unusual loans or savings transactions (e.g., early repayment of a loan from an unknown income source); and reluctance from a customer to provide evidence of identity or information about the purpose or nature of the business relationship. Given the services offered by credit unions and their connections to employers, benefits providers, and schools, it is important to consider whether a customer might have a reasonable explanation for not having suitable ID and whether they might be considered “financially excluded,” i.e., unable to access the traditional banking system. The guidance provides examples, such as a letter from the employer or school, which can help to identify someone who is financially excluded. Ongoing monitoring can potentially be easier for credit unions, especially if they are smaller, because there is a narrower range of expected activity to monitor against, and transactions are often processed manually, making it easier to identify unusual activity. Additionally, smaller credit unions have fewer organizational hurdles to overcome when reporting suspicious activity to the nominated officer.