Investigations Initiated by the Financial Organization

Conducting and Responding to Investigations This chapter discusses the various channels through which financial organizations receive information with which to initiate investigations and explains the steps they should take to ensure that investigations are conducted thoroughly and effectively. Investigations Initiated by the Financial Organization Sources of Investigations Investigations can be initiated from proactive monitoring for potentially suspicious activity and reactive measures taken to address regulatory findings, referrals, and other recommendations. Common investigation initiators include: • Regulatory recommendations and official findings • Transaction monitoring rules designed to detect and trigger alerts on potentially suspicious activity • Referrals from customer-facing employees regarding potentially suspicious activity • Information obtained from internal hotlines • Negative media information • Receipt of a governmental subpoena, search warrant, or other law enforcement request Regulatory recommendations and official findings Financial organizations often initiate investigative efforts based on regulatory findings and recommendations. These efforts could result in the creation of new ongoing monitoring or serve as one-time reviews to address specific questions or observations. Most importantly, investigations that are initiated as a result of regulatory findings should be clearly documented and designed to ensure that all aspects of the findings are addressed within the time frame (if any) provided by the issuing body. Moreover, senior management or higherlevel professionals should be informed of the findings of the regulatory review, the status of measures to address them, and their final disposition to ensure the financial organization appropriately remediates the findings or recommendations. Transaction monitoring Financial organizations should establish a program to regularly monitor transactions to proactively identify potentially suspicious activity. Common approaches to transaction monitoring include the creation of in-house, customizable transaction monitoring rules or engaging a third-party vendor to assist with the development and implementation of automated rules. Financial organizations should use a risk-based approach to designing transaction monitoring rules that considers the size of the organization, products offered, and features of those products. The organization should also have policies and procedures for monitoring for suspicious activity and clearly specify the parameters and thresholds that are set to trigger an investigation. These policies should be regularly reviewed and updated to account for changes and enhancements to the monitoring rules program. The Wolfsberg Group noted in its Statement on Monitoring, Screening, and Searching that an organization’s transaction monitoring framework should be aligned to the risk of its business model, the products and services offered, and its customer base, and it should be embedded in the organization’s AML program. The document additionally discusses types of monitoring, typology reviews, and staff training. Transaction monitoring rules should be regularly reviewed and tuned accordingly to ensure that they continue to operate as designed. Tuning practices may include evaluating the output of monitoring rules, examining specific thresholds and conducting above and below-the-line testing to determine whether rule adjustments are necessary. Referrals from customer-facing employees In addition to automated, ongoing transaction monitoring, financial organizations often have a mechanism by which customer-facing employees can refer matters to be investigated for potentially suspicious activity. Depending on the size of the organization, there could be manual referral processes via email or telephone, or an internal reporting system that routes the referrals to the appropriate investigative teams. For example, a financial organization might have a specific, internal, online form that can be completed by branch personnel when they identify unusual activity. Examples of such activity include a customer who structures transactions, currency that contains an odor indicative of controlled substances, and inconsistent responses by the customer to questions regarding the source of large cash deposits. Upon completion of the form by the branch, it is delivered to a designated AML/CFT compliance email address. Subsequently, the AML/CFT team reviews the activity during the normal course of its investigations process. The existence of these referral mechanisms and the types of activity that may warrant referrals should be included in employee training programs, especially for those employees on the first line of defense. Internal hotlines Internal hotlines are also known as ethics, compliance, and whistleblower hotlines. They allow employees to report a wide range of activity, including employee fraud, harassment, discrimination, violations of codes of conduct, theft of company property, and inappropriate gifts. The hotlines might ask the employee to provide his identity, but most allow for anonymous reporting. In either case, in most jurisdictions, the financial organization is prohibited from retaliating against the person who made a report via the hotline. The financial organization must maintain policies, procedures, and processes to confidentially investigate the information provided through the hotline. The size and scale of a financial organization will determine the organizational recipient of the hotline information, such as legal, compliance, human resources, or corporate security. Negative media information Investigations can be initiated in response to notable media stories about a financial organization’s customer, how a product is used in the market, a geographic location it serves, or a money laundering or terrorist event. Thus, financial organizations should develop a process to receive, review, and escalate these types of potentially high-priority triggers. It is critical to determine whether the negative information is financially risk-relevant to the organization. In some instances, financial organizations might proactively monitor media stories and initiate investigations to determine if a SAR should be filed and if further actions are necessary. Negative news example Receipt of a governmental subpoena or search warrant Financial organizations often initiate investigations upon receipt of a governmental subpoena or search warrant. In either situation, the organization has two independent obligations: (1) legally fulfill the requirements of the subpoena or warrant, and (2) determine whether the activity of its customer identified in the subpoena or warrant requires the filing of a SAR. Notably, banking regulatory agencies do not need to use subpoenas, search warrants, or other jurisdiction-specific legal mechanisms. Rather, their authority to conduct examinations includes the ability to inspect all books and records of a regulated organization. Subpoena Subpoenas are usually issued by grand juries that operate under the purview of a court. They empower a law enforcement agency to compel the production of documents and testimony, which allow the law enforcement agency to investigate suspicious transactions, develop evidence, and, ultimately, put together a case for prosecution. When an organization is served with a subpoena compelling the production of certain documents or summon an individual related to its customer, the organization should ensure its senior management and/or legal counsel reviews the subpoena and independently confirms its legitimacy (e.g., to confirm that it is not an attempted fraud to obtain confidential information). If there are no grounds for contesting the subpoena, the organization should take all appropriate measures to comply with the summons or subpoena on a timely and complete basis. Failure to do so can result in adverse action and penalties for the financial organization. The financial organization should never notify the customer being investigated. To produce documents related to governmental requests, an organization should start by appoint an employee with knowledge of the organization’s files to take charge of retrieving documents for the organization. A system must be in place to ensure that all documents are located, whether they be in central files, department files, or individual files. In addition, copies of the same document in different hands should be retrieved, because some copies might have handwritten notes by the employees who received them. If the government asks the organization to keep certain accounts open, this request should be obtained in writing under proper letterhead and authority from the government. The request should include the duration for which the account should remain open. Documentation of the request should be maintained for at least five years after the request has expired. Search warrant A search warrant is a grant of permission from a court for a law enforcement agency to search certain designated premises and seize specific categories of items or documents. Generally, the requesting agency is required to establish that probable cause exists that evidence of a crime will be located. The warrant is authorized based on information contained in an affidavit submitted by a law enforcement officer. When a search warrant is served, it is important that everyone present remain calm. Every employee should know that a search warrant is not usually an open-ended demand. Instead, it gives the law enforcement agents the right to enter the premises, search, and seize only certain items or documents. A search warrant also does not compel testimony. When presented with a search warrant, an organization should consider taking the following steps: • Call the financial organization’s in-house or outside legal counsel and/or designated officer in charge of security, risk management, or a similar business area. • Review the warrant to understand its scope. • Ask for and obtain a copy of the warrant. • Ask for a copy of the affidavit that supports the search warrant. The agents are not obligated to provide a copy of the affidavit; however, when a financial organization is allowed to review the affidavit, it can learn more about the purpose of the investigation. • Remain present while the agents make an inventory of all items they seize and remove from the premises and keep track of the records taken by the agents. • Ask for a copy of law enforcement’s inventory of what it has seized. • Document the names and agency affiliations of the agents who conduct the search. Documents and computer records that are protected by the attorney-client and other legal privileges should be so marked and retained separately from general records. Privileged records should be stored in an area (e.g., a cabinet) labeled “Attorney Client Privilege.” If law enforcement agents want to seize privileged records, organization representatives may object and suggest, as an alternative, that the records be given to the court for safekeeping. All employees should be trained on how to behave in a search, and one person should be designated to communicate with the agents. Orders to restrain or freeze accounts or assets When a law enforcement agency or prosecutor obtains a court order to freeze an account or prevent funds from being withdrawn or moved, the organization should obtain a copy of the order and make every effort to comply. Generally, such an order is obtained based on a sworn affidavit, which is sometimes included with the order. If the affidavit is not part of the order, the financial organization can ask to see the affidavit, which should provide clues as to why a customer’s information is being requested. Whether law enforcement authorities are obligated to provide the affidavit depends on each country’s laws and regulations. In some jurisdictions, freezing orders can also be executed by seizure warrant. National security letters National Security Letters (NSLs) are authorized by four federal statutes: the USA PATRIOT Act, Electronic Communications Privacy Act, National Security Act, and Fair Credit and Reporting Act. However, several amendments were added to the USA PATRIOT Act and the USA PATRIOT Act Reauthorization of 2006. These amendments significantly reduced the standards required to issue an NSL and expanded the utilization NSLs by the FBI and other federal agencies in limited circumstances when counterintelligence and counterterrorism investigations are being conducted. The most common type of NSLs can be issued directly by the FBI leadership including the director, assistant director and special agents in charge. An NSL is a written investigative demand requiring third-party businesses, such as credit reporting agencies, telecommunications/internet service providers, and financial institutions, to provide a broad range of data and information on investigation targets, including telephone and electronic communications records, credit report information, and financial records The NSL process is secret and does not require a judge’s approval or other judicial oversight. Third-party businesses are not permitted to disclose the receipt of an NSL (i.e., gag order). Pursuant to 12 USC 3414(a)(3) and (5)(D), no bank, officer, employee, or agent of the institution can disclose to any person that a government authority or the FBI has sought or obtained access to records through a Right to Financial Privacy Act NSL. Keeping records Proper recordkeeping is a requirement, and it can help protect a financial organization from regulatory findings. Records that must be kept include CDD information and EDD records. You must also keep information about suspicious activity reports made to the authorities and internally reported suspicious activity that did not require a report to the authorities. Finally, keep records that describe your internal AML controls and your training records for all relevant staff. Sources of investigations (Case example: Preserving subpoenaed audio recordings) In September 2020, the US Commodity Futures Trading Commission (CFTC) announced that it settled charges against Citibank and its affiliates, Citigroup Energy Inc. and Citigroup Global Markets. Citibank failed to preserve audio recordings that were subject to a hold notice in connection with a subpoena sent by the CFTC’s Division of Enforcement in December 2017. Citibank admitted that more than 2.77 million audio recordings were deleted due to a flaw in its system, including files responsive to the subpoena that should have been preserved. The Citibank entities agreed to pay a US$4.5 million fine. CFTC determined that, from at least 2014 through at least November 2018, Citibank entities violated CFTC regulation 166.3: Failure to supervise. According to the regulation, records subject to subpoena should be segregated and stored safely. Senior management should ensure that adequate systems and staff are in place to meet legal and regulatory requirements. Any recordkeeping and regulatory deficiencies should be escalated to senior management and addressed in a timely manner. In addition, remedial action plans should be required, implemented, and tracked for system deficiencies. In 2014, Citibank determined that the system used to preserve audio recordings was not reliable for addressing legal holds to meet recordkeeping requirements and regulatory requests. Citibank implemented a stopgap measure to preserve audio recordings indefinitely. The audio recordings would be preserved as long as there was sufficient storage space. The system reached the storage threshold in October 2018 and automatically began deleting older recordings, including recordings subject to a December 2017 subpoena. The subpoena department should have sent legal hold notices to the applicable parties and segregated and preserved the responsive records. This did not occur. Further, despite being notified of the problem, Citibank did not take timely and adequate steps to mitigate the associated risks. Citibank’s failures, which led to deleting audio recordings subpoenaed by the CFTC Division of Enforcement staff, included: • Failed to adequately staff the department responsible for the oversight of audio recording preservation • Failed to adequately train staff to understand and recognize the risks of deleting audio files based on first-in, first-out settings • Failed to fully document system changes and ensure adequate procedures were in place for the system • Failed to preserve audio recordings through system backups • Failed to escalate the system weaknesses to Citibank management, the legal department, or any other compliance department Key takeaways • Records subject to subpoena should be segregated and stored safely. • Senior management should ensure adequate systems and sufficient staff are in place to meet legal and regulatory requirements • Recordkeeping and regulatory deficiencies should be escalated to senior management and addressed in a timely manner • Remedial action plans should be required, implemented, and tracked for system deficiencies Sources of investigations (Case example: Acting on seizure warrants) Regulators assessed a civil money penalty against a midsize regional bank for failing to maintain an effective anti-money laundering program. The regulators determined that Midsize failed to detect suspicious activity related to legal orders and failed to file timely suspicious activity reports (SARs). Over US$100 million in criminal proceeds from a trade-based money laundering scheme was processed through the institution over a four-year period. Additionally, despite receiving a seizure warrant from law enforcement, the bank failed to freeze US$1.25 million in funds from the suspect account. The bank was ordered to pay a US$10 million civil money penalty and agreed to a US$1.25 million forfeiture. The bank required its legal department to process all legal orders, including subpoenas, keep-open letters, and seizure warrants. However, the legal department did not establish a formal process or document written policies for reporting legal orders related to bank customers to the AML department. The AML department also did not adopt policies requiring the review of subpoenas, keep-open letters, and seizure warrants to determine if the underlying account activity was suspicious. Accordingly, it failed to review hundreds of accounts that were subject to legal orders for suspicious activities. It also failed to file timely SARs. In one case, the AML department failed to review an account subject to multiple subpoenas which resulted in over US$100 million in suspicious transactions. The AML department was unaware the account records had been subpoenaed. Law enforcement served a seizure warrant for US$1.5 million in funds remaining in the account. However, the bank allowed an additional US$5 million in funds transfers to be processed through the account. Eventually, the remaining balance was US$250,000. The legal department failed to freeze the funds due to backlogs, and the AML department had not been informed of the seizure warrant. Ultimately, the bank agreed to forfeit US$1.25 million related to the funds released. The regulators ordered the bank to pay a US$10 million civil money penalty. Key takeaways • Financial organizations must implement policies and procedures to appropriately respond to legal orders, including timely processing of seizure warrants. • Effective communication among departments within financial organizations is critical to ensure that suspicious activities are reported to the AML department. • The timely filing of SARs is an important element of effective AML programs. Conducting the Investigation Several key actions are required to conduct an effective financial investigation into potential suspicious activity, including: • Reviewing internal transactions, including value and volume, information obtained from the customer, and other relevant internal documentation • Determining whether the activity is expected for the customer • Identifying and reviewing external information to understand the customer, related entities, and relevant media • Contacting business line employees who are responsible for the account relationship • Generating a written report that documents relevant findings A financial investigator’s main objective is to track the movement of money, whether through a bank, broker-dealer, money services business, casino, or other financial organization. Financial organizations have access to a wealth of information, because they are in the business of taking in, paying out, accounting for, and recording the movement of money. For example, banks maintain signature cards, which are collected at the opening of an account, account statements, deposit tickets, checks and withdrawal items, and credit and debit memorandums. Financial organizations also keep records on loans, cashier’s checks, certified checks, traveler’s checks, and money orders. They exchange currency, cash third-party checks, and conduct wire transfers, as do most MSBs. Financial organizations also keep safe deposit boxes and issue credit cards. Online-based financial organizations maintain login activity logs, IP addresses, and geographical location information. Often, financial organizations are required to keep records of customer accounts for five years, such as in the EU, US, and Canada. Although that rule might vary in different countries, it is important for compliance officers at financial organizations to be aware of these legal requirements. Account records and records of other nonaccount activities can be essential to tracking possible money laundering. Other financial organizations keep similar records of transactions and the ability to exert control over an account, such as the ability to trade stocks in a brokerage account. With all the information financial organizations are privy to, it is important for them to develop and maintain policies and procedures regarding financial investigations. Typically, financial organizations identify the procedural steps required, the information needed to complete the investigation, and any recommended next steps. Following are two examples of the steps in a financial investigation: 1. An investigation is initiated after a branch teller identifies a new customer who conducted large cash deposits at three different branches on consecutive days just below the statutory cash-reporting threshold. Subsequently, the customer wired 95 percent of the funds to an unrelated individual located in a high-risk jurisdiction that is known as a gateway for narcotics traffickers. According to the financial organization’s investigation policies and procedures, the following must be done: Conduct a documented review of the customers’ accounts for one year, including all transactions, KYC information, and social media searches for any relevant negative media. The report must analyze the information reviewed, determine whether or not a SAR should be filed, and take any additional remedial measures. 2. An investigation results from a transaction monitoring alert that identified large, round-dollar wire transfers to a commercial customer from import/export companies with generic names located in high-risk jurisdictions. The KYC review indicated the customer was engaged in furniture sales through several retail locations. Further, it identified a high volume of incoming check and credit transactions and no incoming wire transfers; however, the customer originated wire transfers to low-risk jurisdictions to purchase the furniture. This investigation led to contacting the relationship manager for information about the customer’s activity to assist with explaining the deviation. If unexplained, the next step in the investigation would be to determine whether such activity warranted a SAR filing. Utilizing the internet when conducting financial investigations An effective investigation requires that information be sourced both from the information held by the financial organizations and from external sources. Care should be taken to ensure that the information found is reliable and verifiable, and the assistance of external specialists is sought if necessary. It is critical to be confident about the soundness of the information relied upon during an investigation, especially when it could be the deciding factor in closing an account or terminating a business relationship. The internet is often used to source information as part of internal investigations. A focused approach to searching reliable and reputable sources can provide useful third-party information and additional context to the files held by financial organizations. Combined with a review of internal documents and records, internet sources can help provide a complete understanding of whether further steps are needed to mitigate possible financial crime risks associated with the customer. Conducting research on the internet is most effective when there is a clear understanding of what online sources are considered reliable. For example, social media sites such as Facebook and LinkedIn can be useful to verify some information, but blogs and comments posted on these sites might not prove to be reliable sources about an individual’s reputation. Independent websites maintained by independent standards bodies (e.g., FATF, Wolfsberg, and OECD) and supervisory authorities (e.g., national and state-level regulators, corporate registrars, electoral rolls, and registration lists) can provide valuable information concerning regulatory status, sanctions, fines, business activities, and broader commercial activities of the party under investigation. Furthermore, these sources are considered to have a high degree of reliability. In some countries, court lists, decisions rendered by courts, magistrates, administrative tribunals, and professional oversight bodies with disciplinary powers (e.g., law societies) can be useful sources of information. When using the internet to glean customer reputation information, care must be taken when researching news and quasi-news websites. Steps should always be taken to verify, from more than one source, the accuracy of negative news articles to reduce the risk of relying solely on a writer’s opinion. Journalists have their own biases, as do their employers, and these biases can subtly find their way into news articles. In addition, in countries where freedom of speech and press are not well established, journalists are not always free to write exactly what they would like. This often takes the form of prominently publicizing negative news about someone who is not in favor with the government (including what could be politically motivated criminal or civil charges) or downplaying negative news about someone in favor with the government. Not all media is corrupt, but sometimes the source has as much at stake as the subject of the news. This is why investigators must take a close look at the source of the news as well as the news itself, and why getting multiple sources is important to ensure a complete understanding of the story. Some sources might have limited parts of the whole story, which only is revealed when the investigator has additional pieces of information. When dealing with a country or region that is known to have tighter controls on what is published on the internet and to restrict the amount of information that is publicly accessible, it may be necessary to seek additional assistance. Particularly when dealing with a valuable customer that justifies the additional expense, an organization can retain the services of a vendor with expertise in this area to verify whether serious adverse information about a customer is in fact supported by independent sources. Tips on searching the internet Before searching the internet, the investigator should prepare a plan, focusing on the topics under investigation and the types of information needed. This will ensure that the work is undertaken in an efficient and focused manner, with the relevant records retained (e.g., screen capture or downloads due to the risk of website changes). The investigator should start with a metasearch using several different search engines and then move to specific search engines with different capabilities. From the metasearch, the investigator can start narrowing the parameters using keywords. The plan devised in advance will help the investigator select the keywords and areas where greater focus should be applied. For example, if a customer’s transaction activity has raised concerns, the search could begin with the customer’s personal and professional background and then focus on the nature of the commercial activities she has been undertaking. This will assist the investigator in assessing whether the transactions appear to be consistent with the reasons given by the customer for opening the account and the expected commercial activity she proposed to use it for. There are high-quality tutorials on the web for individuals who want to improve their search skills. There are also sites that identify search engines for professional researchers. The easiest and most effective way to improve your web-searching skills is to read the Help pages of major search engines and to practice with their advanced features. Some tips on search engines include: • Using multiple search engines is effective because no single engine covers the entire web. • If you are searching in a foreign country, use a local search engine. • Use metasearch engines. An additional step is to access a commercial database. Although these databases require the payment of a fee, public record aggregators can be cost-effective, because they cross-reference an enormous number of records. Moreover, they can include certain personally identifiable information, such as date of birth and government identification number, which might not be located on the internet. Search scenario: Too much money. Consider the case of a gas station owner who deposits US$50,000 in cash per week. Is this money laundering? Would simply searching the owner’s name on Google be considered sufficient due diligence? A better approach would be to search how much cash gas stations of that size and location typically deposited. This leads to a very different line of inquiry. Internet sources might reveal sources such as marketing studies, commercial valuation sites, and businesses for sale that could provide useful clues about the cash flow of comparable gas stations. The internet might also reveal useful information about the area in which the gas station is located, such as population statistics, income levels, ethnicity, and crime rates. Is it located on a commuting corridor? Are there competitors nearby? Does it have a car wash or a convenience store attached? By comparing the business with others and examining the context, it becomes possible to argue that there is “…a high level of cash deposits atypical of the expected business profile”—a classic indicator of money laundering. Search scenario: Unknown business. A bank client was depositing large amounts of cash in his personal account. The bank suspected that its client was operating an unlicensed money remittance service out of the back of his restaurant. It was about to file a SAR when the bank realized that it was missing a key piece of information: the name of the client’s restaurant. How did the bank solve the mystery? It began by assuming that the client’s restaurant was near the bank. Using a simple online telephone directory, the bank was able to generate a list of all the restaurants within one mile of the bank. But which one belonged to the client? The bank needed a way to search incorporation records for each of the businesses that it had identified. Not wanting to use a commercial service, it went to a free online public records provider. Clicking on the jurisdiction and then the link for corporations led the bank to the right government department, where it input the name of each one of the area restaurants until it found one with its customer listed as a director. This case provides a useful example of the benefits of starting an investigation and then focusing on more specific areas to gain a complete understanding of the customer being investigated. Search scenario: Unusual bank account activity. What technical skills are useful for KYC and due diligence? The following simple scenario can be used to consider how to approach an investigation. You are asked to research a customer named Cynthia Jenkins in Albuquerque, New Mexico. Transaction monitoring raised an alert that Cynthia appeared to be using her account in a way that was inconsistent with what was expected when she first opened the account—or maybe the account had been dormant for some time and had suddenly reactivated. Transaction monitoring showed that Cynthia’s account had received a significant number of wire transfers from different parties in the past two weeks. Each transfer was for US$9,900. When Cynthia first opened the account, she stated that it was for “household expenses.” Your first step might be to confirm Cynthia’s identity and search the internet to determine whether the use of the account appears to be legitimate, for example: • Is she listed in the telephone directory or on the electoral roll? • Where does Cynthia live? Is there any evidence that the property is used for any commercial activity that could justify the payments received? • Is she mentioned in any other public records? Try a public records search engine. • What information does she provide on social media about her occupation, location, and other aspects of her life? • Is there evidence that someone could be misusing Cynthia’s account? For example, is she elderly or possibly deceased? Could this be a case of identity theft? Imposters often use the Social Security numbers of deceased people. In the United States, it is possible to check the Social Security Death Index by searching for “Social Security Death Index.” Information obtained from internet searches should be complimented by internal documents and records held by the financial organization. For example, who sent the transfers? From what banks? Do the transfers indicate why the monies were paid? Is it possible to check the internet to see whether there is any information about the payers? Conducting the investigation (Case example: Utilizing the internet when conducting financial investigations) Easy Cash Ltd. is a money services business (MSB) that has been a customer of XYZ Bank Corp for seven months. During customer onboarding, Easy Cash advised XYZ Bank that its customers would come from Europe and that it would conduct an estimated 10 to 20 transactions on the account each month. During the regular transaction monitoring of its customers, XYZ Bank identified possible anomalies with the Easy Cash transactions and initiated an investigation. The investigator reviewed Easy Cash’s KYC and transaction history. It also used open-source intelligence (OSINT), i.e., information obtained from data that is publicly available. OSINT is often used in financial crime investigations and KYC processes to better understand key information related to customers and their activities. It is often used in conjunction with internal and closed sources and helps to analyze different aspects of cases using primary and secondary information related to the investigation that could corroborate or disprove concerns and information. OSINT involves searching through a large variety of online sources, such as social media, news sites, public registries, and websites, in a structured and logical manner. It can involve the use of basic search strings to find data using key terms or delve into more complex techniques involving artificial intelligence-driven automation capabilities and external platforms to compile and analyze data. The investigator started with a web search of the name of the customer and its ultimate beneficial owner (UBO) for potential adverse media. She also searched the names of senders and recipients of transactions using key words, for example, “money laundering” or “crime,” and Boolean operators such as “AND” or “OR.” The investigator learned that one of the recipients of several transactions was mentioned in multiple reliable media sources as having ties to the Italian Mafia and using Italian restaurants for laundering money. She also accessed the home page of the customer and businesses associated with the UBO. On the home page of Easy Cash, the investigator discovered that the company was promoting its money transfer services in the Middle East and East Africa and downplaying the need to provide KYC. She also discovered that Easy Cash had a branch in Turkey. Because some of the home page content was written in a language the investigator did not speak, she used an online translation tool and identified it as Farsi, the language spoken in Iran. The Farsi content promoted the services of Easy Cash to transfer funds in various currencies, including US dollars. The investigator also used an online map service to research the address of the Turkish branch and discovered that it was located in a city near the Iranian border. XYZ Bank quickly took steps to freeze and later close the account with Easy Cash once it notified the finance intelligence unit (FIU) of its findings. Key takeaways • OSINT is an effective tool for investigations. • OSINT uses various search engines and conducts key word searches. • Boolean operators enhance the effectiveness of an internet search. • Customers’ home pages can provide important information. • Online translation services can help you utilize foreign websites in investigations. • Online map applications can verify locations and determine what is physically near that location. • Report to your FIU when you suspect a customer is engaged in money laundering. SAR Decision-Making Process The decision of whether or not to file a SAR often involves weighing the aggravating and mitigating factors arising from the research conducted during the investigative process. Financial organizations should draft procedures that document the factors to consider when determining whether a SAR filing is appropriate. Properly trained personnel in charge of investigating and reporting suspicious activities should have a clear and concise procedure for escalating their findings to a compliance officer, manager, or other staff member with authority to make the filing decision. The final decision should be documented and supported by the reasoning that was used to make the determination. Often, the reason not to file an SAR is as important as the reason to file an SAR. After the decision to file has been made, the organization should report the activity to its regulatory agency, law enforcement, or both, as defined by the applicable regulations within its jurisdiction. Many jurisdictions require SARs to be filed within a specific number of days following the discovery of potentially suspicious activity. In many jurisdictions, it is a requirement to report certain information regarding SARs to senior management and/or the board of directors. This information could be limited to the number of reports filed, the dollar amounts involved, and significant trends observed by compliance personnel. In some cases, if the activity presents a significant or potentially ongoing risk to the organization, the leaders should be notified so that high-level decisions can be made regarding potential changes to systems, staffing, products, services, or specific relationships maintained by the organization. Filing a SAR The decision to file a SAR should be the result of an accumulation of aggravating factors and a lack of mitigating factors, in combination with the knowledge of what is expected activity for the organization’s customer base, product offerings, and geographical area of service. The SAR filing should include the details of the suspicious activity and the related demographics, as well as the reasons the organization finds the activity suspicious. The recipient of the SAR does not have the intimate knowledge of what is expected activity for a particular organizations, clients, and products, and will only benefit from Certified Anti-Money Laundering Specialist Version 6.5 Page 364 the inclusion of this information. In addition, any known typologies identified as part of the review should be included in the filing as well. If, following the investigation, the organization decides that it should file an SAR, it should notify the investigators or prosecutors as soon as possible. However, this might not be practical in certain jurisdictions due to the continuous nature of the SAR process and the volume of reports filed by the reporting organization. The establishment of a filing timeline in concert with country guidelines is critical to avoiding organizational penalties and fines. The failure to file timely reports is often cited in regulatory actions against financial organizations. The AML/CFT officer or designee should keep senior management and board members apprised of SAR filing metrics and any significant issues resulting from those filings, especially items that pose a regulatory or reputational risk to the organization. Finally, the financial organization should maintain a record of the SAR and all supporting documentation. Under the BSA record-retention requirements, this information should be maintained for five years following the date the SAR was filed. Quality assurance and control All financial organizations are required to file timely and complete SARs, and the quality of the SARs can be an indication of the quality of a financial organization’s AML/CFT program. Quality and consistency in the SAR decision-making process is critical to ensuring the appropriate level of oversight in the investigative process. A quality assurance (QA), or quality control (QC), review helps to ensure that SAR filings are internally consistent, the right decisions are being made, and high-priority issues are identified and escalated to leadership. A strong QA/QC process is also needed to ensure that SARs are completed according to all regulatory requirements. The larger the scale of the financial organization, its staff, and where it is located all have an impact on the QA/QC process. As a result, financial organizations that implement a QA/QC process should document the requirements and qualifications of QA/QC reviewers and regularly review the outcome of QA/QC reviews to assess the quality of staff, training requirements, and the general health of the program. SAR filing oversight and escalation An organization should have robust policies and procedures for documenting the appropriate oversight of the investigation process and regulatory reporting requirements. This should include specific actions to be taken, such as escalation to senior management in cases in which a customer-facing employee or individual in the AML/CFT chain of command is complicit or willfully blind to suspicious financial activities. Failing to report SARs (Case example: Money laundering reporting officer) Governments and regulators routinely enact laws and publish guidance to ensure that professionals report suspicious activity within various business functions in an effort to identify, manage, and mitigate money laundering and other financial crimes. In June 2021, the UK updated guidance on prosecuting “failure to disclose” cases under section 330 of the Proceeds of Crime Act 2002. It is now legal to prosecute the offense of failing to report suspicious activity, even when the suspected money laundering activities have not yet been determined. The intention of the updated guidance is to encourage professionals to actively report any suspicious activity to the authorities; in the UK, this would be the UK financial intelligence unit (UKFIU). The money laundering reporting officer (MLRO), Bank Secrecy Act (BSA) officer, and other designated persons “report” or “sign” as the reporter to their FIU. The boards of financial organizations delegate such functions to these appropriately trained and experienced people. A conviction for failure to disclose information on suspected or determined money laundering activity can result in a five-year prison sentence. In July 2021, Dominic Thorncroft was given an 18-month suspended prison sentence and ordered to do 250 hours of unpaid work at Southwark Crown Court, UK, for failing to alert the authorities to money laundering (i.e., not reporting SARs), breaching money laundering regulations, and retaining a wrongful credit. Thorncroft was an MLRO for a money services business (MSB) and the former chair of the Association of UK Payment Institutions. In that capacity, he worked with lawmakers and financial regulators and provided AML advice and training. An investigation by the Metropolitan Police found evidence linking Thorncroft to a 2014 investment fraud. Thorncroft had allowed his MSB to be used by fraudsters to transfer money to Hong Kong and mainland China. In addition, he knowingly transferred money to the fraudsters, despite the fact that one individual was subject to a serious crime prevention order, which should have stopped him from sending money overseas. Investigators found that Thorncroft should have known or suspected that the money passing through his business’s bank accounts was criminal property. Despite his substantial knowledge and expertise of money laundering, Thorncroft failed to alert the authorities to the suspicious activity and allowed it to continue. It was noted in court that “Thorncroft did not commit the fraud himself. However, his actions have allowed £850,000 defrauded from 60 individuals to be dispersed across the world.” Thorncroft promoted himself as an antimoney laundering expert, but he did not follow the standards he set for others. When his business was clearly being used to launder criminal property, he failed to follow his own advice and report what was happening to the authorities. Key takeaways • Designated persons must ensure that suspicious activity is identified and reported through SARs to FIUs, to protect potential crime victims, their firms, and themselves. • Designated persons must be held accountable, as they have a higher level of knowledge and thus responsibility compared with others in businesses. Failing to report SARs (Case example: Deutsche Bank) Suspicious activity reports (SARs) are routinely described by law enforcement as the “lifeblood” of financial investigations. They contain intelligence related to criminal financing and useful supporting contextual information. SARs can be the catalyst for new investigations or a vital “piece of the puzzle” for an existing investigation. Law enforcement officers rely on designated individuals such as money laundering reporting officers (MLROs) and Bank Secrecy Act (BSA) officers to identify and report suspicious behavior in a timely manner. To fight financial crime, organizations must know the current reporting laws and regulations and take responsibility for reporting suspicious activity. This will protect the individual designated officers and the organization. The person who detects the suspicious activity is responsible for reporting it internally for further development to establish whether the activity is suspicious. The MLROs, BSA officer, or other designated officer “reports” or “signs” as the reporter to the financial intelligence unit (FIU). At a higher level, the board must ensure that the right people, technology, and processes are in place to meet the reporting requirement. Reporting is genuinely a collective responsibility but reporting to the FIU is the responsibility of the MLRO, BSA officer, or designated officer. People working in regulated sectors must exercise a greater level of diligence by identifying and reporting any red flags that might indicate suspicious activity. Regulators have taken action against numerous organizations for failure to report suspicious activity. In October 2020, Deutsche Bank received a €13.5 million administrative fine for failing to submit SARs in a timely fashion. Deutsche Bank allegedly failed to disclose more than one million suspicious money transfers with Danske Bank Estonia, for which Deutsche Bank was the correspondent bank. The money transfers occurred over a five-year period after a whistleblower at Danske Bank flagged them as suspicious transactions. German prosecutors launched an investigation to determine whether Deutsche Bank employees had sanctioned these transactions and subsequently attempted to cover them up. Deutsche Bank withdrew from its position as a correspondent bank for Danske Bank Estonia over increasing concerns about potential misconduct by Danske Bank and launched two internal investigations into the matter under the scrutiny of US regulators. Frankfurt prosecutors cleared Deutsche Bank of money laundering, but found that, between 2010 and 2015, Deutsche Bank failed to send timely alerts of potentially suspicious transactions to law enforcement authorities on 627 occasions. For each of these failures, Deutsche Bank was fined between €12,500 and €30,000. Key takeaways • Failure to report suspicious transactions can result in fines and other penalties. • People working in regulated sectors must exercise a greater level of diligence by identifying and reporting any red flags that trigger suspicion. • Financial organizations are required to report suspicious activity by filing SARs with FIUs. Closing the Account Based on its internal investigation, the financial organization should independently determine whether to close the account in issue. Following are important factors the organization should consider: • The legal basis for closing an account • The organization’s stated policies and procedures for closing an account, which might include an automatic closure recommendation following a specified number of SAR filings • The seriousness of the underlying conduct; that is, if the conduct rises to the level of seriousness at which it would typically be closed, the organization should consider closing it • The reputational risk to the organization posed by maintaining the account • Correspondence with law enforcement and requests from law enforcement to either cancel or maintain the account Communicating with Law Enforcement on SARs When an organization files an SAR, the details of that filing might warrant additional law enforcement notification. SARs represent financial intelligence to a country’s FIU; depending on the volume of reports filed in a given country, a report worthy of priority attention could be lost in the large number of reports filed. Following the filing of the SAR, the responsible compliance officer or designee can contact a specific law enforcement division to notify it of the recent filing and make it aware of activity relevant to its area of coverage or geographical location. Moreover, a law enforcement agent can contact the financial organization that filed the SAR to seek the underlying information used in the investigation that resulted in the SAR. Therefore, it is critical that each organization develop its own policies and procedures for communicating with law enforcement regarding SARs.