How to Investigate Money Laundering

Retail Banking

This post has already been read 6544 times!

How to Investigate Money Laundering – A short Guide

How to investigate Money Laundering
How to investigate Money Laundering

There are many new entrants to the AML sector that have little to no investigative experience. That’s natural in any sector. Below are some tips on how to instigate and progress an investigation into Money Laundering or Terrorist Financing within a bank. And the factors that will impact it. What needs to be considered with every investigation is the proportionality of it. It may just be a case of reviewing transactions, or going the extra mile due to the value and volume of transactions. That comes with experience and an understanding of the risk a customer or series of transactions places on an organisation. Read ‘How to investigate money laundering’ to get some insight.

Investigations Initiated by a Financial Institution

Common investigation initiators include:

  1. Regulatory recommendation or findings
  2. Transaction monitoring rules designed to detect potentially suspicious activity
  3. Referrals from customer-facing employees regarding potentially suspicious activity
  4. Information obtained from internal hotlines
  5. Negative media information
  6. Receipt of a governmental subpoena or search warrant
  7. Whistle-blowers.

Regulatory Findings

  • Investigation may be initiated based on regulatory findings or recommendations:
    • Identify remedial measures
    • Ongoing reviews
    • One-time reviews
    • Require internal and external reporting
    • Document results of investigations
    • Escalate to senior management

Transaction Monitoring Rules

The below transactions are from an account. Let’s see what the transaction monitoring rule does.

Rule: Incoming aggregated cash deposits more than $20,000 and outgoing wire transfers more than $20,000 within 10 days on individual accounts:

14/11/2019 Cheque Deposit Lantana Inc, BVI$5500
15/11/2019 Cash Deposit$8000
16/11/2019ATM Withdrawal$200
17/11/2019Cash Deposit$9000
18/11/2019Cash Deposit$8500
19/11/2019ATM Withdrawal$500
20/11/2019ATM Withdrawal$300
21/11/2019Cheque deposit – Lantana Inc, BVI$5500
22/11/2019 Wire Out Lantana Ltd, Panama($11000)
23/11/2019Wire Out Lantana Ltd, Singapore($24000)

Transaction Monitoring Rules – What Met the Rule?

14/11/2019Cheque Deposit Lantana Inc, BVI$5500
15/11/2019Cash Deposit$8000
16/11/2019ATM Withdrawal$200
17/11/2019Cash Deposit$9000
18/11/2019Cash Deposit$8500
19/11/2019ATM Withdrawal$500
20/11/2019ATM Withdrawal$300
21/11/2019Cheque Deposit – Lantana Inc, BVI$5500
22/11/2019Wire out Lantana Ltd, Panama($11000)
23/11/2019Wire out Lantana Ltd, Singapore($24000)
  • Cash Deposits equal $25,500 in less than 10 days.
  • Wire out on the 23rd equals $24000.

Transaction Monitoring Rules – What did not?

14/11/2019Cheque Deposit Lantana Inc, BVI$5500
15/11/2019Cash Deposit$8000
17/11/2019Cash Deposit$9000
18/11/2019Cash Deposit$8500
21/11/2019Cheque Deposit – Lantana Inc, BVI$5500
22/11/2019Wire out Lantana Ltd, Panama($11000)
23/11/2019Wire out Lantana Ltd, Singapore($24000)
  • Cheque deposits only $11,000
  • Wire out less than $20,000

What should be investigated?

14/11/2019Cheque deposit – Lantana Inc, BVI$5500
15/11/2019Cash Deposit$8000
17/11/2019Cash Deposit$9000
18/11/2019Cash Deposit$8500
21/11/2019Cheque Deposit – Lantana Inc, BVI$5500
22/11/2019Wire out Lantana Ltd, Panama($11000)
23/11/2019Wire out Lantana Ltd, Singapore($24000)

The wire out to Lantana Ltd in Panama, it looks like the two Cheque deposits are being aggregated into the payment to Panama. The $24000 payment to Lantana in Singapore also needs investigating. The fact the transactions are going to jurisdictions that have secretive business registrations and low tax plus the similarity in name raise suspicions enough to ask questions.

Referrals from Customer-Facing Employees

  • Financial institutions may maintain an internal communication system to report activities identified by customer facing employees.
  • Referrals would be completed by the employee and sent to the compliance investigations unit. Examples include:
    • Internal form
    • Internal email
    • Internal database
    • Observed activity, behavior relevant to determining whether something suspicious.
    • Executed transactions may be identified by transaction monitoring rules, but not the observed activity.

Internal Hotlines

Negative Media

Adverse media
Adverse media
  • Investigations can be initiated by information obtained in the public domain such as:
    • Information about a financial institution’s customer
    • How a product is used in the market
    • Geographic location it serves or
    • Money laundering or terrorist event
  • Negative media should be considered in the STR process

Receipt of Governmental Subpoena or Search Warrant

  • Subpoena / Warrant
    • Compulsory legal process issued by a court to compel the appearance of a witness at a judicial proceeding, sometimes requiring the witness to bring specified documents.
  • Search warrant
    • A grant of permission from a court for a law enforcement agency to search certain designated premises and to seize specific categories of items or documents.
    • Generally, the requesting agency is required to establish that probable cause exists US, suspicion in the UK) to believe that evidence of a crime will be located.
    • The warrant is authorised based on information contained in an affidavit submitted by a law enforcement officer.

Legal and AML Obligations

  • Financial institutions maintain two independent obligations:
    • Fulfill the requirements of the subpoena or warrant; and
    • Determine whether the activity of its customer identified in the subpoena or warrant requires the filing of a STR
    • Excerpt from the Wachovia Bank, NA civil money penalty (2010) on AML program failures, including investigating subpoenas:
Wachovia subpoena
Wachovia subpoena

Summons and Subpoenas

  • If the FI is served with summons/subpoena compelling the production of documents senior management and/or counsel should review it.
  • If there are no grounds for contesting the summons or subpoena, the institution should comply with the summons or subpoena on a timely and complete basis. Failure to do so can result in adverse action and penalties for the institution.
  • Do not notify/tip off the customer who is being investigated.
  • If the government asks the bank to keep certain accounts open, such a request should be obtained in writing under proper letterhead and authority from the government.

What To Do – Search Warrant

  • Inform the institute counsel.
  • Review the warrant to understand its scope.
  • Ask for and obtain a copy of the warrant.
  • Ask for a copy of the affidavit/laying of information document that supports the search warrant. The agents are not obligated to provide a copy of the affidavit, but, if an institute is allowed to see the affidavit, the institute can learn more about the purpose of the investigation.
  • Remain present while the agents record an inventory of items they seize.
  • Make copies of the records taken by the agents.
  • Ask for a copy of law enforcement’s inventory of what they have seized.
  • Write down the names and agency affiliations.
  • Attorney-client records: Suggest, as an alternative, that the records be given to the court for safekeeping.

In the UK the law enforcement are required to leave inventories and should not have to be asked. CYW provide a private to public liaison service designed to advise on what the authorities can and cannot do and the likely action that would be taken in an inquiry/operational search/seizure. Contact us for more.

Order to Freeze an Account

If the law enforcement agency or a prosecutor obtains a court order to freeze an account or to prevent funds from being withdrawn or moved, the institution should obtain a copy of the order and should comply with it.
Generally, the order is obtained based on a sworn affidavit/laying of information. Ask to see the affidavit. It provides clues about why a customer’s information is being requested. Whether authorities are obligated to provide the affidavit depends on laws and regulations.

Conducting the Investigation

In the course of conducting an effective financial investigation, consider the following steps:

  • Review internal records
  • Review external information related to subjects of the investigation
  • Review adverse media
  • Review business registrations
  • Review links to other businesses and accountants/law firms
  • Review links to business registration agents
  • Review large purchases through real estate, brokers, high net purchase retailers.
  • Review publicly available movement tracking databases.
  • Conduct open source intelligence searches
  • Conduct trade based inquiries
  • Review fraud databases.
  • Cross match and merge records, telephone numbers, email, IP addresses, digital footprints.
  • Consult with internal witnesses.
  • Contact the business line responsible for the account relationship
  • Generate a written report recording relevant findings
  • Follow the money trail
  • Maintain an investigative mindset
  • Include digital data searches for digital footprints.
  • Include basic CCTV inquiries for ATM/counter withdrawals, who was it?
  • Consider facial recognition if your institute has it.
  • Share and request data relating to transactions and customers with partner agencies and institutes.
  • For more contact us…

CYW are creating a network to share intelligence between agencies. The network removes the identity of the requesting institute, scores, weights and grades intelligence return and removes the identity of the returning agency. Protecting commercial interest while improving AML investigations. #Opembrace

Review Internal and External Information

  • Review internal records covering the time frame of the suspected activity, including time before and after. Examples:
    • Signature cards
    • Account statements
    • Deposit tickets, checks and withdrawal items
    • Credit and debit memorandums
    • Records on loans, cashier’s checks, certified checks, traveler’s checks and money orders
    • Request further information from other agencies.
    • Liaise with partners.

Utilising the Internet when Conducting Financial Investigations

Open source intelligence
Open source intelligence
  • Start with Metasearch (search tool that sends user requests to several other search engines and aggregates results into a single list) and then move to specific search engines
  • Tips on search engines:
    • Use multiple search engines
    • Use local (foreign) search engines when searching in a foreign country
    • Ideally you should be employing an Open Source search company or software. The internet has many search options, not least different language. Unless you are very proficient in search you should employ experts. You will miss critical evidence/intelligence otherwise.
    • Search social media accounts.
    • Employ a system that does all of this with AI capability.

STR Decision-Making Process

  • Decision whether or not to file a STR/SAR often involves weighing the aggravating and mitigating factors arising from the research conducted during the investigative process.
  • The final decision should be documented and supported by the factors that were used to make the determination.
    • File report to Financial Intelligence Unit
    • Comply with STR timelines

Quality Assurance

  • Financial institutions are required to file timely and complete STR/SARs and the quality of STRs can be an indication of the quality of the institutes AML/CFT program. For this reason managers should dip sample and provide feedback on STR/SAR submission.
  • QA review helps to ensure that STR filings are internally consistent, the right decisions are being made and high priority matters are identified and escalated to leadership.
  • The institute should have a clear direction for its staff, in policy, that indicates what, when, how and why to escalate an investigation. Guidance to staff is critical.

Quality Assurance Impacts Investigations

Bank SAR
Bank SAR
  • TCF National Bank
  • 2013 consented to a $10M civil money penalty for AML program violations
  • Quality of investigation process cited in consent order

Closing the Account Based on its internal investigation, the institution should make an independent determination as to whether to close the account. Consider: – The legal basis for closing an account. – The institution’s policies and procedures for closing an account. – How serious is the underlying conduct? If the conduct is serious and rises to the level where the account would ordinarily be closed, then consider closing the account. If Law Enforcement requests the institution to keep the account open, request it in writing. In addition, the institution should determine whether or not to file a STR.

Communicating with Law Enforcement
Communicating with Law Enforcement

Law Enforcement Investigations vs. Bank Examinations

In the U.S. and several other jurisdictions, the banking regulatory agencies do not need to use subpoenas or search warrants. Their authority to conduct examinations includes the ability to inspect all books and records of a regulated institution.

Law Enforcement Investigations

  • WHEN: Law enforcement investigations can be triggered by STRs, tips from sources and information from other cases.
  • WHAT: The agency can request information from an institute in order to obtain evidence.
  • HOW: Requests for information can come in several forms: subpoenas, search warrants, etc.
  • WHY: The documents and testimony are designed to allow the agency to investigate suspicious transactions, develop evidence and put together a case for prosecution.

Steps Law Enforcement Agencies Take in a Money Laundering Investigation

  • Follow the money – Identify the unlawful activity (predicate offense)
  • Document the underlying activity and transactions, flow of funds through bank accounts
  • Review databases (FIU databases, commercial databases)
  • Review public records (court records, corporate filings, newspapers)
  • Review licensing and registration files (including motor vehicle department)
  • Analyze the financial transactions and account activity of the target.
  • Review STR/SARs
  • In cross-border cases, seek international assistance via MLAT or other.

Decision to Prosecute a Financial Institution

When considering whether – or to what extent – to bring a case against a Financial Institution involving ML-related charges, prosecutors will look at:

  • Does the institution have a criminal history?
  • Has the institution cooperated with the investigation
  • Did the institution discover and self-reported the ML -related issues
  • Does the institution have a comprehensive and effective AML program
  • Did the institution take timely and effective remedial action
  • Are there civil remedies available that can serve as punishment
  • Will deterring wrongdoing be served by a prosecution

Responding to a Law Enforcement Investigation

  • Respond quickly and completely to all requests.
  • If a request is overly broad/unduly intrusive, the institut can attempt to narrow the request or can even seek to contest the request, in court. Typically, the most effective strategy is to cooperate with investigators and prosecutors.
  • Never ignore, defer or otherwise put aside or delay responding to a law enforcement inquiry or request for documents.
  • Obtain counsel.
  • Create a centralised control policy: To ensure requests are responded to on a complete and timely basis and to establish a complete record of what is provided.
  • Keeping a centralised record will also assist with regard to the institute’s own internal investigation.
  • The FI needs to ensure that appropriate senior management is informed.
  • Someone should be designated as being responsible for responding to all law enforcement requests.
  • If the inquiry appears to be focused on the institution and not just an account or customer, then the Board of Directors should be kept appraised as well.
  • Information about an investigation should not be provided to any employees, officers or directors of the institution who might be a suspect in the investigation.

CYW can support institutes under investigation.

Legal Counsel

Upon notification of a law enforcement investigation, especially one directed at the institution, consideration should be given to the retention of qualified, experienced legal counsel.

  • Guides the institution through the inquiry.
  • Contests requests that are perceived to be improper.
  • Assist in negotiating settlements if necessary.
    • If the inquiry is merely focused on a particular account or is only seeking to obtain financial evidence about a customer and there is no apparent wrongdoing by the institution, there is a less pressing need to obtain counsel. Each case, however, requires individualized review and analysis.

We have articles on MLATs and FIU roles and responsibilities. We recommend you read these in continuing learning around investigations. Follow the links.

MLAT learning

FIU role learning.

Register for our newsletter today


Register for our newsletter today