17.01.2010

AML-CTF: CASE STUDIES


1. Cross-Border Activities:

A European FIU received some thirty disclosures from several exchange offices regarding Asian nationals residing in that country and remittances being made to their home country. The money was always deposited in cash and therefore the origin of the funds was unknown.

Analysis revealed the following elements:

􀂃 The regularity and scope of the transactions could not be justified by the economic profile of the individuals involved, that is, they did not perform any known professional activity, were not officials of a company, nor were they registered for Value Added Tax.

􀂃 Furthermore, the majority of these individuals were registered as candidate refugees.

􀂃 Several names and addresses of principals were linked to an organisation responsible for various terrorist attacks in Asia.

􀂃 Several individuals involved were known in a case related to human trafficking.

All these elements indicated that the transactions performed could be related to terrorism financing.

Given that the individuals involved did not perform any professional activities, the money was believed to have originated, in whole or in part, from illegal activities, i.e. trafficking in human beings.

Indicators:
• Transactions not in keeping with expectations
 
2. Fraud Related Activities:
 
Mr. L, a foreigner residing in Eastern Europe, opened a current and a securities account with a bank in Country A. Immediately after it was opened the current account was credited with amounts between 20 and 70 EUR. These were payments for articles sold on an auction site. The payments were mostly by order of persons from Western Europe. The communications referred to the sale of luxury brands. The money was subsequently transferred to Mr. L’s account in his country of residence. Over the course of a few months, the total sum amounted to several thousand Euros. There was no economic justification for opening bank accounts in Country A nor for the transactions being performed there as the individuals did not have any ties with the Country.

Searches on the auction site revealed that Mr. L used a different name and that the buyers had posted negative comments about him, mentioning that the goods offered by him were counterfeit.

The amounts deposited on Mr. L’s account to pay for the articles on the auction site were particularly low for luxury items and this was mentioned in the communications accompanying the payments.

All these elements indicated that the person was involved in counterfeit trade through an auction site and the proceeds were laundered through more than one account.

Indicators:
• Use of foreign bank accounts
 
3. Misuse of Business Facilities:
 
Company A, managed by Mr. O, sold a property to company B, managed by Mr. R, for a significant amount for which the deposit was paid in cash. A large part of the final price was also paid in cash. When the notary who had executed the transaction noticed these transactions he sent a disclosure to the European Financial Intelligence Unit.

The Unit’s analysis revealed the following elements:

􀂃 The notary deed showed that money for the cheque to the notary was put in the account of company A by way of a cash deposit two days before the cheque was issued.

􀂃 Information from the bank showed that company A and Mr. O’s personal account were credited by substantial cash deposits. This money was used for, among other things, reimbursing a mortgage loan, and was withdrawn in cash.

􀂃 Police sources revealed that Mr. O and Mr. R were the subject of a judicial inquiry into money laundering with regard to trafficking of narcotics. They were suspected of having invested their money into purchasing several properties in Europe through their companies.

Indicators:
• Purchase of valuable assets
 
4. Misuse of Charities:
 
A European national asked his bank for a direct debit instruction from his account to a NPO in Country A. The reference that accompanied this direct debit instruction referred to the sponsoring of an individual.

Further investigation revealed that the NPO was known to be closely linked to certain groups who financed acts of terrorism. Furthermore, the name of the individual who was to be sponsored was mentioned on the United Nations list of persons and organisations suspected of being linked to Osama Bin Laden, the Al Qaeda network and the Taliban.

 Indicators:
• Abuse of non-profit organizations
 
5. Misuse of Charities:
 
An NPO held an account on which two individuals from the Middle East, residing in Country D, held power of attorney. The bank found it unusual that the name of the account was not stated correctly by the principals and that some deposits included references in a foreign language which referred to terrorist activities.

Further investigation identified that the NPO’s account was credited by small transfers from several individuals and referenced as donations for the poor in the Middle East. Some cash deposits were also received. Some of the funds were subsequently withdrawn in cash.

Police checks revealed that the NPO was the subject of an investigation for the financing of terrorism. The funds collected by the NPO were apparently intended for training camps in the Middle East.

The police are investigating.

Indicators:
• Abuse of non-profit organisation
 
6. Misuse of Business Facilities:

X, a non-native, repeatedly went to several agencies of two exchange offices in a European country to exchange various currencies into Euros. This amounted to almost 2 million Euros over a period of a couple of months. There was no economic justification for the way these transactions were performed and X had no relation at all with the country in which he was performing these exchanges; he resided abroad and did not have any known professional activity.

The FIU's analysis revealed that there were similarities between X and other persons whose transactions also originated from the same country as X and that they resided in the same neighbouring country. They did not have any professional activity and reputedly were still students. Some of these transactions were even performed the same day within a thirty-minute interval.

Information from the FIU in the individual’s country of residence made clear that the individuals involved were known for trafficking in narcotics, which corresponded to the typological indicators in this case file.

The police are investigating.

Indicators:
• Currency exchanges / cash conversion
 
7. Fraud Related Activities:
 
The account of Mr. X with bank A in a European country was credited with a substantial amount by means of an international transfer by order of Mr. Y with bank B abroad. The next day Mr. X withdrew all the funds in cash. Subsequently bank A were informed by bank B that the transfer was fraudulent, the bank then disclosed to the FIU.

The Unit’s analysis revealed the following elements:

􀂃 Mr. X’s account was credited by a transfer from company P, established in a neighbouring country.

􀂃 An employment contract was signed between this company and Mr. X. This stipulated that the personal bank account of the latter would be credited by an international transfer. This transfer corresponded to the transactions disclosed by bank A. In accordance with the agreement Mr. X withdrew almost all of the money in cash. The rest of the money, which apparently corresponded to his commission, remained in his account.

􀂃 The money was subsequently transferred to a beneficiary in Eastern Europe through a money remittance service and later withdrawn in cash.

Apparently company P used Mr. X as a financial intermediary, using his account in exchange for a commission of 8%.

The first stage of the deceit was "phishing" of a private individual's account, then an international transfer being made unbeknown to the patron, which led to a money remittance to Eastern Europe via the account of another private person in the European country. The money was later laundered by means of cash withdrawal.

Indicators: Phishing
• Unexplained business transactions
 
8. Fraud Related Activities:

A bank disclosed several suspicious transactions by Asian nationals residing in a Western European country who had opened several accounts in Country A. Over the period of a few months, the account of one of these Asians, Mr. X, was credited with various international transfers from Western Europe. The account was then debited by a substantial transfer to a foreign account in name of Mr. X as well as to accounts of other Asians. There was no economic justification for these transactions.

Analysis revealed the following elements:

􀂃 Mr. X was a tax consultant who was introduced to the bank by a lawyer.

􀂃 Mr. X and the lawyer later introduced other Asians to the bank.

􀂃 Mr. X was known to the police for fraud. He was suspected of having received money from Asians by offering interest of 4%-20%. The amounts assigned to him were never paid back. Part of the money was sent to Country A.

􀂃 Mr. X possibly moved part of the money from Eastern Europe to Country A to hamper further investigation into the origins of the money.

These elements indicate that the money credited to Mr. X’s account from Eastern Europe, which was partially transferred to an account abroad in his name, probably originated from the fraud that he had set up.

Indicators:
• Use of foreign bank accounts
 
9. Misuse of Charities:

Several individuals from the Middle East residing in a European Country X opened accounts with various financial institutions in the names of Company A and Company B, both companies having been established in Western Europe, and an NPO established in Country X. These foreign nationals were officers of the companies and organisation and all were active in film production and telecommunications.

Several cash deposits from foreign nationals took place on these accounts. The total of the deposited funds amounted to up to several million Euros. Part of the money was used to increase company A’s capital and part was used for international transfers to other companies which were also active in film production. Police sources revealed that company A’s managers were active in an organisation suspected of being involved in terrorism and the deposits were suspected to have originated from terrorist activities.

This case file was referred to the criminal court.

Indicators:
• Abuse of non-profit organizations
• Mingling
 
10. Misuse of Charities:

Mr X, of Middle Eastern origin, held two accounts that were solely credited by transfers from the social services and by several cash deposits.

The bank noticed several irregularities, firstly, there was no economic justification for the number of cash deposits as the individual did not have any known profession. Secondly, most of the deposits included references to the telephone industry.

Mr X also had power of attorney on the account of an NPO. This account was only used to perform cash deposits from donors. The amounts credited to the accounts of Mr X and the NPO were mainly withdrawn in cash by Mr X.

Police sources revealed that this NPO was a place of worship where Mr X performed services and they also revealed that this NPO could be linked to terrorist activities.

The police are investigating.

Indicators:
• Abuse of non-profit organisations

11. Alternative/Emerging Remittance Services:

An African national residing in a European country (Country Z) declared that he performed Hawala banking activities. His account was exclusively credited by cash deposits and numerous transfers for small amounts.

Over the course of several months the funds were transferred to company A in Africa. Shortly thereafter the funds were transferred to company B in Country Z. Companies A and B performed international money remittance services. According to the subject, he performed Hawala activities for fellow countrymen wishing to send money to Africa. However, he did not hold any position within companies in country Z where he executed the transactions and he was not registered as a representative of an authorised exchange office.

Police enquiries revealed that he was known to be a member of a terrorist organisation and it is thought that this alternative remittance system may have been used for terrorism financing.

Indicators:
• Underground banking / alternative remittance services
• Wire transfers
• Use of foreign bank accounts
 
12. Gambling:

A suspected drug trafficker was gambling large sums and using third parties to purchase gaming chips on his behalf. The casino reported this activity and multiple chip cash outs on the same day, some being transacted just below the legal reporting limit.

Further investigations found that the subject would send large cash payments to various entities in an Asian country through a remittance dealer, who was a compliant associate and therefore did not make reports on this activity to the FIU.

Indicators:
• Gambling activities
• Criminal knowledge of and response to law enforcement / regulations
• Structuring (smurfing)
 
13. Alternative/Emerging Remittance Services:

The suspects of this case purchased stolen bank account and credit card details from Russia and Eastern Europe via the internet. Payments for these purchases were made through international funds transfers (IFT's) of approximately £1,000 and by way of e-Gold payments. The principal was arrested on multiple fraud and computer crime offences in relation to using these bank details to withdraw funds without authorisation via internet transfers to 'mule' accounts.

Computers seized on arrest revealed details of IFT's transacted through money transfer businesses and e-gold. These transfer methods used by the suspect avoided reports being made to the FIU.

Indicators:
• New payment technologies
 
14. Fraud Related Activities:

Mr B sent emails to people claiming that they could obtain millions of dollars in return for sending him an up-front fee to cover expenses. This is commonly known as advanced fee fraud.

Searches conducted by the FIU identified persons of interest, including Mr B’s wife and associates.

As the investigation continued, analysts from the investigating agency conducted routine searches of the FIU database. These searches were performed to identify the victims of the scam and their location which was critical given the international nature of the offences. The financial intelligence gathered identified that the man had defrauded approximately 5 million dollars from his unsuspecting victims which was crucial in obtaining the man’s conviction.

He has been sentenced to more than 5 years jail having pleaded guilty to the internet scam.

Indicators:
• Use of the internet

15. Terrorism Financing:


A European national asked his bank for a direct debit instruction from his account to a non-profit organisation in another European country. The reference that accompanied this direct debit instruction referred to the sponsoring of an individual. Information collected by the FIU showed that this non-profit organisation was known to be closely linked to certain groups that financed terrorist acts. Furthermore, the name of the individual that was to be sponsored was also mentioned on the United Nations list of persons and organisations suspected of being linked to terrorist groups.

Indicators
• Abuse of non-profit organisations
 
16. Use of Gatekeepers:


An FIU in country Z received information from a foreign FIU regarding two trusts that were established there.

The trustee had been requested to make two payments in favour of a bank in an offshore finance centre.

Correspondence between the trustees and the settlor was always conducted through a law firm, which had also established the trust.

Investigation identified that the beneficiaries of the trusts were siblings. These subjects (Mr A and Mr B) were managers of two companies, established in country Z that had been the subject of a serious fraud investigation. Even though Messrs A and B were not managers of the companies at the time of the investigation, it became clear that part of the funds in the trusts may have originated from the criminal activity of the said companies as they were managed by their father at the time.

Indicators
• Use of gatekeepers
• Use of nominees, trusts, family members or third parties
• Use of offshore banks / businesses
 
17. Terrorism Financing:


The FIU of a European country (Country Z) were made aware of suspicious transactions on a bank account, over which Mr A held power of attorney. The account was held for a non-profit organisation established in country Z and was receiving large amounts of cash.

Mr A was vague in his explanation as to the source of funds and intimated that it was from donations.

As Mr A did not go to the branch office where the account was held, the bank refused to accept the deposits and advised Mr A to attend the branch office where the non-profit organisation’s account was held, however he failed to do so.

The FIU analysed the account and found that the debit transactions included a cheque that had been made out to a notary for the purchase of real estate.

This cheque was covered by the alleged donations and a transfer by order of Mr A. The analysis of Mr A’s personal account revealed multiple cash deposits that corresponded to donations from private individuals. The debit transactions consisted of transfers to the non-profit organisation and international transfers to Mr B.

Mr A was connected to individuals who were thought to be linked to terrorist activities, including Mr B.

It was revealed that Mr A used the non-profit organisation to raise funds and filtered these through his personal account, whilst siphoning some of them to Mr B, where they were possibly intended for terrorism financing.

Indicators
• Frequent cash deposits.
• Abuse of non-profit organisations.
• Purchase of valuable assets.
 
18.Terrorism Financing:


Mr X, a resident of a European country who originated from the Middle East held a bank account which received significant credits from abroad, which were immediately withdrawn in cash. Mr X stated that the money was from a family member abroad.

Apart from these international transfers, the account was also credited with several cash deposits by X a few months later.

Mr X was not known to have any professional activity and received state assistance.

He was known to the police for trafficking in humans and terrorism financing. These elements revealed that his account may have been used to place money from trafficking in humans intended for terrorism financing.

Indicators:
• Wire transfers
 
19.Terrorism Financing:


A political refugee resident in a European country held power of attorney over two accounts (at a bank in that country) in the names of his family members. He did not hold any accounts of his own. One of the accounts exclusively received state assistance benefit payments as the subject was unemployed and had no independent income. The other account was credited by cash deposits. All of the credits were withdrawn via cash machines, thus preventing the identification of the final beneficiary of the money.

Open source checks revealed that the subject had links to a terrorist organisation and further analysis suggested that he was a fund raiser for that organisation.

Indicators
• Use of nominees, trusts, family members or third parties
 
20.Terrorism Financing:


A subject opened two accounts in different branch offices of the same bank, in Country A where he had no official links. The first account was opened in the name of company X, established in North America, and the second one was opened in the name of company Y, established in another jurisdiction.

Both companies were active in the catering supplies sector and their accounts were mainly credited by significant cash deposits (often for round figures) and to a lesser extent by transfers from abroad by order of companies also active in the catering supplies sector.

The funds were then transferred to other European companies in the same sector.

No business rationale or economic justification could be found for performing these transactions in this manner.

Further enquiries found that the individual concerned was the subject of a terrorism investigation in another jurisdiction.

It is suspected that the catering supplies business and the co-mingling may have been a cover for his criminal activities.

Indicators
• Frequent cash deposits.
• Mingling.
• Wire transfers.
• Structuring.
 
21. Terrorism Financing:


A resident of a European country ‘A’ was repeatedly sending funds to his own account in the Middle East with an interval of a couple of days between each deposit.

The FIU in country ‘A’ learnt that the individual was the manager of a company active in the distribution of phone cards and that this company was already known to the police for fraudulent activity.

The subject also managed a phone shop that had already shown irregularities upon regulatory examination.

Enquiries made by Law Enforcement revealed that the individual was known to the police as a fundraising manager for a domestic terrorist organisation.

Analysis would indicate that the individual’s business activities could have been used as a cover for his criminal activities.

Indicators
Mingling