Chapter 4 Conducting and Responding to Investigations Flashcards
Regulatory recommendations and official findings
investigations that are initiated as a result of regulatory findings should be clearly documented and designed to ensure that all aspects of the findings are addressed within the time frame
senior management or higherlevel professionals should be informed of the findings of the regulatory review,
the status of measures to address them, and their final disposition to ensure the financial organization appropriately remediates the findings or recommendations
Sources of Investigations
- Regulatory recommendations and official findings
- Transaction monitoring rules designed to detect and trigger alerts on potentially suspicious activity
- Referrals from customer-facing employees regarding potentially
suspicious activity - Information obtained from internal hotlines
- Negative media information
- Receipt of a governmental subpoena, search warrant, or other law
enforcement request
Transaction monitoring
Common approaches to transaction monitoring include the creation of in-house, customizable transaction monitoring rules or engaging a third-party vendor to assist with the development and implementation of automated rules
The organization should also have policies and procedures for monitoring for suspicious activity and clearly specify the parameters and thresholds that are set to trigger an investigation
Wolfsberg Group :Statement on Monitoring, Screening, and
Searching- transaction monitoring framework should be
aligned to the risk of its business model, the products and services offered, and its customer baseThe document additionally discusses types of monitoring, typology reviews, and staff training
Referrals from customer-facing employees
manual referral processes via email or telephone, or an internal reporting system that routes the referrals to the appropriate investigative teams
Upon completion of the form by the branch, it is delivered to a
designated AML/CFT compliance email address
The existence of these referral mechanisms and the types of activity
that may warrant referrals should be included in employee training programs
Internal hotlines
known as ethics, compliance, and whistleblower hotlines
The hotlines might ask the employee to provide his identity, but most allow for anonymous reporting
maintain policies, procedures, and processes to confidentially investigate the information provided through the hotline
Negative media information
Investigations can be initiated in response to notable media stories about a financial organization’s customer, how a product is used in the market, a geographic location it serves, or a money laundering or terrorist event
In some instances, financial organizations might proactively
monitor media stories and initiate investigations to determine if a SAR should be filed and if further actions are necessary
Receipt of a governmental subpoena or search warrant
In either situation, the organization has two independent obligations: (1) legally fulfill the requirements of the subpoena or warrant, and (2) determine whether the activity of its customer identified in the subpoena or warrant requires the filing of a SAR
Subpoena
Subpoenas are usually issued by grand juries that operate under the purview of a court
the organization should ensure its senior management and/or legal counsel reviews the subpoena and independently confirms its legitimacy
The financial organization should never notify the customer being investigated
A system must be in place to ensure that all documents are located, whether they be in central files, department files, or individual files.
Documentation of the request should be maintained for at least five years after the request has expired.
Search warrant
- Call the legal counsel and/or designated officer in charge of security, risk management, or a similar business area.
- Review the warrant to understand its scope.
- Ask for and obtain a copy of the warrant.
- Ask for a copy of the affidavit that supports the search warrant. The agents are not obligated to provide a copy of the affidavit; however, when a financial organization is allowed to review the affidavit, it can learn more about the purpose of the investigation.
- Remain present while the agents make an inventory of all items they seize and remove from the premises and keep track of the records taken by the agents.
- Ask for a copy of law enforcement’s inventory of what it has seized.
- Document the names and agency affiliations of the agents who conduct the search
Orders to restrain or freeze accounts or assets
organization should obtain a copy of the order and make every effort to comply
Generally, such an order is obtained based on a sworn affidavit, which is sometimes included with the order
National security letters
National Security Letters (NSLs) are authorized by four federal statutes: the USA PATRIOT Act, Electronic Communications Privacy Act, National Security Act, and Fair Credit and Reporting Act
These amendments significantly reduced the standards required to
issue an NSL and expanded the utilization NSLs by the FBI and other federal agencies in limited circumstances when counterintelligence and counterterrorism investigations are being conducted
common type of NSLs can be issued directly by the FBI
Third-party businesses are not permitted to disclose the receipt of an NSL (i.e., gag order).
Sources of investigations (Case example: Preserving subpoenaed audio recordings)
September 2020
US Commodity Futures Trading Commission (CFTC) announced that it settled charges against Citibank and its affiliates
Citibank failed to preserve audio recordings that were subject to a hold notice in connection with a subpoena sent by the CFTC’s Division of Enforcement in December 2017
admitted that more than 2.77 million audio recordings were deleted due to a flaw in its system
CFTC determined that, from at least 2014 through at least November 2018, Citibank entities violated CFTC regulation 166.3: Failure to
supervise,According to the regulation, records subject to subpoena should be segregated and stored safely
The system reached the storage threshold in October 2018 and automatically began deleting older recordings
- Failed to adequately staff the department responsible for the oversight of audio recording preservation
- Failed to adequately train staff to understand and recognize the risks of deleting audio files based on first-in, first-out settings
- Failed to fully document system changes and ensure adequate
procedures were in place for the system - Failed to preserve audio recordings through system backups
- Failed to escalate the system weaknesses to Citibank management, the legal department, or any other compliance department
Sources of investigations (Case example: Preserving subpoenaed audio recordings)-Key takeaways
- Records subject to subpoena should be segregated and stored safely.
- Senior management should ensure adequate systems and sufficient staff are in place to meet legal and regulatory requirements
- Recordkeeping and regulatory deficiencies should be escalated to senior management and addressed in a timely manner
- Remedial action plans should be required, implemented, and tracked for system deficiencies
Sources of investigations (Case example: Acting on seizure warrants)
Regulators assessed a civil money penalty against a midsize regional bank for failing to maintain an effective anti-money laundering program
failed to file timely suspicious activity reports (SARs). Over
US$100 million in criminal proceeds from a trade-based money laundering scheme was processed through the institution over a four-year period.
the bank failed to freeze US$1.25 million in funds from the suspect account. The bank was ordered to pay a US$10 million civil money penalty and agreed to a US$1.25 million forfeiture.
The AML department also did not adopt policies requiring the review of ubpoenas, keep-open letters, and seizure warrants to determine if the underlying account activity was suspicious
In one case, the AML department failed to review an account subject to multiple subpoenas which resulted in over US$100 million in suspicious transactions
Sources of investigations (Case example: Acting on seizure warrants)-Key Takeaways
- Financial organizations must implement policies and procedures to
appropriately respond to legal orders, including timely processing of
seizure warrants. - Effective communication among departments within financial
organizations is critical to ensure that suspicious activities are reported to the AML department. - The timely filing of SARs is an important element of effective AML
programs
Conducting the Investigation
- Reviewing internal transactions, including value and volume, information obtained from the customer, and other relevant internal documentation
- Determining whether the activity is expected for the customer
- Identifying and reviewing external information to understand the
customer, related entities, and relevant media - Contacting business line employees who are responsible for the account relationship
- Generating a written report that documents relevant findings
A financial investigator’s main objective is to track the movement of money
important for them to develop and maintain policies and procedures regarding financial investigations. Typically, financial organizations identify the procedural steps required, the information needed to complete the investigation, and any recommended next steps
Utilizing the internet when conducting financial investigations
A focused approach to searching reliable and reputable
sources can provide useful third-party information and additional context to the files held by financial organizations
Conducting research on the internet is most effective when there is a clear understanding of what online sources are considered reliable
Independent websites maintained by independent standards bodies (e.g., FATF, Wolfsberg, and OECD) and supervisory authorities (e.g., national and state-level regulators, corporate registrars, electoral rolls, and registration lists) can provide valuable information concerning regulatory status, sanctions, fines, business activities,
and broader commercial activities of the party under investigation
nvestigators must take a close look at the source of the news as well as the news itself, and why getting multiple sources is important to ensure a complete understanding of the story
Tips on searching the internet
Before searching the internet, the investigator should prepare a plan, focusing on the topics under investigation and the types of information needed
The investigator should start with a metasearch using several different search engines and then move to specific search engines with different capabilities. From the metasearch
Some tips on search engines include:
* Using multiple search engines is effective because no single engine covers the entire web.
* If you are searching in a foreign country, use a local search engine.
* Use metasearch engines.
An additional step is to access a commercial database
Conducting the investigation (Case example: Utilizing the internet when conducting financial investigations)
Easy Cash Ltd. is a money services business (MSB) that has been a customer of XYZ Bank Corp for seven months
open-source intelligence (OSINT),OSINT involves searching through a large variety of online sources, such as social media, news sites, public registries, and websites, in a structured and logical manner
The investigator started with a web search of the name of the customer and its ultimate beneficial owner (UBO) for potential adverse media
She also searched the names of senders and recipients of transactions using key words, for example, “money laundering” or “crime,” and Boolean operators such as “AND” or “OR.”
one of the recipients of several transactions was mentioned in multiple reliable media sources as having ties to the Italian Mafia and using Italian restaurants for laundering money
On the home page of Easy Cash, the investigator
discovered that the company was promoting its money transfer services in the Middle East and East Africa and downplaying the need to provide KYC
The investigator also used an online map service to research the address of the Turkish branch and discovered that it was located in a city near the Iranian border
Conducting the investigation (Case example: Utilizing the internet when conducting financial investigations)-Key takeaways
- OSINT is an effective tool for investigations.
- OSINT uses various search engines and conducts key word searches.
- Boolean operators enhance the effectiveness of an internet search.
- Customers’ home pages can provide important information.
- Online translation services can help you utilize foreign websites in
investigations. - Online map applications can verify locations and determine what is
physically near that location. - Report to your FIU when you suspect a customer is engaged in money laundering