5.2 Anti-Money Laundering (AML) and Counter Threat Finance (CTF) Investigations

Money laundering, terrorism, and threat financing present dangerous risks to businesses and the financial community. A business that does not establish procedures to identify and prevent money laundering or threat finance is at risk for financial losses, compliance violations, operational disruption, and reputational damage.

Financial Institutions (FI) evaluate the risks to their organization from exposure to AML/CTF. Similar to may other sectors, transactions represent the exchange of resources between parties. In finance, rules, laws, and guidelines regulate the terms and process of banking transactions. When criminal actors intend to violate the banking systems and established protocols, FI's and the public are at risk.

Compliance programs assess the threat of criminal activity, vulnerability of a business, and the potential risk to an organization. Financial services are required and/or expected to comply with laws such as the Bank Secrecy Act (BSA), regulations, policies, and International norms. The risk of ignoring or accommodating money laundering in a bank, financial institution, or money service business (MSB) can be catastrophic to a business. At the least, penalties such as fines, fees, or forfeitures, may impact the company’s bottom line. The volume of money laundering is estimated at $300B (USD) in illicit trade.[6]

What actions should a financial organziation take in finding, freezing, and forfeiting criminally derived income and assets? The main objective, in support of law enforcement action, is to break the ties between financial institutions (FIs) and criminals or traffickers, follow the flow of money through investigations, and uncover clients who act as producers, distributers, and beneficiaries in the illicit trade. It is not in the scope of this course to determine illegal activity. The purpose of the exercise is to model the use of location intelligence in AML/CTF investigations.

Basic understandings of AML/CTF, fraudulent transactions, and risk assessment are important for geospatial scientists and analysts working in the financial sector. Many elements of Know Your Customer involve geospatial relationships in place and time. The use of geospatial analysis and location intelligence tradecraft support FI and law enforcement investigations to identify suspicious activity. For additional context, one must understand that not all outlier events relate ot illegal money laundering activity or possible fraud. During the case study exercise, be on the lookout for false leads to test your hypotheses and analysis.

Money Laundering 

Money laundering is an attempt or action to conceal the origins of money obtained from illicit activities. It may also be referred to a a concealment of assets acquired legally or illegally intended for personal consumption or beneficial heirs. (OED 2002)

The U.S. Bank Secrecy Act (BSA) requires Anti-Money Laundering programs, oversight, and action to protect the public, safeguard the economy and financial systems, and refer suspicions of money laundering to authorities. On the financial side, AML is risk-based to identify types of customers, customer locations, and services a financial entity provides. Law enforcement, government regulatory, and public safety agencies conduct AML to investigate suspicions, follow the money, and defeat the ability of an individual, business, or organization to illegally launder money.

The Association of Certified Anti-Money Laundering Specialists (ACAMS) simplifies money laundering as the process of making dirty money look clean. ACAMS provides training, continuing education, seminars, and forums for Certified Anti-Money Laundering Specialists (CAMS certification), law enforcement, financial professionals, and investigators. www.acams.org

Terrorism and threat financing

Terrorism is the unlawful use of intimidation and violence for political or ideological gains, often directed against civilians. There's a direct correlation between the level of activity of a terrorist group and their capability to acquire and move funds. Thus, the primary objective in countering terrorism is to cut off adversary's access to money. Counter Threat Finance (CTF) refers to govenment and Department of Defense action taken to deny, disrupt, destroy, or defeat threat finance systems and networks that negatively affect US interests. Threat finance refers to the methods used by organized criminal organizations or adversary groups to move and use funds to support their illegal activities or profit from them.

Stakeholders of CTF include entire sectors of the public safety (e.g. government, law enforcement, military) and financial community (e.g. private sector banks, insurance companies, mortgage lenders, money service businesses, law firms, accounting firms, real estate, auction houses).

CTF strategies are planned to disrupt an organization's illicit financial activity and counter criminal and terrorist groups' ability to fund and commit criminal plots. Major criminal activities that source adversary threat financing include black market operatons, illegal taxation, counterfeiting of all sorts, credit card fraud and identity theft, embezzlement or diversion of government funds, kidnapping, theft and sale of fuel.

ACAMS describes Terrorist Financing as using funds for an illegal purpose, but the money is not necessarily derived from illicit proceeds. Readers may see similar references to Counter Threat Finance (CTF) and Combating the Financing of Terrorism (CFT); the context is equivalent yet specific actions may differ.

Know Your Customer (KYC)

The imperative to this entire process of strengthening the community's financial security is for FIs to Know Your Customer, or KYC, and verify client identities.

For the purpose of this lesson, we will now refer to money laundering as the target of geospatial analysts' work in AML/CTF investigations. Money laundering is certainly not only a 21st century problem and goes beyond stacks of U.S. $20's, Euro's, and Russian rubles. We must understand how criminals get their funding, where the money comes from, and what tactics are used to avoid detection.

FI's which unintentionally or intentionally launder money introduce similar risks to the financial sector as the criminal actors committing money laundering or threat financing. EU laws and directives hold supervisors and individual employees liable to imprisonment or fines if the FI is found to be assisting a money launderer. The principles of KYC and strict compliance of KYC procedures are designed and emplaced to reduce risks to the FI and employees.

Stages of Money Laundering

There are three distinct stages of Money Laundering:

1. Placement of dirty money into financial institutions,
2. Layering of those funds throughout the financial community, and
3. Integration of laundered money with seemingly legitimate purchases.

Figure 5.2 Typical Money Laundering Scheme, FINRA 2017

Investigators look for evidence of these three sequential events or activities in money laundering cases:

1. Placement is the physical movement of cash, currency or other funds to a place or other form which is less suspicious to law enforcement authorities and more convenient for criminals.

• Placement often takes the form of dividing illicit cash into small sums, making deposit transactions that fall below a Financial Institution (FI’s) regulatory reporting levels. Initial deposits of money into a FI is followed by layering the value of deposits into circulation through multiple FI’s, casinos, shops, bureau de change, other domestic or foreign businesses, and MSBs.
• The entire process is complicated by smuggling currency out of a country, the level of a bank's reporting complexity, currency exchanges, and foreign exchange markets.
• This represents the physical movement of currency and other funds to a place or other form which is less suspicious to law enforcement authorities and more convenient for criminals.

2. Layering involves further separation of the proceeds from their illegal source, using multiple financial transactions, networks linkage, and money flows.

• Electronic banking benefits the launderer, directly or subsequently transferring funds into a Bank secrecy haven (site) with lax reporting requirements. From there, it is common to see withdrawals in form of highly liquid monetary instruments, often money orders, traveler’s checks, and recently, cryptocurrency.
• Criminals distribute their money through wire transfers, purchase of insurance contracts or monetary instruments to obscure audit trails and hide proceeds; often using securities brokers and digital currency markets. High value transfers that may trigger suspicion are wire transfers, currency transactions, or spikes in sales of antiquities.

3. Integration is where illegal proceeds are converted into legitimate business earnings through normal financial or commercial operations; the movement of laundered money into the economy.

• Integration is the reinsertion of successfully laundered proceeds into a market by high value purchases, spending, investing, lending techniques, and legitimate Cross-border transactions. The funds often appear as normal business earnings.
• Layering and then integration changes the form of the proceeds from cash bundles to possessions of similar value; but less conspicuous. It’s not always cash that is reintegrated in the financial system and economy. High value purchases further disguise and launder dirty money proceeds. Classic asset purchases investigated are real estate property, artwork, coins and collectibles.
• Targets of money laundering may also include shell companies, business chains, insurance products, precious stones and jewelry, high value goods (e.g. performance or luxury cars), and antiquities.

Alerts to Suspicion of Money Laundering

Perpetrators of criminal acts strive to make the transactions as innocent-looking as possible. A suspicious activity report (SAR) or suspicious transaction report (STR) is filed by a financial institution to alert authorities of suspicious activity, known or suspected violations of BSA, and finance-related laws. Suspicious transaction detection is used to report banking transactions that may be connected with criminal activities.

When an AML/CTF case is referred for investigation or a geospatial analyst is involved, several types of events trigger alerts. Adverse media, such as a criminal investigation or international incident relating to a bank's customer, often initiates a review of that customer, accounts, and services the institution provides. For US transactions over the $10,000 threshold, a transacton monitoring system alert triggers a review of transfers to identify or rule out patterns of red flags for money laundering. FIs are required to evaluate risks of customers with multiple SARs and multi-layered account risks.

Investigation

What does an investigator look for? What differences appear from typical and atypical methods of money laundering? Where sources of funding are illegitimate, money laundering occurs to make the funds appear legitimate, to conceal its criminal origins.

The geographic issues raise questions:

• Where are the players?
• Where is what they want?
• Where can they get away with criminal activity?

Transactions - in finance and intelligence - represent relationships between entities. AML investigations start with finance customers, behaviors, reported or suspicious activity, and vast disjointed finacial data sets. These are the sources, recipients, conduits, unwitting facilitators, and indications for AML/CTF investigators.

• People
• Transaction data
• Financial institutions
• Correspondent banks
• Bridge-relationships
• Dates, times, transaction accounts and remittance records

Consider using the available financial transactions, credit card statements, bank records, tax documents, net worth analysis, andother open source or third-party geospatial information. From these spreadsheets, screens, and databases, the goal is to identify possible illicit activity, people involved, and to connect geospatial patterns of suspicious financial activity related to space and time.

Patterns of Money Laundering and Threat Financing

High value transactions take place at and through:

• Financial Institutions and banks
• Money service businesses, e.g. Western Union or MoneyGram
• Casinos
• Antiquity auctions
• Real estate markets
• Online digital currency exchanges, or cryptocurrency
• Mobile Money, M-transfers
• Online auction houses, e.g. EBay or Amazon