Anti-Money Laundering: Developing Scenarios for Transaction Monitoring by AML Report

Anti-Money Laundering: Developing Scenarios for Transaction Monitoring

DISCLAIMER - COPYRIGHT This report is produced by Columbia University’s School of International and Public Affairs (SIPA) as a research project. The authors, Murat Erinç Bayrakci, Weyni Tadesse Berhe, Ryan Kanatbekoff, Angel Li, Eleanor Jiahui Liu, Esther Owens, Lily Wei, Ye Zheng, and Yuxin Zhou, are graduate students studying international policy at SIPA, Columbia University. Annemarie McAvoy, Adjunct Faculty at Columbia SIPA, served as the research advisor. Any views expressed herein are the authors’ own and do not necessarily represent those of SIPA.

TABLE OF CONTENTS ABBREVIATIONS ...................................................................................................................... 1

I. ACKNOWLEDGEMENTS ........................................................................................................ 2 II. ABOUT THE AUTHORS ......................................................................................................... 2

III. IV. A. B. C.

EXECUTIVE SUMMARY ........................................................................................................ 3 INTRODUCTION .................................................................................................................. 4 BACKGROUND AND PROJECT SCOPE ...................................................................................... 4 METHODS AND MATERIALS ................................................................................................. 4 REGULATORY EXPECTATIONS ............................................................................................... 5

V. RECOMMENDATIONS FOR COMMON SCENARIOS ....................................................................... 6 HIGH RISK JURISDICTIONS ................................................................................................. 6 CHARITABLE ORGANIZATIONS .......................................................................................... 10 THIRD PARTY PAYMENTS ................................................................................................. 13 CASH/ATM ACTIVITIES .................................................................................................... 18 ELDER ABUSE ................................................................................................................... 24 MARIJUANA RELATED BUSINESSES ................................................................................. 29 TRADE-BASED MONEY LAUNDERING ............................................................................... 34 VIRTUAL CURRENCY ......................................................................................................... 37 HUMAN TRAFFICKING ....................................................................................................... 42 VI. EMERGING TRENDS IN AML TRANSACTION MONITORING ......................................................... 48

CUSTOMER SEGMENTATION FOR PEER-GROUP TRANSACTION MONITORING ................ 48 APPLYING ARTIFICIAL INTELLIGENCE ............................................................................... 50

APPENDIX ONE ...................................................................................................................... 54 APPENDIX TWO ..................................................................................................................... 55 BIBLIOGRAPHY ...................................................................................................................... 68

FIGURES & TABLES FIGURES Figure 1.Straw Borrower Scheme ....................................................................... 17 Figure 2.Brokerage Account, Collateral and Loan Balance ................................ 17 Figure 3. Transaction Flow of Suspicious Changes in Behaviors ....................... 22 Figure 4. Tripartite Atomic Model for Scenario Development (TAMS-D) ............ 32 Figure 5. Risk Relationships ................................................................................ 32 Figure 6. An Enhanced AML System Incorporating AI ........................................ 53 TABLES Table 1. Scenarios for High Risk Jurisdictions ...................................................... 8 Table 2. Scenarios for Charitable Organizations ................................................. 12 Table 3. Scenarios for Third Party Payments ...................................................... 16 Table 4. Scenarios for Cash/ATM Activities ........................................................ 20 Table 5. Scenarios for Elder Abuse ..................................................................... 26 Table 6. Tripartite Risk Structure ......................................................................... 31 Table 7. Scenarios for Trade-Based Money Laundering ..................................... 35 Table 8. Scenarios for Virtual Currency ............................................................... 39 Table 9. Scenarios for Human Trafficking ........................................................... 44 Table 10. Utilizations & Outcomes of AI .............................................................. 51 ii

ABBREVIATIONS ACAMS ACH AML AML/CFT AI AUSTRAC BBI BSA CFPB CMIR CTR DOJ EFE FFIEF FATF FI FinCEN HRJ MRB TMS FATF MCC ML/TF NYDFS NPO OBI OCC OECD OFAC OTC PEP PLA SAR SEC SIPA TAMS-D US VC

Association of Certified Anti-Money Laundering Specialists Automatic Clearing House Anti-Money Laundering Anti-Money Laundering /Combating the Financing of Terrorism Artificial Intelligence Australian Transaction Reports and Analysis Centre Bank to Bank Information Bank Secrecy Act Consumer Financial Protection Bureau Report of International Transportation of Currency and Monetary Instruments Currency Transaction Report Department of Justice Elder Financial Exploitation Federal Financial Institutions Examination Council Financial Action Task Force Financial Institution Financial Crimes Enforcement Network High Risk Jurisdictions Marijuana Related Business Transaction Monitoring System Financial Action Task Force Merchant Category Classification Money Laundering/Terrorist Financing New York State Department of Financial Services Not for Profit Originator to Beneficiary Information Office of the Comptroller of the Currency Organization for Economic Cooperation and Development Office of Foreign Assets Control Over-the-Counter Politically Exposed Person Portfolio Loan Account Suspicious Action Report Securities and Exchange Commission School of Public and International AffairsColumbia University Tripartite Atomic Model for Scenario Development United States Virtual Currency

I. ACKNOWLEDGEMENTS The Columbia SIPA Capstone team would like to extend our gratitude to our interviewees, participants, and advisor who were pivotal to the success of this research. We would like to thank our SIPA faculty advisor, Professor Annemarie McAvoy, for her invaluable advice and guidance. In addition, the authors would like to thank all regulators, consultants, finance professionals, professors, and technology experts who took the time to share their perspectives and experiences.

II. ABOUT THE AUTHORS Anqi Angel Li (CHINA)

studies International Finance & Management

Ariel Yuxin Zhou (CHINA)

studies International Finance

Eleanor Jiahui Liu (CHINA)

studies International Finance & Management

Esther Owens (US)

studies International Security Policy & Environment/Energy Policy

Lily Wei (AUSTRALIA)

studies International Finance and Technology, Media, & Communications

Murat E. Bayrakci (TURKEY)

studies International Finance, and Economic Policy

Ryan Kanatbekoff (US)

studies International Security Policy, Conflict Resolution, and Russia & Former Soviet Union

Weyni T. Berhe (ETHIOPIA)

studies International Finance, Economic Analysis, & Management

Ye Zheng (CHINA)

studies International Finance

III.

EXECUTIVE SUMMARY

Transaction monitoring systems (TMS) play a key role in a financial institution’s antimoney laundering (AML) compliance program. The systems enable financial institutions to monitor money/assets flows, using scenarios that analyze underlying transactions and generate automated alerts for activities that may be indicative of money laundering1. However, most TMS used in the financial industry today produce high false-positive rates (approximately 90%-95% on average)2, resulting in high operational overhead and missed opportunities to investigate high-value alerts. This white paper discusses the AML risks, regulatory expectations, key transactional red flags and case studies, as well as develops transaction monitoring scenarios for nine AML topics. The nine topics are high risk jurisdictions, charitable organizations, cash/ATM activities, lending products, marijuana, trade-based money laundering, elder abuse, virtual currency, and human trafficking. In addition, the paper discusses two emerging trends, namely, the implementation of artificial intelligence technology and customer segmentation, to enhance the overall quality of AML transaction monitoring.

“Bridging the Gap Between Risk Assessment and Transaction Monitoring”, ACAMS, Sep 19, 2017, www.acamstoday.org/bridging-the-gap-between-risk-assessment-and-transaction-monitoring/ accessed Mar 2018 “Using Artificial Intelligence to Minimize Risk”, Corporate Compliance Insights, June 30 2017 www.corporatecomplianceinsights.com/improving-effectiveness-aml-programs/ accessed in Feb 2018 1

IV.

INTRODUCTION

BACKGROUND AND PROJECT SCOPE

Discussions with several FIs and sample reviews of TMS scenarios identified that the current scenarios are primarily focused on monitoring the value, frequency and velocity of funds/assets movements. There are improvement opportunities to: • incorporate qualitative factors, such as jurisdictions, industries, transaction timing, merchant category classification codes, and payment descriptions as keywords to facilitate more targeted transaction monitoring; • develop behavior-based scenarios to identify abrupt or unusual changes in customers’ transactional behaviors; • develop scenarios to monitor money laundering activities relevant to wealth management businesses; • develop scenarios to monitor emerging money laundering activities; • develop scenarios for activities that mainly rely on manual monitoring; and • use multiple red flags to develop one scenario. Based on the above observations, the objective of this study is to improve the efficiency and effectiveness of AML transaction monitoring by developing TMS scenarios for nine areas. They are broadly classified into the following categories: • high risk jurisdictions, a common AML focusing area; • primary wealth management and banking businesses, such as cash/ATM activities and lending products; • trade-based money laundering, a traditionally manually monitored area; • customers considered high risks by the financial industry, such as charitable organizations; and • emerging AML topics, such as marijuana, elder abuse, virtual currency, and human trafficking.

METHODS AND MATERIALS

The study primarily focuses on developing scenario logics, and not on developing quantitative parameters and thresholds for each scenario as the latter may vary depending on the size, services/products, complexity, and risk appetite of each financial institution. The scenarios developed are applicable to FI’s’ wealth management and nonretail banking operations within the United States. The following methodologies were employed to carry out this study: ● Conducted a review of several FI’s’ transaction monitoring systems and scenarios, along with regulatory requirements and expectations; ● Researched past, current, or pending civil and criminal AML related legal cases related to the aforementioned nine AML areas in order to identify past or emerging money laundering practices and litigations; ● Conducted approximately 50 external interviews with FIs, consulting firms, regulatory agencies, technology firms, and academic institutions to understand current and emerging trends in the AML-TMS field; 4

● ●

Developed transaction monitoring scenarios to facilitate the detection of money laundering risks arising from the nine AML topics; and Identified emerging trends and industry’s best practices to improve the quality of AML transaction monitoring scenarios.

REGULATORY EXPECTATIONS

Interviews with AML specialists identified that regulators use the following parameters to assess the quality of a financial institution’s transaction monitoring system: • Quality of the overall governance structure: a robust governance structure includes well-documented policies and procedures, as well as clearly defined roles and responsibilities for developing, selecting, customizing, validating, and tuning the scenarios. In addition to the internal compliance, investigation, and technology teams, the front-line staff should also provide their knowledge and observations on customer behaviors, as well as being properly trained on money laundering indicators, to facilitate the scenario design and updates. • Adequacy of the scenario coverage: a complete scenario database should cover scenarios applicable to FIs in general and specific scenarios tailored to the financial institution’s business operations. In addition, the scenarios must adequately monitor products and services offered, customers and accounts served, and jurisdictions covered. • Application of a risk-based approach: the scenarios should commensurate with a financial institution’s specific AML risk exposure and appetite. It is essential for the financial institution to map the areas with higher ML/TF and determine residual risks associated with the scenarios. • Value of alerts: FIs should continuously measure the case conversion rates of alerts into Suspicious Activity Reports (SARs). • Periodic quality assurance: internal compliance teams should perform periodic above/below the line testing to achieve optimal thresholds and parameters. It is also important to periodically perform independent audit/testing by external firms to validate scenario quality, for example, through look-back reviews3. • Quality of documentation: it is critical for FIs to adequately and properly document end-to-end scenario design, review, execution, and tuning processes, including judgements applied in alert investigation and SAR filing/non-filing.

Umberto Lucchetti, “AML Rule Tuning: Applying Statistical & Risk-Based Approach to Achieve Higher Alert Efficiency”, ACAMS, www.acams.org/wp-content/uploads/2015/08/AML-Rule-Tuning-Applying-Statistical-Risk-BasedApproach-to-Achieve-Higher-Alert-Efficiency-U-Luccehtti.pdf accessed in Feb 2018

RECOMMENDATIONS FOR COMMON SCENARIOS

This section presents the nine following common AML TMS scenarios: • High Risk Jurisdictions; • Charitable Organizations; • Third-party Payments; • Cash/ATM Activities; • Elder Abuse; • Marijuana Related Businesses; • Trade-based Money Laundering; • Virtual Currency; and • Human Trafficking. For standardization and ease of reference, each of 9 these scenarios is divided into the following subsections: Regulatory/Legislative Requirements and Expectations; Key Transaction Monitoring Red Flags; Case Studies; Recommended Scenarios; and Additional Recommendations. This format is designed to make the report more readable and to also allow this section to function as a standalone treatment of scenario development/enhancement. Appendix II contains all scenario logic recommendations in a table format. Given the report’s methodology and research approach and to facilitate the effective development of appropriate scenario logic, each scenario includes two case studies.

HIGH RISK JURISDICTIONS OFAC maintains lists of countries, entities and individuals associated with terrorism, money laundering and other sanctioned activities. This list is based on United States national security and foreign policy goals. In addition, FATF identified jurisdictions that have strategic AML/CFT deficiencies that have not made sufficient progress or have not committed to developing an action plan with the FATF to address the deficiencies. A list of high-risk countries is available on the FATF website. Regulatory/Legislative Requirements and Expectations Regulators in the US expect fully conformity of FIs to laws, regulations or executive orders. For example, violating executive order 13219 “Blocking Property of Persons Who Threaten International Stabilization Efforts in the Western Balkans” needs to be penalized. Criminal fines for violating the Executive Order or regulations to be issued pursuant to the Executive Order may range up to the greater of $500,000 or twice the pecuniary gain per violation for an organization, or up to the greater of $250,000 or twice the pecuniary gain per violation for an individual. Individuals may also be imprisoned for up to 10 years for a criminal violation. Knowingly making false statements or falsifying or concealing material facts when dealing with OFAC in connection with matters under its

jurisdiction is a criminal offense. In addition, civil penalties of up to $11,000 per violation may be imposed administratively.4 Key Transaction Monitoring Red Flags for High Risk Jurisdictions According to FinCEN, AUSTRAC, and Financial Action Task Force, the following are a non-exclusive list of red flags related to asset movements for HRJs: ● Asset movements with countries having AML laws/regulations deficiencies ● Asset movements with weak FIs and oversight ● Asset movements with politically unstable regimes, lack of financial intelligence unit, high levels of public or private corruption ● Asset movements with reputation as a bank secrecy haven or maintaining excessive secrecy provisions ● Asset movements with high level of internal drug production or located in drug transit regions or uncooperative in the global AML effort ● Asset movements with countries with heightened terror financing/activity exposure ● Relevant US & international sanctions regimes & intergovernmental AML/CFT bodies ● Customers Who Provide Insufficient or Suspicious Information ● Efforts to Avoid Reporting or Recordkeeping Requirement ● Funds transfer activity occurs to or from a financial secrecy haven, or to or from a higher-risk geographic location without an apparent business reason or when the activity is inconsistent with the customer’s business or history ● Customers conducting business in higher-risk jurisdictions ● Customers shipping items through higher-risk jurisdictions, including transit through non-cooperative countries ● Frequent involvement of multiple jurisdictions or beneficiaries located in higher-risk offshore financial centers ● Funds generated by a business owned by persons of the same origin or by a business that involves persons of the same origin from high-risk countries (countries or territories designated by national authorities & FATF as non-cooperative) ● A large number of incoming or outgoing funds transfers take place through a business account, and there appears to be no logical business or other economic purpose for the transfers, particularly when this activity involves higher-risk locations ● Foreign exchange transactions are performed on behalf of a customer by a third party, followed by funds transfers to locations having no apparent business connection with the customer or to higher-risk countries ● Transactions involving foreign currency exchanges are followed within a short time by funds transfers to higher-risk locations ● Multiple accounts are used to collect and funnel funds to a small number of foreign beneficiaries, both persons and businesses, particularly in higher-risk locations ● A customer obtains a credit instrument or engages in commercial financial transactions involving the movement of funds to or from higher-risk locations when there appear to be no logical business reasons for dealing with those locations ● Banks from higher-risk locations open accounts 4

“Executive Order 13219: Blocking Property of Persons Who Threaten International…”, US Dept of Treasury Office of Foreign Asset Control, Jun 27, 2001, www.treasury.gov/resource-center/sanctions/Documents/balkans.pdf

●

Funds are sent/received via international transfers from or to higher-risk locations

Two Case Studies Case Study 1 - Failure to Identify Sub-Account Holders “Firm A operates as an online business providing primarily foreign customers direct access to the U.S. securities markets. Direct online access allows customers to electronically execute trades with virtually no intervention by the firm. Nearly all of the firm's customers, including foreign FIs, reside in overseas jurisdictions known for a high degree of money-laundering risk, as classified by the U.S. Department of State. These foreign FIs opened sub-accounts for foreign customers who could then direct activity without fully disclosing their identity. From January 2006 to September 2009, Firm A failed to adopt risk-based procedures to verify the identity of sub-account holders, even though these customers lived overseas in high-risk jurisdictions and could freely execute trades for their own profit.”5 Case Study 2 - Failure to Update AMS systems for High Risk Jurisdictions “Since 2002, Firm B’s AML program maintained internal controls specific for low to moderate-income clientele within its designated field of membership in New York City. In 2011, Firm B began providing banking services to many wholesale, commercial money services businesses (MSBs). Many of these MSBs were located in high-risk jurisdictions outside New York and engaged in high-risk activity, including wiring millions of dollars per month to countries at risk for money laundering. When Firm B began to service these MSBs, it did not take steps to update its AML programs. As a result, Firm B was unable to adequately monitor, detect, and report suspicious activity or mitigate the associated risks, leaving the credit union particularly vulnerable to money laundering.”6 Recommended Scenarios for High Risk Jurisdictions Table 1. Scenarios for High Risk Jurisdictions

Scenario Logic One

Purchasing Power Parity

Nancy Condon, Herb Perone, “FINRA Fines Firms $750K for Inadequate AML Programs”, FINRA, Feb 2, 2010, www.finra.org/newsroom/2010/finra-fines-firms-750000-inadequate-anti-money-laundering-programs-other-violations Jamal El-Hindi,” ASSESSMENT OF CIVIL MONEY PENALTY “, FINCEN, Dec 2016, www.fincen.gov/sites/default/files/enforcement_action/2016-12-15/Bethex%20Assessment_Final.pdf Alan Cole, “The Real Value of $100 in Each State”, Tax Foundation, Aug 4 2016, https://taxfoundation.org/realvalue-100-each-state-2016/ 6

Scenario Logic Two

Classification of High Risk Jurisdictions

Scenario Logic Three

Payments for University Tuition

The classification of sensitive geographies, locations, and entities need to be consistent with each country’s respective evaluation. For example, France has assessed and published information on 751 sensitive zones.8 In addition, several media reports describe Molenbeek in Belgium as a "no-go area”9. Therefore, assets movements from/to these sensitive/”no-go” regions should be thoroughly investigated and, if applicable, be assigned with higher risk scores. FIs may also consider implementing additional checks to mitigate their money laundering risks associated with university accounts10. A significant portion of international students come from risky countries in terms of money laundering.11 Many US universities also have branches in at-risk jurisdictions such as Dubai, Qatar, Kosovo etc. Thus, it is necessary to perform thorough due diligence on the beneficiaries of these transactions. For example, a college tuition may be paid by a third-party for a student, whose parent(s) are politically exposed persons (PEPs).

“Atlas des zones urbaines sensibles(ZUS)”, Ministere de la cohesion des territoires, https://sig.ville.gouv.fr/Atlas/ZUS/ “Europe's no-go zones: Inside the lawless ghettos that breed and harbour terrorists”, National Post, Oct 11, 2016, http://nationalpost.com/opinion/europes-no-go-zones-inside-the-lawless-ghettos-that-breed-and-harbour-terrorists Michael Lowe, “Why UK’s universities should take a closer look at where money is coming from…”, PWC, Aug 2016, http://pwc.blogs.com/fraud_academy/2016/08/why-the-uks-universities-should-take-a-closer-look-at-where-theirmoney-is-coming-from-and-not-just-.html “Number of international students studying in the US in 2016/17, by country of origin”, www.statista.com/statistics/233880/international-students-in-the-us-by-country-of-origin/ 9

CHARITABLE ORGANIZATIONS Tax evasion and tax fraud through the abuse of charities is a serious crime and it is increasing in many countries. The Organization for Economic Co-operation and Development (OECD) estimates that the abuse of Not-For-Profit Organizations (NPO) costs millions of dollars and is increasing every year12. The money laundering operations run by criminal networks are becoming more complex and frequently involve working with terrorist organizations. Broadly speaking, there are three forms of abuse: (1) Diversion of funds, which can occur alongside charitable work and within a legitimate charity. This could happen at different stages of the NPO business process, such as during the collection and transfer phases13. (2) The use of an entirely bogus or sham organization as a front organization for terror groups14. (3) Broad exploitation, e.g., implementing a charitable cause through a designated terrorist organization15. Regulatory/Legislative Requirements and Expectations According to the Federal Financial Institutions Examination Council’s Bank Secrecy Act(BSA) /Anti-Money Laundering(AML) Examination Manual, “NGO accounts that are at higher risk for BSA/AML concerns include those operating or providing services internationally, conducting unusual or suspicious activities, or lacking proper documentation” 16 . FIs need to implement effective due diligence, monitoring, and reporting systems to manage AML risks associated with these accounts. The Treasury’s Office of Terrorist Financing and Financial Crime provide resources, such as the “Designated Charities and Potential Fundraising Front Organizations for FTOs” 17 , to protect charities from terrorist abuse. Key Transaction Monitoring Red Flags for Charitable Organizations According to Organization for Economic Co-operation and Development, 18 Financial Action Task Force 19 and industry white papers, from a transaction monitoring perspective, key red flags indicating money laundering and terrorist financing risks for charitable organizations are: 12

“Report on abuse of charities for money laundering and tax”, Organization for Economic Co-operation and Development, Feb 2009, www.oecd.org/tax/exchange-of-tax-information/42232037.pdf “Terrorist Financing Typologies Report”, FATF, Feb 2008. http://www.fatf-gafi.org/media/fatf/documents/ reports/FATF%20Terrorist%20Financing%20Typologies%20Report.pdf Ibid. Ibid. “Nongovernmental Organizations and Charities — Overview”, Federal Financial Institution Examination Council, www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_095.htm “Designated Charities and Potential Fundraising Front Organizations for FTOs”, US Dept of Treasury, www.treasury.gov/resource-center/terrorist-illicit-finance/Pages/protecting-fto.aspx “Report on abuse of charities for money laundering and tax”, Organization for Economic Co-operation and Development, Feb 2009, www.oecd.org/tax/exchange-of-tax-information/42232037.pdf Ibid. 13

14 15 16

● ● ● ● ● ●

A high ratio of donation amount to net income20 Abrupt changes in donation pattern, e.g., the client has no history of donating and now is suddenly making donations in varying ranges21 Large cash deposits with either an unknown source of funds or solicited as donations from the public22 Increased frequency of international transactions 23 ,especially from and/or to countries that have a high incidence of terrorism or known tax havens24 NPO funds are commingled with personal or private business funds or NPO funds are transferred to entities not associated with declared programs or activities25 International funds transfers described as ‘loan draw down’ or ‘loan advance’26

Two Case Studies Case Study 1 - Former Congressman Indicted on Conspiracy Charges Former Rep. Steve Stockman (R-Texas) and a former staffer Jason Posey were indicted by a federal grand jury for allegedly taking money intended for charity and using it for personal ($285,0027) and campaign purposes ($165,00028). They were accused of using charitable donations in order to fund their Congress campaign, including conducting surveillance on a potential political opponent. Case Study 2 - Former Charity President Arrested & Charged in ML Scheme Brian J. Brown, former president of National Relief Charities, was indicted on moneylaundering violations for defrauding the charity29. Brown and unnamed co-conspirators established a nonprofit company called Charity One Inc and allegedly induced National Relief Charities to fund Charity One Inc. with $4 million30. The money was supposed to be used to fund educational scholarships for Native Americans. Instead, the entire $4 million was used for their personal gain.

Ibid. Ibid Chris Galloway,” Banking Non-Profit Organizations (NPOs) - How Financial Institutions Can Avoid Wholesale DeRisking NPOs by Mitigating Money Laundering and Terrorist Financing Risks Posed by the Sector”, www.acams.org/wp-content/uploads/2015/08/Banking-Non-Profit-Organizations-NPOs-C-Galloway.pdf Ibid. Ibid. “Risk of Terrorist Abuse in Non-Profit Organizations,” FATF, Jun 2014. www.fatfgafi.org/media/fatf/documents/reports/Risk-of-terrorist-abuse-in-non-profit-organisations.pdf “AUSTRAC typologies and case studies report 2014”, Australian Transaction Reports and Analysis Centre, pg 44, 2014, www.austrac.gov.au/sites/default/files/typologies-report-2014.pdf, pg. 44 Megan Wilson, “Former congressman indicted on conspiracy charges”, Feb 2017 http://thehill.com/homenews/house/326236-former-congressman-indicted-on-fraud-charges Ibid. FBI, “Former President of National Charity Arrested and Charged in $4M Fraud and Money Laundering Scheme”, Oct 2013, https://archives.fbi.gov/archives/portland/press-releases/2013/former-president-of-national-charity-arrestedand-charged-in-4-million-fraud-and-money-laundering-scheme Ibid. 21 22

23 24 25

28 29

Recommended Scenarios for Charitable Organizations Table 2. Scenarios for Charitable Organizations

Scenario Logic One

A High Ratio of Donation Amount to Net Income

[A] or more asset movement(s), which is >= [B] % of existing account balance, to a nonprofit organizations(NPOs), within prior [C] days.

Scenario Logic Two

Rapid Fund Movements between Charitable Organizations and Overseas Destinations or Individuals

Frequent and rapid asset movements between NPOs, and/or between NPOs and unrelated organizations, including international transfers31: [A] or more external assets, received by a domestic potential relief or charitable organization, were transferred out to foreign-based organizations, within prior [B] days.

Scenario Logic Three

Loan Payments

[A] or more external funds movements from/to a potential relief or charitable organization, each of which is >= $[B], within prior [C]days, with payment reference being ‘loan drawdown’ or ‘loan advance’; AND/OR [D]% of the funds movements are to/from overseas destinations.

Scenario Logic Four

Abrupt Changes in Donation Patterns

[A] or more donation contributions and/or [B] or more (donation receiving), each of which is greater than [C] standard deviations away from the account’s or the customer’s average value of prior [D] days

Frequent and rapid asset movements between NPOs and individuals, including international transfers32: [A] or more external assets, received by a domestic potential relief or charitable organization, were transferred out to an individual’s account, within prior [B] days.

Risk of Terrorist Abuse in Non-Profit Organizations,” FATF, Jun 2014. www.fatfgafi.org/media/fatf/documents/reports/Risk-of-terrorist-abuse-in-non-profit-organisations.pdf, case 11, pg.39 Ibid. 31

THIRD PARTY PAYMENTS Third-Party Payment is an increasingly significant concern of AML law enforcement and major financial service institutions, because through a third-party, real source of fund and real destination of proceed can be easily hidden. Many banks only conduct in-depth background check on direct clients, raising the risk of accepting/transferring/carrying illegal assets from a third-party that has beneficiary relationship with the banks’ clients. Tracking down relationships between account holders and third-party is time-consuming and costly, requiring additional long-term and repeating due diligence; however, FIs can rely on ongoing transaction monitoring system to identify suspicious incoming or outgoing transfer activity using both quantitative and qualitative thresholds and timely terminate the transaction without actually identifying the third-party. This section focuses on developing scenarios to identify suspicious activity that may indicate any third-party transaction involved in any violation of the law through a typical lending product, such as mortgage loan and small personal loan. Regulatory/Legislative Requirements and Expectations FinCEN33 First, any individual or entity that have intention to conduct loan modification/foreclosure scams usually approach to FIs (lenders) to apply for eligible loan products; after receiving loan proceeds, criminals may receive, deposit or move certain proceeds illegally. In regards of these circumstances, consistent with AML obligations following 31 C.F.R. Part 103, FIs are required to implement appropriate risk-based rules, procedures, and system application, including customer due diligence on a risk-based approach to avoid developing relationship with criminals who tend to conduct potentially suspicious transactions. Second, FIs should be aware of the fact that their clients (either potential or existing) may become victims of certain loan scam cases. Following the standard of filing suspicious activity (SARs) introduced in 31 C.F.R. Part 103, if a financial institution knows, starts to suspect, or has enough reason to suspect that a transaction involves funds sourced from any illegal activity or that transactions conducted by, within, or through the financial institution have potentials to indicate any activity related to money laundering, terrorist financing, or other violation of the law, the financial institution should then file a Suspicious Activity Report. As published in FinCEN's SAR Narrative Guidance Package, FIs must include a comprehensive enough description about any existing or suspected criminal violations or suspicious activity through their Suspicious Activity Reports.

FinCEN, “Updated Advisory to Financial Institutions on Filing SARs Regarding Loan Modification/Foreclosure Rescue Scams,” DoT, FinCEN. Jun 17, 2010. www.fincen.gov/resources/advisories/fincen-advisory-fin-2010-a006

FinCEN - The Final Rule In 2012, FinCEN published new regulations that required non-bank mortgage lenders and brokers to develop and implement AML programs and file SARs. The final rules close a “regulatory gap” in the reporting of suspected loan fraud, money laundering or terrorist activity in the mortgage industry. In this regard, it is important to note that these new requirements would not conflict with any existing regulatory requirements. Rather, the AML program rule will require lenders and brokers to incorporate these existing requirements and the new requirements for SAR reporting into an overarching and robust program, as same as depository institutions have done. The Final Rules requires lenders and brokers to file complete reports of describing any existing or potential suspicious activity that may be involved at, by or through the financial institution. Suspicious activities include any illegal attempt conducted by client to obtain a loan proceeds or to launder money. It is important to note that with the respect to new rules, no currency transaction reports (CTRs) is required. Key Transaction Monitoring Red Flags for Third Party Payments ● Unexpected payment on loans. A customer may suddenly pay down or pay off a large loan, with no evidence of refinancing or any other reasonable explanation ● Reluctance to provide the purpose of the loan, or the stated purpose is ambiguous. A customer seeking a loan with no stated purpose may be trying to disguise the loan’s true nature. BSA requires all FIs to document the purpose of any loan exceeding $10K except for loans secured by physical properties. Inconsistent use of loan proceeds, especially conflict with customer’s business statement or transaction history rd ● Loan payments from 3 parties. High percentage of payments for a certain loan rd that are paid by 3 parties should raise an alert and requires lenders to conduct further investigation on collateral assets backing the loan because such high percentage of pay down can suggest collateral assets may belong to 3rd party who pay down loans. Such action is an attempt to hide true beneficiary ownership of collateral assets that may be illegally acquired rd rd ● Loan proceeds to unknown 3 parties or collateral assets owned by a 3 party ● Structured down payments or asset movements. An attempt to “structure” a down payment suggests true beneficiary ownership behind transaction may be involved in suspicious activity to conceal true source of the funds ● Attempt to provide paper trail. Attempts revealing unwillingness of clients to provide paper documents are suspicious ● Wire transfer of loan proceeds. Although use of wire transfers is not suspicious in and of itself, sudden changes of transaction methods should be investigated. ● Disbursement of loan proceeds through multiple bank checks. It is possible that a loan customer transfer one loan proceeds through multiple bank checks to one same landing part; each transaction is structured to be under $10,000, a strong indicator of structured payment scheme

●

Loan proceeds transferred to companies outside the U.S. If loan customers are offshore customers or business entities registered in so-called “secrecy havens”, such accounts’ related transactions should be marked at high risk level

Two Case Studies34 Case Study 1 - Land Developer Sentenced in $23M Bank Loan Scheme On June 25, 2015, in Asheville, North Carolina, Keith Vinson, was condemned to 216 months in jail for his part in a plan including the fizzled arrive improvement arrangement of Seven Falls, a fairway and private group in North Carolina. Vinson was additionally requested to serve 3 years of directed discharge and pay $18,384,584 as compensation. Vinson was convicted by a federal jury in October 2013 for conducting mortgage fraud, wire transfer fraud, and money laundering. Vinson and his co-defendants had obtained a certain amount of loan proceeds from multiple banks by applying straw borrower transactions in order to transfer funds to his personal business, Seven Falls since 2008. Vinson and his co-conspirators, including Avery Cashion III, Raymond Chapman and others, also paid inside bank officers, including George Greenwood and Ted Durham who worked as the presidents of 2 separate banks at that time. When straw borrowers hired by Vinson reached their respective lending limit, Vinson recruited additional straw borrowers. Additional straw borrowers acquired further loans to keep former loan accounts current. This type of scheme is known as “loan kiting” and is designed to make payments on former loans. When Vinson’s business (Seven Falls) and his luxury golf real estate project (Queens Gap) eventually failed, Vinson lost millions in property losses and eligibility of acquiring loan products. Law enforcement eventually detected the scheme. In addition, the banks involved failed and were taken over by FDIC. Case Study 2 - Former Bank CEO Sentenced for Bank Fraud & Money Laundering On November 24th, 2014, James Ladio, Delaware, was charged for bank fraud and money laundering, sent to prison for 24 months, and ordered to pay restitution of $700,000. Ladio worked as the founder and the former CEO of Midcoast Community Bank, Inc. Ladio, leveraged his position at the bank and convinced MidCoast bank customers to apply for commercial loans for different but rationale business purposes. However, the true purpose of the loans was to transfer the actual loan money to Ladio’s personal account outside the bank. Ladio was found to have been actively involved in “loan-swap” arrangements with a former Wilmington Trust Co. Market Manager - Brian Bailey. For ten years, they had issued more than 20 loans to each other, exceeding $1.5M. Wilmington Trust Co. eventually called off Ladio’s loans in June 2010.

IRS, “Examples of Money Laundering Investigations – Fiscal Year 2015”, Internal Revenue Service, Dec 2015. www.irs.gov/compliance/criminal-investigation/examples-of-money-laundering-investigations-fiscal-year-2015 34

Recommended Scenarios for Third Party Payments Table 3. Scenarios for Third Party Payments

Scenario Logic One

Potential Straw Borrower

Scenario Logic Two

Same Third-party Destination

Scenario Logic Three

Straw Borrower Fraud See Figure 1 for an illustration of a Straw Borrower Scheme

Scenario Logic Four

Asset Movement/ Circular Fund in Portfolio Loan Account See Figure 2 for an illustration of Brokerage Account, Collateral & Loan Balance

Within [X] business days, [A] or more loan accounts have been opened within lending institutions, each of which is [geographical] related OR [name] related OR [collateral] related OR [address] related OR [company name] related Within [X] business days, [A] or more loan accounts make asset movement outgoing to an unknown third party, each asset movement amount >= $[B], or >= [C]% of each loan balance Time interval between account open time and loan withdraw time: Within [X] business days after account is open, [A] or more asset movements out to an unknown third party, each of which is >= $[B], and >= [C]% of the loan balance (balance party only applicable to Security-based Loan Products); AND Potential Straw Borrower; AND Same Third-party Destination; OR Problematic Collateral: Collateral asset is either [cash equivalent] or [third-party owned] Within [A] business days, [K] or more asset movement from one or more unknown third-parties into [collateralized brokerage account], aggregate to >= $[W] amount AND Within [Y] following business days, [Z] or more asset movement out to an unknown third-party, each of which is >=[M], aggregate to >=[N] or [S]% of the loan balance. (both balance party and collateral party only applicable to Security-based Loan products)

Figure 1.Straw Borrower Scheme35

Figure 2.Brokerage Account, Collateral and Loan Balance36

35 36

Angel Li, one of this studyâ&#x20AC;&#x2122;s authors. Angel Li, one of this studyâ&#x20AC;&#x2122;s authors.

CASH/ATM ACTIVITIES Automated Teller Machines (ATMs) are the ideal financial service delivery points for laundering and terror financing through cross-border cash withdrawals, structuring cash withdrawals, and debit cards. To better capture money laundering activities, FIs should monitor both sides of transactions: incoming money transfer/asset movement/deposit and money withdrawal. However, according to industry research, there are two potential gaps of most current ATM scenarios, which includes lack of integrating the suspicious introduction of funds with cash withdrawals into the scenario and lack of change in behavior analysis. Therefore, this section proposes several solutions, according to industry best practices, case studies, and regulatory expectations. Regulatory/Legislative Requirements and Expectations • Community banks are required to work to continually update account monitoring and due diligence procedures to keep pace with financial criminals. • FinCEN37: As a follow-up to previous SAR Activity Reviews, FinCEN sampled SARs filed after SAR Bulletin – Issue 1 was published to determine if identifiable patterns of suspicious activity associated with ATMs had changed appreciably. • Continued Use of ATM to Avoid BSA Reporting Requirements: ATMs continue to be used to avoid triggering the filing of both CTRs and CMIRs. • Cross-Border Currency Movements: Drug dealers use domestic ATMs to deposit illicit proceeds into FI accounts and then withdraw funds from ATMs in the drug’s country of origin. This facilitates bulk cash smuggling and avoidance of enhanced scrutiny of law enforcement at the border and CMIR filing. SARs sampled in FinCEN’s analysis identified various monetary instruments deposited into accounts, with funds withdrawn shortly from foreign ATMs. Regulators expect FIs to discern different methods of introducing funds, including cash & other monetary instruments, which are then withdrawn in foreign countries. • Update on Suspicious ATM Activity Follow-up analysis of SAR reporting on ATM transactions confirms a continuing trend in suspicious transactions in which funds are wired to/through a U.S. FI from a foreign source and then withdrawn in cash in a third country using ATMs. There are at least 57 nations that have been recorded in SARs for this ATM withdrawal pattern. Colombia has 408 occurrences, while Venezuela has 145 and México has 119. The wire transfers were conducted from Switzerland, Italy, Germany, and England, in amounts exceeding several hundred thousands of dollars.38 • Structuring: SAR indicated 2 prevalent patterns of structuring: customers making multiple cash deposits and/or withdrawals aggregating to sums over $10K on the same day at one or more ATM locations, and customers using a combination of same-day teller and ATM activity.

The SAR Activity Review Trends & Tips Issue 7" Bank Secrecy Act Advisory Group. Aug 2004. www.fincen.gov/sites/default/files/shared/sar_tti_07.pdf#page=29 The SAR Activity Review Trends & Tips & Issues." Bank Secrecy Act Advisory Group. Oct 2000. www.fincen.gov/sites/default/files/shared/sar_tti_01.pdf 38

Key Transaction Monitoring Red Flags for Cash/ATM Activities • High risk jurisdiction. Asset movements involving countries: a) with heightened exposure to terrorist financing and activity; b) that have deficiencies in their AML laws and regulations; c) with politically unstable regimes, lack of financial intelligence unit, high levels of public or private corruption; d) that have reputation as a bank secrecy haven or maintain excessive secrecy provisions; e) with high level of internal drug production or located in drug transit regions or uncooperative in the global AML effort ● Abnormal location: customer repeatedly uses a bank or branch location geographically distant from their home or office without sufficient purpose ● Deposits/withdrawals of newly open/close account during short time period after opening and then subsequently closes account or account becomes dormant. Or, an account with little activity suddenly experiences deposit/withdrawal activities ● Accounts with a high volume of activity, which carry low balances or are frequently overdrawn, may be indicative of money laundering or check kiting ● Activity inconsistent with the customer’s business a) The currency transaction patterns of a business show a sudden change inconsistent with normal activities b) A retail business has dramatically different patterns of currency deposits from similar businesses in the same general location c) Goods/services purchased do not match stated line of business ● Frequent deposits/withdrawals with no apparent business source, or the business is of a type not known to generate substantial amounts of currency ● Unusual transaction methods that haven’t been actively used before, even though the method itself is common, suddenly large increase ● Currency deposited/withdrawn in amounts just below reporting thresholds ● Multiple accounts with numerous deposits under $10,000. An individual or group opens several accounts under one or more names, and makes numerous cash deposits just under $10K, or deposits containing bank or traveler’s checks ● Customers with multiple accounts at a bank or at different banks for no apparent legitimate reason. Accounts may be in same or different names with different signature authorities. Inter-account transfers are evidence of common control. ● Customer conducts large deposits/withdrawals during a short time period after opening and then subsequently closes account or account becomes dormant. Or, an account with little activity suddenly experiences deposit/withdrawal activity • Red flags for bulk currency shipments a) Large volumes of small denomination US bank notes sent from foreign nonbank FIs to their US accounts via armored transport, or sold directly to US banks b) Exchange of small denomination US bank notes for large denomination notes that may be sent to foreign countries c) Deposits by foreign nonbank FIs to their US bank accounts that include 3rd party items, like sequentially numbered monetary instruments

d) Deposits of currency and 3rd party items by foreign nonbank FIs to their accounts at foreign FIs and thereafter direct wire transfers to foreign nonbank FIâ&#x20AC;&#x2122;s accounts at US banks Two Case Studies Case Study 1 - Drug Syndicates Used Commonwealth ATMs to Launder Cash39 Commonwealth is accused of breaching AML laws. According to regulators in Australia, Commonwealth Bank had delayed or failed to report over 50,000 suspicious transactions. Total amount involved in ATM transactions reached AUD$77M. Regarding ATM withdrawals, a drug syndicate laundered more than $6M via CommBank IDMs between June 2014 and January 2015. The undetected transaction pattern was that money was transferred out of accounts immediately after deposit. 3 individuals have been charged with dealing in proceeds of crime connecting with drug importation syndicate. Case Study 2 - Rabobank to Pay $369 million in Mexico Money-Laundering Case40 In 2010, Mexico imposed restrictions on cash deposits at the country's banks. As a result, more illicit money was deposited at Rabobank branches in Calexico and Tecate, under the plea agreement. Suddenly, the number of accounts rose by more than 20% in Calexico and Tecate. Bank officials apparently reasoned that the increased money came from drug trafficking and organized financial crime. One customer even funneled more than $100M through suspicious activities. Customers in Tecate withdrew more than $1M in cash a year from 2009 to 2012. Often structured withdrawal can circumvent CTR filings. Recommended Scenarios for Cash/ATM Activities Note: all the recommendations exclude the deposit function of ATMs. Table 4. Scenarios for Cash/ATM Activities

Scenario Logic One

Money In or Out of High-risk Jurisdictions

Scenario Logic Two

Cross-border Money Deposits and Withdrawals

"This is how drug syndicates used Commonwealth ATMs to launder cash." Business Insider Australia, Aug 3, 2017. www.businessinsider.com/this-is-how-drug-syndicates-used-commonwealth-atms-to-launder-cash-2017-8?IR=T. Spagat, Elliot. "Rabobank to pay $369 million in money-laundering case." Fox News, Feb 7, 2018. www.foxnews.com/us/2018/02/07/rabobank-to-enter-plea-in-money-laundering-investigation.html. 39

Scenario Logic Three

Rapid Money Movements (In and Out)

Scenario Logic Four

Money Withdrawals from Rapid Sales of Securities or Investment Capitals without Rational Reasons Suspicious Behavioral Changes in Frequency, Aggregate Amount, Geographic Distance, Crossborder Transactions, Third-party Involvement, Transaction Methods, and Risk Rating

Scenario Logic Five

See Figure 3 for an illustration

AND ATM in foreign country, which is different from country where customer conducts normal activities. After single or multiple transfers/deposit made into the bank within [B] days, within [C] time units, another single or multiple withdrawals immediately (e.g., last day in and first day out) out of the bank at customer account level, with a cumulative amount aggregated to ranging from [100-D] % to [100+D] % of the cumulative amount of the incoming transfers/deposits within [B+N] days. Customer sells securities after short-term holding period within [B] days, within [C] time units and withdraws proceeds or investment capital out of bank at customer aggregate account level, with cumulative amount aggregated to granting from [100-D] % to [100+D] % of cumulative amount within [B+N] days Frequency: The frequency of cash withdrawal activities within [B] days, is [E] standard deviations away from the account/customer’s average historical amount of [O] days; OR Aggregate Amount: The aggregate amount for the [D] transactions within [C] days, is [F] standard deviations away from the account/customer’s historical average amount of [P] days; OR Cross-border Transactions: From [100-B] % to [100+B] % of the account activities within [D] days are cross-border transactions, which is [G] standard deviations away from the account/customer’s average historical amount of [Z]; AND Country that occurred the cash advance activity is different from country in which account/customer conducts normal activities; OR Distance: Cash advance activity is >= [C] miles geographically distant from account/customer’s daily activity area; OR Third-party Involvement: From [100-D] % to [100+D] % of the fund's transfers within [G] days are from unusual 3rd parties, is [H] standard deviations away from account/customer’s average historical amount of [Q] days; OR Transaction methods: The transaction method is different from the normal one;

AND Aggregating amount of the money introduced is [I] standard deviation from account/customer’s average historical amount of [R] days; OR Risk Rating: Activities are inconsistent with the clients’ risk rating Figure 3. Transaction Flow of Suspicious Changes in Behaviors41

Additional Recommendations for Privately Owned ATMs for Cash/ATM Activities Most US states do not register, limit ownership, monitor, or examine privately owned ATMs or their providers. Money Launders can replenish ATMs with illicit currency themselves or collude with merchants and previously legitimate ISOs with illicit currency at a discount. All illicit currency will be subsequently withdrawn by legitimate customers. This results in ACH deposits to the ISO’s account that appear as legitimate business transactions.42 The BSA/AML Examination Manual recommends that institutions43: 41

Yuxin Zhou, one of the study’s authors. Bank Secrecy Act Anti-Money Laundering Examination Manual. Federal Financial Institutions Examination Council, www.ffiec.gov/bsa_aml_infobase/pages_manual/olm_069.htm. Accessed 8 May 2018. Shonk, Krista. "Know Your Customer: ATM Transactions May Indicate Money Laundering." Community Banker 16:4. Apr 2007: 56-57. Columbia University Library. https://search-proquestcom.ezproxy.cul.columbia.edu/docview/195162909?pq-origsite=summon&accountid=10226. 42

● ●

Verify ATM owners’ legitimacy by reviewing corporate documentation, licenses, permits, contracts, or references, including the ATM transaction provider contract Review public databases for information on the ATM owners; Obtain the addresses of all ATM locations, ascertain the types of businesses in which the ATMs are located, and identify the targeted demographic of ATM users Determine expected ATM activity levels, including currency withdrawals Ascertain ATMs’ sources of currency by reviewing copies of armored car contracts, lending arrangements, or other appropriate documentation

Additional Recommendations for Financial Institutions: • Conduct due diligence on all private ATMs that an FI conducts transactions with, including their customers and owners. • Coordinate with other FIs to record collected information of private ATMs in the FI’s transaction system.

ELDER ABUSE Elder financial exploitation (EFE) has emerged as one of the top frauds resulting in individuals losing their assets or even dignity of life, but a large fraction of incidents goes underreported or undetected. 44 The U.S. Financial Crimes Enforcement Network (FinCEN) defines Elder Financial Exploitation as “the illegal or improper use of an older person’s funds, property or assets”.45 According to the data in 2015, EFE causes the seniors to lose $2.9 billion to $36.5 billion each year. Regulatory/Legislative Requirements and Expectations Disclaimer: this report will focus on the regulations at the federal level As early as in 1999, the Gramm-Leach-Bliley Act (GLBA) has paved the path to disclose necessary information for detection of suspected financial exploitation46. With recent developments, several regulatory organizations have issued documents to either mandate or advocate that FIs enhance their programs on combating EFE. In 2011, FinCEN advised FIs to report suspicious activities in relation to EFE in their FIN2011-A003 “Advisory to Financial Exploitation” document 47 . Subsequently, in March 2016, the Consumer Financial Protection Bureau (CFPB) also published an “Advisory for Financial Institutions on Preventing and Responding to Elder Financial Exploitation” to recommend that FIs adopt a comprehensive definition of EFE and have a holistic view of potential crimes48. The increased scrutiny reminds FIs to embrace the trend of a higher expectation of programs combating EFE. As criminals can move the seniors’ fund through methods such as wire transfer, FIs also need to comply with transaction-specific regulations such as the Electronic Fund Transfer (EFTA) and Regulation E49. Key Transaction Monitoring Red Flags for Elder Abuse According to FinCEN, CFPB, OCC, ACAMS and other financial service firms, the following are a non-exclusive list of red flags indicating EFE for the Wealth Management and Banking division. By incorporating these red flags into the TMS and combining with suspicious activities, such as a sudden wire transfer to an oversea account, FIs can be at a better position to detect EFE-related money laundering. 44

FinCEN and Consumer Financial Protection Bureau. “Memo on Financial Institution & Law Enforcement Efforts to Combat Elder…”, Aug 30, 2017. www.fincen.gov/sites/default/files/2017-08/8-25-2017_FINAL_CFPB%2BTreasury% 2BFinCEN%20Joint%20Memo.pdf Ibid. “The Gramm-Leach-Bliey Act”, Electronic Privacy Information Center, https://www.epic.org/privacy/glba/ “Elder Financial Exploitation—Surveillance is Only Part of the Solution”, ACAMS Today, last modified May 27, 2015. www.acamstoday.org/elder-financial-exploitation-surveillance-only-part-solution/ Consumer Financial Protection Bureau, “Advisory for financial institutions on preventing and responding to elder financial exploitation”. https://files.consumerfinance.gov/f/201603_cfpb_advisory-for-financial-institutions-onpreventing-and-responding-to-elder-financial-exploitation.pdf Ibid. 45 46 47

● ● ● ● ● ● ● ● ● ● ●

Unexplained non-sufficient balance and ignorance of overdraft fees50 Sudden increase in activities of inactive accounts51 Unexplained opening of a joint account or adding a third-party as joint owner to an existing account52 Uncharacterized new recipient of ACH payment53 Change in recipient of electronic bill payments54 Abnormal or increasing transactions of wire transfers55 Unusual gaps in check sequence numbers 56 Closing of certificates of deposit or accounts without regard to penalties57 Overconcentration of investment in a specific security or sector58 Changes to account information, such as mailing address and signature59 Sudden increase in the amount spent for Internet purchases60

In addition, organizations such as care homes and nursing facilities are also deemed as high risk in getting involved in EFE61 and can be a potential red flag. Two Case Studies Case Study 1 - TX Federal Court Investigated Fraud Schemes Targeting the Elderly On February 2, 2018, the Federal Court in Austin sentenced two Nigerian citizens and a Houston man to prison for their conspiracy to commit money laundering. The illegal funds worth millions of dollars were raised through vulnerable citizen, such as the seniors. The investigation was targeted at a money laundering network that laundered the proceeds from various fraud schemes, including the “grandson-in-jail” frauds over the phone targeting elderly victims62. Case Study 2 - An Elderly Couple Tricked into International Sweepstakes Fraud An elderly US couple in Raleigh, North Carolina, were informed that they won an international sweepstakes. They paid the fraudsters the fees as requested several times. 50

Consumer Financial Protection Bureau, “Recommendations and report for financial institutions on preventing and responding to elder financial exploitation”, Mar 2016. https://files.consumerfinance.gov/f/201603_cfpb_ recommendations-and-report-for-financial-institutions-on-preventing-and-responding-to-elder-financial-exploitation.pdf Ibid. Ibid. Ibid. Ibid. Ibid. Ibid. FinCEN, “Advisory to Financial Institutions on Filing SARs Regarding Elder Financial Exploitation”, Feb 22, 2011. www.fincen.gov/resources/advisories/fincen-advisory-fin-2011-a003 Nick Nichols, “The rise in senior and vulnerable investor abuse”, DST Systems, Oct 3, 2017, www.dstsystems.com/insights/rise-in-senior-and-vulnerable-investor-abuse Denise Hutchings, “28 Red Flags for Elder Financial Abuse”. Verafin, Apr 28, 2015. https://verafin.com/2015/04/28red-flags-for-elder-financial-abuse/ QuantaVerse. Interviewed by Eleanor Jiahui Liu and Lily Wei. Personal interview. Feb 20, 2018, New York. “Elder Financial Exploitation—Surveillance is Only Part of the Solution”, ACAMS Today, May 27, 2015. www.acamstoday.org/elder-financial-exploitation-surveillance-only-part-solution/ US Attorney’s Office W District of Texas, “Seven Sentenced in Money Laundering Scheme…”, Feb 28, 2018, www.justice.gov/usao-wdtx/pr/seven-sentenced-money-laundering-scheme-involving-proceeds-multiple-foreign-scams 51 52 53 54 55 56 57

60 61

When they were deep in debt, the fraudsters offered to hire them to join the sweepstakes company and ordered them to repack and mail out the large amount of cash arriving at the couple’s home. The scam was not detected and reported until finally the couple’s children became suspicious63. From the two case studies, it can be learnt that fraud and schemes are the most common forms of EFE, and it can be difficult for elders to detect these schemes themselves. Recommended Scenarios for Elder Abuse Table 5. Scenarios for Elder Abuse

Scenario Logic One

Change in Transaction Methods

Scenario Logic Two

Decrease in Routine Income

Brooke S Charles, “The Most Common Schemes for Targeting the Unknowing Money Mule”, Security Intelligence, Sep 6, 2014. https://securityintelligence.com/the-most-common-schemes-for-targeting-the-unknowing-money-mule/ 63

Scenario Logic Three

Careless Management of Account

Scenario Logic Four

Joint Account

Scenario Logic Five

Inactive Account Suddenly Becomes Active

Scenario Logic Six

Money Mules

Scenario Logic Seven

Change in Times

Scenario Logic Eight

Exploitation by the Caregiver

from the KYC process shows that the senior is living in a nursing facility or is relying on a caregiver to take care of daily live. The amount of outgoing cash movement is [A] standard deviation away from the average historical value within the prior [B] days; AND The remaining account balance <= $[C]; AND/OR The amount of overdraft fee >= $[D] within the prior [E] days. The aggregating amount of outgoing asset >= $[A] were made after the opening of a joint account; OR after a new joint account holder was added within the prior [C] days; AND The aggregating amount of outgoing asset >= [D] standard deviation away from the historical average within the prior [C] days. This scenario should be closely examined when the joint account holder is not a close family member to the senior client. The number of transactions is [A] standard deviation away from the average historical amount within the prior [B] days; AND [C] or more percentage of transactions were made to an unidentified third party. [A] or more numbers of incoming wires/deposits of dollar cheques, aggregating >= $[B], within prior [C] days; AND [D] or more numbers of outgoing wires/deposits of cheques or cash equivalents, aggregating [E]% of the account balance, within prior [F] days; AND The duration between the incoming and outgoing fund transfers is equal to or less than [G] days; AND/OR [H]% of the outgoing transfers within prior [I] days are cross-border transactions. The number of cash withdrawals and/or purchases between [A] pm to [B] am are [C] standard deviation away from the average historical value within the prior [D] days. The aggregating amount of outgoing transfers to an account under caregiver/nursing facilities is >= $[A]; AND

The aggregating amount is [B] standard deviation away from the average historical amount within the prior [C] days.

Scenario Logic Nine*

Churning of the Customer Investment Account

This scenario will be more effective when combing with keywords screening, including: “nursing”, “health”, “care”, “medication”, “hospital”, “home”, as seniors being taken care of by a third-party is more vulnerable. The number of trading in the brokerage account >= [A]; AND The aggregate amount of trading value is [B] standard deviation away from the aggregating historical average in the prior [C] days; AND/OR The aggregating amount of investment in high risk portfolio >= [D]% of total investment account; AND/OR The investment in a single security >= [F]% of total investment; AND/OR The investment in a single industry >= [G]% of total investment.

*This scenario requires collaboration with the risk team and financial advisors on further investigation. Customer segmentation technique may be required if the net worth varies significantly across clients and different thresholds should be set for different groups.

MARIJUANA RELATED BUSINESSES

As of 2018, more than 22 states allow the use of marijuana for medicinal purposes and two states have legalized marijuana for recreational use. Federally, marijuana is illegal, and since financial institutions (FIs) are federally regulated, there is a significant risk to providing services to marijuana-related businesses (MRBs). This incongruity between federal and state laws complicates offering services to MRBs. FIs must address the challenges of marijuana’s partial legalization at the state level while it remains illegal at the federal level. Among the chief legal & regulatory challenges and risks FIs must address prior to offering services to MRBs is implementing a TMS for MRBs that aligns with regulatory expectations. FIs must review existing AML programs to ensure that TMS and due diligence controls identify emerging trends and associated risks unique to MRBs.

The U.S. Financial Crimes Enforcement Network (FinCEN) issued guidance in 2014 (FIN2014-G001) on meeting BSA expectations (including SAR filing) and offering services to MRBs. 64 While FinCEN requires MRB services be consistent with BSA obligations, federal, and state laws, it grant FIs latitude to determine whether or not to open, close, or refuse any account based on factors unique to each FI. Although customer due diligence is a critical aspect of making this assessment, FIs should consider whether an MRB violates any Cole Memo priorities. 65

Regulatory/Legislative Requirements and Expectations MRB-related risk is correlated with the current US administration. Under the Obama administration, US regulatory bodies appeared to anticipate further legalization of marijuana. This was indicated by multiple FinCEN guidelines meant to allow FIs to accommodate accounts which primarily belong to MRBs. To manage SAR filing requirements, FinCEN instructed FIs to differentiate SAR filings into three categories: “Marijuana Limited”; “Marijuana Priority”; and “Marijuana Termination”. 66 The Obama-era 2014 Cole memo set eight enforcement priorities to guide DOJ attorneys in prosecuting cannabis-related crimes after Colorado and Washington passed recreational cannabis legislation. Right after the Cole Memo, to encourage banking for cannabis industry, the DOJ issued special guidance for Marijuana Related Financial Crimes. This guidance encouraged the use of prosecutorial discretion regarding financial crimes that pertained to the Controlled Substance Act violations, if FIs ensured customers adhered to Cole Memo guidelines. FinCEN’s 2017 Update, shows a steady, sustained increase in the number of FIs providing services to MRBs. Under the Trump administration, Sessions’ January 2018 memo seems to indicate a reversal of this

Dept of Treasury, FinCEN. 2014. Guidance: BSA Expectations Regarding Marijuana Related Businesses, FIN 2014G001. www.fincen.gov/resources/statutes-regulations/guidance/bsa-expectations-regarding-marijuana-related-businesses. James M. Cole, Deputy Attorney General, US Dept of Justice, Memorandum for All US Attorneys: Guidance Regarding Marijuana Enforcement. Aug 29, 2013, www.justice.gov/iso/opa/resources/3052013829132756857467.pdf. Ibid. 64

accommodation. 67 However, since FinCEN (rather than DOJ) issued BSA Guidance, Sessions’ rescission does not affect updated MRB SAR filings guidance. Key Transaction Monitoring Red Flags for Marijuana-Related Businesses FinCEN’s Cole Memo advisory introduced market-based red flags based on factors such as: state-imposed limitations, population demographics, and market competitors. The following red flags are categorized as either market-, behavior-, or keyword-based. 68 Market-based • Generating more revenue than expected given state-imposed limitations, local competitors, or population demographics • Depositing more cash than is appropriate given revenue reported for federal & state tax • Making cash deposits/withdrawals over a short period of time that are excessive relative to local competitors or expected business activity Behavior-based • Third party deposits with no apparent connection to account-holder • Uptick in activity by 3rd parties offering goods or services to MRBs (e.g. equipment or shipping) • Commingling of funds with MRB owner’s personal account or accounts of unrelated businesses • Increase over time in value of digital currency transactions Keyword-based • Third-party transfers to businesses with non-descript names that purport to engage in activity unrelated to marijuana (e.g., “management” companies) • Transactions to/from high-risk US states such as NY, CA, TX, GA, & FL Two Case Studies Case Study 1 - Texas July 2013, Dallas, Texas. Defendant owned a business called Hydro Expo that facilitated marijuana cultivation by supplying growing equipment and supplies to persons illegally growing marijuana. Law enforcement arranged purchase of $20,000 worth of growing equipment and supplies from Hydro Expo in undercover operation. Undercover agents informed defendant that equipment and supplies were to be used for illegal marijuana cultivation. Defendant stated he would break up a $17,000 cash payment into smaller

Jefferson B Sessions, III. Attorney General, U.S. Department of Justice, Memorandum for All US Attorneys: Marijuana Enforcement. Jan 4, 2018, www.justice.gov/opa/press-release/file/1022196/download These red flags are based on findings from FinCEN’s BSA Expectations Regarding MRBs, AUSTRAC, and the DEA’s 2017 National Drug Threat Assessment, as cited in the bibliography. 67

amounts and that purchasers would not be identified in any paperwork. Defendant never filed required IRS Form 8300.69 Case Study 2 - California April 2013, Fresno, California. Defendant structured $693,905 in cash derived from sale of marijuana to evade currency transaction reporting requirements by using multiple bank accounts held by friends and relatives. Marijuana was shipped to other states by people recruited to obtain California medical marijuana recommendations from local physicians for the purpose of growing marijuana.70 Recommended Scenario Development Approach for MRBs Since most of any FI’s existing scenarios can be altered to accommodate MRB related transactions, FIs could take a novel approach to scenario development This model is inspired in part by Bohr’s quantized shell model of the atom, which was developed to illustrate how there are differing orbit levels in an atom. 71 At the center, nucleus, (in red and yellow) are legal recreational and medicinal marijuana dispensaries. These are highest risk. One level out, in the second ring, are ‘dual-use’ entities such as fertilizer and container manufacturers. These are dual-use in the sense that they have legitimate industry uses and also illicit uses. In the largest, and outermost ring, are ‘multisector’ entities such as real estate, legal firms, and farms. These players are less risky but the fact that they still serve MRBs means that they still have risk. These three levels were developed based on FinCEN’s guidance for SAR Filing, as can be seen in the third column as illustrated in Figures 5 and 6 and Table 6. Table 6. Tripartite Risk Structure72

Amlabc.com. 2018. IRS: Examples of Money Laundering Investigations–Fiscal Year 2013. http://amlabc.com/amlcategory/aml-case-studies/irs-examples-of-money-laundering-investigations-fiscal-year-2013/ Accessed Apr 30, 2018. Ibid. Bohr Atomic Model. 2018. http://abyss.uoregon.edu/~js/glossary/bohr_atom.html. Accessed Apr 30 2018. Concept developed by Esther Owens, one of the study’s authors. Data from “Defining Marijuana Related Businesses.” 2018. http://mrbmonitor.com/wp-content/uploads/2017/01/Defining _MarijuanaRelated_Business_ACAMS_TodaySep_2016.pdf. 69

70 71 72

Figure 4. Tripartite Atomic Model for Scenario Development (TAMS-D)

Figure 5. Risk Relationships

As illustrated in figures 4 and 5, tuning a scenario (and thus calculating risk) works a lot like calculating the energy levels of atomic particles--the further away from the dispensaries the less risk. (Note: this is the opposite of Bohr’s calculations, which show the reverse: energy increases the greater the distance from the nucleus). This unique model, combined with a traditional scenario logic approach, allows for tuning based on risk parameters other than velocity, such as the newly-introduced market-based parameters as well as behavior. To ‘tune’ a scenario, you would first assign a transaction to a ring then assign each ring a risk coefficient. This coefficient could be based on regulatory expectations, sectoral expectations, or DOJ guidance. Unlike changing X transactions in X days, with this model, FIs could tune based on the sectors from which the transaction emerged. 73 74

Designed and developed by Esther Owens, one of the study’s authors. Designed and developed by Esther Owens, one of the study’s authors.

Additional Recommendations for Monitoring the Transactions of MRBs ● Use segmentation to comply with Cole Memo Priorities and to further understand the MRB market. ● Apply top-down segmentation to divide accounts into groups based on MRBspecific, inherent, characteristics such as:75 ○ Average transaction volume, frequency, and amount ○ Networth and average account balance ○ Region ○ Line of business ○ Age of account ● Use AI to identify abnormal behavior and monitor relationships between entities indicating possible illicit activity.76 ● Monitor use of ATMs located in MRBs.

Sas. 2018. Developing Scenario Segmentation and Anomaly Detection Models. www.sas.com/content/dam/SAS/en_ us/doc/whitepaper1/scenario-segmentation-anomaly-detection-models-107495.pdf Accessed Apr 28 2018. Irrera, Anna. 2017. HSBC partners with AI startup to combat money laundering. BNN Bloomberg. www.bnn.ca/hsbc-partners-with-ai-startup-to-combat-money-laundering-1.767098. Accessed Apr 30 2018. 75

TRADE-BASED MONEY LAUNDERING According to the definition provided by FATF, trade-based money laundering is the process of disguising the proceeds of crime and moving value using trade transactions to legitimize their illicit origins. 77 The 2009 International Narcotics Control Strategy Report estimated that the annual dollar amount laundered using trade activities reached to approximately hundreds of billions.78 In practice, trade-based money laundering can take place through a range of fraudulent transactions involving a variety of instruments, such as wire transfers, funnel accounts, third party payments, and car activities. Regulatory/Legislative Requirements and Expectations In February 2010, FinCEN issued an advisory79 to inform and assist the financial industry in reporting suspected instances of trade-based money laundering and jurisdictions determined to be of primary money laundering concern. An updated advisory on increased trade-based money laundering activity involving funnel accounts following the restrictions on U.S. currency in Mexico was issued later in May 2014.80 In 2015, FinCEN issued two geographic targeting orders that lowered cash reporting thresholds and added additional recordkeeping requirements for certain financial transactions. 81 The U.S. Department of Homeland Security maintains a Trade Transparency Unit which examines financial irregularities associated with trade-based money laundering.82 Key Transaction Monitoring Red Flags for Trade-based Money Laundering FinCEN and other related regulatory institutions have identified multiple red flags based on activity observed in SARs that may indicate trade-based money laundering. The following focus mainly on account money flows and are particularly applicable to an FI’s wealth management business: • Unusual card activities, for example, repetitive purchases of goods with same or similar category with 3rd party payments, especially in amounts under $1,000 as infrequently as several times per month • Payments for goods or services made by a 3rd party or an intermediary unrelated to the account owner, seller or purchaser of goods and no apparent business relationship could be found • Funds transferred into an account that are subsequently transferred out of the account in the same or nearly the same amounts 77

FATF. "Trade based money laundering." June 23 (2006): 2006. 2009 International Narcotics Control Strategy Report, Volume II: Money Laundering and Financial Crimes, Feb 27, 2009, www.state.gov/p/inl/rls/nrcrpt/2009/vol2/116537.htm. FinCEN, Dept of Treasury. "Advisory to financial institutions on filing suspicious activity reports regarding tradebased money laundering." (2010). FinCEN, Dept of Treasury. "Update on US Currency Restrictions in Mexico: Funnel Accounts and TBML." 2014. FinCEN, Geographic Targeting Order, Apr 15, 2015, “FinCEN Targets Money Laundering Infrastructure with Geographic Targeting Order in Miami: ‘GTO’ Addresses Trade-Based Money Laundering Activity …,” Apr 21, 2015. Miller R S, Rosen L W, Jackson J K. Trade-based Money Laundering: Overview and Policy Issues[M]. Congressional Research Service, 2016. 78

80 81

• • •

Investment accounts of low asset balance but unusual large amount of asset movements within a certain period of time Multiple transactions occurring within a certain period of time in various locations when the account owner resides elsewhere, especially high-risk jurisdictions such as Mexico, Guatemala, Argentina, Brazil, China, or Taiwan Frequent transactions involving rounding or whole dollar amounts

Two Case Studies Case Study 1 - Involving Used Car Sales Used cars were purchased in the US with wire transfers operated by an international bank to US banks. Cars were then shipped to countries in West Africa and other parts of the world while the proceeds would be transmitted back to countries of sales by the method of large amount of cash deposits among conspiring exchange houses. The bank, exchange houses, car dealers, and exporters were prosecuted in a civil money laundering and forfeiture action as a result of this action. 83 Case Study 2 - Drug Trafficking Asian-supplied consumer goods were shipped to Latin America and the funds sent to pay for the goods were laundered through a Black Market Peso Exchange-styled scheme. The criminals took advantage of an international bank’s US correspondent accounts and conducted drug trafficking in countries in Latin America.84 Recommended Scenarios for Trade-based Money Laundering Table 7. Scenarios for Trade-Based Money Laundering

Scenario Logic One

Unusual credit/debit card activities

Scenario Logic Two

Third Party Payments*

[A] or more numbers of credit/debit card payments to vendors with same or similar Merchant Category Classification (MCC) Codes within prior [B] days; AND/OR each is <= $[C] aggregating >= $[D], to or from unknown third parties. This scenario can be run at both account and customer aggregation levels. The aggregate amount of outgoing payments >= [A]% and <=[C]% of incoming asset movements within prior [B] days; AND [D]% of the payments are from/to unknown third parties.

FIS Center of Regulatory Intelligence, Regulatory Intelligence Briefing – Trade-Based Money Laundering Risk and Regulatory Agency Priorities. (2016) House Committee on Financial Services Staff Memo 84

Scenario Logic Three

Low Balance Accounts

Scenario Logic Four

Different Jurisdictions

Scenario Logic Five

Round Dollar

Total asset amount in the account balance <=[A]% of aggregate incoming and outgoing asset movements within prior [B] days; AND each transaction is >=$[C] to exclude operating accounts. This scenario can be run at both account and customer aggregation levels. [A] or more numbers of outgoing payments with aggregate amount >= [C]% and <=[D]% of aggregate incoming asset movements within prior [B] days; AND [E]% of the asset movements are from/to different jurisdictions, especially designated sensitive locations; AND/OR [F]% of the asset movements are from/to unknown third parties or same name. This scenario can be run at both account and customer aggregation levels. The scenario is designed to detect similar aggregate amount of in and out fund flow with different jurisdictions [A] or more number of outgoing payments aggregating [C]; AND the payments are of rounding amount within prior [B] days. The scenario is designed to detect usual frequent transactions involving rounding or whole dollar amounts

*This scenario can be run at both account and customer aggregation levels and is designed to detect similar amounts of fund flow in/out or to/from unknown 3rd parties within a given period.

VIRTUAL CURRENCY Virtual currency (VC) and blockchain, the underlying infrastructure it utilizes, are expected to revolutionize the way business entities conduct transactions. FinCEN makes a clear distinction between a fiat currency and VC, underscoring that unlike fiat currencies, VCs lack legal tender status and are not accepted as a medium of exchange in several jurisdictions. While there are different types of VCs, in this report, the term VC or cryptocurrency refers to decentralized convertible virtual currencies. Albeit the benefits of VCs in lowering transaction cost and settlement/clearing time, VCs can pose risk to financial stability and integrity, consumer protection, capital flow and exchange management, and taxation. Owing to the anonymity/pseudonymity VCs offer users and their cross-border reach, illicit actors and sanctioned countries can use VC to launder money, circumvent capital control, or evade taxes. Furthermore, due to the lack of regulatory safeguards and the irreversibility of transactions, customers have limited protection against risks arising from cyber fraud or VC’s price volatility. Regulatory /Legislative Requirements and Expectations In 2013, FinCEN issued a directive on the “Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies” (“the Guidance”). The Guidance outline the applicability of BSA to persons involved in the issuance, exchange, distribution, and receipt of virtual currency, and broadly classifies such persons into three categories— Users, Exchangers, and Administrators.85 Users refers to a, “person who use virtual currency to buy goods and services.”86 Users are not considered money service businesses (MSB), and are therefore, not required to register with FinCEN. Exchangers are entities that exchange VCs or exchange fiat currency to VC, or viceversa. Administrators refers to persons with authority to issue or redeem VCs. Exchangers and Administrators are considered MSBs, and thereby, are required to abide with FinCEN’s registration, recordkeeping, and reporting requirements.87 There are 2 types of VC exchangers— custodial and non-custodial exchangers. Custodial exchangers connect buyers and sellers, and hold their token as custodial intermediaries, while non-custodial exchangers allow VC buyers and sellers to communicate or advertise their offers.88 Custodial exchangers are required to register with FinCEN, implement risk-based KYC and AML processes, and report suspicious transactions. On the other hand, non-custodial exchangers, VC wallet, new token and software developers, and miners are not required to register with FinCEN.89 “Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies.” FinCEN. 2013. www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering. Ibid. Ibid. “Guidance for A Risk-Based Approach-Virtual Currencies.” FATF. Jun 2015. www.fatf-gafi.org/media/fatf/documents/reports/Guidance-RBA-Virtual-Currencies.pdf Ibid. 85

86 87 88

In its June 2014 VC Report, FATF recommends that nation-states monitor VC transactions at the point of redemption, at points where VCs intersect with regulated FIs (i.e. when converting fiat currency to virtual currency or vice-versa).90 It also calls on jurisdictions to direct their AML/CFT monitoring requirements towards VC exchangers, and not those individuals who use VCs to buy goods and services. It further iterates that countries should regulate and impose AML/CFT requirements on FIs and designate nonfinancial institutions (DNFI) that “send, receive, and store VC.”91 Before and after the onboarding process, FIs and DNFIs need to carefully identify role, nature, and extent of clients’ participation in the VC market, as it will impact their risk exposure and appetite. Key Transaction Monitoring Red Flags for Virtual Currency ● Recurring wire transfers to VC exchanges, particularly those operating in sanctioned countries or jurisdictions regarded as VC safe havens. Specific activities may include: ○ Large/rapid incoming fund followed by a large/rapid fund transfer to VC exchange/s or DCM (designated contract market) and SEFs (swap execution facility) that trade VC derivatives ○ Incoming funds from high risk jurisdictions, in terms of both AML and VC fraud risks, followed by fund transfers to exchange/s ○ Large incoming fund from exchange/s followed by a comparable transfer of fund to high risk jurisdictions ○ Recurring incoming/outgoing fund transfers, below the reporting requirements, from/to exchange/s ○ VC exchanges/administrators not registered/licensed in jurisdictions that offer licensing/ registration ○ VC exchanges/administrators with no accounts at traditional FIs ○ IP logins from high risk jurisdictions or VC safe havens, or IP addresses that are inconsistent with the business/client’s jurisdiction/purpose (software can be used to mask the originator’s IP location) ● Multiple clients or accounts making frequent fund transfers to a specific VC exchange, especially with similar aggregate value or timeline ● Large, frequent and/or rapid fund movements at VC ATMs ● Repeated large-scale asset purchases, inconsistent with the purpose of the account/business. This can be used to bypass detection during the cashing out of crypto-assets. Two Case Studies Case Study 1 - FinCEN Fines Foreign VC Exchange In its first fine against a foreign money transmitter operating in the US, FinCEN, along with the U.S. Attorney’s Office for the Northern District of California, levied a $110 million civil penalty against BTC-e, a foreign VC exchange that also operates in the U.S., for “Guidance for A Risk-Based Approach - Virtual Currencies.” FATF. Jun 2015. www.fatf-gafi.org/media/fatf/documents/reports/Guidance-RBA-Virtual-Currencies.pdf Ibid.

“willfully violating U.S. AML laws.”92 FinCEN fined BTC-e for facilitating transactions for ransoms, drug trafficking, tax fraud, identity theft, and other illicit activities. In addition, BTC-e failed to collect adequate information on its clients; collecting only their email addresses and account login information.93 Case Study 2 - The SEC Charges an Unregistered ICO In April 2018, the SEC charged the 2 cofounders of Centra, Tech Inc., a Florida-based financial service. The SEC accused the cofounders of raising $32M in an unregistered ICO that promised investors utility and equity new tokens. 94 In addition, cofounders allegedly misled investors by falsely claiming that the ICO would offer a “crypto debit card,” backed by Mastercard and Visa. CEOs further claimed that the crypto credit card would enable users to instantly exchange virtual currency to fiat currency. In an earlier report, the SEC underscored that “digital securities can be, and often are, securities.”95 Recommended Scenarios for Virtual Currency Table 8. Scenarios for Virtual Currency

Scenario Logic One

Ingoing/Outgoing Fund Movements*

Steven Hudak. “FinCEN Fines BTEC-e Virtual Currency Exchange $110M….” FinCEN. Jul 27 2017. www.fincen.gov/news/news-releases/fincen-fines-btc-e-virtual-currency-exchange-110-million-facilitating-ransomware Ibid. Conor O’ Hanlon & Keith Miller. “SEC Continues to Take Action Against Alleged ICO Fraud.” Perkins Coie. Apr 3 2018. www.virtualcurrencyreport.com/2018/04/sec-continues-to-take-action-against-alleged-ico-fraud/ Ibid. 92

93 94

Scenario Logic Two

Third Party and Multiple Accounts/ Transactions

Scenario Logic Three

Fund Movement at VC ATM

Scenario Logic Four

Large-Scale Asset Purchases

balance, within prior [D] days; AND/OR The average duration between the incoming fund to the account from a third party (including exchange) and outgoing fund transfers to exchange is equal to or less than [G] days Within [A] business days, [K] or more incoming asset movement from [M] or more unknown third-parties, followed by a [N] number of transfers to an exchange with aggregate >= $[W] amount; AND/OR Following an incoming transfer from an exchange, within [Y] following business days, [Z] or more outgoing asset movement to an unknown thirdparty, each of which is >=[M], or aggregate to >=$[N] or [S]%; OR [X] or more asset movements in or out, from or to unknown third parties (including exchanges), each of which is >=$[Y], and/or >=[Z]% of the total asset in the account or total asset of the beneficiary owner; OR [X] or more incoming assets (from third party, exchange, etc.) of which result in [Y] or more internal asset movements between (unrelated) customer accounts within [Z] days, each of which is >=$[K] or >=[S]% of [X]. [X] or more number of cash withdrawals or deposits at VC ATMs, each of which is greater than or equal to aggregate [Y], within prior [F]days; OR $[X] or more cash withdrawals or deposits at VC ATMs, each of which is greater than or equal to aggregate $[Y], within prior [F]days. [X] or more physical receipt/s of assets (including real estate, boat, luxury goods, securities, etc.) each of which is >= $[Y] and/or of which [S]% or [M] or more of the physical asset is liquidated within [Z] days of receipt; OR [X] or more physical receipt/delivery of assets (including real estate, boat, luxury goods, securities, etc.) aggregating >= $[Y] within prior [W] days into an account with $[Z] total asset; OR [X] or more physical receipt/delivery of assets (including real estate, boat, luxury goods, securities, etc.) aggregating >= $[Y] within prior [W] days into an account aged [Z] days.

Scenario Logic Five

Change in Behaviors

Within [Z] days, investment in cryptocurrency (crypto-assets) as a percentage of total asset increased from [X]% to [Y]%; OR [X] asset movements in and [Y] movement out from/to an exchange, each of which is greater than or equal to [M], which is > than [Z] standard deviation from weekly mean/average of clientâ&#x20AC;&#x2122;s history

*Registered exchanges are listed on SmartCheck.gov.

HUMAN TRAFFICKING The U.S. Financial Crimes Enforcement Network (FinCEN) defines human trafficking as “the act of recruiting, harboring, transporting, providing or obtaining a person for forced labor or commercial sex acts through the use of force, fraud or coercion.”96 Currently, a large portion of the human trafficking economy exists online, presenting significant challenges to follow the illegal funds’ flow. 97 Human traffickers abuse FIs by using business and individual accounts and transactions to house and transport their illicit proceeds.98 In addition, advances in technology and finance have enabled traffickers to employ sophisticated techniques, such as prepaid cards and digital currency99, to move money rapidly and conceal it efficiently.

Regulatory/Legislative Requirements and Expectations US regulators are increasingly seeking to harness the ability of FIs to monitor financial activities that could facilitate the identification and disruption of human trafficking criminality100. In September 2014, FinCEN issued an advisory101 for FIs on how to detect and report suspicious financial activities that may be related to human trafficking. FinCEN advised that no single transactional red flag is a clear indicator of human trafficking related activity. FIs should consider additional factors, such as a customer’s expected financial activity, as well as share information with each other as appropriate, under Section 314(b) of the USA PATRIOT Act, when evaluating whether certain suspicious transactions are related to human trafficking102. Key Transaction Monitoring Red Flags for Human Trafficking According to FinCEN, AUSTRAC, Financial Action Task Force and the U.S. Bankers’ Alliance Against Trafficking, the following is a non-exclusive list of red flags indicating human trafficking money laundering: ●

Large cash (or check deposits) followed by immediate requests for wire transferor or further cash withdrawals (either domestic or international) below $3,000 or $10,000, in apparent efforts to avoid record keeping requirements or CTR filing103

“Guidance on Recognizing Activity Associated with Human Smuggling & Trafficking, Red Flags”, FinCEN, Sep 2014, www.fincen.gov/resources/advisories/fincen-advisory-fin-2014-a008 accessed Mar 2018 “Testimony Before House Financial Services Committee on Human Trafficking”, Manhattan DA office, Jan 2018, www.manhattanda.org/testimony-before-the-house-financial-services-committee-human-trafficking/ accessed Apr 2018 “Following the Money, Straight to Human Traffickers”, Human Rights First, Apr 3 2017, www.humanrightsfirst.org/blog/following-money-straight-human-traffickers accessed Mar 2018 Kaltin Milliken, “Lawmakers worry digital currency helping human traffickers…”, The Hill, Jan 31 2018, http://thehill.com/policy/technology/371573-lawmakers-worry-digital-currency-helping-human-traffickers-avoiddetection accessed in Feb 2018 Keatinge & Barry, “Disrupting Human Trafficking the Role of Financial Institutions”, Royal United Services Institute, Mar 2017, https://rusi.org/sites/default/files/201703_rusi_disrupting_human_trafficking.pdf access Mar 2018 Ibid. Ibid. “Money Laundering Risks Arising from Human Trafficking …”, FATF, Jul 2011, www.fatf-gafi.org/media/fatf/do cuments/reports/Trafficking%20in%20Human%20Beings%20and%20Smuggling%20of%20Migrants.pdf Mar 2018 96

100

101 102 103

●

● ● ● ● ●

Frequent outbound wire transfers directed to states, countries, and industries/sectors at higher risk for human trafficking or sexual tourism, when the customer is not in a business where such payments would be expected104 A customer’s account that may function as a funnel account: entry of a large amount of funds over a short period, followed by comparable amount routed to individuals in an overseas destination105 Frequent debits to online escort services for advertising/classifieds106 Frequent transactions that appear to be for sustenance for individuals (housing/lodging, food, regular vehicle rentals, etc.)107 Repetitive transfers of similar nature (round-dollar transfers, missing/same address, same overseas beneficiary, unusual payment descriptions etc.)108 Credit and debit transactions outside the time of known business operation109 Frequent transfers to corrections-related services, with payment descriptions containing terms and phrases commonly used by traffickers, such as “Circuit”, “Exit Fee” and “Facilitators”110. Pimps use inside recruiters to identify vulnerable women who are getting out of jail, as they often lack employment skills or even a stable living place, making them susceptible to human trafficking111.

Two Case Studies Case Study 1 - NYDFS Fined Western Union for Failing to Report Suspicious Human Trafficking Transactions On January 4, 2018, the New York State Department of Financial Services (DFS) fined Western Union $60M for violations of the New York BSA and New York’s AML laws112. One of the key violations was that Western Union’s senior management team willfully ignored, and failed to report to the DFS, suspicious transactions from several agents in New York, and other locations to Western Union branches in China, that may have aided human trafficking 113 . These transactions include customers used Western Union’s money transfer services to pay debts to human traffickers based in China, and structured these transactions to avoid identification and reporting requirements114.

104

Ibid. Ibid. Ibid. Ibid. Tatjana Dobrovolny, “Combating Human Trafficking as part of Money Laundering Detection”, Raiffeisen Bank International, Oct 3 2011, https://www.osce.org/cthb/84649?download=true accessed Mar 2018 “Human Trafficking: Customer and Financial Transaction Traits That May Present Risk”, The Bankers’ Alliance Against Trafficking, Feb 17 2014, https://www.osce.org/secretariat/115618?download=true accessed Mar 2018 Leischen Stelter, “Know the Language of Human Trafficking: Glossary …”, Public Safety, Jul 2014, inpublicsafety.com/2014/07/know-the-language-of-human-trafficking-a-glossary-of-sex-trafficking-terms/ Mar 2018 Leischen Stelter, “Combating Human Trafficking Networks within Prison Walls”, Public Safety, Jan 22 2014, https://inpublicsafety.com/2014/01/combatting-human-trafficking-networks-within-prison-walls/ accessed Mar 2018 Richard Loconte, “DFS fines Western Union $60M for violations of New York’s AML laws …”, NY State Dept of Financial Services, Jan 4 2018, https://www.dfs.ny.gov/about/press/pr1801041.htm accessed in Apr 2018 Ibid. Ibid. 105 106 107 108

109

110

111

112

113 114

This case study demonstrates that FIs are increasingly expected to monitor and report potential suspicious human trafficking money laundering activities. To achieve the objective, it is vital for FIs to identify frequent, large and rapid asset movements to destinations at higher risk of human trafficking in a timely and effective manner. Case Study 2 – Uncovering a Trafficking Ring A US financial investigation in 2017 uncovered a trafficking ring that laundered their criminal proceeds through 50 accounts at 9 different banks115. Funds were deposited and withdrawn among dozens of financial accounts, moved in and out of the US, funneled through a series of shell corporations, and used for purchasing 3 properties and a vehicle116. This case study shows that funnel accounts, namely, individual or business accounts that have multiple deposits from different originators, sources or jurisdictions but are quickly withdrawn in or transferred out to a different geographic area, are used by human traffickers to conceal and move illicit proceeds. FIs should have automated transaction monitoring scenarios to identify such accounts. Recommended Scenarios for Human Trafficking Table 9. Scenarios for Human Trafficking

Scenario Logic One

Assets Movements Between At-risk Factors*

Scenario Logic Two

Unusual Outgoing Wire Transfers

Denise Hutchings, “US Court Case: 9 Banks & 50 Bank Accounts Exploited…”, Verafin, Feb 21 2017, https://veraf in.com/2017/02/u-s-court-case-9-banks-and-50-bank-accounts-exploited-by-human-trafficking-ring/ access Mar 2018 Ibid. 115

116

Scenario Logic Three

Funnel Accounts

Scenario Logic Four

Unusual Credit/Debit Card Activities

[F]% of the outgoing wires have unusual payment descriptions in the Originator to Beneficiary Information (“OBI”) or Bank to Bank Information (“BBI”) field, such as code words or common names used in the military to call out letters, or close matches to sanction lists (e.g., Echo)117. [A] or more numbers of incoming funds (e.g., cheques or cash equivalents), each is smaller than or equal to $[B] aggregating >= $[C], within prior [D] days; AND [E] or more numbers of outgoing funds (e.g., cash withdrawals, cheque issuances), aggregating [F]% of the existing account balance, within prior [D] days; AND The average duration between the incoming and outgoing funds transfers is equal to or less than [G] days; AND [H]% of the incoming funds have different originators; AND [I]% The recipients of the outgoing funds are the same or share some common characteristics (e.g., the same address, phone number, email or Taxpayer Identification Number); AND [J]% of the outgoing funds activities are crossborder transactions. [A] or more numbers of credit/debit card payments, each is smaller than or equal to $[B] aggregating >= $[C], within prior [D] days; AND [E]% of the transactions occurred at or later than [F]pm; AND [G]% of the transactions were to beauty/nail salons, model agencies, hotels, travel agents, vehicles, gasoline stations, and/or automatic DVD rental kiosks; AND [I]% of the payments were to adult service advertising websites. Refer to Appendix One for a keyword list of the websites; OR [H]% of the payments were to cell phone companies, utility companies, and/or housing

117

Identified via an interview with a senior compliance officer of a Brazilian bank

Scenario Logic Five

Unusual Online and Mobile Payments

Scenario Logic Six

Abrupt Change in Behaviors

agents, indicating the provision of sustenance for individuals. [A] or more numbers of transfers/payments made online or via mobile-app, each is larger than or equal to $[B] aggregating >= $[C], within prior [D] days; AND [E]% of the transfers/payments were for purchasing or reloading prepaid cards; AND/OR [F]% of the transfers/payments were to corrections related service providers. Within prior [A] days, the frequency of assets outgoing activities; OR The dollar value, either individual or aggregate amount, of assets outgoing activities; OR The duration between assets incoming and outgoing activities; OR The number of originators or beneficiaries of assets movements (incoming or outgoing); OR The number of jurisdictions of assets movements (either incoming or outgoing); OR The variety of sources of incoming assets (e.g., checks, wire transfers, etc.) is [B] standard deviations away from the account’s or the customer’s average value of prior [C] days

* This is a key-word scenario. Refer to Appendix One for a more detailed list of at-risk factors and their respective examples and sources

Additional Recommendations for Transaction Monitoring • Foster strong partnerships with other FIs, law enforcement, and non-governmental organizations (NGOs) to develop strategies and best practices in combating human trafficking. For example, o The compliance and internal investigation teams of JP Morgan Chase and Bank of America have developed relationships with the Manhattan District Attorney's Office, to proactively seek out trafficking indicators118. o The North America Banks Alliance coordinated by the Thomson Reuters Foundation share confidential and practical toolkits on human trafficking red flags and case studies on a regular basis119. Members of the alliance “Follow the Money: DA Vance Testifies About Sex Trafficking & US Financial Markets…”, Manhattan District Attorney’s office, Jan 30, 2018, www.manhattanda.org/follow-the-money-da-vance-testifies-about-sex-trafficking-and-u-sfinancial-markets-before-u-s-house-financial-services-committee/ Ed Upright, “Bank staff will 'red-flag' trafficking suspects with powerful new tool”, Reuters, May 2 2017, 118

119

•

include Barclays, HSBC, Western Union, Standard Chartered, Deutsche Bank, Santander, UBS and Commerzbank120. Invest in compiling human trafficking-related media content, such as that provided to Thomson Reuters by Liberty Asia121, an NGO, to incorporate the latest information about jurisdictions, industries, and websites susceptible to human trafficking into transaction monitoring scenarios. Such media content should include both domestic and international sources122. In addition, FIs could perform a search of its own customer and/or SAR database to identify any matches with phone numbers or email addresses published on the websites123.

www.reuters.com/article/us-banks-trafficking/bank-staff-will-red-flag-trafficking-suspects-with-powerful-new-toolidUSKBN17Y22Q accessed in Mar 2018 Ibid. “Thomson Reuters World-Check & Liberty Asia exceed 5,000 names in anti-human trafficking initiative”, Thomson Reuters, Jun 18 2017, www.thomsonreuters.com/en/press-releases/2017/june/thomson-reuters-world-check-and-libertyasia-clear-5000-names-in-anti-human-trafficking-initiative.html Based on an interview with a professor at Yale University Ibid. 120 121

122 123

VI.

EMERGING TRENDS IN AML TRANSACTION MONITORING

CUSTOMER SEGMENTATION FOR PEER-GROUP TRANSACTION MONITORING Interviews with industry experts identified peer group-based monitoring as an effective strategy to improve AML transaction monitoring. The key to effectively implement this strategy is to develop a sound and robust customer segmentation model, which is multiphased as follows: •

•

• •

Selecting a customer segmentation methodology: the traditional approach is to segregate customers based on their inherent characteristics, such as industry profile and business attributes124. However, the outcome could be too broad and not always accurate. Several fintech companies have developed advanced analytical techniques, such as topological data analysis 125 and softclustering126, to define the number and types of segments based on customer transactional behaviors (product usage, transaction channels etc.), and risk characteristics127. For example, if there are four customer segments capturing all activity types, and there are three risk levels, then there will be a total of 12 customer segments where each customer segment is split into three risk levels. Identifying constituents for each segment: use statistical tools to analyze attributes associated with each customer, including their exhibited transactional activities 128 and predicted future behaviors 129 to cluster them into relevant segments. For new customers, their segmentations largely rely on expected activities derived from onboarding and customer due diligence data. Conducting multiple iterations: after the execution of membership analyses, if the segments are highly polarized (for example, one segment having more than 50% of the customer population), it may be necessary to re-execute the segmentation cycle to break the polarized segment into more granular segments130. Integrating with TMS: develop and apply appropriate scenarios, parameters and thresholds to each segment131. Verifying and refining customer segments: perform periodic above-/below-line testing, incorporating new and updated data and technological development to validate and update the segmentation mode132l.

West & Suplee, “Developing Scenario Segmentation & Anomaly Detection Models”, SAS, www.sas.com/content/ dam/SAS/en_us/doc/whitepaper1/scenario-segmentation-anomaly-detection-models-107495.pdf Mar 2018 Gunnar Carlsson, “Why Topological Data Analysis Works”, Ayasdi, Jan 6, 2015, www.ayasdi.com/blog/bigdata/whytopological-data-analysis-works/ accessed Mar 2018 “Using AI & Machine Learning to Improve AML”, FICO, www.fico.com/en/blogs/analytics-optimization/when-aimeets-aml-a-report-from-edinburgh/ accessed Mar 2018 “Analytics for Smarter Transaction Monitoring”, SAS Software, www.youtube.com/watch?v=GEJtticX7kE Mar 2018 “Enhance AML Transaction Monitoring”, Protiviti, www.protiviti.com/US-en/insights/enhance-aml-transactionmonitoring-scenarios-leveraging-customer-segmentation accessed Mar 2018 Jonathan Symonds, “Intelligent Segmentation as the Attack Point for AML”, Ayasdi, Jul 12 2017 www.ayasdi.com/blog/aml/intelligent-segmentation-as-the-attack-point-for-aml/ accessed Mar 2018 Ibid. Ibid. Haselkorn, Meyer, Murphy and Boezio, “Finding a needle in a haystack”, Oliver Wyman, www.oliverwyman.com /content/dam/oliver-wyman/v2/publications/2017/jul/AML%20Transaction%20Monitoring.pdf accessed Feb 2018 124

125

126

127 128

129

130 131 132

Effective customer segmentation yields significant benefits, including: • enabling AML typologies, scenarios, and thresholds to apply to customers with similar transactional behaviors and risk profiles, identifying those not behaving as expected compared to their peers; • supporting implementation of risk-based transaction monitoring methodology133; • improving accuracy of transaction monitoring by effectively leveraging customer due diligence data, risk assessment outcomes, and customer transaction activities134. In 2018, a large global financial institution partnered with a US fintech company to segment their correspondent banking customers based on topological data analysis. The approach achieved a 20% reduction in investigative volume while discovering new risk segments135. The main challenge regarding customer segmentation is that it will require additional resources to validate and tune the customer segmentation model 136. In addition, the effectiveness of applying technological innovation in customer segmentation still needs to be proved with more user cases.

“Enabling AML monitoring analytics & optimization,” Ernst & Young, www.ey.com/Publication/vwLUAssets/ey-actenabling-aml-monitoring-analytics-and-optimization/$FILE/ey-act-enabling-aml-monitoring-analytics-andoptimization.pdf accessed Mar 2018 Ibid. “Anti-Money Laundering Solution Deep Dive”, Ayasdi, https://d3v6gwebjc7bm7.cloudfront.net/event/16/51/16/2/rt/ 1/documents/resourceList1522850336246/amlsolutionsdeepdivewp011011711522850343594.pdf accessed Mar 2018 “Transaction monitoring: To segment or not?”, SAS Software, www.sas.com/en_us/insights/articles/riskfraud/transaction-monitoring-dynamic-segmentation.html accessed Apr 2018 133

134 135

136

APPLYING ARTIFICIAL INTELLIGENCE The development in compliance programs has surged after the Global Financial Crisis, and it was mainly driven by recruiting additional staff137. Banks are now spending millions of dollars on enhancing their TMS mostly through expanding the compliance team to maintain the pre-designed process and system to remediate threats, which are emerging due to the increasingly complex cross-border trading patterns and regulators’ higher expectations. However, TMS programs that operate under rigid rules may lack flexibilities and may not be able to develop oversights beyond the scope of existing scenarios. Moreover, sophisticated criminals are learning how to get around the rules, challenging the effectiveness of many firms’ TMS. The leading challenges of the systems include poor data quality 138 , too much time spent on issues with low to moderate materiality139, and lack of an integrated view due to fragmented assessment140. To utilize the organization’s resources in a more efficient way, AI technology, along with underlying Machine Learning, Robotic Process Automation (RPA), and Natural Language Processing (NLP) can potentially have a role to play. Capabilities of AI Machine Learning, especially the unsupervised machine learning, are the technology to “be able to learn when exposed to new data without being explicitly programmed”141. Machine Learning has the capacity to detect new behavior patterns that are outside the scope of rule-based scenarios, reconstruct data with minimal data, “soft-cluster” clients into segmentation by analyzing their banking transaction instead of relying on the KYC142, and assign intelligent risk scores143. Robotic Process Automation (RPA) can facilitate the investigation process, reduce the bank’s reliance on human labor, and enhance business system automation 144 . Specifically, RPA has the capacity to consolidate data from various sources, including database outside the KYC, and develop a holistic view of a case145. Natural Language Processing (NLP) is the technology that computer process human Kaminsk, et al. “Sustainable compliance: 7 steps toward effectiveness & efficiency”, McKinsey, 2017. www.mckinse y.com/business-functions/risk/our-insights/sustainable-compliance-seven-steps-toward-effectiveness-and-efficiency McKinsey & Company, “The new frontier in Anti-Money Laundering”, Nov 2017, accessed Mar 14, 2018. https://www.mckinsey.com/business-functions/risk/our-insights/the-new-frontier-in-anti-money-laundering Ibid. Ibid. Accenture Consulting, “Evolving AML Journey”, accessed Mar 20, 2018. www.accenture.com/_acnmedia/PDF61/Accenture-Leveraging-Machine-Learning-Anti-Money-Laundering-Transaction-Monitoring.pdf FICO, “When AI meets AML”, FICO Blog, accessed Mar 20, 2018. www.fico.com/en/blogs/analyticsoptimization/when-ai-meets-aml-a-report-from-edinburgh/ FICO, “Advancing AML Compliance with Artificial Intelligence”, FICO Blog, accessed Mar 20, 2018. www.fico.com/es/latest-thinking/executive-brief/aml-compliance-artificial-intelligence#form_for_eloqua Culp, “Are AI & machine learning the next …”, Forbes, accessed Apr 2, 2018. www.forbes.com/sites/steveculp/2018 /01/16/are-artificial-intelligence-and-machine-learning-the-next-frontiers-for-fighting-money-laundering/#abfe02f4a639 Inside Financial & Risk, “How natural language processing …”, Thomson Reuters, accessed Apr 2, 2018. www.blogs. thomsonreuters.com/financial-risk/risk-management-compliance/natural-language-processing-adding-value-compliance/ 137

138

139 140 141

142

143

144

145

language and can be used for translating heavily texted documents, such as application to loans and negative news screening. Concerns of the Regulators Despite of AI’s potential, the actual adoption in AML is quite limited, mainly due to the regulators’ concerns. The top concerns are: ● AI’s “black-box” approach, meaning the inner workings of AI not being clearly justified, may result in difficulty to validate and audit the TMS146. ● Difficulty for the IT team to explain the technology to the compliance officer, who should understand the AML models well enough in order to validate the system147. ● The responsibility will fall fully on the bank if the outcome derived by AI is wrong. For example, if machine learning restructures the data incorrectly, as the data is not from the KYC process, the customers are liable for providing the wrong data, but the bank may have to bear the full responsibility148. Actual Implementation Due to the concerns and uncertainty of regulatory trend, AI-based TMS is rarely seen being implemented stand alone, but rather being implemented as an extra layer of the rule-based and human intensive traditional TMS. In addition to FIs, who are at the center of combating financial crimes, NGO and system vendors are all trying to keep up with the trend of AI. Some examples in the industries are demonstrated below. Table 10. Utilizations & Outcomes of AI

AI Users

System

Utilization of AI and Outcomes Financial Institutions

HSBC

Ayasdi

After applying AI, the number of investigations dropped by 20% without reducing number of cases requiring more scrutiny. AI-automation accelerates AML investigations, a traditionally labor-intensive process149 .

Sumitomo Mitsui (Japan)

SAS Japan

An intelligent alert system was implemented to exclude false alarms from total alerts generated from the TMS,

146

Identified through an interview with a strategy lead at a RegTech . Interviewed by Eleanor Liu and Lily Wei. Personal Interview. 20 Feb 2018, New York. Ibid. Identified through interview with a senior consultant at an international consulting firm. Interviewed by Lily Wei, Eleanor Liu, Esther Owens etc. Personal interview. 20 Feb 2018, New York. Anna Irrera, “HSBC partners with AI startup to combat money laundering”, Thomson Reuters, Jun 1, 2017, access Apr 20, 2018. www.reuters.com/article/us-hsbc-ai/hsbc-partners-with-ai-startup-to-combat-money-launderingidUSKBN18S4M5 147 148

149

so as to improve alert accuracy, enhance SAR quality, & reduce labor costs150.

Intel Saffron AML Advisor uses associative memory technology to identify similarities and anomalies hidden in complicated data. Bank of New Zealand

Intel Saffron

Through restructuring and cleansing dynamic data that are from internal database and third-party web or emails, an unsupervised learning approach is used to surface patterns and connections to catch the network of money launders, so as to detect crimes. The development of a “White-box AI” was also explored to surfaces behaviors transparently151. The AI technology was able to reduce the number of false-positive alerts by 35%.

OCBC Bank (Singapore)

ThetaRay

Moreover, AI enables a better categorization of transactions based by assigning more accurate risk levels, resulting in 48 unique risk groups that accommodates 4200 alerts152. NGOs

Liberty Asia

QuantaVerse

Liberty Asia uses AI to fight money laundering related to human trafficking by uploading data about companies involved in human trafficking into QuantaVerse’s database. Other subscribers to the database will screen their transactions against the database and generate alerts when a future bank transaction has names in the database involved153.

Potential Structure to Embed AI into Existing TMS It is not the time yet to implement a stand-alone AI-based system due to immaturity of the technology and uncertainty of the regulatory environment. Therefore, it is suggested that companies embrace various AI technologies into different stages of the AML process on top of the existing system (as shown in yellow). An enhanced system is suggested in figure 6 below:

Maria Nikolova, “Sumitomo Mitsui to use AI for AML monitoring of transactions”, Finance Feeds, Sep 25, 2017. https://financefeeds.com/sumitomo-mitsui-use-ai-aml-monitoring-transactions/. Stephanie Condon, “Intel launched AI enabled anti-money laundering advisor”, ZdNet, Oct 11, 2017, accessed Apr 15, 2018. www.zdnet.com/article/intel-launches-ai-enabled-anti-money-laundering-advisor Jamie Lee, “OCBC sees AI payoff in transaction monitoring”, the Straits Times, Nov 8, 2017, accessed Apr 15, 2018. www.straitstimes.com/business/banking/ocbc-sees-ai-payoff-in-transaction-monitoring Roberto Torres, “How a Main Line company helps banks crack down on human traffickers”, Mar 30, 2018, accessed Apr 26, 2018. https://technical.ly/philly/2018/03/30/quantaverse-human-trafficking-economist/ 150

151

152

153

Figure 6. An Enhanced AML System Incorporating AI

154

Concept developed by Lily Wei. Graphic designed by Esther Owens, two of the paperâ&#x20AC;&#x2122;s authors.

APPENDIX ONE Human Trafficking At-risk Factors At-risk factors

Examples

Sources

States in the US

• • • • •

California Texas Florida Ohio New York

The National Human Trafficking Hotline155 “State Ratings Map” released by Polaris Project156

Countries

• • • • • •

Mexico China India Syria Nigeria United Kingdom

US Dept. of State Trafficking in Persons Annual Report157 2011 FATF Report: Money Laundering Risks Arising from Trafficking in Human Beings & Smuggling of Migrants158 Mutual Evaluations Reports issued by FATF159 & Global Slavery Index160

Industries/ sectors

• • • • • • • •

Websites, Metatags, or search terms

• • • • • • • • •

Hospitality providers Food service workers Massage parlors Nail salons Travel agents Adult Entertainment Sex Industry Corrections-related services The Erotic Review Torture, BDSM Craigslist Cityvibe ECCIE Worldwide Escorts in College Spa Hunters Godaddy, Wix Squarespace, Paxful

The Bankers’ Alliance Against Trafficking— “Human Trafficking: Customer and Financial Transaction Traits That May Present Risk”161 U.S. Department of Labor List of Products Produced by Forced or Indentured Child Labor162 Association of Certified AML Specialists (ACAMS) publications In Public Safety

Manhattan District Attorney's Office ACAMS’ publications The Road Journal

155

Hotline Statistics, National Human Trafficking Hotline, www.humantraffickinghotline.org/states accessed Mar 2018 “2014 State Ratings on Human Trafficking Laws”, Polaris, Sep 2014, www.polarisproject.org/resources/2014-stateratings-human-trafficking-laws accessed Mar 2018 “2017 Trafficking in Persons Report”, U.S. Department of State, www.state.gov/j/tip/rls/tiprpt/ accessed Apr 2018 “Money Laundering Risks from Human Trafficking & Migrant Smuggling”. FATF, Jul 2011, www.fatf-gafi.org/ media/fatf/documents/reports/Trafficking%20in%20Human%20Beings%20and%20Smuggling%20of%20Migrants “Table of ratings for assessment conducted against the 2012 FATF Recommendations, using the 2013 FATF Methodology”, FATF, Apr 30 2018, www.fatf-gafi.org/media/fatf/documents/4th-Round-Ratings.pdf access Mar 2018 “Global Slavery Index 2016”, Global Slavery Index, www.globalslaveryindex.org/about/ accessed Mar 2018 “Human Trafficking: Customer & Financial Transaction Traits That May Present Risk”, Bankers’ Alliance Against Trafficking, Feb 17 2014, www.osce.org/secretariat/115618?download=true accessed in Mar 2018 “List of Products Produced by Forced or Indentured Child Labor”, US Dept of Labor, www.dol.gov/ilab/reports/ child-labor/list-of-products/index-country.htm accessed Mar 2018 156

157 158

159

160 161

162

APPENDIX TWO Consolidated scenario recommendations Scenarios for High Risk Jurisdictions Scenario Logic Purchasing Power One Parity

Scenario Logic Two

Classification of High Risk Jurisdictions

Scenario Logic Three

Payments for University Tuition

We recommend FIs to consider purchasing power parity when establishing and/or tuning the quantitative thresholds of scenarios. For example, according to a study by the Bureau of Economic Analysis, the relative value of $100 in New York and Oregon is $86.43 and $101.01 respectively163. This means that some transaction values may increase when they are measured in relative terms, potentially indicating a higher risk of money laundering. The classification of sensitive geographies, locations, and entities need to be consistent with each country’s respective evaluation. For example, France has assessed and published information on 751 sensitive zones.164 In addition, several media reports describe Molenbeek in Belgium as a "no-go area”165. Therefore, assets movements from/to these sensitive/”no-go” regions should be thoroughly investigated and, if applicable, be assigned with higher risk scores. FIs may also consider implementing additional checks to mitigate their money laundering risks associated with university accounts166. A significant portion of international students come from risky countries in terms of money laundering.167 Many US universities also have branches in at-risk jurisdictions such as Dubai, Qatar, Kosovo etc. Thus, it is necessary to perform thorough due diligence on the beneficiaries of these transactions. For example, a college tuition may be paid by a thirdparty for a student, whose parent(s) are politically exposed persons (PEPs).

Alan Cole, “The Real Value of $100 in Each State”, Tax Foundation, Aug 4 2016, https://taxfoundation.org/realvalue-100-each-state-2016/ “Atlas zones urbaines sensibles (ZUS)”, Ministere de la cohesion des territoires, https://sig.ville.gouv.fr/Atlas/ZUS/ “Europe's no-go zones: Inside the lawless ghettos that breed and harbor terrorists”, National Post, Oct 11, 2016, http://nationalpost.com/opinion/europes-no-go-zones-inside-the-lawless-ghettos-that-breed-and-harbour-terrorists Michael Lowe, “Why UK’s universities should take a closer look at where their money is coming from…”, PWC, Aug 2016, http://pwc.blogs.com/fraud_academy/2016/08/why-the-uks-universities-should-take-a-closer-look-at-wheretheir-money-is-coming-from-and-not-just-.html “Number of international students studying in the US in 2016/17, by country of origin”, www.statista.com/statistics/233880/international-students-in-the-us-by-country-of-origin/ 163

164 165

166

167

Scenarios for Charitable Organizations Scenario Logic One

A High Ratio of Donation Amount to Net Income

[A] or more asset movement(s), which is >= [B] % of existing account balance, to a nonprofit organizations(NPOs), within prior [C] days.

Scenario Logic Two

Rapid Fund Movements between Charitable Organizations and Overseas Destinations or Individuals

Frequent and rapid asset movements between NPOs, and/or between NPOs and unrelated organizations, including international transfers168: [A] or more external assets, received by a domestic potential relief or charitable organization, were transferred out to foreignbased organizations, within prior [B] days.

Scenario Logic Three

Loan Payments

Scenario Logic Four

Abrupt Changes in Donation Patterns

Frequent and rapid asset movements between NPOs and individuals, including international transfers169: [A] or more external assets, received by a domestic potential relief or charitable organization, were transferred out to an individual’s account, within prior [B] days.

Risk of Terrorist Abuse in Non-Profit Organizations,” FATF, Jun 2014 www.fatf-gafi.org/media/fatf/documents /reports/Risk-of-terrorist-abuse-in-non-profit-organisations.pdf, case 11, pg.39 Ibid. 168

169

Scenarios for Third Party Payments Scenario Logic One

Potential Straw Borrower

Scenario Logic Two

Same Third-party Destination

Scenario Logic Three

Straw Borrower Fraud See Figure 1 for an illustration of a Straw Borrower Scheme

Scenario Logic Four

Asset Movement/ Circular Fund in Portfolio Loan Account See Figure 2 for an illustration of Brokerage Account, Collateral & Loan Balance

Within [X] business days, [A] or more loan accounts have been opened within lending institutions, each of which is [geographical] related OR [name] related OR [collateral] related OR [address] related OR [company name] related Within [X] business days, [A] or more loan accounts make asset movement outgoing to an unknown third party, each asset movement amount >= $[B], or >= [C]% of each loan balance Time interval between account open time and loan withdraw time: Within [X] business days after account is open, [A] or more asset movements out to an unknown third party, each of which is >= $[B], and >= [C]% of the loan balance (balance party only applicable to Securitybased Loan Products); AND Potential Straw Borrower; AND Same Third-party Destination; OR Problematic Collateral: Collateral asset is either [cash equivalent] or [third-party owned] Within [A] business days, [K] or more asset movement from one or more unknown third-parties into [collateralized brokerage account], aggregate to >= $[W] amount AND Within [Y] following business days, [Z] or more asset movement out to an unknown third-party, each of which is >=[M], aggregate to >=[N] or [S]% of the loan balance. (both balance party and collateral party only applicable to Security-based Loan products)

Scenarios for Cash/ATM Activities Scenario Logic Money In or Out of One High-risk Jurisdictions Scenario Logic Two

Cross-border Money Deposits and Withdrawals

Scenario Logic Three

Rapid Money Movements (In and Out)

Scenario Logic Four

Money Withdrawals from Rapid Sales of Securities or Investment Capitals without Rational Reasons Suspicious Behavioral Changes in Frequency, Aggregate Amount, Geographic Distance, Crossborder Transactions, Thirdparty Involvement, Transaction Methods, and Risk Rating

Scenario Logic Five

See Figure 3 for an illustration

The cash deposit or fund transferred in accounts which are based in US were subsequently withdrawn from ATMs located in high-risk jurisdictions AND withdrawn aggregating amount is >=[A] at customer account level within [B] days After a single transfer made into the bank/deposit into the bank domestically OR from foreign countries, within [B] days, within [C] time units, another single or multiple transfers/withdrawals aboard out of the bank at customer account level, with a cumulative amount aggregated to ranging from [100-D] % to [100+D] % of the coming-in transfer/deposit OR aggregating >=[A]; AND ATM in foreign country, which is different from country where customer conducts normal activities. After single or multiple transfers/deposit made into the bank within [B] days, within [C] time units, another single or multiple withdrawals immediately (e.g., last day in and first day out) out of the bank at customer account level, with a cumulative amount aggregated to ranging from [100-D] % to [100+D] % of the cumulative amount of the incoming transfers/deposits within [B+N] days. Customer sells securities after short-term holding period within [B] days, within [C] time units and withdraws proceeds or investment capital out of bank at customer aggregate account level, with cumulative amount aggregated to granting from [100-D] % to [100+D] % of cumulative amount within [B+N] days Frequency: The frequency of cash withdrawal activities within [B] days, is [E] standard deviations away from the account/customer’s average historical amount of [O] days; OR Aggregate Amount: The aggregate amount for the [D] transactions within [C] days, is [F] standard deviations away from the account/customer’s historical average amount of [P] days; OR Cross-border Transactions: From [100-B] % to [100+B] % of the account activities within [D] days are crossborder transactions, which is [G] standard deviations away from the account/customer’s average historical amount of [Z]; AND Country that occurred the cash advance activity is different from country in which account/customer conducts normal activities; OR Distance: Cash advance activity is >= [C] miles geographically distant from account/customer’s daily activity area; OR

Third-party Involvement: From [100-D] % to [100+D] % of the fund's transfers within [G] days are from unusual 3rd parties, is [H] standard deviations away from account/customer’s average historical amount of [Q] days; OR Transaction methods: The transaction method is different from the normal one; AND Aggregating amount of the money introduced is [I] standard deviation from account/customer’s average historical amount of [R] days; OR Risk Rating: Activities are inconsistent with the clients’ risk rating

Scenarios for Elder Abuse Scenario Logic Change in One Transaction Methods

Scenario Logic Two

Decrease in Routine Income

Scenario Logic Three

Careless Management of Account

Scenario Logic Four

Joint Account

The number of transactions of outgoing wire transfers; OR ACH payments; OR Overseas transactions; OR P2P payments; OR online purchases is [A] standard deviation away from the average historical amount in the past [B] days; AND The aggregating amount of outgoing wire transfers; OR ACH payments; OR Overseas transactions; OR P2P payments; OR online purchases is [C] standard deviation away from the average historical amount in the past [B] days Excessive amount of internet purchases is suggested to be deemed highly suspicious. The aggregating amount of incoming wires; OR deposit of dollar cheques from the social security funds, a pension funds, or a charitable organization is <= [A] within the prior [B] days; AND The aggregated amount > = [C] standard deviation away from the historical average in the prior [B] days This scenario is more effective when the information from the KYC process shows that the senior is living in a nursing facility or is relying on a caregiver to take care of daily live. The amount of outgoing cash movement is [A] standard deviation away from the average historical value within the prior [B] days; AND The remaining account balance <= $[C]; AND/OR The amount of overdraft fee >= $[D] within the prior [E] days. The aggregating amount of outgoing asset >= $[A] were made after the opening of a joint account; OR after a new joint account holder was added within the prior [C] days; AND The aggregating amount of outgoing asset >= [D] standard deviation away from the historical average within the prior [C] days.

Scenario Logic Five

Inactive Account Suddenly Becomes Active

Scenario Logic Six

Money Mules

Scenario Logic Seven

Change in Times

Scenario Logic Eight

Exploitation by the Caregiver

Scenario Logic Nine*

Churning of the Customer Investment Account

*This scenario should be closely examined when joint account holder is not a close family member to the client. The number of transactions is [A] standard deviation away from the average historical amount within the prior [B] days; AND [C] or more percentage of transactions were made to an unidentified third party. [A] or more numbers of incoming wires/deposits of dollar cheques, aggregating >= $[B], within prior [C] days; AND [D] or more numbers of outgoing wires/deposits of cheques or cash equivalents, aggregating [E]% of the account balance, within prior [F] days; AND The duration between the incoming and outgoing fund transfers is equal to or less than [G] days; AND/OR [H]% of the outgoing transfers within prior [I] days are cross-border transactions. The number of cash withdrawals and/or purchases between [A] pm to [B] am are [C] standard deviation away from the average historical value within the prior [D] days. The aggregating amount of outgoing transfers to an account under caregiver/nursing facilities is >= $[A]; AND The aggregating amount is [B] standard deviation away from the average historical amount within the prior [C] days. This scenario will be more effective when combing with keywords screening, including: “nursing”, “health”, “care”, “medication”, “hospital”, “home”, as seniors being taken care of by a third-party is more vulnerable. The number of trading in the brokerage account >= [A]; AND The aggregate amount of trading value is [B] standard deviation away from the aggregating historical average in the prior [C] days; AND/OR The aggregating amount of investment in high risk portfolio >= [D]% of total investment account; AND/OR The investment in a single security >= [F]% of total investment; AND/OR The investment in a single industry >= [G]% of total investment.

A Scenario Modification Approach for Marijuana Related Businesses These three levels Tripartite Risk were developed Structure170 based on FinCEN’s guidance for SAR Filing, as can be seen in the ‘risk’ column

171

Tripartite Atomic Model for Scenario Development (TAMS-D)

At the center, nucleus, (in red & yellow) are highest risk legal recreational and medicinal dispensaries. In the 2nd ring, are ‘dual-use’ entities such as fertilizer & container manufacturers. 172

Risk Relationships

To ‘tune’ a scenario, first assign a transaction to a ring then assign the ring a risk coefficient, which could be based on regulatory expectations or DOJ guidance. Unlike changing X transactions in X days, this model allows FIs to tune based on sector, not just velocity.

173

170

“Defining Marijuana Related Businesses.” 2018. http://mrbmonitor.com/wp-content/uploads/2017/01/Defining _Marijuana-Related_Business_ACAMS_TodaySep_2016.pdf. Concept developed by Esther Owens, one of the study’s authors. Data from “Defining Marijuana Related Businesses.” 2018. http://mrbmonitor.com/wp-content/uploads/2017/01/Defining _MarijuanaRelated_Business_ACAMS_TodaySep_2016.pdf Designed and developed by Esther Owens, one of the study’s authors. Designed and developed by Esther Owens, one of the study’s authors. 171

172 173

Scenarios for Trade-based Money Laundering Scenario Logic Unusual credit/debit [A] or more numbers of credit/debit card payments to vendors with same or similar Merchant Category One card activities Classification (MCC) Codes within prior [B] days; AND/OR each is <= $[C] aggregating >= $[D], to or from unknown third parties. This scenario can be run at both account and customer aggregation levels. The aggregate amount of outgoing payments >= [A]% Scenario Logic Third Party and <=[C]% of incoming asset movements within prior [B] Two Payments* days; AND [D]% of the payments are from/to unknown third parties. Total asset amount in the account balance <=[A]% of Scenario Logic Low Balance aggregate incoming and outgoing asset movements Three Accounts within prior [B] days; AND each transaction is >=$[C] to exclude operating accounts. This scenario can be run at both account and customer aggregation levels. [A] or more numbers of outgoing payments with Scenario Logic Different aggregate amount >= [C]% and <=[D]% of aggregate Four Jurisdictions incoming asset movements within prior [B] days; AND [E]% of the asset movements are from/to different jurisdictions, especially designated sensitive locations; AND/OR [F]% of the asset movements are from/to unknown third parties or same name. This scenario can be run at both account and customer aggregation levels. The scenario is designed to detect similar aggregate amount of in and out fund flow with different jurisdictions [A] or more number of outgoing payments aggregating Scenario Logic Round Dollar [C]; Five AND the payments are of rounding amount within prior [B] days. The scenario is designed to detect usual frequent transactions involving rounding or whole dollar amounts

Scenarios for Virtual Currency Scenario Logic Ingoing/Outgoing One Fund Movements*

Scenario Logic Two

Third Party and Multiple Accounts/ Transactions

Scenario Logic Three

Fund Movement at VC ATM

$[X] or more incoming/outgoing assets from/to exchanges, each of which is greater than or equal to aggregate $[Y], within prior [F]days; OR [X] or more incoming asset from exchange of which [Y] or more of the asset or $[Z] amount is transferred out to high risk jurisdiction or VC sensitive locations within [G] days; [X] or more incoming asset from an exchange of which [Y] or more of the asset or $[Z] amount is transferred to high risk jurisdiction or VC sensitive location/s; AND [X] >= [M] aggregating past transfers to the high-risk jurisdiction or VC sensitive location/s; [A] or more numbers of incoming funds from a VC exchange, each is smaller than or equal to $[B] aggregating >= $[C], within prior [D] days; OR [A] or more numbers of outgoing funds to a VC exchange, each is smaller than or equal to $[B] aggregating >= $[C], within prior [D] days; OR [E] or more numbers of outgoing funds to a VC exchange, aggregating [F]% of the existing account balance, within prior [D] days; AND/OR The average duration between the incoming fund to the account from a third party (including exchange) and outgoing fund transfers to exchange is equal to or less than [G] days Within [A] business days, [K] or more incoming asset movement from [M] or more unknown third-parties, followed by a [N] number of transfers to an exchange with aggregate >= $[W] amount; AND/OR Following an incoming transfer from an exchange, within [Y] following business days, [Z] or more outgoing asset movement to an unknown third-party, each of which is >=[M], or aggregate to >=$[N] or [S]%; OR [X] or more asset movements in or out, from or to unknown third parties (including exchanges), each of which is >=$[Y], and/or >=[Z]% of the total asset in the account or total asset of the beneficiary owner; OR [X] or more incoming assets (from third party, exchange, etc.) of which result in [Y] or more internal asset movements between (unrelated) customer accounts within [Z] days, each of which is >=$[K] or >=[S]% of [X]. [X] or more number of cash withdrawals or deposits at VC ATMs, each of which is greater than or equal to aggregate [Y], within prior [F]days; OR

Scenario Logic Four

Large-Scale Asset Purchases

Scenario Logic Five

Change in Behaviors

$[X] or more cash withdrawals or deposits at VC ATMs, each of which is greater than or equal to aggregate $[Y], within prior [F]days. [X] or more physical receipt/s of assets (including real estate, boat, luxury goods, securities, etc.) each of which is >= $[Y] and/or of which [S]% or [M] or more of the physical asset is liquidated within [Z] days of receipt; OR [X] or more physical receipt/delivery of assets (including real estate, boat, luxury goods, securities, etc.) aggregating >= $[Y] within prior [W] days into an account with $[Z] total asset; OR [X] or more physical receipt/delivery of assets (including real estate, boat, luxury goods, securities, etc.) aggregating >= $[Y] within prior [W] days into an account aged [Z] days. Within [Z] days, investment in cryptocurrency (cryptoassets) as a percentage of total asset increased from [X]% to [Y]%; OR [X] asset movements in and [Y] movement out from/to an exchange, each of which is greater than or equal to [M], which is > than [Z] standard deviation from weekly mean/average of clientâ&#x20AC;&#x2122;s history

Scenarios or Human Trafficking Scenario Logic Assets Movements One Between At-risk Factors*

Scenario Logic Two

Unusual Outgoing Wire Transfers

Scenario Logic Three

Funnel Accounts

Scenario Logic Four

Unusual Credit/Debit Card Activities

[A] or more numbers of assets moving in/out, each is greater than or equal to $[B] aggregating >= $[C], within prior [F]days; AND [D]% of the asset movements are from/to states, countries and industries/sectors vulnerable to human trafficking. [A] or more numbers of outgoing wires, each is smaller than or equal to $[B], aggregating >= %[C] of existing account balance, within prior [D] days; AND The wire transfers had similar and/or round dollar amounts; AND [E]% of the outgoing wires were international transactions; AND The wire transfers have the same recipient or the recipients share some common characteristics (e.g., the same address (or the address is missing), phone number, email or Taxpayer Identification Number); AND [F]% of the outgoing wires have unusual payment descriptions in the Originator to Beneficiary Information (“OBI”) or Bank to Bank Information (“BBI”) field, such as code words or common names used in the military to call out letters, or close matches to sanction lists (e.g., Echo)174. [A] or more numbers of incoming funds (e.g., cheques or cash equivalents), each is smaller than or equal to $[B] aggregating >= $[C], within prior [D] days; AND [E] or more numbers of outgoing funds (e.g., cash withdrawals, cheque issuances), aggregating [F]% of the existing account balance, within prior [D] days; AND The average duration between the incoming and outgoing funds transfers is equal to or less than [G] days; AND [H]% of the incoming funds have different originators; AND [I]% The recipients of the outgoing funds are the same or share some common characteristics (e.g., the same address, phone number, email or Taxpayer Identification Number); AND [J]% of the outgoing funds activities are cross-border transactions. [A] or more numbers of credit/debit card payments, each is smaller than or equal to $[B] aggregating >= $[C],

174

Identified via an interview with a senior compliance officer of a Brazilian bank

Scenario Logic Five

Unusual Online and Mobile Payments

Scenario Logic Six

Abrupt Change in Behaviors

within prior [D] days; AND [E]% of the transactions occurred at or later than [F]pm; AND [G]% of the transactions were to beauty/nail salons, model agencies, hotels, travel agents, vehicles, gasoline stations, and/or automatic DVD rental kiosks; AND [I]% of the payments were to adult service advertising websites. Refer to Appendix One for a keyword list of the websites; OR [H]% of the payments were to cell phone companies, utility companies, and/or housing agents, indicating the provision of sustenance for individuals. [A] or more numbers of transfers/payments made online or via mobile-app, each is larger than or equal to $[B] aggregating >= $[C], within prior [D] days; AND [E]% of the transfers/payments were for purchasing or reloading prepaid cards; AND/OR [F]% of the transfers/payments were to corrections related service providers. Within prior [A] days, the frequency of assets outgoing activities; OR The dollar value, either individual or aggregate amount, of assets outgoing activities; OR The duration between assets incoming and outgoing activities; OR The number of originators or beneficiaries of assets movements (incoming or outgoing); OR The number of jurisdictions of assets movements (either incoming or outgoing); OR The variety of sources of incoming assets (e.g., checks, wire transfers, etc.) is [B] standard deviations away from the accountâ&#x20AC;&#x2122;s or the customerâ&#x20AC;&#x2122;s average value of prior [C] days

BIBLIOGRAPHY “2009 International Narcotics Control Strategy Report, Volume II: Money Laundering and Financial Crimes”, Feb 27, 2009, http://www.state.gov/p/inl/rls/nrcrpt/2009/vol2/116537.htm “2014 State Ratings on Human Trafficking Laws”, Polaris, Sep 2014, https://polarisproject.org/resources/2014-state-ratings-human-trafficking-laws ”2017 Trafficking in Persons Report”, U.S. Department of State, Apr 2018, https://www.state.gov/j/tip/rls/tiprpt/ “Advancing AML Compliance with Artificial Intelligence”, FICO, FICO Blog, accessed Mar 20, 2018. http://www.fico.com/es/latest-thinking/executive-brief/aml-compliance-artificialintelligence#form_for_eloqua "Advisory to financial institutions on filing suspicious activity reports regarding trade-based money laundering." The Financial Crimes Enforcement Network, Department of the Treasury, 2010 “Advisory to Financial Institutions on Filing Suspicious Activity Reports Regarding Elder Financial Exploitation”, Finance Crimes Enforcement Network, last modified Feb 22, 2011. https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2011-a003 “Advisory for financial institutions on preventing and responding to elder financial exploitation”, Consumer Financial Protection Bureau, last modified Mar, 2016. https://files.consumerfinance.gov/f/201603_cfpb_advisory-for-financial-institutions-on-preventing-andresponding-to-elder-financial-exploitation.pdf “Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies.” Finance Crimes Enforcement Network, 2013. https://www.fincen.gov/resources/statutesregulations/guidance/application-fincens-regulations-persons-administering “Anti-Money Laundering Solution Deep Dive”, Ayasdi, https://d3v6gwebjc7bm7.cloudfront.net/event/16/51/16/2/rt/1/documents/resourceList1522850336246/ amlsolutionsdeepdivewp011011711522850343594.pdf accessed in Mar 2018 “Atlas des zones urbaines sensibles(ZUS)”, Ministere de la cohesion des territories, May 2018, https://sig.ville.gouv.fr/Atlas/ZUS/ “AUSTRAC typologies and case studies report 2014”, Australian Transaction Reports and Analysis Centre, page 44, 2014, http://www.austrac.gov.au/sites/default/files/typologies-report-2014.pdf, pg. 44 “Bank Secrecy Act Anti-Money Laundering Examination Manual”, Federal Financial Institutions Examination Council, May 8, 2018, www.ffiec.gov/bsa_aml_infobase/pages_manual/olm_069.htm. “Bridging the Gap between Risk Assessment and Transaction Monitoring”, ACAMS, Sep 19, 2017, https://www.acamstoday.org/bridging-the-gap-between-risk-assessment-and-transaction-monitoring/ accessed in Mar 2018 Bohr Atomic Model. [online], Abyss.uoregon.edu. (2018), http://abyss.uoregon.edu/~js/glossary/bohr_atom.html Carlsson, Gunnar, “Why Topological Data Analysis Works”, Ayasdi, Jan 6, 2015 https://www.ayasdi.com/blog/bigdata/why-topological-data-analysis-works/

Charles, Brooke Satti, “The Most Common Schemes for Targeting the Unknowing Money Mule”, Security Intelligence, last modified Sep 6, 2014. https://securityintelligence.com/the-most-commonschemes-for-targeting-the-unknowing-money-mule/ Cole, Alan, “The Real Value of $100 in Each State”, Tax Foundation, Aug 4 2016, https://taxfoundation.org/real-value-100-each-state-2016/ Condon, Stephanie, “Intel launched AI enabled anti-money laundering advisor”, ZdNet, last modified Oct 11, 2017, accessed Apr 15, 2018. https://www.zdnet.com/article/intel-launches-ai-enabled-anti-moneylaundering-advisor Culp, Steve, “Are artificial intelligence and machine learning the next frontiers for fighting money laundering”, Forbes, accessed Apr 2, 2018. https://www.forbes.com/sites/steveculp/2018/01/16/areartificial-intelligence-and-machine-learning-the-next-frontiers-for-fighting-moneylaundering/#abfe02f4a639 Dobrovolny, Tatjana, “Combating Human Trafficking as part of Money Laundering Detection”, Raiffeisen Bank International, Oct 3, 2011, https://www.osce.org/cthb/84649?download=true “Elder Financial Exploitation—Surveillance is Only Part of the Solution”, ACAMS Today, May 27, 2015. https://www.acamstoday.org/elder-financial-exploitation-surveillance-only-part-solution/ “Enabling AML monitoring analytics and optimization”, Ernst & Young, http://www.ey.com/Publication/vwLUAssets/ey-act-enabling-aml-monitoring-analytics-andoptimization/$FILE/ey-act-enabling-aml-monitoring-analytics-and-optimization.pdf accessed in Mar 2018 “Enhance AML Transaction Monitoring”, Protiviti, https://www.protiviti.com/US-en/insights/enhanceaml-transaction-monitoring-scenarios-leveraging-customer-segmentation accessed in Mar 2018 “Europe's no-go zones: Inside the lawless ghettos that breed and harbour terrorists”, National Post, Oct 11, 2016, http://nationalpost.com/opinion/europes-no-go-zones-inside-the-lawless-ghettos-that-breedand-harbour-terrorists “Evolving AML Journey”, Accenture Consulting, accessed Mar 20, 2018. https://www.accenture.com/_acnmedia/PDF-61/Accenture-Leveraging-Machine-Learning-Anti-MoneyLaundering-Transaction-Monitoring.pdf “Examples of Money Laundering Investigations – Fiscal Year 2015”, the Internal Revenue Service, last modified Dec, 2015. https://www.irs.gov/compliance/criminal-investigation/examples-of-moneylaundering-investigations-fiscal-year-2015 “Executive Order 13219: Blocking Property of Persons Who Threaten International Stabilization Efforts in the Western Balkans”, US Department of Treasury Office of Foreign Asset Control, Jun 27, 2001, https://www.treasury.gov/resource-center/sanctions/Documents/balkans.pdf “Following the Money, Straight to Human Traffickers”, Human Rights First, Apr 3, 2017, https://www.humanrightsfirst.org/blog/following-money-straight-human-traffickers “Follow the Money:” DA Vance Testifies About Sex Trafficking and U.S. Financial Markets Before U.S. House Financial Services Committee”, Manhattan District Attorney’s office, Jan 30, 2018, https://www.manhattanda.org/follow-the-money-da-vance-testifies-about-sex-trafficking-and-u-sfinancial-markets-before-u-s-house-financial-services-committee/

Galloway, Chris, ”Banking Non-Profit Organizations (NPOs) - How Financial Institutions Can Avoid Wholesale De-Risking NPOs by Mitigating Money Laundering and Terrorist Financing Risks Posed by the Sector”, http://www.acams.org/wp-content/uploads/2015/08/Banking-Non-Profit-OrganizationsNPOs-C-Galloway.pdfhttp://www.acams.org/wp-content/uploads/2015/08/Banking-Non-ProfitOrganizations-NPOs-C-Galloway.pdf Geographic Targeting Order, Apr 15, 2015, “FinCEN Targets Money Laundering Infrastructure with Geographic Targeting Order in Miami: ‘GTO’ Addresses Trade-Based Money Laundering Activity Involving Drug Cartels,” Apr 21, 2015. “Guidance on Recognizing Activity that May be Associated with Human Smuggling and Human Trafficking – Financial Red Flags”, Financial Crimes Enforcement Network, Sep 2014, https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2014-a008 accessed in Mar 2018 “Guidance for a Risk-Based Approach - Virtual Currencies.” FATF. Jun 2015. http://www.fatfgafi.org/media/fatf/documents/reports/Guidance-RBA-Virtual-Currencies.pdf Haselkorn, Dov, Meyer, Allen, Murphy, Adrian and Boezio, Stefano, “Finding a needle in a haystack”, Oliver Wyman, http://www.oliverwyman.com/content/dam/oliverwyman/v2/publications/2017/jul/AML%20Transaction%20Monitoring.pdf accessed in Feb 2018 Hotline Statistics, The National Human Trafficking Hotline, Mar 2018, https://humantraffickinghotline.org/states accessed in House Committee on Financial Services Staff Memo “How can banks be used to stop human trafficking?”, The Economist, Mar 20, 2018, https://www.youtube.com/watch?v=r9PaRFtlLmc&feature=youtu.be&lipi=urn%3Ali%3Apage%3Ad_flag ship3_feed%, 3B0TklHxyEQI%2B9KiY%2B9Nge2A%3D%3D “How natural language processing adding value to compliance”, Inside Financial & Risk, Thomson Reuters, accessed Apr 2, 2018. https://blogs.thomsonreuters.com/financial-risk/risk-managementcompliance/natural-language-processing-adding-value-compliance/ Hudak, Steven, “FinCEN Fines BTEC-e Virtual Currency Exchange $110Million For Facilitating Ransomware, Dark Net Drug Sales.” FinCEN. Jul 27 2017. https://www.fincen.gov/news/newsreleases/fincen-fines-btc-e-virtual-currency-exchange-110-million-facilitating-ransomware “Human Trafficking: Customer and Financial Transaction Traits That May Present Risk”, The Bankers’ Alliance Against Trafficking, Feb 17, 2014, https://www.osce.org/secretariat/115618?download=true Hutchings, Denise, “28 Red Flags for Elder Financial Abuse”, Verafin, Apr 28, 2015, https://verafin.com/2015/04/28-red-flags-for-elder-financial-abuse/ Hutchings, Denise, “U.S. Court Case: 9 Banks and 50 Bank Accounts Exploited by Human Trafficking Ring”, Verafin, Feb 21 2017, https://verafin.com/2017/02/u-s-court-case-9-banks-and-50-bankaccounts-exploited-by-human-trafficking-ring/ Irrera, Anna, “HSBC partners with AI startup to combat money laundering”, BNNBloomberg, Jun 2017, https://www.bnn.ca/hsbc-partners-with-ai-startup-to-combat-money-laundering-1.767098 Jamal El-Hindi,” ASSESSMENT OF CIVIL MONEY PENALTY “, FINCEN, Dec 2016, www.fincen.gov/sites/default/files/enforcement_action/2016-12-15/Bethex%20Assessment_Final.pdf

Keatinge, Tom and Barry, Anne-Marie, “Disrupting Human Trafficking The Role of Financial Institutions”, Royal United Services Institute, Mar 2017, https://rusi.org/sites/default/files/201703_rusi_disrupting_human_trafficking.pdf accessed in Mar 2018 Kaminsk, Piotr, Mikkelsen, Daniel Poppensieker, Thomas and Robu, Kate, “Sustainable compliance: Seven steps toward effectiveness and efficiency”, McKinsey & Company, last modified Feb, 2017. https://www.mckinsey.com/business-functions/risk/our-insights/sustainable-compliance-seven-stepstoward-effectiveness-and-efficiency Lee, Jamie, “OCBC sees AI payoff in transaction monitoring”, Straits Times, Nov 8, 2017, accessed Apr 15, 2018. www.straitstimes.com/business/banking/ocbc-sees-ai-payoff-in-transaction-monitoring “List of Products Produced by Forced or Indentured Child Labor”, United States Department of Labor, Mar 2018, https://www.dol.gov/ilab/reports/child-labor/list-of-products/index-country.htm Loconte, Richard, “DFS fines Western Union $60M for violations of New York’s anti-money laundering laws and for ignoring suspicious transactions to locations in China”, New York State Department of Financial Services, Jan 4 2018, www.dfs.ny.gov/about/press/pr1801041.htm accessed in Apr 2018 Lowe, Michael, “Why the UK’s universities should take a closer look at where their money is coming from”, PWC, Aug 2016, http://pwc.blogs.com/fraud_academy/2016/08/why-the-uks-universities-shouldtake-a-closer-look-at-where-their-money-is-coming-from-and-not-just-.html Lucchetti (Junior), Umberto, “AML Rule Tuning: Applying Statistical and Risk-Based Approach to Achieve Higher Alert Efficiency”, Association of Certified Anti-Money Laundering Specialists, Feb 2018, http://www.acams.org/wp-content/uploads/2015/08/AML-Rule-Tuning-Applying-Statistical-Risk-BasedApproach-to-Achieve-Higher-Alert-Efficiency-U-Luccehtti.pdf “Memorandum on Financial Institution and Law Enforcement Efforts to Combat Elder Financial Exploitation”, Finance Crimes Enforcement Network and Consumer Financial Protection Bureau, Aug 30, 2017, https://www.fincen.gov/sites/default/files/2017-08/8-252017_FINAL_CFPB%2BTreasury%2BFinCEN%20Joint%20Memo.pdf Milliken, Kaltin, “Lawmakers worry digital currency helping human traffickers avoid detection”, The Hill, Jan 31, 2018, http://thehill.com/policy/technology/371573-lawmakers-worry-digital-currency-helpinghuman-traffickers-avoid-detection Miller, R S, Rosen, L W, Jackson, J K, Trade-based Money Laundering: Overview and Policy Issues [M]. Congressional Research Service, 2016. “Money Laundering Risks Arising from Trafficking in Human Beings and Smuggling of Migrants”, FATF, Jul 2011, http://www.fatfgafi.org/media/fatf/documents/reports/Trafficking%20in%20Human%20Beings%20and%20Smuggling %20of%20Migrants.pdf Nichols, Nick, “The rise in senior and vulnerable investor abuse”, DST Systems, last modified Oct 3, 2017, http://www.dstsystems.com/insights/rise-in-senior-and-vulnerable-investor-abuse Nikolova, Maria, “Sumitomo Mitsui to use AI for AML monitoring of transactions”, Finance Feeds, last modified Sep 25, 2017. https://financefeeds.com/sumitomo-mitsui-use-ai-aml-monitoring-transactions/. “Number of international students studying in the United States in 2016/17, by country of origin”, https://www.statista.com/statistics/233880/international-students-in-the-us-by-country-of-origin/

O’ Hanlon, Conor & Miller, Keith. “SEC Continues to Take Action Against Alleged ICO Fraud.” Perkins Coie. Apr 3 2018. www.virtualcurrencyreport.com/2018/04/sec-continues-to-take-action-againstalleged-ico-fraud/ “Recommendations and report for financial institutions on preventing and responding to elder financial exploitation”, Consumer Financial Protection Bureau, Mar 2016, https://files.consumerfinance.gov/f/201603_cfpb_recommendations-and-report-for-financial-institutionson-preventing-and-responding-to-elder-financial-exploitation.pdf “Regulatory Intelligence Briefing – Trade-Based Money Laundering Risk and Regulatory Agency Priorities”, FIS Center of Regulatory Intelligence, 2016 “Risk of Terrorist Abuse in Non-Profit Organizations”, FATF, Jun 2014 http://www.fatfgafi.org/media/fatf/documents/reports/Risk-of-terrorist-abuse-in-non-profit-organisations.pdf “Seven Sentenced in Money Laundering Scheme Involving Proceeds from Multiple Foreign Scams that Targeted U.S. Victims”, The United States Attorney’s Office Western District of Texas, last modified Feb 28, 2018, https://www.justice.gov/usao-wdtx/pr/seven-sentenced-money-laundering-scheme-involvingproceeds-multiple-foreign-scams Spagat, Elliot. "Rabobank to pay $369 million in money-laundering case." Fox News, Feb 7, 2018. www.foxnews.com/us/2018/02/07/rabobank-to-enter-plea-in-money-laundering-investigation.html. Stelter, Leischen, “Combating Human Trafficking Networks within Prison Walls”, Public Safety, Jan 22, 2014, https://inpublicsafety.com/2014/01/combatting-human-trafficking-networks-within-prison-walls/ Stelter, Leischen, “Know the Language of Human Trafficking: A Glossary of Sex Trafficking Terms”, Public Safety, Jul 3, 2014, https://inpublicsafety.com/2014/07/know-the-language-of-human-traffickinga-glossary-of-sex-trafficking-terms/ Symonds, Jonathan, “Intelligent Segmentation as the Attack Point for AML”, Ayasdi, Jul 12, 2017, https://www.ayasdi.com/blog/aml/intelligent-segmentation-as-the-attack-point-for-aml/ Shonk, Krista. "Know Your Customer: ATM Transactions May Indicate Money Laundering." Community Banker 16, no. 4 (Apr 2007): 56-57. Columbia University www.searchproquest.com.ezproxy.cul. columbia.edu/docview/195162909?pq-origsite=summon&accountid=10226. “Table of ratings for assessment conducted against 2012 FATF Recommendations, using 2013 FATF Methodology”, FATF, Apr 30, 2018, www.fatf-gafi.org/media/fatf/documents/4th-Round-Ratings.pdf “Terrorist Financing”, Financial Action Task Force, Feb 2008, www.fatfgafi.org/media/fatf/documents/reports/FATF%20Terrorist%20Financing%20Typologies%20Report.pdf “Testimony Before the House Financial Services Committee on Human Trafficking”, Manhattan District Attorney’s office, Jan 30, 2018, https://www.manhattanda.org/testimony-before-the-house-financialservices-committee-human-trafficking/ "This is how drug syndicates used Commonwealth ATMs to launder cash." Business Insider Australia, Aug 3, 2017. http://www.businessinsider.com/this-is-how-drug-syndicates-used-commonwealth-atmsto-launder-cash-2017-8?IR=T. “Global Slavery Index 2016”, Global Slavery Index, Mar 2018, https://www.globalslaveryindex.org/about/ “The Gramm-Leach-Bliey Act”, Electronic Privacy Information Center, www.epic.org/privacy/glba/

“The new frontier in Anti-Money Laundering”, McKinsey & Co, Nov 2017, accessed Mar 14, 2018. www.mckinsey.com/business-functions/risk/our-insights/the-new-frontier-in-anti-money-laundering The SAR Activity Review Trends & Tips & Issues." Bank Secrecy Act Advisory Group (Oct 2000). https://www.fincen.gov/sites/default/files/shared/sar_tti_01.pdf. The SAR Activity Review Trends & Tips Issue 7" Bank Secrecy Act Advisory Group (Aug 2004). https://www.fincen.gov/sites/default/files/shared/sar_tti_07.pdf#page=29 “Thomson Reuters World-Check and Liberty Asia exceed 5,000 names in anti-human trafficking initiative”, Thomson Reuters, Jun 2017, www.thomsonreuters.com/en/press-releases/2017/june/thoms on-reuters-world-check-and-liberty-asia-clear-5000-names-in-anti-human-trafficking-initiative.html Torres, Roberto, “How a Main Line company helps banks crack down on human traffickers”, Mar 30, 2018, accessed Apr 26, 2018. https://technical.ly/philly/2018/03/30/quantaverse-human-traffickingeconomist/ “Trade based money laundering." The Financial Action Task Force. Jun 23, 2006. “Transaction monitoring: To segment or not?”, SAS Software, www.sas.com/en_us/insights/articles/risk-fraud/transaction-monitoring-dynamic-segmentation.html “Tuning Suspicious Transaction Monitoring Scenarios: Combining AML Expertise and Data Analytics”, Protiviti, Mar 2018 https://www.protiviti.com/US-en/insights/tuning-suspicious-transaction-monitoringscenarios-combining-aml-expertise-and-data “Updated Advisory to Financial Institutions on Filing Suspicious Activity Reports Regarding Loan Modification/Foreclosure Rescue Scams." The Financial Crimes Enforcement Network, last modified Jun 17, 2010. https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2010-a006 "Update on U.S. Currency Restrictions in Mexico: Funnel Accounts and TBML”, Finance Crimes Enforcement Network, 2014. Upright, Ed, “Bank staff will 'red-flag' trafficking suspects with powerful new tool”, Reuters, May 2 2017, https://www.reuters.com/article/us-banks-trafficking/bank-staff-will-red-flag-trafficking-suspects-withpowerful-new-tool-idUSKBN17Y22 “Using Artificial Intelligence to Minimize Risk”, Corporate Compliance Insights, Jun 30, 2017,http://www.corporatecomplianceinsights.com/improving-effectiveness-aml-programs West Jim, Suplee Carl, “Developing Scenario Segmentation and Title Anomaly Detection Models”, SAS, accessed May 2018, https://www.sas.com/content/dam/SAS/en_us/doc/whitepaper1/scenariosegmentation-anomaly-detection-models-107495.pdf “When AI meets AML”, FICO, FICO Blog, accessed Mar 20, 2018. http://www.fico.com/en/blogs/analytics-optimization/when-ai-meets-aml-a-report-from-edinburgh/