Our latest Secret Crime Fighter discovered a suspected terrorist financing scheme involving charities, high risk countries and structured payments. It is often hard to distinguish between money laundering or fraud, and terrorist financing. What do you think about this typology? Would you have reported this as terrorist financing?

‍

The Typology

Setting up the Accounts

Over a number of years, from 2018 through 2020, customers of our Secret Crime Fighter set up accounts and transacted normally, with some activity of low amounts and volumes. The customers had Bangladeshi names, and were sending money there.

‍

From the later investigation, it became apparent that there were 12 connected customers, some of whom shared devices, had similar email addresses and had similar backgrounds in their selfie videos. Two of the customers provided different ID documents which contained different dates of birth at sign up, but the photos were similar and looked like the same person, one with short hair, and one with longer hair and a beard. The accompanying selfies were identical.

‍

Raising Suspicion

Initially there was normal activity on the accounts that were opened, but suspicion was raised when, over a 6 month period, approximately €425k was moved through the 12 accounts. These funds all came from 2 nonprofit organizations in France. The money was then sent to accounts in Bangladesh. Given the 12 accounts were personal accounts, these amounts were higher than expected.

In addition, some of the accounts had clear structuring of payments, with several deposits being made within a matter of minutes, all just under €1000.

‍

Failed Enhanced Due Diligence

When our Secret Crime Fighter contacted some of the customers for more information on the payments, the customers said that they worked as volunteer fundraisers in France, for a charity in Bangladesh. The charity, however, had no online presence, and documentation provided had indications that it was fake, such as using a logo from another company, and listing an address that is not on google maps. In addition, the customers provided the exact same payslips with just the name changed - the same ID codes, even the same errors.

‍

And finally, one of the strongest indicators that this was terrorist financing was that one of the customer’s names had an adverse media flag involving arms trafficking in India, not far from the border with Bangladesh.

‍

Red Flags

• Customers connected by shared devices
• Customers with fake identity documentation, sometimes shared across accounts
• Customers with similar email addresses
• Higher than expected transaction amounts
• Structured payments
• Payments to high risk countries
• Payments from or to charities with little or no online presence
• Adverse media related to arms trafficking

‍

Stopping the Typology

Our Secret Crime Fighter was able to identify the suspicious activity through a series of rules looking at the amounts and volumes of transactions, the countries the transactions were coming from and going to, and connections between customers. Performing EDD enabled them to gather more evidence of suspicious activity and confirm their beliefs that this scheme involved terrorist financing.

Going forward, our Crime Fighter is introducing machine learning to flag similar but not identical activity.

‍

Controls

• Facial matching at onboarding looking for indicators of shared ID documents or selfies
• Adverse media screening for arms trafficking flags
• Transaction monitoring rules looking for unusually large or frequent payments
• Transaction monitoring rules looking for payments to or from high risk countries
• Transaction monitoring rules looking for connections between customers, even when the accounts were opened years apart
• Enhanced due diligence when the activity includes any of the above red flags

‍

Thanks for reading our latest Secret Crime Fighters newsletter. If you have an interesting typology that you’d like to share, we’d love to hear about it! Please email us at [email protected].