Red Flags for Employees with Advanced Responsibilities

Transcription

1 Flag the Money for Canadian Credit Unions Red Flags for Employees with Advanced Responsibilities This Red Flags list is designed for roles such as: supervisors branch managers internal audit compliance officers As someone who is responsible for overseeing other staff or working directly with the compliance department, you need a broader understanding of AML issues and your credit union s unique vulnerabilities. You may need to escalate a potential money laundering or terrorist financing activity to further investigation, submit a report to FINTRAC, or even alert law enforcement. This list includes the red flags from all the role- specific group lists: front line, behind the scenes, commercial business and specialized responsibilities. It will be a useful reference to identify transactions that are unusual enough to require further scrutiny. Keep in mind that a single red flag may not be sufficient to suggest money laundering or terrorist financing, and that this list is not exhaustive and does not cover every situation. A transaction may be terminated based on one or more of these red flags, or if a member requests a service that is prohibited by your credit union s policies and procedures or by your compliance software. In this case, you may still have to submit an STR for the attempted transaction. The deadline for filing an STR is within 30 days of becoming aware of a suspicious activity. Certain indicators could trigger reasonable grounds to suspect that one or more earlier transactions (which had not seemed suspicious at the time) could be related to money laundering or terrorist financing. For example, a media report could alert you that one of your members may be involved in illegal activity and prompt you to review previous transactions. If you find grounds for suspicion, you must submit a report to FINTRAC within 30 days. For a more extensive list of Red Flags, refer directly to the FINTRAC website. Special Considerations Risk Assessment: Your compliance department is required to conduct a risk assessment to identify the vulnerabilities of your credit union, and may have developed a separate list of high- priority red flags. If so, you might want to keep the two lists together. Significant Changes in Account Behaviour: Pay special attention to members who dramatically change the way they use their accounts, particularly any substantial or repeated increase in funds passing through quickly. Ask yourself if this transaction or series of transactions is consistent with the stated purpose of the account, the individual or company profile, and the accounts that have similar profiles

2 Opening Deposits or Investments: It s important to determine a new member s source of funds and establish the background of the first transaction. Of particular interest would be a wire transfer from outside the country, certain monetary instruments and, of course, a large cash deposit. Ask yourself if there is a good reason why the new member is bringing this transaction to your credit union instead of to their previous financial institution. Common addresses, phone numbers, IP addresses and other data: While household members often have accounts at the same institution, unrelated members who share street or IP addresses, or who have the same phone number or account, could be using their accounts for suspicious or fraudulent purposes. Watch for members who change their contact information to locations shared with other members. Out- of- Market Windfalls: If you think a new member who just appeared at your credit union sounds too good to be true, you might be right. For example, pay attention to someone whose address is far from your location, especially if there is no apparent reason why you are to receive the business. This may be an attempt to prevent you from discovering that there is not actually any legitimate enterprise. Do not be one of those who follow a no questions asked philosophy of taking in new business. 2 Suspicious Behaviour Member has an unusual or excessively nervous demeanour. Member appears to have a hidden agenda or behaves abnormally for example, turning down the chance to obtain a higher interest rate on a large account balance. Member wants to discuss your record- keeping or reporting requirements, with the apparent intention of avoiding them. Member tries to threaten, bribe, or befriend you or one of your staff in an effort to prevent fulfilment of the record- keeping or reporting requirements. Member is reluctant to proceed with a large cash transaction after being told it must be reported. Member uses informal book- keeping methods such as scribbled notes on loose paper (particularly for a commercial business account). Agent, attorney or financial advisor acts for a member without proper documentation such as a power of attorney, or in a manner inconsistent with the expectations of their profession (for example, possible misuse of funds held in trust). Member moves frequently, unless there is something in their profile to suggest that frequent changes in residence might be normal. Low- income member (such as a student) or low- volume account (such as a small business) uncharacteristically transfers or exchanges large sums of money. Account shows high volume in the movement of funds, but maintains low beginning and ending daily balances.

3 Member conducts foreign exchange transactions/currency swaps without caring about the margins. Transaction involves offshore institutions whose names resemble those of well- known legitimate financial institutions. Transaction involves unfamiliar countries or islands that are hard to find on a map. Relative or close associate of a foreign public official makes large deposits not consistent with known sources of legitimate income. Suspicious Identification Circumstances Member provides unusual or suspicious identification documents or declines to produce originals for verification. Member tries to open an account without identification. Member is unwilling to provide background information when opening an account. Business member is unwilling to provide personal background information, financial statements, business documents or references when opening an account. Member s ID used to open the account does not have a complete local address. Be sure to obtain a physical location residential address for personal, and operational for business. Postal box numbers alone are not acceptable. Government- issued ID is not sufficient to validate a current address. Mail drop services, especially when used for all legal documents and correspondence, should be questioned you should be satisfied as to why there is no physical address for this person or company. Member s permanent address is outside the credit union s service area. Member s home or business telephone is disconnected. Member does not wish to have a statement or any documents mailed to the address provided (unless there is a logical explanation for the request). Business member is reluctant to reveal details about business activities. Business member is unwilling to provide information or documents about a related business. Business member s account documentation shows an unclear ownership structure. Member asks questions about how the credit union shares information about the identification of its members. Member claims to be a law enforcement agent conducting an undercover operation, without being able to validate the claim. 3

4 Suspicious Cash Transactions Member s deposits often contain counterfeit bills or musty or extremely dirty bills. Member wants to cash a cheque or purchase a monetary instrument without processing it through their account. Member visits their safety deposit box before or after a cash transaction. Member makes large cash deposit without having counted the cash. Member attempts to take back a portion of a cash deposit that exceeds the reporting threshold after learning that an LCTR will otherwise be filed. Member frequently deposits large sums of cash wrapped in currency straps. Member makes large cash deposit containing many larger denomination bills (without an acceptable business reason). Member frequently exchanges small bills for large bills in denominations that are inconsistent with expectations. Member withdraws cash after having deposited funds in another form (wire, draft, etc.). Member withdraws cash from one of his accounts and deposits the cash into another account the member owns. Member makes frequent deposits or withdrawals of large amounts of currency for no apparent business reason, or for a business that normally does not generate large amounts of cash. Member conducts large cash transactions at different branches or ATMs on the same day, or coordinates others to do so on their behalf. Member deposits cash that is then transferred to another account or accounts, perhaps at another FI, when the payee is the same as your member (double- banking). Member often withdraws cash in large amounts. While there is no threshold for cash withdrawals, unusual amounts should be questioned, especially when outside the normal activities of the individual or business. Member frequently purchases monetary instruments with cash in amounts just less than the reporting threshold. Member pays bills, makes loan payments, especially accelerated loan payments, using cash or monetary instruments. Member conducts an unusual number of foreign exchange transactions/currency swaps without caring about the margins. Member has multiple accounts in one or more names, makes large cash deposits to the various accounts and then consolidates the funds into one account. This is especially suspicious if the funds are then transferred outside your credit union. Member conducts unusual cash transactions through night deposit boxes, especially large sums that are not consistent with the member s business. 4

5 Suspicious Non- Cash Activity Member deposits a large number of traveler s cheques, often in the same denominations and in sequence. Member deposits monetary instruments where memo indicates a 3 rd party. Deposits from a common payer go to multiple accounts (not apparent payroll). Frequently transfers funds amongst their accounts without apparent purpose. Frequent use of high- risk point- of- sale locations such as casinos, MSBs, hotels (especially near home), retail cash- back, or retail transactions with monetary instruments such as store cards. Cheques or transfers frequently issued to regular or irregular payees, without apparent purpose. Member deposits large numbers of consecutively numbered money orders. Member deposits cheques and/or money orders that are not consistent with the stated purpose of the account or nature of business. Member deposits a large number of third party cheques. Funds withdrawn from the accounts are not consistent with the normal business or personal activity. Funds deposited are moved quickly out of the account via payment methods inconsistent with the established purpose of the account. Funds withdrawn from accounts are transferred to suspicious international jurisdictions. 5 Suspicious Wire Transfers Non- account holder sends wire transfer with funds that include numerous monetary instruments, each in an amount just under the reporting threshold. An incoming wire transfer has instructions to convert the funds to cashier s cheques and to mail them to a non- account holder. Wire deposit where the payee and the account holder are not the same, or where notes may indicate a 3 rd party. A wire transfer directs large sums to an international account when the purpose of the transaction is not clear. An incoming wire transfer, followed by an immediate purchase by the beneficiary of monetary instruments for payment to another party. An increase in international or inter- provincial wire transfer activity in an account with no history of such activity or where the stated business of the member does not warrant it. Member receives many small incoming wire transfers and then orders a large outgoing wire transfer to another province or country.

6 Member deposits bearer instruments followed by instructions to wire the funds to a third party. Account in the name of a currency exchange house receives multiple wire transfers or cash deposits just under the reporting threshold. Member frequently shifts purported profits by wire transfer out of the country. A wire transfer directs large sums to secrecy havens. 6 Suspicious Activity in Credit Transactions Credit balances: Members may over pay their credit line or card accounts prior to vacations or when other circumstances may prevent them from making payments, or when they anticipate numerous upcoming transactions, but large or frequent credit balances may also be red flags for money laundering. On a loan application, member submits artificially low income (business or personal). Reported income to CRA does not match stated income. A member s financial statement (used to apply for a loan) makes representations that do not conform to accounting principles. For example, there is a lack of statements or homemade statements; evidence of two sets of books. An application is made to appear more complicated than it needs to be by use of impressive but nonsensical terms such as emission rate, prime bank notes, standby commitment, arbitrage or hedge contracts. Member provides no record of past or present employment on a loan application. Member requests loans either made to offshore companies or secured by obligations of offshore banks. Member purchases certificates of deposit and uses them as collateral for a loan. Member collateralizes a loan with cash deposits. Member uses cash collateral located offshore to obtain a loan. Member s loan proceeds are unexpectedly transferred offshore. Unexpected accelerated pay- down, either at outset, or as a significant change against transactional history. Member suddenly pays off a large problem loan with no plausible explanation as to the source of funds. Suspicious Trade Financing Transactions Member seeks trade financing on the export or import of commodities whose stated prices are substantially more or less than those in a similar market situation or environment. Member makes changes to a letter of credit beneficiary just before payment is to be made.

7 Member changes the place of payment in a letter of credit to an account in a country other than the beneficiary s stated location. Member s standby letter of credit is used as a bid or performance bond without the normal reference to an underlying project or contract, or designates unusual beneficiaries. Letter of Credit is inconsistent with member s business. Letter of Credit covers goods that have little demand in importer s country. Letter of Credit covers goods that are rarely if ever produced in the exporter's country. Documents arrive without title documents. Letter of Credit is received from countries with a high risk for money laundering. Commodities are shipped through one or more jurisdictions for no apparent economic or logistical reason. Transaction involves the use of repeatedly amended or frequently extended letters of credit. Size of the shipment appears inconsistent with the regular volume of business of the importer or of the exporter. ATM Usage The convenience of ATMs makes them ideal financial services delivery points for launderers and terrorists. Launderers can use an account in Canada to deposit funds within Canada and have another person withdraw them outside the country. Domestic terrorists might find ATMs convenient to access accounts as they travel. Deposit accounts with multiple access devices might be indicators of illegal abuse of ATMs. Member s deposits often contain counterfeit bills or musty or extremely dirty bills. Frequent unexplained usage of the exchange network Frequent use of ATMs at high- risk locations (casinos, retail locations, hotels) Unexplained geographic profile for usage of ATMs Use of many different ATMs for deposit, perhaps on the same day Red Flags for Terrorist Financing FINTRAC notes that a single indicator on its own may seem insignificant, but combined with others, could provide reasonable grounds to suspect that the transaction is related to terrorist financing activity. Client accesses accounts, and/or uses debit or credit cards in high risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations. 7

8 Client identified by media or law enforcement as having travelled, attempted/intended to travel to high risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations. Client conducted travel- related purchases (e.g. purchase of airline tickets, travel visa, passport, etc.) linked to high- risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations. The client mentions that they will be travelling to, are currently in, or have returned from, a high risk jurisdiction (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations. Client depletes account(s) by way of cash withdrawal. Client or account activity indicates the sale of personal property/possessions. Individual/Entity s online presence supports violent extremism or radicalization. Client indicates planned cease date to account activity. Client utters threats of violence that could be of concern to National Security/Public Safety. Sudden settlement of debt(s) or payments of debts by unrelated 3rd party(ies). Law enforcement indicates to reporting entity that the individual/entity may be relevant to a law enforcement and/or national security investigation. Client s transactions involve individual(s)/entity(ies) identified by media or law enforcement as the subject of a terrorist financing or national security investigation. Client donates to a cause that is subject to derogatory publicly available information (crowdfunding initiative, charity, NPO, NGO, etc.). Client conducts uncharacteristic purchases (e.g. camping/outdoor equipment, weapons, ammonium nitrate, hydrogen peroxide, acetone, propane, etc.). A large number of transfers between client and unrelated 3rd party(ies). Client provides multiple variations of name, address, phone number or additional identifiers. The sudden conversion of financial assets to a virtual currency exchange or virtual currency intermediary that allows for increased anonymity. 8