European Focus: AML/CTF Responses to Recent Terrorist Acts ...files.acams.org/webcasts/20150323/ACAMS_WebSeminar... · Responses to Recent Terrorist Acts and ISIS Violence ... -Cash

European Focus: AML/CTF

Responses to Recent Terrorist

Acts and ISIS Violence

• The web seminar has not yet started:• A sound check will be performed 5 minutes before the start time.

• COPYRIGHT NOTICE – USE OF WEBEX LOGIN/PASSWORD FOR ACAMS WEB SEMINARS

Each site license entitles registrant to one login: one phone connection (if accessing audio via teleconference) and one Internet connection for simultaneous Webcast, in one room where an unlimited number of listeners may participate.

Providing your login instructions and password to another for their use, using your login ID/password more than once, or any simultaneous or delayed transmission, broadcast, re-transmission or re-broadcast of this event to additional sites/rooms by any means (including but not limited to the use of telephone conferencing services or a conference bridge, whether external or owned by the registrant) or recording is a violation of U.S. copyright law and is strictly prohibited.

Moderator

John Byrne, Esq., CAMSExecutive Vice President

ACAMS

Speakers

Fabrice BorselloA founding member of the French ACAMS Chapter

Chief AML Risk Officer and Vice PresidentWestern Union Payment Services Ireland Ltd.

Western Union Business Solutions

Markus SchulzHead, Financial Crime Compliance Controls

Group Financial Crime ComplianceStandard Chartered Bank

Justine Walker Director, Financial Crime (Sanctions and Bribery)

British Bankers Association

Foreign Terrorist Fighter (‘’FTF’’) / ISIS Threat in 2015

New form of terrorism threat, different from more traditional terrorism funding typologies

Impacts every financial institution that:• Serves clients who may become foreign fighters, then returned fighters• Maintains financial ties with the countries facing / neighboring the ISIS

threat e.g. Syria, Iraq, Turkey, Lebanon (banking & MSB activities)

Foreign Fighters : “Noncitizens of conflict states who join insurgencies during civil conflicts” David Malet - Foreign Fighters: Transnational Identities in Civil Conflicts (2013)

- Institutions with banking subsidiaries or MSB branches in Turkey / Lebanon / Jordan / Iraq

- Business transactions with the region- NGO transactions- Individual remittance transactions (e.g. emergencies)

Recent FATF Guidance report (Feb. 2015) + key topic for the upcoming Forum with Private Sector (Brussels, March 2015)

Not Every International Wire is a Foreign Fighter / ISIS Threat

Za’atari Refugee Camp, Jordan

1000+ NGOs involved (incl. Amnesty International, Oxfam and Save the Children

Huge remittance / humanitarian assistance needs among the regional population

Situation requires a robust risk assessment methodology

4 Million+ refugees (1.6M in Turkey alone)

Vulnerable population in Syria & Iraq: 17M

Foreign Fighter by Country

FATF report proposes an updated list of country data

Feb. 2015FATF Report

Financing of the Terrorist Organization ISIL

(Page 21)

ISIS Conflict Area – Iraq / Syria / Turkey / Lebanon

• Territories on the periphery of the control & support zones are under an increasingly high threat

• security situation changes regularly

• Frequent monitoring and updating of the status of towns and cities in this area is critical

• Specialized websites offer reliable information

Foreign Fighter Typology Development

■ Recommended approach:

• Develop a dedicated FTF program to identify, assess and monitor typology-specific characteristics

• Target entities with travel / transaction activity possibly associated with the ISIS conflict

• Leverage open source and law enforcement reporting to build networks and enhance in-house typologies

■ Actions:

• Identify and evaluate key FTF typology characteristics & funding mechanismson an on-going basis

• File comprehensive SARs and coordinate with law enforcement• Enhance monitoring rules; operationalize targeted SAR & investigation triggers• Deploy typology-specific training across your institution (first line of defense)

Design Typology

Characteristics

Search all Transactions Analyze ResultsIdentify entities

with questionable

client activity

Build Client Network

Engage LE * / File SAR

Update / Enhance Typologies

1.

2.

3. 4.

5.

6.

* LE : Law Enforcement Agencies

Analytic Workflow (1) : from Typology to Target

Search all Transactions Analyze Results

Get Targets from LE or

open source reporting

Build Client Network

File SAR

Cre

ate

/ Up

da

te

Typ

olo

gie

s

Typology Characteristics

Run Typologies / Generate new Targets

1.

2.

3.4.

5.6.

7.

* LE : Law Enforcement Agencies

Analytic Workflow (2) : from Target to Typology

Primary Typology Characteristics

■ Single entities before they travel to the ISIS conflict area

• Target: behavioral red flags and financial operations details that indicate the client possibly considers becoming a FTF

• Client red flag & typology

- Signs of sudden radicalization (like sectarian excess typologies)- Bank account & payment instrument activity is not aligned with the client economic profile

o Frequent domestic or intra-EU travel activities / intensive usage of peer-to-peer car sharing services

o Client has an abnormal payment activity within transportation hubs o Client purchases airline / bus tickets with a connection to Turkey e.g. Turkish Airlineo (Non-Turkish) client visits Turkey : he paid for the transportation but has no expense

for accommodation once out there (lodging / food) o Client suddenly multiplies garment & equipment purchases in shops specializing in

outdoor and ‘’survival’’ sports / second-hand military supplieso Client wants to upgrade his debit card to credit and inquires about available ATM

withdrawal limits in Turkey, Lebanon and Jordano Client submits a request for consumer loans / car loano Client request to clean out most of his account for cash

■ Single entities with apparent travel activity in specific geographies, then returning

• Target: financial operations funding the living expenses and equipment of the foreign fighters while in the conflict area (then as a returnee)

• Client typology : customers conducting transactions or payments (1) in your country then (2) in Syria / Iraq / specific zones of Turkey / Lebanon / Jordan, then (3) back in your country as a client again

- Incoming transfers: ISIS reportedly pays its members (50 EUR to 1,500 EUR per month)

- Outgoing wires: funding from grass root-level individual contributors mobilized thru. social networks

- Cash financing through MVTS services- Continued access to home country bank account (card payment / foreign cash

withdrawal at ATMs) requires dedicated tracking- Multiple travels are possible before the Syrian border is passed

Primary Typology Characteristics

Primary Typology Characteristics

■ Multiple entities operating in networks to apparently facilitate the enrollment,the transportation and the accommodation of Foreign Fighters

• Target: financial operations funding propaganda activities, travel preparation for new individuals and other logistics

• Client typology:

- Clusters of interconnected entities e.g. many-to-one, many-from-one and one-to-many patterns

- Cross-border transactions connecting your country + other foreign fighter source countries + Syria, Iraq and/or Turkey (multi-country transaction routing)

- Flipping activity: individual controlling the client network flips transactions from one country to another one

e.g. Multiple EU countries Turkey Syria or Iraqe.g. Multiple EU countries Turkey EU countries again (different recipients)

Primary Typology Characteristics

■ Multiple entities operating in networks to apparently facilitate theenrollment, the transportation and the accommodation of Foreign Fighters

• Client typology (contd.):

- Focus on both inbound and outbound operations

- Transactions or payments involving neighboring zones of the conflict area & border areas known to be funding, logistical and smuggling hubs for FTFs e.g. Turkey/Syria border (Gaziantep, Hatay, Sweida and Aleppo)

- High velocity operations

Additional Typology Characteristics

■ Aggravating Risk Factors (for Investigation Purpose)

• Age and Gender: most Foreign Fighters are men between the ages of 18 and 35

• Single entity transactions maybe conducted with or through family members (donations supported by social media)

• Client network activities also comprise other TF-related jurisdictions: Gulf countries, North Africa, Egypt, PAKAF or African Sub-Sahel region

• Multiple entity activities connecting different EU countries as sending places and clients of various ethnic extractions

• An increasing amount of fighters globally are Muslim converts who have changed their names to an Arabic moniker (but financial operations may be conducted in their given name)

Additional Typology Characteristics

■ Aggravating Risk Factors (for Investigation Purpose) Contd.

• Clients using web-based systems identified with significant distance between city and IP address location

• Clients submitting inconsistent biographical data

• Use of ID unconnected with places of transaction

• Client profile has poor connection to remittance needs (e.g. convert entity)

• Client asks for the conversion of large amount of Iraqi / Syrian currencies

Consumer Network case : EU-based network to Turkey

(2014 scheme)• Individual 1 in Turkey received 70 fund transfers from 54 distinct senders in 17 countries,

primarily the Netherlands, France and Germany• Additional domestic consumer networks are linked in some countries, (e.g. France)• Individual 1’s counterparties include an individual who is currently fighting in Syria.

Additionally, another sender was identified as uploading ISIS related material on Youtube.com

Flipping Case example : Hatay, Turkey network

2014 scheme• One entities network, centered on a Hatay’s border with Syria• Turkey-based Syrian national receiving transactions from U.S. and Saudi-based entities

and sending transactions to individuals in Syria (as well as seven other countries)

• Spot the names of the foreign fighters and acolytes• Follow the news of the battlefront (impacted cities)

A proportion of the identified activity may be regime-related too (e.g. Syrian regime / Syrian opposition)

Conclusion

FTF Typologies is a constantly changing picture – requires a dedicated effort

Pro-activeness and intelligence sharing with LEAs is key (bi-directional information sharing ) since open source information on known FTFs is limited

The FTF has departed: what legal framework for the execution of Sanctions-related procedures (FTF’s bank account freeze, annulment of debit & credit card / criminalization of fund transfer

Organize your own news monitoring service: