Suspicious Activity Reports

In 2008, financial institutions (FIs) submitted nearly 1.3 million Suspicious Activity Reports (SARs) to the Financial Crimes Enforcement Network (FinCEN). But sometimes, a single complete and timely SAR can spur an investigation that helps put a fraudster behind bars.

In 2009, for example, FinCEN, a division of the U.S. Department of the Treasury, reported the conviction of a mortgage broker who had structured more than $600,000 into multiple accounts at several banks. Ultimately, the defendant admitted making numerous deposits of less than $10,000 each to avoid triggering bank filing of the Currency Transaction Reports required for all activity involving five figures or more.

In a single month, he made nearly 30 such deposits at a number of banks, totaling more than $260,000. Later, in almost 20 transactions at various branches of a single bank, he deposited an additional $185,000. That bank promptly filed a SAR detailing how the mortgage broker had deposited into his personal and business accounts sums ranging from $9,000 to $9,800.

A team of federal investigators then searched FinCEN’s database of millions of SARs and found related reports from other depository institutions and money services businesses indicating both cash structuring and structured purchases of money orders by and for the defendant.

Law enforcement officials credited the bank’s first SAR with providing the lead that prompted a more comprehensive investigation than otherwise would have been possible. Other SARs revealed the defendant’s purchase of large cashier’s checks payable to individuals with whom he had no known business relationship.

Case conclusion: The culprit awaits sentencing. Thanks to effective SARs and close teamwork by FIs, FinCEN, and federal agents, all leads were linked and investigated, and the defendant’s financial crime spree is over.

HEAVY TRAFFIC ON THE INFORMATION HIGHWAY 

The Bank Secrecy Act (BSA) and the USA PATRIOT Act, which amended it, require financial institutions to file SARs and other reports with FinCEN in specific situations. These documents, 77 percent of which were submitted electronically in 2008, are stored in an IRS-hosted online database of more than 100 million such records.

In 1996, the first year SARs were required upon discovery of suspicious activity, FIs (depository institutions, money services businesses, casinos and card clubs, and organizations in the securities and futures industries) submitted 62,000 of them. In 2008, with SAR submissions far exceeding the million-a-year mark, some FIs wondered if law enforcement results justified the resources they had to expend to comply with regulatory reporting requirements.

BSA confidentiality provisions prohibit release of most SAR-related information, and investigators work best in relative obscurity. So the FBI, Immigrations and Customs Enforcement (ICE), and other law enforcement agencies can’t publicize detailed proof of how SARs help them detect and prevent financial crime. But they all want FIs to understand how crucial SARs are to successful law enforcement.

A prime example is FinCEN’s Analysis and Liaison Division (ALD). The ALD combines BSA data with that from a variety of other sources to meet the informational needs of the law enforcement and intelligence communities.

“FinCEN greatly appreciates the time, effort, and expense FIs devote to BSA reporting,” said ALD Deputy Associate Director Nicholas Colucci. To help FIs continue their valuable reporting, he called their attention to an article that FBI and ICE agents co-authored for Issue 16 of FinCEN’s online informational and advisory publication, “SAR Activity Review – Trends, Tips & Issues” (October 2009, pp. 45-47).

The article lists 11 suggestions on how to prepare reports that are optimally accessible and useful to government investigators reviewing SARs. Among the topics discussed are:

• Preparing clear and informative SAR narratives
• Adequately describing any supporting documentation an FI can provide to investigators upon request
• Properly completing specific data fields
• Remembering information not to include in a SAR

With advanced technology playing an increasingly crucial role in the interpretation of SAR data, Colucci spoke enthusiastically of FinCEN’s collaboration with the U.S. Federal Trade Commission and the U.S. Department of Housing and Urban Development to develop electronic-mapping technology that will help law enforcement track and arrest perpetrators of loan modification fraud. He said FinCEN now sends an acknowledgement with a document control number for each SAR an FI submits electronically to improve the reporting process for FIs.

Another recent enhancement for SAR e-filers is FinCEN’s implementation of Adobe-based forms that validate data during submission, display instructions for each SAR field a cursor hovers over, offer spell checking and pop-up country codes, and permit users to identify any number of suspects on a SAR form. FinCEN expects these enhancements will help improve the overall quality of SAR data.

HOW LAW ENFORCEMENT USES SARS 

Supervisory Special Agent Laura Williams is the FBI’s FinCEN liaison officer. “The FIs are our front-line eyes,” she said. “So it’s important that they have confidence in our ongoing use of the information from SARs, CTRs, and any other BSA reports they submit.”

Williams emphasized that if a bank files a SAR and no law enforcement agency calls the bank to follow up, that doesn’t mean the information is useless. “It remains in the system for years, and its significance may not be revealed until we get another lead,” she said. “For example, we could become aware of a terrorism allegation that makes a transaction reported two years ago the key to a broader investigation we can really sink our teeth into.”

In 2004, the FBI implemented its Investigative Data Warehouse (IDW), a master database of information from FinCEN and other sources including U.S. intelligence agencies. Since then, FinCEN has routinely fed IDW large quantities of SAR information. This enables the FBI and other law enforcement agencies on task forces with the bureau to scan – with a single query – all the data in IDW.

For example, using IDW, the FBI compared BSA data with a non-BSA list of the subjects of post-9/11 terrorism investigations. This revealed that 42 percent of the suspected terrorists had some link to BSA data – an impressive amount of financial intelligence obtained unobtrusively. “Without tipping our hand to anyone,” Williams said, “we developed a deeper understanding of the relationship between terrorism and financial crime.”

Another way law enforcement uses SARs is through the more than 100 SAR review teams located across the country. Staffed by federal, state, and local investigators and led by the nearest U.S. attorneys’ offices, these teams review SARs as they arrive in the BSA database. The teams decide which SARs should be investigated further and which agency will take the lead on each case.

In a recent example, a review team following a SAR lead discovered a conspiracy that netted its participants more than $15 million in illicit proceeds. A retired financial executive and his confederates had used straw buyers to obtain higher quantities of initial public stock offering shares than is permitted under federal and state banking regulations. The defendant was sentenced to prison for securities fraud and required to return more than $10 million in illegal gains, as were other conspirators.

VISUAL INVESTIGATIVE ANALYSIS SOFTWARE 

To help agents and analysts more easily interpret enormous amounts of BSA data, the FBI uses visual investigative analysis (VIA) software. “With tools like this, we can derive a lot more intelligence from SAR data than would otherwise be likely,” Williams said. This helps the FBI and other law enforcement agencies allocate personnel and other resources with greater insight as to where and how they can be most productively deployed.

Investigators can use VIA to accurately represent vast quantities of documents based in customizable graphical arrangements called views, which facilitate data interpretation and speed the development of leads for investigators.

Though the details of how the FBI uses such tools are classified, many in the public sector are developing other VIA techniques that any investigator can use.

Researchers at the Georgia Institute of Technology in Atlanta are developing VIA software that already has been used to explore a wide variety of document types including intelligence and police reports. John T. Stasko, Ph.D., associate chair of the institute’s School of Interactive Computing, directs its Information Interfaces Research Group, at which he and his colleagues are developing Jigsaw, a VIA application.

CFEs and fraud examination units interested in learning more about Jigsaw may contact Stasko. There’s no charge to those who test Jigsaw and provide comments on its functionality and usefulness because it’s still under development.

Evaluators receive a stand-alone copy of Jigsaw, which they can install on their systems. (“Stand-alone” means the program can perform its functions independently without any other components.) Each new version of the application is offered to test program participants at no charge.

The identity of test participants can’t be disclosed because Jigsaw is often evaluated for use in confidential investigations and law enforcement. But among those organizations that have tested Jigsaw is a “fusion center” – a team of federal, state, and local law enforcement entities, public safety organizations, and private companies established by the Department of Homeland Security and the Department of Justice, which shares information and intelligence to fight terrorism and crime. 

In a single query, Jigsaw and programs like it can analyze thousands of documents and reveal complex, layered relationships. Each view of a VIA application can offer considerable insight from a unique perspective. So VIA users often position three, even four, large monitors at one workstation to simultaneously explore leads from several perspectives and synthesize their collective intelligence.

Read the sidebar, “A Closer Look at the Jigsaw VIA Application” below that illustrates how four Jigsaw views can be applied to a test bed of data from hypothetical SARs. 

ICE THAWS BUSINESS RELATIONSHIPS

Immigrations and Customs Enforcement (ICE) is another top user of BSA data. Janice Ayala is deputy assistant director of its Office of Investigations. “Sure, we use SARs, CTRs, and other BSA data to fight crime,” she said, “but our relationship with the FIs is a two-way street. We also give them useful advice so they can protect themselves from criminals.”

ICE Operation Cornerstore staffers work with businesses and FIs, through presentations and meetings, to help prevent money laundering and other crimes.

Making the most of BSA data doesn’t always translate into, for example, sensational asset seizures for ICE. “Sometimes when we break up a large criminal network,” Ayala said, “we seize a relatively small amount of cash and assets. But the real measure of our success is the number of people those criminals won’t be able to victimize.”

THE OTHER SIDE OF THE SAR STORY 

Every day of the year, ingenious and determined foes attack the U.S.’s financial system. Fortunately, a diverse team of governmental and private-sector crime fighters efficiently uses SARs and other information-sharing tools to track, foil, and jail those fraudsters.

To complement the law-enforcement perspectives presented in this article, the first in a two-part series, the next issue of Fraud Magazine will offer the first-hand experiences and recommendations of those at the front of the information supply chain – SARs preparers and the savvy specialists who advise them.

Among the advice they’ll offer are tips on how to cooperate effectively with FinCEN; whether, when, and how to file a SAR; how to design and manage SAR policy and procedures programs; how to perform enhanced due diligence to really “Know Your Customer”; and how to observe the rights of customers mentioned in SARs or other BSA reports of suspicious activity.

Robert Tie is a New York business writer and contributing editor at the AICPA’s Journal of Accountancy.

A Closer Look At The Jigsaw VIA Application 

[Exhibits referenced below are no longer available. — Ed.]

The Jigsaw VIA application, developed by the Georgia Institute of Technology’s Information Interfaces Research Group, offers various views of the data it analyzes. (All analyzed information here is fictitious.) Jigsaw offers more views than the samples presented here and enables investigators to follow potential leads as they emerge during analysis.

Circular Graph 

In Exhibit 1, “Unity Bank” and “taxi driver” are in bold text, which identifies them as user-selected criteria for querying a collection of SARs. The lines connecting those two search criteria to other values arrayed along the circle’s perimeter represent links between the search criteria and other values in the dataset being searched.

For example, lines flow from “Unity Bank” to virtually every other value in the view, indicating that all the other values (for example, “taxi driver,” “chemist,” “money laundering, terrorist financing,” “physicist,” “14000,” “restaurant owner,” “9/25/2009,” etc.) appear in records that also contain the value “Unity Bank.” Similarly, numerous lines connect “taxi driver” to many other values in the view, which indicates a smaller but still significant number of relationships like those described above.

Further, each data class represented in this view is positioned contiguously with all others of its kind. For example, people, cities, states, organizations, dates, occupations, and amounts all are grouped.

Jigsaw also has consistently assigned a unique color to the segment of perimeter that spans the range of values in each class of data. Other views presented below also will use this same color coding to visually indicate commonalities among various values in the dataset.

Jigsaw concisely illustrates the numerous important relationships – among people, dates, and events – that are present but not apparent in these documents. Such insights speed agents toward productive investigations.

Individual Document 

In Exhibit 2, the left frame displays the file name of every document in this view. Clicking on a file name displays its corresponding document in the right frame. The top frame lists the data values most common among all documents: larger fonts reflect more frequent occurrences. This combination of frames at once presents an investigator with the particular and general characteristics of an individual SAR and the people, places, dates, and events it reports.

Network Graph 

There are two types of object in Exhibit 3, each with its particular symbolic significance. White rectangles represent the four SARs returned by the query that produced this view. Circles of various kinds represent different types of information – for example, dates, names, and other values – mentioned in the SARs.

Because Jigsaw classes everything into two data types – documents and the pieces of data within them – it needs only rectangles and circles to represent all the relationships in a network graph view. Lines connect each white rectangle to circles of different types and colors. A circle with a cross – if clicked – will reveal additional layers of information. The view’s only “circled circle” (circle within a circle) represents the user’s current selection of a particular data element as the focal point of further analysis.

Jigsaw succinctly illustrates all the relationships between data values in the various SARs represented. The Network Graph view makes it easier for an investigator to perceive numerous different relationships and identify leads to multiple potential conspiracies all on one screen.

List 

The three frames in Exhibit 4 show the alphabetized names of four types of entity: FIs (left frame), people (second frame from left) and their businesses or occupations (second frame from right), and the reporting FI’s city (right frame). In each frame, the length of the bar immediately to the left of each name or occupation indicates relatively how many SARs in the dataset mention it. Hovering the cursor over each bar displays an exact count of the number of SARs in which that value appears.

In the second frame from the right, “taxi driver” is a user-selected value that guides the current analysis of this view. The highlighted items in the left and second-from-the-left frames appear in the same SARs as the item (for example, “taxi driver”) highlighted in the second-from-the-right frame. This indicates that three taxi drivers are mentioned in the SARs in this dataset, and that they each have an account with one of the banks listed in the left frame. Also highlighted (in italics) is the name of a waiter who attempted a suspicious transaction peripherally but significantly linked to the taxi drivers.

This information, combined with relationships revealed in other views, can help an investigator piece together a series of relationships perhaps entered into solely to thwart detection and thus permit fraud or money laundering.

More information on Jigsaw is available at www.cc.gatech.edu/gvu/ii/jigsaw/.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.