What Happens with the Intelligence Gathered by the FIC

Anti-Money Laundering and Counter-Terrorism Financing Workshop What happens with the intelligence that is gathered? Monitoring and Analysis February 2019

Slide 2 of 32 Purpose of the presentation • Provide some background on the FIC and its activities • Provide an overview of the environment in which the Investment Advisor or Intermediaries industry operates • Provide data on statutory reporting as submitted to the FIC • Focus on the vulnerabilities, threats with regards to money laundering and terror financing activities. • Illustrate how these reports are used to combat crime.

Slide 3 of 32 Presentation outline • Why do we need collaboration? • Anti-Money Laundering (AML)/Counter-Terrorism Financing (CTF) Framework • The FIC and why crime concerns it • Value chain and FIC’s involvement • Stakeholders • Reporting • FIC’s contribution to investigations • Case studies • Statistical overview • Observations and Way Forward

Click to edit Master title style Slide 4 of 32 • Destruction caused by financial crimes: • An average of 3.1% of annual turnover is spent on combating financial crimes; and • 47% of respondents have been victims of financial crime over the last 12 months*. • Financial crime and professional money laundering schemes have become more complex and sophisticated to bypass the AML/CFT controls that have been put in place. • On the other hand, terrorists are using small amounts of money to inflict great amounts of damage, and as a result, TF is becoming harder to detect. • Partnerships between government and the private sector can help both parties more effectively safeguard their financial systems against misuse by criminal organisations or terrorists. • Addressing these more complex issues requires proactive engagement between government and the private sector. *Revealing the true costs of Financial Crime” - Thomson Reuters 2018 Survey Report Why do we need collaboration?

Slide 5 of 32 Anti-Money Laundering (AML)/Counter-Terrorism Financing (CTF) ➔ Framework Money laundering is the taking of criminal proceeds and disguising its illegal origin in order to use the funds to perform legal or illegal acts. Financing of Terrorism (TF) The solicitation, collection and provision of funds to support terrorists, their acts and organisations. They want to conceal both the financing and the nature of the activity being financed. Global Domestic Financial Action Task Force (FATF) intergovernmental body focusing on combating ML and TF. It is a policy making and standard setting body (IMF and World Bank). Financial Intelligence Centre Act (Act 38 of 2001) – [FICA] established the FIC and placed obligations on accountable institutions and other businesses deemed vulnerable to money laundering. The Prevention of Organised Crime Act (Act 121 of 1998) [POCA] - Introduced the crime of ML and sets the penalties associated with a conviction. The Protection of Constitutional Democracy Against Terrorist and Related Activities Act (Act 33 of 2004) [POCDATARA] - Introduced measures to address the financing of acts of terrorism. Client identification and verification (RBA) [s21] Record keeping [s22] Reporting [s28, 28A, S29] STRs, CTRs, TPRs Risk Management Compliance Program (RBA) [s42] Competent person to ensure effective compliance [s42A] Ongoing training of employees [s43] Registration with FIC AI; RI - [s43B]

Click to edit Master title style Slide 6 of 32 Commercial Crime Crime Against the State International Cooperation Organised Crime Monitors and gives guidance to accountable and reporting institutions. Receives, Processes and Analyses transactional data to develop financial intelligence products Exchanges information with similar bodies in other countries. This is made available to stakeholders to facilitate the administration and enforcement of laws. The FIC and why crime concerns it

Click to edit Master title style Slide 7 of 32 AIs, RIs and business need to comply with FICA Compliance is monitored and enforced by FIC and Supervisory Bodies Data base of FIC receiving reports / information (STRs & CTRs) Monitor & Analyse reports received Enrich the reports / information with other information to create informed report Refer relevant intelligence to LEA / SARS / SSA or receive requests from LEA / SARS / SSA Criminal investigation (Law Enforcement) Support Law Enforcement by analysing evidence (reconstruction of financial side of the investigation) STR, TPR, CTR TPR CTR STR Value chain and the FIC’s involvement

Click to edit Master title style Slide 8 of 32 ▪ National Intelligence Coordinating Committee (NICOC) ▪ State Security Agency (SSA) ▪ Defence Intelligence ▪ Foreign FIUs (Egmont Group) ▪ DIRCO ▪ South African Revenue Services (SARS) ▪ Special Investigating Unit (SIU) ▪ Public Protector (PP) ▪ Supervisory Bodies (SARB, FSB) ▪ National Treasury ▪ Commissions of Inquiry ▪ JCPS Cluster ▪ SA Police Service ▪ General Detectives ▪ Directorate Priority Crime Investigation (DPCI) ▪ Crime Intelligence ▪ National Prosecuting Authority (NPA) ▪ National Prosecuting Services (NPS) ▪ Asset Forfeiture Unit (AFU) ▪ Independent Police Investigative Directorate (IPID) ▪ An investigative division in an organ of state ▪ An investigating authority ▪ Department of Environmental Affairs ▪ Department of Correctional Services (DCS) Stakeholders ▪ Accountable Institutions (AIs) and ▪ Reporting Institutions (RIs) ▪ Government Departments (CIPC, DHA, NT, SARB) ▪ Data Providers (Experian, Compuscan) ▪ SABRIC/SAFPS/SAICB Crime National Security Admin Actions Data/Info Section 40: FIC makes information reported to it, and information obtained in terms of its mandate, available to specified stakeholders Provide intelligence upon REQUEST or at the INITIATIVE of the FIC

Click to edit Master title style Slide 9 of 32 Public Protector SARS Intelligence Services Supervisory Bodies NPA LEAs IPID Defence Intelligence Investigative Division in an Organ of State SIU FIUs Construct a narrative on the type and extent of illegal activities involved through the approach of “following the money” Life cycle of a statutory report

Click to edit Master title style Slide 10 of 32 4,884,417 1 330,639 5,215,057 Section 28 CTRs Section 29 STRs/SARs Sec 28A TPRs 93.65990% 0.00002% 6.34008% Statistical overview – reporting: all scheduled entities FY2017/18

Click to edit Master title style Slide 11 of 32 Attorneys Estate Agents Investment advisors or intermediaries Motor Vehicle Dealers Gambling Banks 32,65% 25.10% 20.97% 9.34% 7.67% 0,10% Rest 4.16% 84,32% 6,79% 8,90% Scheduled reporting entities vs statutory reporting 40 000 entities 5.2 million reports

Click to edit Master title style Slide 12 of 32 The aim is to provide data on statutory reporting as submitted to the FIC. This feedback covers six (6) financial year quarters over two financial years, commencing with Q2-2016 and ending with Q3-2017. [1/4/2016 – 31/12/2017] The Investment Advisor or Intermediaries in numbers • A total of R9 trillion was reported as assets under the management of categories II, IIA and III FSPs as at 30 June 2016. • As of 31 March 2017 a total of 10 669 FSPs were registered with the FSB. • The Financial Intelligence Centre (FIC) has 8 965 (Q3-2017) Financial Advisory and Intermediary Services registered on its system Investment Advisor or Intermediaries

Click to edit Master title style Slide 13 of 32 • [1/4/2016 – 31/12/2017] • A total of 456 entities reported to the FIC for the time period. • A total of 24 081 reports were submitted for the time period to the FIC. • The Gauteng Province submitted the majority of the reports, 20 297 (84%). • A total of 24 081 reports were submitted representing 142 097 transactions to the value of R9 885 104 943,00 (9,8 billion) Investment Advisor or Intermediaries - reporting Q2-2016 Q3-2016 Q4-2016 Q1-2017 Q2-2017 Q3-2017 66 74 85 72 79 80 Registered Entities Reporting 0.000% 10.000% 20.000% 30.000% 40.000% 50.000% 60.000% 70.000% 80.000% 90.000% 0 5000 10000 15000 20000 25000 UK LP EC Jersey No designation NW NC MP WC KZN GT Volume of Reports Jurisdiction Volume of Reports by the Reporting Entities Reports Precentage

Click to edit Master title style Slide 14 of 32 • [1/4/2016 – 31/12/2017] • The types of reports submitted indicated that Cash Threshold Reports (CTRs), Cash Threshold Aggregate Reports (CTRA) and Suspicious Transaction Reports (STRs) were the largest volume of reports submitted to the FIC • A total of 19 336 CTRs were reported, representing 32 180 transactions to the value of R6 184 010 150,00. • A total of 3 079 CTRAs were reported representing 108 318 transactions to the value of R2 193 727 302,00 • A total of 1 308 STRs were reported representing 1 558 transactions to the value of R1 421 834 854,00. Investment Advisor or Intermediaries - reporting 3 10 19336 3079 312 1338 0 3 0 AIF_Reports AIFT_Reports CTR_Reports CTRA_Reports SAR_Reports STR_Reports STRB_Reports TFAR_Reports TFTR_Reports Types of Reports Submitted

Click to edit Master title style Slide 15 of 32 Scheduled reporting entities vs actual reporters [1/4/2017-31/3/2018] Attorneys 13 322 32,65% Estate Agents 10 242 25.10% Investment advisors or intermediaries 8 556 20.97% Motor Vehicle Dealers 3 809 9.34% 38,38% 1 462 Gambling 17,38% 558 3 130 7.67% 3,68% 490 1,10% 113 1,55% 133

Click to edit Master title style Slide 16 of 32 Reporting by investment advisors or intermediaries SAR STR STRB TFAR TFTR 371 793 0 CTR 26 462 0,53% of all reports Investment advisors or intermediaries 8 556 20.97% 1,55% 133

Click to edit Master title style Slide 17 of 32 Provide clear and concise information. • Who? – the subject, its associates and relationships • What? – the transaction or activity • When? – date of detection, date of occurrence, span of time • Where? – location of the client and where the transaction occurred • How? – describe how the activity/transaction was completed or attempted • Why? – results of your investigation into why the activity/transaction is reported/suspicious What makes a good STR/SAR?

Click to edit Master title style Slide 18 of 32 Tracing of bank accounts (26 banks) Long-term insurance portfolios (15 entities) Gambling information (6 groups) Money remitters (4 groups) MasterCard Visa Suspicious Transaction Reports (STRs) (Sec 29) Cash Threshold Reports (CTRs) (Sec 28) >R25k Terror Property Reports (TPRs) (Sec 28A) Reports from Supervisory Bodies (Sec 36) Freezing of bank accounts (Sec 34) Monitoring of bank accounts (Sec 35) Requests - Egmont for financial info with other FIUs globally (Sec 40) Cross-border monetary flows - Reserve Bank Cross-border Movement System – Home Affairs (MCS) Deeds info – registration of fixed property Vehicle registrations

• eNatis Directorships and company registration
• CIPC Paid subscription services Open source / desktop analysis Analysing of bank statements / Big Data Link analysis Financial Information (sec 27) Powers to support investigations International Information Assets Other relevant information Reports received FIC’s contribution to investigations

Click to edit Master title style Slide 19 of 32 How does the FIC produce financial intelligence reports? Accountable and reporting institutions are legally required to submit reports to the FIC on suspicious and unusual transactions; transactions over a certain cash threshold; and transactions related to property owned or controlled by or on behalf of a terrorist. These reports may include sensitive information about financial transactions, amounts involved, bank account details and account balances, for example. The FIC is the gatekeeper of this information, which is treated as private and confidential, and is only shared in terms of the FIC’s mandate and within legislative parameters . The FIC analyses the information and produces financial intelligence products. The information referred for investigation does not contain the actual suspicious or unusual transaction reports made to the FIC. The referral contains descriptions of the transactions and analysis of their potential links to unlawful activity. The financial intelligence report is handed over to the relevant authorities for further action and/or investigation if necessary.

Click to edit Master title style Slide 20 of 32 Case study 1) Organised Crime syndicate • The FIC supported a law enforcement investigation between 2014 and 2017 that resulted in the successful pursuit and arrest of a large syndicate on charges relating to murder, attempted murder, kidnapping, VAT fraud, and cloning of stolen motor vehicles. The South African Revenue Service and the Asset Forfeiture Unit confiscated about R486 million from the syndicate. • During this investigation the FIC analysed reports and financial transactions that led to the identification of another large foreign syndicate that was hydroponically cultivating cannabis. The syndicate was operating both domestically and internationally. • The FIC’s analysis during 2017/2018 of financial data assisted to identify: • Individuals running hydroponic operations in the North West, Gauteng and the Free State. Four of these illicit operations were successfully disrupted and the subjects arrested. Equipment valued at about R5 million was seized. • Properties purchased with the suspected proceeds of crime in the KwaZulu-Natal South Coast region. This information helped uncover eight hydroponic cannabis laboratories in KwaZulu-Natal. • Four foreign nationals and three South Africans were arrested. The authorities made additional arrests in Gauteng and confiscated equipment, vehicles and cannabis products to the value of about R26 million.

Click to edit Master title style Slide 21 of 32 2) Theft and money laundering • The FIC received a request regarding a subject who allegedly stole about R460 million from her employer over a period of eight years. She reportedly duplicated payments to legitimate clients and service providers‚ paying money directly into her deceased husband’s bank account. • Through financial profiling, the FIC established that funds were going into a relative's bank account and then used to buy luxury vehicles and several properties. The money was also used to fund gambling activities and family holidays, and donations to family members. • The FIC’s analysis of the husband’s bank statements revealed funds paid to an insurance company in large monthly instalments and, at times, frequent payments during the month too. It was established that the premiums were paid with the stolen proceeds of crime. • The FIC issued a directive in terms of section 34 of the FIC Act to prevent the subject from accessing these investment products which represented the proceeds of crime, to the value of about R21 million. The subject was subsequently arrested and the Asset Forfeiture Unit proceeded to attach or preserve several assets worth millions under the Prevention of Organised Crime Act.

Click to edit Master title style Slide 22 of 32 3) Cracking a cryptocurrency - Ponzi scheme • The FIC identified what appeared to be an alleged Ponzi scheme run by an individual marketing a “new cryptocurrency”. This product was marketed as Africa’s first cryptocurrency and investors were promised huge returns on their investments. • The FIC’s analysis of the individual’s bank statements revealed that there was no cryptocurrency and that this was indeed a Ponzi scheme. • A restraining order was issued for more than R2.8 million in proceeds from the alleged scheme, and the FIC assisted the Asset Forfeiture Unit in obtaining a preservation order relating to fixed property and vehicles worth more than R4 million that was bought using the proceeds of the scheme.

Click to edit Master title style Slide 23 of 32 4) Case study: Following the money to find rhino poachers • An investigative documentary exposed people and criminal networks believed to be involved in the illegal rhino horn trade. • This led to the FIC’s involvement in assisting the Hawks in its investigations. • The FIC provided financial intelligence on foreign nationals involved in the syndicate. • The FIC was able to identify the methods being used to launder the proceeds of rhino horn trade, which included the use of cash deposits, international fund transfers and electronic transfers, often through the accounts of third parties. • The syndicate also used the money to buy cars and immediately changed the ownership.

Click to edit Master title style Slide 24 of 32 5) Drug Manufacturing and depositing the proceeds (smurfing) • The FIC assisted in a drug manufacturing matter in which the main subject was arrested on several historic cases. The subject’s wife started assisting the subject by opening a bank account for the purpose of depositing the proceeds of crime and also receiving the proceeds of crime from persons to whom the drugs were distributed. • The FIC identified numerous CTRs on accounts linked to the spouse of the subject and closer analyses of accounts obtained revealed that the transactions were styled as business related transactions, but it became evident that these transactions were clearly styled as such in order to avoid detection (“smurfing”). • The total amount of cash deposits made into the account amounted to close to R1m. The FIC was able to support the Asset Forfeiture Unit (AFU) in a successful Preservation order in terms of the Prevention of Organised Crime Act (POCA) with which an amount of R 364,424.68 was seized as the proceeds of crime in the reported account.

Click to edit Master title style Slide 25 of 32 6) Ponzi scheme uncovered • Through its analysis of reports received, the FIC identified two business accounts with activities indicative of a Ponzi scheme. • Both investment companies promised a 100% return on investment within one to five days. • The FIC’s analysis revealed: • Similar transacting patterns involving cash and electronic funds transfers on both accounts. • A funds transfer between the two entities, linking them to each other. • The transacting pattern in both accounts reflected an almost equal amount of deposits followed by withdrawals. • Both entities were not registered with the Financial Services Conducting Authority. • Both directors were under the age of 30 and no movable or immovable assets could be linked to either director. • The addresses of the entities were the same as the addresses of the directors, in a residential area. • Working with the Reserve Bank, the SAPS and the then Financial Services Board, the FIC shared its transactional analysis for judicial action to recover the proceeds of the scheme. A Ponzi scheme is a fraudulent investment scheme, which offers investors unusually high returns, but the pay-outs do not come from actual profits – the victim’s own money, or money paid by subsequent investors, is used.

Click to edit Master title style Slide 26 of 32 Detection Indicators

1. High end vehicle purchases that are seemingly not in line with the expected income of the customer.
2. Concealment/misuse within Business structures
3. Illogical business activity - why do multiple transfers at a higher charge
4. Multiple transactions in a short time period with no underlying business rationale
5. Use of False Identities and documents / Missing documentation normally to be expected from a legitimate business
6. Purchasing of property in family members’ names.
7. Purchasing of valuable commodities / extreme luxury goods, normally associated with extremely wealthy persons (Brand Name Boutique Clothing, expensive watches and expensive electronic goods etc.)
8. Gambling activities - significant year on year increase in turnover / not in line with the expected income of the customer.
9. Declared Source of Income not aligning to activity of the customer /exceeds the expected deposits for the customer.

Slide 27 of 32 Statistical overview

Click to edit Master title style Slide 28 of 32 Reactive Financial Intelligence Reports produced on request by Law Enforcement Agencies and other FIU (2014-2018) 1799 1979 2145 2243 0 500 1000 1500 2000 2500 FY 2014/2015 FY 2015/2016 FY 2016/2017 FY 2017/2018 Number of requests 870 511 1322 1470 0 500 1000 1500 2000 FY 2014/2015 FY 2015/2016 FY 2016/2017 FY 2017/2018 Number of Referrals Proactive Financial Intelligence Reports produced to Domestic Law Enforcement Agencies and other FIUs (2014-2018)

0 100 200 300 400 500 600 700 800 900 ILLEGAL GAMBLING KIDNAPPING CYBER CRIMES RACKETEERING CRIMES AGAINST THE STATE EXCHANGE CONTROL… ARMS AND AMMUNITION ILLICIT CIGARETTES CONTRAVENTION OF… HIJACKING MURDER DUE DILLIGENCE NON FERROUS METALS HUMAN TRAFFICKING PRECIOUS METALS AND… ROBBERY THEFT TERRORISM OTHER ENVIRONMENTAL CRIMES MONEY LAUNDERING CORRUPTION TAX RELATED NARCOTICS FRAUD Crime types analysed 2013 to 2017 2017/18 2016/17 2015/16 2014/15 2013/14 Our priority focus areas: • Fraud • Narcotics • Tax related • Corruption • Money Laundering • Investment scams

Click to edit Master title style Slide 30 of 32 181.0 184.6 149.3 55.1 2296.7 477.6 443.9 3027.9 0.0 500.0 1000.0 1500.0 2000.0 2500.0 3000.0 3500.0 FY 2014/2015 FY 2015/2016 FY 2016/2017 FY 2017/2018 Millions in Rands Section 34 freezing of accounts Proceeds of crime recovered using FinInt Suspected proceeds of crime frozen 2014-2018

Click to edit Master title style Slide 31 of 32 • The Investment Advisor or Intermediaries, as with any financial sector, is vulnerable to abuse/misuse in terms of money laundering and terrorist financing. • The large volumes of assets within the Investment Advisor or Intermediaries industry makes it a critical cornerstone of the South African economy and should be protected from any instability. • South Africa is experiencing a dramatic shift in the way investigations are conducted using a multi-disciplinary approach involving different agencies and institutions. • It is believed that financial intelligence is at the heart of every serious crime investigation in the country, and plays a central role in the successful apprehension and conviction of serious criminals. • Detection and pursuit of criminal money flows are challenging for law enforcement. • As FIC South Africa, we remain committed to engage with all stakeholders to ensure the collective effort in addressing the scourge of financial crimes. Observations and Way Forward

QUESTIONS