NIGERIAN FINANCIAL INTELLIGENCE NFIU INTEGRITY & DILIGENCE NIGERIAN FINANCIAL INTELLIGENCE UNIT

GUIDANCE NOTE

NFIU/EXT/PUB/GDNTE/AC-COMP/FI-DNFI/2-MAY-2023/VOL.01/001

Guidance to Reporting Institutions on Preparing a Complete Suspicious Transaction / Activity Report and Filing Electronically to the Nigerian Financial Intelligence Unit (NFIU)

Pursuant to Section 7 of the Money Laundering (Prevention and Prohibition) Act 2022, Section 84 of the Terrorism (Prevention and Prohibition) Act 2022, and Section 3(q) of the Nigerian Financial Intelligence Unit Act 2018, the Nigerian Financial Intelligence Unit (NFIU), in fulfilment of its obligations, publishes this guidance to improve the quality of Suspicious Transactions Reports rendered by Reporting Entities

---

Contents

Introduction 3

Collection of Information for the STR/SAR Narrative 4

WHO is conducting a suspicious transaction or activity? 5

WHAT instruments or mechanisms are being used to facilitate the “suspicious" transactions(s)/Activity?. 5

WHEN did the suspicious activity take place? 6

WHERE did the suspicious transaction/activity take place?. 6

WHY does the Reporting Entity think the transaction/activity is suspicious?. 7

HOW did the suspicious transaction or activity occur?. 8

Conducting Internal Investigation and Organizing Information In The STR Narrative 9

Filing The Suspicious Transaction or Activity Report to The NFIU 14

Tipping Off 15

Protection of Staff. 16

Feedback 16

Penalty For Non-Compliance With This Guideline 16

---

NFIU

Introduction

The purpose of the Suspicious Transaction Report/Suspicious Activity Report (STR/SAR) is to report any known or suspected violations of the law or suspicious activity observed by Financial Institutions and Designated Non-Financial Businesses and Professionals. Das Ziel des Berichts über verdächtige Transaktionen/verdächtige Aktivitäten (STR/SAR) ist die Meldung aller bekannten oder vermuteten Gesetzesverstöße oder verdächtigen Aktivitäten, die von Finanzinstituten und bestimmten Nicht-Finanzunternehmen und Berufen beobachtet werden. This report should be subject to the provisions of the Money Laundering (Prevention and Prohibition) Act, 2022, the Terrorism (Prevention and Prohibition) Act, 2022, as well as the various AML/CFT Regulations and other relevant circulars and guidelines issued by regulators and international organization (FATF and UN resolutions) on AML/CFT/CPF. Dieser Bericht sollte den Bestimmungen des Gesetzes zur Verhinderung und Bekämpfung der Geldwäsche von 2022, des Gesetzes zur Verhinderung und Bekämpfung des Terrorismus von 2022 sowie den verschiedenen AML/CFT-Bestimmungen und anderen relevanten Rundschreiben und Richtlinien unterliegen, die von Aufsichtsbehörden und internationalen Organisationen (FATF und UN-Resolutionen) zu AML/CFT/CPF erlassen wurden.

Financial institutions (FIs)1, and Designated Non-Financial Businesses and Professions (DNFBPs), also known as Reporting Entities (REs), are required to file STRS/SARS promptly (within 24 hours from when the STR/SAR occurred). Finanzinstitute (FIs)1 und bestimmte Nicht-Finanzunternehmen und -berufe (DNFBPs), auch bekannt als meldende Einrichtungen (REs), sind verpflichtet, STRS/SARS unverzüglich (innerhalb von 24 Stunden nach dem Auftreten des STR/SAR) einzureichen. STRS/SARs are primarily filed on the goAML platform. STRS/SARs werden hauptsächlich über die goAML-Plattform eingereicht. In many instances, analysis of STRS/SARs has been instrumental in investigations of money laundering, terrorist financing, and other predicate crimes. In vielen Fällen war die Analyse von STRS/SARs maßgeblich an den Ermittlungen zu Geldwäsche, Terrorismusfinanzierung und anderen Vortaten beteiligt. Information provided in STRs/SARs also assists the Nigerian Financial Intelligence Unit (NFIU) in identifying emerging trends and patterns associated with financial crimes thereby providing vital intelligence to law enforcement agencies and valuable feedback to Reporting Entities. Die in STRs/SARs bereitgestellten Informationen unterstützen auch die nigerianische Financial Intelligence Unit (NFIU) bei der Identifizierung neuer Trends und Muster im Zusammenhang mit Finanzkriminalität und liefern so wichtige Informationen für Strafverfolgungsbehörden und wertvolles Feedback für meldende Einrichtungen.

The NFIU has observed inconsistencies in the narratives of STRs/SARs filed by reporting entities on the goAML platform, impacting the usefulness and timeliness of the analysis conducted and intelligence disseminated to competent authorities. Die NFIU hat Unstimmigkeiten in den Erzählungen von STRs/SARs festgestellt, die von meldenden Stellen auf der goAML-Plattform eingereicht wurden, was sich auf die Nützlichkeit und Aktualität der durchgeführten Analyse und der an die zuständigen Behörden weitergegebenen Informationen auswirkt. These include STRs/SARs with incomplete, inaccurate, and disorganized narratives and in some instances no narrative provided. Dazu gehören STRs/SARs mit unvollständigen, ungenauen und unorganisierten Erzählungen und in einigen Fällen ohne Erzählung. The failure of reporting institutions to adequately describe the factors making a transaction or activity suspicious undermines the very purpose of the STRs and lessens their usefulness to law enforcement. Das Versäumnis der meldenden Stellen, die Faktoren, die eine Transaktion oder Aktivität verdächtig machen, angemessen zu beschreiben, untergräbt den eigentlichen Zweck der STRs und verringert ihren Nutzen für die Strafverfolgung. The STR/SAR narrative serves as the only free text section of the reporting platform for summarizing any suspicious activity, and therefore, it is essential that reporting institutions/compliance officers provide narratives that are clear, concise, and coherent. Die STR/SAR-Erzählung dient als einziger Freitextbereich der Meldeplattform zur Zusammenfassung verdächtiger Aktivitäten, und daher ist es wichtig, dass meldende Stellen/Compliance-Beauftragte Erzählungen liefern, die klar, prägnant und kohärent sind.

Late filing, absence of supplementary STR information, or inaccuracies in STRs also impact negatively on law enforcement's ability to determine whether a crime has been committed, and the magnitude of criminal activity being committed. Eine verspätete Einreichung, das Fehlen zusätzlicher STR-Informationen oder Ungenauigkeiten in STRs wirken sich auch negativ auf die Fähigkeit der Strafverfolgungsbehörden aus, festzustellen, ob ein Verbrechen begangen wurde, und auf das Ausmaß der begangenen kriminellen Aktivität. Therefore, it is imperative that reporting institutions file complete STRs/SARs promptly. Daher ist es unerlässlich, dass meldende Stellen vollständige STRs/SARs unverzüglich einreichen.

1 Section 30 of the Money Laundering (Prevention and Prohibition) Act 2022 extends the definition of financial institutions to include Virtual Assets Service Providers (VASPs). 1 Abschnitt 30 des Gesetzes zur Verhinderung und Bekämpfung der Geldwäsche von 2022 erweitert die Definition von Finanzinstituten auf Virtual Assets Service Providers (VASPs). Therefore, all references to Financial Institutions in this guidance applies to VASPs. Daher gelten alle Verweise auf Finanzinstitute in dieser Anleitung auch für VASPs.

GUIDANCE NOTE 3 Page

---

NFIU Section 7 of the MLPPA 2022 and Section 84 of the TPPA mandate Reporting Entities to file STRS/SARs. Abschnitt 7 des MLPPA 2022 und Abschnitt 84 des TPPA verpflichten meldende Stellen zur Einreichung von STRS/SARs. Though Reporting Entities perform a variety of transactions, the basic structure for an STR/SAR narrative remains the same for all sectors. Obwohl meldende Stellen eine Vielzahl von Transaktionen durchführen, bleibt die grundlegende Struktur für eine STR/SAR-Erzählung für alle Sektoren gleich. Therefore, the purpose of this Guidance is to sensitize RE on filing STRs/SARs and on how to organize and write constructive narratives that maximize the value of each STR/SAR through: Daher besteht der Zweck dieser Richtlinie darin, RE für die Einreichung von STRs/SARs zu sensibilisieren und zu zeigen, wie konstruktive Erzählungen organisiert und geschrieben werden können, die den Wert jeder STR/SAR maximieren durch:

• the uses of a simple methodology for evaluating and reporting information for the STR narrative and why it is important, and - die Verwendung einer einfachen Methodik zur Bewertung und Meldung von Informationen für die STR-Erzählung und warum dies wichtig ist, und

• organizing the STR narrative systematically so that critical information is concise and follows a logical order of presentation. - die systematische Organisation der STR-Erzählung, so dass kritische Informationen prägnant sind und einer logischen Reihenfolge der Präsentation folgen.

Information presented in this guidance document should be used in conjunction with other user guides such as guides for Reporting Entities on Electronic Reporting as well as Lookup tables, regulations, circulars and guidance issued by respective regulators. Die in diesem Leitfadendokument enthaltenen Informationen sollten in Verbindung mit anderen Benutzerhandbüchern wie Leitfäden für meldende Stellen zur elektronischen Meldung sowie Nachschlagetabellen, Vorschriften, Rundschreiben und Leitlinien verwendet werden, die von den jeweiligen Aufsichtsbehörden herausgegeben werden.

This information on how to prepare a complete and sufficient Suspicious Transaction/Activity Report Narrative is provided solely to assist respective FIs, and DNFBPs in strengthening existing due diligence initiatives on AML/CFT/CPF. Diese Informationen zur Erstellung einer vollständigen und ausreichenden Verdachtsbericht-/Tätigkeitsberichtserzählung dienen ausschließlich dazu, die jeweiligen FIs und DNFBPs bei der Stärkung bestehender Due-Diligence-Initiativen zu AML/CFT/CPF zu unterstützen.

Collection of Information for the STR/SAR Narrative

The information generated from STR filings plays a vital role in identifying potential illegal activities such as money laundering, terrorist financing, proliferation financing and other financial crimes, and assists law enforcement agencies in detecting and preventing the flow of illicit funds through the financial and non- financial systems. Die aus STR-Meldungen generierten Informationen spielen eine wichtige Rolle bei der Identifizierung potenzieller illegaler Aktivitäten wie Geldwäsche, Terrorismusfinanzierung, Proliferationsfinanzierung und anderer Finanzverbrechen und unterstützen Strafverfolgungsbehörden bei der Aufdeckung und Verhinderung des Flusses illegaler Gelder durch die Finanz- und Nicht-Finanzsysteme. It is critical that the information provided in STR/SAR filing be as accurate and complete as possible. Es ist von entscheidender Bedeutung, dass die in der STR/SAR-Anmeldung bereitgestellten Informationen so genau und vollständig wie möglich sind. The STR/SAR should include any information available to the filing institution obtained through the account opening process and during due diligence efforts such as transaction monitoring or customer record update. Die STR/SAR sollte alle Informationen enthalten, die der meldenden Stelle zur Verfügung stehen und die sie durch den Kontoeröffnungsprozess und durch Due-Diligence-Bemühungen wie Transaktionsüberwachung oder Kundenstammdatensatzaktualisierung erhalten hat.

A good STR/SAR narrative should identify the five essential elements of information Who? Eine gute STR/SAR-Erzählung sollte die fünf wesentlichen Informationselemente identifizieren: Wer? What? Was? When? Wann? Where? Wo? and Why? und Warum? of the suspicious transaction or activity that is being reported. der verdächtigen Transaktion oder Aktivität, über die berichtet wird. The narrative should also include how the transaction or activities was carried out (the method of operation), as this provides vital additional information to the STR/SAR. Die Erzählung sollte auch beinhalten, wie die Transaktion oder Aktivität durchgeführt wurde (die Methode der Durchführung), da dies wichtige zusätzliche Informationen für die STR/SAR liefert. This guidance will assist FIs and DNFPBs in providing information that addresses each of the elements to improve the quality of the STR/SAR filed. Diese Anleitung unterstützt FIs und DNFPBs bei der Bereitstellung von Informationen, die jedes der Elemente ansprechen, um die Qualität der eingereichten STR/SAR zu verbessern.

GUIDANCE NOTE 4 Page

---

NFIU

WHO is conducting a suspicious transaction or activity?

The goAML STR template calls for specific "suspect” information details, however, the narrative field should be used to further describe the suspect(s), including occupation, title or rank within the business, and the nature of the suspect's business(es). Die goAML-STR-Vorlage erfordert spezifische "Verdächtigen"-Informationen, aber das Erzählfeld sollte verwendet werden, um den/die Verdächtigen weiter zu beschreiben, einschließlich Beruf, Titel oder Rang innerhalb des Unternehmens und Art des/der Unternehmen des/der Verdächtigen. If more than one individual or business is involved in the suspicious transaction or activity, all suspects and any known relationships among them must be included in the Narrative Section. Wenn mehr als eine Einzelperson oder ein Unternehmen an der verdächtigen Transaktion oder Aktivität beteiligt ist, müssen alle Verdächtigen und alle bekannten Beziehungen zwischen ihnen im Narrative-Abschnitt aufgeführt werden. While detailed “suspect” information may not always be available (e.g., in situations involving non-account holders or a third party), reporting entities should include as much information to the maximum extent possible, such as Biometric Verification Number (BVN). Obwohl detaillierte "Verdächtigen"-Informationen möglicherweise nicht immer verfügbar sind (z. B. in Situationen, in denen Nicht-Kontoinhaber oder ein Dritter beteiligt sind), sollten meldende Stellen so viele Informationen wie möglich angeben, z. B. die biometrische Verifikationsnummer (BVN). Addresses of suspects are necessary, and reporting institutions should note not only the suspect's primary street addresses but also other known address fields, including house, plot or flat or apartment numbers when applicable. Die Adressen von Verdächtigen sind erforderlich, und meldende Stellen sollten nicht nur die primären Straßenadressen des Verdächtigen, sondern auch andere bekannte Adressfelder angeben, einschließlich Haus-, Grundstücks- oder Wohnungsnummern, falls zutreffend. Any form of identification numbers associated with the suspect(s) other than those provided earlier is also beneficial, such as staff identity, visa type and number, expatriate registration, driver's license numbers, international passport number, voters card, National Identity Number, e-mail addresses, telephone numbers, etc. Jede Form von Identifikationsnummern, die mit dem/den Verdächtigen verbunden sind, außer den zuvor angegebenen, ist ebenfalls von Vorteil, wie z. B. Mitarbeiterausweis, Visumtyp und -nummer, Expatriierungsregistrierung, Führerscheinnummern, internationale Reisepassnummer, Wählerkarte, nationale Identitätsnummer, E-Mail-Adressen, Telefonnummern usw.

Examples Mr XYZ has a savings account opened at the ABC branch on April, 20xx, with Bank Verification Number, 222xxxxxxx, phone number +234xxxxxxxx, and address at Block 1, Flat C, Mr. P's Compound, Road7 Extension, Fed Housing, DEF State. ABC Limited with account number xxx started a business relationship with yyy Bank Plc on June 19xx. The Company and proprietor's details are hereby given: Account Name/Number: ABC limited /xxx Name of Signatory: Mrs QRS Address: 14 E Street Secretariat Road PP State Date of birth: 5th June, 19xx BVN: 22xxxxxxxxx ID type/Number: International Passport/Axxxxxxxx Issue/Expiry date: Mobile Number: +2348xxxxxxx

WHAT instruments or mechanisms are being used to facilitate the "suspicious” transaction(s)/Activity?

An illustrative list of instruments or mechanisms that may be used in suspicious transactions or activity includes the following; cash transactions, wire transfers, GUIDANCE NOTE 5 Page

---

NFIU letters of credit, certificate of capital importation and other trade or financial instruments, correspondent accounts, shell companies, bonds/notes, stocks, mutual funds, insurance policies, claims or annuity, checks, bank drafts, money orders, credit/debit cards, stored value cards, property documents, precious metals and stones, digital currency/asset, and business services.

Several methods may be employed for initiating the negotiation of funds or buying of shares or negotiation of insurance policies such as online, phone, e-mail, agents and couriers.

Examples During our review of the subject account opened on November 04 2021, we observed that on August 20xx, the account witnessed a huge cash withdrawal in the sum of $875,000.00 by Mr, Further review shows that the account has a repetitive pattern of receiving inflows followed by huge cash withdrawals.

WHEN did the suspicious activity take place?

If the transaction or activity takes place over a period, reporting entities should indicate the date(s) the suspicious transaction(s)/activity(ies) were first noticed and describe the duration of the activity. Wenn die Transaktion oder Aktivität über einen bestimmten Zeitraum stattfindet, sollten die meldenden Stellen das Datum/die Daten angeben, an dem/denen die verdächtige(n) Transaktion(en)/Aktivität(en) zuerst bemerkt wurde(n), und die Dauer der Aktivität beschreiben. Reporting entities often provide a tabular presentation of suspicious account activities (transactions in and out). Meldende Stellen stellen häufig eine tabellarische Darstellung verdächtiger Kontoaktivitäten (Transaktionen ein und aus) zur Verfügung. While this information is useful and retained, do not insert objects, tables, or pre-formatted spreadsheets when filing an STR. Obwohl diese Informationen nützlich sind und aufbewahrt werden, fügen Sie keine Objekte, Tabellen oder vorformatierten Tabellenkalkulationen ein, wenn Sie einen STR einreichen. These can be attached to the STR template under ‘Attachment'. Diese können der STR-Vorlage unter „Anhang“ beigefügt werden. These items may not convert accurately when keyed in or merged into the STR System. Diese Elemente werden möglicherweise nicht genau konvertiert, wenn sie in das STR-System eingegeben oder mit diesem zusammengeführt werden. Furthermore, specific dates and amounts of transactions should be included in the narrative rather than just the aggregated amount(s). Darüber hinaus sollten bestimmte Daten und Beträge von Transaktionen in der Erzählung und nicht nur der aggregierte Betrag angegeben werden.

Example Structured inflows from ABC LTD on 20/08/20xx are the major reason for suspicion. The customer received inflows from XYZ LTD in tranches of NGNaamillion, NGNbbmillion and NGNccmillion the same day. The inflow of NGNdd million from DEF on March 14, 20xx, also deviated from his usual transaction threshold of NGN5 million. This is the highest inflow received in the last one year.

WHERE did the suspicious transaction/activity take place?

The "Narrative" section on the goAML platform should include information on the offices or branches of all FIs and DNFBPs involved in the suspicious transaction/activity and provide the addresses of those locations if known. Der Abschnitt "Narrative" auf der goAML-Plattform sollte Informationen über die Büros oder Zweigstellen aller FIs und DNFBPs enthalten, die an der verdächtigen Transaktion/Aktivität beteiligt sind, und die Adressen dieser Standorte angeben, falls bekannt. The narrative should indicate if the suspected transaction (s) or activity involves foreign jurisdiction. Die Erzählung sollte angeben, ob die vermutete(n) Transaktion(en) oder Aktivität(en) eine ausländische Gerichtsbarkeit betreffen. Details of the foreign jurisdiction, including the FI(s) and/or GUIDANCE NOTE 6|Page

---

NFIU DNFBP(s) involved, address(es), the suspected person(s) or entity(ies) affiliated with the suspected transaction (s) or activity(ies) should be provided.

Example During the investigation and based on the outcome of our Enhanced Due Diligence (EDD), the following observations were made: Mr A resides and operates from jurisdiction A. This is a high-risk jurisdiction as noted in the FATF's list of high-risk jurisdictions. The email maintained on this account (abc@xyz.jurisdiction a) makes it more suspicious.

WHY does the Reporting Entity think the transaction/activity is suspicious?

It is recommended that the reporting entity's sector/industry or nature of business is briefly introduced (e.g. Es wird empfohlen, dass der Sektor/die Branche oder die Art des Geschäfts der meldenden Stelle kurz vorgestellt wird (z. B. Deposit money bank (DMB), Primary mortgage banker, securities dealer/broker, insurance underwriting, bureau de change, real estate, financial/legal advisory services). Einlagensicherungsbank (DMB), primärer Hypothekenbankier, Wertpapierhändler/Broker, Versicherungsgarantie, Devisenbörse, Immobilien-, Finanz-/Rechtsberatungsdienste). The reporting entity should, as detailed as possible, describe why the transaction or activity is unusual for the customer, the existing transaction pattern known to the reporting entity, unusual behaviour and requests, and resistance to providing additional information. Die meldende Stelle sollte so detailliert wie möglich beschreiben, warum die Transaktion oder Aktivität für den Kunden ungewöhnlich ist, das bestehende Transaktionsmuster, das der meldenden Stelle bekannt ist, ungewöhnliches Verhalten und Anfragen sowie Widerstand gegen die Bereitstellung zusätzlicher Informationen. It should also describe the existing patterns for comparison with the transactions/activities that have triggered the STR/SAR filing. Es sollte auch die bestehenden Muster zum Vergleich mit den Transaktionen/Aktivitäten beschreiben, die die STR/SAR-Einreichung ausgelöst haben. The NFIU has provided a list of indicators under the STR template to assist in this regard. Die NFIU hat eine Liste von Indikatoren unter der STR-Vorlage bereitgestellt, um Sie dabei zu unterstützen.

Example of a good narrative The customer received an inflow of NGN5 million on 13th October 20xx. This is the highest inflow received in the last one year. The customer has done a cumulative credit turnover of NGN300m in the last two and half months (from August to date) and this amounts to 41% of the cumulative credit turnover for the last one-year period reviewed. This shows that recent transactions on the account deviates from usual transaction dynamics. 4. The customer features occasionally on our one-to-many transfer to more than ten customer alerts. He made a transfer to 16 personal accounts on June 11, 20xx, amounting to a total of NGN1bn: and to 16 personal accounts on July 6, 20xx, amounting to a total of NGN8bn. Enhanced due diligence report showed that the customer deals in the supply of sea foods. The seafood industry in the landlocked country of jurisdiction A is a major source of sustenance.

Examples of some common patterns of suspicious transactions or activity are: a. A lack of evidence of legitimate business activity, or any business operations at all, undertaken by many of the parties to the transaction (s); GUIDANCE NOTE 7 Page

---

NFIU b. Unusual financial nexuses and transactions occurring among certain business types (e.g., a food importer dealing with an auto parts exporter);

c. Transactions that are not commensurate with the stated business type or that are unusual and unexpected in comparison with the volumes of similar businesses operating in the same locale;

d. Unusually large numbers or volumes of wire transfers or repetitive wire transfer patterns;

e. Unusually complex series of transactions indicative of layering activity involving multiple accounts, banks, parties, jurisdictions;

f. Suspected shell entities;

g. Bulk cash and monetary instrument transactions;

h. Unusual mixed deposits of money orders, third-party checks, and payroll checks, into a business account;

i. Transactions were conducted in bursts of activities within a short period, especially in previously dormant accounts;

j. Transactions or volumes of aggregate activity inconsistent with the expected purpose of the account and expected levels and types of account activity conveyed to the financial institution by the account holder at the time of the account opening;

k. Beneficiaries maintaining accounts at foreign banks in flagged jurisdictions or that have been subjects of previous STR filings;

l. Parties and businesses that do not meet the standards of routinely initiated due diligence and anti-money laundering oversight programs (e.g., unregistered/unlicensed businesses);

m. Transactions seemingly designed to or attempting to avoid reporting and recordkeeping requirements, and correspondent accounts being utilized as “pass- through" points by foreign jurisdictions with subsequent outgoing funds to another foreign jurisdiction. Further indicators of ML/TF are provided on the goAML template to assist reporting institutions.

HOW did the suspicious transaction or activity occur?

Use the Narrative field on the goAML to describe the “modus operandi” or the method of operation of the subject conducting the suspicious Transaction or activity. In a concise, accurate and logical manner, give a breakdown of the steps, actions and 8 Page GUIDANCE NOTE

---

NFIU methods instruments used to create the suspicious transaction or pattern of transactions committed. Provide as detailed as possible a full picture of the suspicious transaction or activity involved. For example, if what appears to be the structuring of deposits is matched with outgoing wire transfers from the accounts, the STR narrative should include information about both the inbound and outbound transfers (including amounts, dates, destinations, accounts, frequency, and beneficiaries of the funds transfers). Common methods used include cash, wire transfers, and structured deposits.

When summarizing the movement of funds, always include the source of the funds (origination) that led to the application for a service or product, or recipient's use of the funds (as beneficiary), or both. In documenting the movement of funds, identify all FI and DNFBP services or products used, such as account numbers at the financial institution affected by the suspicious transaction or activity and where possible, policy number, property details, unit of shares and the names/locations of the other FIs or DNFBPs, including foreign institutions involved in the reported transaction/ activity. It is essential that the location of depositor(s) and the beneficiary(ies) is provided.

Example The customer has been receiving inflows from Mr A, Mrs B and Dr. C through wire transfer, usually followed by immediate or next-day_cash withdrawal. Prior to this time, there were repetitive wire transfers from the above-mentioned senders followed by immediate or next-day cash withdrawals and transfers.

Conducting Internal Investigation and Organizing Information In The STR Narrative

Reporting entities are expected to conduct internal investigations on the suspected transaction/activity and summarize the outcome of the internal in the STR narrative in a concise and chronological format.

The internal investigation report must be conducted as soon as possible to enable reporting entities to capture and report all elements of the five W's and an H (Who? What? When? Where? Why? And How?)

Note that it is only by conducting a thorough internal investigation that reporting institutions can be able to address all the issues previously discussed in Section 1 of this document, as well as the provision of any other information that can assist the NFIU and law enforcement agencies in conducting thorough analysis and investigation respectively.

Reporting entities are expected to present the narrative in three sections or paragraphs: an introduction, a body, and a conclusion.

GUIDANCE NOTE 9 Page

---

NFIU

Introduction:

The introductory paragraph should provide: i. The purpose of the STR and a general description of the known or alleged violation [In some instances, this might warrant mentioning at the outset the type of suspicious transaction or activity being monitored, such as Informal Money Transfer System (IMTS) operations, smurfing, shell entities, complex layering activities, structuring, early policy termination, embezzlement];

ii. The date of any STR(s) filed previously on the suspect or related suspects and the reason why the previous STR(s) was filed;

iii. Whether the STR is associated with any watchlist such as the Office of Foreign Assets Control's (OFAC) sanctioned countries or Specially Designated Nationals and Blocked Persons or other government watchlists for individuals or organizations;

iv. A summary of the “red flags" and suspicious patterns of activity that initiated the STR. (This information can be provided either in the introduction or conclusion of the narrative)

Body:

The next paragraph or paragraphs of the narrative can provide all pertinent information – supporting why the STR was filed and might include:

Any or all relevant facts about the party(ies) (individuals and businesses) that facilitated the suspicious activity or transactions. Include any unusual observations such as suspected shell entities; financial activities which are not commensurate with the expected normal business flows and types of transactions; unusual multiple-party relationships; verbal customer statements; unusual or complex series of transactions indicative of layering; lack of business justification and documentation supporting the activity;

Specific description of the involved accounts and transactions, identifying if known, both the origination and application of funds (usually identified in chronological order by date and amount);

Disaggregating substantial volumes of financial activity into categories of credits and debits and by date and amount;

The sender and beneficiary information; providing as much detail as possible. This should include the name and location of any involved domestic and/or international financial institution(s); names, addresses, account numbers, and any other available identifiers of originator and beneficiary and/or third parties or business entities on whose behalf the conductor was acting; the date(s) of the transaction(s); and amount(s); GUIDANCE NOTE 10 | Page

---

NFIU An explanation of any observed relationships among the transaction parties or persons (e.g., joint accounts or group policy, addresses, employment/ employer, known or suspected business relationships and/or frequency of transactions occurring amongst them; signatory and account name or beneficial owner);

Specific details on transactions that identify the branch(es) or location(s) where the transaction(s)/activity occurred, the type of transaction(s), and how the transaction(s)/activity occurred (e.g., deposit, online banking, ATM, etc.);

Other observations or incriminating statements made by the suspect, especially when filing SARS.

Conclusion:

The final paragraph of the narrative should summarize the report findings and include:

Information about any follow-up actions conducted by the reporting entity (e.g., intent to place the account under ‘POST NO DEBIT or blocking of accounts, termination of Insurance policy, ongoing monitoring of activity);

Contact details of liaison staff at the reporting entity if different from the authorized personal filing the STR.

A general description of any additional information related to the reported transaction or activity that may be made available to law enforcement by the institution; and

Details of other law enforcement agency(ies) already investigating the case, where applicable.

Examples of a good STR narrative

Introduction (provides an overview of the customer and introduces the reason for suspicions. Also answers WHO – details of the primary subject of the STR) Customer A (account no 00000xxx) has a Savings Account opened at branch A on 21/12/20xx, with Bank Verification Number, 222xxxxxxx, phone number +xxxxxxxxxxx, and address at ABC Compound, Fed Housing, City X, AA State. Recent unusual transaction on the account though the customer resides abroad is the major reason for suspicion. During the investigation and based on the outcome of our Enhanced Due Diligence (EDD), the following observations were made: 1. The customer operates from jurisdiction A (as deduced from his phone number). This is a high-risk jurisdiction as jurisdiction A is on the FATF list of high-risk jurisdiction. The email maintained on this account (rustem.yakimov@inbox.ru) 11| Page GUIDANCE NOTE

---

NFIU makes it more suspicious. Body (answers the 5Ws and H. provides a detailed analysis of the transaction that has triggered the STR) Structured inflows from ABC Limited on_20/10/xxxx are the major reason for suspicion. The customer received inflows from ABC Limited in tranches of NGN7 million, NGN4 million and NGN3 million the same day. The inflow of NGN28,028,000 from XYZ limited (another bank account- account no BBB) on 15/10/xxxx, also deviated from his usual transaction threshold of NGN5 million. This is the highest inflow received in the last one year. 3. The customer has done a cumulative credit turnover of NGN228,194,284.90 in the last two and half months (from August to date) and this amounts to 41% of the cumulative credit turnover (NGN 551,108,131) for the last one-year period reviewed. This shows that recent transactions on the account deviates from usual transaction dynamics. 4. The customer features occasionally on our one-to-many transfer to more than ten customer alerts. He made the transfer to 16 personal accounts_on_11/10/xxxx, amounting to a total of NGN1,921,494.53: and to 16 personal accounts on 6/10/xxxx, amounting to a total of NGN8,445,448. Conclusion (additional investigation conducted by the FI) Enhanced due diligence report showed that the customer deals in a supply of sea foods. The seafood industry in the landlocked country of jurisdiction A is a major source of sustenance. Introduction (Provides details of the primary subject of the STR) ABC Nig Limited operates a domiciliary (USD) account with the Bank. The account was opened on 7/06/xxxx, and it is domiciled at AA Branch. The signatory to the account is Mr. B. As stated on the KYC form the customer is into trading. During the investigation and based on information at our disposal, the following were discovered. Body (answers the 5Ws and H. provides a detailed analysis of the transaction that has triggered the STR) A search on Accuity and the public domain returned negative as no adverse news was found against the customer. On 28/10/xxxx, the customer received the sum of $4,582.05 via a fintech application in three tranches of $1,527.35 from Mr M. On October 26, 2022, the customer received the sum of $2,993.06 via the same fintech application in two tranches of $1,496.53 respectively. The customer has been 12 | Page GUIDANCE NOTE

---

NFIU receiving multiple inflows from 15 individuals totaling $xxx, all through another fintech application, and is usually followed by immediate or next-day cash withdrawal. Prior to this time, there were repetitive wire transfers from the above- mentioned senders followed by immediate or next-day cash withdrawals and transfers. The cumulative credits and debits from inception to date are $72,503.49 and $ 67,919.88, respectively. The current balance in the account is $4,583.61. Conclusion