Guidance to Reporting Institutions on Preparing a Complete Suspicious Transaction/Activity Report and Filing Electronically to the NFIU

Guidance to Reporting Institutions on Preparing a Complete Suspicious Transaction / Activity Report and Filing Electronically to Nigerian Financial Intelligence Unit (NFIU). ISSUED DECEMBER, 2014

2 TABLE OF CONTENTS 1.0 Introduction------------------------------------------------------------------------3-4 2.0 Collection of Information for STR narrative----------------------------------5-8 3.0 Conducting Internal Investigation ---------------------------------------------9-11 4.0 Filling the STR/SAR to the NFIU--------------------------------------------11-12 5.0 Feedback-----------------------------------------------------------------------------12 6.0 Penalty for Non-compliance-------------------------------------------------13

3 1.0 INTRODUCTION The purpose of the Suspicious Transaction Report/Suspicious Activity Report (STR/SAR) is to report known or suspected violations of law or suspicious activity observed by financial institutions and Designated Non-Financial Institutions subject to the provisions of the Money Laundering Prohibition Act, 2011 as amended and Prevention of Terrorism Act, 2013 as well as the AML/CFT Regulations and other relevant circulars and guidelines issued by regulators on AML/CFT issues. In many instances, STRs have been instrumental in enabling law enforcement to initiate or support major money laundering or terrorist financing investigations and other criminal investigations. Information provided in STRs assists the Nigerian Financial Intelligence Unit (NFIU) in identifying emerging trends and patterns associated with financial crimes thereby providing vital intelligence to law enforcement agencies and valuable feedback to financial and designated non financial institutions (FI & DNFIs). Financial institutions (FIs) and designated non-financial institutions (DNFIs), also known as reporting entities (REs), are required to file complete and sufficient STRs in a timely manner. However, some reporting institutions file STRs that contain incomplete, inaccurate, and/or disorganized narratives, thus making meaningful analysis difficult, and impossible in some instances whiles others submit STRs with blank narratives. The failure to adequately describe the factors making a transaction or activity suspicious undermines the very purpose of the STRs and lessens its usefulness to law enforcement. Because the STR narrative serves as the only free text area for summarizing suspicious activity, it is essential that reporting institution’s staff write narratives that are clear, concise, and coherent. Late filings, absence of supplementary STR, and/or inaccuracies in STR may impact negatively on law enforcement’s ability to determine whether a crime has been committed or continues to be committed and the extent of any possible criminal activity that has been committed. Therefore, it is imperative that reporting institutions file complete and sufficient STR in a timely manner. Many reporting institutions are now required to file STRs. Despite the fact that these institutions perform different types of transactions, the basic structure for a STR narrative remains the same for all sectors. The purpose of Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative is to

4 educate STR filers on how to organize and write narrative details that maximizes the value of each STR by: • using a simple methodology for evaluating and reporting information for the STR narrative and why it is important; • providing a general guideline on how to organize the STR narrative so that critical details are concise and follow a logical order of presentation; and • providing respective categories of reporting entities with examples of sufficient and insufficient STR narratives. Information presented in this guidance document should be used in conjunction with the Web user Guide and Guide to Reporting Institutions on Electronic reporting as well as Lookup tables, regulations, Circulars and other guidance issued by respective regulators. The information in Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative is provided solely to assist respective financial institutions and designated non-financial institutions in strengthening existing due diligence initiatives and anti-money laundering/financing of terrorism programs. 2.0 COLLECTION OF INFORMATION FOR THE STR NARRATIVE The information generated from STR filings plays an important role in identifying potential illegal activities such as money laundering and terrorist financing, and assists law enforcement in detecting and preventing the flow of illicit funds through our financial and non-financial systems. It is critical that the information provided in STR filing be as accurate and complete as possible. The STR should include any information readily available to the filing institution obtained through the account opening process and during due diligence efforts. In general, an STR narrative should identify the five essential elements of information – Who? What? When? Where? and Why? of the suspicious transaction or activity being reported. The method of operation (or how?) is also important and should be included in the narrative. 2.1 Who is conducting the suspicious activity?

5 While one section of the STR template calls for specific “suspect” information. The narrative should be used to further describe the suspect or suspects, including occupation, position or title within the business, and the nature of the suspect’s business (es). If more than one individual or business is involved in the suspicious transaction or activity, identify all suspects and any known relationships amongst them in the Narrative Section. While detailed “suspect” information may not always be available (e.g., in situations involving non-account holders), such information should be included to the maximum extent possible. Addresses for suspects are important; filing institutions should note not only the suspect’s primary street addresses, but also, other known addresses, including any post office box numbers and apartment numbers when applicable. Any identification numbers associated with the suspect(s) other than those provided earlier are also beneficial, such as passport, alien registration, and driver’s license numbers, email addresses, Telephone numbers etc. 2.2 What instruments or mechanisms are being used to facilitate the “suspicious” transaction(s)? An illustrative list of instruments or mechanisms that may be used in suspicious transaction or activity includes, but is not limited to, wire transfers, letters of credit and other trade or financial instruments, correspondent accounts, casinos, structuring, shell companies, bonds/notes, stocks, mutual funds, insurance policies, travelers checks, bank drafts, money orders, credit/debit cards, stored value cards, and/or digital currency business services. In addition, a number of different methods may be employed for initiating the negotiation of funds such as the Internet, phone access, mail, night deposit box, remote dial-up, couriers, or others. In summarizing the flow of funds, always include the source of the funds (origination) that lead to the application for, or recipient use of, the funds (as beneficiary). In documenting the movement of funds, identify all account numbers at the financial institution affected by the suspicious transaction or activity and when possible, provide any account numbers held at other institutions and the names/locations of the other financial institutions, including money service businesses (MSBs) and foreign institutions involved in the reported transaction/ activity. It is also very essential that the location of depositor(s) and beneficiary (ies) is provided

6 2.3 When did the suspicious activity take place? If the transaction or activity takes place over a period of time, indicate the date when the suspicious activity was first noticed and describe the duration of the activity. Reporting entities will often provide a tabular presentation of the suspicious account activities (transactions in and out). While this information is useful and should be retained, do not insert objects, tables, or pre-formatted spreadsheets when filing a STR but should be attached to the STR template under ‘Attachment’. These items may not convert properly when keyed in or merged into the STR System. Also, in order to better track the flow of funds, individual dates and amounts of transactions should be included in the narrative rather than just the aggregated amount(s). 2.4 Where did the suspicious activity take place? Use the Narrative Section to indicate that multiple offices or branches of a single financial institution or designated non-financial institution were involved in the suspicious activity and provide the addresses of those locations. Specify if the suspected activity or transaction(s) involve a foreign jurisdiction. If so, provide the name of the foreign jurisdiction, financial institution, address and any account numbers involved in, or affiliated with the suspected activity or transaction(s). 2.5 Why does the Reporting Entity think the activity is suspicious? We suggest that you first describe briefly your industry or business – depository institution, casino, mortgage broker, securities broker, insurance, real estate, investment services, and money remitter, check casher, etc. Then describe, as fully as possible, why the activity or transaction is unusual for the customer; consider the types of products and services offered by your industry and the nature and normally expected activities of similar customers. The list of indicators provided by the NFIU under the STR template can assist filers in this regard. 2.5.1 Examples of some common patterns of suspicious transaction or activity are: • A lack of evidence of legitimate business activity, or any business operations at all, undertaken by many of the parties to the transaction(s);

7 • Unusual financial nexuses and transactions occurring among certain business types (e.g., food importer dealing with an auto parts exporter); • Transactions that are not commensurate with the stated business type and/or that are unusual and unexpected in comparison with the volumes of similar businesses operating in the same locale; • Unusually large numbers and/or volumes of wire transfers and/or repetitive wire transfer patterns; • Unusually complex series of transactions indicative of layering activity involving multiple accounts, banks, parties, jurisdictions; • Suspected shell entities; • Bulk cash and monetary instrument transactions; • Unusual mixed deposits of money orders, third party checks, and payroll checks, etc., into a business account; • Transactions being conducted in bursts of activities within a short period of time, especially in previously dormant accounts; • Transactions and/or volumes of aggregate activity inconsistent with the expected purpose of the account and expected levels and types of account activity conveyed to the financial institution by the accountholder at the time of the account opening; • Beneficiaries maintaining accounts at foreign banks that have been subjects of previous STR filings; • Parties and businesses that do not meet the standards of routinely initiated due diligence and anti-money laundering oversight programs (e.g., unregistered/unlicensed businesses); • Transactions seemingly designed to, or attempting to avoid reporting and recordkeeping requirements; and correspondent accounts being utilized as “pass￾through” points by foreign jurisdictions with subsequent outgoing funds to another foreign jurisdiction. Further indicators of ML/TF are provided on the XML template to assist reporting institutions.

8 2.6 How did the suspicious transaction or activity occur? Use the Narrative Section to describe the “modus operandi” or the method of operation of the subject conducting the suspicious transaction or activity. In a concise, accurate and logical manner, describe how the suspect transaction or pattern of transactions was committed. Provide as completely as possible a full picture of the suspicious transaction or activity involved. For example, if what appears to be structuring of currency deposits is matched with outgoing wire transfers from the accounts, the STR narrative should include information about both the inbound and outbound transfers (including dates, destinations, amounts, accounts, frequency, and beneficiaries of the funds transfers). 3.0 CONDUCTING INTERNAL INVESTIGATION AND ORGANIZING INFORMATION IN THE STR NARRATIVE When all applicable information is gathered, analyzed, and documented and the financial or designated non-financial institution decides that a STR is required to be filed to the NFIU, the reporting institution should conduct internal investigation and the outcome of the internal investigation should be described and summarized in the STR Narrative in a concise and chronological format. The internal investigation report must be conducted as soon as possible to enable reporting institutions to capture and report all elements of the five W’s (Who? What? When? Where? and Why?) Note that it is only by conducting a thorough internal investigation that reporting institutions can be able to address all the issues previously discussed in Section 1 of this document, as well as provision of any other information that can assist the NFIU and law enforcement agencies in conducting thorough analysis and investigation respectively. We suggest that you divide the narrative into three sections: an introduction, a body, and a conclusion. Introduction: The introductory paragraph can provide: • The purpose of the STR and a general description of the known or alleged violation [In some instances, this might warrant mentioning at the outset the type of suspicious transaction or activity being observed, such as Informal Value Transfer System (IVTS) operations, smurfing, shell entities, complex layering activities, structuring, check kiting, embezzlement, etc.];

9 • The date of any STR(s) filed previously on the suspect or related suspects and the reason why the previous STR(s) was filed; • Whether the STR is associated with the Office of Foreign Assets Control’s (OFAC) sanctioned countries or Specially Designated Nationals and Blocked Persons or other government lists for individuals or organizations; • A summary of the “red flags” and suspicious patterns of activity that initiated the STR. (This information should be provided either in the introduction or conclusion of the narrative) Body: The next paragraph or paragraphs of the narrative can provide all pertinent information − supporting why the STR was filed and might include: • Any and all relevant facts about the parties (individuals and businesses) who facilitated the suspicious activity or transactions. Include any unusual observations such as suspected shell entities; financial activities which are not commensurate with the expected normal business flows and types of transactions; unusual multiple party relationships; customer verbal statements; unusual and/or complex series of transactions indicative of layering; lack of business justification and documentation supporting the activity; etc.; • A specific description of the involved accounts and transactions, identifying if known, both the origination and application of funds (usually identified in chronological order by date and amount); • breaking out larger volumes of financial activity into categories of credits and debits, and by date and amount; • Sender and beneficiary information, providing as much detail as possible, including the name and location of any involved domestic and/or international financial institution(s); names, addresses, account numbers, and any other available identifiers of originator and beneficiary and/or third parties or business entities on whose behalf the conductor was acting; the date(s) of the transaction(s); and amount(s); • An explanation of any observed relationships among the transactors (e.g., shared accounts, addresses, employment, known or suspected business relationships

10 and/or frequency of transactions occurring amongst them; appearing together at the institution and/or counter); • Specific details on cash transactions that identify the branch(es) where the transaction(s) occurred, the type of transaction(s), and how the transaction(s) occurred (e.g., night deposit, on-line banking, ATM, etc.); and • Any factual observations or incriminating statements made by the suspect. Conclusion: The final paragraph of the narrative can summarize the report and might also include: • Information about any follow-up actions conducted by the financial and designated non-financial institution (e.g., intent to place the account under ‘POST NO DEBIT or Blocking of accounts, ongoing monitoring of activity, etc.); • Names and telephone numbers of other contacts at the financial institution if different from the; point of contact indicated in the STR • A general description of any additional information related to the reported transaction or activity that may be made available to law enforcement by the institution; and • Names of any law enforcement agency already investigating the case. NOTE It is required that the internal investigation and reporting of suspicious transaction should be done immediately a suspicion is noticed in line with the provision of the MLPA, 2011 as amended. Where it is not possible to conclude the internal investigation within the 24 Hour period, the STR should be filed clearly indicating that there is an on-going internal investigation and same will be forwarded to the NFIU when concluded under Action Taken on the STR template. 4.0 FILING THE SUSPICIOUS TRANSACTION OR ACTIVITY REPORT TO NFIU Reporting institutions can file these reports to the NFIU electronically using the following options;

11 WEB Report XML Upload The web report entails filling the STR Form manually while the XML Upload gives an interface where XML reports generated according to the XML schema are uploaded. STRs may also be filed via the WEB Report portal to ease populating the required information on the form. This makes it easier for the reporting institution(s) that do not have third party application to generate reports into XML format. It also gives the flexibility of providing detailed REASON(s) FOR SUSPICION and ACTION TAKEN which may be unique and cannot be general for all STRs. STRs and SARs can also be filed via the NFIU Compliance Help Desk using nfiucompliance@efccnigeria.org in case of any system failure or for institutions that are yet to register on the goAML application. NIL STR/SAR is also expected to be filed via this medium (nfiucompliance@efccnigeria.org) and not via the Message Board on the goAML application. Please note that any STR/SAR filed via the compliance email must be re-sent via the goAML portal when the system failure issue is resolved/ restored. 4.1 ATTACHMENTS It is important to attach all necessary documents to the STR filed with the NFIU. These documents must include the summary of the internal investigation report. Account Opening package, Statement of Account(s) and the instrumentalities used in the suspected transaction or activity. It is required that all statement of accounts should be converted to EXCEL FORMAT for ease of analysis. 5.0 FEEDBACK The NFIU is required to send periodic feedback to reporting institutions on all STRs/SARs received, analyzed and disseminated to various Law Enforcement agencies to serve as encouragement to those reporting institutions in compliance with international best practice. The NFIU will send feedback on STR/SAR filed by reporting institutions on the status of the report received from LEAs and will clearly indicate the following;

12 Number submitted to NFIU Number rejected by NFIU with specific reason(s) Number under investigation Number under prosecution Number of convictions Number profiled by the NFIU ( Put under monitoring and not disseminated to any LEA) 6.0 PENALTY FOR NON-COMPLIANCE WITH THIS GUIDELINE Any reporting institution that fails to comply with this guideline shall be appropriately sanctioned by their respective regulators and any STR filed to the NFIU that is not in conformity with this guideline shall be rejected and will be considered as not filed at all.