Appendix 2/B: Suspicious Transaction Indicators Related to Terrorism Financing

Appendix 2/B Suspicious Indicators for Transactions Related to Terrorism Financing

Indicators Related to Customer Identification Data:

• Providing misleading information that is difficult to verify.
• Discrepancies in information provided by the customer (e.g., place of passport issuance, place of last passport renewal, country of residence, last country visited).
• Submission of forged documents.
• Frequent changes of residential address by the customer.
• The beneficial owner belongs to a region known for criminal activity or security disturbances.
• Information or indicators linking the customer to persons, organizations, or institutions associated with extremism, or supporting extremist publications or acts.
• Frequent changes in authorized persons for a specific account or changes in beneficiaries (beneficial owners).
• Bank staff knowledge that the customer has a criminal record, or reliable sources (such as media) indicate the customer is involved in illegal activities.

Indicators Related to Accounts:

• Transactions with persons/entities that have no clear relationship to the suspect.
• Transactions with multiple persons without clear justification, especially if they are of foreign nationality.
• Discrepancy between the nature of the customer's activity and account management (e.g., a student sending remittances).
• The customer manages multiple accounts under powers of attorney granted by persons with no clear relationship to them.
• Repeated use of the same withdrawal slip to justify the source of funds when depositing with other entities (banks), where the original copy of the withdrawal slip must be taken and kept in the customer's file.
• Joint accounts opened by two or more persons without a business relationship between them.
• Dormant accounts with small balances that suddenly receive deposits/transfers (repeated), followed by daily cash withdrawals.
• Account management by multiple authorized signatories without a clear relationship among them.
• Deposits to the customer's account despite the Know Your Customer (KYC) form indicating that income is limited to salary transferred to the bank only.
• Cessation of the customer's salary deposits to the bank without the customer requesting a clearance certificate or formally requesting to stop it.
• The nature of financial operations performed on personal accounts does not reflect normal living expenses.
• Presence of parties to the executed/requested banking transaction under investigation by an external authority or listed on international sanctions lists.
• The customer stops withdrawing amounts from their salary account for a relatively long period without clear justification, indicating the existence of another income source.
• Establishment of companies and institutions that turn out to be fictitious, or using their accounts to conduct suspicious transfers.

Indicators Related to Cash Deposits:

• Cash deposits sourced from remittances paid through exchange companies.
• Cash deposits from persons with no clear relationship to the account holder.
• Cash deposit operations at branches followed by immediate cash withdrawals via ATMs in locations relatively far from the deposit location, or in locations known as gathering points for extremist or radical groups.
• Repeated presence of fake documents within the customer's deposits.
• Deposit operations followed shortly by financial remittances, especially those conducted from/to high-risk regions.
• Deposit of large cash amounts brought in across borders or failure to submit a declaration/disclosure form regarding possession of those funds.

Indicators Related to Financial Transfers:

• Repeated or large transfers from or to countries suffering from political or security disturbances.
• The customer provides illogical justifications for incoming and outgoing remittances from other parties with whom they have no clear relationship (e.g., debt repayment, family assistance).
• High number of transfers, both domestic and international, without clear justification.
• Transferring repeated or large amounts to persons in a region known for criminal activity.
• Incoming remittances from a person or multiple persons with no clear relationship to the customer.
• Outgoing remittances from the customer to another party with no clear relationship.
• Incoming remittances followed by transfer orders to other party/parties.
• Existence of standing orders (transfers) without specifying the relationship between the sender and the beneficiary.
• Transfers from and to countries known for supporting terrorism or experiencing security disturbances.
• Transfers of equal or similar values to multiple persons in different countries or to a single beneficiary across multiple accounts.
• Customers who transfer multiple amounts abroad with instructions for cash payment, or non-resident customers who receive amounts transferred from abroad with instructions for cash payment.
• Use of multiple accounts to pool funds and then transfer amounts to individuals or commercial institutions, especially if they are in high-risk regions.

Indicators Related to Credit and Payment Instruments:

• Customer obtaining credit facilities against salary transfer, where reliance is placed on cash deposits to repay installments made by third parties.
• Cash withdrawals of unusual amounts through credit cards, ATM cards, and prepaid cards.
• Cessation of the salary securing the credit facilities granted to the customer to the bank due to resignation.
• Customer requesting facilities against guarantees from a bank operating outside the country, especially guarantees from countries with terrorist groups or associated entities, or those characterized as high-risk, without clear justification.
• Customer's desire to send ATM and credit cards to international or local addresses other than their own.

Indicators Related to Safe Deposit Boxes:

• Heavy use of safe deposit boxes, which may indicate the customer is keeping cash inside the box.
• Customer behavior characterized by confusion before/during entry to visit the box or refusal to sign the visit log.
• Customer requesting entry to the safe deposit box hall and use of the box outside scheduled times.
• Customer with a volatile mood who refuses to sign the safe deposit box visit card.
• Refusal to present identification when using the safe deposit box.
• Customer who is controlled by another person when visiting the safe deposit box and is unaware of their actions, or is elderly.
• Student who still attends school and requests safe deposit boxes inconsistent with their status as a student.
• Customer visiting the safe deposit box immediately before a cash deposit or after a withdrawal.
• Customer authorizing a person with no clear relationship to them to use their safe deposit box.

Indicators Related to Charitable Associations, Non-Profit Companies, and Donations:

• Accounts of local or foreign charitable associations that issue and/or receive remittances to/from abroad, especially from countries characterized as high-risk.
• Transfers between customer accounts and charitable association accounts without any clear justification.
• Existence of large donations, especially from external parties, to non-profit entities, particularly where no clear relationship exists between them.
• Transactions related to unregistered humanitarian organizations.
• Collection of donations in an unofficial and unlicensed manner.

Indicators Related to Customer Behavior:

• Signs of anxiety and confusion appearing on the customer or their representative during the execution of the transaction.
• Customer's reservation regarding information provided when opening the account or when inquired about any transaction performed on their account.
• Customer's attempt to cancel the financial (banking) transaction after learning that the information provided will be audited, or their dissatisfaction with (procedures, systems used) at the bank.
• Customer providing multiple justifications/explanations regarding the financial movements intended to be executed on the account.
• Customer avoiding (fear of) meeting bank staff face-to-face and resorting to alternative methods (ATM).
• Customer refusing to send any documents to their postal address.
• Customer resorting to choosing the staff member who does not take enhancements/notes from the movement intended to be executed on the account.
• Suspicion of customer behavior regarding extremist ideas, such as refusing to deal with female bank staff.
• Customer's nationality and profession are inconsistent with their name, appearance, or beliefs.

Indicators Related to Employee Behavior:

• Sudden and noticeable change in employee behavior, especially regarding ideological and intellectual orientations.
• Bank employee receiving external remittances, especially from high-risk countries.
• Transfer from the bank employee's account to customer accounts at the bank with whom they have no clear relationship.
• Cash deposits in the bank employee's account from third parties with no clear relationship to them.
• Employee showing signs of a high standard of living inconsistent with the salary they receive.
• Movements appearing on the employee's account inconsistent with expected movements on their account.
• Failure of the employee to provide the bank with a certificate of non-conviction issued by the Ministry of Justice.

Other Indicators:

• Failure of the insurance company to provide the bank with contracts signed with customers that justify movements to and from the company's accounts.
• Life insurance policies purchased from customers known for young age, limited income, and lack of fixed income.
• Remittances issued by the insurance company to customers justified as payment for an insurance policy where the conditions for payment to the beneficiary have been met.
• Attempt to exchange foreign currencies belonging to high-risk and non-internationally traded countries.
• Repeated purchase of travel tickets or life insurance policies through accounts/cards without executing movements outside the country's borders.