SAR Bulletin

Information drawn from the Suspicious Activity Reporting System

January 2002 | Issue 4

Aspects of Financial Transactions Indicative of Terrorist Funding

This Bulletin is provided to alert financial institutions to financial transactions and methods that could indicate fundraising associated with various criminal activities including terrorism.

This Bulletin provides synopses of FinCEN’s investigative support describing financial transactions that may be associated with criminal fundraising activities. This information was derived from Suspicious Activity Reports (SARs) and other Bank Secrecy Act (BSA) information filed by depository institutions. Each case example is followed by a set of indicators of fundraising activity that were extracted from the case. SAR narratives were used extensively in the development of these indicators.

The information provided in this Bulletin is intended to assist financial institutions in identifying transactions that may be linked to potential terrorist activity. The indicators of such activity outlined in this Bulletin are intended to augment existing systems and procedures used by financial institutions to identify suspicious or unusual activity that may be of interest to law enforcement.

Taken individually, the indicators do not necessarily equate to terrorist or other criminal financial activity. Combinations of indicators should raise the level of concern about potential terrorist financing or other criminal context. For example, references to occupation or nationals of countries associated with terrorist activity as reported in SARs should not, on their own, be taken to indicate potential terrorist activity. But such indicators when part of the larger grouping of indicators could add to the suspicion of potential terrorist activity.

Case # 1

SAR reporting identified activity involving multiple payments by check from a business account of approximately $420,000 to a securities brokerage in the U.S. The account was also used to wire transfer a total of $2.1 million into and out of business and personal accounts in a Persian Gulf State. In addition, a Currency Transaction Report (CTR) was filed on a cash withdrawal of $11,000 from the account by an individual with a foreign passport. Two individuals with signature authority on the account were also involved in two other businesses, both of which are the subject of CTR filings for cash withdrawals totaling $43,000.

The indicators and patterns of activity described in the SARs that could be associated with funds collection and movement relating to terrorist financing include:

• Use of a business account to collect and then funnel funds to a small number of foreign beneficiaries, both individual and business, in a Persian Gulf State;
• Use of a business account that would not normally generate the volume of wire transfer activity, into and out of the account, as reported;
• Use of a business account to make payments to a brokerage firm;
• Large currency withdrawals from a business account not normally associated with cash transactions; and
• Funds generated by a business owned by nationals of countries associated with terrorist activity.

Case # 2

SARs outlined activity involving three grocery markets, two of which share a common location. The activity was conducted by nationals of countries associated with terrorist activity using a single address, which corresponds to one of the business locations. Two individuals employed by a grocery market, and a third whose occupation was unknown, each deposited funds just under CTR reporting thresholds and immediately made checks payable to a fourth individual. The checks cleared through two different banks in a Middle Eastern country. All three bank customers supplied the same address. In addition, two individuals associated with a second grocery market located at the same address above each purchased cashiers' checks or bank drafts just under the BSA record keeping threshold at the same bank branch, at the same time but from different tellers. One of the checks was purchased on behalf of the second grocery market, the other on behalf of a third party. The checks were payable to two different individuals, one of whom shared the same last name as one of the purchasers. In related activity, a third business used the common address discussed above when opening a business account. The new account immediately received a $20,000 wire transfer from a wholesale grocery located in a different state. CTR filings indicate that a total of approximately $72,000 was withdrawn in cash from other accounts associated with this business.

The indicators and patterns of activity described in the SARs and CTRs that could be associated with funds collection and movement relating to terrorist financing include:

• Use of multiple individuals to structure transactions under the reporting threshold to circumvent reporting requirements and then funnel funds to a foreign beneficiary;
• Same day transactions at the same depository institutions using different tellers;
• Shared addresses, which are also business locations, by individuals involved in currency transactions;
• Use of cash intensive businesses to disguise the source of funds; and
• Involvement of multiple nationals of countries associated with terrorist activity acting on behalf of similar business types.

Case # 3

SARs were filed by both a wire remittance company and a depository institution, outlining the movement of approximately $7 million in money orders through the U.S. account of a foreign business. The wire remittance company reported various individuals purchasing money orders at the maximum face value of $500 to $1,000 in sequential order. Purchases were made at multiple locations, primarily in the Northeast corridor, with several purchases also reported in the Southeast area. The money orders were made payable to various individuals, negotiated through banks in Lebanon and later cleared through three U. S. depository institutions. The foreign business endorsed the money orders. In some instances, the funds were then credited to accounts at other U. S. depository institutions or foreign institutions (one in Lebanon, the second location not identified). SARs filed by the depository institution reported similar purchases of money orders in the Northeast corridor negotiated at the foreign business. Various beneficiaries were identified, all with Middle Eastern names. They received amounts ranging from $5,000 to $11,000. The foreign business identified as a wire remittance company was also identified as a secondary beneficiary. The money orders cleared through a foreign bank's cash letter account at the U.S. depository institution.

The indicators and patterns of activity described in the SARs that could be associated with funds collection and movement relating to terrorist financing include:

• Use of multiple accounts at multiple depository institutions funneling funds to a small number of foreign beneficiaries;
• Use of sequentially numbered money orders;
• Structuring of money order purchases at multiple locations to circumvent federal Currency Transaction Report requirements and BSA recordkeeping requirements;
• Apparent intent to circumvent wire remittance company's internal requirements for presentation of identification through purchase of money orders in small amounts;
• Movement of funds through a Financial Action Task Force (FATF) designated non-cooperative country or territory¹; and
• Involvement of multiple nationals of countries associated with terrorist activity.

¹ Cook Islands, Dominica, Egypt, Grenada, Guatemala, Hungary, Indonesia, Israel, Lebanon, Marshall Islands, Myanmar, Nauru, Nigeria, Niue, Philippines, Russia, St. Kitts and Nevis, St. Vincent and the Grenadines, and Ukraine.

Case # 4

SARs filed by a U.S. depository institution identified an import/export business, acting as an unlicensed remitter, generating $1.8 million in outgoing wire transfer activity during a five-month period. Wire transfers were sent to beneficiaries (individuals and businesses) in North America, South Asia, Asia and the Persian Gulf. Cash, checks, and money orders were also deposited to the suspect account totaling approximately $1 million. Approximately 60 percent of the wire transfers were sent to individuals and businesses in foreign countries, who were then responsible for disseminating the funds to the ultimate beneficiaries. A significant portion of the funds was ultimately disseminated to nationals of Afghanistan residing in various countries. Individuals conducting these transactions described the business as involved in refugee relief or money transfer. The individual with sole signatory authority on the suspect account had significant CTR activity reporting deposits of $17.4 million and withdrawals of $56,900 over an extended period of time to what appear to be 15 personal accounts at 5 different depository institutions. The individual also traveled on a U. S. passport returning to the U. S. from Europe and Asia, several times over a three-year period.

The indicators and patterns of activity described in the SARs and CTRs that could be associated with funds collection and movement relating to terrorist financing include:

• Import/export business acting as an unlicensed remitter to conduct wire transfers;
• Individuals/businesses serving as intermediaries in the wire transfer process;
• Beneficiaries of wire transfers involving a large group of nationals of countries associated with terrorist activity;
• Beneficiaries of wire transfers linked by Afghani national origin but residing in multiple nations;
• Charity/relief organization linked to the transactions;
• Mix of cash deposits and monetary instruments; and
• Significant deposit amounts to an apparently personal account held by suspect business owner.

Case # 5

A pattern of cash deposits below the CTR reporting threshold generated a SAR filing by a U.S. depository institution. Deposits were made to the account of a foreign currency exchange on a daily basis totaling $341,421 over approximately a two and one-half month period. During the same period, the business initiated ten wire transfers totaling $2.7 million that were sent to a bank in the United Arab Emirates. When questioned, the business owner reportedly indicated he was in the business of buying and selling foreign currencies in Iran, the Persian Gulf States, and other countries in the Middle East, and his business never generated in excess of $10,000 a day. CTRs for a three-year period reflected cash deposits totaling $137,470 and withdrawals totaling $29,387. The business owner and the cash out transactions were conducted by nationals of countries associated with terrorist activity. Another U.S. depository institution filed a SAR on this individual indicating an $80,000 cash deposit, which was deemed unusual for his profession. He also cashed two negotiable instruments at the same depository institution for $68,000 and $16,387 according to CTR filings.

The indicators and patterns of activity described in the SARs and CTRs that could be associated with funds collection and movement relating to terrorist financing include:

• Apparent structured, daily deposits to business account;
• Wire transfer activity within a short period following deposits;
• Beneficiary account in a problematic country;
• Currency exchange buying and selling foreign currencies from various countries in the Middle East;
• Business account activity conducted by nationals of countries associated with terrorist activity with no obvious connection to the business; and
• Transactions at a level not commensurate with stated occupations.

What to do:

FinCEN has established a Financial Institutions Hotline, 1-866-556-3974, for financial institutions to voluntarily report to law enforcement suspicious transactions that may relate to recent or potential terrorist activity. The purpose of the Hotline is to facilitate the immediate transmittal of this information to law enforcement. Hotline use is voluntary and does not negate an institution's responsibility to file a Suspicious Activity Report (SAR) in accordance with applicable regulations with the IRS Detroit Computing Center. You may obtain more information about the Financial Institutions Hotline and SAR preparation guidelines from FinCEN's web site at: http://www.fincen.gov.

This Bulletin includes information reported by financial institutions on financial transactions and methods that could indicate fund raising associated with various criminal activities including terrorism. Additional information on other related activities will be issued in advisories, bulletins, or other means as it is developed.

For additional information, comments, or questions concerning this Bulletin, call FinCEN's Office of Strategic Analysis at (703) 905-3525 or send an email to osa@fincen.treas.gov.

[Signature: James F. Sloan, Director]

United States Department of the Treasury • Financial Crimes Enforcement Network