What Happens with the Intelligence Gathered by the FIC

Anti-Money Laundering and Counter-Terrorism Financing Workshop What happens with the intelligence that is gathered? Monitoring and Analysis February 2019

Slide 2 of 32
Purpose of the presentation

• Provide some background on the FIC and its activities
• Provide an overview of the environment in which the Investment Advisor or
  Intermediaries industry operates
• Provide data on statutory reporting as submitted to the FIC
• Focus on the vulnerabilities, threats with regards to money laundering and terror
  financing activities.
• Illustrate how these reports are used to combat crime.

Slide 3 of 32
Presentation outline

• Why do we need collaboration?
• Anti-Money Laundering (AML)/Counter-Terrorism Financing (CTF) Framework
• The FIC and why crime concerns it
• Value chain and FIC’s involvement
• Stakeholders
• Reporting
• FIC’s contribution to investigations
• Case studies
• Statistical overview
• Observations and Way Forward

Click to edit Master title style
Slide 4 of 32

• Destruction caused by financial crimes:
• An average of 3.1% of annual turnover is spent on combating financial crimes; and
• 47% of respondents have been victims of financial crime over the last 12 months*.
• Financial crime and professional money laundering schemes have become more complex and
  sophisticated to bypass the AML/CFT controls that have been put in place.
• On the other hand, terrorists are using small amounts of money to inflict great amounts of damage,
  and as a result, TF is becoming harder to detect.
• Partnerships between government and the private sector can help both parties more effectively
  safeguard their financial systems against misuse by criminal organisations or terrorists.
• Addressing these more complex issues requires proactive engagement between government and the
  private sector.
  *Revealing the true costs of Financial Crime” - Thomson Reuters 2018 Survey Report Why do we need collaboration?

Slide 5 of 32
Anti-Money Laundering (AML)/Counter-Terrorism Financing (CTF) ➔ Framework Money laundering is the taking of criminal proceeds and disguising its illegal origin in order to use the funds to perform legal or illegal acts. Financing of Terrorism (TF) The solicitation, collection and provision of funds to support terrorists, their acts and organisations. They want to conceal both the financing and the nature of the activity being financed. Global Domestic Financial Action Task Force (FATF) intergovernmental body focusing on combating ML and TF. It is a policy making and standard setting body (IMF and World Bank). Financial Intelligence Centre Act (Act 38 of 2001) – [FICA] established the FIC and placed obligations on accountable institutions and other businesses deemed vulnerable to money laundering. The Prevention of Organised Crime Act (Act 121 of 1998) [POCA] - Introduced the crime of ML and sets the penalties associated with a conviction. The Protection of Constitutional Democracy Against Terrorist and Related Activities Act (Act 33 of 2004) [POCDATARA] - Introduced measures to address the financing of acts of terrorism. Client identification and verification (RBA) [s21] Record keeping [s22] Reporting [s28, 28A, S29] STRs, CTRs, TPRs Risk Management Compliance Program (RBA) [s42] Competent person to ensure effective compliance [s42A] Ongoing training of employees [s43] Registration with FIC AI; RI - [s43B]

Click to edit Master title style
Slide 6 of 32
Commercial
Crime
Crime Against the
State
International
Cooperation Organised Crime
Monitors and gives guidance to accountable and reporting institutions. Receives, Processes and Analyses transactional data to develop financial intelligence products Exchanges information with similar bodies in other countries. This is made available to stakeholders to facilitate the administration and enforcement of laws. The FIC and why crime concerns it

Click to edit Master title style
Slide 7 of 32
AIs, RIs and business need to comply with FICA Compliance is monitored and enforced by FIC and Supervisory Bodies Data base of FIC receiving reports / information (STRs & CTRs) Monitor & Analyse reports received Enrich the reports / information with other information to create informed report Refer relevant intelligence to LEA / SARS / SSA or receive requests from LEA / SARS / SSA Criminal investigation (Law Enforcement) Support Law Enforcement by analysing evidence (reconstruction of financial side of the investigation) STR, TPR, CTR TPR CTR STR Value chain and the FIC’s involvement

Click to edit Master title style
Slide 8 of 32

• National Intelligence Coordinating Committee
  (NICOC)
• State Security Agency (SSA)
• Defence Intelligence
• Foreign FIUs (Egmont Group)
• DIRCO
• South African Revenue Services (SARS)
• Special Investigating Unit (SIU)
• Public Protector (PP)
• Supervisory Bodies (SARB, FSB)
• National Treasury
• Commissions of Inquiry
• JCPS Cluster
• SA Police Service
• General Detectives
• Directorate Priority Crime
  Investigation (DPCI)
• Crime Intelligence
• National Prosecuting Authority (NPA)
• National Prosecuting Services
  (NPS)
• Asset Forfeiture Unit (AFU)
• Independent Police Investigative
  Directorate (IPID)
• An investigative division in an organ of
  state
• An investigating authority
• Department of Environmental Affairs
• Department of Correctional Services
  (DCS)
  Stakeholders ▪ Accountable Institutions (AIs) and
• Reporting Institutions (RIs)
• Government Departments (CIPC, DHA, NT, SARB)
• Data Providers (Experian, Compuscan)
• SABRIC/SAFPS/SAICB
  Crime
  National Security
  Admin
  Actions
  Data/Info
  Section 40: FIC makes information reported to it, and information obtained in terms of its mandate, available to specified stakeholders
  Provide intelligence upon
  REQUEST or at the
  INITIATIVE of the FIC

Click to edit Master title style
Slide 9 of 32
Public Protector
SARS Intelligence
Services
Supervisory
Bodies
NPA LEAs
IPID Defence
Intelligence
Investigative
Division in an
Organ of State
SIU
FIUs Construct a narrative on the type and extent of illegal activities involved through the approach of “following the money” Life cycle of a statutory report

Click to edit Master title style
Slide 10 of 32
4,884,417 1 330,639
5,215,057
Section 28
CTRs
Section 29
STRs/SARs
Sec 28A
TPRs
93.65990% 0.00002% 6.34008%
Statistical overview – reporting: all scheduled entities FY2017/18

Click to edit Master title style
Slide 11 of 32
Attorneys
Estate Agents
Investment advisors or intermediaries
Motor Vehicle
Dealers
Gambling
Banks
32,65%
25.10%
20.97%
9.34%
7.67%
0,10%
Rest 4.16%
84,32%
6,79%
8,90%
Scheduled reporting entities vs statutory reporting 40 000 entities 5.2 million reports

Click to edit Master title style
Slide 12 of 32
The aim is to provide data on statutory reporting as submitted to the FIC. This feedback covers six (6) financial year quarters over two financial years, commencing with Q2-2016 and ending with Q3-2017. [1/4/2016 – 31/12/2017] The Investment Advisor or Intermediaries in numbers

• A total of R9 trillion was reported as assets under the management of categories II, IIA and III FSPs as at 30
  June 2016.
• As of 31 March 2017 a total of 10 669 FSPs were registered with the FSB.
• The Financial Intelligence Centre (FIC) has 8 965 (Q3-2017) Financial Advisory and Intermediary Services
  registered on its system
  Investment Advisor or Intermediaries

Click to edit Master title style
Slide 13 of 32

• [1/4/2016 – 31/12/2017]
• A total of 456 entities reported to the FIC for the time period.
• A total of 24 081 reports were submitted for the time period to the FIC.
• The Gauteng Province submitted the majority of the reports, 20 297 (84%).
• A total of 24 081 reports were submitted representing 142 097 transactions to the value
  of R9 885 104 943,00 (9,8 billion)
  Investment Advisor or Intermediaries - reporting Q2-2016 Q3-2016 Q4-2016 Q1-2017 Q2-2017 Q3-2017 66 74 85 72 79 80 Registered Entities Reporting 0.000% 10.000% 20.000% 30.000% 40.000% 50.000% 60.000% 70.000% 80.000% 90.000% 0 5000 10000 15000 20000 25000 UK LP EC Jersey No designation NW NC MP WC KZN GT Volume of Reports Jurisdiction Volume of Reports by the Reporting Entities Reports Precentage

Click to edit Master title style
Slide 14 of 32

• [1/4/2016 – 31/12/2017]
• The types of reports submitted indicated that Cash Threshold Reports (CTRs), Cash Threshold Aggregate Reports
  (CTRA) and Suspicious Transaction Reports (STRs) were the largest volume of reports submitted to the FIC
• A total of 19 336 CTRs were reported, representing 32 180 transactions to the value of R6 184 010 150,00.
• A total of 3 079 CTRAs were reported representing 108 318 transactions to the value of R2 193 727 302,00
• A total of 1 308 STRs were reported representing 1 558 transactions to the value of R1 421 834 854,00.
  Investment Advisor or Intermediaries - reporting 3 10 19336 3079 312 1338 0 3 0 AIF_Reports AIFT_Reports CTR_Reports CTRA_Reports SAR_Reports STR_Reports STRB_Reports TFAR_Reports TFTR_Reports Types of Reports Submitted

Click to edit Master title style
Slide 15 of 32
Scheduled reporting entities vs actual reporters [1/4/2017-31/3/2018] Attorneys 13 322 32,65% Estate Agents 10 242 25.10% Investment advisors or intermediaries 8 556 20.97% Motor Vehicle Dealers 3 809 9.34% 38,38% 1 462 Gambling 17,38% 558 3 130 7.67% 3,68% 490 1,10% 113 1,55% 133

Click to edit Master title style
Slide 16 of 32
Reporting by investment advisors or intermediaries SAR STR STRB TFAR TFTR 371 793 0 CTR 26 462 0,53% of all reports Investment advisors or intermediaries 8 556 20.97% 1,55% 133

Click to edit Master title style
Slide 17 of 32
Provide clear and concise information.

• Who? – the subject, its associates and relationships
• What? – the transaction or activity
• When? – date of detection, date of occurrence, span of time
• Where? – location of the client and where the transaction occurred
• How? – describe how the activity/transaction was completed or attempted
• Why? – results of your investigation into why the activity/transaction is
  reported/suspicious
  What makes a good STR/SAR?

Click to edit Master title style
Slide 18 of 32
Tracing of bank accounts
(26 banks)
Long-term insurance portfolios
(15 entities)
Gambling information
(6 groups)
Money remitters
(4 groups)
MasterCard
Visa
Suspicious
Transaction Reports
(STRs) (Sec 29)
Cash Threshold
Reports (CTRs)
(Sec 28) >R25k
Terror Property
Reports (TPRs)
(Sec 28A)
Reports from
Supervisory Bodies
(Sec 36)
Freezing of bank accounts
(Sec 34)
Monitoring of bank accounts
(Sec 35)
Requests - Egmont for financial info with other FIUs globally (Sec 40) Cross-border monetary flows - Reserve Bank Cross-border Movement System – Home Affairs (MCS) Deeds info – registration of fixed property Vehicle registrations

• eNatis
  Directorships and company registration
• CIPC
  Paid subscription services
  Open source / desktop analysis
  Analysing of bank statements / Big
  Data
  Link analysis
  Financial
  Information
  (sec 27)
  Powers to support investigations
  International
  Information Assets Other relevant information Reports received FIC’s contribution to investigations

Click to edit Master title style
Slide 19 of 32
How does the FIC produce financial intelligence reports?
Accountable and reporting institutions are legally required to submit reports to the FIC on suspicious and unusual transactions; transactions over a certain cash threshold; and transactions related to property owned or controlled by or on behalf of a terrorist. These reports may include sensitive information about financial transactions, amounts involved, bank account details and account balances, for example. The FIC is the gatekeeper of this information, which is treated as private and confidential, and is only shared in terms of the FIC’s mandate and within legislative parameters . The FIC analyses the information and produces financial intelligence products. The information referred for investigation does not contain the actual suspicious or unusual transaction reports made to the FIC. The referral contains descriptions of the transactions and analysis of their potential links to unlawful activity. The financial intelligence report is handed over to the relevant authorities for further action and/or investigation if necessary.

Click to edit Master title style
Slide 20 of 32
Case study 1) Organised Crime syndicate

• The FIC supported a law enforcement investigation between 2014 and 2017 that resulted in the
  successful pursuit and arrest of a large syndicate on charges relating to murder, attempted murder, kidnapping, VAT fraud, and cloning of stolen motor vehicles. The South African Revenue Service and the Asset Forfeiture Unit confiscated about R486 million from the syndicate.
• During this investigation the FIC analysed reports and financial transactions that led to the identification
  of another large foreign syndicate that was hydroponically cultivating cannabis. The syndicate was operating both domestically and internationally.
• The FIC’s analysis during 2017/2018 of financial data assisted to identify:
• Individuals running hydroponic operations in the North West, Gauteng and the Free State. Four
  of these illicit operations were successfully disrupted and the subjects arrested. Equipment valued at about R5 million was seized.
• Properties purchased with the suspected proceeds of crime in the KwaZulu-Natal South Coast
  region. This information helped uncover eight hydroponic cannabis laboratories in KwaZulu-Natal.
• Four foreign nationals and three South Africans were arrested. The authorities made additional arrests in
  Gauteng and confiscated equipment, vehicles and cannabis products to the value of about R26 million.

Click to edit Master title style
Slide 21 of 32
2) Theft and money laundering

• The FIC received a request regarding a subject who allegedly stole about R460 million from her
  employer over a period of eight years. She reportedly duplicated payments to legitimate clients and service providers‚ paying money directly into her deceased husband’s bank account.
• Through financial profiling, the FIC established that funds were going into a relative's bank account
  and then used to buy luxury vehicles and several properties. The money was also used to fund gambling activities and family holidays, and donations to family members.
• The FIC’s analysis of the husband’s bank statements revealed funds paid to an insurance company
  in large monthly instalments and, at times, frequent payments during the month too. It was established that the premiums were paid with the stolen proceeds of crime.
• The FIC issued a directive in terms of section 34 of the FIC Act to prevent the subject from
  accessing these investment products which represented the proceeds of crime, to the value of about R21 million. The subject was subsequently arrested and the Asset Forfeiture Unit proceeded to attach or preserve several assets worth millions under the Prevention of Organised Crime Act.

Click to edit Master title style
Slide 22 of 32
3) Cracking a cryptocurrency -
Ponzi scheme

• The FIC identified what appeared to be an alleged Ponzi scheme run by an
  individual marketing a “new cryptocurrency”. This product was marketed as Africa’s first cryptocurrency and investors were promised huge returns on their investments.
• The FIC’s analysis of the individual’s bank statements revealed that there was
  no cryptocurrency and that this was indeed a Ponzi scheme.
• A restraining order was issued for more than R2.8 million in proceeds from the
  alleged scheme, and the FIC assisted the Asset Forfeiture Unit in obtaining a preservation order relating to fixed property and vehicles worth more than R4 million that was bought using the proceeds of the scheme.

Click to edit Master title style
Slide 23 of 32
4) Case study: Following the money to find rhino
poachers

• An investigative documentary exposed people and criminal networks believed
  to be involved in the illegal rhino horn trade.
• This led to the FIC’s involvement in assisting the Hawks in its investigations.
• The FIC provided financial intelligence on foreign nationals involved in the
  syndicate.
• The FIC was able to identify the methods being used to launder the proceeds of
  rhino horn trade, which included the use of cash deposits, international fund transfers and electronic transfers, often through the accounts of third parties.
• The syndicate also used the money to buy cars and immediately changed the
  ownership.

Click to edit Master title style
Slide 24 of 32
5) Drug Manufacturing and depositing
the proceeds (smurfing)

• The FIC assisted in a drug manufacturing matter in which the main subject was arrested
  on several historic cases. The subject’s wife started assisting the subject by opening a bank account for the purpose of depositing the proceeds of crime and also receiving the proceeds of crime from persons to whom the drugs were distributed.
• The FIC identified numerous CTRs on accounts linked to the spouse of the subject and
  closer analyses of accounts obtained revealed that the transactions were styled as business related transactions, but it became evident that these transactions were clearly styled as such in order to avoid detection (“smurfing”).
• The total amount of cash deposits made into the account amounted to close to R1m. The
  FIC was able to support the Asset Forfeiture Unit (AFU) in a successful Preservation order in terms of the Prevention of Organised Crime Act (POCA) with which an amount of R 364,424.68 was seized as the proceeds of crime in the reported account.

Click to edit Master title style
Slide 25 of 32
6) Ponzi scheme
uncovered

• Through its analysis of reports received, the FIC identified two business accounts with activities indicative of a Ponzi
  scheme.
• Both investment companies promised a 100% return on investment within one to five days.
• The FIC’s analysis revealed:
• Similar transacting patterns involving cash and electronic funds transfers on both accounts.
• A funds transfer between the two entities, linking them to each other.
• The transacting pattern in both accounts reflected an almost equal amount of deposits followed by withdrawals.
• Both entities were not registered with the Financial Services Conducting Authority.
• Both directors were under the age of 30 and no movable or immovable assets could be linked to either director.
• The addresses of the entities were the same as the addresses of the directors, in a residential area.
• Working with the Reserve Bank, the SAPS and the then Financial Services Board, the FIC shared its transactional analysis
  for judicial action to recover the proceeds of the scheme.
  A Ponzi scheme is a fraudulent investment scheme, which offers investors unusually high returns, but the pay-outs do not come from actual profits – the victim’s own money, or money paid by subsequent investors, is used.

Click to edit Master title style
Slide 26 of 32
Detection Indicators

1. High end vehicle purchases that are seemingly not in line with the expected income of the customer.
2. Concealment/misuse within Business structures
3. Illogical business activity - why do multiple transfers at a higher charge
4. Multiple transactions in a short time period with no underlying business rationale
5. Use of False Identities and documents / Missing documentation normally to be expected from a legitimate business
6. Purchasing of property in family members’ names.
7. Purchasing of valuable commodities / extreme luxury goods, normally associated with extremely wealthy persons (Brand
   Name Boutique Clothing, expensive watches and expensive electronic goods etc.)
8. Gambling activities - significant year on year increase in turnover / not in line with the expected income of the customer.
9. Declared Source of Income not aligning to activity of the customer /exceeds the expected deposits for the customer.

Slide 27 of 32
Statistical overview

Click to edit Master title style
Slide 28 of 32
Reactive Financial Intelligence Reports produced on request by Law Enforcement Agencies and other FIU (2014-2018) 1799 1979 2145 2243 0 500 1000 1500 2000 2500 FY 2014/2015 FY 2015/2016 FY 2016/2017 FY 2017/2018 Number of requests 870 511 1322 1470 0 500 1000 1500 2000 FY 2014/2015 FY 2015/2016 FY 2016/2017 FY 2017/2018 Number of Referrals Proactive Financial Intelligence Reports produced to Domestic Law Enforcement Agencies and other FIUs (2014-2018)

0 100 200 300 400 500 600 700 800 900
ILLEGAL GAMBLING
KIDNAPPING
CYBER CRIMES
RACKETEERING
CRIMES AGAINST THE STATE
EXCHANGE CONTROL…
ARMS AND AMMUNITION
ILLICIT CIGARETTES
CONTRAVENTION OF…
HIJACKING
MURDER
DUE DILLIGENCE
NON FERROUS METALS
HUMAN TRAFFICKING
PRECIOUS METALS AND…
ROBBERY
THEFT
TERRORISM
OTHER
ENVIRONMENTAL CRIMES
MONEY LAUNDERING
CORRUPTION
TAX RELATED
NARCOTICS
FRAUD
Crime types analysed 2013 to 2017
2017/18 2016/17 2015/16 2014/15 2013/14
Our priority focus areas:

• Fraud
• Narcotics
• Tax related
• Corruption
• Money Laundering
• Investment scams

Click to edit Master title style
Slide 30 of 32
181.0 184.6 149.3 55.1
2296.7
477.6 443.9
3027.9
0.0
500.0
1000.0
1500.0
2000.0
2500.0
3000.0
3500.0
FY 2014/2015 FY 2015/2016 FY 2016/2017 FY 2017/2018 Millions in Rands
Section 34 freezing of accounts Proceeds of crime recovered using FinInt
Suspected proceeds of crime frozen 2014-2018

Click to edit Master title style
Slide 31 of 32

• The Investment Advisor or Intermediaries, as with any financial sector, is vulnerable to abuse/misuse in terms of money laundering and terrorist
  financing.
• The large volumes of assets within the Investment Advisor or Intermediaries industry makes it a critical cornerstone of the South African
  economy and should be protected from any instability.
• South Africa is experiencing a dramatic shift in the way investigations are conducted using a multi-disciplinary approach involving different
  agencies and institutions.
• It is believed that financial intelligence is at the heart of every serious crime investigation in the country, and plays a central role in the
  successful apprehension and conviction of serious criminals.
• Detection and pursuit of criminal money flows are challenging for law enforcement.
• As FIC South Africa, we remain committed to engage with all stakeholders to ensure the collective effort in addressing the scourge of financial
  crimes.
  Observations and Way Forward

QUESTIONS