Is there a point of diminishing returns in Bank Secrecy Act/anti-money laundering (BSA/AML) compliance where further investigative efforts within the financial institution’s scope is no longer prudent?

Does your institution have what it takes to go beyond establishing a clear suspicious activity and is this a realistic goal within your financial institution’s investigative scope?

First, let me never suggest that you should not take prudent steps in regards to satisfying regulatory or compliance demands. What I do want you to consider is, what would be the best, most efficient and effective investigative steps, if they were available to you? From there you can consider the real life limitations and make a decision on the potential productivity in using your available resources. You may just find that your goal and satisfaction may be in reaching an acceptable level of suspicion and uncertainty. The investigative actions available to you may be unnecessarily burdensome and may only highlight the fact that more prudent investigative steps should have been taken.

By no means are investigative resource limitations unique to AML investigators. There are considerably more solvable crimes than ever are solved. The resources available to both criminal and private investigators are inherently too limited and too costly to efficiently or effectively conduct comprehensive investigations into every petty crime and misdemeanor. Community norms and criminal justice experiences will unofficially dictate the level of investigative resources or energy put into investigations. In training new detectives, I have often used the “20 Minute Investigation” concept to help examine the everyday considerations investigators make in resource allocations. This idea may be just as relevant for AML investigators in determining the scope and resources which can or should be put into investigations.

Investigator Time

Let us analyze the following scenario. Police are called to a bar for a “domestic disturbance.” On arrival, the bartender points to a man and a woman at the bar and tells the responding officers that the man had struck the woman in the face. The woman is weeping slightly and holding a cold beer mug against her cheek. Her cheek is reddened but has no true abrasions. The couple is identified as husband and wife. The husband denies striking her, but separately she tells officers it was all her fault. Officers arrest the husband for domestic assault, take a picture of her face and take down the bartender’s information. Although the fruition of the case will take some time, the actual investigation determination took less than “20 minutes.”

Now, suppose that it is the same call, but this time the husband had used a beer mug to strike her and this results in a big gash to her face requiring medics, a trip to the emergency room and eventually a number of stiches. This time more formal CSI type photos are taken, several other patrons are identified as potential witnesses and the mug is collected as evidence. The charge now escalates to a more serious felony. The scene and allocation of resources has appropriately been increased, but the “investigation” conclusion was made in the same 20 minutes.

Again let us take this scenario a step further where the blow to the face by the mug causes the wife’s demise. A lot more resources will now be dispatched. Every potential witness is identified, the “crime scene” becomes taped off, and the bar is closed as detectives and CSI are called to investigate. They will closely examine any potential forensic evidence and will be very detailed and deliberate in their actions. Although the process will take considerable time, the investigative conclusion will actually be reached in the same 20 minutes.

We have the same basic investigation in all three scenarios but the severity dictated the investigative resource considerations. Few would argue that applying all the resources used in the last scenario would have been a prudent choice in the first. For AML investigators, the level of potential severity also dictates the allocation and use of investigative resources. The question is: At what point can enough of a conclusion be made to assess if additional resources are needed to support it or not?

For AML investigations the severity is more often measured in dollars than in blood, but the principles are the same. Various crimes have various manifestations as to what may be observed or identified during the financial activities associated with them. However, these financial manifestations are rarely unique to a specific crime and will share traits within the general criminal spectrum. That can be a very diverse spectrum. A conclusion confirming suspicious activity might be made in 20 minutes but the underlying specific criminal activity may require considerably more resources. Some of those resources may not be within the financial institution’s scope. Time and time again AML professionals will seek training and guidance for identifiers associated with a specific criminal activity. Could it be drug dealing? Human trafficking? Terrorist financing? Certainty is the desired goal, but is it a realistic one?

Take Two Pills

Take the case of two doctors who both came to the attention of the BSA/AML departments at their respective financial institutions when a seeming sudden influx of potentially structured cash deposits were identified. After the discovery of the cash anomaly, what is the next best course of investigative action? To either confirm or dispel the reason of the suspicious activities? Let us look at the conclusions eventually reached in these cases and analyze if it could have been accomplished efficiently through other investigative steps.

In one case the doctor had become frustrated with insurance hassles and decided to go rogue. He quickly devolved into a cash-only practice primarily catering to prescription opiate drug abusers as his patients. A steady stream of disheveled and often disorderly patients (typical of addicts in need of a fix) was a common sight around his office. Neighboring businesses also began to take notice. There was even an uptick in petty crime around the area. Each day the doctor would collect and deposit up to $8,000 in cash from office visits which took little more than the time that he needed to write out a prescription form. It was no surprise to anyone familiar with the doctor when a couple of his patients robbed him on his way to the bank. That robbery actually became the catalyst to a more serious investigation into the doctor’s activities. The doctor, eventually confronted with both drug and financial violations, entered a plea agreement with prosecutors.

Another doctor had started making regular and fairly obvious structured cash deposits. In his case, it turned out that he found a niche market primarily with an immigrant community where “off the books” employees lacking insurance were common. For a reasonable price, in cash, he offered access to a physician and basic medical care. On the positive side, his patient base would otherwise be crowding emergency rooms for routine medical issues. Word of mouth kept him overflowed with both patients and cash as well. His efforts in trying to keep his cash influx off the books, as well as away from the tax man, would lead him to eventually enter a guilty plea for BSA-related violations.

After the cash anomalies were identified the next investigative steps taken by investigators in both cases was doing an actual site visit. In both cases a probable conclusion of what was taking place was apparent after as little as “20 minutes” worth of observations. For the first doctor, the investigators readily observed these questionable “patients” loitering in and around the office displaying all the characteristics of addicts needing a fix. The conclusion was made quickly. However, the action plan to abate this nuisance would require multiple enforcement agencies and departments coordinating their efforts.

For the second doctor, investigators would observe that there was nearly always a full lobby of immigrant workers and their families, including crying babies, from opening to closing. On your average Friday the doctor could also be observed walking to his bank (about a block away) and back multiple times.

Financial activities need context to move beyond suspicious

By doing the same extensive and time consuming detailed analysis of either doctor’s transactional data, you might also reach similar conclusions. With the “pill doctor” you would have noticed a lack of invoices or purchases for medical supplies commonly used in an active doctor’s practice. There was also a distinctive lack of insurance company debits or credits as well as no checks, credit or debit card activity for the ever more common copays these days. This would certainly not be indicative of a traditional medical office practice. That would add to “suspicious activity” but not to an investigative conclusion. The financial activities need context to move beyond suspicious. That context in this, and most AML cases, will be outside the financial activities. The financial institution activity is only a part of the totality.

For the “immigrant doctor” there was lots of cotton balls, tongue depressors and sundry medical supplies needed to treat a plethora of ailments and wounds. Those expenses and invoice payments were apparent, but are also “normal” for any primary care physician. There was still a lack of insurance, credit card, or even check payment activities. That might indicate a cash centric business practice but not why a physician would choose this route. You also do not have enough information to conclude you know all the accounts the doctor may have. Although detailed deposit and check analysis may find other potential account relationships you still would lack certainty.

Worth the time?

From an AML perspective were these site visits the most efficient and prudent investigative actions in these cases after identifying the cash anomalies? What others might come to mind?

If your AML investigation resources do not allow for such field work, you might start chasing current hot AML topics such as human trafficking, drug dealing or terrorist financing, hoping your identified indicators can be tailored to fit one of these violations. That is unless you are already familiar or aware of the seemingly endless possibilities that can make up money laundering schemes with these same indicators. These possibilities can include regional issues with very lucrative schemes that involve commodities or items related to regional circumstances. Tax and regulatory issues have made many otherwise innocuous commodities subject to lucrative black and gray markets with corresponding BSA/AML issues. In many of these cases the amounts and quantities involved often exceed their more purely contraband counterparts, like drugs.

Currently, wheels of cheese are being smuggled from the U.S. into Canada in amounts of both dollars and products that rival many drug cartels. Heavy taxes and regulation on dairy products in Canada have caused many pizza restaurants in Canada to find a cheese “source” across the border. Although pizza shops have had some notoriety in the past as being used as fronts for money laundering, would an AML investigator equate the cash anomalies at a cheese-related business with this activity? How about a Canadian pizza shop with “cash out” anomalies? Did those previous investigators ever have to consider that part of the scheme was actually ending up as part of the toppings. I do not recall felonious cheese schemes as being an AML hot topic!

Virginia and Missouri have some of the lowest tobacco taxes and regulations in the nation. The smuggling of these cheaper cigarettes has created black and gray markets in regional states with higher taxes. These schemes are often easier, more lucrative, and usually far less risky than finding a connection to the illicit narcotics counterparts. Big box wholesale clubs are more reliable and safer suppliers than back alley pushers in obtaining a quantity of cigarettes for profitable re-sale a state or two away.

Do other financial indicators ever eliminate a potential drug dealing or other nefarious nexus? AML training has often included how convenience stores are used in all manners of money laundering schemes. Should it include the possibility that the source of the illicit funds might be sold in plain sight?

Poaching and ivory smuggling has also received considerable international attention lately and only now is the analyzation of potentially associated financial activity behavior being considered in the identification, interdiction and abatement planning. Will this prompt a search for new AML alert indicators or actually result in a second look as reasons for already existing ones?

Although criminal activity may have identifiers associated with it, the accompanying activities at financial institutions may be similar or the same for a wide variety of violations. What needs to be added is context. What further can be observed or identified in those financial activities toward that specificity will likely be innocuous nuances requiring endless examination and the crunching of numbers. In most cases, this micro transactional analysis is a very inefficient means of trying to make an investigative determination, which can more effectively and efficiently be made through leads or evidence outside of a financial institution’s scope.

How many nuances to identifying specific violations should your AML training cover?

Are you certain?

Steve Gurdak, CAMS, supervisor, Washington Baltimore HIDTA, Northern Virginia Financial Initiative (NVFI) Annandale, VA, USA, sgurdak@wb.hidta.org

For information on how to obtain advanced training to reinforce your investigation skills and your ability to effectively communicate suspicious activity, please visit http://www.acams.org/cams-fci/.