Money Mules: ID Theft and AML Compliance

QUESTION 

Our company is under investigation by the banking department and law enforcement for allowing "money mules" to use our financial services. They managed to use our mortgage and depository services. The crooks targeted people in nursing homes and hospice care facilities. 

The banking department is now determining if we properly implemented an Identity Theft Protection Program and Anti-Money Laundering Program. They're looking back at the procedures as well as the level of testing and training. Our CEO has told us that she expects an administrative action against us. 

We haven't updated our Identity Theft Protection Program and Red Flags Rule in years. We're reviewing it now. Well, better late than never! 

But we do the Anti-Money Laundering Program testing and training as required. The banking department is closely scrutinizing both written policies. Yesterday, we received a notice from FinCEN that they are investigating our SAR filings. 

The news fallout has been devastating. We have been in business for decades and have never had a hit to our reputation, let alone something as shocking as being an unwitting accessory to an identity theft and money-laundering scheme. There's not enough money in the world to reestablish trust! 

How do "money mules" operate? 

How do "money mules" exploit the stealing of identities? 

How do "money mules" undermine anti-money laundering procedures? 

ANSWER 

Your situation reminds me of a recent arrest in California involving money mules. The victims' money is often initially handled by "money mules," individuals who permit their addresses or bank accounts to be used or agree to receive or negotiate cashier's checks. In brief, a money mule moves money obtained illegally on behalf of another individual. Funds are transferred in person, digitally, or through mail or courier. 

I have discussed money mules previously. Here is one about how the COVID pandemic was used by criminals to bilk the public: COVID-19: Imposters and Money Mules. 

Money mules can be – but are not always! – aware they are involved in laundering money obtained illegally. The purpose of this illegal activity is to obscure the source of funds. They are a key element in the money laundering and identity theft process. 

Scheme 

With some variance and nuances here and there, the following are the steps to money mule schemes: 

Step 1: Criminal looking to launder money employs a money mule to layer illicit funds. 

Step 2: Criminal transfers the funds to the money mule in person or electronically. 

Step 3: Money mule either places[i] the money into the financial system or receives money that has already been integrated[ii] into the financial system. 

Step 4: Money mule uses a series of transfers and transactions to layer[iii] the money. 

Step 5: Money mule returns the layered funds to the criminal. 

In the case I have in mind,[iv] the FBI arrested money mules involved in scams that bilked grandparents. This is brutal, wicked, and heartless, of course, but crooks will do what crooks will do! A con is a con. A mark is a mark. As Hamlet observed, "one may smile, and smile, and be a villain!"[v] 

Two money mules were arrested and indicted for their scheme to launder at least $2 million in proceeds obtained from victims of grandparent scams who were defrauded with false claims that their relatives were in distress and urgently needed funds. 

The indictment detailed how perpetrators of grandparent scams convince victims to send money – purportedly to help relatives, frequently their grandchildren, who are typically described as being in legal trouble – "to bank accounts, business entities, and physical addresses specified by the scammers, using interstate wires and cashier's checks…for the supposed purpose of assisting the relatives in distress." 

One of the money mules is said to be a manager of money mules, and the other, thus recruited, recruited his own money mules. Federal prosecutors further assert that the manager created business entities and opened bank accounts using information stolen from identity theft victims. 

Once the money was in the accounts associated with the money mules or identity theft victims, the two money mules allegedly engaged in transactions designed to conceal the true nature of the funds, which, in this case, had been obtained via wire fraud. 

The indictment specifically alleges that the scheme laundered funds obtained from victims of grandparent scams who live in California and Pennsylvania. The bank fraud scheme alleged in the indictment involves fraudulently obtained funds held in suspense in an account set up in the name of an identity theft victim. 

The two money mules and a co-conspirator allegedly worked in concert to contact the bank and impersonate the identity theft victim to secure the issuance of a check for nearly $83,000 that was remaining in the account. 

As I noted above, money mules can be unwittingly involved in a money mule scam. That seems hard to believe. Investigators find that the trail usually ends with the money mule, who might not have realized that they are laundering money for crime gangs. Unfortunately, the process often depends on the unwitting money mule for its effectuation. The enforcement authorities have found at least three primary types of money mules: (1) unwitting, (2) witting, and (3) complicit. Here's a synopsis of each type. 

Types 

(1) Unwitting Individuals are unaware they are involved in criminal activity and engage in it thinking it's legal. They are often deceived into doing the activity for someone they believe to be an employer, acquaintance, perhaps a romance scammer, or somebody in a position of some trust. 

(2) Witting Individuals who should be aware they are involved in suspicious activity but engage in it anyway. While they aren't fully aware of the extent to which they are involved in criminal activity, they typically ignore clear indicators that what they do is illegal or suspicious. 

(3) Complicit Individuals know they are involved in criminal activity yet still engage in it willfully. This type of money mule ranges from inexperienced individuals unaware of their involvement to experienced and adept fraudsters who run entire money mule rings. 

Identity Theft Prevention Program 

Beyond the legal ramifications of acting as a money mule,[vi] the people who serve as money mules may open themselves up to identity theft. All of their personally identifiable information ("PII") can be stolen by criminals, leading to the theft of their financial assets. Victims often wind up with drained accounts, damaged credit, and deprivation of medical treatment due to loss of cash liquidity. 

Stealing an individual's identity is a fraud committed or attempted using the identifying information of another person without authority.[vii] The "identifying information" of a victim is particularly onerous because such information means "any name or number that may be used, alone or in conjunction with any other information, to identify a specific person."[viii] 

The Red Flags Rule (" Rule") goes back to 2007 under a section in the Fair and Accurate Credit Transaction Act (FACTA), which amended the Fair Credit Reporting Act (FCRA).[ix] The Rule was promulgated in 2010.[x] 

If you haven't reviewed your written Identity Theft Protection Program – which is statutorily required – it is a bit late now, given that the regulators are currently involved in an investigation. In compliance, it is not the case to throw up your hands and, as you do, declare it is "better late than never." Indeed, that phrase harks all the way back to Geoffrey Chaucer in the 14^th century, who said, "For better than never is late; never to succeed would be too long a period."[xi] 

In compliance, virtually everything has a tail, a trace, a remnant, a vestige, some lingering scintilla of activity, a dash of evidence that cannot escape discovery at some point and in some way. Thus, "better late than never" is not functionally good enough in compliance. 

Pay attention to the second half of Chaucer's statement, "never to succeed would be too long a period." There are no viable exceptions to maintaining regulatory vigilance, and if there is a systemic or some other failure, admitting the mistake and fixing it permanently. Regulators are sometimes sympathetic to companies that recognize and willingly fix mistakes. But be assured that most of the time, they will find out about the errors you prefer not to tell them about. To succeed in compliance, you must proactively review, monitor, test, train, and implement regulatory requirements. 

There are notorious correlations between money mules and identity theft. I have been discussing "traditional" money mules, but there are "synthetic identities" used by money mules. Synthetic identities are created using a discrete combination of PII to fabricate a person or entity. Given the availability of stolen data on the dark web, these identities are easy to create on a large scale. 

If you haven't reviewed your Identity Theft Prevention Program in some time, you are quite remiss, and, from a regulatory compliance perspective, you are not only opening yourself to regulator scrutiny but may also be recklessly endangering your customers. 

Anti-Money Laundering Program 

You asked, How do "money mules" undermine anti-money laundering procedures? In our Anti-Money Laundering test audits, we have noted weaknesses in screening for money mules. The results of our findings are provided in our Executive Summary, and we offer our work papers so that you can see how deep we have gone to evaluate your AML program. We provide recommendations to fix the weaknesses. 

Our reviews have uncovered many money mule schemes. However, catching the scams is a never-ending task because the crooks are remarkably inventive in finding ways to undercut even the best AML programs. 

There are telltale elements that might indicate a money mule has landed on your AML radar. We are always adding to our audit list as crooks invent new schemes and scams. You should do the same! These scams come up repeatedly in our AML test audits to the point that we consider them triggers to conducting an investigation to determine if a Suspicious Activity Report (SAR) should be filed with FinCEN[xii]. 

Our organization maintains a list of warning signs that a money mule may be making their way onto a client's AML radar. Our list contains elements provided by CISA[xiii], and we build on these elements continually. In our estimation, AML compliance must include, among other things, periodic testing, employee training, due diligence, transaction monitoring, Identity Theft Protection Program mandates, KYC and KYB[xiv] requirements, CIP[xv], OFAC[xvi], identity theft[xvii] "frozen credit" alerts, and historical SAR filings. 

An example of due diligence is conducting your own investigation. Money mules can contaminate PII. During an investigation, a client of ours discovered that a money mule group used fake websites and social media profiles to trick victims into providing their personal information. It then used that PII to open bank accounts, apply for mortgage loans, and set up cryptocurrency wallets. This criminal group then laundered the stolen funds through a network of money mules, who received and transferred the funds on behalf of the criminals.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Placement is where illegitimate funds are introduced to the legitimate financial system.

[ii] Integration is where layered funds (which now appear legitimate) are returned to the criminal.

[iii] Layering is where the criminal intentionally moves funds to disguise where the money actually originated.

[iv] Two Indicted in Scheme that Allegedly Laundered over $2 Million Generated by ‘Grandparent Scams’ Targeting Elderly Victims, Press Release, Department of Justice, U.S. Attorney's Office, Central District of California, December 12, 2023

[v] Hamlet, Act 1, Scene 5, Shakespeare

[vi] For instance, among other things, the charge of conspiracy to commit money laundering carries a statutory maximum penalty of 20 years in federal prison, and the charge of conspiracy to commit bank fraud carries a sentence of up to 30 years.

[vii] 16 CFR 603.2(a)

[viii] 16 CFR 603.2(b)

[ix] The Red Flags Rule was issued in 2007 under § 114 of the Fair and Accurate Credit Transaction Act of 2003 (FACT Act), Pub. L. 108-159, amending the Fair Credit Reporting Act (FCRA), 15 USC 1681m(e). The Red Flags Rule is published at 16 CFR 681.1. See also 72 FR, Nov. 9, 2007.

[x] The Rule was amended in 2010 by the Red Flag Program Clarification Act of 2010, 15 U.S.C. 1681m(e)(4), Pub. L. 111-319, 124 Stat. 3457 (December 18, 2010).

[xi] Actually, the phrase is a direct translation from the Latin “potiusque sero quam nunquam” (viz., and better late than never) in Livy’s fourth book Ab Urbe Condita (History of Rome), 27 BC. The full quote in Livy is “Their insolence and recklessness must be opposed, and better late than never.” (My translation.)

[xii] Financial Crimes Enforcement Network (FinCEN), for nonbanks, see Anti-Money Laundering Program and Suspicious Activity Report Filing Requirements for Residential Mortgage Lenders and Originators, Financial Crimes Enforcement Network, 77 FR 8148-8160 (February 14, 2012), as revised from time to time.

[xiii] CISA provides several publications involving money mules and other schemes. One example is Understanding and Protecting Yourself Against Money Mule Schemes, Matthew DeSantis, Chad Dougherty, Mindi McDowell, US-CERT, Cybersecurity & Infrastructure Security Agency

[xiv] Respectively, Know Your Customer (KYC) and Know Your Business (KYB)

[xv] Customer Information Program (CIP)

[xvi] Office of Foreign Assets Control (OFAC)

[xvii] FCRA Identity Theft Rules, Op. cit. ix

Identity-Related Suspicious Activity

QUESTION 

We are a large mortgage lender in the West. A hedge fund owns us. Recently, the hedge fund came down hard on our compliance department for allowing the originating of loans that our AML process should have screened out. They were up in arms because our state regulator issued an administrative action against us. 

We didn't file some SARs that were identity-related, but we did document why the SARS were not filed. That didn't satisfy the regulator because they said we did not follow our own AML program guidelines. We may now lose our Safe Harbor because we didn't file the SARs by following our own policy. 

There are other issues, but the biggest one involves not screening for identity-related suspicious activity. That's the regulator's term: "identity-related suspicious activity." 

The auditor we hired to do our annual AML test was fired. Now, to comply with the regulator, we have to find an auditor who will work with us to review the last 36 months to determine if we should have filed more identity-related SARs. This is a massive undertaking. I am one of several operations persons drafted into the compliance department to assist. I want to know more, and I hope you will give us some feedback. 

What is identity-related suspicious activity? 

ANSWER 

We provide Anti-Money Laundering (AML) testing and training. We were the first compliance firm in the country to offer testing, training, and a written AML Program. Also, we handle large AML due diligence projects such as the one you've described. If you want information about our AML compliance support, contact us here. 

For years, the Financial Crimes Enforcement Network (FinCEN) has issued trend analyses showing that identity-related suspicious activity is a huge percentage of filings. For instance, in 2021, approximately 1.6 million SARs (42% of the SARs filed that year) related to identity, which was $212 billion in suspicious activity. 

Just a few weeks ago, FinCEN published its findings as part of its ongoing Identity Project ("Report").[i] The Report outlines how bad actors exploit identity-related processes in processing transactions as well as opening and accessing accounts. 

I will provide a cursory overview of the Report and then move on to an answer to your question. 

TYPOLOGIES 

The Report discusses the existence of significant identity-related exploitations through various schemes. FinCEN identified over fourteen "typologies" commonly indicated in identity-related SARs. 

The most frequently reported were 

(1) fraud,

(2) false records,

(3) identity theft,

(4) third-party money laundering, and

(5) circumvention of verification standards. 

These top five typologies accounted for 88% of identity-related SARs and 74% of the total suspicious activity reported in 2021. 

TRENDS 

Trends found in the BSA reporting include: 

·       Although identity-related suspicious activity impacted all types of financial institutions, depository institutions filed the most identity-related BSA reports, which was about 54% of all identity-related filings. 

·       The impact of identity-related exploitations by BSA report volumes and cited U.S. dollar values are significant. Attackers most frequently use impersonation tactics, followed by compromise during authentication, and then circumvent verification to evade detection. Compromised credentials have a disproportionally large monetary impact compared to impersonation and circumvention. 

·       The Report found that compromised credentials have a disproportionate financial impact compared to other types of identity exploitation. 

SAFE HARBOR 

I will not comment on your company's exposure to losing the Safe Harbor except to point out that the Safe Harbor provision of the Bank Secrecy Act (BSA)[ii], among other things, shields financial institutions, their officers, and employees from civil liability for reporting known or suspected criminal offenses or suspicious activity by filing a SAR. From your question, I can't tell who told you that your company may lose the Safe Harbor. 

The Safe Harbor provides immunity to any "financial institution that makes a voluntary disclosure of any possible violation of law or regulation to a government agency." This protection precludes liability under any federal, state, or local law, or regulation, or under any contract. Nevertheless, courts have disagreed about the scope of the protection it affords. You should be working with competent counsel in responding to the regulatory agency. 

SCREENING PROCEDURES 

It seems to me that your screening procedures failed to identify identity-related suspicious activity. You state that the regulator alleges you did not follow your own AML program procedures. That infers that you have procedures in a ratified AML Program that were not implemented. 

There are three stages to a systemic framework that mitigates identity-related suspicious activity.[iii] These stages are: (1) Validation; (2) Verification; and (3) Authentication. I do not think this framework is failsafe, but it is quite comprehensive. Nonetheless, in the age of Artificial Intelligence, we can expect updates to these stages. 

The following is a brief outline of each stage. 

Validation 

The validation stage begins when a customer presents identity attributes and supporting evidence (i.e., birth certificate, passport, driver's license, and so forth) – in person or remotely – for review by a financial institution. The financial institution then attempts to determine:

a)     Whether the presented identity exists (i.e., whether it is tied to a real-life identity);

b)     Whether the presented identity is unique (i.e., whether it is claimed by only one entity);

c)     Whether the presented information and evidence are authentic and accurate. 

Generally, the financial institution makes these determinations by comparing the presented information and evidence against authoritative government data, such as public records and Social Security Administration data, or third-party data sources, such as credit reporting agency, utility, and employer data (i.e., independent and reliable data sources). 

Verification 

In the verification stage, the financial institution confirms that the previously validated identity evidence belongs to the customer. The financial institution may, for instance, match the customer's appearance in person (or virtually) via photo or video to a photo on the customer's driver's license, passport, or other photo identification. 

Verification tools and techniques can rely on humans or be entirely automated. These tools may also use biometrics like facial recognition and "liveness" detection or verify documents and attributes to determine a match. This process may also use various other technical and risk data from third parties. 

Authentication 

In the authentication stage, a financial institution assesses whether the customer is who they purport to be based on the customer's possession and control of valid "authenticators." Financial institutions may also engage in other activities involving transactions, such as verifying counterparties and other transaction monitoring. 

Authentication is supposed to provide "risk-based" assurance that the customer is the same customer whose identity was validated and verified during previous steps of the identity process. 

The authentication process can occur in person or remotely, be manual or digital, rely on humans or machines, and is considered more robust when it depends on multiple authentication factors (i.e., multifactor authentication). 

Common authentication factors include: 

a)     Ownership of something the customer has (i.e., a badge, phone, or cryptographic key);

b)     Knowledge of something the customer knows (i.e., a password, passphrase, or PIN);

c)     Inherent or something the customer is (i.e., a fingerprint or other biometric data).

AML Examinations: Common Audit Findings

QUESTION 

We are a credit union with several branches. Our concern is that we don't believe we have a comprehensive training program for BSA/AML. We are going to have a regulatory examination soon, and I think we will be written up for having an incomplete training program and aids. But that's just one of the weaknesses. 

We need some direction here. First, our compliance manager is contacting your firm to review our written AML program. Second, we need to know the areas of weakness that regulators often find in our AML program. 

What are some areas of weakness we can anticipate being reviewed in an AML examination? 

ANSWER 

If you expect the AML examination soon, you and other subscribers can contact us here. 

We have conducted hundreds of AML risk assessments over the years, and the findings regarding BSA/AML vary depending on the financial institution's risk profile, size, complexity, and products and services. Still, there is a common grouping of weaknesses that tend to recur. 

Before listing the more salient, I urge you to segment your responsibility matrix for those personnel involved in the Anti-Money Laundering review process. Regulators take a keen interest in evaluating whether an institution properly allocates responsibilities and authorities along the chain of command in reviewing AML data. 

Segmenting the specific responsibilities will make the written AML program easier to execute. Importantly, the regulators will be able to determine that your institution is complying in a procedurally reliable way. 

I will segment the responsibilities into four groups: (1) Frontline Staff, (2) Operations Staff, (3) Board of Directors, and (4) New Personnel. Now, consider the following brief description of each. You can take these responsibilities as a "starting point." I suggest you broaden them to reflect your institution's normative information paths.

Frontline Staff 

Responsibilities 

• CTR reporting requirements,

• Recognizing suspicious activity,

• Completing a SAR,

• Customer Identification Program due diligence, and

• Office of Foreign Assets Control (OFAC) requirements (if applicable). 

Operations Staff 

Responsibilities 

• Wire transfers,

• ACH Transactions,

• Debit, Credit, Gift Card Transactions

• Recognizing and reporting suspicious activity related to applicable financial products and services, and

• OFAC requirements (if applicable). 

Board of Directors

Responsibilities 

• Methods to enhance the importance of BSA/AML requirements,

• Consequences and risks of noncompliance, and

• Changes and new developments in the BSA laws and regulations. 

New Personnel 

Responsibilities

• Orientation for BSA/AML overview, 

• Jobs requiring performance of BSA/AML and/or OFAC duties must receive thorough training prior to starting the position.

There are eight recurring weaknesses we have found through our AML risk assessments. I will list them here, with the caveat that they are by no means meant to be comprehensive. Also, keep in mind our AML test audits and risk assessments are focused on residential mortgage loan originations and servicing compliance. 

My advice is for you to review your written AML program to ensure you cover these areas with respect to policies, descriptions, and procedures. And be sure to test them! 

Some Commonly Recurring Weaknesses 

in 

Anti-Money Laundering Programs

• Customer ID Program requirements.

• Timely 314(a) reviews and CTR reports.

• Independent audits must address all the issues they identify.

• BSA policies should note both the BSA/AML officer and the backup BSA/AML officer.

• Risk assessments must consider all new products and services.

• Confidentiality of all SARs must be maintained at all levels of the institution.

• BSA training is kept current and available; examiners scrutinize training records and materials.

• Customize the BSA/AML training program to employees' specific responsibilities. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

AML Compliance: Violations Bait and Land Mines

QUESTION 

I am updating our Anti-Money Laundering Program. It was last updated three years ago. We had an AML test last year, and the report showed problems with the written program, yet we did not update it even then. This delay has happened because of staff turnover. 

My concern is what areas I should emphasize in this new update. I would like to know what kinds of issues and challenges are critical, so I can identify them in the program and provide procedures for resolving them. Since your firm is known for conducting AML tests for mortgage companies, I thought you would list important AML issues. 

What challenges do you see occurring in your AML audit tests? 

ANSWER 

If you do not review your Anti-Money Laundering Program (Program) for updates, as needed, and at least annually, you are not complying with Bank Secrecy Act (BSA) guidelines. You are violating the applicable statute if you are not conducting an Anti-Money Laundering (AML) test annually but no later than eighteen months from the previous test. 

If you are not implementing AML training annually, including, when needed, for new hires, you have caused a statutory violation. 

And, if you do not have a responsible, designated, and ratified AML Officer, you have not complied with the BSA mandates. 

The Program is the written structure on which the four pillars of AML compliance rest. Those pillars are (1) ratifying the Program itself, (2) establishing an AML Officer, (3) conducting the AML test, and (4) implementing AML training. 

Lenders Compliance Group was the first compliance firm in the country to provide AML audit tests for Residential Mortgage Lenders and Originators (RMLOs), the specific term used in the BSA. RMLOs were required to develop and implement a Program and begin filing Suspicious Activity Reports (SARs) by August 13, 2012. If you want LCG to conduct an AML test or provide other AML Compliance support, please contact us. 

The test may be conducted internally, following FinCEN guidelines, or by an external auditor entirely independent of the AML Officer. If the findings report recommends that you go further by conducting an AML Risk Assessment, do it. 

In using the term RMLOs, I am referring to two types of entities that are considered loan or finance companies: the mortgage lender, the entity that is explicitly stated in the note as being the initial payee in connection with a mortgage transaction, and the mortgage originator, the party that accepts a mortgage loan application or offers or negotiates the terms of a residential mortgage loan. 

Each RMLO must adopt a policy and procedure for AML compliance in recognition of its obligations under BSA, other related money laundering regulations, the Financial Crimes Enforcement Network requirements, and federal and state licensing agencies. 

That you are not revising policies and procedures pursuant to a competent AML test may put your firm at considerable regulatory risk. The audit results must be reported to the audit committee of the RMLO's management and the BSA/AML Officer. It is the responsibility of the AML Officer to take appropriate action to correct any problems found as a result of the audit and promptly respond to the RMLO's audit committee or appropriate senior management. 

Crooks and bandits continue changing tactics, and your organization must adjust your AML program accordingly. Several "land mines" can be anticipated in BSA/AML examinations. 

We keep a record of evolving money laundering schemes. At this point, our due diligence auditors avail themselves of an extensive database that keeps us alert to the nefarious money laundering tactics the crooks have developed and, unfortunately, continue to develop. 

I will provide several actions and non-actions – what some organizations do or don't do – that trigger regulatory violations. My focus is on RMLOs. 

Violations Bait and Land Mines 

1.     314(a) searches aren't completed promptly. RMLOs should make certain that the U.S. Patriot Act contacts listed in their online profiles are current and that they certify these profiles when contacts are updated. Moreover, companies must ensure that their policies and procedures name a point of contact. 

They should also provide the following: 

 a.     steps for when the primary contact is unavailable; 

 b.     ways to ensure information confidentiality; 

 c.     how to respond to FinCEN requests; 

 d.     how to determine if and when to file a SAR; and 

 e.     the process for independent testing of 314(a) compliance. 

2.     Inadequate AML training for appropriate personnel. Board members and the AML Officer do not always receive the appropriate BSA/AML training for their roles. Failure to educate staff on illicit financial activities to keep members safe and the organization compliant. We believe financial institutions should train new staff as soon as possible. 

To prevent staff-related issues, AML functions and responsibilities should encompass adequate resources, a sufficient level of aggregate AML expertise, and an appropriate allocation of time to AML tasks. 

3.     An AML Officer must be designated to own the system and ensure that processes are followed and updated, reports are filed, training is robust, and the entire system is running effectively. The board should grant the AML Officer the duties and authority to implement AML processes and policies. 

4.     AML training should include examples of money laundering and suspicious activity monitoring relevant to each operational area. This training also should provide officials with a sufficient understanding of the institution's risk profile and BSA/AML regulatory requirements. 

Additionally, companies must document all training, including the following: 

 a.     testing materials; 

 b.     attendance records; 

 c.     employees that fail to participate; and 

 d.     corrective actions taken concerning employees who fail to attend training. 

5.     A lack of independent testing. Avoid utilizing in-house staff that does not satisfy the "qualified" and "independent" criteria for independent testing. If staff is not qualified and independent, the work product is worthless and will likely be rejected by regulators. Not using an external resource to conduct the independent review causes delays in the required testing. 

6.     No written and approved Program. BSA/AML compliance programs must be in writing, approved by the board, and documented in board meeting minutes. It should be comprehensive. Off-the-shelf AML policies are notoriously defective. 

Additionally, the Program must set forth requirements for internal controls, independent testing, a designated AML Officer, training for appropriate personnel, member due diligence, and customer identification data. AML policies and procedures should be documented, comprehensive, consistent with best practices, approved by stakeholders, and regularly updated. 

7.     Stay alert to sanctions issued by the Office of Foreign Assets Control (OFAC). To be compliant with OFAC-governed sanctions regulations, your firm must ensure it is not engaging in trade or transaction activities that violate the rules behind OFAC's country-based sanctions programs or engaging in trade or transaction activities with sanctions targets named on OFAC's list of Specially Designated Nationals and Blocked Persons. 

The linkage to AML compliance requires an organization's policies and procedures to address aspects of OFAC compliance and controls, including customer onboarding, screening, and even specialized training. 

Customer Identification Program (CIP) requirements should be applied to all customers opening a new account as that term is defined in the Bank Secrecy Act and implementing regulations. The CIP must include procedures for making and maintaining a record of all information obtained to verify a customer's identity. At a minimum, the record must include all the identifying information gathered by the firm about a customer. 

8.     Noncompliant SARs. SARs are not filed within 30 or 60 days and are not complete or accurate, particularly SAR narratives. Failure to promptly detect, escalate, investigate, and file SARs. Include appropriate risk-based procedures for conducting ongoing customer due diligence, including (i) understanding the nature and purpose of customer relationships to develop a customer risk profile and (ii) conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. 

9.     Know Your Customer (KYC) practices do not clearly define and align with customer attributes and risks (i.e., customer identification programs, customer due diligence, enhanced due diligence, and special circumstances due diligence). 

10.  Certain loan products pose a higher risk of criminal activity than others and attract money laundering criminality. You must document processes for monitoring your high-risk products and services for potential money-laundering activity. A "best practice" is to ensure that the AML Officer and compliance department are part of product plans at your institution.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

Challenges of Cryptocurrency Compliance

QUESTION

We are writing a policy for cryptocurrency compliance. We are a mid-sized nonbank. I am the Compliance Manager, and I have two in support staff. Our Board of Directors thinks cryptocurrency will continue to be a part of bank and nonbank transactions. They retained a research firm that says it is growing quickly.

I recognize that there are benefits to cryptocurrency. However, in writing this policy, we see how it can also impact our Anti-Money Laundering safeguards. So, we need to know the risks of cryptocurrency triggering our AML tripwires. 

What are the safe versus risky features of cryptocurrency? 

ANSWER

Your question comes at a time when cryptocurrency is a hot topic in banking and government circles. Indeed, the Treasury Department views cryptocurrency as potentially leading to economic instability due to increased fraud risk in the absence of sufficient government regulation. The Washington Post reports:

“The Treasury Department will warn the White House that cryptocurrencies could pose significant financial risks that outweigh their benefits unless the government rolls out major new regulations, according to two people familiar with the matter.”[i] 

I speak with DC political types all the time, and I can tell you that a good percentage of them do not know what cryptocurrency is, let alone how to regulate it. Sometimes I wonder if they only just recently figured out how to send an email. Several of them are oblivious to how the Internet works, so I suppose they think it works by magic. 

But, there is no mystery to cryptocurrency. It’s not magic. 

Cryptocurrency is establishing itself as a legitimate alternative to traditional finance. As such, it should be regulated. And, as to linking it to Anti-Money Laundering (AML), you are entirely correct: there is a direct interface with Know Your Customer (KYC) processes and cryptocurrency. 

Understand that cryptocurrencies had a total market capitalization of $900 billion in June, which jumped to $1 trillion in August.[ii] That is astounding growth! 

You’ll need to become familiar with certain new terminology to make sense of cryptocurrency compliance. I will embolden a few words that are particular to cryptocurrency. So, let’s dig in! 

What is Cryptocurrency? 

Some people believe that cryptocurrency is impervious to scrutiny and appropriate regulation. The notion here is that transactions are “transparent” because they are kept in blockchain ledgers. Thus, it is erroneously thought, cryptocurrency can’t be well-regulated. However, these are simply digital ledgers that capture each transaction, which can be traced back to a wallet address. Transactions are time-stamped and immutable because to alter something in a ledger, every single block in the chain, across all its distributed versions, would need to be changed. 

There is also the view that cryptocurrency is where criminals hang out to hide their nefarious purposes. I don’t think that holds up to scrutiny. The fact is that only 0.15% of such transaction volume was related to crime in 2021.[iii] 

Is cryptocurrency vulnerable to cyberattacks? Well, yes and no. Wallets are owned and accessed by persons, which means they will be vulnerable to fraudsters and cybercriminals.[iv] But the blockchain technology that facilitates and records cryptocurrency transactions is nearly impossible to edit and is rooted in cryptography. However, cryptocurrency wallets need to be secured to protect them from attack. 

It seems to me that anyone who thinks cryptocurrency is a fad has not been paying attention. It jumped by 567% in 2021[v] and is forecasted to have a compound annual growth rate of 12.8% between 2021 and 2031.[vi] 

I have read that people in economies battling hyperinflation have avoided devaluation of their hard-currency wages by exchanging them for digital currencies, which are then used to pay for food and other products.[vii] In economies with high remittance-based GDPs, cryptocurrency seems to be a fast and reliable way to transfer funds overseas compared to traditional alternatives, which may offer poor exchange rates. Some large financial institutions also appear to recognize opportunities to mobilize in cryptocurrency investing. Small companies seem to acknowledge that cryptocurrency can fill financial access gaps in regions where the traditional finance market is more limited. 

But money attracts thieves! 

Criminality and Cryptocurrency 

Cash has anonymity, but crypto currency does not! Cryptocurrency transactions are traceable through the blockchain, and cryptocurrency wallets are represented by a numbered key rather than held in a natural or legal person’s name. Therefore, KYC is an essential tool in cryptocurrency compliance. 

Blockchain analysis can show the transaction history of a cryptocurrency coin or crypto wallet, but criminals will still find ways to obfuscate their source of funds and identities. The same risk and transaction patterns and factors used in KYC for traditional financial products show evidence of similar criminals, such as money launderers, cybercriminals, and traffickers. These crooks tend to adapt to and use the efficiencies of new technology. 

Vendors that provide wallets to businesses and individuals must aim to have an accurate and perpetual KYC record of persons they are onboarding and servicing. If there are signs of criminality, law enforcement can trace the behavior and know who is behind it. 

As cryptocurrency and its accessibility continue to grow, so does the evidence of criminal activity. International financial compliance regulators such as the Financial Action Task Force (FATF), the Financial Crimes Enforcement Network (FinCEN), and the European Union are taking the lead in developing regulatory approaches to virtual currencies. Although these efforts are critical, regulation is still much too tenuous and loose. Regulations certainly do not maintain international continuity. 

Another transaction medium is a “kiosk” that lets users purchase Bitcoins (and other cryptocurrencies) using cash or a debit card. This “kiosk” is called a Bitcoin Automated Teller Machine (BATM). The BATM is a quickly growing medium that requires regulation. To get a sense of how quickly BATMs are being installed, in June 2022 there were 37,786 BATMs available in seventy-eight countries.[viii] As of today, there are nearly 38,723 BATMs. 

Ratifying policies and procedures for cryptocurrency transactions is “mission critical” to a financial institution involved in cryptocurrency transactions. Frankly, given the lack of comprehensive regulation, it is vital that banks and financial institutions develop their own best practices and manage AML strategies that will mitigate the risks bad actors pose, making sure due diligence is as complete as possible. 

Safe and Risky Features 

You asked about distinguishing between safe and risky features of cryptocurrency. I believe that a primary, reliable measure of risk is traceability. The blockchain provides a record of transactions and ownership. But what if that history is hidden, or nobody is reviewing it? 

And, to be sure, traceability in cryptocurrency and digital assets varies. 

There are several known ways that ownership is obscured in cryptocurrency transactions, and you must ensure that your KYC initiatives account for them. I will provide four examples.

 

1. Mixers

 

Also called tumblers, mixers aim to hide the origin of their users’ funds by obscuring the transaction history of crypto assets. For instance, Bitcoin Fog[ix] allowed users to transfer funds from their crypto wallets into ‘the fog,’ where the assets would be mixed with other users’ currencies to anonymize the funds. After the currencies were mixed, the original user would receive a random number of payouts, each containing a random amount of cryptocurrency.[x]

Mortgage Fraud versus Money Laundering

QUESTION         

We recently completed your AML audit test and found that mortgage fraud and money laundering differ. This became clear when we learned that layering occurred on one of our loans. 

Three people were involved in a mortgage fraud scheme. Two stole the personal information, and the other one used that information to obtain a fraudulent loan. She became our borrower. Once the borrower received the loan's proceeds, some of the funds were transferred to the other two accomplices. We were shocked. 

Our question involves finding out how to identify mortgage fraud as distinct from money laundering. 

What is the difference between fraud and money laundering? 

ANSWER

Conducting the test of the Anti-Money Laundering Program is statutorily required. Each Residential Mortgage Lender and Originator[i] ("RMLO") must adopt a policy and procedure for Anti-Money Laundering in recognition of its obligations under the Bank Secrecy Act ("BSA"), other related money laundering regulations, the requirements of the Financial Crimes Enforcement Network (FinCEN), and federal and state licensing agencies. 

Testing every twelve months is recommended but not later than every eighteen months. An audit of the procedures must be conducted either internally, pursuant to FinCEN guidelines, or by an independent, external auditor entirely independent of the BSA Officer. Most clients retain us to conduct the audit test every twelve months. Our firm was the first in the country to offer AML testing for RMLOs.[ii] 

You can request information about our AML policy, testing, and training HERE. 

Simply stated, fraud creates value for the fraudster. Money laundering is the process by which that value enters the financial system and then moves around within and exits the financial system. 

Money laundering is the criminal practice of processing ill-gotten gains, or "dirty" money, through a series of transactions; in this way, the funds are "cleaned" so that they appear to be proceeds from legal activities. In effect, money laundering is the process of disguising funds derived from illicit activity in order to permit the use of the funds without the detection of the illegal activity that produced the funds. 

Fraud negatively impacts an organization's balance sheet, as the fraud will likely result in a loss of assets. The goal of a fraud is to steal value from the financial services provider. 

On the other hand, money laundering often boosts the balance sheet of a financial institution, as it results in greater use of the organization's products and services and more fee income. Money launderers are accustomed to paying a premium to place their funds in the financial system and often are less sensitive, if not indifferent, to the costs of moving such funds within the financial system. 

FinCEN has amassed substantial data on mortgage fraud. Traditional mortgage fraud involves homebuyers and/or lenders who falsify information to obtain a home loan. Other forms of mortgage fraud have proliferated in recent years and may include a plethora of scams, such as mortgage rescue and loan modification scams, reverse mortgage scams, rent-to-own scams, and bait-and-switch scams. 

Scammers may pose as lawyers, credit counselors, forensic loan auditors, mortgage loan auditors, or foreclosure prevention auditors. Indeed, in our AML tests and risk assessments, we have found that in both money laundering and terrorist financing, criminals can exploit loopholes and other weaknesses in the financial system to launder criminal proceeds, finance terrorism, or conduct other illegal activities, and, ultimately, hide the actual purpose of their activity. 

Terrorist Financing and Money Laundering

Since I'm providing an understanding of the difference between mortgage fraud and money laundering, I think this is a good place to clarify the difference between terrorist financing and money laundering. Many people think they're the same, but that is not true. 

Money laundering and terrorist financing are distinctly different criminal acts. However, as the law enforcement community has investigated how terrorists finance their activities, they have found that money laundering is often a necessary part of financing terrorist efforts. 

Although the motivation differs between traditional money launderers and terrorist financiers, the actual methods used to fund terrorist operations can be the same or similar to those used by other criminals who launder funds. For example, terrorist financiers use currency smuggling, structured deposits or withdrawals from bank accounts, purchases of various types of monetary instruments, credit, debit, or prepaid cards, and funds transfers. 

Getting back to the concept of "clean" funds versus "dirty" funds, terrorist financing may involve either of them. Clean funds are funds obtained from ostensibly legitimate sources, such as personal employment, donations to a charitable organization, or the good faith purchase of goods – the purpose of which is the intention to use or contribute the proceeds therefrom to fund terrorist activities. 

Dirty funds, however, are those obtained through criminal activities. Terrorists have reportedly relied on extortion, kidnapping, narcotics trafficking, smuggling, fraud, theft, robbery, identity theft, and the use of conflict diamonds[iii] to raise money for their activities. 

Money laundering is typically described as occurring in three stages: placement, layering, and integration. However, as more financial transactions are conducted electronically, the lines between the three phases are gradually blurring.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Briefly put, a person who accepts a residential mortgage loan application or offers or negotiates terms of a residential mortgage loan.

[ii] Residential mortgage lenders and originators (RMLOs – known as “mortgage companies” and “mortgage brokers” but not individual loan originators) were subject to the Bank Secrecy Act’s (BSA) anti-money laundering regime pursuant to a regulation published in the Federal Register on February 14, 2012 by FinCEN, a part of Treasury that implements the U.S.’s anti-money laundering regime. Under the new rules, RMLOs are required to develop and implement an anti-money laundering program (AML Program) and begin suspicious activity reporting (SAR filings) by August 13, 2012.

[iii] Conflict diamonds originate from areas controlled by forces or factions opposed to legitimate and internationally recognized governments and are used to fund military action in opposition to those governments, or in contravention of the decisions of the United Nations Security Council.