Suspicious Activities Detection -

Suspicious Activities Detection

Anti-Financial Crime

November 12, 2024

The authors

Negin Ajam Senior Legal Officer

Leila Hosseingholizadeh Senior AML Consultant

Introduction

Identifying suspicious activities is a cornerstone of combating money laundering, helping Obliged Entities (OEs) detect and deter fraud and other illicit activities. To this end, OEs must closely monitor high-risk criteria to flag transactions or behaviours that deviate from standard patterns. All red flags should be investigated to determine whether they represent legitimate transactions or warrant further scrutiny. This proactive approach protects OEs from regulatory penalties, minimizes reputational damage, and upholds the integrity of the financial system. The following sections discuss the process of suspicious activity identification in the context of the German Money Laundering Act (GwG) framework.

A. Suspicious Activities of Customers and High-Risk Criteria according to the German Money Laundering Act (GwG)

According to Section 43(1) of the GwG, any indication that suggests a property or a transaction may originate from a criminal act, potentially serving as a precursor to money laundering or involving terrorist financing, must be reported promptly to the German Financial Intelligence Unit (FIU). Additionally, if a client fails to disclose to an OE whether it intends to establish, continue or conduct a business relationship or transaction on behalf of a beneficial owner, the OE is required to report these incidents to the FIU.

This raises the question: what is classified as a suspicious activity or one step behind, a red flag? The GwG outlines various high-risk criteria for Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) that can help identify factors indicative of suspicious activities (Sections 10, 14, and 15 of the GwG, as well as Annex 2). Additionally, the Interpretation and Application Guidance on the GwG elaborates on these provisions, highlighting three key factors critical to assessing the potentially suspicious nature of an activity:

1. The customer (including their financial and business background) and the source of the customer’s wealth are essential factors to effectively identify suspicious activities related to the customer. It is crucial to pay close attention to the following factors:

a) Being a PEP, a family member, or a close associate of a PEP.
b) Possessing or being involved in high-risk occupations or activities as cash-intensive businesses like gambling, or personal asset management.
c) Being a natural or legal person residing in a geographically high-risk area as defined by the European Commission Directive (EU) 2015/849.
d) Being a legal person with nominee shareholders or shares in bearer form.
e) Being a legal person with an overly complex or unusual ownership structure.

2. The transaction (its nature, purpose, and delivery channel) i.e. plays a crucial role. Examples include:

a) Products or transactions that could enable anonymity, such as virtual currencies, prepaid cards, and cash equivalents like money orders or traveller’s checks.
b) Remote business interactions or transactions without particular protections, such as electronic signatures.
c) Receiving payment from individuals or entities with whom there is no prior business relationship or association.
d) Transactions that are complex or large, for example, if the origin or worth of assets, or the recipient of a transaction, does not align with the customer's known personal or business activities, or if the provided information is unclear or challenging to confirm.
e) The transaction displaying an unusual or complicated pattern.

3. Geographical risk factors: when customers reside in or engage with high-risk geographical areas or maintain or utilize accounts with financial institutions based in these regions, it raises red flags. Additionally, any business activities, investments, or connections in these areas warrant careful scrutiny. The risk factors include:

a) Countries with ineffective or inadequate systems for preventing and detecting money laundering.
b) Countries with significant levels of criminal activities or support for terrorist activities.
c) Countries subject to regional or international sanctions.

B. Identifying Suspicious Behaviour of Customers (Red Flags)

As elucidated in the previous section, the GwG places significant responsibilities on OEs regarding the identification of high-risk factors through CDD and ECDD and subsequently identifying suspicious activities.

Red flags may arise from one or a combination of the previously mentioned risk categories, identified through risk assessment or monitoring of customer behaviour. Subsequently, all red flags should undergo a thorough investigation, and if there are reasonable grounds for suspicion, they must be reported. Therefore, it is crucial to conduct risk assessments on the customers and monitor their behaviour throughout the ongoing customer relationship to find suspicious, sudden, or frequent changes in their behaviour. Here are some examples of red flags which might lead to an obligation to report as suspicious behaviour:

Complex Ownership Structures: Customers using complex business or ownership structures or offshore entities with no apparent legitimate business purpose.

Transactions Involving High-Risk Countries: When the transaction involves high-risk countries, or sanctioned persons or organizations.

Inconsistent Financial Activity: A customer’s account balances, or activity significantly exceed their typical levels or frequency, or a customer engages in transactions that are notably larger or more frequent than their typical pattern.

Frequent Large Cash Transactions: Regular deposits or withdrawals of substantial amounts of cash, which could indicate an attempt to avoid scrutiny or launder money.

Reluctance to Provide Information: Customers who are unwilling or hesitant to provide necessary identification or transaction details when requested by financial institutions.

Multiple Accounts with Minimal Activity: Customers open numerous accounts with little to no activity, which could be used to facilitate illicit transactions or disguise funds.

It is essential to recognize that, as stipulated in the GwG, the list of customers’ suspicious behaviours and high-risk factors provided above is not exhaustive and may encompass other criteria or scenarios.