Four Lists of Red Flag Indicators for Terrorist Financing

1. Financial and Behavioral Indicators Published by The Egmont Group of Financial Intelligence Units

Indicators linked to the financial transactions:

1. The use of funds by the non-profit organization is not consistent with the purpose for which it was established.
2. The transaction is not economically justified considering the account holder’s business or profession.
3. A series of complicated transfers of funds from one person to another as a means to hide the source and intended use of the funds.
4. Transactions which are inconsistent with the account’s normal activity.
5. Deposits were structured below the reporting requirements to avoid detection.
6. Multiple cash deposits and withdrawals with suspicious references.
7. Frequent domestic and international ATM activity.
8. No business rationale or economic justification for the transaction.
9. Unusual cash activity in foreign bank accounts.
10. Multiple cash deposits in small amounts in an account followed by a large wire transfer to another country.
11. Use of multiple, foreign bank accounts.

Behavioral Indicators:

1. The parties to the transaction (owner, beneficiary, etc.) are from countries known to support terrorist activities and organizations.
2. Use of false corporations, including shell-companies.
3. Inclusion of the individual in the United Nations 1267 Sanctions list.
4. Media reports that the account holder is linked to known terrorist organizations or is engaged in terrorist activities.
5. Beneficial owner of the account not properly identified.
6. Use of nominees, trusts, family member or third party accounts.
7. Use of false identification.
8. Abuse of non-profit organization.

2. Potentially Suspicious Activity That May Indicate Terrorist Financing Published in the FFIEC BSA/AML Examination Manual

Activity Inconsistent With the Customer’s Business:

1. Funds are generated by a business owned by persons of the same origin or by a business that involves persons of the same origin from higher-risk countries (e.g., countries designated by national authorities and FATF as noncooperative countries and territories).
2. The stated occupation of the customer is not commensurate with the type or level of activity.
3. Persons involved in currency transactions share an address or phone number, particularly when the address is also a business location or does not seem to correspond to the stated occupation (e.g., student, unemployed, or self-employed).
4. Regarding nonprofit or charitable organizations, financial transactions occur for which there appears to be no logical economic purpose or in which there appears to be no link between the stated activity of the organization and the other parties in the transaction.
5. A safe deposit box opened on behalf of a commercial entity when the business activity of the customer is unknown or such activity does not appear to justify the use of a safe deposit box.
6. Funds Transfers:
7. A large number of incoming or outgoing funds transfers take place through a business account, and there appears to be no logical business or other economic purpose for the transfers, particularly when this activity involves higher-risk locations.
8. Funds transfers are ordered in small amounts in an apparent effort to avoid triggering identification or reporting requirements.
9. Funds transfers do not include information on the originator, or the person on whose behalf the transaction is conducted, when the inclusion of such information would be expected.
10. Multiple personal and business accounts or the accounts of nonprofit organizations or charities are used to collect and funnel funds to a small number of foreign beneficiaries.
11. Foreign exchange transactions are performed on behalf of a customer by a third party, followed by funds transfers to locations having no apparent business connection with the customer or to higher-risk countries.
12. Other Transactions That Appear Unusual or Suspicious:
13. Transactions involving foreign currency exchanges are followed within a short time by funds transfers to higher-risk locations.
14. Multiple accounts are used to collect and funnel funds to a small number of foreign beneficiaries, both persons and businesses, particularly in higher-risk locations.
15. A customer obtains a credit instrument or engages in commercial financial transactions involving the movement of funds to or from higher-risk locations when there appear to be no logical business reasons for dealing with those locations.
16. Banks from higher-risk locations open accounts.
17. Funds are sent or received via international transfers from or to higher-risk locations.
18. Insurance policy loans or policy surrender values that are subject to a substantial surrender charge.

3. Financial Red Flags Published by DML Associates LLC:

Dennis Lormel, founder and president of DML Associates, LLC, established and directed the FBI’s terrorist financing initiative following the terrorist attacks of September 11, 2001.

1. IP logins in areas of conflict such as near the Syrian border, to include Jordan and Lebanon, but particularly in Turkey
2. Periods of transaction dormancy, which could be the result of terrorist training or engagement in combat
3. ATM cash withdrawals in areas of conflict
4. Wire transfers to areas of conflict
5. Charitable activity in areas of conflict especially in Syria
6. Financial activity identifiable with travel [purchase of airline tickets] to Syria through Turkey and other points of entry to include Jordan, Lebanon and Israel

4. Terrorist Activity Financing Related Indicators Published by FINTRAC (Canada’s Financial Intelligence Unit)

FINTRAC (Financial Transactions and Reports Analysis Centre of Canada) noted that a single indicator on its own may seem insignificant, but combined with others, could provide reasonable grounds to suspect that the transaction is related to terrorist financing activity.

1. Client accesses accounts, and/or uses debit or credit cards in high risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations.
2. Client identified by media or law enforcement as having travelled, attempted/intended to travel to high risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations.
3. Client conducted travel-related purchases (e.g. purchase of airline tickets, travel visa, passport, etc.) linked to high-risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations.
4. The client mentions that they will be travelling to, are currently in, or have returned from, a high risk jurisdiction (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations.
5. Client depletes account(s) by way of cash withdrawal.
6. Client or account activity indicates the sale of personal property/possessions.
7. Individual/Entity’s online presence supports violent extremism or radicalization.
8. Client indicates planned cease date to account activity.
9. Client utters threats of violence that could be of concern to National Security/Public Safety.
10. Sudden settlement of debt(s) or payments of debts by unrelated 3rd party(ies).
11. Law enforcement indicates to reporting entity that the individual/entity may be relevant to a law enforcement and/or national security investigation.
12. Client’s transactions involve individual(s)/entity(ies) identified by media or law enforcement as the subject of a terrorist financing or national security investigation.
13. Client donates to a cause that is subject to derogatory publicly available information (crowdfunding initiative, charity, NPO, NGO, etc.).
14. Client conducts uncharacteristic purchases (e.g. camping/outdoor equipment, weapons, ammonium nitrate, hydrogen peroxide, acetone, propane, etc.).
15. A large number of email transfers between client and unrelated 3rd party(ies).
16. Client provides multiple variations of name, address, phone number or additional identifiers.
17. The sudden conversion of financial assets to a virtual currency exchange or virtual currency intermediary that allows for increased anonymity.

Since counter-terrorist financing is of such vital importance for financial institutions in today’s global environment, I have also provided the red flags indicators noted above as PDF documents which can be downloaded and conveniently shared with colleagues in your institution. I hope I have succeeded in heightening the awareness among financial institutions that tracking and reporting suspicious bank transactions can enhance efforts to counter terrorism.

Downloads:

Egmont Group – FIUs and Terrorist Financing Analysis = http://bit.ly/1g7Tdkt

FFIEC BSA-AML Examination Manual – Terrorist Financing Red Flags = http://bit.ly/1JgMmk1