Annex 1. Red Flag Indicators for TF and PF
Accurately identifying and assessing the TF and PF risks of a customer or business relationship is critical for appropriately managing these risks. A single indicator on its own may seem insignificant, but when combined with others it could provide reasonable grounds to suspect that the transaction is related to TF or PF activity.
1. Red Flag Indicators for TF7
Potentially Suspicious Activity That May Indicate Terrorist Financing Published in the FFIEC BSA/AML Examination Manual5
Activity Inconsistent with the Customer’s Business:
• Funds are generated by a business owned by persons of the same origin or by a business that involves persons of the same origin from higher-risk countries (e.g., countries designated by national authorities and FATF as non-cooperative countries and territories). • The stated occupation of the customer is not commensurate with the type or level of activity. • Persons involved in currency transactions share an address or phone number, particularly when the address is also a business location or does not seem to correspond to the stated occupation (e.g., student, unemployed, or self-employed). • Regarding nonprofit or charitable organizations, financial transactions occur for which there appears to be no logical economic purpose or in which there appears to be no link between the stated activity of the organization and the other parties in the transaction. • A safe deposit box opened on behalf of a commercial entity when the business activity of the customer is unknown or such activity does not appear to justify the use of a safe deposit box.
Funds Transfers:
• A large number of incoming or outgoing funds transfers take place through a business account, and there appears to be no logical business or other economic purpose for the transfers, particularly when this activity involves higher-risk locations. • Funds transfers are ordered in small amounts in an apparent effort to avoid triggering identification or reporting requirements. • Funds transfers do not include information on the originator, or the person on whose behalf the transaction is conducted, when the inclusion of such information would be expected. • Multiple personal and business accounts or the accounts of nonprofit organizations or charities are used to collect and funnel funds to a small number of foreign beneficiaries. • Foreign exchange transactions are performed on behalf of a customer by a third party, followed by funds transfers to locations having no apparent business connection with the customer or to higher-risk countries.
Other Transactions That Appear Unusual or Suspicious:
• Transactions involving foreign currency exchanges are followed within a short time by funds transfers to higher-risk locations. • Multiple accounts are used to collect and funnel funds to a small number of foreign beneficiaries, both persons and businesses, particularly in higher-risk locations. • A customer obtains a credit instrument or engages in commercial financial transactions involving the movement of funds to or from higher-risk locations when there appear to be no logical business reasons for dealing with those locations. • Banks from higher-risk locations open accounts. • Funds are sent or received via international transfers from or to higher-risk locations. • Insurance policy loans or policy surrender values that are subject to a substantial surrender charge.
Terrorist Financing Indicators Published by FINTRAC (Canada’s Financial Intelligence Unit)6
• Transactions involving certain high-risk jurisdictions such as locations in the midst of or in proximity to, armed conflict where terrorist groups operate or locations which are subject to weaker ML/TF controls. • An account opened in the name of an entity, a foundation or association, which may be linked or involved with a suspected terrorist organization. • The use of funds by a non-profit organization is not consistent with the purpose for which it was established. • Raising donations in an unofficial or unregistered manner. • Client identified by media or law enforcement as having travelled, attempted or intended to travel to high-risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations. • Transactions involve individual(s) or entity(ies) identified by media and/or Sanctions List as being linked to a terrorist organization or terrorist activities. • Law enforcement information provided which indicates individual(s) or entity(ies) may be linked to a terrorist organization or terrorist activities. • Client conducted travel-related purchases (e.g. purchase of airline tickets, travel visa, passport, etc.) linked to high-risk jurisdictions (including cities or districts of concern), specifically countries (and adjacent countries) under conflict and/or political instability or known to support terrorist activities and organizations. • Individual or entity's online presence supports violent extremism or radicalization. • Client donates to a cause that is subject to derogatory information that is publicly available (e.g. crowdfunding initiative, charity, non-profit organization, non-government organization, etc.).
5 Available at: https://bsaaml.ffiec.gov/manual/Appendices/07
6 Available at: https://www.fintrac-canafe.gc.ca/guidance-directives/transaction-operation/indicators-indicateurs/fin_mltf-eng2. Red Flag Indicators for PF
(i) Transaction involves person or entity in foreign country of proliferation concern. (ii) Transaction involves person or entity in foreign country of diversion concern. (iii) The customer or counterparty or its address is similar to one of the parties found on publicly available lists of “denied persons” or has a history of export control contraventions. (iv) Customer activity does not match business profile, or end-user information does not match end-user’s business profile. (v) A freight forwarding firm is listed as the product’s final destination. (vi) Order for goods is placed by firms or persons from foreign countries other than the country of the stated end-user. (vii) Transaction involves shipment of goods incompatible with the technical level of the country to which it is being shipped, (e.g. semiconductor manufacturing equipment being shipped to a country that has no electronics industry). (viii) Transaction involves possible shell companies (e.g. companies do not have a high level of capitalisation or displays other shell company indicators). (ix) Transaction demonstrates links between representatives of companies exchanging goods i.e. same owners or management. (x) Circuitous route of shipment (if available) and/or circuitous route of financial transaction. (xi) Trade finance transaction involves shipment route (if available) through country with weak export control laws or weak enforcement of export control laws. (xii) Transaction involves persons or companies (particularly trading companies) located in countries with weak export control laws or weak enforcement of export control laws. (xiii) Transaction involves shipment of goods inconsistent with normal geographic trade patterns (e.g. does the country involved normally export/import good involved?). (xiv) Transaction involves financial institutions with known deficiencies in AML/CFT controls and/or domiciled in countries with weak export control laws or weak enforcement of export control laws. (xv) Based on the documentation obtained in the transaction, the declared value of the shipment was obviously under-valued vis-à-vis the shipping cost. (xvi) Inconsistencies in information contained in trade documents and financial flows, such as names, companies, addresses, final destination etc. (xvii) Pattern of wire transfer activity that shows unusual patterns or has no apparent purpose. (xviii) Customer vague/incomplete on information it provides, resistant to providing additional information when queried. (xix) New customer requests letter of credit transaction awaiting approval of new account. (xx) Wire instructions or payment from or due to parties not identified on the original letter of credit or other documentation. (xxi) Involvement of items controlled under WMD export control regimes or national control regimes. (xxii) Involvement of a person connected with a country of proliferation concern (e.g. a dual-national), and/or dealing with complex equipment for which he/she lacks technical background. (xxiii) Use of cash or precious metals (e.g. gold) in transactions for industrial items. (xxiv) Involvement of a small trading, brokering or intermediary company, often carrying out business inconsistent with their normal business. (xxv) Involvement of a customer or counterparty, declared to be a commercial business, whose transactions suggest they are acting as a money-remittance business. (xxvi) Transactions between companies on the basis of “ledger” arrangements that obviate the need for international financial transactions. (xxvii) Customers or counterparties to transactions are linked (e.g. they share a common physical address, IP address or telephone number, or their activities may be coordinated). (xxviii) Involvement of a university in a country of proliferation concern. (xxix) Description of goods on trade or financial documentation is nonspecific, innocuous or misleading. (xxx) Evidence that documents or other representations (e.g. relating to shipping, customs, or payment) are fake or fraudulent. (xxxi) Use of personal account to purchase industrial items.
7 Available at: fatf guidance on proliferation financing (fatf-gafi.org)
3. Red Flag Indicators for Potential Sanctions Circumventions
Some Red Flags or Situations to Identify Potential Sanctions Circumventions Published in the Executive Office’s “Typologies on the circumvention of Targeted Sanctions against Terrorism and the Proliferation of Weapons of Mass Destruction” 8
The following are some red flags or situations that could be looked at more closely or monitored by financial institutions and designated non-financial businesses or professions to identify potential sanctions circumventions of your clients, their business, or their transactions.
• Dealings in sectors vulnerable for terrorist financing and/or proliferation of weapons of mass destructions, for example o Financial sector o Hawalas or other money transfer services providers o Oil and gas sector o Non-profit organizations o International trade • Dealings, directly or through a client of your client, with high-risk countries for terrorism financing. • Dealings, directly or through a client of your client, with sanctioned countries or territories where sanctioned persons are known to operate. • The use of shell companies through which funds can be moved locally and internationally by misappropriating the commercial sector in the UAE. • Dealings with sanctioned goods or under embargo. For example: o Weapons o Oil or other commodities o Luxury goods (for DPRK sanctions) • Dealings with dual-used goods. • Dealings with controlled substances. • Identifying documents that seemed to be forged or counterfeited. • Identifying tampered or modified documents with no apparent explanation, especially those related to international trade. • Use of intermediaries. • When the flows of funds exceed those of normal business (revenues or turnover). • The activity developed or financed does not relate to the original or intended purpose of the company o entity. For example: • For companies, they are importing high-end technology devices, but they are registered as a company that commercializes nuts. • For a non-profit organization, they are exporting communication devices, but they are an entity aimed to provide health services. • Very complex commercial or business deals that seem to be aiming to hide the final destiny of the transaction or the good. • Complex legal entities or arrangements that seem to be aiming to hide the beneficial owner. • Carrying out of multiple ATM cash withdrawals in short succession (potentially below the daily cash reporting threshold) across various locations in territories where sanctioned people have influence or in the border of sanctioned countries. • Irregularities during the CDD process which could include, but is not limited to: o Inaccurate information about the source of funds and/or the relationship with the counterparty. o Refusal to honor requests to provide additional KYC documentation or to provide clarity on the final beneficiary of the funds or goods. o Suspicion of forged identity documents
8 Available at https://www.uaeiec.gov.ae/en-us/un-page#