Report (STR): A local bank filed a suspicious transaction report on a customer and related accounts, after coming across an article in a newspaper that mentioned names of individuals arrested abroad by a foreign law enforcement agency for suspicion in taking part in a ML/TF network and for being affiliated with ISIL.
Analysis and investigation: The SIC initiated its investigation by obtaining all available bank records including KYC forms, bank statements and copies of identification documents from the reporting bank, and also circulated the suspect’s name to all banks and FIs operating in Lebanon. The analysis performed on the account statements identified several cash deposits below the threshold, and payment orders that were not related to the suspect’s line of business that were followed by cash withdrawals. The related accounts reflected a similar pattern of transactions. Furthermore, the SIC analysis revealed that a spontaneous dissemination received from a counterpart FIU, as a result of its own analysis of several STRs filed by an international money remittance company, had also mentioned the same suspect.
Subsequent measures: The SIC decided to lift banking secrecy and freeze the account balances of the suspect at all banks and FIs, and also to freeze any transactions at all money remittance companies. Findings were forwarded to the General Prosecutor for further investigation.
Report (ROA): The SIC received a request of assistance from the Lebanese Internal Security Forces (ISF) which apprehended a suicide bomber before being able to carry out his attack in Lebanon. The ISF was seeking the SIC assistance to identify accounts and transactions of several suspects.
Analysis and investigation: The SIC initiated its investigation by circulating the names of the suspects to all banks and financial institutions operating in Lebanon in an effort to identify bank accounts and transactions. During this period, and while under interrogation by law enforcement authorities, the apprehended suicide bomber provided authorities with names of additional suspects that were involved in two suicide bombings that took place in Lebanon killing innocent civilians and injuring many more. Under interrogation, some of the arrested suspects confessed to have pledged allegiance to ISIL. With this information at hand, the General Prosecutor informed the SIC of his decision to designate 23 individuals on Lebanon’s national terrorism/terrorist financing list. Prior to the actual designation, the SIC circulated all the names, and a number of banks reported having bank accounts for some. The analysis of those bank accounts revealed that they had minimal activity and balances. Furthermore, a money remittance company reported several transactions in prior years.
Subsequent measures: The SIC decided to freeze all the identified accounts. In addition, and since the SIC is empowered by Law to issue the freezing orders on designations, it circulated the names of the suspects to several local agencies including the real estate register, commercial register and vehicle register requesting identification of assets and taking the necessary measures to prevent the use of movable or immovable assets belonging to the individuals to be designated. All the findings were forwarded to the General Prosecutor, and several counterpart FIUs were contacted in this respect.
Report (STR): The AML/CFT compliance officer of a local bank noticed an increase in cash deposits while performing the enhanced due diligence measures for high-risk customers’ accounts as called for in the risk-based approach regulations. One of the accounts reflected repetitive cash deposits followed by checks issued to numerous parties and was kept at a minimum balance. The officer became dissatisfied with the clarifications made to justify the source of the cash deposits, the reason for several bounced checks and the relationship between the account holder and the beneficiaries of the checks. Furthermore, the requested supporting documents received were self-contradictory, misleading and some appeared to be forged. An STR was consequently filed with the SIC.
Analysis & Investigation: The SIC initiated its investigation by analyzing bank records and the account statement obtained from the reporting bank. In addition to the increase in cash deposits which had become inconsistent with the customer’s profession, the analysis of the account movement reflected check deposits with several endorsements, and transactions with unassociated business parties. In an effort to identify other bank accounts related to the suspect, the SIC broadened its investigation and forwarded his name to all banks and financial institutions. Several additional accounts were identified, and the analysis thereof depicted a similar pattern of transactions.
During the course of the investigation, additional information was received from the General Prosecutor on the suspect’s possible involvement in acts of forgery of signature that resulted in both the unlawful use of a bank account and of a checkbook belonging to a relative and business partner.
Subsequent Measures: With the information at hand, the SIC decided to lift banking secrecy and freeze all identified bank accounts. Findings were forwarded to the General Prosecutor.
Report (ROA): The SIC received a request of assistance, via the Egmont Secure Web (ESW), from a European counterpart FIU. The requesting FIU was seeking assistance in an ongoing money laundering and drug trafficking investigation involving several suspects, including two that were Lebanese nationals.
Analysis and investigation: The SIC initiated its investigation by circulating the names of the suspects to all banks and financial institutions operating in Lebanon. Findings revealed the existence of one bank account belonging to one of the suspects. The said account reflected minimal activity, including several cash deposits below the threshold followed by cash withdrawals. The SIC also broadened its investigation and contacted in this regard local law enforcement authorities seeking information on criminal records, convictions and warrants. Information received from the ISF on one of the suspects revealed the existence of several arrest warrants and Interpol communications in prior years for acts of fraud and drug trafficking.
Subsequent measures: The SIC decided to lift banking secrecy, freeze the account balance of the suspect, and forward the findings to the General Prosecutor. The information at hand was also shared with the counterpart FIU.
Report (STR): A longtime customer of a local bank who regularly imports goods from abroad provided the bank with details of an overseas account, and instructed the latter to settle via swift an amount of 250 thousand euros for cost of goods purchased. A few days later, the customer claimed that the payment details were wrong, and that the supplier’s e-mail was hacked. At the same time, the correspondent bank asked for clarifications regarding the same swift. As such, the bank requested from both the correspondent and the receiving bank abroad to return the funds, and filed an STR with the SIC.
Analysis & Investigation: The SIC initiated its investigation by reviewing all relevant records, documents and invoices submitted by the reporting bank, confirming that the supplier’s e-mail was hacked and that the overseas bank account was different from that used in previous settlements. The SIC contacted a European counterpart FIU seeking information on the bank account that received the transfer, and was advised that an individual had opened the account several days prior to receiving the funds. The said transfer was the only transaction credited to the newly opened account and was followed by cash withdrawals and transfers to another bank in the same European country. The first bank was able to block an amount of 170 thousand euros and wire it back. The counterpart FIU advised that in order to recover the remaining funds from the second bank, a mutual legal assistance request was needed. It also provided the name of the account holder at the second European bank, and a search of the SIC database revealed that he was subject to previous cybercrime investigations.
Subsequent Measures: With the information at hand that also included input from the judicial police-cybercrime office, the SIC decided to forward its investigation findings to the General Prosecutor, and highlighted the need for a mutual legal assistance request. The SIC also requested from the counterpart FIU to take the necessary measures to freeze the funds at the second bank.