Report (STR): A local bank filed a suspicious transaction report on a customer and related accounts, after coming across an article in a newspaper that mentioned names of individuals arrested abroad by a foreign law enforcement agency for suspicion in taking part in a ML/TF network and for being affiliated with ISIL.

Analysis and investigation: The SIC initiated its investigation by obtaining all available bank records including KYC forms, bank statements and copies of identification documents from the reporting bank, and also circulated the suspect’s name to all banks and FIs operating in Lebanon. The analysis performed on the account statements identified several cash deposits below the threshold, and payment orders that were not related to the suspect’s line of business that were followed by cash withdrawals. The related accounts reflected a similar pattern of transactions. Furthermore, the SIC analysis revealed that a spontaneous dissemination received from a counterpart FIU, as a result of its own analysis of several STRs filed by an international money remittance company, had also mentioned the same suspect. 

Subsequent measures: The SIC decided to lift banking secrecy and freeze the account balances of the suspect at all banks and FIs, and also to freeze any transactions at all money remittance companies. Findings were forwarded to the General Prosecutor for further investigation.

Report (STR): The AML/CFT compliance officer of a local bank noticed an increase in cash deposits while performing the enhanced due diligence measures for high-risk customers’ accounts as called for in the risk-based approach regulations. One of the accounts reflected repetitive cash deposits followed by checks issued to numerous parties and was kept at a minimum balance. The officer became dissatisfied with the clarifications made to justify the source of the cash deposits, the reason for several bounced checks and the relationship between the account holder and the beneficiaries of the checks. Furthermore, the requested supporting documents received were self-contradictory, misleading and some appeared to be forged. An STR was consequently filed with the SIC. 

Analysis & Investigation: The SIC initiated its investigation by analyzing bank records and the account statement obtained from the reporting bank. In addition to the increase in cash deposits which had become inconsistent with the customer’s profession, the analysis of the account movement reflected check deposits with several endorsements, and transactions with unassociated business parties. In an effort to identify other bank accounts related to the suspect, the SIC broadened its investigation and forwarded his name to all banks and financial institutions. Several additional accounts were identified, and the analysis thereof depicted a similar pattern of transactions. 

During the course of the investigation, additional information was received from the General Prosecutor on the suspect’s possible involvement in acts of forgery of signature that resulted in both the unlawful use of a bank account and of a checkbook belonging to a relative and business partner. 

Subsequent Measures: With the information at hand, the SIC decided to lift banking secrecy and freeze all identified bank accounts. Findings were forwarded to the General Prosecutor.

Report (STR): A longtime customer of a local bank who regularly imports goods from abroad provided the bank with details of an overseas account, and instructed the latter to settle via swift an amount of 250 thousand euros for cost of goods purchased. A few days later, the customer claimed that the payment details were wrong, and that the supplier’s e-mail was hacked. At the same time, the correspondent bank asked for clarifications regarding the same swift. As such, the bank requested from both the correspondent and the receiving bank abroad to return the funds, and filed an STR with the SIC. 

Analysis & Investigation: The SIC initiated its investigation by reviewing all relevant records, documents and invoices submitted by the reporting bank, confirming that the supplier’s e-mail was hacked and that the overseas bank account was different from that used in previous settlements. The SIC contacted a European counterpart FIU seeking information on the bank account that received the transfer, and was advised that an individual had opened the account several days prior to receiving the funds. The said transfer was the only transaction credited to the newly opened account and was followed by cash withdrawals and transfers to another bank in the same European country. The first bank was able to block an amount of 170 thousand euros and wire it back. The counterpart FIU advised that in order to recover the remaining funds from the second bank, a mutual legal assistance request was needed. It also provided the name of the account holder at the second European bank, and a search of the SIC database revealed that he was subject to previous cybercrime investigations. 

Subsequent Measures: With the information at hand that also included input from the judicial police-cybercrime office, the SIC decided to forward its investigation findings to the General Prosecutor, and highlighted the need for a mutual legal assistance request. The SIC also requested from the counterpart FIU to take the necessary measures to freeze the funds at the second bank.