Report (STR): A local bank filed a suspicious transaction report with the SIC concerning a customer who instructed the bank to transfer an amount to his supplier in a European country. Following the execution of the transfer, the customer discovered that the e-mail of his supplier had been compromised and that the payment instructions he acted on originated from a hacker and not the supplier.
Subsequent Measures: The SIC forwarded the findings to the General Prosecutor suggesting that the judicial police-cybercrime office also further investigate the matter, and also asked the counterpart FIU for additional information.
Report (ROA): The SIC received a request of assistance from the Lebanese General Prosecutor concerning a suspect who is employed with a government agency. The suspect was charged with abusing his job, embezzlement of public funds, fraud and also for receiving bribes to facilitate sales contracts, fees exemption and tax evasion. Banking information among other things were needed to complement the ongoing investigation, and accordingly the SIC assistance was sought.
Analysis and Investigation: In order to identify transactions and bank accounts, the SIC circulated the name of the suspect to all banks, financial institutions and money remittance companies operating in Lebanon. The SIC also contacted the real estate register for information on the suspect’s real estate ownership. Two bank accounts belonging to the suspect were identified. The analysis performed on the obtained account statements revealed unjustified cash and check deposits followed by check withdrawals. One money remittance company also reported a few incoming and outgoing remittances.
Subsequent Measures: During the investigations, and as a precautionary measure, the SIC decided to freeze the balances of the two identified accounts, placed an encumbrance on all properties owned by the suspect, and requested from all money remittance companies not to perform any transaction for the suspect. The SIC decided to lift banking secrecy off the identified bank accounts and forward the investigation findings to the General Prosecutor for further investigation.
Report (STR): The SIC received two suspicious transaction reports from two local banks concerning the same customer who owns several companies in Lebanon. The compliance officers at the two banks didn’t receive any justifications or supporting documents from the said customer regarding certain accusations and suspicious account activity. The first bank became suspicious of the customer after coming across an article in the newspaper that mentioned the customer as being detained for corruption and bribing government officials in order to cover up for illicit acts committed by others, including drug trafficking. The second bank became suspicious after realizing that the customer’s companies accounts were being used as transitory accounts, and that almost all cash deposits were withdrawn directly in checks.
Analysis and Investigation: The SIC initiated its investigation by obtaining all available bank records including KYC forms, bank statements and copies of identification documents from the two reporting banks. In the first bank, multiple cash deposits below the threshold were executed on the customer’s account, and this activity was presented as being proceeds from real estate transactions. Checks deposited in his account were from individuals where no business relationship could be established. The analysis of his companies’ accounts at the second bank revealed that cash deposits were followed by cash and check withdrawals, and the relationship with the beneficiaries of the issued checks couldn’t also be established. During the investigation, further information on the suspect was received from local law enforcement authorities. The SIC decided to circulate the suspect’s name to all banks, financial institutions and money remittance companies operating in Lebanon to identify bank accounts and transactions. One additional bank reported having accounts for the suspect and his companies. The analysis performed on the accounts’ statements reflected a similar pattern of transactions.
Subsequent Measures: With the findings at hand, the SIC decided to lift banking secrecy off the identified bank accounts and forward the investigation findings to the General Prosecutor for further investigation.
Report (STR): While updating KYC forms for a number of dormant customers’ accounts, the compliance officer at a local bank tried to contact a customer using address details on file. The compliance officer was informed that the address details were no longer valid, and that law enforcement authorities had also tried to reach the said customer who has arrest warrants issued against him for being affiliated with ISIL. The bank consequently filed an STR with the SIC.
Subsequent Measures: The SIC decided to lift banking secrecy off the identified bank account and forward the findings to the General Prosecutor for further investigation.
Report (ROA): During 2019, a terrorist attack took place in Northern Lebanon and resulted in the death of law enforcement officers, army personnel and the injury of several civilians. The terrorist, known to be affiliated with ISIL, opened fire on army personnel, and blew himself up after a pursuit and confrontation with law enforcement officers. The Lebanese General Prosecutor sought the SIC assistance in order to identify any related bank accounts and transactions pertaining to the terrorist and related individuals arrested for interrogation.
Analysis and Investigation: The SIC initiated its investigation by circulating the names of the terrorist and related individuals to all banks, financial institutions and money remittance companies operating in Lebanon. No bank accounts or real estate ownership were identified for the terrorist, but two money remittance companies reported two incoming remittances in minimal amounts in prior years. A counterpart FIU was contacted in this regard. Investigations conducted by law enforcement authorities made available to the SIC revealed that in order to carry out the attack, the terrorist sold his house furniture and used the proceeds to self-finance his attack. Furthermore, the terrorist did not receive instructions from ISIL leaders but instead committed what was described as a “lone wolf” operation after having served time in jail for joining ISIL in Syria.
Subsequent Measures: The SIC requested from all money remittance companies not to perform any transaction for any of the related individuals under interrogation and forwarded the findings to the Lebanese General Prosecutor.