Report (STR): The SIC received from a local bank a suspicious transaction report concerning a customer who instructed the bank to execute a cross border transfer to a European based supplier who maintained an account with a foreign bank. Following the execution of the transfer, the customer who frequently has business dealings with foreign suppliers of material discovered that the supplier’s email was compromised, and that the payment instructions he acted on originated from a hacker. 

Analysis and Investigation: The SIC initiated its investigation by reviewing all bank records, documents and invoices submitted by the reporting bank and decided to contact a European FIU to seek information on the foreign bank account that received the transfer. The information gathered from the counterpart FIU indicated that the account was for an individual who was subject to an ongoing money laundering investigation, and was not for the intended supplier. The counterpart FIU stated that the amount of the transfer was blocked following a police investigation and that they await a written request from the victim requesting the funds to be returned. 

Subsequent Measures: The SIC forwarded to the counterpart FIU a copy of the law suit filed against the hacker that described the case, and also a written request from the customer asking for the transferred amount to be returned. As a result of the SIC cooperation with its counterpart FIU, the funds were seized and returned. The entire investigation findings were also forwarded to the General Prosecutor.

Report (STR): A local bank filed a suspicious transaction report on three related customers whose accounts reflected an unusual and similar pattern of multiple cash deposits followed later on by ATM cash withdrawals in a country bordering the ISIL conflict zone. When the bank asked for clarification, the customers stated that it was done to avoid travelling with cash. The bank requested that the customers stop this activity and provide further supporting documents to justify the source of cash deposits. The customers provided no additional supporting documents and refrained from using the accounts that were later closed. 

Analysis and Investigation: The SIC initiated its investigation by circulating the names of the suspects to all banks and financial institutions operating in Lebanon in an effort to identify whether or not they had transactions or maintained other bank accounts. Two banks reported having accounts for the suspects and a money remittance company provided information on transactions. The analysis performed on the suspects’ statements of accounts reflected cash deposits and ATM cash withdrawals abroad, along with other types of transactions. 

Subsequent Measures: Since similar transactions have been associated with TF indicators according to typology reports and studies undertaken by international bodies, the SIC decided to forward the findings to the General Prosecutor for further investigation. Simultaneously, the SIC also contacted a counterpart FIU on the matter, providing it with the information at hand and seeking information on the suspects.

Report (ROA): The SIC received a request of assistance from the Lebanese Internal Security Forces (ISF) which apprehended a suicide bomber before being able to carry out his attack in Lebanon. The ISF was seeking the SIC assistance to identify accounts and transactions of several suspects.

Analysis and investigation: The SIC initiated its investigation by circulating the names of the suspects to all banks and financial institutions operating in Lebanon in an effort to identify bank accounts and transactions. During this period, and while under interrogation by law enforcement authorities, the apprehended suicide bomber provided authorities with names of additional suspects that were involved in two suicide bombings that took place in Lebanon killing innocent civilians and injuring many more. Under interrogation, some of the arrested suspects confessed to have pledged allegiance to ISIL. With this information at hand, the General Prosecutor informed the SIC of his decision to designate 23 individuals on Lebanon’s national terrorism/terrorist financing list. Prior to the actual designation, the SIC circulated all the names, and a number of banks reported having bank accounts for some. The analysis of those bank accounts revealed that they had minimal activity and balances. Furthermore, a money remittance company reported several transactions in prior years. 

Subsequent measures: The SIC decided to freeze all the identified accounts. In addition, and since the SIC is empowered by Law to issue the freezing orders on designations, it circulated the names of the suspects to several local agencies including the real estate register, commercial register and vehicle register requesting identification of assets and taking the necessary measures to prevent the use of movable or immovable assets belonging to the individuals to be designated. All the findings were forwarded to the General Prosecutor, and several counterpart FIUs were contacted in this respect.