Report (STR): The SIC received from a local bank a suspicious transaction report concerning a customer who instructed the bank to execute a cross border transfer to a European based supplier who maintained an account with a foreign bank. Following the execution of the transfer, the customer who frequently has business dealings with foreign suppliers of material discovered that the supplier’s email was compromised, and that the payment instructions he acted on originated from a hacker.
Analysis and Investigation: The SIC initiated its investigation by reviewing all bank records, documents and invoices submitted by the reporting bank and decided to contact a European FIU to seek information on the foreign bank account that received the transfer. The information gathered from the counterpart FIU indicated that the account was for an individual who was subject to an ongoing money laundering investigation, and was not for the intended supplier. The counterpart FIU stated that the amount of the transfer was blocked following a police investigation and that they await a written request from the victim requesting the funds to be returned.
Subsequent Measures: The SIC forwarded to the counterpart FIU a copy of the law suit filed against the hacker that described the case, and also a written request from the customer asking for the transferred amount to be returned. As a result of the SIC cooperation with its counterpart FIU, the funds were seized and returned. The entire investigation findings were also forwarded to the General Prosecutor.
Report (STR): A local bank filed a suspicious transaction report with the SIC on a customer who was a previous government employee. The bank became suspicious of the customer’s account after a number of transactions seemed inconsistent with his profile, and after not receiving any justifications or supporting documents regarding multiple cash deposits that were under the threshold. Furthermore, an article in a newspaper mentioned the name of the customer among other names as being accused of receiving bribes to secure unlawful employment in a governmental agency.
Analysis and Investigation: The SIC initiated its investigation by obtaining from the reporting bank all available records including the KYC form, bank statements and copies of identification documents. The analysis revealed that in addition to the increase in cash deposits, most of the checks deposited in the account were from unrelated parties, including from a person subject to a previous STR filed by a bank. During the investigation, the SIC received a request of assistance from a judicial authority on the suspect for soliciting and taking bribes, seeking the SIC assistance in identifying bank accounts. With the findings at hand, the SIC decided to circulate the suspect’s name to all ban ks and financial institutions operating in Lebanon, and contacted several other national agencies, including the real estate register.
Subsequent Measures: The SIC froze the balances of the identified bank accounts, placed an encumbrance on properties owned by the suspect, requested from all money remittance companies not to perform any transaction for the suspect, and the findings were forwarded to the General Prosecutor for further investigation.
Report (STR): A local bank filed a suspicious transaction report on three related customers whose accounts reflected an unusual and similar pattern of multiple cash deposits followed later on by ATM cash withdrawals in a country bordering the ISIL conflict zone. When the bank asked for clarification, the customers stated that it was done to avoid travelling with cash. The bank requested that the customers stop this activity and provide further supporting documents to justify the source of cash deposits. The customers provided no additional supporting documents and refrained from using the accounts that were later closed.
Analysis and Investigation: The SIC initiated its investigation by circulating the names of the suspects to all banks and financial institutions operating in Lebanon in an effort to identify whether or not they had transactions or maintained other bank accounts. Two banks reported having accounts for the suspects and a money remittance company provided information on transactions. The analysis performed on the suspects’ statements of accounts reflected cash deposits and ATM cash withdrawals abroad, along with other types of transactions.
Subsequent Measures: Since similar transactions have been associated with TF indicators according to typology reports and studies undertaken by international bodies, the SIC decided to forward the findings to the General Prosecutor for further investigation. Simultaneously, the SIC also contacted a counterpart FIU on the matter, providing it with the information at hand and seeking information on the suspects.
Report (STR): A local bank filed a suspicious transaction report on a customer and related accounts, after coming across an article in a newspaper that mentioned names of individuals arrested abroad by a foreign law enforcement agency for suspicion in taking part in a ML/TF network and for being affiliated with ISIL.
Analysis and investigation: The SIC initiated its investigation by obtaining all available bank records including KYC forms, bank statements and copies of identification documents from the reporting bank, and also circulated the suspect’s name to all banks and FIs operating in Lebanon. The analysis performed on the account statements identified several cash deposits below the threshold, and payment orders that were not related to the suspect’s line of business that were followed by cash withdrawals. The related accounts reflected a similar pattern of transactions. Furthermore, the SIC analysis revealed that a spontaneous dissemination received from a counterpart FIU, as a result of its own analysis of several STRs filed by an international money remittance company, had also mentioned the same suspect.
Subsequent measures: The SIC decided to lift banking secrecy and freeze the account balances of the suspect at all banks and FIs, and also to freeze any transactions at all money remittance companies. Findings were forwarded to the General Prosecutor for further investigation.
Report (ROA): The SIC received a request of assistance from the Lebanese Internal Security Forces (ISF) which apprehended a suicide bomber before being able to carry out his attack in Lebanon. The ISF was seeking the SIC assistance to identify accounts and transactions of several suspects.
Analysis and investigation: The SIC initiated its investigation by circulating the names of the suspects to all banks and financial institutions operating in Lebanon in an effort to identify bank accounts and transactions. During this period, and while under interrogation by law enforcement authorities, the apprehended suicide bomber provided authorities with names of additional suspects that were involved in two suicide bombings that took place in Lebanon killing innocent civilians and injuring many more. Under interrogation, some of the arrested suspects confessed to have pledged allegiance to ISIL. With this information at hand, the General Prosecutor informed the SIC of his decision to designate 23 individuals on Lebanon’s national terrorism/terrorist financing list. Prior to the actual designation, the SIC circulated all the names, and a number of banks reported having bank accounts for some. The analysis of those bank accounts revealed that they had minimal activity and balances. Furthermore, a money remittance company reported several transactions in prior years.
Subsequent measures: The SIC decided to freeze all the identified accounts. In addition, and since the SIC is empowered by Law to issue the freezing orders on designations, it circulated the names of the suspects to several local agencies including the real estate register, commercial register and vehicle register requesting identification of assets and taking the necessary measures to prevent the use of movable or immovable assets belonging to the individuals to be designated. All the findings were forwarded to the General Prosecutor, and several counterpart FIUs were contacted in this respect.