Welcome to the Investigation!
Welcome to one of the most exciting parts of being an AML specialist! If the rest of the CAMS curriculum is about the rules of the game, this chapter is about the "detective work." We are going to learn how to follow the breadcrumbs left by potential money launderers. Don't worry if this seems like a lot to take in; we will break it down step-by-step. By the end of this, you’ll understand how an investigation starts, how to conduct it, and how to finish it properly.
Section 1: Why Do We Start an Investigation?
An investigation doesn't just happen out of nowhere. It usually begins with a trigger. Think of a trigger like a smoke alarm: it doesn't always mean there is a fire, but it means you must go and check the room.
Common Triggers include:
• Automated Alerts: Your bank’s software flags a transaction that looks unusual (like a huge cash deposit).
• Internal Referrals: A front-line teller notices a customer acting strangely or asking odd questions.
• External Inquiries: Law enforcement or regulators ask about a specific person or account.
• Negative News: You see a report in the media that one of your clients has been arrested for fraud.
Quick Review: An investigation is a search for the truth behind a "red flag." Our goal is to determine if the activity is suspicious or if there is a logical, legal explanation.
Section 2: The Investigation Process - Step by Step
When you start an investigation, you need a plan. You can't just jump in! Here is the standard flow:
1. Initial Review and Planning
Before diving into the data, look at what triggered the alert. Is it a repeat offender? Is this a high-risk customer? Determine the scope (how far back you will look) and the objective (what you are trying to prove).
2. Gathering Evidence
This is where you collect your "puzzle pieces." You should look at:
• Internal Records: Account opening documents (KYC), transaction history, and previous SARs (Suspicious Activity Reports).
• External Records: Public records, social media (for business context), and news articles.
• The "Paper Trail": Copies of checks, wire transfer instructions, and deposit slips.
3. Analyzing the Data
Now, you look for patterns. Are there "round-dollar" amounts? Is money moving in and out immediately (layering)?
Analogy: Imagine someone says they are a "student," but they are receiving $50,000 wire transfers every week from a foreign country. The profile doesn't match the activity.
4. Making a Decision
At the end, you must decide: Is this suspicious? If yes, you file a SAR/STR. If no, you close the case with a clear explanation of why it’s not suspicious.
Common Mistake to Avoid: Never close an investigation just because the customer is "nice" or "well-known." Base your decision on the data and facts, not on personal feelings!
Section 3: Interviewing Techniques
Sometimes, you need to talk to people to get the full story. This could be a bank employee or, in some cases, the customer (though you must be very careful not to "tip them off").
How to conduct a successful interview:
• Be Prepared: Know the facts before you walk in.
• Ask Open-Ended Questions: Instead of asking "Did you send this money?", ask "Can you explain the purpose of this transaction?" This encourages the person to talk more.
• Observe Non-Verbal Cues: Is the person sweating, avoiding eye contact, or acting overly defensive? (Though remember, some people are just naturally nervous around investigators!).
• The "Two-Person" Rule: It is often helpful to have two investigators present—one to ask questions and one to take detailed notes.
Memory Aid: The 5 W’s
Always ensure your interview covers: Who involved, What happened, Where it happened, When it happened, and Why it’s suspicious.
Section 4: Responding to Law Enforcement
Law enforcement might come knocking with a Search Warrant or a Subpoena. It is vital to handle these correctly to protect the institution.
What is a Subpoena? It is a legal demand for records. You must provide the documents requested, but you usually have some time to gather them.
What is a Search Warrant? This is more urgent. It allows officers to enter the premises and seize records immediately.
The Golden Rules for Law Enforcement Requests:
1. Verify Identity: Ask for the officer's credentials.
2. Notify Legal/Compliance: Immediately call your senior management or legal counsel.
3. Keep a Record: Keep a detailed list of every document the police take. Do not interfere with them, but do stay present and observe.
Did you know? If you receive a grand jury subpoena, you are often prohibited from telling the customer that their records have been requested. This is to prevent the customer from destroying evidence or fleeing.
Section 5: Filing a SAR/STR (The Final Step)
If your investigation confirms that the activity is suspicious, you must file a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR).
The Narrative is Key
The "Narrative" is the story part of the report. It needs to be clear and concise. A good narrative should explain:
• How the activity started.
• What specifically made it suspicious.
• The "flow of funds" (where the money came from and where it went).
Important Point: Do not use overly technical jargon in the SAR narrative. Write it so that a law enforcement officer—who might not be a banker—can easily understand what happened.
Section 6: Closing the Investigation
Whether you file a SAR or not, you must document everything. If a regulator visits two years from now and asks why you didn't file a SAR on "Customer X," you need to show your notes and evidence to prove you did a thorough job.
Key Takeaway for Closing: Documentation should be "self-standing." This means if a stranger reads your file, they should be able to understand your logic and the conclusion you reached without you being there to explain it.
Summary and Encouragement
Let's recap:
1. Investigations start with a trigger.
2. We follow a structured process: Plan, Gather, Analyze, and Decide.
3. Interviews help fill in the gaps using open-ended questions.
4. Law enforcement requests must be handled through legal/compliance channels.
5. SARs are the final output if we find true suspicion.
Investigations can be complex, but remember: you are the gatekeeper of the financial system. By being thorough and documenting your work, you are making it harder for criminals to succeed. You've got this! Keep reviewing these steps, and they will become second nature.