MOUNTAIN WEST CREDIT UNION ASSOCIATION June 9, 2020 Special Agent - - PowerPoint PPT Presentation

Special Agent Lisa Palmer, IRS-CI

MOUNTAIN WEST CREDIT UNION ASSOCIATION June 9, 2020

Objectives

• Overview of Role of CI Special Agents
• Components & Importance of SARs
• Discuss Traditional Case Studies
• Emerging Cryptocurrency Trends
• Discuss Cryptocurrency Cases
• Discuss Role SARs Play in Investigations

Who i

• is

s IRS-CI a and W nd Wha hat Do Do The hey Do Do?

• Approx. 2,200 Special Agents

Fraud Detection Centers Forensic Laboratory Computer Investigative Specialists Undercover Program Tech. Program Asset Forfeiture Coordinator

• Interview witnesses and subjects
• Serve search, seizure and arrest warrants
• Perform undercover operations
• Armed Escorts/Building Security
• Evaluate Information
• Testifying - Grand Jury & Trial
• Recommend Prosecution

Wha hat Do Do S Speci pecial Ag Agents Do Do?

SAR AR Revie view T Tea eams

• Includes FBI, IRS, USAO, ICE/HSI, DEA, ATF, USSS, USPS, CO

Dept of Rev., and SEC etc.

• Meet once a quarter
• Discuss SARs, cases, and trends

So

• Many SARs - How t

to

• Chose
• se
• Different agencies have different priorities

• Investigative Authority:
• Title 26 – Internal Revenue

Code

Who i

• is

s IRS-CI a and W nd Wha hat Do Do The hey Do Do?

• Legal Source Income
• Illegal Source Income
• Return Preparer Schemes
• ID Theft

• Money Laundering

(Video Break!)

Who i

• is

s IRS-CI a and W nd Wha hat Do Do The hey Do Do?

SA SAR Analysi sis s Tool

Data Analytics

• Are there individuals with multiple SARs this months?
• Previous months? Outside this area?
• Are there individuals with SARs who also have other BSA Documents
• What specialized filers have filed in my area?
• Are there new documents for existing cases?

Da Data Ana Analytics ics

Preparing SAR Narratives

• This is your chance to tell me, in plain English, what you THINK is suspicious.
• Give me a summary in the first 1-2 sentences.
• Provide a detailed description of the known or suspected criminal violation or

suspicious activity.

• Add any information you have about the knowledge, mindset, or intent of the

subject.

• Conversations, or statements from the subject are especially useful

Prepp epping g SAR AR N Narr rratives

TELLER 08 AT 12:29 10/12/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 08 AT 16:23 10/13/2010 WEDNESDAY CASH DEPOSIT $9,500.00 TELLER 10 AT 10:30 10/19/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 08 AT 16:40 10/20/2010 WEDNESDAY CASH DEPOSIT $9,500.00 TELLER 11 AT 14:44 10/21/2010 THURSDAY CASH DEPOSIT $9,500.00 TELLER 08 AT 14:46 10/26/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 04 AT 15:02 10/27/2010 WEDNESDAY CASH DEPOSIT $9,500.00 TELLER 04 AT 11:34 11/02/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 11 AT 16:35

How We S e See S ee SAR AR Narr rratives es

Attach Transaction Charts to SAR

DEPOSIT Teller Time Day of Week Date $9,500.00 08 16:23 WEDNESDAY 10/13/2010 $9,500.00 10 10:30 TUESDAY 10/19/2010 $9,500.00 08 16:40 WEDNESDAY 10/20/2010 $9,500.00 11 14:44 THURSDAY 10/21/2010 $9,500.00 08 14:46 TUESDAY 10/26/2010 $9,500.00 04 15:02 WEDNESDAY 10/27/2010 $9,500.00 04 11:34 TUESDAY 11/02/2010 $9,500.00 11 16:35 THURSDAY 11/04/2010

Example 1

Excerpt from a SAR

This SAR is being filed for suspicious incoming funds, a suspicious use

• f funds and a suspicious movement of funds conducted in personal

checking account… …[the bank] considers this activity suspicious because the true source

• f the electronic credits and incoming wires is undetermined. Also,

the inability to determine the true use of the visa debit card purchases and electronic debits is suspicious. Additionally, the inability to determine the source and use of funds indicates a suspicious movement of activity. Online research supporting this customer is buying and selling bitcoins adds to this suspicious nature.

Example e 1

Example 1

Excerpt from a SAR

This SAR is being filed for suspicious incoming funds, a suspicious use

• f funds and a suspicious movement of funds conducted in personal

checking account… …[the bank] considers this activity suspicious because the true source

• f the electronic credits and incoming wires is undetermined. Also,

the inability to determine the true use of the visa debit card purchases and electronic debits is suspicious. Additionally, the inability to determine the source and use of funds indicates a suspicious movement of activity. Online research supporting this customer is buying and selling bitcoins adds to this suspicious nature.

Example e 1

Limited Use of SAR Information

• Back-up documentation
• Transactions are great but context ALWAYS helps
• More is better…additional account activity and history, conversations

with subject, video, and pictures

• We cannot directly use any of the information in the SAR
• Follow-up with subpoena, summons, court order
• Interview employees of the financial institution who were

involved/witness to the suspicious activity

Limited Us d Use e of S SAR AR I Inform rmation

Red Flags Depository Accounts

• Structuring
• Large amount of cash deposits
• International wires
• Activity out of the ordinary for customer
• Customer inquiring about BSA laws
• Business activity in personal accounts
• Multiple U.S. Treasury checks in various names in single account
• Recycling of Cashier’s Checks to keep account balance low

Red F ed Flags – Depo Depository Ac Accoun unts

Reach Out to Law Enforcement

• Thousands of SARs are filed each month in Colorado - don’t be scared

to reach out

• Time sensitive
• Out of the ordinary
• Trust your instincts
• You are the boots on the ground, much of our financial intelligence

comes from you

Rea each Out ch Out to Law E Enforcemen ent

Tax Evasion in a nutshell

This boils down to intent to defraud the United States by concealing income from being taxed or concealing assets so as not to pay an

• utstanding tax.
• Evasion of Assessment vs. Evasion of Payment

Applies to all types of federal taxes: income, employment, etc.

Tax E x Evasion i n in n a Nut utshell

• Structured cash deposit/withdrawals
• Using nominees (shell corporations, nominee signor, stamped signature)
• Business activity in a personal bank account
• Comingling business and personal funds/expenses
• Sweeping accounts regularly (i.e.: depositing funds, purchasing cashier’s

checks, then redepositing cashier’s checks at a later date)

• Cash intensive businesses with no cash activity in business bank account

(i.e.: retail, bars, dry cleaners, etc.)

• Admissions or statements from account holders

What Can Tax Evasion/Fraud Look Like in a Bank Account?

Return Preparers

• No Licensing Rules for Return Preparers
• Make up Information on Returns
• Charge a Percentage of the Refund

Return Preparers

Tax Fraud ID Theft

• Stolen SSN
• Fabricate income – Refundable credits
• Use last year’s income numbers
• Business Email Compromise
• ITIN Fraud
• Create an account
• Receive Additional Child Tax Credit
• The gift that keeps on giving

Fraud – ID Theft

• Direct Deposit into Bank Account
• Limit of three
• Prepaid Debit Card
• Also a limit of three
• Debit cards have AML programs
• Checks
• You need an ID to cash the checks

MONEY: From the IRS to the Criminal

IRS Impersonation Schemes

• Phone and email (mostly phone)
• Threaten arrest
• Action required immediately
• Send money through MSB, gift cards, or cryptocurrency
• Not limited to IRS
• Social Security Administration
• Utility Companies

IRS I Impersonation S Schemes

Case Studies

Case Study #1 – The Home Healthcare Providers

• SARs filed by local CU stating two new

business accounts just received over $3 million from the Treasure Department related to claims with the VA

• Businesses registered to same

residential addresses

• Majority of the funds were quickly

transferred to personal accounts.

• Funds largely used for what appear to

be personal expenses

Case Study #1 – The Home Healthcare Providers

• The businesses’ claims with the VA

were analyzed and outliers were identified for patient care

• Interviews showed business owner had

cold called patients with a chronic condition, and helped care takers fraudulently enroll as certified healthcare workers.

• Subject’s businesses kept 80% of the

money

• Found guilty – subjects are awaiting

sentencing

Case Study #2 The Landlord

• Multiple SARs filed on local landlord
• Subject would bring in an empty bag,

go to their safe deposit box and then buy a large cashier’s check with cash from the bag

• Subject would cash checks regularly

with memos for “Rent” or an address

• Kept low balances in personal accounts

Case Study #2 The Landlord

• Follow up documentation requested, and

agents interviewed bank personnel

• Subject told tellers she didn’t trust

banks, and preferred to use cash

• Review SAR support and public records

showed she was buying inexpensive properties and renting them

• Review of tax returns showed income was

reported

CRYPTOCURRENCY

• History of Cryptocurrency
• Components of a Cryptocurrency Transaction
• Role of Cryptocurrency in Financial Crimes
• Emerging Trends

Cryptocurrency

Cryptocurrency SARs: Volume

Cryptocurrency S SARs Rs: V Volume

Cryptocurrency SARs: Filers

Cryptocurrency S SARs Rs: F Filers

Cryptocurrencies

Cryptocurrenies

ADDS TO NARRATIVE

• Public Key (a/k/a “account number”)
• Email Address(es)
• Conversations RE: cryptocurrency exchangers used
• Other cryptocurrencies used
• Bank photographs during the transaction
• Device Information
• IP Addresses

Add dds t s to N Narrative

IMPORTANCE for LE & BSA

• Threats to integrity
• More difficult to ID (anonymity)
• More difficult to detect by LE (avoidance)
• More difficult to trace & track (3 stages of ML)
• Counting on LE & Regulators being novices
• Threats to safety

Imp mpor

• rtan

ance f e for LE a and B BSA

Cryptocurrency kiosks

ATMs sell and buy cryptocurrencies for cash

• Different companies deal in different

currencies

• High fees
• Some are legitimate, others less so

These can, and are frequently used to launder money

Cryp yptocu curr rrency K cy Kios

• sks

Contact Info

• lisa.palmer@ci.irs.gov

303-603-4940

Conta tact I Info