tracfin - economie.gouv.fr
TRANSCRIPT
ML/TF risk trends and analysis in 2019-2020
TRACFIN
TRACFINUnit for intelligence processing
and action against illicit financial networks
FOREWORD
Tracfin is publishing its sixth annual report on money laundering and terrorist financing (ML/TF) risk trends and analysis. The assessment process’s starting point is the implementation, at Tracfin level, of the requirement set out in recommendation 1 of the Financial Action Task Force (FATF) standards, which specifies that “countries should identify, assess and understand the money laundering and terrorist financing risks for the country”. 1
Tracfin’s risk assessment relies on three sources of information: suspicious transaction reports (STRs) submitted by the reporting entities concerned by anti-money laundering and combating the financing of terrorism (AML/CFT) which are specifically mentioned in the French Monetary and Financial Code (CMF); financial intelligence sent by the administrative departments and foreign Financial Intelligence Units (FIUs); the content of investigation files referred by Tracfin to the courts or partner departments.
Since 2014, Tracfin’s ML/TF risk trends and analysis reports have described the main recurrent and nascent typologies with an eye to providing the reporting entities with the most relevant information to inform their risk classification. This 2019-2020 edition follows on from the previous reports and supplements the 2019 Annual Report and the communication media disseminated by the Unit (joint guidelines, newsletters).
The ML/TF risk trends and analysis in 2019-2020 report contains three components:– The first is centred on a summary of the main ML/TF trends that have been
pinpointed by examining the reporting flows handled by Tracfin which have been constantly increasing in terms of both volume and standard. The summary is enhanced by citing examples of the main underlying violations that have been noted, analysed and submitted by the Unit.
– The second focuses on substantiating the analysis of the risks being run by the economic sectors which are the most vulnerable to money laundering and terrorist financing. This section highlights shortcomings and details, where applicable, ways to bolster the AML/CFT system.
– The report’s third and final component homes in on the new financial vectors which, as part of the digitalisation of economic and financial activities, may be used for ML/TF purposes.
1. FATF: International standards on combating money laundering and the financing of terrorism & proliferation, The FATF Recommendations, February 2012.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
3
TABLE OF CONTENTS
DETAILING THE TRENDS OVERVIEW OF THE MAIN ML/TF RISKS IDENTIFIED BY TRACFIN 9
THE ANALYSIS OF REPORTING FLOWS IN 2019-2020 HIGHLIGHTS RISK INDICATORS WHICH SUPPLEMENT THE NATIONAL ANALYSIS OF ML/TF RISKS 10
THE NATIONAL RISK ANALYSIS STRIVES TO RATE THE RISKS ATTACHED TO THE MAIN ML/TF VECTORS 10
THE ANALYSIS OF REPORTING FLOWS HANDLED BY TRACFIN IN 2019-2020 COMPLEMENTS
THE NATIONAL RISK ANALYSIS 11
TRENDS OBSERVED 13
EXAMPLES OF TRENDS: THREE RECURRENT ACTIVITIES AS REGARDS FIGHTING FINANCIAL CRIME, COMBATING FRAUD AND INTERNATIONAL COOPERATION 15
EXAMPLE 1: THE PERPETUATION OF FRAUD AGAINST THE PUBLIC PURSE 15
EXAMPLE 2: DETECTING THE LAUNDERING OF THE PROCEEDS OF ILLEGAL TRAFFICKING IS PARTLY
RELIANT ON MONITORING FLOWS OF CASH 22
EXAMPLE 3: THE MAIN MONEY LAUNDERING TRENDS MAKE ACTIVE COOPERATION BETWEEN TRACFIN
AND ITS FOREIGN COUNTERPARTS ESSENTIAL 26
MITIGATING VULNERABILITIES A REVIEW OF THREE SECTORS THAT CARRY HIGH ML/TF RISKS 33
PROPERTY, A SECTOR IMPLICATED IN ALL THE STAGES OF MONEY LAUNDERING 35
A SECTOR USED TO FOSTER CONSPIRACY TO COMMIT FRAUD 35
A SECTOR USED AS A VECTOR IN THE INTEGRATION STAGE OF MONEY LAUNDERING 36
A SECTOR EXPOSED TO LAUNDERING THE PROCEEDS OF BRIBERY AND THE MISAPPROPRIATION
OF PUBLIC FUNDS 36
THE ART SECTOR IS VULNERABLE TO THE RISKS OF BOTH MONEY LAUNDERING AND TERRORIST FINANCING 43
A SECTOR USED TO CIRCUMVENT TAX OBLIGATIONS 44
VIOLATIONS OF THE REQUIREMENT TO DECLARE THE EXPORT OF CULTURAL GOODS 44
THE ART MARKET IS CONDUCIVE TO TERRORIST FINANCING 47
PROFESSIONAL SPORT, A SECTOR REQUIRING FORCEFUL APPLICATION OF THE AML/CFT SYSTEM 49
THE STILL-RECENT REGULATION OF THE PROFESSION OF SPORTS AGENT NEEDS TO BE TIGHTENED
TO BOLSTER VERIFICATION OF THE RELATED FINANCIAL FLOWS 49
A SECTOR SUSCEPTIBLE TO BRIBERY, IN PARTICULAR FOR THE AWARDING OF SPORTS COMPETITIONS 51
A SECTOR IN WHICH COMPETITIONS MAY BE FIXED BY THE PLACING OF SPORTS BETS 52
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
5
ANTICIPATING RISKS NEW ML/TF CIRCUITS DUE TO THE DIGITALISATION OF PAYMENT SERVICES 55
E-MONEY AND CRYPTO-ASSESTS ARE STILL LEADING MEANS OF MONEY LAUNDERING AND TERRORIST FINANCING 58
DESPITE MAJOR LEGISLATIVE REFORM, PREPAID CARDS AND VOUCHERS STILL PROVIDE ANONYMITY 59
MORE HARMONISED OVERSIGHT AT EUROPEAN LEVEL WOULD HELP CLOSE THE LOOPHOLES
INTRODUCED BY THE EUROPEAN PASSPORT 62
ACCOUNTS OPENED ONLINE MAY PROVIDE NEW ANGLES FOR INVESTIGATIONS 66
NEW RISKS IN THE CRYPTO-ASSETS SECTOR 68
POTENTIAL FRAUD RISK IN INITIAL COIN OFFERINGS USED TO RAISE FUNDS 68
THE FRENCH AML/CFT SYSTEM FACED WITH THE EXPANSION OF STABLECOINS 70
BIG TECH’S ENTRY INTO FINANCIAL SERVICES: A EUROPE-WIDE EXPANSION THAT CALLS FOR REGULATORY ATTENTION 73
NEW COMPETITION FOR EUROPEAN MONEY TRANSFER AND ONLINE PAYMENT SERVICE PROVIDERS 73
ACQUIRING STAKES AND FORMING PARTNERSHIPS: BUSINESS STRATEGIES WITH LONG-TERM RISKS 74
SUMMARY OF MAIN RECOMMENDATIONS 75
APPENDICES 77
APPENDIX I: LIST OF CASE STUDIES 78
APPENDIX II: STATISTICAL METHODOLOGY FOR ANALYSING REPORTING FLOWS 80
APPENDIX III: LIST OF ABBREVIATIONS AND ACRONYMS 81
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
6
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
7
1T
RA
CFI
N -
ML/
TF
RIS
K T
REN
DS
AN
D A
NA
LYSI
S IN
201
9-20
20
8
DETAILING THE TRENDSOVERVIEW OF THE MAIN ML/TF RISKS IDENTIFIED BY TRACFIN
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
9
The main areas of risks faced by the French AML/CFT system, which have been set out in the reports on the risk trends and analysis regarding money laundering and terrorist financing published by Tracfin since 2014, are established by cross-referencing a number of areas of analysis: the main underlying violations noted by Tracfin, the principal vectors or arrangements used by money laundering networks and the most-exposed economic sectors.
THE ANALYSIS OF REPORTING FLOWS IN 2019-2020 HIGHLIGHTS RISK INDICATORS WHICH SUPPLEMENT THE NATIONAL ANALYSIS OF ML/TF RISKS
THE NATIONAL RISK ANALYSIS STRIVES TO RATE THE RISKS ATTACHED TO THE MAIN ML/TF VECTORS
The national analysis of ML/TF risks in France2 (ANR) was adopted on 17 September 2019. It is an interministerial approach, coordinated by the AML/CFT Advisory Board (COLB), which strives to flag up the threats, vulnerabilities and level of resulting risks as regards ML/TF at national level. National risk analysis, which is vital for summarising the regular analysis work carried out by the relevant authorities, helped with the groundwork for the FATF’s 2020 mutual evaluation of the French AML/CFT system.
Methodology based on cross-referencing threats and vulnerabilities The methodology for the national risk analysis abides by the principles laid down by the FATF, especially the cross-referencing of threats and vulnerabilities to assess the extent of the resulting associated risk for each major ML/TF vector.
A three-level ranking (low, moderate or high exposure) has been applied for the ML/TF threat for each product or sector. The vulnerability of each product, service or transaction has also be subject to the same type of ranking. Cross-referencing threats and vulnerabilities has enabled the level of risk for each product or sector to be determined.
Targeted findings on the main ML/TF vectorsNational risk analysis reports on the main criminal threats faced by France and provides substantiated information on the primary vectors used for ML/TF purposes. With respect to terrorist financing, the analysis focuses on the main vectors for financial flows for the benefit of Jihadi groups: networks of collectors, the non-profit sector, innovative financing methods.
Similarly, for money laundering, it establishes the vulnerabilities of the financial and non-financial sectors, and highlights the use of complex legal structures, cash, instruments that foster anonymity (e-money, digital assets), property acquisitions or non-profits of a sensitive nature, as being exposed vectors.
2. COLB, Analyse nationale des risques de blanchiment de capitaux et de financement du terrorisme en France, September 2019, available on the website of the Directorate General of the Treasury: https://www.tresor.economie.gouv.fr/Articles/2019/09/20/le-conseil-d-orientation-de-la-lutte-contre-le-blanchiment-de-capitaux-et-le-financement-du-terrorisme-approuve-l-analyse-nationale-des-risques-anr-en-france (in French).
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
10
THE ANALYSIS OF REPORTING FLOWS HANDLED BY TRACFIN IN 2019-2020 COMPLEMENTS THE NATIONAL RISK ANALYSIS
The analysis of reporting flows handled by Tracfin in 2019-2020 draws on metho-dology involving cross-referencing the main reported offences and the related sectors of activity.3 Money laundering, excluding terrorist financing, underlies all the violations presented in this report. The purpose of the analysis is to shed light on the extent to which an economic sector can be used as an ML/TF vector. It does not call into question either the involvement or detection capabilities of the relevant reporting entities working in some of these sectors but just aims to underscore their level of exposure to ML/TF risks due to the amount of information relating to them.
A sector of activity is examined with regard to its exposure to risk criteria which are materialised as underlying violations: to what extent does it enable cash to be laun-dered, for income of undetermined origin or undeclared work to be concealed? How far does it suit the requirements and operating methods of criminal networks involved in fraud, bribery or terrorist financing? What is the likelihood of it being used to cloud the traceability of financial flows?
The division of reporting flows by economic sector, as set out in the table below, was carried out using suspicious transaction reports (STRs) received by the Unit and information from investigations. It sets out three levels of exposure to ML risks: – “ * ”: economic sector exposed to ML/TF risk – “ ** ”: economic sector highly exposed to ML/TF risk – “ *** ”: economic sector very highly exposed to ML/TF risk
These findings draw on an analysis of the volume of reporting flows and the bias already contained in the STRs received by Tracfin. The resulting conclusions highlight the recurrent trends handled by the Unit on a daily basis. In this respect, Tracfin’s analysis does not represent, in itself, a ranking of the sectoral ML/TF risk but is part of a collective approach to enhance the national risk analysis in consultation with its partners.
This means that the original nature of some areas of risk analysed on the fringes of these trends is not explicitly flagged up. Although the breakdown of reporting flows has less impact on certain economic sectors, this is not a sign that they are not exposed to the ML/TF risk.
Conversely, it demonstrates that a number of “pockets” of risk, which are more rarely noted, fly under the radars of the reporting entities and require heightened diligence. Phenomena having unique ML/TF features such as white certificate (CEE) fraud in the environment sector, bribery in the armaments sector or investment fraud in the commodities sector have been detailed by Tracfin in its various ML/TF risk trends and analysis reports since 2014.
3. Detailed methodology is set out in Appendix II.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
11
Economic sectors
Offences
Terrorist financing
Tax evasion, social security and customs
fraud
Undeclared work
Misuse of company
assets
Fraud and theft
Trafficking
Bankruptcy and
organisation of insolvency
Bribery and breaches
of the duty of probity
Cash4
Aeronautics and space *Farming – Agrifood * * *Armaments ** *Crafts, art professions and trade in cultural goods
* *** * * ** **
Non-profit organisations *** * * *Audiovisual *Audit, accounting, management * *Automotive * *** ** ** ** * * **Banks, insurance * **Construction * *** *** *** *** *** ** * ***Biology, chemicals, pharmaceuticals
Trading – distribution ** *** ** ** *** *** ** * ***Communication *Education *Environment *Civil service * ***Hotel – restaurant *** * ** ** * **Property *** ** ** * ** *** **Manufacturing *IT, telecoms ** * * ** ** *Gambling ** * * ** ***Medical * * *Fashion and textiles * *
Legal professions * *
Human resources *
Sports ** * *Tourism * *Transport – logistics ** ** ** ** * *
4. Unlike the table’s other columns, use of cash does not represent an offence. Nevertheless, its intensive use in certain sectors justifies it having its own category.
Reporting activity of reporting entities
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
12
TRENDS OBSERVED
The economic sectors in which there are the largest number of suspected offences are construction, and trading and distribution. These two sectors alone account for a very substantial proportion of the STRs submitted to Tracfin. The STRs which are processed also very often concern the property, art, hotel-restaurant, transport, logistics, IT and telecoms sectors.
The main potential offences logged by Tracfin relate to tax evasion and social security fraud, undeclared work and, to a lesser extent, misuse of company assets and theft/fraud. The Unit pays particular attention to all STRs concerning the financing of terrorism, illegal trafficking and breaches of the duty of probity.
Fraud against the public purse,5 primarily tax evasion and social security fraud, is examined separately below.6 It takes place mainly in sectors in which large amounts of cash are handled (construction, restaurants, hotels) and in the retail trade (automotive, trading and distribution). Tax evasion tied in with property transactions should be subject to special attention. With a broader interpretation, this category can also include the organisation of insolvency which is noted less frequently in the same economic sectors. The many different types of tax evasion, social security or customs fraud are set out every year in Tracfin’s Annual Reports and the ML/TF risk trends and analysis reports.
Undeclared work involves either basic defrauding of social security organisations and violations of labour law, or more sophisticated money laundering circuits that use the payment of undeclared workers to launder cash of criminal origin. This takes place essentially in the construction industry.
A significant amount of fraud, particularly when committed as a conspiracy, has been reported to Tracfin. Since 2015, the Unit has provided details of many different types of fraud in its ML/TF risk trends and analysis reports on, inter alia, false transfer orders, fraudulent Forex investments, physical diamonds or crypto-assets or fraud against public schemes such as white certificates (CEE) misused at the expense of the mandatory participants7. Clients of credit institutions and insurance companies are the primary victims of these offences. The perpetrators set up companies in the IT, trading or distribution sectors to get rid of and launder the proceeds of the fraud. In most cases, these companies have no actual business activity.
Combating the financing of terrorism is one of the Unit’s imperative assignments. Besides recurrent trends such as microfinancing and the use of cash collection networks, Tracfin has noted increased exposure of the community-based non-profit sector to the financing of radicalisation and terrorist organisations, especially Islamic ones.
5. The National Anti-Fraud Office (DNLF) defines fraud against the public purse as including both tax evasion (individuals and businesses) and all forms of social security fraud (undeclared work and benefit fraud).See https://www.economie.gouv.fr/dnlf/quest-que-fraude-aux-finances-publiques (in French).
6. See page 15.
7. The mandatory participants are energy generating companies (suppliers of electricity, gas, fuel, oil, etc.) that are tasked by the scheme with achieving energy savings based on their volume of sales. The workings of the scheme are described on page 27 of Tracfin’s ML/TF risk trends and analysis in 2017/2018 report.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
13
Suspected trafficking, such as that of drugs and weapons, smuggling, counterfeiting or of humans concerns persons operating in the field of organised crime,8 and the laundering of the cash generated through various economic sectors (e.g. construction, trading, restaurants). Fighting this trafficking is one of Tracfin’s main strategic objectives (see Example 2 below).
Breaches of the duty of probity9 often involve complex legal structures which frequently have an international dimension. As a result of how international banking flows are organised, the intermediation of correspondent banks is noted when the proceeds of an offence of bribery or the misappropriation of public funds, which is committed abroad, are transferred to France. The French property and art sectors are especially susceptible to the laundering of the proceeds of these offences. In addition, the public sector, through semi-public companies, could be exposed to the risk of breaches of the duty of probity.
Lastly, besides the violations mentioned, the plethora of STRs concerning the handling of cash of unknown origin bears witness to this vector’s presence in many stages of money laundering. Laundering cash is most often carried out by:10
– networks for transnational fundraising, physical transport and informal remittance – injecting cash into companies with a legitimate business activity, particularly those
operating in construction, vehicle trading (especially second-hand),11 import-export, or other sectors in which cash is extensively used such as local shops, bars, tobac-conists, cafés and restaurants
– paying undeclared workers – gambling (purchases of winning lottery, horse racing and sports tickets, cash bets
in casinos)
Although it is not expressly mentioned in the analysis of reporting flows, intelligence of economic interest covers sectors which are sensitive as regards France’s fundamental interests. Tracfin focuses on information concerning the pharmaceutical industry, the armaments sector, the circumvention of economic embargos, and on the taking of interests or takeover of leading French companies by foreign investors.
8. Organised crime is defined on page 10 of Tracfin’s ML/TF risk trends and analysis in 2018/2019 report by referring, inter alia, to the United Nations Convention against Transnational Organized Crime, which was adopted in Palermo in December 2000, as “a structured group of three or more persons, existing for a period of time and acting in concert with the aim of committing one or more serious crimes or offences […] in order to obtain, directly or indirectly, a financial or other material benefit”.
9. Tracfin, ML/TF risk trends and analysis in 2016 report, pp. 38 to 42, ML/TF risk trends and analysis in 2017/2018 report, pp. 78 to 83 and ML/TF risk trends and analysis in 2018/2019 report, pp. 21 to 29.
10. Tracfin, ML/TF risk trends and analysis in 2015 report, pp. 22 to 25 and pp. 35 to 41.
11. Tracfin, ML/TF risk trends and analysis in 2017/2018 report, pp. 35 to 37.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
14
EXAMPLES OF TRENDS: THREE RECURRENT ACTIVITIES AS REGARDS FIGHTING FINANCIAL CRIME, COMBATING FRAUD AND INTERNATIONAL COOPERATION
The main ML/TF trends described above highlight Tracfin’s core assignments as part of the government’s AML/CFT policy: fighting economic and financial crime, tax evasion and social security fraud and combating the financing of terrorism. The purpose of this section is to provide examples of this observation to substantiate Tracfin’s work to tackle fraud against the public purse and illegal trafficking, and to describe how the Unit cooperates with its foreign counterparts to successfully accomplish these assignments.
EXAMPLE 1: THE PERPETUATION OF FRAUD AGAINST THE PUBLIC PURSE
Fighting tax evasion and social security fraud is set out clearly in the new national intelligence strategy of July 2019.12 For this purpose, verification and penalty provisions have been bolstered, in particular by the Anti-Fraud Act of 23 October 2018. According to the tax authorities, the amount of fraud detected in these two areas stood at €5.73bn in 201813.
Social security fraud damages the government’s financial interests Social security fraud is one of the main money laundering threats.14 It covers all fraudulent behaviour and acts against social security, and encompasses two concepts: social security contribution fraud, essentially through undeclared work (as defined by Article L.8211-1 of the French Labour Code) and benefit fraud (receipt of undue welfare benefits).
Combating social security fraud is essential to ensure economic effectiveness and social justice. According to the report on benefit fraud published by the Government Audit Office in 2020, the main social security funds detected €1bn in losses suffered and avoided as part of anti-fraud measures.15 Fighting fraud mainly involves looking for irregularities after the fact. But, these discrepancies could, theoretically, be more easily stemmed by verification work during the day-to-day management of benefits.
Tracfin is continuing to improve its detection of fraud affecting social protection organisations. The types of illegal activities are broken down between contribution fraud (undeclared work, under declarations by self-employed workers to the social security scheme or the MSA social agricultural mutual fund) and benefit fraud (receipt of unemployment benefit at the same time as carrying on undeclared work, residence fraud, “collection account” schemes for undue benefits).
In 2020, the extraordinary circumstances caused by the COVID-19 pandemic and the worsening of the economic situation of certain sectors fostered a new type of fraud against the short-time working benefits scheme.
12. Government, Bilan 2019 de lutte contre la fraude et renforcement du civisme fiscal, February 2020 (in French).
13. National Anti-Fraud Office (DNLF), Les grandes tendances du bilan 2018 de la lutte contre la fraude aux finances publiques, 30 December 2019 (in French).
14. AML/CFT Advisory Board (COLB), Analyse nationale des risques de blanchiment de capitaux et de financement du terrorisme en France, September 2019, p.26 (in French).
15. Government Audit Office, La lutte contre les fraudes aux prestations sociales, September 2020 (in French).
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
15
A new phenomenon in 2020: fraud against the short-time working benefits scheme which was introduced in response to the health crisis Against the backdrop of the health crisis caused by the COVID-19 pandemic and the economic support measures rolled out by the government, Tracfin acted to help the reporting entities by informing them of the main risks of fraud and money laun-dering observed in this context.16
One of these measures, introduced by Decree no. 2020-325 of 25 March 2020, fol-lowed by Order no. 2020-346 of 27 March 2020, allowed for the recasting of the short-time working scheme (called “partial unemployment or temporary layoffs”), to facilitate entitlement, retrospectively to 1 March 2020. A streamlined procedure was opted for to provide businesses and employees with rapid support. The Ministry for Labour, Employment and Integration estimates that 7.2 million French workers were subject to short-time working for one or several days per week in March, 8.8 million in April and 7.9 million in June 2020.
16. Tracfin, Les risques de BC/FT liés à la crise sanitaire et économique de la pandémie COVID-19. Analyse typologique des principaux risques identifiés, May 2020. https://www.economie.gouv.fr/tracfin/les-risques-de- blanchiment-de-capitaux- et-de-financement-du- terrorisme-lies-la-crise (in French).
APPLICATIONS FOR SHORT-TIME WORKING BENEFIT
Employers file applications for benefits for hours not worked by employees on the activitépartielle.emploi.gouv.fr website, following a simplified online registration process. Unlike the current scheme, they no longer require prior authorisation to use short-time working arrangements.
Eight pieces of easily-obtainable information are needed to set up an account: the SIRET number, the company’s name and address, an email address, a landline number and details of the contact person (name and email address), and a bank account identification document (RIB).
Once the account has been set up, the employer can file its benefit application using the
codes received at the email address provided. It then enters the names of the employees, the number of working hours and the gross hourly rate. As part of COVID-19 measures, the benefit paid is in proportion to the wages of workers placed under short-time working arrangements within a limit of 4.5 times the gross French statutory minimum wage (SMIC). Applications were initially approved after 48 hours but the timeline is now 15 days.
No supporting documents are required but subsequent checks may be carried out by officials from the Regional Directorates for Enterprises, Competition Policy, Consumer Affairs, Labour and Employment (DIRECCTE), who may ask to be provided with pay slips.
Tracfin uncovered widespread short-time working fraud. The total amount of the fraud is thought to be €225m,17 more than half of which has been able to be blocked and recovered. To contain the phenomenon, checks have been set up throughout the benefit process chain. This was materialised by the extension of the timeline for approving applications from 48 hours to 15 days, data visualisation to pinpoint suspicious applications, the introduction of upstream verification with a blocking mechanism via an embedded system detecting inactive SIRET codes or multiple applications, a downstream on-site documentary audit by teams from the Ministry for Labour, and checks by the payer organisation, the French Services and Payment Agency (ASP).
17. Estimates from the Ministry for Labour, Employment and Integration (see Le Monde, “Chômage partiel : le montant des fraudes estimé à 225 millions d’euros, dont plus de la moitié a été récupérée”, 17 September 2020).
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
16
Short-time working fraud is deemed to be social security contribution fraud within the meaning of the French Labour Code.18 Fraudsters risk the following penalties: – Full repayment of the amounts received for short-time working – Ban on receiving government aid for employment and training for a maximum of
five years – Two years’ imprisonment and a €30,000 fine under Article 441-6 of the French
Penal Code
Following its verification work, the Ministry for Labour flagged up two types of short-time working fraud: – Fraud: identity theft or use of fictitious businesses. With identity theft, the
application for payment of benefit by online declaration is filed using the corporate name and SIRET identification number of existing companies that have not applied for short-time working benefits
– False declarations: declared hours that do not correspond to actual hours not worked, etc.
Since the health crisis started, Tracfin has received a large number of STRs concerning this type of fraud from credit institutions. At 30 September 2020, Tracfin had referred over 90 cases representing a total of over €22m to the courts, with average financial stakes of €238,000 per case. In this respect, the Unit exercised its right of opposition more than 30 times between June and September 2020 for an aggregate amount of €2.2m. By way of comparison, it exercised that right 18 times in 2018 and 11 times in 2019; the figure between June and September 2020 is therefore three times higher than for 2019 as a whole.
In most cases, the arrangements noted have common features and enable the following warning signs to be highlighted: – Dormant companies filing an application for short-time working benefit – No employees in the company (the business has not declared any employees and
does not pay any wages, etc.) – Inconsistency between the amount of benefit received and the number of
employees declared by the company – The benefit received is not used to pay wages – The benefit received is followed by international transfers to individuals or other
companies domiciled abroad – Identity theft or use of fake documents to receive benefit on behalf and in the
place of another company
The Unit also receives reports concerning individuals or legal entities who/which, on the basis of investigations conducted, are acting in a conspiracy.
18. Articles L.5124-1 and L.5429-1 of the French Labour Code set out the conditions which constitute undeclared work. These articles refer to benefits paid as part of a short-time working scenario. This means that short-time working fraud falls within the category of social security contribution fraud.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
17
CASE STUDY 1
Short-time working fraud, criminal seizures with the perpetrator being placed on remandBetween May and August 2020, the catering company X and its manager, Ms A, received almost €450,000 in short-time working benefit due to the COVID-19 pandemic from a Regional Public Finances Directorate (DRFiP). €300,000 of this amount were received in the name of other companies. The unduly received funds were then transferred to bank accounts held abroad.
Ms A had been known to the police for fraud offences since 2006. Company X had filed 16 advance hiring notices since 2017 showing that it had between four and eight employees. Strangely, the €150,000 in benefit requested for its employees were not credited to company X’s bank accounts but to the personal account of its manager, Ms A. Concurrently, company X’s bank account was credited with 15 payments totalling €300,000 whose descriptions show the names of three other companies.
Part of the funds received by company X and Ms A was used to settle personal debts. Another part was transferred to accounts held by Ms A in EU Member States. One of these accounts was used as a transit account towards North African countries to pay for IT and consulting services. At Tracfin’s request, funds were seized in France and in two non-EU countries from transit accounts held within the EU and in the country where the funds were ultimately destined.
Referral of this case to the Court of Justice led to the accused being placed on remand for money laundering and conspiracy to defraud. Several tens of thousands of euros were subject to criminal seizures. Ms A risks up to ten years in prison and a fine of one million euros.
Warning signs:
– Receipt of part of the funds on the manager’s personal account – Description of the transfer for the benefit of a company other than the one receiving the funds
– Transfer of part of the benefit received to an account held abroad CASE STUDY 1: Short-time working fraud, criminal seizures with the perpetrator being placed on remand
Personal bank account
Mrs AManager
€150kShort-time working
benefit
Company X
Company X’s bank account
Benefit in the name of three other companies received on company X’s bank account
€300kShort-time working
benefit
Settlement of personal debts
Mrs A’s personal bank accounts
Benefit received on behalf of company X on the manager’s personal account
Transit account North Africa
Known to the police for fraud since 2006
Country (EU)
Seizure of part of the funds following a proposal from Tracfin
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
18
Tracfin has cutting-edge expertise to tackle all forms of tax evasion In 2019, the proportion of STRs with a direct or indirect bearing on tax evasion accounted for around 30% of reporting flows. The number of information notes sent by Tracfin and concerning tax evasion offences was up 15% in 2019.19 In the reporting flows, the most frequent forms of evasion were undeclared business activity, under-declaring company turnover, possession of undeclared foreign bank accounts or assets, concealed gifts and reducing wealth tax, and then property wealth tax, liability.
Whilst tax evasion may be an exclusive offence, it often underlies the main violation. In the first case, Tracfin reports the matter to the tax authorities; in the second, the report is sent to the courts.
To heighten coordination between the departments involved in fighting tax evasion, a task force focusing on tax intelligence was set up in October 2019 at the Ministry for the Economy, Finance and the Recovery.20 The task force has members from the National Tax Investigation Directorate (DNEF), the National Directorate for Customs Intelligence and Investigations (DNRED) and Tracfin. It is tasked with fostering the circulation of information that may be of use in identifying complex tax evasion arrangements.21 Its operational structure, comprised of representatives designated within the three departments, centralises all exchanges and disseminates information concerning targeted cases to the field operatives.
Value added tax (VAT) fraud and scams cause major losses for the public purse Tracfin’s work to combat VAT fraud is essentially focused on recently set up businesses which receive VAT credit refunds for fairly small amounts and which, subsequently, file further applications. The suspicion of fraud is raised by the immediate transfer of these funds to a bank account held abroad. Tracfin aims to allow for upstream intervention to rapidly interrupt the VAT refund chain.22
Carousel fraud is one of the procedures that is the most-used by fraudsters. The circuit for this fraud involves setting up a chain of companies in a number of EU Member States which make intra-Community acquisitions and supplies, or imports and exports, between themselves. These companies artificially generate entitlement to deduct VAT through so-called “letterbox” shell companies which create fictitious VAT by means of a circuit of false invoices. The arrangements used by the fraudsters have become increasingly complex and use a host of shell companies with an ever-shorter lifespan.
The anti-VAT fraud system becomes stronger every year. An operational interministerial coordination structure, called the “VAT task force” was set up in 2014 and is primarily responsible for steering the fight against VAT fraud with an eye to coordinating and improving performance levels. Tracfin takes part in the task force’s work, alongside tax and customs officials, and representatives from the Ministries of the Interior and Justice.
19. Tracfin, 2019 Annual Report, July 2020, pp. 75 to 76.
20. Ministry for Government Action and Public Accounts when the task force was set up.
21. Government, Bilan 2019 de lutte contre la fraude et renforcement du civisme fiscal, February 2020 (in French).
22. TRACFIN, Rapport annuel d’activité 2019, juillet 2020, p. 78.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
19
CASE STUDY 2
Conspiracy to commit VAT fraud through a network of companies set up using fake documents and an e-money institution Tracfin uncovered a series of fraudulent VAT refunds based on a network of 500 fictitious companies set up using fake documents and identity theft. The fraud was scaled up in several layers:
– First, an initial group of companies was registered with commercial court registries. To do so, they used fake ID documents and produced fund deposit certificates that usurped the capacity and names of members of the same notary’s practice
– Once set up, these companies filed VAT credit refund applications using false invoices. This process continued until the first rejection decisions by the tax departments.
– The funds received financed the registration of new companies which repeated the same procedure
– The funds were then transferred to the accounts of an e-money institution operating in France under the freedom to provide services regime. This institution was managed by Mr A, who had been targeted by a Europol request in 2015 for fraud and who was known to the police for a number of suspicious financial transactions. Mr A and certain members of this institution could have been at the origin or could have facilitated the laundering of the funds received by this network of shell companies.
Warning signs:
– Use of fake documents and identity theft to set up companies – VAT credit refund applications using false invoices – Part of the funds received for VAT credit refunds is used to set up new companies
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
20
CASE STUDY 2: Conspiracy to commit VAT fraud through a network of companies set up using fake documents and an e-money institution
First group of network companies EME
E-money institution Operating in France under the freedom
to provide services regime
Identity theft Fake ID documents
Commercial CourtsRegistration
Using false invoices
Refund applications
VAT credits
New group of network companies
Identity theft Fake ID documents
Registration
Funds received
Funds received
Bank accounts
Domiciled
Mr A
Targeted by a Europol request in 2015 for fraud and known to the police Could facilitate, via his e-money institution, the laundering of the funds fraudulently received by the network of companies
Manager
Commercial Courts
Risks in the life and non-life insurance segmentsThe entire life and non-life insurance sector is covered by the AML/CFT system pursuant to Article L.310-1 of the French Monetary and Financial Code. The Unit exercises particular due diligence in respect of transactions concerning life insurance policies, including redemption of such policies.
Life insurance policies can be used as leverage to commit different types of fraud such as tax evasion, abuse of weakness or scams. These may take the following forms: – Laundering the proceeds of tax evasion by investing in life insurance policies.
The laundered funds are usually held abroad and have not been declared to the French tax authorities.
– Fraud related to searching for the beneficiaries of life insurance policies: one or more individuals pretend to be lawyers or insurance companies from which they steal the logo. They contact individuals and wrongfully inform them that they are the beneficiaries of the life insurance policy of a person who has died. They then ask the alleged beneficiaries to send their bank details, a copy of an ID document and to pay administrative charges.
– Redemption of life insurance policies by elderly persons who are victims of abuse of weakness
– Redemption of a life insurance policy under cover of a disguised redundancy to benefit from the provisions of Article 125-0 A of the French General Tax Code (CGI)
CASE STUDY 3
Suspected tax evasion as part of the redemption of a life insurance policyAs part of the redemption of one of their life insurance policies, Mr A and his wife, Mrs B, received several transfers for a total of €600,000. The capital gains on redemption of this policy amounted to €65,000 which was subject to €2,500 in social levies. As Mr A had been made redundant several months earlier, Mrs B and himself asked to benefit from the provisions of Article 125-0 A of the French General Tax Code which provides that revenue from capitalisation warrants or contracts or life insurance policies are tax exempt when their redemption is due to their beneficiary being made redundant.
Several months prior to the redemption of the life insurance policy, Mr A was hired by his wife for a very short period even though the latter had discontinued her business activity. The hiring followed very soon after by Mr A being made redundant just before the redemption of the policy appears to have been carried out with the sole aim of avoiding paying income tax.
Warning signs:
– Mr A hired by his wife who had discontinued her business activity – Hiring followed by redundancy within a short period of time – Redundancy occurring shortly prior to the redemption of the life insurance policy
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
21
EXAMPLE 2: DETECTING THE LAUNDERING OF THE PROCEEDS OF ILLEGAL TRAFFICKING IS PARTLY RELIANT ON MONITORING FLOWS OF CASH
The use of cash transfers is a laundering method for all types of illegal trafficking (drugs, counterfeits, humans). Money remittance transactions enable cash to be sent to the countries of origin or transit of the goods and persons subject to the trafficking. The ringleaders use intermediaries to pay suppliers and collect the revenue generated.
Tracfin receives information on some of the transfers made to and from France by means of systematic information disclosures (COSIs) concerning money remittance transactions.23 The Unit is able to use this information to work on transactions for small amounts which would not have been subject to STRs, but which could allow for identification of cash transfer channels connected to trafficking, for the network of targeted stakeholders to be broadened and for potential international connections to be pinpointed.
The enactment of the EU’s Fifth AML/CFT Directive in French law24 bolsters Tracfin’s detection and investigation capabilities. The Unit can now send information requests concerning the persons referred to in the systematic information disclosures provided for by Article L.561-15-1 of the French Monetary and Financial Code in the same manner as those mentioned in the STRs or the information received from national government departments or foreign FIUs.
Drug trafficking, a closely monitored national threat The national risk analysis has flagged up drug trafficking as one of the largest threats in France. The French drugs market, which is one of the most active in Europe, has witnessed the arrival of organised drug crime (narco-banditisme), materialised by heightened cooperation between different types of criminals (traffickers, traditional organised crime and foreign criminal groups). Due to its geographic location and its port and airport infrastructure, France is both a drug consumption area and a transit point towards other countries.
Many vectors are involved in laundering the proceeds of drug trafficking in France as well as in the producer or transit countries. Usual methods for fund remittance, the physical transportation of cash and international transfers exist alongside more elaborate methods such as the organisation of cash collection and settlement networks or the conversion of cash into gold. The proceeds of trafficking can also feed into the underground economy, in particular undeclared work, or be laundered through property investments, takeovers of commercial companies or gambling.
23. Credit, payment and e-money institutions are bound to systematically provide Tracfin with information on money remittance transactions carried out from a cash payment or by using e-money of an amount of €1,000 per transaction or a total of €2,000 per customer for a calendar month (Articles L.561-15-1 and D.561-31-1 of the French Monetary and Financial Code).
24. Order no. 2020-155 of 12 February 2020 bolstering the French AML/CFT system and Decrees no. 2020-118 and no. 2020-119 of 12 February 2020.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
22
CASE STUDY 4
Repatriation of funds originating from suspected drug traffickingA dozen or so South American nationals living in mainland France made a large number of cash transfers that were not commensurate with their insecure financial and employment situations. Four of them were known to the authorities for multiple offences connected with the acquisition, possession, use, transportation and import of drugs (cocaine and cannabis).
Over a period of several years, the group received over €95,000 from around sixty senders based in different towns and cities in mainland France. Concurrently, the group transferred €250,000 in cash from a dozen French towns and cities to a hundred or so individuals in French Guiana. A number of these French senders and Guianese beneficiaries were known for offences against drugs legislation. Associative links were established between several individuals which revealed a network structure: money remittance transactions carried out from the same institution, use of shared telephone numbers, collectors’ homes within a close geographic radius, senders connected by common beneficiaries.
The main sender of cash to French Guiana was Ms X. She managed a number of catering businesses (bars, cafés) and travelled on a regular basis between mainland France and French Guiana. Her companies had no business activity except for atypical financial transactions: receipt of funds from companies not operating in her sector of activity, receipt of welfare benefits. Ms X’s companies appeared to have been set up solely to launder the proceeds of drug trafficking.
Warning signs:
– Cash transfers between individuals without economic reasons between areas at risk as regards drug production
– Associative links between the individuals – Physical travel between the cash transfer sending and receipt areas – Use of a company with low, or even fictitious, volumes of business activity
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
23
Mrs X
French Guiana
South American nationals
€95k
Potential injection of funds of criminal origin
Manager
Catering company
€250k
Criminal records for drug-related offences
Physical travel
CASE STUDY 4: Repatriation of funds originating from suspected drug trafficking
Criminal records for drug-related
offencesCriminal records for drug-related offences
The fight against counterfeiting, a challenge for the protection of consumers and intellectual property rights Counterfeiting involves reproducing, imitating or using an intellectual property right, such as a trademark, patent, drawing, model or work, without its owner’s authorisation. It affects all types of products, including clothing, fashion accessories, mobile phones, medicinal products or car parts. At European level, it is estimated that, between 2012 and 2016, the trade in counterfeit products accounted for 6.8% of imports and caused tax losses of €16.3bn every year.25 France is thought to be one of the countries most affected by sales of counterfeits from Asia or from Italian mafia networks, in particular the ‘Ndrangheta.
It is hard to detect underlying networks due to the large number of cash transactions in the illegal trade in counterfeit products. But, the huge increase in online sales of counterfeits raises the core question of the accountability of digital platforms in the prevention, detection and dissemination of counterfeit content. As there are no binding obligations, the majority of platforms do not currently take action in this respect. The emergence of counterfeit trafficking on e-commerce platforms and the subsequent use of electronic payments via payment service providers (PSPs) nevertheless open up broader detection channels for financial institutions if due diligence requirements are complied with across the entire payment chain.
Financial institutions are alerted when all or some of the following signs appear: – Unusually large financial flows on online sales platforms – Use of several foreign PSPs to make it more difficult to track flows – Company’s corporate purpose related to the types of goods susceptible to
counterfeiting (e.g. “retail clothing sales”) – Financial links with individuals or legal entities based in a country “at risk”
as regards counterfeiting – For an individual, financial movements incommensurate with the declared lifestyle – For a legal entity, financial flows inconsistent with the declared business activity
25. Government Audit Office, La lutte contre les contrefaçons, March 2020 (in French).
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
24
CASE STUDY 5
Network laundering the proceeds of suspected counterfeit product trafficking A group of a dozen individuals, with insecure employment and financial situations, were involved in the transfer and receipt of cash totalling almost €300,000 over a 20-month period. The transactions were carried out between various French départements and were destined for country A which was notorious for manufacturing counterfeit goods. The individuals in question had already carried on a retail activity or kept stands on markets; one of them was also known to the customs authorities for repeat counterfeit selling offences.
The group received cash from a hundred of so different individuals who were all based in France. A number of them were known for violation of anti-counterfeit legislation, such as the possession and transportation of counterfeit goods, tobacco smuggling or possession of counterfeit or forged money. One of the senders was identified on social media accounts set up especially for the sale of counterfeits. The collected funds were then transferred to around fifty individuals in France, several of whom were known for counterfeit selling offences. Within the network, Mr J appeared to have a key role both in terms of the proportion of amounts in cash handled by him and his presence in country A. His bank account was also credited with cash payments for a total of €150,000 without any justification of the origin of the funds.
The group was suspected of trafficking counterfeit products as part of a structured network in France which could have been acting as a purchasing platform in relation with country A, enabling supplies to be made to a number of French cities.
Warning signs:
– Inconsistency between the amounts of transferred funds and the individuals’ declared income
– Connection between the individuals (common senders and beneficiaries, transfers made from the same counters)
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
25
Markets, social media, e-commerce platforms
Network of collectors
CASE STUDY 5: Network laundering the proceeds of suspected counterfeit product trafficking
Mr J
Country A
Country “at risk” as regards counterfeiting
1
Counterfeits?
3
4
Handling counterfeits?
2
Individuals
€300k
EXAMPLE 3: THE MAIN MONEY LAUNDERING TRENDS MAKE ACTIVE COOPERATION BETWEEN TRACFIN AND ITS FOREIGN COUNTERPARTS ESSENTIAL
Reporting entities are bound to send STRs to the FIU of the country in which they are based. This territorial notion is supplemented by the related requirement of sharing and comparing information between FIUs. As part of these exchanges, the FIUs must use safe communication channels and are encouraged to use FIU.net, a secure and decentralised network for exchanging operational data between FIUs of EU Member States. To allow for reliable, operational and effective exchanges, Tracfin has worked in the area of bilateral relations to execute cooperation agreements with its foreign counterparts, including European ones.
Heightening cooperation between national FIUs is a strategic imperative of the European Council. The fifth Anti-Money Laundering Directive 2018/843, which was enacted in French law in February 2020, aims to improve operational cooperation between national FIUs. There is no doubt that close international cooperation is now vital.
Specifically, international cooperation can be effectively leveraged against terrorism and financial crime. Cross-border cooperation between Tracfin and other FIUs covers very broad issues such as tax evasion and laundering its proceeds, fraud and laundering its proceeds and terrorist financing.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
26
Unsolicited reports sent by the FIUs to Tracfin provide crucial information as the internationalisation of financial circuits is on the rise. Reporting entities experience more problems in detecting international financial circuits, especially when the latter are restricted to an approach by departure or arrival channel in France. As a result, international cooperation enables the information reported by the entities to be substantiated and leads to investigations being sent to the courts or to other departments.
INSTITUTIONAL COOPERATION BETWEEN TRACFIN AND THE FINANCIAL INTELLIGENCE UNIT (FIU) OF THE NETHERLANDS CONTRIBUTES TO COORDINATION OF EUROPEAN FIUS
Hennie Verbeek-Kusters, Head of the FIU of the Netherlands
In July 2019, Hennie Verbeek-Kusters, Head of the Dutch FIU and the Head of Tracfin’s International Department, were elected to represent the FIUs of the EU and the European Economic Area (EEA) on the Egmont Committee (equivalent of the Egmont Group’s board).
In this respect, they organise, at each Egmont Group meeting (twice yearly) and on the fringes of each meeting of the EU FIUs Platform in Brussels (four times per year), a regional meeting of the FIUs of the Egmont Europe I region. The meeting deals with Egmont Group news related to the Committee’s work such as the review of the IT tool which enables the member FIUs to exchange information. The projects handled by European FIUs within the Egmont Group’s various Working Groups, for which contributions are sometimes expected, are also discussed. Hennie Verbeek- Kusters considers that “these regional meetings are crucial moments in the functioning of the Egmont Group; they enable the FIUs of each region – which have similar features and face similar challenges – to discuss operational issues of joint interest, such as bolstering the capabilities of FIUs to combat the use of virtual assets in money laundering or terrorist financing scenarios”. In this respect, the Dutch and French FIUs organised a workshop, which took place in Brussels in
December 2019, to present their respective working methods and the resources used by their specialists to examine transactions carried out using blockchain, not only with the aim of promoting best practices but also to flag up the scope for progress in cooperation between FIUs in the field of crypto-currencies.
More broadly, Ms Verbeek-Kusters and Tracfin’s International Department are looking to heighten coordination and harmonisation of the stances of European FIUs on all European subjects of common interest and, in particular, as part of the many discussions undertaken in wake of the European Commission’s publication of its anti-money laundering “package” in July 2019 and its action plan in May 2020. They took the initiative of drafting a number of “non-papers” which set out constructive and bold proposals from European FIUs to outline a future “support and coordination mechanism” for FIUs which has been called for by the Commission and the European Parliament. “It is vital for European FIUs to take an active part in these discussions to help, especially by making the European institutions aware of the operational reality of their day-to-day operations, strengthen their ability to collectively combat money laundering and terrorist financing”, said the Head of the International Department. Against this backdrop, European FIUs are advocating setting up a network of FIUs which would allow for greater consistency in European financial intelligence strategy and would ensure operational cooperation between FIUs by, for instance, promoting the standardisation of certain practices and resources used by the latter.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
27
CASE STUDY 6
Identification of potential fraud due to reports from a FIUFInformation received from one of Tracfin’s partners showed that a company trading in IT components (company A), which was based in a neighbouring country (country A) and managed by Ms X, a French national who lived in France, received a large number of transfers from French individuals on a number of bank accounts held in country A. Concurrently, another report revealed that French individuals were also transferring funds to another company (company B) which sold software, was registered in another EU Member State (country B) and was also managed by Ms X.
The funds sent by the individuals to these two companies, which sometimes represented very large amounts, appeared to be for investments in crypto-assets which are allegedly highly profitable. On a mirror website, which was cloned from the company’s official site, unknown operators offered potential clients based in France the opportunity of making financial investments by leading them to believe that they were visiting a website specialising in crypto-asset investments.
As it turned out, the returns were low, despite aggregate investments of €3m. Companies A and B then transferred all the funds received to foreign companies based outside the EU or in Asia and whose corporate purpose was not connected with the crypto-asset sector.
The large overall amount of these transfers abroad over a short period of time, and the number of contributors and beneficiaries abroad led to suspicions that there was a huge fraudulent network at transnational level based on promises of very high returns on an intangible product.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
28
French individuals investing in crypto-assets
Company A
Company B
Country A
Country B
Manager
Mrs X
Bank accounts held in country A
Banks accounts held in country B
Companies based outside the EU or in Asia and not
specialised in the sale of crypto-assets
Transfer of all the fraudulent funds
Transfer of all the fraudulent funds
€3m
Unknown operators in contact with potential investors via a mirror website for
companies A and B
CASE STUDY 6: Identification of potential fraud due to reports from a FIU
An effective anti-tax evasion mechanism International cooperation is a particularly effective means of fighting tax evasion. Within the EU, organising financial arrangements for the sole purposes of tax evasion has been made easier by the setting up of the SEPA which has standardised payments and facilitated the opening of bank accounts in all the area’s countries.
A number of FIUs, which were previously reluctant to disseminate tax-related information, have made a U-turn. This has been materialised by the stepping up of international cooperation in this field.
Unsolicited reports from FIUs enable Tracfin to identify assets held by French residents that have not been declared to the French tax authorities. This information can substantially clarify facts already set out in the STRs sent by the reporting entities. This means that the reports can lead to information being sent to the French tax authorities and to tax audits.
CASE STUDY 7
Unsolicited information from a FIU leading to a report being sent to the French tax authorities Mr Z, a resident of France for tax purposes, had autoentrepreneur status for his business activity as a repairman. He was known to the police for acts of violence, fraud and damage to the property of third parties. As part of his activity, he was involved in numerous scams on the Internet. A number of testimonies from individuals attested to improper practices: prohibitive prices, damage to property when carrying out repairs. He was also known to the tax authorities which carried out two audits after having discovered foreign bank accounts that had not been declared by Mr Z.
In an unsolicited report, the FIU of country A advised Tracfin that Mr Z had three bank accounts in that country through which almost €2m had transited since 2010. According to Mr Z, the majority of this amount came from his business activity which was, however, carried on in France. The accounts were mainly credited by paying in cheques made out to Mr Z in payment of invoices related to his activity. Almost €300,000 had been collected since 2019 whereas Mr Z only declared income of €20,000 for that year to the tax authorities. Mr Z’s bank accounts in country A were therefore used to conceal a large proportion of income from his activity in France.
Tax audits may be followed by searches. Cooperation between Spain’s Financial Intelligence Unit (SEPBLAC) and Tracfin led to tax searches as part of tax evasion cases.26 26. For more information
on this case, see Tracfin, ML/TF risk trends and analysis in 2018/2019 report, December 2019, p. 37.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
29
CROSS-BORDER COOPERATION FOR AML/CFT ISSUES BETWEEN FRANCE AND SPAIN
Cross-border cooperation between FIUs which face AML/CFT issues with similar features is vital to enable rollout of prevention measures or penalties (judicial investigations, tax searches, seizures). Collaboration between Tracfin and SEPBLAC, Spain’s FIU, which was formalised by a bilateral cooperation agreement executed in 1996, plays an active role, through exchanges of information, in identifying suspected cross-border ML/TF.
These exchanges of information cover various tax evasion issues: avoidance, concealing income, doubts as to the residence for tax purposes of the individual in question. They also enable circuits for laundering the proceeds of various fraudulent activities such as false transfer orders to be brought to light and for suspicions of terrorist financing to be confirmed or disproven when suspect financial transactions involving nationals of both countries are identified.
INTERVIEW WITH SEPBLAC
“In 2019 SEPBLAC received 57 requests for information from Tracfin (which represents a 60% increase compared to the 34 received in 2017) and 3 spontaneous disclosures (4 in 2017 and 5 in 2018). Meanwhile, SEPBLAC made 11 requests for information to Tracfin and shared 28 reports in the form of spontaneous disclosure.
Year after year the level and quality of the cross-border collaboration between SEPBLAC and Tracfin has drastically improved. The exchange of information between our FIUS is smooth, effective and does not present any specific problem. Currently Tracfin constitutes a great example of how international exchange of information should work.
– How is SEPBLAC organised to deal with cooperation requests from foreign counterparts and how do you share with them spontaneous reports? How many people are conducting investigations and more particularly from an operational perspective, how many people are dedicated to international cooperation?SEPBLAC is organized in three main coordination areas: Financial Intelligence, Supervision and Inspection, and Planning. Likewise, the Central Financial Intelligence Brigade of the National Police, the Investigation Unit of the Civil Guard and a Unit of the State Tax Administration Agency (AEAT by its initials in Spanish) are also assigned to SEPBLAC. SEPBLAC is an inter-agency body in which, under a single direction, professionals from five different State institutions (Ministry of Economic Affairs and Digital Transformation, Bank of Spain, Tax Administration (which includes Customs Surveillance), National Police and Civil Guard), perform their AML/CFT functions taking stock of these synergies.Around 60 employees are currently conducting financial analysis from an operational perspective. This figure includes officers from National Police, Guardia Civil and the Tax Administration. The team devoted to the exchange of information at international level is composed of 6 analysts.
– What are the main ML/TF typologies observed by SEPBLAC which involve French nationals or the French territory? What are the most common typologies on which SEPBLAC questions Tracfin?« Main typologies involving French nationals or the French Territory include intra-community VAT, fraud taxes schemes, frauds and scams and
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
30
in a lesser extent, foreign PEPs/corruption and terrorism financing. Half of the requests for information remitted by SEPBLAC to Tracfin in 2019 had origin in ongoing investigations being conducted by the Spanish LEAs whilst the other half came from SARs. No common typologies patterns could be observed since the requests were related to a wide range of activities and underlying offences, including drug trafficking, organized crime, robbery, scams, terrorism financing or the intensive use of cash.
– What are the main criteria to launch an investigation by SEPBLAC, based on a report shared by Tracfin? What are the strengths on which SEPBLAC can rely to initiate in-depth investigations? Did SEPBLAC ever refer to the prosecuting authorities based on a report shared by Tracfin? If yes, on what typologies?According to our files, in 2019 SEPBLAC received 3 spontaneous reports from Tracfin. From these one was filed as the information provided had already been analyzed as a consequence of a previous SAR, another involving a BEC (business email compromise)27 fraud was disseminated to Guardia Civil and the last one, referring a tax matter, was shared with the Tax Agency. The information received from Tracfin disclosures (as any other operational information received by SEPBLAC) is treated, according to a risk approach, and categorized with a level of risk that will determine the urgency of the dissemination. The information may have an urgent treatment, depending on aggregate risk elements (associated predicate offences, main ML/TF risks, links to ongoing LEA investigations, etc.).
In 2019 SEPBLAC received 57 requests for information from Tracfin relating a great variety of suspicious activities, in many cases involving bank accounts located in Spain. According to the nature and relevance of the criminality involved, the possible links with other analysis being conducted at SEPBLAC or with ongoing LEAs investigations and the utility of the information provided, an assessment is made to establish an eventual interest of the whole intelligence gathered by the international team (not only the information coming from Tracfin but also that may be obtained from the variety of sources available to us). In that sense, a great deal of the information contained in your requests was shared with the Spanish competent authorities, mostly National Police and Civil Guard but also the Tax Agency and in a lesser extent, the Special units within National Police and Civil Guard dealing with terrorism financing matters. At least in 2019 none of the intelligence reports including information from TRACFIN was disseminated to the prosecuting authorities.
– What are your priorities on a short term and mid-term perspective and what are the ML/TF issues on which Tracfin could provide support?Our priorities comprise a variety of typologies (organized crime, drug trafficking, all types of fraud/scams, corruption, human trafficking...), having present that the fight against terrorism financing is a key priority to SEPBLAC and that enhancing the level of understanding of the risks associated with new financial technologies is also a priority for us in the short term”.
27. Attempted spamming or phishing against a business.
A key measure in the fight against terrorist financing International cooperation for fighting terrorist financing is crucial: information exchanged between FIUs enables individuals with ties to extremist or terrorist organisations to be identified, for the links between these individuals to be pinpointed and for the connections of the networks to which they are affiliated to be highlighted.
When unsolicited reports from FIUs concern French nationals or individuals residing in France, who may be participating in a terrorist organisation, they enable the Unit to cross-reference these reports with other information. The Unit may, where applicable, share this intelligence with other national departments involved in combating terrorist financing.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
31
2T
RA
CFI
N -
ML/
TF
RIS
K T
REN
DS
AN
D A
NA
LYSI
S IN
201
9-20
20
32
MITIGATING VULNERABILITIES
A REVIEW OF THREE SECTORS THAT CARRY HIGH ML/TF RISKS
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
33
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
34
PROPERTY, A SECTOR IMPLICATED IN ALL THE STAGES OF MONEY LAUNDERING
Property investments are an important money laundering vector in France because of the specificity of certain market segments such as the Parisian housing market, which is driven by upward price pressure, and prestigious real estate in regions with high tourist potential such as the Côte d’Azur and certain mountain resorts.
However, ML risks in the property sector are not limited to these two segments. Tracfin has identified money being laundered through the purchase of mass-market suburban residential properties, financed by profits from drug trafficking, bribery of foreign public officials or unusual financial practices such as tontines.28 Commercial properties also offer opportunities for money-laundering networks.
The real estate sector involves a variety of professionals, some of whom are particularly exposed to ML risks. This is particularly true of property developers, property dealers and certain specialised investment funds registered abroad. The latter use complex arrangements to conceal the beneficial owner of the property and the origin of the funds used for its acquisition. The variety of professions present in the real estate market exposes this sector to all three money laundering phases: placement, layering and integration.
Risks exist at all stages of the lifecycle of a property project: during the award of property contracts (bribery of public officials), during the construction phase (use of undeclared labour by construction companies), during property transactions or leases (concealment of profits from various crimes, manipulation of property prices, fraudulent use of tax exemption schemes, Ponzi schemes), or when taking out a property loan (use of false documents).
Notaries and estate agents, who are subject to AML/CFT obligations, play a key role in detecting money laundering schemes in the property sector. TRACFIN has noted that their involvement increased in 2019. Notaries submitted 1,816 STRs (a 23% increase year-on-year), while property professionals submitted 376 (a 37% increase). However, the volume of information reported remains modest in view of the number of property transactions carried out each year in France (1,059,000 sales of existing housing between 1 October 2018 and 30 September 2019).29
A SECTOR USED TO FOSTER CONSPIRACY TO COMMIT FRAUD
Financing property transactions exposes financial institutions to lending money obtained illegally by fraudsters. The use of falsified documents concerning income and assets, or using false identity papers is frequently cited in STRs received by Tracfin.
These scams carried out by organised groups of criminals are based on an in-depth knowledge of the sector, sometimes with the backing of notaries or specialised professionals such as property dealers. The property dealer profession is not regulated by any specific legislation, and is not subject to AML/CFT reporting requirements. Nevertheless, it is a source of particularly high money laundering risk. It appears in the following typologies: – In association with large offshore fortunes or members of criminal gangs seeking
to reinvest some of their gains in property in France
28. The tontine is a scheme in the form of a collective annuity association. It allows a group of people to pool financial assets that are managed by a service provider. At the end of its term, the capital and income generated by its management are divided among the surviving members of the tontine. Although the scheme is legal, its operation has the particularity of resulting in the disappearance of the assets invested by the investor, thus suggesting an attempt to conceal them. See also Tracfin, ML/TF risk trends and analysis in 2015 report, December 2016, pp. 51-54.
29. National Association of Notaries (CSN).
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
35
– International corruption scenarios, compensation of dubious intermediaries or funneling money to concealed investors through the payment of economically unjustified commissions
– Mortgage fraud, misuse of company assets, carousel fraud or the use of undeclared labour for renovation works
CASE STUDY 8
Property loan fraud with the collusion of a notary’s officesMs X was an account manager at a credit institution. At the same time, she worked as a property dealer through Company M, of which she was the manager and sole partner. Ms X had personal financial connections with Mr Y, who appeared to be the de facto manager of Company M.
In the space of one year, Company M acquired nine properties for a total of €3 million without having the necessary financial resources to carry out these transactions. The properties were financed by third parties who took out mortgages with several banks using false documents such as false pay slips, false sales agreements and false deeds of purchase. The fraudulent loans were obtained with the collusion of a notary’s office, which issued certificates of authenticity for the loans. The notary’s office issued certificates of deposit of personal funds to its account, although the financial considerations could not be ascertained. It also recorded calls for funds from several banking institutions for the financing of a single property.
Unbeknownst to the lending banks, the funds were redirected from the notary’s office account to Company M. The final deeds of purchase drawn up by the notary’s office did not mention the borrowers as purchasers of the property, but rather Company M. In return, the individuals who had taken out mortgages appear to have been paid for their role in the fraud and the laundering of the proceeds by means of a low-value credit flow from the notary’s office account.
Mr Y also set up Company N, specialising in property transactions, which he immediately sold to Mr Z, a foreign PEP whose Parisian properties had been the subject of foreclosure auctions. Company N enabled Mr Z to acquire a prestigious property without however identifying the origin of the funds used.
The initial judicial investigations carried out on the basis of information provided by Tracfin led to the arrest of some twenty people and the seizure of some thirty properties.
Warning signs:
– Repeated use of the same mortgage fraud scheme – All property transactions carried out via a single notary’s office – Presence of a PEP as part of a property transaction
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
36
A SECTOR USED AS A VECTOR IN THE INTEGRATION STAGE OF MONEY LAUNDERING
The value of property transactions makes this sector a prime vehicle for the integration of funds derived from various crimes and offences. The purchase and sale of properties and their financing through the repayment of mortgages facilitate the laundering of fraudulent or criminal funds, particularly when the transactions are carried out through structures or financial arrangements designed to conceal the identity of the beneficial owner.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
37
Commission
CASE STUDY 8: Property loan fraud with the collusion of a notary’s office
Mr Y
Mrs X
Mr Z
Purchase
False documents
Company M
Société N
Owns
De factomanager
Owned
- Foreign PEP- Several properties
seized
Property
Properties
Complicit notary’s office
Victimised credit institutions
€3m
€3m
1
2
3
4
Network of fraudulent bank loans
€3m
€3m
Purchase
New manager
CASE STUDY 9
Suspected conspiracy to defraud in connection with organised crimeMr X, manager of Non-trading Property Investment Company L, was involved in organised crime, particularly in the field of drug trafficking. In the space of a few months, Non-trading Property Investment Company L registered the sale of several properties linked to the subdivision of an industrial plot of land it owned. The purchasers, presenting identity documents issued by European countries, invested the sum of €7.50 million. The warehouse on the plot was previously used for the manufacture of narcotics.
The purchase was financed via real estate loans obtained on the basis of stolen identities and questionable supporting documents. The amount of the loans disbursed to finance investments did not match the assets declared at the time of the loan. All property transactions were authenticated by the same notary.
The initial bank charges for the loans were financed through accounts linked to Mr X, instead of the purchasers, revealing his likely role as coordinator and supervisor of the fraud scheme. Part of the funds from Non-trading Property Investment Company L’s real estate sales were channelled through an account opened with a European payment service provider. With the help of criminal accomplices, Mr X also transferred a portion of the capital gains to the bank accounts of several companies registered in several European countries.
The laundered funds were reinvested in real estate transactions in France in the name of members of Mr X’s family.
Warning signs:
– Use of false foreign identities, in particular corroborated by the absence of tax or banking information
– Inconsistencies in the supporting documents needed to release the borrowed funds – Inconsistencies between the actual use of the loan amount and the use declared at the time of subscription
– Transfer of a portion of the profits from real estate sales to foreign bank accounts, without any economic rationale
– Use of a single notary for all purchase and sale transactions
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
38
CASE STUDY 10
Suspected laundering of the proceeds of tax evasion, fraudulent organisation of insolvency and real estate investmentMs X was the founder of Group G, which comprised some forty companies specialising in property throughout France. The structure was held by Non-trading Property Investment Company A, in which Ms X’s daughters had equal shares.Ms X had no bank account in her name in France and had already been convicted of tax evasion on several occasions. Tracfin’s investigations revealed that she was the subject of new legal proceedings for aggravated tax evasion, money laundering and fraudulent organisation of insolvency.
Ms X held a claim of more than €9 million against Group G, which had been funded for several years by various deposits into current accounts. However, all of the accounting documents and evidence of these transactions disappeared shortly before a criminal search, making it impossible to trace the origin of the funds.
A settlement agreement concluded between Group G and Ms. X, through the intermediary of Holding Company A, provided for the settlement of all the claims held by Ms. X in the group’s companies in return for her renunciation of the capital and financial connections linking her to the group’s entities.
All of the debts, i.e. €9 million, were thus transferred to Non-trading Property Investment Company O, then six months later to Non-trading Property Investment Company P, both managed by Ms X. Non-trading Property Investment Company P then received a transfer of €9 million corresponding to the settlement of Holding Company A’s debt. The funds
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
39
CASE STUDY 9: Suspected conspiracy to defraud in connection with organised crime
Official purchasers
Mr X
Family ties
Same notary
Relatives of Mr X
SCI L
Manager
Warehouse formerly used to manufacture narcotics
converted to properties
EU countriesFrance
Seller
Purchasers
€7.5m
Purchasers
Fraudulent loansRepayment of loans
Properties
CompaniesBank accounts
PSP account
Hold
Removal of funds
Payment for new properties
1
2
3
were partly used to purchase a property in an Alpine resort worth €6 million and the rest was paid into a bank account in a country that favours banking discretion and held by Company R, which was managed by one of Ms X’s daughters. This transaction was part of a €12 million loan granted by Non-trading Property Investment Company P to Company R without any document having been sent to the tax authorities.
Because of the legal proceedings against Mrs X, this final transaction was the subject of an objection by Tracfin.
Warning signs:
– The fact that Ms X had no bank account in her name in France – The unfavourable factors concerning Ms X and her judicial convictions could be found in public records
– A number of financial flows without justification between the accounts of Ms X and the structures comprising Holding Company A.
– Implementation of a legal and financial scheme to remove the funds from a judicial attachment
A SECTOR EXPOSED TO LAUNDERING THE PROCEEDS OF BRIBERY AND THE MISAPPROPRIATION OF PUBLIC FUNDS
The weakest links in the French property sector have to do with high value transactions, particularly in the luxury and business property segments. These transactions appear to be more risky when they involve property located in border areas or when they involve foreign clients. Some are aimed at laundering the proceeds of corruption or misappropriation of public funds.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
40
CASE STUDY 10: Suspected laundering of the proceeds of tax evasion, fraudulent organisation of insolvency and real estate investment
Holding A
Mrs X Daughters of Mrs X
Group G
- No bank account in France- Convicted of tax evasion- Legal proceedings underway
Equal partners
Owns
Founder
Owes €9m
Contributions to current accounts
Funds of unknown origin Property holding company O
Property holding company P
Transfer of debt Transfer of debt
Owns
1
2
3
2
Property
€6m
Company R
Own
Bank account
Owns
€3m
Tracfin right of opposition
CASE STUDY 11
Suspected money laundering from misappropriation of public funds in high-end propertyeThree luxury property development projects located in the same geographical area were the subject of several off-plan sales under suspicious conditions:
– Two couples, nationals of Country A, purchased four properties for a total of €3 million, financed by transfers from the bank accounts of companies registered in five different countries (Countries B, C, D, E, F), all of which are sensitive in terms of money laundering. These trading companies were used as financial intermediaries between the embargoed country A and France. Three of these purchases were made with the assistance of a notary’s office, which appears to be actively involved in the suspected money laundering circuit.
– Five individuals, including nationals of embargoed countries, acquired seven properties for a total of €8m. These individuals are close to foreign politically exposed persons (PEPs), directors of large government-owned companies in the same country or are known to be involved in cases of misappropriation of public funds through their role as «launderers».
All of these factors indicate a deliberate attempt to invest in property using funds derived, in whole or in part, from the circumvention of an embargo or from possible misappropriation of public funds. Tracfin renews its call for increased vigilance by the legal and property professions regarding the origin of funds used for property acquisitions. Their knowledge of the sector and their involvement at the various stages of a property’s life (acquisition, disposal, financing) give them a unique ability to detect such transactions.
Warning signs:
– Purchases of prestigious French property by nationals of embargoed countries and persons prosecuted for misappropriation of public funds
– Use of centralised management accounts used for off-plan sales, which facilitates the receipt of one-off international transfers for the purpose of staggered financing of purchases
– Use of complex international financial arrangements, in particular through the intermediation of commercial companies domiciled in countries presenting a high risk of money laundering
– Use of the same notary by several buyers, suggesting a certain level of coordination
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
41
ML/TF RISKS ASSOCIATED WITH OFF-PLAN PROPERTY SALES
An off-plan sale is an agreement whereby a buyer purchases a property that is under construction, which the seller agrees to deliver to him/her when it is completed. Like every property sale, it must be registered by a notary. The deed of purchase must be a notarised instrument and must contain:– An accurate and detailed description of the
property– The price and the payment schedule based on
the progress of the work, with the amounts not exceeding:30
• 35% of the purchase price at the completion of the foundations • 70% of the purchase price at the topping-out • 95% of the purchase price at the completion of the building • And the remainder (5%) when the property is made available to the buyer
The notarised deed indicates an initial payment into the notary office’s bank account and subsequent instalments paid into a centralising account. This latter account is a technical account
that serves as an intermediary between the private buyers and the property developers. Transfers are made into it based on the state of advancement of the work.
Financing property via off-plan sales necessarily involves the bank account of the notary registering the deed, which is held at the Caisse des dépôts et consignations (CDC). It also involves a bank that registers the instalment payment via the centralising account of the property development programme. This is different from a traditional property sale, where all financial flows are recorded in the notary’s CDC account. Staggered payments enable individuals or legal entities to settle instalments in a fragmented manner, sometimes as part of large international money laundering networks. Some money laundering operations are likely to be carried out with the collusion of property developers.
Greater vigilance is required when funds originate from abroad or transit through third-party companies that have no apparent economic justification to be part of the transaction.
30. Article R. 261-14 of the Construction and Housing Code.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
42
Other countries
- Persons close to foreign PEPs- Directors of government-owned companies- "Launderers" in cases of misappropriation of
public funds
CASE STUDY 11: Suspected money laundering from misappropriation of public funds in high-end property
Nationals
Country A
Commercial companies
Sensitive countries in terms of money laundering
Country B, C, D, E, F
Property – off-plan salesNotary’s office
Instalment
Centralised management accounts used for off-plan
sales
Intermediary payments
Sells
Property developer
Beneficiary
Nationals
2€3m
1
Intermediary payments2
1Instalment
€8m
THE ART SECTOR IS VULNERABLE TO THE RISKS OF BOTH MONEY LAUNDERING AND TERRORIST FINANCINGE
The art market sector comprises more than 130,000 professionals31 (gallery owners, antique dealers and second-hand dealers). A number of factors make this sector particularly vulnerable to ML/TF risks, including:
– A significant number of cash payments: the ban on cash payments above €1,000 is applicable only to French residents. Foreign nationals, who are very much present in the art sector, can pay cash for their purchases, up to a maximum limit of €15,000.32
– Highly fluctuating sale prices: the art market has a complex speculative dimension. In public sales, the rating system is subject to very disparate criteria that may mask certain money laundering operations. Professionals have few vigilance measures to detect possible collusion between sellers and buyers for the purpose of manipulating prices. Lastly, art fairs are places for over-the-counter sales with no possibility of monitoring the transactions and prices charged. There is a high risk of handling stolen goods.
– Growth in remote auctions and sales: prior checks on internet sales, organised by auction houses, are often insufficient (limited KYC, lack of traceability of works and funds). Furthermore, independent sales, via the deep web or dark web, facilitate the trafficking of works of art.
– The internationalisation of the profession and of financial flows: the worldwide presence of the major art auction houses, as well as the use of offshore companies and accounts by certain buyers and sellers, make it difficult to trace the works sold and the funds used.
– Misuse of free-trade ports: initially created to store raw materials and subsequently manufactured goods for a limited period of time, most of them have become long-term storage areas for high-value works of art, offering anonymity and security to their owners. They are used to blur the traceability of an asset and avoid possible controls. Buy/sell transactions can be carried out from one owner to another without the works leaving these warehouses. The major flaw of free-trade ports in terms of AML/CFT stems from the absence of an obligation to declare the works’ beneficial owner.
– The still very limited involvement of reporting professionals in the AML/CFT system, especially auctioneers and auction houses, who, given the momentum of the art market and the financial stakes involved, rarely file STRs
– Exposure to the risk of terrorist financing through trafficking in archaeological objects
The supervisory and sanctioning mechanism as regards professionals in the art sector was strengthened by Order No. 2016-1 635 enacting the 4th Directive of 1 December 2016 into French law, which confirms that persons habitually engaged in trading in antiques and works of art are subject to the national AML/CFT framework. The Directorate General of Customs and Excise (DGDDI) has been designated as the supervisory authority for these professionals and the National Enforcement Commission as the enforcement authority. Tracfin and the DGDDI published joint guidelines on 10 May 2019 for this sector of activity.
31 Estimate from April 2019.
32 Decree No. 2015-741 of 24 June 2015 barring cash payments for certain claims.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
43
A SECTOR USED TO CIRCUMVENT TAX OBLIGATIONS
Despite its attractive tax regime, the art sector remains vulnerable to tax evasion. The methods used to circumvent the tax obligations associated with the acquisition of works of art can take different forms:– The sale of a cultural good may be carried out without any legal procedure or at
a reduced price so that the buyer and seller evade some or all of the taxes relating to or arising from the transaction. This evasion is facilitated by the difficulty of assessing the price of the good, whose value is often subjective.
– Cultural goods can also be sold through various offshore structures that create complex legal arrangements. These structures make it possible to inject and launder the proceeds of tax evasion into the legal art market.
– Art dealers themselves can under-report their professional income declared to the tax authorities. This practice is facilitated by the frequent use of cash during transactions and by depositing cheques issued by buyers directly into the art dealers’ personal accounts.
CASE STUDY 12
Suspected trafficking in works of art and laundering the proceeds of tax evasionMr Y was the manager of a French antiques gallery, Gallery A. In 3 years, Gallery A’s bank account was credited with €7 million from a trust registered in a foreign country. The distinctive feature of trusts is that they make it difficult to identify their beneficial owners.
Most of the funds, €5 million, were transferred to several European galleries to finance the purchase of artworks. Of this amount, only three transactions, totalling €2 million, were the subject of declarations of trade in goods filed with the customs services. The remaining €3 million was transferred to another gallery, Gallery B, whose manager was suspected by his country’s legal authorities of being involved in dealing in stolen antiques.
The invoices for the purchase of antiques by Gallery A from Gallery B contained irregularities: the VAT number was not valid for cross-border transactions in the EU and was linked to a company that has been inactive since 2014. The transactions between the two galleries were not declared to the customs authorities. Lastly, €150,000 credited to Mr Y’s account from Gallery A’s account was withdrawn in cash. These funds could have been used to finance an undeclared commercial activity. The elements described above could constitute tax fraud and tax laundering and are likely to be part of efforts to launder the proceeds of art trafficking.
Warning signs:
– The origin of the funds used to purchase the works of art by Gallery A from Gallery B could not be established because of the involvement of a trust
– The invoices for the transactions between the two galleries contained irregularities – The majority of the goods acquired were not declared to the customs authorities – Mr Y used his personal account as a transit account to make substantial cash withdrawals
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
44
VIOLATIONS OF THE REQUIREMENT TO DECLARE THE EXPORT OF CULTURAL GOODS
Customs fraud involving the trade in cultural goods observed by the Unit include the undeclared export of goods sold within and outside the European territory, failure to obtain an export licence from outside the EU, and imports of goods not accompanied by an export licence from the country of origin or from conflict zones.
The purpose of these types of fraud is to evade the payment of taxes, such as the 5.5% VAT on imports of works of art, antiques and collectors’ items or the 6% flat-rate export tax on jewellery, works of art, collectors’ items and antiques. These frauds also provide cover for the illegal trade in works of art.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
45
Declared goods
Suspected of dealing in stolen antiquities
CASE STUDY 12: Suspected trafficking in works of art and laundering the proceeds of tax evasion
EU country
Mr Y
Manages
Trust
Bank account
Manages
Owns
Gallery A
€7m
Non-EU country France
Funds of unknown origin
€150k
Art galleries
Gallery B
€2m
€3m
Mr Z
• Goods not declared to customs
• False invoices
THE LEGAL FRAMEWORK APPLICABLE TO THE EXPORT OF CULTURAL GOODS OUTSIDE THE EUROPEAN TERRITORYN
Council Regulation (EC) No 116/2009 of 18 December 2008 and the provisions of the French Heritage Code (Article L. 111-1 et seq.) regulate the export of cultural goods for the purposes of heritage protection. In this respect, all exports of cultural goods of historical, artistic, archaeological, aesthetic, scientific or technical interest out of the European customs territory are subject to an authorisation regime. Cultural goods whose export is subject to this regime fall under the provisions of Article R. 111-1 of the Heritage Code and its Annex 1. In addition to the export certificate (or temporary exit permit in the case of non-definitive exit from the national territory) provided for under
national law, European law requires an export licence to be issued for any exit from European territory of cultural goods as defined in Annex 1 to Council Regulation (EC) No 116/2009.
Furthermore, infringements of legislation concerning the protection of cultural property are punishable under the provisions of Articles L. 114-1 et seq. of the Heritage Code. Finally, the definitive export from the EU of jewellery, works of art, collectors’ items or antiques may, in accordance with the terms and conditions set out in Articles 150 VI et seq. of the General Tax Code, be subject to a flat-rate tax of 6%.
CASE STUDY 13
Suspected customs violationMrs X was a national of Country A. She was a resident of France, where she worked as an antique dealer in the art gallery of which she was the director. In one year, her business bank account was credited with €3 million from an art gallery and a museum located in Country A. The French customs authorities found no export declaration from Mrs X’s gallery in return for these payments. Mrs X was suspected of exporting goods to Country A in breach of the regulations protecting cultural heritage.
Warning signs:
– Mrs X refused to respond to requests from her bank to verify the regularity and substance of the transactions
– Mrs X’s business account did not show any expenditure relating to transport costs to Country A
– The financial transactions noted are unrelated to export declarations t the customs authorities
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
46
THE ART MARKET IS CONDUCIVE TO TERRORIST FINANCING
Archaeological looting in conflict zones and in countries with unstable security situations is highly susceptible to the financing of terrorist organisations. Although antiquities trafficking has existed for a long time, its organisation has gained new momentum in the context of armed conflicts involving terrorist organisations controlling regions with a significant cultural heritage. Members of these organisations have developed professional methods for the mass exfiltration of looted goods, commonly known as «blood antiquities», to Western countries, before laundering them via the legal art market.
These traffickers use a variety of methods to insert looted antiquities into the legal economy. Examples include the successive sale of looted objects between insiders to blur their traceability, the export of looted antiquities via shell structures, the production of false customs documents to conceal the works’ country of origin, the production of falsified cultural property passports or the use of unscrupulous international art dealers and expert appraisers.
The prestige and international reputation of the French art market exposes it to trafficking in «blood antiquities». Act No. 2016-731 of 3 June 2016 establishing stricter measures to combat perpetration and financing of terrorism and organised crime created a specific offence for trafficking in cultural goods from terrorist groups’ areas of operation (Article 322-3-2 of the Criminal Code). Consequently, a French art dealer can be charged with possession or sale of cultural good removed from a terrorist group’s area of operation. If he/she is unable to prove the good’s lawful origin, the defendant is liable to a seven-year prison sentence and a €100,000 fine.
The fight against art trafficking can also be pursued through more common offences such as theft, handling of stolen goods, forgery, organised money laundering and conspiracy.
CASE STUDY 14
Financial elements relating to an antiquities trafficking network linked to a terrorist organisationThe opening of judicial proceedings relating to the trafficking of antiquities organised by terrorist groups has enabled Tracfin to identify the role of several intermediaries in the trafficking of antiquities in Europe. The financial ramifications point to Western art dealers and gallery owners who are involved in laundering «blood antiquities».
Mr X ran Company A, an art gallery with branches in several cities and established in Country A. Mr X and Company A are being prosecuted in several countries for trafficking in antiques.
To sell the looted antiques, Mr X used Company B, a subsidiary of Company A established in Country B, to trade with European art dealers who were known to be part of an art trafficking network and to set up commercial relays in Europe. To this end, Mr X uses two direct intermediaries:– Company C, a foreign company registered in Country A, which favours banking
discretion, specialising in the storage of precious objects and known to have stored looted works of art in a free-trade port on behalf of Mr X
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
47
– A European art gallery, Company D, domiciled at the same address and with the same manager as Company B in Country B. It acted as a financial intermediary for the marketing of the works. The purpose of this partnership was to conceal the identity of the beneficial owners of the works of art acquired. This company received more than €4 million from transactions with collectors, an archaeologist and an auction house.
Mr Y was an antique dealer and owned a gallery in a European country (Country D). He was suspected by the authorities in his country of involvement in terrorist financing and of belonging to a criminal organisation. Mr Y has had extensive business relations with several French antique dealers. One of them had especially opaque and fragmented accounts between different structures registered in tax havens.
Mr Y used the services of an antiques gallery, Company E, to store his works in Country C. Company E’s bank account was credited with more than €4 million from the account of a French art gallery. Its manager did not file any intra-Community VAT declaration for purchases of cultural goods.
Warning signs:
– The presence of several individuals and legal entities known to the judicial authorities of their respective countries for their involvement in the trafficking of antiques
– Use of financial intermediaries for the marketing of looted works – Use of a personal account for a professional activity – Failure to file an intra-Community VAT declaration following a commercial transaction involving works of art
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
48
CASE STUDY 14: Financial elements relating to an antiquities trafficking network linked to a terrorist organisation
Gallery A
Country A Country B
Country C France
Mr X
Manages
Gallery B
Suspected of trafficking in
antiques
Subsidiary
Countries favouring banking discretion
Company C
Stores looted works
Company D
Shared address and manager
End purchasers of looted works
Sells
€4m
Physical transfer of works?
1
1
Country D
Mr Y
Suspected of terrorist financing
Commercial connections
Antique dealers
Opaque accounting
Shell companies
Gallery E
€4m
Stores looted works
Physical transfer of works?
2
2
Including French buyers
PROFESSIONAL SPORT, A SECTOR REQUIRING FORCEFUL APPLICATION OF THE AML/CFT SYSTEM
THE STILL-RECENT REGULATION OF THE PROFESSION OF SPORTS AGENT NEEDS TO BE TIGHTENED TO BOLSTER VERIFICATION OF THE RELATED FINANCIAL FLOWS
The profession of sports agent is regulated by the Act of 6 July 2000 amending Act No. 84-610 of 16 July 1984 on the organisation and promotion of physical and sports activities. This legislation laid the foundations for the rules relating to access to the profession, the conditions of its exercise and its control. There are more than 600 sports agents in France, about two-thirds of whom are in football.
THE LEGAL FRAMEWORK FOR THE PROFESSION OF SPORTS AGENT
A sports agent is a person who, on an occasional or regular basis, in exchange for compensation, brings together the parties interested in concluding a contract relating to the paid practice of a sporting activity, in accordance with Article L. 222-7 of the French Sports Code.
Act No. 2000-627 of 6 July 2000 amending Act No. 84-610 of 16 July 1984 on the organisation and promotion of physical and sports activities introduced the concept of the granting of a sports agent’s licence by the federations. The aim of this legislation was to clean up a profession in which abuses had been observed, such as double commissioning and payments to agents for the transfer of minors.
Licences are currently issued for a period of three years by the relevant delegated federation and must be renewed at the end of this period. The terms and conditions for the attribution, issuance and withdrawal of the sports agent’s
licence by the federation are defined by decree adopted after consultation with the Conseil d’Etat (French Supreme Administrative Court). It is the Commission interfédérale des agents sportifs, set up by the French National Olympic and Sport Committee (CNOSF), which takes part, alongside the sports agents’ commissions of the delegated federations, in organising the examination of the sports agent’s licence. Illegal exercise of the profession of sports agent is a criminal offence punishable by one year’s imprisonment and a fine of €15,000.
Nationals of EU Member States or other EEA countries may work as sports agents in France provided that they make a declaration to the sports agents’ commission of the relevant delegated federation.33
33. Articles L. 222-15 and R. 222-22 of the French Sports Code.
The Sports Code provides for the creation, within each federation, of a body with an independent power of assessment, empowered to refer cases to disciplinary bodies and with the task of ensuring the administrative, legal and financial monitoring of sports associations and companies that are members of the federation or professional league, or apply for membership of the federation or league.34 In particular, it stipulates that sports agents must submit all accounting documents relating to their activities on an annual basis.35
In practice, shortcomings in the application of the legislation have been observed: – Supervisory bodies may be satisfied with consistency checks – Monitoring campaigns may be limited – Agents licensed in a non-EU country are not included in controls – Regarding the disclosure of documents, the supervisory bodies do not have all
the accounting documents, especially those of consulting companies acting as intermediaries in certain transactions, including player transfers. For some of
34. Article L. 132-2 of the Sports Code.
35. Article R. 222-31.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
49
these companies, the beneficial owners are in fact sports agents. Consequently, the purpose of these companies may be to avoid submitting all accounting documents, to pay kickbacks on transfer transactions and to circumvent the rule whereby the sports agent’s compensation may not exceed 10% of the amount of the agreement between the parties he or she has brought together (pursuant to Article L. 222-17 of the Sports Code).
Since Act 2010-626 of 9 June 2010, sports agents have been subject to AML/CFT requirements pursuant to Article L. 561-2-16 of the French Monetary and Financial Code. Sports professionals have an underused reporting potential. Although sport is considered to be a high-risk sector in terms of money laundering, it is still insufficiently supervised and is not sufficiently involved in AML/CFT. A better understanding of the risks and greater involvement of professionals in this sector, particularly sports agents, is needed. The sports agent profession is particularly exposed to illegal practices and tax evasion.
CASE STUDY 15
Suspected laundering of the proceeds of tax evasionMr X claimed to be an international sports agent. He was prosecuted for illegally practising the profession of sports agent, but his case was eventually dismissed by the court in charge of the case. The investigations conducted by the Unit identified two offshore companies linked to Mr X, Companies A and B. These two companies shared the same address in a tax haven. To avoid appearing directly as the beneficial owner of these companies, Mr X used an authorised representative, a trust domiciled in the same tax haven.
The bank accounts of Companies A and B were credited with nearly €5 million, probably originating from the compensation of Mr X’s activity as a sports agent. These companies were also the source of several transfers to various French companies belonging to the same group, Group C, of which Mr X was the final beneficial owner.
Cross-lending occurred between the entities of Group C, blurring the origin and destination of the funds. The holding company also received funds directly from Companies A and B as part of a capital increase. Both A and B, as well as several companies belonging to the group, had not filed any tax returns for the last three years and their managers were tax defaulters.
Established in countries with privileged tax regimes that favour discretion, Companies A and B therefore serve as intermediary structures to conceal the origin of the funds received by Mr X that were not declared to the tax authorities.
Warning signs:
– Use of offshore companies with an authorised representative – Transfer of funds from two offshore companies to several companies of the same group with the same beneficial owner
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
50
The report of the Sports Commission of 19 April 201636 pointed to insufficient monitoring of the profession with regard to the financial flows generated by it. The lack of means to monitor financial flows linked to investment operations, kickbacks or remuneration was also highlighted in this report. Some recommendations were made to give the federations the additional task of monitoring the activities of sports agents and the financial flows linked to player placement operations.
In addition to cleaning up the sector and preventing illicit financial transactions, the implementation of these recommendations and the rigorous application of the provisions of the Sports Code relating to the reporting obligations of sports agents would enable TRACFIN to obtain more information from the federations, professional leagues and the agents themselves.
A SECTOR SUSCEPTIBLE TO BRIBERY, IN PARTICULAR FOR THE AWARDING OF SPORTS COMPETITIONS
The media exposure of sports events, the financial resources allocated and the potential gains linked to the organisation of international sports competitions increase the sports sector’s exposure to corruption: corruption of athletes, the refereeing body, the awarding of sports competitions or corruption in obtaining public contracts for the construction of sports infrastructures.
The Act of 1 February 2012, intended to strengthen the ethics of sport and the rights of sportsmen and women, established the offence of sports corruption with the creation of Articles 445-1-1 and 445-2-1 of the Criminal Code37. Sports corruption is punishable by five years’ imprisonment and a fine of €500,000.
When dealing with cases of corruption in the field of sport, Tracfin primarily assists in legal proceedings to provide financial information for the investigation. The Unit intervenes mainly in response to requests to identify financial elements linked to acts of corruption.
36. The French Professional Sport Commission was launched on 2 October 2015. The initiative, led by the Ministry of Sport, has a steering committee and six working groups. It brings together all sports stakeholders and concerns the seven professional team sports: football, rugby, basketball, handball, volleyball, ice hockey and cycling. Its objective is to make proposals to improve the image of French professional sport.
37. Article 445-1-1 of the Criminal Code defines sports bribery as the act of offering, without right, at any time, directly or indirectly, to a participant in a sports event or horse race where bets are taken, offers, promises, gifts, donations or advantages of any kind, for himself or for another person, so that this participant, by an act or abstention, alters the fair course of this event or race.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
51
CASE STUDY 15: Suspected laundering of the proceeds of tax evasion
Group C with companies domiciled in France
Repatriation of funds to France via Group C Cross-lending
Blurring the origin and
destination of funds
?€5m
Funds potentially from Mr X’s compensation as a sports agent
Mr X suspected final beneficial owner
Authorised agent (trust) as representative and director of offshore
Companies A and B
Mandates
Offshore company A Offshore company B
Same domiciliation address
CASE STUDY 16
Provision of financial evidence in court proceedings for bribery in connection with the award of a sports competitionCorruption was suspected in the awarding of several international sports competitions. The vast system of corruption uncovered revolved around a single individual: Mr A, who was close to the head of a sports federation. Mr A was also the director of several sport-related companies registered abroad. Mr A received €2.5 million from a company domiciled in a tax haven. This company was linked to certain members of the bidding committee of a country applying to host an international sports competition. Mr A also received €1m from a company chaired by a member of the sports committee of a country bidding for another sporting event. This transaction took place at the same time as the vote to award the competition. Mr A also received two transfers totalling €2 million from a company managed by a relative of a sports club director. These transfers of funds took place shortly before the award of a world sports competition.
The various funds were deposited in the accounts of Mr A’s companies, under the pretext of payment for services. These transactions could correspond to the payment of bribes in connection with the awarding of international sports competitions. Acts of active bribery are initiated through companies managed by individuals directly or indirectly concerned with the hosting of sports competitions in their country. Mr A, as the recipient of the funds and indirectly involved in the vote to award the competitions, is suspected of passive bribery.
Warning signs:
– Transfers issued by companies run by individuals with direct or indirect interests in the sports competition concerned
– Use of intermediate companies domiciled in tax havens to receive funds – Connections between the beneficial owner of the funds and the voting power in the awarding of competitions
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
52
Relative of a sports federationexecutiveSuspicion of passive bribery
CASE STUDY 16: Provision of financial evidence in court proceedings for bribery in connection with the award of a sports competition
Company chaired by a member ofthe sports committee of a countrybidding for a sports event
Company domiciled in a tax havenlinked to members of the biddingcommittee of a country biddingfor a sports event
Company managed by a relative ofa sports club manager
Candidate country
Candidate country
Companies managed by individuals involved in
hosting sports competitions in their
country
Suspicion of active bribery
Provision of services
Mr A
Director
Companies specialised in the field of sport, registered
abroad
€1m
€2.5m
€2m
UN SECTEUR EXPOSÉ AUX MANIPULATIONS DE COMPÉTITIONS PAR LA PRISE DE PARIS SPORTIFS
To prevent, detect and sanction, both criminally and from a disciplinary point of view, the manipulation of sports competitions, the Council of Europe initiated the Convention on the Manipulation of Sports Competitions, known as the Magglingen Convention. The Convention, which was opened for signature on 18 September 2014, entered into force on 1 September 2019. It defines the notion of manipulation of sports competitions as “an intentional arrangement, act of omission aimed at an improper alteration of the result or the course of a sports competition in order to remove all or part of the unpredictable nature of the aforementioned sports competition with a view to obtaining an undue advantage for oneself or for others”.38
One of the key concepts of the Magglingen Convention is the establishment of national platforms to bring together all actors and address all forms of sports manipulation. The network of national platforms (Copenhagen Group) has laid the foundations for transnational cooperation. France set up a national platform to combat the manipulation of sports competitions in 2016 which brings together the Ministry of Sports, the National Gaming Authority (ANJ), the French National Olympic and Sports Committee (CNOSF), the Central Racing and Gaming Unit (SCCJ), the National Financial Public Prosecutor’s Office (PNF), the French Anti-Corruption Agency (AFA), the Française des Jeux (FDJ) and Tracfin. The aim of this platform is to facilitate the collection and transmission of information between the players in order to carry out effective investigations and effectively combat bribery and match-fixing.
Match-fixing is associated with sports betting and criminal networks operating in unregulated gambling markets, although the regulated betting market is not immune to fraud. A rigged competition is usually characterised by abnormally high betting amounts on a particular outcome. Bribery is perpetrated in advance of the competition to achieve the desired outcome. Unlike unregulated markets, where bettors operate with little supervision, regulated markets are easier to monitor and fraud is easier to detect.
Given the growing popularity of legal sports betting, including online and single-event betting, the financial impact of match-fixing on sporting events is significant. Manipulation of sports competitions is more likely to occur in minor sports events due to their lower media exposure, which ultimately makes them more attractive. Furthermore, as athletes are paid less in lower leagues and events, they are more susceptible to bribery.
38. Article 3 of the Convention, https://www.coe.int/en/web/conventions/full-list/-/conventions/rms/09000016801cdd7e
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
53
3T
RA
CFI
N -
ML/
TF
RIS
K T
REN
DS
AN
D A
NA
LYSI
S IN
201
9-20
20
54
ANTICIPATING RISKS
NEW ML/TF CIRCUITS DUE TO THE DIGITALISATION OF PAYMENT SERVICES
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
55
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
56
TRACFIN has been alert to the ML/TF risks posed by the digitalisation of payment services since 2015.39 With the introduction of European directives on payment services in 2007 and 2015, there has been a proliferation of payment service providers (PSPs) and electronic money providers (EMPs) in terms of both their number and volume of activity.
The use of PSPs and EMPs is now a clear trend in money laundering, having been observed in most case types investigated by Tracfin. This use may take the form of physical payment instruments (prepaid cards or vouchers) or online/mobile payment and e-money accounts. These kinds of services are also used in conjunction with crypto-assets.40
Tracfin has been closely monitoring crypto-assets as a vector for money laundering since they were first introduced. It has observed specific risks in relation to exchange transactions (converting physical money into crypto-assets and crypto-assets into other crypto-assets), asset management in e-wallets and issuances of digital tokens convertible into crypto-assets (initial coin offerings, or ICOs).41
In previous ML/TF risk trends and analysis reports, Tracfin has detailed multiple instances where crypto-assets have been used to launder money: as a means of committing investment fraud, for laundering the proceeds of identity fraud, as a method of concealing income and as tender for dealing in illegal goods.42 These money laundering circuits show no sign of abating – they continue to thrive and multiply, as noted in a recent report by France’s National Information System Security Agency (ANSSI) on ransomware being used against companies and institutions.43 The use of crypto-assets has also been observed in terrorist financing circuits.
Rapid developments in the sector open up new mechanisms for fraud and money laundering, which Tracfin endeavours to pre-empt by monitoring ICOs and new stablecoins.
39. Refer to Tracfin’s ML/TF risk trends and analysis reports dating back to 2015.
40. Crypto-assets are defined in Article L.54-10-1 2° of France’s Monetary and Financial Code as “a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and can be transferred, stored and traded electronically”. The most popular crypto-assets are Bitcoin, Ether and Ripple.
41. Tracfin, ML/TF risk trends and analysis in 2018–2019 report, December 2019, pp. 67–69.
42. Tracfin, ML/TF risk trends and analysis in 2018–2019 report, December 2019, pp. 66–67; Tracfin, ML/TF risk trends and analysis in 2017–2018 report, December 2018, pp. 58–59; Tracfin, ML/TF risk trends and analysis in 2016 report, December 2017, p. 63.
43. ANSSI, État de la menace rançongiciel à l’encontre des entreprises et des institutions, February 2020.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
57
E-MONEY AND CRYPTO-ASSETS ARE STILL LEADING MEANS OF MONEY LAUNDERING AND TERRORIST FINANCINGE
The majority of PSPs and EMPs operate in France under the European passport, either on a freedom of establishment (FOE) basis if they have a physical presence in France (branch or network of agents for payment services; branch or network of distributors for e-money) or on a freedom to provide services (FPS) basis if they do not have a physical presence in France and remain under the supervision of their country of licensing.
In FPS cases, the lack of a designated contact for authorities to correspond with prevents Tracfin from directly exercising its right to request information for the purposes of identifying parties involved in suspicious financial transactions. Addi-tionally, the interconnectedness of different PSPs and EMPs established in multiple EEA countries makes it difficult to identify the appropriate FIU to contact for infor-mation. Furthermore, since some EEA countries are less strict in the area of AML/CFT supervision, the European passport and the FPS regime end up undercutting France’s AML/CFT system significantly.
As at 30 June 2020, the vast majority of institutions operating in France were licensed in another EEA country:
Licensed in France (ACPR)
FOE (branch in France) FPS
Credit institution 344 70 613
Payment institution 44 36 495
E-money institution 15 23 261
Total 403 123 1 369
Source: Financial Agents Register (REGAFI)
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
58
DESPITE MAJOR LEGISLATIVE REFORM, PREPAID CARDS AND VOUCHERS STILL PROVIDE ANONYMITY
The risks associated with the use of physical payment instruments loaded with e-money – more commonly referred to as prepaid cards or vouchers – have been the subject of multiple reports since Tracfin published its risk trends and analysis report for 2015. Despite legislative and regulatory reforms that have helped make them less anonymous,44 there are still loopholes in the AML/CTF system that allow prepaid cards to be purchased without having to provide ID.
In theory, an ID check is mandatory if €1 or more is being loaded onto a physical payment instrument using either cash or anonymous e-money. However, an exception in Article R.561-16-1 of France’s Monetary and Financial Code exempts distributors of prepaid cards from due diligence requirements if the following conditions are met: – The e-money is being issued for the sole purpose of purchasing consumer goods
or services – The monetary value stored on the instrument does not exceed €150 and, if the
instrument is rechargeable, this €150 limit applies over a 30-day period – The prepaid card is not reloaded using cash, unless it is being used to purchase
goods or services from a limited network of sellers accepting the payment method or for a limited range of products or services and the amount being stored does not exceed €50
The loophole lies in a deliberate misinterpretation of the concept of purchasing goods/services from a limited network. This is meant to refer to branded gift cards usable only in France for the purchase of a limited range of goods or services within a specific network of stores. It came to light that this provision was being abused after Tracfin uncovered a new terrorist financing scheme where prepaid vouchers were being converted into crypto-assets.
CASE STUDY 17
Prepaid vouchers converted into crypto-assets and sent to war zones to finance terrorismThrough a France-wide network of retailers (newsagents, tobacconists, etc.), Company Y was selling prepaid vouchers in €50, €100 and €150 denominations. The vouchers came with a flash code or PIN and were meant to be converted into bitcoin. The customer decided whether the crypto-assets were transferred to an e-wallet provided by Company Y or to a third-party address of their choosing. The financial circuit was as follows:
– The e-money loaded onto the vouchers was issued by a European electronic money institution (in Country A) via an electronic money distributor established in another EU country (Country B).
– Newsagents would collect payment from customers using cash register software provided by Company Z that recorded the payment method used by the customer but not their identity. Company Z remitted the funds to the electronic money distributor in Country B, which then transferred them to Company Y.
– Since the e-money on the customer’s voucher was used exclusively to purchase bitcoin held outright by Company Y, Company Y was fulfilling its due diligence obligations when it transferred this bitcoin to either the client’s e-wallet or the e-wallet automatically created by Company Y.
44. The “Urvoas Act” of 13 June 2016 and its implementing decree set out limits for the use of prepaid cards, prohibiting them from being loaded with more than €10,000 and from being reloaded with more than €1,000 in cash per month. When the fourth and fifth European AML/CTF directives were enacted in French law, these products were rendered substantially less anonymous, with the introduction of identity check requirements for physical instruments being reloaded in an amount above €250. This was lowered to €150 in the order enacting the fifth directive published on 12 February 2020.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
59
Tracfin’s investigations led to the discovery of the central role played by two fundraisers affiliated with a jihadist group. Mr A and Mr B were found to have opened two crypto-asset wallets where bitcoins converted from vouchers were collected. They used a network of intermediaries and bureaux de change which, for a fee, would send money to jihadists in war zones in the following manner:
– The voucher’s details (flash code or PIN) would be sent by the purchaser via encrypted message to a war zone combatant.
– These details would be presented by the combatant to a local bureau de change, which would verify the validity of the voucher. Once confirmed, the voucher’s value would be credited to one of the e-wallets held by Mr A and Mr B.
– The money credited to the e-wallet would be routed through different bitcoin address clusters before being sent to another crypto-asset trading platform with a border presence. This platform would clear the transaction with a bureau de change inside the war zone, using the hawala system.
– The funds would be paid out in cash, minus a commission, to the combatant.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
60Country A Country B
E-money institution
E-money distributor
Issues e-money
Prepaid vouchers
Company Y
Markets
Distributes e-money
?Sells
War zone
Sends voucher details
Jihadists
Country borderingthe war zone
Manual money changer
Sends voucher details
Sends voucher details
Credits bitcoin wallet
Fundraisers Mr A and Mr B
Bitcoin clusters Trading platform
Clearing
1
2
3
4
5
6
CASE STUDY 17: Prepaid vouchers converted into crypto-assets and sent to war zones to finance terrorism
Activates voucher
Once this new type of financial circuit was detected and the two e-wallet fundraisers were identified, a preliminary investigation was opened into terrorist financing and conspiracy to commit terrorist crimes. An anti-terrorism operation, ordered by the French Anti-Terrorism Prosecutor’s Office (PNAT), was carried out by specialised criminal investigation units45 and the Directorate General of Domestic Security (DGSI), leading to the arrest of 29 individuals on 29 September 2020. An analysis of the network confirmed the central role played by the two crypto-asset fundraisers identified by Tracfin, who are suspected Al-Qaeda operatives.
The elaborate financial circuit, designed to conceal the source of money sent to combatants, managed to adapt terrorist financing methods to the compliance measures put in place for more traditional vectors (cash transfers to fundraisers, money collection websites). It raises a number of issues concerning the traceability of illicit financial flows: – The first issue is identifying people who purchase vouchers in France, which is
not something Tracfin is able to do due to ID check exemptions for prepaid cards that are: • Purchased in cash, in an amount of up to €50, for the purpose of purchasing goods or services within a limited network • Purchased using any other payment method, in an amount of up to €150, on the grounds that crypto-assets purchased using vouchers are considered consumer goods
An ID check requirement should be mandatory for any physical payment instrument loaded with €1 or more using cash, with clearly defined exceptions (gift cards). There should also be maximum restrictions on e-money anonymously converted into crypto-assets, crypto-assets anonymously converted into other crypto-assets and accounts held anonymously with digital asset service providers.
– The second issue is the interconnectedness of e-money institutions operating in France under the European passport on a freedom to provide services (FPS) basis. In this case, the e-money stored on the prepaid voucher was issued by an electronic money institution established in Country A and distributed by an electronic money distributer established in Country B. These institutions have no visibility on the individuals who purchase the vouchers; their due diligence is limited to the movement of funds received by merchants.
– Furthermore, neither company has a physical presence in France, which prevents Tracfin from directly receiving suspicious transaction reports concerning unusual transactions and makes it difficult for Tracfin to know which FIU to turn to for information for its investigations.
Therefore, in addition to these measures, there should be an obligation for digital asset service providers operating in France on an FPS basis to register themselves in France. There should also be an alignment of the EU regulatory framework on these measures.
45. The Anti-Terrorism Sub-Directorate (SDAT) and the Cybercrime Sub-Directorate (SDLC) of the National Criminal Police Directorate (DCPJ), the Central Office for the Prevention of Serious Financial Crime (OCRGDF) and other interregional criminal investigation departments.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
61
MORE HARMONISED OVERSIGHT AT EUROPEAN LEVEL WOULD HELP CLOSE THE LOOPHOLES INTRODUCED BY THE EUROPEAN PASSPORT
Through the European passport, banking institutions, payment service providers and electronic money providers are able to export their commercial offerings to all EEA countries. They give customers the option of combining multiple payment services to make financial flows less easily traceable.
When a customer deals with a bank or payment service provider, these entities form links in a chain and become interdependent for the purposes of establishing the traceability of transactions and identifying recipients. In the online banking and payment sectors, the transnational nature of institutions and their presence in multiple EEA countries disrupt Tracfin’s ability to use its investigative powers.
The following case study illustrates this issue. It involves a company using the services of a bank that operates exclusively online in France as well as in other EEA countries via a mandate given to a European institution. The institution operates by issuing a different International Bank Account Number (IBAN) depending on the transaction type (debit or credit): some transactions are recorded with the IBAN issued by the France-based institution and others with the IBAN issued by the mandated European institution. As a result, only some of the transactions, those made with the French IBAN, are traceable.
CASE STUDY 18
Suspected laundering of the proceed of precious metal trafficking via online bank accounts spread across multiple EEA countriesMr A, a foreign businessman, set up an international system for laundering the proceeds of illegal trafficking by directly and indirectly establishing multiple companies abroad. These companies would transfer money to French companies, which would in turn transfer funds to individuals’ accounts. The French companies would have banking arrangements both in France and in two other EEA countries thanks to a digital solution offered by a payment services provider operating as both the payment agent of a French payment institution and the electronic money distributor of a European electronic money institution.
There were multiple steps in the financial circuit:
– First, Mr A took funds from the accounts of companies established in Asia. He is the beneficial owner of a conglomerate of companies wherein Company X holds a central position. Mr A founded and managed these companies using an assumed identity. They took in nearly €200m from different companies established in Africa or the Middle East, the original source of which could not be traced. Mr A then attempted to send the money to France via a banking advisor who oversaw the opening of bank accounts in France. The banking institution declined the transactions due to a lack of supporting documentation.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
62
– Next, Mr A began using intermediary companies established in Europe, including Company Y and Company Z, both having the same address. These two companies replaced the Asian companies as intermediaries. They transferred funds to the accounts of two French entities, Company J and Non-Profit K, whose activities suggested they were fronts with no real operations. Three-quarters of their incoming funds came from Company Y and Company Z.
– Finally, Company J and Non-Profit K made cross-transfers of funds between their accounts and transferred more than €20,000 to different individuals having ties with Mr A, with no logical economic or legal justification. The money received by these individuals was withdrawn in cash, used for personal purposes or transferred from France to third parties residing abroad.
Entities J and K signed up for a dual bank account scheme offered by the payment agent, enabling them to obtain a French IBAN and IBANs in two other European countries. Using pre-programmed inter-account transfers, the entities split their credit and debit transactions between the various accounts. This method of disassociating credit flows into French accounts and debit flows out of foreign accounts had the effect of making the transactions less traceable and obscuring the ultimate destination of the funds.
While Tracfin was able to exercise its right to discovery for the bank accounts with French IBANs, it was unable to do so for transfers involving the foreign-IBAN accounts obtained through the payment agent. With this type of financial product, it is essential that PSPs working with agents that provide cross-border services conduct due diligence, particularly as concerns the nature of their business relationships and the coherence of their transactions. That said, the introduction of the obligation, for the permanent correspondents of payment agents and electronic money distributors,46 to respond to Tracfin’s requests for information has been a significant improvement in terms of its being able to access the banking documentation it needs to thoroughly conduct its financial investigations.
46. Provision brought into force under Decree No. 2019-490 of 21 May 2019 amending Article D561-3-1 of the Monetary and Financial Code.
CASE STUDY 18: Suspected laundering of the proceeds of precious metal trafficking via online bank accounts spread across multiple EEA countries
AfricaMiddle East
Conglomerate
Transfer
Banking advisor to Mr A
Company X
Asia
€200m Bank accountsXRefusal by institution Opens
Manager or member
Company J Non-profit organisation K
Crossed financial
flows
Mr A
Beneficial owner
Company Y Company Z
Advisory services
Relatives of Mr A
PSP agent
Credit Debit
Clients
1 2
3
4Transfers
PI EMI EMI
Multiple accounts opened
Clearing
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
63
NEW PAYMENT SERVICES: AN AREA OF INTEREST FOR FRANCE’S PRUDENTIAL SUPERVISORY AND RESOLUTION AUTHORITY (ACPR)
Dominique Laboureix, Secretary General of the ACPR
As the digital economy has developed, we have seen a wide range of innovative new financial services emerge, sometimes referred to as “neobanks”, even if the providers behind them are not necessarily banks.
These new services are organised around activities that we supervise at the ACPR: payment services and e-money issuing services. They take many forms: providing payment accounts and payment cards; managing payments for third parties (online marketplaces, online retailers, crowdfunding platforms); managing e-wallets for online money transfers or funds transferred from prepaid cards. These activities are regulated by separate licensing systems: unless provided by a credit institution, the first two services are the activities of payment institutions (PIs) and the third is an activity of electronic money institutions (EMIs). Under AML/CTF regulations, these institutions fall under ACPR supervision if they are licensed in France or if they operate in France via a branch or use a network of payment services agents or electronic money distributors (operating
on a freedom of establishment (FOE) basis under the European passport).
As at 30 June 2020, there were 80 PIs established in France, of which 36 were operating on an FOE basis (17 via a branch, the remainder via agents) and 38 EMIs, of which 23 were operating on a FOE basis (6 via a branch, the remainder via distributors). Additionally, there were 495 PIs and 261 EMIs established in other EU countries (including the United Kingdom) that had been declared by their national authorities as operating in France on a freedom to provide services (FPS) basis under the European passport. FPS operators are subject to the AML/CTF regulations of their home country (which stems from the provisions of the EU’s Fifth Anti-Money Laundering Directive) and are supervised by the authorities in their home country.
As indicated in the ACPR’s 2019 sectoral risk analysis, the payment and e-money sectors present a high risk for ML/TF. The ACPR is also paying special attention to the quality of the AML/CTF systems of entities in these new sectors, which often have cross-border operations. Audits conducted by the ACPR help to identify potential areas for improvement in these systems.
In terms of remote business relationships entered into in a digital environment, regarding which the regulatory framework has been revised to better reflect technical innovations (Articles R.561-5-1 and R.561-5-2 of the Monetary and
The primary solution to overcome the loopholes created by the European passport is an effective monitoring and sanctioning system harmonised at EU level. On 7 May 2020, the Commission published an action plan for a comprehensive EU policy on preventing money laundering and terrorist financing.47. It is built on six pillars, which include, as areas of particular interest, establishing an EU single rulebook on AML/CFT and bringing about EU level AML/CFT supervision.
Adopted by the European Parliament on 10 July 2020,48 the plan may be an opportunity to promote strengthened and harmonised supervision over financial institutions operating on an FPS basis, with the inclusion of digital asset service providers. A European oversight authority with stronger powers, working in coordination with national supervisory authorities, could introduce consistency into how institutions with AML/CFT weaknesses are supervised.
47. Communication from the Commission on an Action Plan for a comprehensive Union policy on preventing money laundering and terrorist financing, C/2020/2800 final, https://ec.europa.eu/finance/docs/law/200507-anti-money-laundering-terrorism-financing-action-plan_en.pdf.
48. 2020/2686(RSP).
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
64
Financial Code), work may still need to be done in the area of identifying and verifying the identity of customers in a business relationship, as well as identifying beneficial owners (Article R.561-7 of the Code). On this last point, making it mandatory to consult the register of beneficial owners, which is expected to be made more reliable by the measures adopted in enacting the 5th AML Directive into French law, should contribute to improving the situation.
In terms of electronic money, under a strict set of conditions, excluding cases of suspicious transactions, the regulations allow for identification and identity verification requirements to be waived (Article R.561-16-1 of the Code). However, in light of the ML/TF risks (undeclared labour, terrorist financing) associated with the use of “anonymous” e-money, these conditions were tightened by Decree No. 2020-118 of 12 February 2020, which lowered the limits for loading and using payment instruments to €150. It is up to institutions to continue their compliance efforts in this area.
There are also improvements to be made in the area of know your customer (KYC) requirements. Careful attention should be paid by PIs and EMIs providing payment services via marketplaces that connect buyers and sellers online (whether professionals or non-professionals). Several audits have revealed the need to collect more relevant information about online retailers, for example on their circumstances (residence, professional status) and financial situation. This
information is necessary to maintain appropriate oversight over activities and ensure consistent and effective due diligence. Money laundering cases uncovered during audits have involved suspected undeclared imports, undeclared economic activity and counterfeit sales. In this regard, it should be noted that suspected tax evasion is grounds for reporting a transaction (item II of Article L.561-15 of the Code). Consistent due diligence based on relevant, up-to-date KYC information and supported by anti-fraud systems would help ensure better coverage of these types of risks.
Reminders have also been issued concerning the obligation, under certain conditions (Articles L.561-3 and D.561-3-1 of the Code), to designate a permanent representative in France for institutions operating in the country via a network of agents or distributors. The primary responsibility of this point of contact is to send suspicious transaction reports to Tracfin and diligently respond to its requests for information. The ACPR also recently imposed sanctions as a reminder of the obligation of PIs, including those operating on an FOE basis, to send systematic information disclosures (COSIs) to Tracfin (Article L.561-15-1 of the Code).
Several ACPR decisions and sanctions have also highlighted deficiencies in how domestic asset freezing measures are implemented. Working closely with Tracfin, the ACPR will continue to pay close attention to payment services and e-money operators, through both its education and audit activities.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
65
ACCOUNTS OPENED ONLINE MAY PROVIDE NEW ANGLES FOR INVESTIGATIONS
Remote business relationships between a customer and their banking institution or PSP/EMP are considered high risk for ML/TF and have been the subject of Tracfin alerts in past reports.49 This is corroborated by the cases Tracfin referred to the courts in 2020, particularly in the area of online gambling. Recent investigations uncovered online gambling accounts that had been opened using stolen identities, which were then topped up using prepaid cards loaded with anonymously sourced funds. The accounts served as intermediaries for transferring funds to bank accounts that were also opened using stolen identities.
Investigation outcomes for these types of cases have improved thanks to the support of financial institutions that have strengthened their compliance monitoring systems by looking into geographic connections between multiple users of a single identity.
CASE STUDY 19
European network laundering the proceeds of undeclared labour identified by cross-checking IP addressesTracfin’s investigations determined that Company X was at the centre of a Europe-wide undeclared labour network involving a broad group of companies, including Companies Y, Z and U, all three of which specialised in the auto sector. The total scale of the fraud is estimated to be nearly €8m.
Company X, a used-car company, took in revenues of €6m in one year, mostly in the form of transfers from companies operating in the same sector. Company X had three types of outgoing transactions: transfers to companies specialised in manufacturing cosmetics products (€650,000); transfers to other entities, primarily operating in construction with European-based accounts (€600,000); and transfers to individuals whose names did not feature on advance hiring notices (€2.5m).
A similar pattern was observed in the accounts of Companies Y, Z and U. Their revenues were primarily made up of transfers from companies operating in the same sector, chiefly Company X as well as other companies that also made transfers to Company X’s accounts. Outgoing transactions followed the same patterns as those of Company X.
In addition to similarities in their banking activities, the various companies involved in the undeclared labour network had the following in common: no corporation tax returns and practically non-existent VAT returns containing no information on any transactions in relation to their activities.
This network was identified by cross-checking IP addresses used to log in to the bank accounts of the various companies. This data led to the identification of the beneficial owners of the network of companies. Specifically, a static IP address and a mobile IP address led to the identification of Ms A and, by extension, her partner, Mr A. The two individuals were already known to police for their association with companies using undeclared labour.
49. Tracfin, ML/TF risk trends and analysis in 2018–2019 report, pp. 62–64.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
66
Company XUsed-car company
Transfers
€650k
€2.5m
Undeclared workers
Companies operating in the same sector as Company X
€6m generated from undeclared labour and fraud
CASE STUDY 19: European network laundering the proceeds of undeclared labour identified by cross-checking IP addresses
Transfers
Companies Y, Z and U – satellites of Company X operating in the same sector in a similar manner to
Company X
€600k
Construction companies
Bank accounts
Cosmetics companies
Cross-checking of IP addresses used to log
in to the bank accounts of the companies in the
network
Two beneficial owners of the network of companies identified as individuals known to
police for undeclared labour practices
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
67
NEW RISKS IN THE CRYPTO-ASSETS SECTOR
POTENTIAL FRAUD RISK IN INITIAL COIN OFFERINGS USED TO RAISE FUNDS
An initial coin offering (ICO) is a way for a company to raise money by issuing tokens to investors. Investors almost exclusively use crypto-assets (Bitcoin, Ether etc.) to buy into the offering. The tokens they receive can be used toward the company’s products or services in the future and can be traded on a secondary market.
ICOs are a practical alternative source of funding for innovative startups that are having difficulty raising capital via traditional financing channels due to their small size or the perceived risk of their operations. The value of a token is intrinsically tied to the project: the more lucrative the product or service, the more valuable the token, and vice-versa. Speculation is particularly prevalent in ICOs since tokens tend to be undervalued at issue, which can mean high returns for early investors.
Investing in an ICO is risky: investors can lose some or all of their investment, and tokens come with no guarantees as to their liquidity during the ICO period, their value in real currency or the existence of a secondary market to trade them on. The European Securities and Markets Authority (ESMA) considers ICOs to be “very risky and highly speculative investments”.50 On top of these risks, there is also the possibility that an ICO has been launched for fraudulent purposes, using a made-up company and fake whitepaper.51
Given the risks surrounding ICOs, the “PACTE” Act of 22 May 2019 on business growth and transformation introduced an optional system for regulating token issuances. Issuing companies can apply to the Autorité des marchés financiers (AMF) for a visa, which will be granted if the AMF considers the ICO whitepaper to be sufficiently detailed and clear for investors. The AMF publishes a whitelist of ICOs that have been approved for a visa, as well as a blacklist. As at 13 October 2020, there were three ICOs that had been issued an AMF visa.52
The following case study describes a typical scheme where an ICO is used to commit fraud. In this case, a company was using an ICO to raise money to launch a new crypto-asset. However, there were several reasons to doubt the economic legitimacy of the project.
50. ESMA, “ESMA highlights ICO risks for investors and firms”, press release from 13 November 2017.
51. A whitepaper is a document that outlines a project’s technical, financial and commercial details and the tokens that are to be issued. It lends credibility to the project.
52. https://www.amf-france.org/sites/default/files/private/2020-10/liste-blanche-ico-131020.pdf
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
68
CASE STUDY 20
Fraudulent crypto-asset investment scheme involving a bogus ICOMs A was behind an ICO launched to raise money for a new crypto-asset. It attracted 20 or so investors, who made their investments either directly or via individuals who had conceivably been commissioned to promote this type of investment. All the money raised, more than €200,000, was collected by Ms A in foreign accounts or through a company with cross-border operations and no economic ties to the project, but was managed by Ms A’s common-law partner.
Although the project appeared legitimate in some respects – a whitepaper was drafted, a smart contract and code were published, tokens were generated – there was no technical or economic reality behind it: no company was identified as having issued the ICO, the team members working on the launch of the new crypto-asset did not have any relevant experience and token ownership rights were not clearly detailed.
The crypto-asset’s value trajectory also showed signs of a “pump and dump” scheme, which is where the value of an asset is artificially inflated by making a large buy-in to attract investors, whose investments keep the momentum going and allow the perpetrators of the scheme to sell their assets at the height of their value. The price then plummets, bilking the second wave of investors.
Warning signs:
– ICO created to raise money to launch a new crypto-asset – Non-transparent investment circuit involving foreign accounts and a company managed by an associate of Ms A with no link to the project in question
– No real evidence to substantiate the technical or economic reality of the project – “Pump and dump”-style price manipulation of the new crypto-asset
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
69
CASE STUDY 20: Fraudulent crypto-asset investment scheme involving a bogus ICO
Mrs A
Foreign bank accounts
€200k
New crypto-asset
Organises
Cross-border company
Mrs A’s common law partner
Owns
FundraisingIndividual investors
Manager
Transfers
Questions about the economic and technical legitimacy of this crypto-asset:• Company behind the ISO not identified• Inexperienced team working on the launch of the
crypto-asset“• Pump and dump”- style price fluctuations
THE FRENCH AML/CFT SYSTEM FACED WITH THE EXPANSION OF STABLECOINS
Unlike so-called first-generation crypto-assets, which tend to be highly volatile, stablecoins are designed to maintain a stable value. They can be defined as a digital asset whose value is pegged to an underlying asset (a currency, a commodity, a first-generation crypto-asset). A stablecoin can therefore be considered either a digital asset or a traditional financial asset. In both cases, they are covered by FATF stan-dards.
Categories of stablecoinsThere are different categories of stablecoins, based on what they are backed by: real assets, crypto-assets or other. Like crypto-assets, stablecoins use blockchain technology and are built on different types of architecture.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
70
Category Description Status
Backed by a real asset
Also referred to as IOU stablecoins, these are pegged to a real asset, like a legal (fiat) currency (dollar, euro, basket of currencies), a precious metal (usually gold) or a commodity.
These stablecoins are issued by a central entity, and they are redeemable by reference to the asset held as collateral.
The IOU model requires the stablecoin issuer to hold a stock of currencies, precious metals or commodities allowing it to issue coins at a 1:1 ratio with its reserve.
This is the most developed category. Some stablecoin initiatives in this category, with sponsors that suggest the possibility of a large volume of users, are considered global stablecoins.53 Most stablecoins in this category are backed by the US dollar.
Backed by a crypto-asset
The entire process occurs on the blockchain, unlike the IOU category where a trusted third party is required to serve as custodian. The advantage of this model is its decentralised nature: the collateral is held in a smart contract.
This category is more sophisticated in that the underlying asset guaranteeing the value of the stablecoins in circulation is tied to these stablecoins via an algorithm that maintains the value at near par with the underlying asset.
This category remains relatively underdeveloped.
Not backed
These stablecoins are not backed by an asset, but employ a set of rules expressed in software code, using blockchain technology, to match the supply of the stablecoins with demand.
If there is a change in supply or demand, the smart contract will automatically adjust the number of tokens (the unit of measurement of a stablecoin) in circulation to keep the price level.
This category remains relatively underdeveloped.
53. See below.
Although stablecoins may be promoted as a universal method of payment and may facilitate cross-border payments, they pose significant risks for payment systems and, just like first-generation crypto-assets, are exposed to significant ML/TF risks, due to: – The anonymity of transactions, where the stablecoin uses blockchain technology
specifically designed to keep users anonymous – Their potential for use by cybercriminals, where the stablecoin is used to launder
the proceeds of crime or online payments for criminal activity on the deep or dark web
Stablecoins also differ from first-generation crypto-assets in their potential to reach a global scale. Apprehensions about the risks of stablecoins mainly concern initiatives developed by digital players that have a worldwide network of users and would therefore be able to influence a massive population and introduce stablecoin payments in an array of digital services (messaging services, apps, etc.). These are referred to as global stablecoins and are the IOU type.54
Technological and regulatory issues of stablecoinsThe degree to which stablecoins are exposed to ML/TF risks should be evaluated based on their architecture and structure: – In a centralised structure where digital assets are created by a central adminis-
tration, risk can be better controlled. This is the case of stablecoin initiatives developed by central banks.
54. See table.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
71
– By contrast, an instrument such as Bitcoin, which uses a decentralised system where no authorisation is needed to carry out a transaction, presents a high level of ML/TF risk.
– A stablecoin developed and managed by a private-sector entity, with the potential for large-scale adoption, could also heighten ML/TF risks if appropriate controls are not put in place.
Most of today’s stablecoins use a centralised blockchain, an administrator or a control mechanism. This tendency toward centralisation is partly due to the very nature of stablecoins, which claim to offer a degree of stability compared to other crypto-assets. However, that does not mean a decentralised stablecoin could not still emerge – and pose more significant ML/TF risks.
The Financial Stability Board (FSB) has observed that many countries do not currently have regulatory regimes specific to crypto-assets in general or stablecoins in particular, especially in emerging economies.55 The transnational nature of stablecoins calls attention to the limitations imposed by regulatory inconsistencies between different countries. An international regulatory framework needs to be created to prevent these regulatory inconsistencies from being exploited and to ensure consistency in the rules governing stablecoin issuers.
With the emergence of stablecoins, in March 2020 the Banque de France launched a pilot program for a central bank digital currency (CBDC) within Europe to identify practical applications for integrating a CBDC into payment systems. The objective of developing a CBDC is to rethink the conditions under which central bank currency is issued and released to provide a safe and liquid payment instrument that can keep pace with technological developments. Other central banks are also working on launching their own digital currencies.
55. Financial Stability Board, Regulation, Supervision and Oversight of “Global Stablecoin” Arrangements: Final Report and High-Level Recommendations, October 2020.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
72
BIG TECH’S ENTRY INTO FINANCIAL SERVICES: A EUROPE-WIDE EXPANSION THAT CALLS FOR REGULATORY ATTENTION
Big Tech companies, the world’s leading digital service providers with massive user bases, now offer a wide range of payment products and services. After making their initial entry in Asia and the Americas, tech giants are now expanding into Europe, both competing with traditional banks and forming partnerships with them.
The motivation behind tech giants’ foray into payment services is the opportunity to collect new data on their customers’ buying and consumption habits. Many of these giants now offer the same types of financial services as traditional banks, including savings products, insurance and consumer credit.
The AML/CFT issues associated with Big Tech’s rising prominence in the EU’s financial services sector have to do with the methods they are using to develop their business: some of these companies are already licensed banks or PSPs in the EEA, allowing them to operate in all EEA countries in a shaky state of compliance; in contrast, there are others that are not licensed and are developing their business by entering into partnerships with financial institutions. Not only is there a risk of technology poaching, these partnerships also fragment the KYC data of their users.
NEW COMPETITION FOR EUROPEAN MONEY TRANSFER AND ONLINE PAYMENT SERVICE PROVIDERSE
Within the European market, Big Tech is entering an environment where consumer payment systems are already highly developed and work well, and where operators are working to adapt to new developments in the sector. Some non-European operators have adhered to the EU regulatory framework and have applied to be or have been licensed as credit or e-money institutions via subsidiaries established in an EU country offering preferential tax treatment. Thanks to the European passport and the option of operating on a freedom to provide services basis, their licensed status allows them to export their services throughout all EEA Member States.
Licensed status allows these operators to directly offer online international money transfer services and payment services. Offered exclusively online and available via mobile apps, these services involve an exceptionally large number of potential users, across all EU countries, and cover a wide range of activity sectors: payments on e-commerce platforms, online video games, person-to-person money transfers and even crypto-asset purchases. Between the relatively immature status of their AML/CFT compliance systems and the diversity of their customers’ profiles and usage types, these operators are not in a strong position to be able to detect suspicious transactions or meet due diligence requirements.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
73
Furthermore, although licensed subsidiaries established in Europe are subject to the AML/CFT requirements of their host country, the Big Tech parent companies are not. Parent companies and their operating subsidiaries are not regulated like financial conglomerates or holding companies, which makes for a notable difference vis-à-vis financial institutions in terms of oversight. Furthermore, the operating subsidiaries of these tech giants, particularly those dedicated to e-commerce, are purely commercial undertakings and are not subject to banking or AML/CFT regulations. Big Tech companies opting to independently roll out payment services should therefore be subject to scrutiny by European authorities, which are encouraged to enforce AML/CFT regulations for all entities in a group.
ACQUIRING STAKES AND FORMING PARTNERSHIPS: BUSINESS STRATEGIES WITH LONG-TERM RISKSE
In emerging and developing economies, where financial service offerings from local banks remain limited, tech giants have leveraged their financial and digital clout to design services themselves on an ad hoc basis. In Asia, for example, with its sizeable population and low financial inclusion rates among SMEs and individuals, Big Tech has been able to position itself in a wide range of services: online banking, brokerage, insurance, payments, consumer credit and wealth management. Some Asian tech giants are now positioned as major players and competitors to traditional banks.
In Europe, some of these services are being offered to merchants via traditional banking entities that tech companies have formed partnerships with. Some of these players are even acquiring stakes in fintech startups. Ultimately, the business development model of these tech giants involves obtaining their own banking or PSP/EMP licenses after having poached and assimilated the organisational models and technologies of their European partners.
In the short term, the income potential and prospective user pool are attractive incentives for European banks and fintechs. In the medium and long term, Big Tech could become a fierce competitor in the payment instrument space. If European actors open themselves up to a new and predominantly foreign customer base, it could make it more difficult to obtain KYC information and identify the source of funds that were originally loaded on Big Tech mobile applications. Also, the scope of their operations, particularly online payments on e-commerce platforms, presents a big risk in terms of laundered proceeds of illegal trade.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
74
SUMMARY OF MAIN RECOMMENDATIONS
Recommendation 1Introduce more upstream verification upon initial payment and in the day-to-day management of benefits.
Recommendation 2Make digital platforms accountable for the prevention, detection and circulation of counterfeit goods and educate payment service providers about financial flows resulting from online counterfeit sales.
Recommendation 3Continue Tracfin’s work at European level within the European FIU network to strengthen cross-border cooperation.
Recommendation 4Pursue education efforts among legal and property professionals.
Recommendation 5Impose a limit on the amount art merchants are allowed to accept in cash for a transaction.
Recommendation 6Strengthen the supervisory and reporting powers of the federations that oversee sports agents, particularly for the examination of accounting records.
Recommendation 7Leverage France’s anti-match-fixing platform to facilitate exchanges of information with the relevant authorities.
Recommendation 8Make it mandatory to obtain ID for any e-money instrument converted into crypto-assets when loaded with €1 or more using cash or anonymous e-money, and prohibit anonymous crypto-asset accounts.
Recommendation 9Make it a routine requirement for electronic money distributors and payment agents operating in France on a freedom of establishment basis under the European passport to designate a permanent representative and undergo audits.
Recommendation 10Encourage the introduction of a single, Europe-wide AML/CFT rulebook and harmonised oversight.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
75
4T
RA
CFI
N -
ML/
TF
RIS
K T
REN
DS
AN
D A
NA
LYSI
S IN
201
9-20
20
76
4APPENDICES
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
77
APPENDIX I LIST OF CASE STUDIES
Case study 1 Short-time working fraud, criminal seizures with the perpetrator being placed on remand 18
Case study 2 Conspiracy to commit VAT fraud through a network of companies set up using fake documents and an e-money institution 20
Case study 3 Suspected tax evasion as part of the redemption of a life insurance policy 21
Case study 4 Repatriation of funds originating from suspected drug trafficking 23
Case study 5 Network laundering the proceeds of suspected counterfeit product trafficking 24
Case study 6 Identification of potential fraud due to reports from a FIU 28
Case study 7 Unsolicited information from a FIU leading to a report being sent to the French tax authorities 29
Case study 8 Property loan fraud with the collusion of a notary’s office 36
Case study 9 Suspected conspiracy to defraud in connection with organised crime 38
Case study 10 Suspected laundering of the proceeds of tax evasion, fraudulent organisation of insolvency and real estate investment 39
Case study 11 Suspected money laundering from misappropriation of public funds in high-end property 40
Case study 12 Suspected trafficking in works of art and laundering the proceeds of tax evasion 44
Case study 13 Suspected customs violation 46
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
78
Case study 14 Financial elements relating to an antiquities trafficking network linked to a terrorist organisation 47
Case study 15 Suspected laundering of the proceeds of tax evasion 50
Case study 16 Provision of financial evidence in court proceedings for bribery in connection with the award of a sports competition 53
Case study 17 Prepaid vouchers converted into crypto-assets and sent to war zones to finance terrorism 59
Case study 18 Suspected laundering of the proceeds of precious metal trafficking via online bank accounts spread across multiple EEA countries 62
Case study 19 European network laundering the proceeds of undeclared labour identified by cross-checking IP addresses 66
Case study 20 Fraudulent crypto-asset investment scheme involving a bogus ICO 69
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
79
APPENDIX II STATISTICAL METHODOLOGY FOR ANALYSING REPORTING FLOWS
The period examined covers the year 2019 and Q1 2020.
The database analysed is established by extracting STRs covering at least one sector of activity and containing at least one item of evidence representing an offence within the meaning of the French Penal Code, on the basis of Tracfin’s in-house targeting parameters. This means that the analysed sample is not exhaustive.
The list of offences selected on the x-axis compiles, by type of threat, a set of information targeted by the Unit according to the category of offence declared by the reporting entities. The list of sectors of activity, on the y-axis, is established by cross-referencing all sectors declared in Tracfin’s in-house information system.
Risks are ranked according to the volume of information declared by category of offence in relation to each sector of economic activity. This ranking is geared towards establishing the offence and excludes geographic parameters.
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
80
ACPR Prudential Supervision and Resolution Authority
AMF French Financial Market AuthorityAML/CFT Anti-money laundering/combating the
financing of terrorism ANJ National Gambling Authority ANR National risk analysis ANSSI National Information System Security
Agency ASP French Services and Payment Agency CBDC Central bank digital currency CDC Deposits and Loans Fund CEE White certificatesCGI French General Tax Code CMF French Monetary and Financial CodeCNOSF French National Olympic and Sports
CommitteeCOLB AML/CFT Advisory BoardCOSI Systematic Information Disclosure DGDDI Directorate General of Customs and
Excise DGFiP Public Finances Directorate General DIRECCTE Regional Directorate for Enterprises,
Competition Policy, Consumer Affairs, Labour and Employment
DINUM Interministerial Directorate for Digital Technology
DNEF National Tax Investigation DirectorateDNLF National Anti-Fraud OfficeDNRED National Directorate for Customs
Intelligence and InvestigationsDRFiP Regional Public Finances Directorate ESMA European Securities and Markets
Authority EU European UnionFATF Financial Action Task Force FDJ Public lottery and betting companyFIU Financial Intelligence Unit FSB Financial Stability BoardIBAN International Bank Account NumberICO Initial Coin OfferingIFI Property wealth tax ISF Wealth tax ML/TF Money laundering/terrorist financing MSA Social agricultural mutual fundPME Small and medium-sized enterprises
PNAT French Anti-Terrorism Prosecutor’s Office PNF French Financial Prosecutor’s OfficePEP Politically exposed person RIB Bank account identification document SCCJ Central Racing and Gaming UnitSEPA Single euro payments area SEPBLAC Spain’s Financial Intelligence Unit SIRET French business register information
systemSMIC French statutory minimum wageTRACFIN Unit for intelligence processing and
action against illicit financial networks URSSAF Union for the Collection of Social
Security Contributions and Family Allowances
VAT Value added taxVEFA Off-plan sale
APPENDIX III LIST OF ABBREVIATIONS AND ACRONYMS
TR
AC
FIN
- M
L/T
F R
ISK
TR
END
S A
ND
AN
ALY
SIS
IN 2
019-
2020
81
Unit for intelligence processing and action against illicit financial networks
Publication Manager: Maryvonne Le Brignonen10 rue Auguste Blanqui 93186 MONTREUIL
Tel : +33 (0)1 57 53 27 00