Anti-Money Laundering and Sanctions Whistleblower Program

In a May 6, 2024 speech at the SIFMA AML Conference, the Director of the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) Andrea Gacki discussed the success of the Anti-Money Laundering Act (AMLA) in generating disclosures about money laundering and sanctions evasion:

[The whistleblower] program holds tremendous potential as an enforcement force-multiplier. Whistleblowers have submitted information relating to some of the most pressing policy objectives of the United States, from Iran- and Russia-related sanctions evasion to drug-trafficking to cyber-crimes and corruption. While efforts are underway to develop an online tip intake portal and other aspects of this important program, I want to note that even while these efforts are underway, the program is actively receiving, reviewing, and sharing tips with our enforcement partners.

We have received over 270 unique tips since the program’s inception, and many of the tips received have been highly relevant to many of Treasury’s top priorities.

The AMLA incentivizes whistleblowers to report money laundering and sanctions evasion by requiring the Department of the Treasury to pay an award where a whistleblower’s voluntary disclosure of original information leads to a successful enforcement action imposing monetary sanctions above $1,000,000. The minimum whistleblower award is ten percent of collected monetary sanctions and the maximum award is thirty percent. Awards are paid from penalties collected in successful enforcement actions stemming from whistleblower disclosures.

To determine the amount of an AMLA whistleblower award, Treasury will consider:

• the significance of the information provided by the whistleblower to the success of the covered money laundering judicial or administrative action;
• the degree of assistance provided by the whistleblower and any legal representative;
• the programmatic interest of Treasury in deterring the particular violations that the whistleblower disclosed; and
• additional relevant factors that Treasury will promulgate, which will likely echo the factors that the SEC employs to determine the amount of an SEC whistleblower award.

FinCEN Issues Advisory About Terrorist Financing

Among the violations that whistleblowers can help the government detect and combat are sanctions evasion and money laundering related to Islamic Republic of Iran-backed terrorist organizations. On May 8, 2024, FinCEN issued an Advisory to assist financial institutions in detecting potentially illicit transactions related to Islamic Republic of Iran-backed terrorist organizations. FinCEN Advisory to Financial Institutions to Counter the Financing of Iran-Backed Terrorist Organizations, FIN-2024-A001 (May 8, 2024).

The Advisory identifies the means by which certain terrorist organizations receive support from Iran and the techniques they use to illicitly access or circumvent the international financial system to raise, move, and spend funds. According to the Advisory, the sale of commodities, particularly oil, is the primary source of revenue for Iran to fund its terrorist proxies. Iran has “established large-scale global oil smuggling and money laundering networks to enable access to foreign currency and the international financial system through the illicit sale of crude oil and petroleum products in global markets.” FIN-2024-A001, at 3. In 2021, the National Iranian Oil Company sold approximately $40 billion worth of petroleum products and in 2023, Iran’s exports to the People’s Republic of China reached approximately 1.3 million barrels per day. Some of the proceeds of the sale of Iranian oil finances the activities of the IRGC-Qods Force and other terrorist groups.

Financial Institutions Can Serve as Intermediates for Terrorist Financing Transactions

Financial institutions located outside Iran become intermediaries for the IRGC-QF’s terrorist financing transactions. In particular, “third-country front companies—often incorporated as ‘trading companies’ or ‘general trading companies’—and exchange houses act as a global ‘shadow banking’ network that processes illicit commercial transactions and channels money to terrorist organizations on Iran’s behalf.” Those exchange houses and front companies rely on banks with correspondent accounts with U.S. financial institutions, especially to process dollar-denominated transactions. FIN-2024-A001, at 5.

The Advisory lists red flags of illicit or suspicious activity that financial institutions should consider in determining if a behavior or transaction is indicative of terrorist finance or is otherwise suspicious and therefore may warrant the filing of a Suspicious Activity Report:

• A customer or a customer’s counterparty conducts transactions with Office of Foreign Assets Control (OFAC)-designated entities and individuals, or transactions that contain a nexus to identifiers listed for OFAC-designated entities and individuals, to include email addresses, physical addresses, phone numbers, passport numbers, or CVC addresses.
• Information included in a transaction between customers or in a note accompanying a peer-to-peer transfer include key terms known to be associated with terrorism or terrorist organizations.
• A customer conducts transactions with a money services business (MSB) or other financial institution, including a VASP, that operates in jurisdictions known for, or at high risk for, terrorist activity and is reasonably believed to have lax customer identification and verification processes, opaque ownership, or otherwise fails to comply with AML/CFT best practices.
• A customer conducts transactions that originate with, are directed to, or otherwise involve entities that are front companies, general “trading companies” with unclear business purposes, or other companies whose beneficial ownership information indicates that they may have a nexus with Iran or other Iran-supported terrorist groups. Indicators of possible front companies include opaque ownership structures, individuals and/or entities with obscure names that direct the company, or business addresses that are residential or co-located with other companies.
• A customer that is or purports to be a charitable organization or NPO84 solicits donations but does not appear to provide any charitable services or openly supports terrorist activity or operations. In some cases, these organizations may post on social media platforms or encrypted messaging apps to solicit donations, including in CVC.
• A customer receives numerous small CVC payments from many wallets, then transfers the funds to another wallet, particularly if the customer logs in using an Internet Protocol (IP) based in a jurisdiction known for, or at high risk for, terrorist activity. In such cases, financial institutions may also be able to provide associated technical details such as IP addresses with time stamps and device identifiers that can provide helpful information to authorities.
• A customer makes money transfers to a jurisdiction known for, or at high risk for, terrorist activity that are inconsistent with their stated occupation or business purpose with vague stated purposes such as “travel expenses,” “charity,” “aid,” or “gifts.
• A customer account receives large payouts from social media fundraisers or crowdfunding platforms and is then accessed from an IP address in a jurisdiction known for, or at high risk for, terrorist activity, particularly if the social media accounts that contribute to the fundraisers contain content supportive of terrorist campaigns.
• A customer company is incorporated in the United States or a third-country jurisdiction, but its activities occur solely in jurisdictions known for, or at high risk for, terrorist activity and show no relationship to the company’s stated business purpose.

FIN-2024-A001, at 12-13.