Special Agent Lisa Palmer, IRS-CI

MOUNTAIN WEST CREDIT UNION ASSOCIATIONJune 9, 2020

Objectives

• Overview of Role of CI Special Agents• Components & Importance of SARs• Discuss Traditional Case Studies• Emerging Cryptocurrency Trends• Discuss Cryptocurrency Cases• Discuss Role SARs Play in Investigations

Who is IRS-CI and What Do They Do?

• Approx. 2,200 Special AgentsFraud Detection CentersForensic LaboratoryComputer Investigative SpecialistsUndercover ProgramTech. ProgramAsset Forfeiture Coordinator

• Interview witnesses and subjects• Serve search, seizure and arrest warrants• Perform undercover operations• Armed Escorts/Building Security• Evaluate Information • Testifying - Grand Jury & Trial• Recommend Prosecution

What Do Special Agents Do?

SAR Review Teams

• Includes FBI, IRS, USAO, ICE/HSI, DEA, ATF, USSS, USPS, CO Dept of Rev., and SEC etc.

• Meet once a quarter

• Discuss SARs, cases, and trends

So Many SARs - How to Chose

• Different agencies have different priorities

• Investigative Authority:• Title 26 – Internal Revenue

Code

Who is IRS-CI and What Do They Do?

• Legal Source Income

• Illegal Source Income

• Return Preparer Schemes

• ID Theft

• Money Laundering

(Video Break!)

Who is IRS-CI and What Do They Do?

SAR Analysis Tool

Data Analytics

• Are there individuals with multiple SARs this months?• Previous months? Outside this area?

• Are there individuals with SARs who also have other BSA Documents

• What specialized filers have filed in my area?

• Are there new documents for existing cases?

Data Analytics

Preparing SAR Narratives

• This is your chance to tell me, in plain English, what you THINK is suspicious.

• Give me a summary in the first 1-2 sentences.

• Provide a detailed description of the known or suspected criminal violation or suspicious activity.

• Add any information you have about the knowledge, mindset, or intent of the subject.

• Conversations, or statements from the subject are especially useful

Prepping SAR Narratives

TELLER 08 AT 12:29 10/12/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 08 AT 16:23 10/13/2010 WEDNESDAY CASH DEPOSIT $9,500.00 TELLER 10 AT 10:30 10/19/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 08 AT 16:40 10/20/2010 WEDNESDAY CASH DEPOSIT $9,500.00 TELLER 11 AT 14:44 10/21/2010 THURSDAY CASH DEPOSIT $9,500.00 TELLER 08 AT 14:46 10/26/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 04 AT 15:02 10/27/2010 WEDNESDAY CASH DEPOSIT $9,500.00 TELLER 04 AT 11:34 11/02/2010 TUESDAY CASH DEPOSIT $9,500.00 TELLER 11 AT 16:35

How We See SAR Narratives

Attach Transaction Charts to SARDEPOSIT Teller Time Day of Week Date $9,500.00 08 16:23 WEDNESDAY 10/13/2010 $9,500.00 10 10:30 TUESDAY 10/19/2010 $9,500.00 08 16:40 WEDNESDAY 10/20/2010 $9,500.00 11 14:44 THURSDAY 10/21/2010$9,500.00 08 14:46 TUESDAY 10/26/2010$9,500.00 04 15:02 WEDNESDAY 10/27/2010 $9,500.00 04 11:34 TUESDAY 11/02/2010 $9,500.00 11 16:35 THURSDAY 11/04/2010

Example 1Excerpt from a SAR

This SAR is being filed for suspicious incoming funds, a suspicious use of funds and a suspicious movement of funds conducted in personal checking account…

…[the bank] considers this activity suspicious because the true source of the electronic credits and incoming wires is undetermined. Also, the inability to determine the true use of the visa debit card purchases and electronic debits is suspicious. Additionally, the inability to determine the source and use of funds indicates a suspicious movement of activity. Online research supporting this customer is buying and selling bitcoins adds to this suspicious nature.

Example 1

Example 1Excerpt from a SAR

This SAR is being filed for suspicious incoming funds, a suspicious use of funds and a suspicious movement of funds conducted in personal checking account…

…[the bank] considers this activity suspicious because the true source of the electronic credits and incoming wires is undetermined. Also, the inability to determine the true use of the visa debit card purchases and electronic debits is suspicious. Additionally, the inability to determine the source and use of funds indicates a suspicious movement of activity. Online research supporting this customer is buying and selling bitcoins adds to this suspicious nature.

Example 1

Limited Use of SAR Information

• Back-up documentation• Transactions are great but context ALWAYS helps• More is better…additional account activity and history, conversations

with subject, video, and pictures

• We cannot directly use any of the information in the SAR• Follow-up with subpoena, summons, court order• Interview employees of the financial institution who were

involved/witness to the suspicious activity

Limited Use of SAR Information

Red Flags Depository Accounts

• Structuring• Large amount of cash deposits• International wires• Activity out of the ordinary for customer• Customer inquiring about BSA laws• Business activity in personal accounts• Multiple U.S. Treasury checks in various names in single account• Recycling of Cashier’s Checks to keep account balance low

Red Flags – Depository Accounts

Reach Out to Law Enforcement

• Thousands of SARs are filed each month in Colorado - don’t be scared to reach out

• Time sensitive• Out of the ordinary• Trust your instincts

• You are the boots on the ground, much of our financial intelligence comes from you

Reach Out to Law Enforcement

Tax Evasion in a nutshell

This boils down to intent to defraud the United States by concealing income from being taxed or concealing assets so as not to pay an outstanding tax.

• Evasion of Assessment vs. Evasion of Payment

Applies to all types of federal taxes: income, employment, etc.

Tax Evasion in a Nutshell

• Structured cash deposit/withdrawals• Using nominees (shell corporations, nominee signor, stamped signature)• Business activity in a personal bank account• Comingling business and personal funds/expenses• Sweeping accounts regularly (i.e.: depositing funds, purchasing cashier’s

checks, then redepositing cashier’s checks at a later date)• Cash intensive businesses with no cash activity in business bank account

(i.e.: retail, bars, dry cleaners, etc.)• Admissions or statements from account holders

What Can Tax Evasion/Fraud Look Like in a Bank Account?

Return Preparers

• No Licensing Rules for Return Preparers

• Make up Information on Returns

• Charge a Percentage of the Refund

Return Preparers

Tax Fraud ID Theft

• Stolen SSN• Fabricate income – Refundable credits• Use last year’s income numbers• Business Email Compromise

• ITIN Fraud• Create an account• Receive Additional Child Tax Credit• The gift that keeps on giving

Fraud – ID Theft

• Direct Deposit into Bank Account• Limit of three

• Prepaid Debit Card• Also a limit of three• Debit cards have AML programs

• Checks• You need an ID to cash the checks

MONEY: From the IRS to the Criminal

IRS Impersonation Schemes

• Phone and email (mostly phone)• Threaten arrest • Action required immediately• Send money through MSB, gift cards, or cryptocurrency

• Not limited to IRS• Social Security Administration• Utility Companies

IRS Impersonation Schemes

Case Studies

Case Study #1 –The Home Healthcare Providers

• SARs filed by local CU stating two new business accounts just received over $3 million from the Treasure Department related to claims with the VA

• Businesses registered to same residential addresses

• Majority of the funds were quickly transferred to personal accounts.

• Funds largely used for what appear to be personal expenses

Case Study #1 –The Home Healthcare Providers

• The businesses’ claims with the VA were analyzed and outliers were identified for patient care

• Interviews showed business owner had cold called patients with a chronic condition, and helped care takers fraudulently enroll as certified healthcare workers.

• Subject’s businesses kept 80% of the money

• Found guilty – subjects are awaiting sentencing

Case Study #2

The Landlord

• Multiple SARs filed on local landlord• Subject would bring in an empty bag,

go to their safe deposit box and then buy a large cashier’s check with cash from the bag

• Subject would cash checks regularly with memos for “Rent” or an address

• Kept low balances in personal accounts

Case Study #2

The Landlord

• Follow up documentation requested, and agents interviewed bank personnel

• Subject told tellers she didn’t trust banks, and preferred to use cash

• Review SAR support and public records showed she was buying inexpensive properties and renting them

• Review of tax returns showed income was reported

CRYPTOCURRENCY

• History of Cryptocurrency• Components of a Cryptocurrency Transaction• Role of Cryptocurrency in Financial Crimes• Emerging Trends

Cryptocurrency

Cryptocurrency SARs: VolumeCryptocurrency SARs: Volume

Cryptocurrency SARs: FilersCryptocurrency SARs: Filers

CryptocurrenciesCryptocurrenies

ADDS TO NARRATIVE

• Public Key (a/k/a “account number”)• Email Address(es)• Conversations RE: cryptocurrency exchangers used• Other cryptocurrencies used• Bank photographs during the transaction• Device Information• IP Addresses

Adds to Narrative

IMPORTANCE for LE & BSA

• Threats to integrity • More difficult to ID (anonymity)• More difficult to detect by LE (avoidance)• More difficult to trace & track (3 stages of ML)• Counting on LE & Regulators being novices• Threats to safety

Importance for LE and BSA

Cryptocurrency kiosks

ATMs sell and buy cryptocurrencies for cash• Different companies deal in different

currencies• High fees• Some are legitimate, others less so

These can, and are frequently used to launder money

Cryptocurrency Kiosks

Contact Info

• lisa.palmer@ci.irs.gov 303-603-4940

Contact Info