The Art of Filing SARs: Practical Insights for AML Professionals

Transcript

So now we have the next workshop which is on suspicious activity reporting and how to do it properly. Um so presenting this workshop today is Mercedes Netto of Bitcoin Swiss, Jean Canerella and Aleandro Pulver Varanti of the MROS the moneyaundering reporting office of Switzerland. here. Do we have here for the slides? You see the slides? The slides?

Yes, we have slides. We sent slides. Yes. So good afternoon and welcome to today's

workshop called the art of filing source. My name is Mercedes Nto, head regulatory at Bitcoin Swiss and today together with our colleagues Sean and Alexandro from Ambrose, we will provide you with some insights for AML professionals. So let us start with some foundational knowledge. Here we go. So what is our duty as best? We have article six AMLA where we have the duty to investigate the background and the purpose of transactions one and also business relationships in case there could be a kind of illicit

activity. This is the starting point can be that maybe uh there is a transaction monitoring alert or the relationship comes and says oh this client somehow behaves differently or you have other indications. Then you do this deep dive. You do this special clarification. That means you do adv adverse media checks. uh you see in general also public available resources if you find something but also in crypto the most important you do this blockchain analysis with the according tool and based on that then you write a report you a summary based on the factual

situation and you decide is there a real suspicion that the assets or the according transaction or business relationship could have somehow a link to an illicit activity. If so, if you have a reasonable suspicion for that, then we need to report. We need to report in that sense that we need to uh submit a suspicious activity reporting or a suspicious transaction reporting to the money laundering reporting office, Switzerland Embro.

And this is absolutely an obligation we have. And what is a SAR? It's basically a electronic notification you submit through the go AML tool. This is the starting point. Now we need to make a distinction between the duty, the obligation to report and the right to report. So we have to there is the obligation to report in case we know or there are reasonable grounds to suspect that this business relationship or this transaction is linked to somehow an illicit activity as described here. So what are reasonable grounds? I mean it's a wide term can be in general it's not a foolproof

but it's more than just vague suspicions or kind of not grounded uh suspicion we also need to report that even if we don't have established the full client relationship that means for example you start with the onboarding you do your compliance due diligence checks and then you see at media Oh, there was maybe a sentence regarding this client or the data related to this client. Also, these kind of cases need to be reported. Then in general when you do your due diligence checks, your client reviews, but also in case internally you see that there was a suspicion, an unusual

behavior that you you based on the facts you really can describe that there is a realistic suspicion that these assets are linked to an illicit activity. Then you report. However, sometimes there are also cases where you don't have a sentence or a letter from a prosecutor or something like that or a real clear case. In such cases where h this case is a bit shady. I have an indication but it's not enough to report uh an article 9 AML. We have still the right to report based on article 305 T Swiss criminal code and this is often a discussion in that sense

it's a nine or a 305 T it's not always crystal clear we take as reference that a reasonable person with the according experience and knowledge would that person see that case as suspicious that's a bit the indication let's go for the crypto cases. What are the typical crypto cases we need to report? For sure, investment fraud. This is uh one of the most common cases we need to report. Typically is that you have scams related to big budgeting at the end. uh all these tricks, these fake profiles, these fake platforms. What we also know from

Treadfi but now with crypto most of the cases are uh related to victims which are vulnerable people. So they really know who are the victims. Another part is theft, misappropriation of cryptocurrency assets. That means um maybe somebody has a wallet with a private key and this private key through the froster gets manipulated or they share the password login for the only online online account and then from one day to the other all the crypto assets from the wallet are gone. This happens unfortunately also often.

suspected use of crypto assets in connection with illicit drug trafficking. This is a bit more difficult and doesn't happen so oft related to that. It's that the client has from one day to the other another kind of transaction behavior or in particular wants to have a third party transaction settled in his account. Then you do your due diligence check and then you see okay on the blockchain on whatever um there are some links maybe to uh people involved in drug trafficking or similar source of funds is a big topic also there uh it's possible to have uh several cases that maybe people don't report from the beginning all their

source of funds can happen sometimes and um indications are also if people when you do your due diligence checks, address, media check pop up in a in general that sentence a court sentence um regarding corruption or similar was given and of course suspected tax offenses. For example, you have a client declared to be a non- US person. Three, four years later, you you do a a renewal of the full documentation and then he says something else and then the process starts.

Exactly. Investment fraud. What's a scam? We don't need to look at that in detail. However, the typical case is online communication. So, the process, they really know how to get these victims. But not only what we have seen in the last time in particular for a group of elderly people they they go to the bridge club in person they uh pretend to be crypto advisors and then they get their victims. Fortunately that happens and uh typically promises of high returns uh fake platforms they say you invest 10,000 and get 1 million back.

We know all that uh this is a trick but people in special situations believe that they always go for the victims for these vulnerable people. And why is this um why does do this scam harm victims and also the west? Of course they lose a lot of money better said crypto and this usually cannot be recovered. But it's not only the money it's also often they are so transparent that they share the full documentation identification theft. So their identity will then be reused for other scams happens also. And this revictimization is also a big topic. Okay, these people

are extremely stressed. They maybe lost the full pension funds or they were already at the limit. They don't have nothing. And in these cases, they go they say, "Okay, I'm a professional lawyer, a professional advisor. I help you to recover these funds." And then it gets even worse. and but also for westps this is a a really sensitive situation and for the whole industry because this is kind of leads to a lack of trust in crypto in technology in the financial institutions in general and also for reputational reasons uh it is um can be a topic for example if it becomes public even if the hasn't done

anything has done everything right and reported Here you see a list of these typical vulnerable people. I spoke about elderly people. Why? Because we have seen a lot of such cases in the last time. But not only old people also young people can be affected though. In general, it comes to when people don't have the according knowledge about crypto. A typical case and that's how how the structure of a SAR filing can be. You have a client profile, the source of wealth and the transaction behavior. The transaction behavior is almost the most important. Then it's important to stick to the facts to have a good overview and

to summarize that. That's what you do when you do a special clarification. transactional behavior in such a case with these elderly people they made several deposits here 400,000 then they bought bitcoin and then from a completely inactive profile they start to withdraw in trenches their bitcoins to their private wallets and for west it's extremely difficult sometimes to detect that in time because you have your maybe your transaction monitoring with your rules but they are they know what they do and they don't usually um withdraw five 15 25 where maybe also your system would recognize that. So and it's extremely difficult uh for west

span also to intervene here because usually you see it often these are questions you then can raise to bit see is there a real suspicion or not as for example the transactional behavior has this uh person been doing that in the past are there any indications you maybe speak with your relationship managers you check the documentation you do adverse media uh checks and um based on that you come to a conclusion and this conclusion then it's summarized in a special clarification where you decided and report and then it's submitted to

Ambrose and with that I'm happy to hand over to Ambrose. Thank you Mercedes and Ladies and gentlemen, good afternoon as well from my side. Um um I will present today alongside my colleague Jean um the art of filing SAR uh from an Amros point of view. Um today's goal is to highlight the importance of having qualitative suspicious activities reports and we'll give you as well some tips which will help you uh drafting them. But first of all, let's start with a short

introduction on what is MROSS. Um, I'm sure you know about it, but it's good to remind that we are an administrative authority. Uh, that we are managed by the federal police department. We are uh Switzerland's uh central moneyaundering office uh receiving then the suspicious activity reports and u we deal as a uh filtration point between on the one hand the financial industry the financial intermediaries and the law enforcement authorities. That's exactly what we're not. We are not a law enforcement authority. We are not a supervisory authority and uh we do not apply coercive measures.

In 2025 we are around 20 60 60 to 65 people working for EMRAS divided into six section as you can see from left to the right. Uh the planning and policy section dealing with all legal and policymatters the preliminary analysis team uh is the team uh collecting and processing all incoming SARS. Um then you have the two operational uh teams um dealing with the in-depth analysis of the of the reports. You have the data management and strategic analysis team which are among others responsible for our information uh system tool ML and the international uh division uh dealing among others with

international exchanges with foreign financial intelligence units. Let me quickly show some statistics. Uh as you can see, every year we receive more and more suspicious activity reports. Uh last year it was more than 15,000. Uh which means uh it was an increase of around 30% more than in 2023. Um this trend uh is the same even this year. we have already received for this first period of year more than compared to the same period of last year. Um there are several reasons for that. Um on the one hand there are better understanding of um money laundering

issues, better awareness and on the other hand um financial intermediaries have as well better uh or improved tools for transaction monitoring or internal analysis. And as you can see on the left side of the screen, uh transaction monitoring is the main factor arousing suspicion leading to reports. When you draft a report, it's important uh or it's very helpful when you indicate the uh predicate offense that you suspect. As you can see in onethird of the cases, this is not the case. And I can assure you this makes everything more complicated. Uh the main ones was fraud.

This has been the case last year but as well in the previous years. So we received last year 15,000 reports uh more than 90% of them from the uh banking sector. Um it's important to highlight the fact that we have introduced a new um category in our GML system uh which is the wasp fintech category. Um last year 30 financial intermediaries registered in it and submitted 227 suspicious activity reports. Um even if we haven't received that many reports from wasps uh it doesn't mean that we receive um many virtual asset related SARS and this as you can see on

the figure uh increases every year as well. We work with our information system uh GUML which is something we encourage you to use as well because this helps you to draft uh and submit in a very efficient quick efficient and uh in a secure manner reports to Amros to do so you just have to end to fill out this uh little form that you can find on our website and as soon as you get confirmation then you can start using And another very important point, you will get updates from MROS such as new newsletters and uh other important

information. Once you have drafted and submitted the report, um we will receive them of course and our preliminary analysis team will perform the first checks. will check that you have sent all necessary attachments to the report and you will get a confirmation uh received as you can see on the on the screen. Um please be informed that uh since we have um very high number of reports that we receive. Um we use a risk based approach that we have developed consisting in prioritizing and um uh the the cases and uh we focus on serious crimes.

We get the operative teams receive then the reports that you have submitted and we have many tools at our disposal to perform this operative analysis. We have the police databases uh which give us very interesting information. Uh we use crypto tools as well to detect the sources of funds. We can exchange information with Swiss authorities as well as with uh foreign financial intelligence units and if we see a link to uh other um reporting entities, other Swiss financial intermediaries, we can ask them for information as well. Uh once we have all this information the

operative analysis is is done which is combined then with a strategic broader analysis that we perform and we create in that case u an very important piece of intelligence. Once um we are done with the whole uh analysis if we have reasonable reasonable grounds for suspicion we can uh transmit the case to the prosecution authorities. And um at the same time we inform the reporting entity that this has been done unless the reporting entity has interrupted the business relationship with the client. Um when we inform the reporting entity they have to freeze the

assets for a maximum period of five days. Um if this if they have to freeze it for a shorter or longer uh period then this is something they have to discuss or you have to discuss with the prosecution authorities directly. Finally, if you don't have suspicion uh reasonable grounds for suspicion, we do not uh notify any prosecution authority. But this doesn't mean that the report is not used from our side. As I said, we can share information with our Swiss authorities. We can share information with foreign financial intelligence units. And in any case, this will feed our go system with important

intelligence and this will help us as well in future to to link such reports with other reports that we'll get and uh create some clusters. With that, I'm done and I'll give I hand over to Jean. Yeah. Thank you. Hi everybody. So um let's start with some uh suspicious activity reporting tips. Um maybe I'm saying that crypto is not always universal knowledge. So for instance for a crypto expert who has a technical background it may be very straightforward to talk about crosschain swap or DEX. But for someone who has no technical background, sometimes it

becomes harder to assess the risk of of a situation. So I would say that it's always a compromise between being precise, both precise and accessible. But at the same time, crypto world and traditional finance were work in two different with two different assumptions. So sometimes for instance it's very different in crypto world you for freezing funds and it's always good to to uh to clarify um maybe just an example that will illustrate some challenges is one typology that was featured in last year report.

Um in this instance, okay, we we observed um credit card, stolen credit card that were used to uh purchase Bitcoin through an app and typically under know your customer threshold. So without the identification of the customer so virtually you have a lot of report with low amount, low materiality, virtually no link with Switzerland and no clients. But what's interesting is no client identification. But what is interesting is that it's not because you don't have the name of someone that you can work with other data for instance financial intermediaries such as BS.

Sometimes I collect IP addresses or type of mobile phone and with that if I'm it's a it's a source to cluster several several reports every transaction together and you can as well leverage blockchain intelligence for instance okay those credit cards were linked to that IP address and okay if we follow the money instance we observe that the funds were rooted to one address and in this address there were like hundreds of other deposits um the the amount being uh really higher and showing a pattern of serial crime. So, but it's it's also possible to to trace back that to it was possible to trace back that that back to

to financial intermediary. So, what I want to say here is that it's not because uh there is no old data that we have usually such as the client name. It's it's also possible to work with IP addresses or with phone numbers or what what is available. Now maybe on when filing a suspicious security report about the importance of giving context uh for instance if a fraudster want to buy bitcoin uh with Swiss Frank it will deposit this uh this to Swiss Frank in a Swiss bank account but the Swiss bank

account is linked to to a vasp with helas that may have a client another virtual asset service provider who is in turn linked to the the the end client forester and in this constellation you may have four different uh jurisdiction involved and when submitting the report it's it's it's very it's it's a good practice to to explain the the the context of the business relationship for instance to for us to understand which rediction we have to approach in order to follow the money. Uh, another tip that was mentioned in the last newsletter is when submitting a report, it's always good to protect the source of this report. For instance, the name of the complian officer, if it's

mentioned in a supporting documentation, it's always good to redact it. Okay, but transactions uh we are in financial intelligence unit. So, our core job is to follow the money and our system is built around transactions. So it's always good to to record all the suspicious transaction which is which help uncover for instance networks and now okay with bitcoins we understand that this is different because uh UTXO but it works differently but uh we can in in this instance Excel file are perfectly acceptable as long as we have all the informations

and as well we have a suspicious activity report based on blockchain uh alerts for instance because of the to analysis or something else identify a risk and if this is part of a suspicious activity report it's always a good practice to to provide the the the graphs and an interpretation of this graph not just there is here here is a we have if someone is interested I don't know how many compliance officer there is here but if uh you're interested we have a small guide uh who helps um recording in go some account or type of transaction and we are happy to to share it with you. It's not published but uh it's available.

All right. So maybe to sum up um the goal is always to to have finally we have different part of a picture. we have small report and the goal is always to cluster that in a in a bigger picture and something that's very important as mentioned by Mercedes before is the clarifications. So it may helps for instance turn simple transaction uh pattern financial pattern in like actionable intelligence because compliance officer actually uh sometimes we see really work of arts I mean really big investigation made by compliance

where they clarify with client and make big on chain analysis and so on and yes I will maybe as well mention that it's always good to indicate the predicate offense predicate offense and yes with that being say I said here are some contact detail if you want to register in go ML please don't hesitate to uh to take a picture of that and we are always a available should you have any question for reporting being technical or just uh in general thank you I think I'm it's the guys is there any Question for any of us.