15.2 Reviewing KYC, Transactions, Open Sources, and Documents to Build an Investigation

CAFCA sub-topic 4.2 asks how to review KYC information, transactions, open-source research and documentation to inform an investigation. A good investigator builds an evidence picture that a reviewer can follow. Every conclusion should trace back to a source.

1. Start with the KYC file

• Identity and verification: what was verified, with what sources, and were there any discrepancies at onboarding?
• Ownership and control for entities: beneficial owners, directors and signatories, and any changes.
• Stated purpose and expected activity: occupation or business model, expected volumes, countries and payment methods.
• Risk history: rating changes, prior alerts and their dispositions, PEP or sanctions screening results, prior RFIs.

Ask: does the activity under review fit the person or business described in the file?

2. Analyse the transactions

3. Use digital and device evidence

Shared devices across accounts, IP addresses in unexpected countries, emulator signals, and logins just before suspicious transfers can link apparently unrelated customers or point to account takeover (Chapter 8).

4. Test documents

Customers may provide invoices, contracts, payslips, bills of lading or bank statements. Before relying on them:

• Check consistency: do the dates, amounts, names and descriptions match the transactions?
• Check against independent sources: does the supplier exist in a corporate registry? Does the employer exist? Does the invoiced amount match the payment exactly?
• Look for tampering: odd fonts, misaligned figures, file metadata showing recent editing, or templates reused across customers.
• Ask whether a genuine business would produce this document. A US$90,000 "consulting invoice" with no description of services is weak evidence.

5. Do open-source research properly

• Adverse media: search the names of the subject, the business and the directors with risk keywords (fraud, laundering, sanction, bribery, arrest, court). Prefer reputable outlets and primary records.
• Corporate registries: incorporation date, officers, filings, dissolution status, shared addresses with other companies.
• Court and regulator records: judgments, enforcement notices, insolvency.
• Online footprint: website age and content (archive services can show history), domain registration, public social media consistent with the declared business, and whether the address exists.
• Method and ethics: use public information only. No fake profiles, pretexting or hacking. Record the URL, date and a capture of each item (Chapter 14).

6. Check internal records

Other accounts held by the subject or by linked people, complaints and fraud claims against the account, chargebacks, previous RFIs, partner-bank referrals and law enforcement requests. Previous SARs may be visible only in the restricted SAR repository, so follow the access rules.

7. Visualise links

When several accounts, devices or counterparties are involved, draw a link chart: nodes for people, accounts, devices, addresses and wallets, and edges for payments or shared attributes. Charts reveal hubs, such as a device used by eight "unrelated" customers, and show directions of flow that tables hide. Keep the underlying data with the chart so that every link can be traced to a record. Many case-management tools build these graphs automatically, but the analyst must still check that each link is real. Two customers sharing a public Wi-Fi address is weaker evidence than two customers sharing a device identifier.

Building the picture

Summarise the evidence in a chronology. Mark what supports and what contradicts each explanation, rate the reliability of each source, and identify the gaps that further enquiry could close. Chapter 15 covers how to avoid bias when weighing the evidence.

Realistic exam scenario

A business account opened as a "marketing consultancy" receives 120 payments from individuals in three countries and sends funds out to a crypto exchange. Open-source checks show the company website was copied from another firm's site and the domain is two months old. A director appears in a court judgment for investment fraud. The customer later provides invoices that all use the same template with different names. Together, the evidence contradicts the stated business and supports escalation for a SAR decision. Each finding is recorded with its source.

Common exam traps

• Relying on customer documents without testing them.
• Using a single news article as proof. Corroborate it.
• Ignoring the KYC baseline and judging transactions in isolation.
• Unrecorded open-source findings.