12.2 Sanctions Investigation Triggers & Case Development

12.2 Sanctions Investigation Triggers & Case Development

Core Principle: An effective sanctions investigation transforms raw alerts, supervisory inquiries, or whistleblower tips into a comprehensive, objective factual record. Successfully developing a sanctions case requires rigorous investigative scoping, strict evidence preservation under litigation holds, multi-source forensic data gathering, and defensible case reporting that withstands regulatory and judicial scrutiny.

---

1. Investigation Inception & The Taxonomy of Triggers

Sanctions investigations within financial institutions, multinational corporations, and fintech platforms are initiated through two primary operational channels: Internal Compliance Controls and External Authoritative Inquiries.

+--------------------------------------------------------------------------------------------------+
|                              SANCTIONS INVESTIGATION TRIGGER TAXONOMY                            |
+--------------------------------------------------------------------------------------------------+
| INTERNAL TRIGGERS (Proactive Compliance Detection):                                              |
|   • Real-Time Payment Screening Hits: True match escalations from Level 1/2 triage queues.       |
|   • Batch Customer Delta Screening: Re-screening flags existing clients added to new watchlists. |
|   • Transaction Monitoring (TM) Anomalies: Post-settlement velocity spikes, U-turns, round-sums. |
|   • Internal Whistleblower Disclosures: Employee reports of wire stripping or filter tampering. |
|   • Internal Audit & QA Sample Testing: Discovery of systemic under-screening or false negatives.|
+--------------------------------------------------------------------------------------------------+
| EXTERNAL TRIGGERS (Reactive Regulatory & Intelligence Inputs):                                   |
|   • Law Enforcement Subpoenas: Grand jury subpoenas, DOJ inquiries, FinCEN 314(a) requests.     |
|   • Regulatory Inquiries & Audits: Formal requests from OFAC, OFSI, FinCEN, SEC, Fed, or BaFin.  |
|   • Adverse Media & OSINT Leaks: ICIJ offshore leaks, investigative journalism on front companies.|
|   • Correspondent Bank Inquiries: SWIFT MT199/MT299 queries from clearing banks requesting CDD. |
+--------------------------------------------------------------------------------------------------+

Comprehensive Trigger-to-Action Matrix

---

2. Scoping the Investigation & Establishing the Investigation Charter

Proper investigative scoping is essential to balance investigative thoroughness against operational paralysis. The compliance investigation lead and legal counsel must formalize an Investigation Charter defining the boundaries across four core dimensions:

+---------------------------------------------------------------------------------------+
|                         THE FOUR DIMENSIONS OF INVESTIGATION SCOPING                  |
|                                                                                       |
|  1. TIMEFRAME SCOPE: Lookback period aligned with applicable Statute of Limitations.  |
|  2. ENTITY & OWNERSHIP SCOPE: Primary targets, corporate affiliates, UBOs (50% Rule). |
|  3. PRODUCT & CHANNEL SCOPE: Wires, letters of credit, FX, crypto, trade finance.    |
|  4. JURISDICTIONAL SCOPE: Domestic offices, foreign branches, correspondent accounts. |
+---------------------------------------------------------------------------------------+

The Four Core Scoping Dimensions

1. Timeframe Scope (Lookback Period):
   • The lookback timeframe must align with applicable statutory periods. In the United States, civil and criminal sanctions enforcement under IEEPA and TWEA is governed by a 10-year statute of limitations (expanded from 5 years under the 21st Century Peace through Strength Act enacted in April 2024).
   • Investigations typically establish an initial focused lookback period (e.g., 3 to 5 years), with mandatory expansion triggers if evidence demonstrates systemic, multi-year evasion patterns.
2. Entity & Ownership Scope:
   • Identify the primary subject, all registered trade names (DBAs), holding companies, operating subsidiaries, directors, authorized signers, and Ultimate Beneficial Owners (UBOs).
   • Apply the OFAC 50 Percent Rule and EU/OFSI Ownership and Control Criteria to map all entities owned 50% or more, individually or in the aggregate, by designated persons, or controlled through non-equity mechanisms.
3. Product & Service Line Scope:
   • Determine which business lines interacted with the target: cross-border wire transfers (SWIFT, Fedwire, CHIPS), trade finance (Letters of Credit, documentary collections), foreign exchange (FX) trading, lending facilities, safe deposit boxes, or custodial wealth management.
4. Jurisdictional & Correspondent Scope:
   • Map all geographic touchpoints, foreign subsidiary branches, overseas representative offices, and intermediary correspondent clearing accounts involved in the transaction lifecycle.

---

3. Evidence Gathering, Digital Forensics & Investigative Methodology

A defensible sanctions investigation synthesizes evidence across multiple internal and external data streams to reconstruct the full financial and operational reality of the questioned activity:

+--------------------------------------------------------------------------------------------------+
|                                 MULTI-SOURCE EVIDENCE SYNTHESIS                                  |
+--------------------------------------------------------------------------------------------------+
| 1. INTERNAL BANKING DATA: KYC files, signature cards, core ledgers, SWIFT MT103/202 messages.    |
| 2. ELECTRONIC COMMUNICATIONS: Email archives, Bloomberg chats, Microsoft Teams, call recordings. |
| 3. TRADE DOCUMENTATION: Commercial invoices, ocean bills of lading, airway bills, customs forms. |
| 4. EXTERNAL PUBLIC REGISTRIES: Corporate registries, land records, maritime AIS tracking, OSINT.  |
| 5. FORENSIC ACCOUNTING: Fund flow diagrams, transaction reconstruction, wire stripping analysis. |
| 6. INVESTIGATIVE INTERVIEWS: Structured witness interviews conducted under Upjohn legal warnings.|
+--------------------------------------------------------------------------------------------------+

Core Investigative Methodology Stages

• Internal Data Gathering & E-Discovery:
  • Retrieve complete Customer Due Diligence (CDD) packages, beneficial ownership declarations, corporate formation deeds, and risk-rating logs.
  • Extract full, unedited electronic payment records—including SWIFT MT103, MT202, and ISO 20022 pacs.008 XML messages—to examine raw Field 50K (Ordering Customer), Field 52A (Ordering Institution), Field 57A (Account With Institution), Field 59 (Beneficiary), and Field 70 (Remittance Information).
  • Secure electronic communications (emails, instant messaging platforms, CRM relationship manager notes, and recorded trading desk telephone lines) using keyword search terms targeting entity names, vessel IMO numbers, project codenames, and geographic locations.
• Public Registry & Open-Source Intelligence (OSINT):
  • Query official corporate registries (e.g., UK Companies House, OpenCorporates, state corporate registries across Delaware, Cyprus, BVI, Panama) to verify corporate ownership structures and identify hidden nominee directors.
  • Consult commercial databases (e.g., Sayari Graph, Moody's Orbis, Dow Jones, Refinitiv) to uncover corporate linkage trees.
  • Review historical maritime vessel tracking data (AIS transmissions, port call histories, ship-to-ship transfer alerts) via Lloyd's List Intelligence or MarineTraffic.
• Forensic Accounting & Transaction Flow Mapping:
  • Reconstruct transactional flows chronologically to detect circular fund routing, nested correspondent banking relationships, U-turn payment paths, and deliberate invoice manipulation (over/under-invoicing).
  • Perform Wire Stripping Analysis: Compare original payment instructions submitted by the customer against outgoing SWIFT messages transmitted through intermediary banks to detect deliberate omission of sanctioned names, addresses, or country tokens.
• Conducting Investigative Personnel Interviews:
  • Sequence interviews systematically: begin with operational and screening analysts, proceed to frontline relationship managers, and conclude with branch managers or subject employees.
  • Maintain contemporaneous, factual interview memoranda without speculative editorializing.

---

4. Evidence Preservation, Litigation Holds & Legal Privilege

Upon identifying a credible sanctions violation or receiving an external legal inquiry, the institution must immediately institute legal safeguards to preserve evidence and protect the integrity of the investigation:

+---------------------------------------------------------------------------------------+
|                        LEGAL PRESERVATION & PRIVILEGE PROTOCOLS                       |
|                                                                                       |
|  [ Investigation Inception ] ──> [ Issue Formal Litigation Hold Notice ]               |
|                                         │                                             |
|                                         ▼                                             |
|  [ IT & Operations Action ] ──> Freeze auto-deletion / preserve server backups & logs |
|                                         │                                             |
|                                         ▼                                             |
|  [ Legal Governance ] ──> Direct probe under Attorney-Client Privilege / Work-Product  |
|                                         │                                             |
|                                         ▼                                             |
|  [ Employee Interviews ] ──> Deliver Corporate Upjohn Warnings to all interviewees    |
+---------------------------------------------------------------------------------------+

Critical Legal and Operational Rules

1. The Litigation Hold (Preservation Notice):
   • A formal directive issued by Legal/Compliance to all relevant employees, business units, and IT administrators instructing them to preserve all hard-copy documents and electronically stored information (ESI).
   • IT must immediately suspend routine document destruction policies, automated email purging schedules, and backup tape overwriting. Failure to preserve data constitutes spoliation of evidence, which carries severe judicial sanctions and aggravating penalties from regulatory bodies.
2. Attorney-Client Privilege & Work-Product Doctrine:
   • Sanctions investigations should be conducted under the direct supervision of legal counsel (in-house counsel or external white-collar defense counsel) to protect investigative findings, legal analyses, and attorney notes under the Attorney-Client Privilege and the Work-Product Doctrine.
   • Exam Distinction: Pre-existing business records (e.g., commercial invoices, executed wire messages, account opening agreements) are never privileged simply because they are collected and reviewed by legal counsel. Only communications seeking/providing legal advice and documents created specifically in anticipation of litigation are protected.
3. The Upjohn Warning (Corporate Miranda Warning):
   • When corporate counsel interviews employees during an internal investigation, counsel must deliver a formal Upjohn Warning explaining that:
     • The attorney represents the corporate entity, not the individual employee;
     • The interview is covered by the company's attorney-client privilege;
     • The company possesses exclusive authority to waive the privilege and disclose interview statements to government regulators (e.g., OFAC, DOJ) without the employee's consent.

---

5. Structuring the Defensible Case Report & Chronological Timeline

The culmination of a sanctions investigation is a formal, defensible Investigation Case Report accompanied by an exhaustive Master Chronological Timeline:

+--------------------------------------------------------------------------------------------------+
|                              SANCTIONS INVESTIGATION REPORT STRUCTURE                            |
+--------------------------------------------------------------------------------------------------+
| 1. EXECUTIVE SUMMARY: Synopsis of triggers, core findings, total exposure ($), and key actors.   |
| 2. BACKGROUND & SCOPE: Timeframe, legal entities examined, products, accounts, and methodology.  |
| 3. MASTER CHRONOLOGY: Minute-by-minute / date-by-date matrix of all relevant transactions.       |
| 4. FACTUAL FINDINGS: Detailed narrative of schemes, corporate layering, and screening bypasses. |
| 5. ROOT CAUSE ANALYSIS (RCA): Identification of underlying control, system, or personnel failure.|
| 6. REGULATORY LIABILITY ASSESSMENT: Specific regulations breached (e.g., 31 CFR / EU Council).   |
| 7. CORRECTIVE ACTIONS & REMEDIATION: Policy enhancements, system retuning, personnel actions.    |
| 8. DISCLOSURE RECOMMENDATIONS: Evaluation of Voluntary Self-Disclosure (VSD) vs SAR/STR filings. |
+--------------------------------------------------------------------------------------------------+

The Master Chronological Timeline Matrix

A rigorous case report must include an itemized timeline organizing every key event chronologically:

---

6. Practical Compliance Scenarios & Exam Warnings

Scenario: The Whistleblower Tip & The Wire Stripping Scheme

A mid-level compliance officer at an international bank files a confidential internal whistleblower report alleging that a senior relationship manager in the trade finance department has been systematically modifying client wire instructions. Specifically, the relationship manager instructed customers shipping electronic equipment to Syria to remove references to Damascus and Syrian port codes from SWIFT MT103 Field 70 (Remittance Info), replacing them with generic transit codes in Dubai.

• Investigation Action Plan:
  1. Immediate Governance: Notify the General Counsel, Audit Committee, and Chief Compliance Officer. Issue a strict litigation hold to IT to preserve all emails, Bloomberg chats, and core banking audit logs of the trade finance department.
  2. Forensic Analysis: Execute a forensic comparison of the physical customer application forms against the transmitted electronic SWIFT MT103 messages. Confirm that geographical destination tokens were stripped.
  3. Employee Interviews: Conduct an Upjohn-warned interview with the relationship manager and operational staff.
  4. Regulatory Action: Compile the defensible investigation report, calculate total illicit USD clearing volume, suspend the relationship manager, freeze related credit accounts, and prepare a Voluntary Self-Disclosure (VSD) to OFAC and relevant national regulators.

Key Takeaways for the CGSS Exam:

• Investigations require a formalized Investigation Charter establishing timeframe, entity, product, and geographic scope.
• The statute of limitations for US sanctions enforcement under IEEPA/TWEA is 10 years.
• Litigation holds must be issued immediately to suspend automated document purging and prevent spoliation of evidence.
• Pre-existing business records are not protected by attorney-client privilege simply because an attorney reviews them.
• Upjohn warnings are mandatory in employee interviews to clarify that counsel represents the corporation alone.