Blog: 12.09.22

The missing link: link analysis in financial crime investigations

When investigating financial crimes, anti-money laundering (AML) investigators generally spend the majority of their time looking at accounts and transactions. If they identify suspicious activity, they will then file a suspicious activity report (SAR).

However, accounts and transactions alone are only part of the picture. For this reason, allocating too many resources to accounts and transactions is rarely the optimal approach. In fact, it can lead investigators to follow false leads, waste time, and draw inaccurate conclusions.

The threshold for filing a SAR is, as the name suggests, simply reasonable suspicion of wrongdoing, not proof beyond reasonable doubt. This “reasonable suspicion” is usually determined by the context of an action, rather than the action as a stand-alone event. This implies that successful AML teams need to look at context as part of their investigations.

This concept can be mirrored in more traditional criminal investigations. For example, a young man walking down a street holding an envelope full of cash should not qualify as a suspicious event in and of itself. However, if investigators knew the man received the envelope from a drug dealer and was heading in the direction of a supplier, the event becomes highly suspicious. In this example, the association of the individuals is what makes the event suspicious.

This example illustrates the importance of link analysis in investigations. And the more complex an investigation, the more important link analysis becomes to make sense of the plethora of data. If the links can be identified and visualized more reliably, then disparate teams involved in the investigation can collaborate effectively and reach accurate conclusions more easily.

Link analysis methods such as using link charts and social network analysis are not new to criminal investigations, but AML teams have been slow to adopt these powerful tools.

But what are the benefits of link charts in financial investigations?

Record keeping is key

AML investigations are complex and very often lead analysts down a rabbit hole and into networks of figurative analytical tunnels. As analysts and investigators work multiple cases a week, they may encounter difficulties when auditors require an explanation of an investigative decision made several months ago. Sometimes, analysts may even need to decipher the decisions of former co-workers that are no longer with the team or the organization.

While link charts are not the only tool available in the field, they can serve as a powerful analytical and record-keeping tool. A well-designed link chart can clearly demonstrate which individuals and legal entities were examined as part of an investigation, as well as at what point these entities came to the attention of the investigative team.

Good link charts are not merely a two-dimensional tool, as they can also contain the data’s attributes and the analyst’s notes. By examining a link chart, it is easier to understand how a connection between two individuals was established, or why a potential lead proved a dead end. In contrast, traditional record keeping often involves looking up old cases. This can be extremely time consuming, requiring investigators to painstakingly recreate the initial analyst’s process in order to understand why a decision was made. Using link charts as a record-keeping tool, investigators simply need to examine the specific relationships that are of relevance.

Geography matters

Another overlooked advantage of link charts is that, with the help of appropriate software, crucial information can easily be transferred from a link chart to a map. While financial crime occurs through the use of bank accounts and wire transfers, the people behind it exist in locations, and knowing these locations adds context to the activities.

One of the biggest red flags for money laundering is the setting-up of bank accounts in a separate location from a launderer’s residence and place of business. Understanding the domicile network of, for example, multiple individuals connected to a single shell company in the Caribbean, may be essential to establishing reasonable suspicion.

In the fast-paced world of financial crime compliance, it is extremely time consuming to create a map showing the locations of all relevant individuals/entities. With the lack of professional-level tools, some analysts are forced to use publicly available tools such as Google Maps, or even to not use any mapping tool at all. But with the right tool, the transition from a conceptual link chart to a map showing the geographic reality of the investigations can be seamless.

Globalization affects illicit markets just as it affects traditional supply chains, and money laundering is increasingly becoming a transnational, global business. For example, Mexican drug trafficking organizations (commonly referred to as drug cartels) have shifted some of their money laundering efforts to China. Financial institutions can no longer think of financial crime investigation as a local endeavor. Now, even at the local branch level, they may be exposed to a criminal network managed from Mexico, operating in the US, and sending funds to and from China.

Writing far-reaching SARs

In financial institutions, the investigation ends in a SAR. But the hope is always that investigations will ultimately lead to real results. If a SAR ends up being sidelined, and never used in an actual investigation, it will inevitably fail to lead to action from law enforcement agencies.

While financial institutions are slow to adopt link charts, they have been a powerful tool in the hands of law enforcement and intelligence agencies for decades. An article from 1975, archived by the U.S. Department of Justice, demonstrates this, stating: “Subsequent field applications of link analysis by law enforcement officers confirmed the utility and potential value of the procedure.”

In the decades following that article, criminal networks have become vastly more complex and global. To address this, and particularly following 9/11 and the subsequent effort to tackle terrorist financing, the use of link analysis became even more prevalent, and yielded excellent results.

In modern investigations, attaching a link chart to a SAR can provide law-enforcement investigators with a clearer understanding of the criminal scheme. Not only can it make the SAR easier to understand by a police officer, but it can also help to establish the foundations of the investigation and be a deciding factor in its success.

Pairing a SAR with a link chart can also increase the chances of the regulators viewing the financial institution favorably. High-quality link charts are, therefore, a simple and easily integratable way of meeting compliance thresholds.

Currently, investigators of financial crimes very rarely attach link charts to SARs as supporting documents, despite the fact that they are commonly used by law enforcement agencies, intelligence organizations, and national financial intelligence units. But, financial institutions stand to gain a great deal by adopting link analysis tools. Firstly, such adoption will make their SARs more effective. Secondly, it will work to convince regulators that AML teams are truly committed to disrupting financial crime by providing high-quality materials to law enforcement.

The solution: simplified link analysis, with Falkor

The importance of good link analysis in financial investigations is difficult to overstate, but it can be a significant challenge to present data in a way that is conducive to the investigation process.

With intuitive data visualizations demonstrating links between people, accounts, and events, Falkor can help investigators make sense of masses of seemingly unconnected data.

Used by law enforcement agencies, governments, and a wide range of private businesses globally, Falkor has the power to transform the workflows and outcomes of your financial investigations.