Following the Flow of Funds
Ruffin, Richard, Security Management
LAW ENFORCEMENT typically reacts to illegal activity, such as the drug trade or organized crime, by arresting street-level criminals, taking them down to the station, and letting them sweat it out under the bright lights. Officers hope a long, tough grilling will force the criminal to leak the name of someone higher up in the organization.
History shows this type of investigation to be ineffective and resource consuming. To better combat crime, law enforcement must change its view and see crime for what it is--a business. A business that is engaged in illegal activity to make a profit. Working from this perspective, the investigator has a new tool. He or she can follow the flow of funds generated by financial events surrounding the criminal activity.
Financial investigations identify and document specific events involving the movement of money during the course of a financial crime. These events are considered to be interrelated, a part of the offense, and attributable to the suspect under investigation. Through a financial investigation, these events are identified and linked together. They serve as the basis of proof that a crime was committed, or they support the determination to stop further inquiry.
Financial investigations by their very nature are record intensive. Bank account information, motor vehicle registrations, and real estate files are documents or records commonly used by the investigator in this type of investigation. Records such as utility bills, divorce decrees, and credit card carbons also can play important roles in financial investigations. Any record that pertains to or shows a trail of events is important to the financial investigator.
The process of identifying and documenting a financial transaction requires the ability to locate records created by an activity; follow its trail through the banking system; analyze and account for the impact of the transaction within a bookkeeping system; summarize interrelationships between it and other financial transactions; and report the findings in order to prove or dispel the criminal allegations.
Sources. Where to look and what to look for are two integral questions facing every investigator. An effective investigator constructs an investigative work plan that establishes retrieval priorities for gathering information and, once implemented, adjusts to the incoming data. The first step is to know what type of information is out there.
Anything or anyone can be a source of information. Although it is impossible for a person to know everything or everyone, it is possible to know where to look or who to ask. Arguably, the best source of information is the target of the investigation. The suspect has all the answers to every question and the documents to support those answers.
Since the target of the investigation usually represents the best source of information, it is only a question of when, not if, to make contact. The timing of the contact depends on the type and complexity of issues surrounding the case. Like people, no two financial investigations are alike, but if this best source of information is known, sooner or later, he or she must be contacted.
If the target is unknown or refuses to talk or provide records, the search for financial facts must be conducted through other sources of information. Unlike investigations into crimes of passion, such as murder, where the only people directly involved in the crime are the criminal and the victim, every transaction that makes up a financial crime creates "eyewitnesses." Knowing where to find these witnesses and what information they possess is the second step in a successful investigation.
Public records. Public law and local regulations require that records and documents of certain financial transactions be subject to review by anyone who wishes to inquire. Such records are known as public records. A tremendous amount of financial information is obtainable from public records. The secret is knowing where to look. For the investigator, public records of note include the following:
* Real estate records. Records of property transfers are normally kept in the county where the real estate is located. The names of the landowners are shown on deeds and title certificates. Real estate tax files indicate who paid the property's taxes and where the bill for the taxes was sent.
* Corporate records. All corporations must file documents in the state in which the incorporation occurred. If the incorporation occurred in one state but business is conducted in another state, the corporation will normally have to file documents as a "foreign corporation" in the state where the business is conducted. Information required from corporations varies by jurisdiction. Usually, however, it includes the articles of incorporation, annual reports of franchise taxes, and corporate bylaws. These documents contain the name of the incorporator, the registered agent in the state of incorporation, and the initial board of directors. In certain states, financial statements and the operating corporate officers' names are a part of the public record.
* Assumed name indexes. When persons or companies conduct business in a name other than their own they must register their "assumed or fictitious name with local authorities." Although primarily used for legitimate purposes, an assumed name can hide the true nature of the business or the principals involved therein.
* Uniform Commercial Code (UCC) filings. Filings under the UCC are made at the state or county level. UCC records contain information regarding mortgages on personal property that is not real estate. The UCC filings normally record loans made to individuals or businesses for equipment, furniture, and automobiles.
* Court records. Transcripts and legal decisions in criminal and civil lawsuits are maintained at the clerk of the court's office. Separate clerks serve the federal, state, and local court systems. Information relating to divorce decrees, bankruptcy petitions, insurance and property settlements, and criminal sanctions are often filled with useful financial information.
* Other public records. The following records are maintained as a matter of public record by state, county, and municipal governments. (No nationwide uniformity exists for retrieval, however): mortgages and releases; judgments, garnishments, and other liens; conditional sales contracts; birth, death, marriage, and divorce records; change of name; auto licensing, transfers, or sales; driver's licenses; occupancy and building privilege licenses; and building and other types of permits.
Bank records. Bankers can be the financial investigator's best friends. Financial institutions are, in financial investigative terms, where the action is. Banks, savings and loans, credit unions, and currency exchanges are established for the purpose of monitoring the movement of money. Financial institutions and their records, hereafter called bank records, are the most important source of financial information available to the investigator.
These records are subject to privacy issues. The security manager of the bank is allowed access to records of his or her bank, as is a law enforcement professional with a subpoena. The records, however, cannot be shared with outside private investigators unless the target has granted permission.
An understanding of the inner workings of the banking system is necessary for the financial investigator. Tracking the movement of money generated through criminal activity usually involves tracing financial transactions through the banking system. This search is for the ultimate source or ultimate disposition of funds. Bank account analysis frequently reveals previously unknown information, financial documents, and new suspects.
Any financial institution's banking system can be divided into two types of transactions: account transactions and nonaccount transactions. Account transactions are financial events that directly affect the movement of money through a bank account by means of deposits to an account or withdrawals from an account. The system maintains a record of this type of activity through the use of the following documents:
* Signature cards. Signature cards provide personal background information relative to the holder of the account and offer an exemplar of the account holder's signature.
* Bank statements. Bank statements reflect the movement of money through the individual's or business's bank accounts for a certain point in time. During analysis, suspicious situations would be shown through patterns of activity, such as unusually high monthly balances in comparison to known sources of income; unusually large deposits, deposits in round numbers, or in repeated amounts that are not attributable to legitimate sources of income; the timing of deposits, particularly when dates of illegal payments are known; checks written in unusually large amounts in relation to known practices; or lack of account activity, which indicates the existence of unknown bank accounts.
* Deposit tickets and items of deposit. Deposit tickets, the records of deposits into an account, do not, in and of themselves, provide enough detail of a financial transaction. For analysis, a record of the currency, checks, and other items that comprise the deposit shown on the bank statement are needed. These are called items of deposit and are retrievable by the investigator. Armed with this information, the investigator can identify the sources of funds available to the account holder. Banks maintain, usually on microfilm, copies of all items making up the deposits into an account, with the exception of currency. Banks rarely photocopy currency.
Equally important to the investigator is the method of deposit. Bank tellers may recall and security photos may show the financial event in question. Often in the early stages of a financial investigation, information is sketchy and denials are frequent. During these investigative times, the books and records usually reveal nothing out of the ordinary and bank statements often seem disjointed and inconclusive. Through deposit analysis, however, the investigator often finds a photograph of the person who "didn't even know the guy" depositing currency into the "guy's" savings account.
The normal method of withdrawal of funds from a bank is through the issuance of a check. The face of a check shows the bank of origin; the date; the amount of the check; the name of the entity to whom the check was made payable; and the authorized signature of the owner of the account on which the check is drawn.
Any check withdrawal, if unobtainable directly from the account holder, can be obtained from the bank of origin through its internal retrieval system. Visual analysis of a canceled check should establish the payee, and it may also indicate the purpose of the check. If necessary, a check can be traced through the clearing process in the same manner as any item of deposit. Through the use of the bank's "proof system" and the American Bankers Association's transit codes, the movement of a check can be determined. The identity of other accounts held by the suspect and other individuals involved in crimes can also be determined.
Checks negotiated between people or businesses establish strong financial links that cannot be overcome by verbal denials. Checks can identify other bank accounts or credit cards, the purchase or location of major assets, and loan transactions. For example, a $25 check for a utility hook-up may identify a $255,000 hidden condominium.
* Credit and debit memorandums. Any transaction that affects an account but does not involve a deposit ticket or check withdrawal requires special handling by the financial institution. A record of these unusual transactions is listed on the customer's bank statement. These entries show movement of money through the account that takes place outside the normal transaction points of entries or withdrawals through check issuance.
A credit memo (CM) indicates an increase in the account funds or a flow of money into the account. A debit memo (DM) indicates a decrease in account funds or flow of money out of the account. Examples of transactions involving memorandum entries include transfers between accounts; loan payments; interest earned; and wire transfers.
The other side of a financial institution's record-keeping system is nonaccount transactions or records of financial events that do not flow through an account. Examples of nonaccount transactions include loans; negotiation of bank checks, cashiers checks, money orders or traveller's checks; and certain currency transactions. Wire transfers, transacting entries into safe-deposit boxes, and the purchase or sale of securities handled through a banking institution should also be considered nonaccount transactions.
The requestor's application for a loan creates a paper trail that often offers important financial information. Beyond the routinely required financial statement and identification of collateral sources, the loan repayment schedule and object of the loan itself are valuable pieces of information.
Entries into safe-deposit boxes are recorded in a log by the financial institution. Entry dates may be commensurate with known dates of illegal activity and act as a corroborative piece of information to the financial investigator.
Transaction entry points, either through teller memories or security photos, may further clarify the picture of currency transactions by the suspect. Additionally, legislation at the federal level requires financial institutions to report currency transactions when the amount exceeds $10,000. This record, filed with the IRS via Form 4789, Currency Transaction Report, maintains a historical record of financial events involving the movement of money through a financial institution.
Financial institutions are required to maintain customer records relating to both account and nonaccount transactions for a period of at least two years and, in some cases, a maximum of five years. This historical record offers an opportunity for the investigator to reconstruct financial events over an extended period of time.
Tracing financial records through financial institutions is more than a mere paper chase. Whether as a check, a wire transfer, a deposit, or safe-deposit box entry, the movement of money and the paper trail that it leaves behind is, for the financial investigator, a road map of events leading to the truth.
Tracing. Proof of a financial crime is established through documentation of the target's receipt or disposition of the proceeds of an identified illegal activity. This proof can be either direct or circumstantial. It must be documented so it is admissible as evidence in a criminal trial or strong enough to support internal personnel decisions.
Direct methods. Direct proof is accomplished when the investigative findings reveal that the target of the investigation has been directly on the receiving or paying end of specific financial transactions. This type of analysis is known as the specific-item method of tracing funds.
This method of tracing funds is the standard and most commonly used technique. If possible to use, it is the preferred method of proving financial criminal activity because it is the easiest to present to reviewing officials or at trial and the most difficult for the defendant to refute.
Whether an investigator chooses to trace funds from the point of payment or the point of receipt will depend on the circumstances of the investigation. Financial transactions that may be impossible to find from the payor's end due to the size and complexity of the business organization involved may be relatively easy to identify among the recipient's accounts. Normally, the investigator chooses the method that appears to be most manageable.
Fraudulent business activity often relies on the establishment of fictitious payables or fraudulent entries in the bookkeeping system. Detection of this type of activity can be best accomplished by tracing the movement of money through bank account information. The investigator should look for the following:
* Payments by check or other types of account withdrawals (DMs) made payable or charged to the account from which the illicit payments are suspected. For example, if it is suspected that kick-backs were paid on sales to the XYZ company, the search would begin with checks made payable to XYZ and analysis of those checks through the bookkeeping system (backup documentation relating to shipments, deliveries, and invoicing).
* Payments by check for services rendered. For example, sales commissions or consulting fees do not require the delivery of goods and create relatively little documentation other than the check itself.
* Anomalous charges or expenses for the business. Out of the ordinary financial transactions relating to unusual services, such as check payments to vendors that are not within the scope of business activity or payments to suppliers outside the usual geographical area, are suspect.
Quite often following the flow of funds from the point of payment revolves around reviewing canceled checks. In these situations analysis should center on the following:
* The endorsement of the check. This may be a signature or, more commonly, an endorsement stamp in the name of the business payee. The identity of the endorser frequently is the corrupt recipient.
* The location where the check was negotiated. When the endorsement is not obvious, the identity of the bank at which the deposit was made becomes important. The depository bank's stamp will appear on the back of the check as a part of the proof symbols. Through these routing symbols the geographical location of the depository bank can be identified and the locale of the suspected recipient can be determined.
* Checks with a second endorsement. A check payable to an individual or business that is endorsed by that entity and then endorsed again by another entity should be considered suspicious. Additionally, a check payable to a third party that is endorsed by that party and subsequently returned to the issuer of the check should raise the investigator's interest.
* Checks payable to a business that are cashed out. Normal business practice calls for the deposit of checks. Usually, a "For Deposit Only" stamp appears on the back of deposited checks. When checks are cashed out (not deposited) suspicions should arise.
* Checks that fall into unexplained patterns. Unusual or unexplained patterns of check transactions can be indicators of illegal activity. For instance, the discovery of a pattern of checks, such as one per month, written to a customer and equaling 10 percent of the monthly sales made to that particular customer should be a red flag.
If examination of the canceled checks does not yield any clear and convincing patterns relating to the illegal movement of money from the point of payment, the next investigative step would be to compare these records of payment to the backup documentation in the bookkeeping system of the business or individual at issue. Particularly close attention should be given to the following situations:
* The absence of documentation to support a particular payment. For example, if no invoice is on file for payments to a supplier or no receipt indicates that the materials paid for were actually delivered and received, the situation is suspect.
* Discrepancies between the payment information and the backup documentation. A check made payable to a supplier in a different amount from the invoice or a check that is made payable to a person or business that is different from the person or business identified on the invoice itself are both suspicious.
* Unusual entries in the backup documentation. Some examples include invoices from several suppliers prepared in different names but having the same business address; invoices that are signed by the same person; or invoices that are returned to a post office box.
* Unnumbered or sequentially unusual invoices. Unnumbered invoices are suspicious. Also, situations where invoices are issued out of sequence or appear to be issued irregularly should be considered suspect.
* Alterations or photocopies of backup documentation. Copies may be made in order to conceal alterations made on the originals.
Once the suspect payment has been isolated, the tracing process begins. Historically, the specific-item method of tracing the flow of funds has been used to analyze financial events relating to suspected criminal activity. Beyond fictitious-payable or fraudulent-entry schemes this method of proof can be used to analyze the movement of money inside a business in situations that may be categorized as "ghost-employee schemes," overbilling, or double-billing schemes.
When searching for fraud, the investigator should be inquisitive and challenge situations that appear to be out of the ordinary or out of sequence. If sales are rising, the cost of outbound freight should be rising. If purchases are increasing, the cost of inbound freight should be increasing. In every business, an analytical relationship should exist; therefore, examining financial statement data to see if it makes sense with respect to nonfinancial statement data is one of the best ways to detect fraud. Investigators should ask themselves whether reported amounts are too small, too early, too often, or too rare. They should also look for items that are reported at odd times, by odd people, or through odd procedures.
Indirect methods. Indirect methods of tracing funds are circumstantial methods of proof based on a simple and almost invariably true principle--money, in any significant amount, will eventually show up directly or indirectly in the accounts, assets, or expenditures of the recipient. These techniques are most useful when the suspect is taking currency or other payments that cannot be directly traced to a source. Additionally, the indirect methods of tracing funds can corroborate testimony alleging hidden illicit payments and provide the investigator with the evidence of a financial crime as well as leads.
The direct method of tracing the flow of funds relies on a microscopic view of the movement of financial transactions through books, records, or bank accounts. Without the benefit or ability to directly trace transactions, the investigator must prepare an overview of the financial condition of the target, essentially a financial profile of the subject under investigation.
A profile is established by taking the investigative steps necessary to prepare a financial picture, a detailed financial statement, of what the target owes, owns, earns, and spends at a given point or over a given period of time. Such a financial profile may uncover direct proof of illegal income or hidden assets or circumstantially show that the suspect's expenditures exceed his or her known sources of funds for a given amount of time.
The financial profile is designed to establish a detailed financial statement relating to the target of the investigation. It is based on an analysis of gathered financial records--those obtained from the suspect, public sources, and banks. When completed, it identifies the assets, liabilities, expenses, and expenditures of the suspect during a given period of time. It also details the identified sources and applications of the funds used to make the purchases or to pay for the expenditures.
The financial profile is developed in a four-step process. The first step is to identify all significant assets held by the suspect. The second step is to identify all significant financial liabilities.
Step three is to identify all sources of funds available to the suspect during the relevant time frame. Typical sources of funds include salary, commissions, rental income, dividends, interest, insurance settlements, inheritances, and gifts. The fourth step is to identify all significant expenditures incurred during the relevant period. Expenditures are not included in liabilities unless money is still owed on them at the end of the relevant period. Some examples of expenditures include food, insurance payments, credit card payments, and health care costs.
Important to the completion of the financial profile is a thorough interview with the suspect; however, significant amounts of information can be gathered through third-party sources, such as public information sources, financial institutions, and employer records. Armed with a financial profile, the investigator is ready to trace the flow of funds from the point of receipt using indirect methods of financial analysis.
One such indirect method of tracing the flow of funds is a comparative net-worth analysis. Through identification of a suspect's assets, liabilities, income, and expenses, a net-worth statement--the difference between a person's assets and liabilities at a given point in time--can be determined. Once completed, changes in the suspect's net worth can be compared to his or her known funds available, and increases, if any, can be inferred as coming from unknown or illegal sources.
The formula for computing funds from unknown or illegal sources using the comparative net-worth analysis is as follows:
* Assets less liabilities equals net worth
* Net worth less prior year's net worth plus known expenses equals total net worth increase
* Total net worth in crease less funds from known sources equals funds from unknown sources. The basic component in computing net worth is the establishment of a starting point--the base year. Generally, for investigative purposes, the base year is the year before the illegal activity began. The base year becomes the point of reference for comparison to the subsequent year's net-worth changes.
Net-worth analysis is a valuable tool in the financial investigator's tool box. It draws financial events together to show the results of financial activity during the course of criminal violations. It can be used during the course of an ongoing financial crime to show the participation of the alleged suspect through, for example, an unexplained accumulation of wealth or unusually high-priced expenditures, or it can be historically superimposed to create a financial legacy of criminal activity. It is a court-tested benchmark operation that can be used to link the suspect to the crime by and through financial analysis. The following scenario depicts the process in action.
The suspect, Jim Dealer, is being investigated for allegedly stealing computer parts from his employer and re-selling them for a profit. The alleged employee thefts occurred during 1991 and 1992. This means that the investigator must develop financial profiles for the years 1990, 1991, and 1992. The profile information is described as follows and is calculated into the net-worth computation.
* Dealer stated that as of December 31, 1990, he had $1,000 cash on hand. (Cash on hand is currency in the possession of the suspect, for example, around the house, in his or her pocket, or in a safe.) He further stated that he had no cash on hand at the end of both 1991 and 1992.
* On December 31, 1990, Dealer's bank account reflected a balance of $1,500. On December 31, 1991, it contained $4,750, and on December 31, 1992, it contained $5,225. The account earned $250 in interest in 1991 and $475 in 1992.
* As of December 31, 1990, Dealer owned $1,000 worth of jewelry. In 1991, he purchased jewelry worth $5,000, and in 1992, he bought $6,000 more.
* Sometime in 1990, Dealer purchased a boat costing $17,500. He still owned the boat as of December 31, 1992.
* During 1992, Dealer purchased an $18,250 car for which he paid cash.
* Dealer purchased a $150,000 residence on January 1, 1991. He made a cash down payment of $50,000 and financed the balance, interest free.
* As of December, 31, 1990, Dealer owed $275, interest free, to a finance company. He made no payments on this note during 1991 or 1992.
* Dealer borrowed $3,000, interest free, from a loan company on June 30, 1991. Beginning July 1, 1992, he made monthly payments of $100.
* Beginning January 1, 1991, Dealer made monthly payments of $500 per month on his residence. He made eleven similar payments in 1991 and twelve similar payments in 1992.
* Dealer paid $1,460 on his credit cards in 1991 and $3,000 in 1992.
* Dealer was able provide records of personal living expenses in addition to those listed above. In 1991, these expenses totaled $11,000, and in 1992, they were $10,000.
* Dealer earned $25,200 from his job in 1991 and $22,200 in 1992.
A cursory review of the investigative net-worth analysis shows that between 1990 and 1992, Dealer's assets increased significantly. In 1991, he was able to purchase a $150,000 house (with a $50,000 down payment) and $5,000 worth of jewelry. Also, his bank account balance increased by $3,250. Yet his income was only $25,450 (salary plus interest). If the information the investigator obtained while completing the financial profile is complete and accurate, it seems obvious that Dealer has some other source or sources of funds.
The key to a successful net-worth analysis is reliable base year, or opening net worth, information. The starting point must include all assets, which are always valued at cost, and liabilities of the suspect at that point in time. If assets or liabilities are uncovered at a later date, it will cast doubt on the entire analysis and recalculation will be required.
There exists an inverse relationship between one year and the next in a net-worth analysis. For example, an understatement of the net worth in one year will result in an overstatement of the increase in the net worth for the subsequent year. Conversely, an over-statement of the net worth in a year results in an understatement of the increase of net worth for the subsequent year. Therefore, estimates of any values or any items on the net worth, if used, should be low or eliminated entirely. Any doubts as to entries in the analysis should be resolved in favor of the suspect. Assuming that the net worth will still show substantial unexplained funds, the result will be an even more convincing demonstration of the dependence on illegal sources.
The successful criminal investigator is a renaissance person who draws on different aspects from many professions to coalesce information in ways, shapes, and forms never imagined by his or her predecessors. Criminal investigators need to be part cop, part investigator, part accountant, part sociologist, part computer operator, and part attorney in order to combat and resolve the major crimes of today and detect the crimes of the future. The ability to understand this interdependence between financial events and criminal activity is the essence of a successful financial investigator.
Richard A. Ruffin is a special agent with the Internal Revenue Service's Criminal Investigation Division. He is also an adjunct professor in the Criminology and Law Studies Department at Marquette University.…
Questia, a part of Gale, Cengage Learning. www.questia.com
Publication information: Article title: Following the Flow of Funds. Contributors: Ruffin, Richard - Author. Magazine title: Security Management. Volume: 38. Issue: 7 Publication date: July 1994. Page number: 46+. © 1999 American Society for Industrial Security. COPYRIGHT 1994 Gale Group.
This material is protected by copyright and, with the exception of fair use, may not be further copied, distributed or transmitted in any form or by any means.