The Mamas and the Papas may not have had AML in mind when they sang about Mondays, but it is a troubling day for those involved in AML investigations. “Where were you on [insert date/time]” is the most routine question in detective work. Unfortunately, financial institutions have little sympathy for an investigator’s obsession with “on or about.” For investigators, alibies are not subject to the “float.” Financial institutions and a good share of fraudsters for that matter live and die by the float. AML investigators soon find out that when dealing in banking you can’t trust Monday.

Investigators follow precise calendars and synchronize watches. It was their detail oriented thought process that led them to the profession in the first place. As detail-oriented as financial institutions otherwise seem to be, their calendar is often open to interpretation. In their world Monday starts sometime Friday afternoon. During their week, the next day routinely starts the previous afternoon. The scanning, stamping and printing going on behind the counter at the bank late Friday afternoon has already fast forwarded to Monday. The documents, that include your next account statement, will reflect those transactions effectively completed Monday. Financial institutions operate on unique “business day” calendars, which do not acknowledge Saturday, Sunday and a number of holidays. That concept is taken further by effectively moving a traditional “close of business (C.O.B.)” day to as early as 2:00 pm.

AML investigators regularly use “business days” in warrant service or other legal process timelines but often fail to recognize its implications in analysis of an AML investigation. The real day and the real time criminals are practicing their nefarious deeds can matter greatly in these cases. Any analyst must think outside of the business day box.

It is no longer uncommon for a business to operate seven days a week and make daily deposits. This can include Friday evening and weekend night drops. By the time the owner goes into the financial institution on Monday, there can be two or more other deposits being credited to the account that day. Those Saturday and Sunday night drops may even be simultaneously counted by another teller while the owner is at the bank with another transaction Monday morning. That late Friday afternoon deposit may actually appear as if it was the last and not the first in a weekend series of deposits. The day count moves forward but the time stamp does not.

Subpoena compliance departments routinely only copy and reprint the documentation reflecting the business day the transaction is attributed to. That is not always the day and time a subject was physically at the financial institution. That information is not important for business purposes, but it can be crucial for investigative purposes. Investigators need to recognize that this seemingly contradictory documentation, as detail oriented as it appears, was not designed with their purpose in mind.

The only documents that even semi-accurately reflect when a customer was at a financial institution are the teller logs or journals. These are often now primarily electronic notations and not readily or easily accessed by the subpoena compliance personnel. Many teller journals or logs have unique formatting or coding that which may require bank help to decipher. “Frustration” is not an uncommon lament of investigators trying to obtain them.

There is also the issue of handling night drops, commercial deposit bags and the rise of ATM banking. Although commonly understood by tellers, many AML investigators fail to account for these elements when analyzing suspicious transactions. The bottom line is that come Monday there can be a lot of activity attributed to that day which may have nothing to do with that day. Any AML investigative analysis that does not account for the time warp in business days will be inaccurate and misleading. The most serious problem is that this leads to more non-suspicious activity being categorized as suspicious and vice versa.

Excelling in AML investigations requires that we question everything

A business making daily deposits can find that aggregated cash amounts attributed to the same day can become large enough to prompt alerts and maybe a SAR. Two or more deposits made on the same day with indications that they were too close together for a normal business practice may be a good indicator for an AML review. If you return to real time and find those transactions were spread out over the weekend, and then a review may not be necessary. Even after a SAR is filed and an investigator retrieves and reviews the back-up documents chances are the documents under review will reflect multiple same day deposits when in reality there were none. It is rare to receive the journal entries in any initial investigative request, be it SAR back-up documents or a subpoena. It also should be pointed out the deposit tickets and date stamping will reflect only a month and day. The day of the week needs to be referenced back to a calendar. Substantial investigative efforts and time can be wasted before the Monday anomaly is finally recognized.

Excelling in AML investigations requires that we question everything and learn about a lot of different elements in the financial and criminal worlds. Numbers and dollars are very ambivalent and it is only the people behind them that establish relevance. Banking transactions only become illegal when outside elements are attached to them. Although crimes like forgery, uttering and counterfeiting are transaction specific offenses, money laundering is more commonly a multiple transaction scheme with the totality of the transactions and other events required to expose the criminality. Proficiency in the investigation of money laundering requires in-depth analysis of all aspects of those transactions. Everything the subject did (and when) or didn’t do and everything the financial institution did (and when) or didn’t do is relevant until your investigation has concluded it is not.

There is more documentation of our activities collected than ever before. Our cell phones and GPS can tell us where we are or were. Tex messages and emails now memorialize conversations or thoughts that sometimes we wish could be erased. Our automobiles have “black boxes.” These can be valuable to investigators as long as they remember that much of this information was collected without them in mind. Interpreting the investigative relevance is part of the job. Financial institution records are certainly something AML investigators need to be keenly aware of.

Once an AML investigator discovers that you can’t trust Monday, they’ll appreciate the weekends more. 

Steve Gurdak, CAMS, supervisor, Washington Baltimore HIDTA, Northern Virginia Financial Initiative (NVFI) Annandale, VA, USA, sgurdak@wb.hidta.org.