EnglishPortugueseSpanish

Suspicious Transactions Detection

CONFIRMED
Financial Intelligence Unit
06.05.2019

Guidelines on the characteristics of suspicious transactions

General provisions

  1. The purpose of this guideline is to provide, pursuant to section 56 of the Money Laundering and Terrorist Financing Prevention Act, instructions for the fulfilment of the reporting obligation laid down in section 49 of the Money Laundering and Terrorist Financing Prevention Act and subsections 12 (2) and 14 (2) of the International Sanctions Act. Under the reporting obligation, reports on suspicions of money laundering and terrorist financing, unusual transactions and activities, as well as suspicions of international financial sanctions or measures taken must be submitted to the Financial Intelligence Unit (hereinafter referred to as the FIU).
  2. The obliged entity shall draw up internal rules of procedure in accordance with their own area of activity, based on the main risks of money laundering and terrorist financing in this particular area, and provide different types of reports with examples of the main types of money laundering and terrorist financing risks in this area. Fulfilment of the reporting obligation as set out in the rules of procedure of the obliged entities shall comply with the provisions of this guideline.

Definitions

  1. Money laundering is the property derived from criminal activity or a transaction or an attempted transaction with the derived property for the purpose of concealing the real origin of the property, its beneficial owner or owner.
  2. A suspicion of money laundering is any circumstance or knowledge which indicates that a transaction or activity is directed at the commission of money laundering or the concealment of criminal assets, while the application of due diligence measures has not eliminated the suspicion.
  3. Unusual financial transactions or activities are economically unusual or illogical circumstances and activities, or implausible circumstances and activities indicating possible links to money laundering or the concealment of illicit proceeds.
  4. Unusual transactions with high-risk countries are unusual circumstances or activities in transactions where at least one party to the transaction is linked to a high-risk country.
  5. Terrorist financing is providing any material support, raising funds or making resources available for a terrorist organisation, its member, or a person whose activities are aimed at committing a terrorist offense.
  6. A suspicion of terrorist financing is any circumstance or knowledge, which indicates that a transaction or activity is directed at financing terrorist offences, and it is not possible to remove suspicion by applying due diligence measures.

Fulfilment of the notification obligation

  1. Unless otherwise provided by law, no person or third party may be informed of sending a report (to the Financial Intelligence Unit) pursuant to this guideline and the rules of procedure set out on the basis of this guideline, except in the case of imposing international sanctions.
  2. If an obligation to report suspicions of money laundering or terrorist financing arises:
  • When establishing a business relationship or in case of a wish to make an occasional transaction — unless the suspicion is removed by complying with clause 11 of this guideline, you must send a report (STR 1-1.3) and must not establish a business relationship or make an occasional transaction.
  • When preparing or carrying out a transaction unless the suspicion is removed by complying with clause 11 of this guideline, you must put the transaction on hold and send a report (STR, TFR 2-2.4 with an indication URGENT). Making a transaction is prohibited. The FIU shall provide feedback on the report (with an indication URGENT) within two working days.
  • In the context of an ex post monitoring unless the suspicion is removed by complying with clause 11 of this guideline, you must send a report (STR, TFR 2-2.4) and terminate the business relationship, if it already exists.
  1. In case of suspicion of money laundering or terrorist financing, you must apply enhanced due diligence measures with the aim to remove the suspicion:
  • If the suspicion is removed, you do not need to send a report to the FIU and may continue your business relationship/occasional transaction.
  • If the suspicion of money laundering or terrorist financing is removed but the transaction or activity is unusual, you must send a report to the FIU (UTR, UAR, TFR 11.6), however, you may continue your business relationship or carrying out an occasional transaction.
  • If any suspicion remains, the transaction must not be carried out and the business relationship must not be established. You must postpone the transaction and send a report (STR, TFR 2-2.4) with an indication URGENT to the FIU.
  1. In the event of a suspicion of money laundering or terrorist financing, and notwithstanding the provisions of the guideline, a transaction may be carried out:
  • where the postponement of the transaction may cause considerable harm;
  • where it is not possible to omit the transaction; or
  • when it may impede catching potential offender involved in money laundering or terrorist financing.

In such cases the transaction will be carried out and a report (STR, TFR 2-2.4) will be submitted to the FIU thereafter (subsections 49 (6), 43 (3)).

  1. Reporting obligation in case of unusual transactions or activities:
  • When establishing a business relationship or in case of a wish to carry out an occasional transaction unless the irregularity is resolved by following clause 14 of this guideline, you must send a report (UTR, UAR, TFR 1-1.6) to the FIU, however, you may establish the business relationship or make the occasional transaction. In the event of any suspicion of money laundering or terrorist financing arising from the statements or reasons given, the general risks of the specific area of activity, or the rules of procedure of the obliged party, it is necessary to refer to clause 10 of this guideline.
  • When preparing or carrying out a transaction — unless the irregularity is resolved by following clause 14 of this guideline, you must send a report (UTR, UAR, TFR 1-1.6) to the FIU, however, you may establish the business relationship or make the occasional transaction. In the event of any suspicion of money laundering or terrorist financing arising from the statements or reasons given, the general risks of the specific area of activity, or the rules of procedure of the obliged party, it is necessary to refer to clause 10 of this guideline.
  • In the context of ex post monitoring — unless the irregularity is resolved by following clause 14 of this guideline, you must send a report (UTR, UAR, TFR 1-1.6) to the FIU, however, you may continue the business relationship. In the event of any suspicion of money laundering or terrorist financing arising from the statements or reasons given, the general risks of the specific area of activity, or the rules of procedure of the obliged party, it is necessary to refer to clause 10 of this guideline.
  1. When an unusual transaction or activity is identified, you must apply enhanced due diligence measures with the aim of eliminating the irregularity:
  • If an irregularity is eliminated — the person justifies the unusual transaction or activity with economic or other plausible explanations. There is no need to send a report to the FIU and you can carry on your business relationship/occasional transaction.
  • If an irregularity remains — the person is not able to justify the transaction or activity with economic or other plausible explanations. You must send a report (UTR, UAR, TFR 1-1.6) to the FIU, however, you can carry on your business relationship or transaction.

In the internal rules of procedure, the examples of unusual transactions and activities need to be complemented according to the field of activity of the obliged entity and the risks prevailing in that particular area. This guideline contains examples, in case of which the obliged entities should raise doubts about the unusual nature of a transaction or activity. However, the obliged entities must follow their internal rules of procedure, the profile of the customer they are in a business relationship with, or the reasons given by the person who wishes to carry out an occasional transaction. Depending on the circumstances of the case, the characteristics of unusual acts or activities may give rise to suspicions of money laundering or terrorist financing.

Types of reports

  1. For the purposes of this guideline, the reports are divided into the following categories:
  • suspicion of money laundering;
  • unusual transaction;
  • unusual activity;
  • a mandatory cash transaction report;
  • suspicion or knowledge of the need to implement an international financial sanction;
  • suspicion of terrorist financing.

Each type shall be characterised by groups of characteristics or descriptions of subcharacteristics (hereinafter referred to as groups of characteristics). The content of the groups of characteristics is described in this guideline by explanations and examples. Each report may be linked to one or more groups of characteristics. The examples fall within a non-exhaustive list that an obliged entity has to complement according to the risks in their field of activity1.

  1. In case of suspicion of money laundering, you must submit a Suspicious Transaction Report (STR). In cases of suspicion of money laundering, the obliged entity has a reasonable suspicion as to whether the means used in the transaction are or may be of criminal origin or used for criminal purposes, regardless of whether the suspicion arose solely from that transaction or from the combined effect of previous or related transactions or circumstances. In cases of suspicion of money laundering, you should apply enhanced due diligence measures to remove the suspicion of money laundering. It should be borne in mind that the application of due diligence measures must not imply to any person suspected of money laundering that the obliged entity has submitted a report to the FIU or intends to do so. In the event on suspected money laundering, you must not carry out a transaction or establish a business relationship.
  2. In case of unusual transactions, you must submit an Unusual Transaction Report (UTR). In cases of unusual transactions, the obliged entity has identified an economically unusual or illogical transaction, or the explanations given about the intended transaction are not plausible and indicate a possible connection with money laundering or the concealment of illicit proceeds. When detecting an unusual transaction, the obliged entity shall apply enhanced due diligence measures in order to obtain justification from the individual about the unusual transaction. If the explanations cannot substantiate the unusual nature of the transaction with economic or plausible explanations, you must notify the FIU of the unusual transaction but you may carry on with the transaction. If the suspicion of money laundering or terrorist financing arises in the course of applying due diligence measures, you must submit a report concerning the type of report and be guided by the explanation of that specific type of report.
  3. In case of an unusual activity, you must submit an Unusual Activity Report (UAR). In cases of an unusual activity, the obliged entity has detected repeated or ongoing unusual transactions or activities by their business partner or a person they are in a business relationship with. You have to notify the FIU of the unusual activity but may carry on with the transactions. When detecting an unusual activity, the obliged entity shall apply

                                                 

If an obliged entity identifies an indicator in his or her field of activity that is not provided for in this guideline but corresponds to the descriptions given in this guideline, he or she shall submit it to the general email address of the FIU rahapesu@politsei.ee

enhanced due diligence measures in order to obtain justification from the individual about the unusual activity. If the explanations cannot substantiate the unusual nature of the activity with economic or plausible explanations, you must notify the FIU of the unusual activity but you may carry on with your transactions or business relationship. If the suspicion of money laundering or terrorist financing arises in the course of applying due diligence measures, you must submit the corresponding report and be guided by the explanation of the type of report that has been submitted.

  1. In case a cash transaction exceeds the limit, you must submit a Cash Transaction Report (CTR). You must submit a Cash Transaction Report if a pecuniary obligation of over 32,000 euros is performed in cash, regardless of whether the transaction is made in a single payment or in several linked payments. You must report any such transaction to the FIU but may carry on with your transactions or business relationship. A credit institution notifies the Financial Intelligence Unit immediately about each transaction of over 32,000 euros made in cash where the credit institution does not have a business relationship with the person participating in the transaction.
  2. In case of a suspicion of terrorist financing or a transaction linked to a high-risk country, you must submit a Terrorist Financing Report (TFR). In cases of suspicion of terrorist financing, if the transaction directly indicates the financing of terrorism, or if there are indicators that a person has criminal ties or is involved in radicalisation, you must submit a report (TFR 2-2.4) to the FIU and must not proceed with the transaction. In case of a transaction linked to a high-risk country or in case of other unusual circumstances with regard to a high-risk country, you must submit a Terrorist Financing Report (TFR 1-1.6). You may proceed with your transaction or continue your business relationship but you must apply enhanced due diligence measures.
  3. In case of implementing an international financial sanction or in case of a need to check the corresponding suspicion, you must submit an International Sanctions Report (ISR). The obligation to notify is set out in the International Sanctions Act but the reports are submitted in accordance with the requirements set out in the Money Laundering and Terrorist Financing Prevention Act. In case of doubt as to the need to impose an international financial sanction, you must not carry out the transaction. The transaction may be carried out subject to a written approval by the FIU in accordance with the exemption provided for in the International Sanctions Act. An International Sanctions Report is the only type of report upon the submission of which the obliged entity has the right to inform the person concerned by the report.
 

 

CHARACTERISTICS OF SUSPICIOUS AND UNUSUAL TRANSACTIONS

STR or a report indicating suspected money laundering or other suspected criminal offence related to money laundering (a reasonable doubt) — it is prohibited to carry out a transaction or to establish a business relationship, except as provided for in clause 12 of this guideline.

STR INDICATORS

  1. Suspicion of money laundering arising at the time of establishing a business relationship/entering into a contract with a customer.

1.1. The person was previously known for being suspected of money laundering or the suspicion has arisen in the course of applying due diligence measures

  • It is known from the past, or it has become known in the course of examining the customer’s background while establishing a business relationship, that the person has been involved in money laundering or other criminal activities and there are other references to a negative background, which significantly increases the level of risk. In addition, it is highly probable that as a natural person, business representative or self-employed person, the future business relationship would be used for criminal purposes. For instance, it appears from publicly available sources that the person has previously displayed criminal behaviour or has been met with refusal to establish a business relationship for the same reasons.
  • The application of due diligence measures has led to a suspicion that the business relationship is being established for the purposes of engaging in criminal activity, being involved in money laundering or some other criminal offence. For instance, a newly created company is asking for unjustified and unusually high limits for carrying out transactions, and is doing business with companies from high-risk[1] countries or countries that present a higher risk [2]of money laundering.
  • Prior information received from a law enforcement authority on suspicious transactions regarding the person.

1.2. There are doubts as to the truthfulness of the data submitted by the person

  • There are grounds to believe that the person has provided falsified documents, incorrect or incomplete essential information regarding himself or the person they represent, or has concealed the actual beneficiaries of the person they represent. For example, the paper size format, the format of the date, etc. do not conform to the practices of the geographic location of the issuer of the document, the signatures of the same person are identical on different documents (stamp signature) or added by cut-and-paste technique (also possible to distort the image). The person uses external assistance to answer questions that should be simple considering their business activities and/or position.
  • The person is not acting in his own name or is acting under the control of a third party.

Representatives of a legal person are not clearly identifiable in the documentation (no personal

identification number or date of birth) or they have no right of representation. The person’s conduct is monitored or otherwise remotely controlled.

  • There is a suspicion that the person acts in the interest of someone else.
  • There is a suspicion that the person tries to establish a business relationship with an invalid authorisation or identification document.
  • The documents presented give rise to suspicion of forgery.
  • The business model the person presents is not credible or feasible and, consequently, there is doubt whether the purpose of establishing a business relationship or carrying out occasional transactions is to commit a money laundering offence or other criminal activities.

1.3. A credit or financial institution refuses to establish a business relationship or terminates a business relationship with a person in accordance with the provisions of section 42 of the Money Laundering and Terrorist Financing Prevention Act due to the impossibility to comply with due diligence measures

  • It is not possible to clearly identify the person or verify the right of representation or to check them.
  • The person refuses to provide additional data or documents requested.
  • It is not possible to identify the actual beneficiary, except in the case of apartment and building associations, public undertakings and publicly listed companies.
  • The person’s capital or the represented person’s capital comprise of bearer securities.

2. Carrying out transactions

2.1. Suspicion of money laundering in the case of cash transactions

  • An occasional transaction in which a person with whom no business relationship has been established makes a cash payment of more than EUR 10,000 to another person’s account or sends cash through a paying agency to another person’s foreign account without any plausible explanation or while attempting to remain unidentified.
  • Quick withdrawal of cash received on a large scale (large scale depends on the context, as compared to business as usual), which is not in the economic interest or in line with the normal business of the individual (for instance, offenders want to cash fraudulent proceeds immediately). It is possible that the person uses multiple bank cards at an ATM or a number of paying agencies.
  • Transaction monitoring (it is possible that an UAR was sent previously, as transactions seemed unusual) has led to suspicions that the person is providing a «cashing service» of at least EUR 100,000. In such a case, you should, where possible, stop the next disbursement or withdrawal from an ATM, compile an STR with an indication URGENT and wait for feedback from the FIU.
  • The person refuses to answer questions about the origin of the property and the purpose of the transaction.

2.2. The person was previously known for being suspected of money laundering or the suspicion has arisen in the course of applying due diligence measures

  • It is known from the past, or it has become known in the course of examining the customer’s background while establishing a business relationship, that the person has been involved in money laundering or other criminal activities and there are other references to their criminal background. In addition, the transaction in process also leads to suspicion of money laundering. For example, money that has already been suspected of being fraudulent has been transferred to the account or the received sum originates from an unusual source for the person.
  • The person, who was previously known for being suspected of a criminal offence, is selling real estate, precious movable property or securities (including business shares).
  • The application of due diligence measures has led to a suspicion of the person being a straw man and the transaction in process is an indication of money laundering.

2.3. The application of due diligence measures has led to a suspicion of money laundering with respect to the counterparty of the person engaged in a business relationship with you or the person who wishes to carry out occasional transactions

  • The counterparty of the person engaged in a business relationship with you or the person who wishes to carry out occasional transactions, is an individual known to be associated with criminal groups, or their website or other public sources indicate the provision of criminal services (for instance, opening a bank account or a payment account for the purposes of money laundering, mediation of transactions under an authorisation, making transactions, such as cash deposits on an account or to a third person, on behalf of another person) or other criminal offences (for instance, the website of the counterparty indicates trade links with North Korea or illegal arms trafficking, there is reliable information about the person having corrupt links to the government of a certain country, etc.).
  • The other party to the transaction, or their bank, is a non-resident shell bank.
  • In case of unusual transactions, due diligence measures[3] cannot be applied to the counterparty of the person engaged in a business relationship with you.
  • A real estate transaction is anonymous — lawyers carry out the transaction, the account used is the deposit account of one of the lawyers, the buyer is a non-resident legal entity.

2.4. Suspicion of money laundering regarding transactions in accounts

  • In case of an incoming payment of more than EUR 1000, the recipient’s name does not match with the name of the account holder and there is a suspicion of money laundering in relation to the transaction.
  • It is known in advance or there is reason to believe that the money in the account has been derived from a criminal offence.
  • There is doubt as to the existence of a network of accounts aimed at obscuring the origin of the property. You should suspend the next transfer to or from the account, if possible, compile an STR with an indication URGENT and wait for feedback from the FIU
  • The incoming payment was recalled due to a suspicion of crime. The report shall also be sent when the payment has been returned.
  • In case of an incoming payment of more than EUR 32,000 to a natural person and of more than EUR 100,000 to a legal person, there is no purpose of payment or the nature of the transaction is not clear from the purpose of payment, and the person does not provide sufficient explanations or documents (such as natural persons stating “money”, “transfer”, etc. as their purpose of payment and legal persons stating their purpose of payment to be “goods”, “contract”, “debt”, “invoice” or their equivalent in other widely spoken languages, without any further clear explanations, etc.).
  • Payments between legal entities are repeatedly made with the same purpose of payment, for example, referring to the same contract, which is not plausible, and the nature of the transaction is not clear from the purpose of payment, or the person does not provide sufficient explanations or documents.
  • There is a suspicion that the transaction involves the transport of strategic goods or service provision, in case of which there is no special authorisation issued by the Commission for strategic and dual-use goods. You have to submit a report even if the parties to the transaction have no connection with Estonia other than a bank account and the goods are transported in other countries. You do not need to submit a report, if the transaction concerns the purchase/sale of materials and goods from/to an authority of a Member State of the European Union.
  • The account of the person engaged in a business relationship with you bears the signs of a socalled transit account (large sums of money are received from abroad and then transferred to accounts based in foreign countries — it is possible that these sums are previously moved around within the accounts of an inner circle; purposes of payment are not plausible, they do not match the declared profile or the transactions indicate signs of money transmission). You should suspend the next transfer to or from the account, if possible, compile an STR with an indication URGENT and wait for feedback from the FIU.
  • The transactions of a company indicate the provision of financial services but the company lacks authorisation and the location where the service is provided is Estonia.
  • The service provided by an online bank, or other credit or financial institution without direct contact is used by an unauthorised person (the service is used with false identity or is abused by usernames, passwords, etc.).
  • There are signs of a money laundering scheme.

2.5. The person does not submit explanations or documents regarding the transaction to the extent necessary to perform due diligence measures or the information provided is not plausible (circumstances set out in subsections 43 (1) and (2) of the Money Laundering and Terrorist Financing Prevention Act)

  • There is a suspicion as to the transaction or the transaction is unusual enough to ask for additional information and documentation about the transaction and the origin of the property. The person refuses to provide explanations or documents, their explanations are not plausible, or there is suspicion that the documents are falsified (for example, the paper size format, the format of the date, etc. do not conform to the practices of the geographic location of the issuer of the document, the signatures of the same person are identical on different documents (stamp signature) or added by cut-and-paste technique (also possible to distort the image), the alleged events and the dates on the documents conflict, etc.)
  • The judgment of a foreign civil court or an arbitral tribunal, on the basis of which the transfers are made, is not plausible or is likely to be fictitious.

2.6. An assessment of the circumstances of a person’s transaction has led to a suspicion that the property being the object of the transaction is an object of money laundering.

  • A person suspected of being incapacitated sells their precious movable property or property at a price significantly lower than the market price.
  • The full cost of real estate is borne by an offshore[4]
  • A company whose actual beneficiaries cannot be clearly identified buys the shares of an active company to an extent, which ensures that it is controlled by that undertaking.

2.7 A suspicion that the property being the object of the transaction is an object of fraud or it is used for money laundering (transactions of a misled person).

  • Explanations of the person concerned regarding their unusual transaction refer to participation in a known fraud scheme (e.g. fake lottery, pyramid schemes, large inheritance scam, social fraud, instant return on investments, e-mail account theft, etc.).
  • The person gifts/gives up/transfers their assets to a non-profit organisation or foundation whose activities are publicly known to be fraudulent.
  • The person refuses to reimburse money being recalled due to a suspicion of a criminal offence.

UTR — Unusual Transaction Report — the transaction can be completed but it has to be reported to the FIU

UTR INDICATORS

1. In the course of concluding a customer, product or service agreement

Unusual circumstances when concluding a customer/service/product agreement that refer to a potential criminal intention or try to create a deceptive impression of the person.

1.1 It is known or it has become known during the course of applying due diligence measures that the person’s trustworthiness is questionable

  • It is known in advance that the person was suspected of being a straw man or the suspicion arises during the application of due diligence measures.
  • The legal person is registered in a jurisdiction for which the Financial Action Task Force on Money Laundering[5] has issued a statement that there are serious deficiencies in the implementation of the country’s AML/CFT measures.
  • The number of employees of a legal person is clearly economically unjustified with regard to their area of activity.
  • The person does not wish to receive correspondence sent to their home address or the address of a legal person is indicated to be a mailbox.
  • Documentation for customer identification and verification of professional or trade activities is provided by an intermediary who has no clear reason to participate in the transaction.
  • The ownership structure of the legal entity is not transparent.

1.2 The person behaves in an unusual way

  • The person’s appearance and behaviour are not consistent with the customer relationship they desire and/or the services they have requested.
  • The person uses external assistance for filling in forms or does not know how to fill them in.
  • The person does not know the nature of the activities of the person they are representing or cannot explain the need for the requested services. There are inconsistencies in their explanations.
  • The person does not know or tries to hide relevant data about the person represented (e.g. actual beneficiaries, owners, location, contact details, etc.).
  • The person is unable to describe their potential partners and/or areas of activity.
  • The person expresses an unusually keen interest in the implementation of anti-money laundering measures.
  • The person makes a proposal or attempts to avoid the application of due diligence measures.

1.3 Unusual documents submitted by a person

  • The person provides incorrect or non-existent contact details or the legal person does not have a contact phone.
  • Documents certifying a person’s right of representation are invalid.
  • The person uses a non-existent address in the documents.
  • There are inconsistencies in the documentation of the legal entity or other association.
  • The paper size or date format of the submitted documents does not conform to the standards of the location where the document was issued.

1.4 Unusual activities in ordering services/unusual contractual terms and conditions

  • The person requests for exceptionally high limits, which are incompatible with their appearance, ability and experience in the field, their expected turnover or, in the case of an undertaking, the volume of their economic activity.
  • The person orders three or more bank cards, which is incompatible with their expected turnover, the number of employees or the nature of their activity.
  • The company wishes to apply for a loan or to enter into a leasing contract for the acquisition of an asset that is not in line with their usual or planned area of activity.
  • The person wishes to designate an individual who is not professionally or personally associated with them as the user of the leased asset.
  • The actual user of the leased asset is not the person indicated to the credit or financial institution or a person related to them.
  • At the time of conclusion of the contract, the person expresses an unusually keen interest in the termination of the contract, the amount of the insurance indemnity and the probability of receiving an indemnity if the damage occurred shortly after the conclusion of the contract.
  • The person wishes to obtain life insurance for a period of less than 3 years and there are indicators other than those specified in this guideline that may indicate illegal activity.
  • A life insurance contract is concluded whereby the insurance premiums involved are disproportionate in relation to the insurance risks and other elements of the contract.
  • During the term of the insurance contract, the beneficiary is replaced with a person with no family link to the policy holder.
  • The policy holder terminates the contract without expressing any interest in the significant contractual penalties or other additional expenses it would entail.
  • The seller asks for the revenue from the sale of immovable property to be transferred into the account of a third party, unless it entails the fulfilment of the debt obligation of the seller or a person related to the seller, or the fulfilment of any other obligation referred to or agreed in the contract.
  • The person is willing to purchase or purchases real estate at a significantly higher price than the market price.
  • A notary suspects that the price of a property entered in the contract of purchase and sale is significantly different from the actual market value of the property (higher or lower).
  • Documentation for customer identification and verification of professional or trade activities is provided by an intermediary who has no clear reason to participate in the transaction.
  • A notary is requested to authenticate a transaction that has no economic rationale.
  • The person is willing to lend or invest at an interest rate that is neither profitable nor competitive.
 

The person transfers money for a notary to deposit, the transaction is cancelled, but the person asks that the assets in the deposit account be transferred to an X account.

  • The method and amount of payment are not disclosed when concluding a notarial contract.
  • At least one of the parties to the contract is suspected of being a straw man.
  • The person seeks out a lawyer or other person providing consultancy services to make a proposal that by its nature refers to money laundering.
  • The person asks a lawyer or other person providing consultancy services to introduce him/her to financial institutions.
  • The person wishes to use the account of a lawyer or other person providing legal services for the deposit or settlement of money in order to ensure their anonymity.
  • The person wishes to use services when setting up a company in order to maintain their anonymity and to conceal the origin of the funds used for the establishment and commercial activities of the company.
  • The trust or company service is requested by a foreign resident who has no ties to Estonia or comes from a country or territory with a higher risk of money laundering.
  • A company with a traditionally passive economic turnover or a newly established company provides data on abnormally high turnover or profitability with the purpose of obtaining credit for expenses not directly linked to the enterprise (e.g. a newly established company leases a luxury car).

2. Carrying out transactions

  • Unusual circumstances arise when making a transaction, indicating that the actual purpose of the transaction is not clear or someone is trying to conceal it.
  • A company threatened with bankruptcy is selling its assets with the aim of not meeting its liabilities to its creditors.
  • The person has made a significant contribution to a sports event, which is suspected of being fixed.

2.1. Unusual transaction with cash

  • Unusually high (unusualness depends on the risk-based approach and context, as compared to business as usual) cash transaction compared to ordinary turnover.
  • The purchase of financial products worth more than EUR 10,000 in cash if it does not correspond to the customer profile or has no logical explanation or the customer is unable to explain/prove the origin of the cash.
  • The person wants the largest value banknotes (worth more than EUR 200) when exchanging currency.
  • Exchange of small banknotes worth more than EUR 10,000 for larger ones.

Exchange of cash worth more than EUR 10,000 from one or more currencies to another, without reasonable justification.

  • After exchanging cash worth more than EUR 10,000, the person asks to transfer this money to another person or to an account located in another country.
  • Exchange of a large amount of damaged banknotes (worth more than EUR 10,000).
  • Placing bets or purchasing gaming chips in cash worth more than EUR 2,000.
  • Purchase of assets worth more than EUR 10,000 in cash without a clear economic justification.
  • The person makes a cash payment, the sum of which remains below the cash payment limit in order to avoid identification.

2.2. Unusual transaction in an account

  • A single, unusually high (depending on the risk-based approach and context, as compared to business as usual) payment that does not conform to ordinary turnover and is not sufficiently substantiated.
  • A transaction of more than EUR 10,000 with a person located in an offshore area carried out without economic justification.
  • Early repayment of a bank loan or lease in an unusually large amount (unusualness depends on the risk-based approach and context, as compared to business as usual) for this customer, as the payment does not conform to their ordinary turnover and is not sufficiently substantiated.
  • A legal person pays for various economically unjustified and/or unrelated consultancy services to a person registered in an offshore area.
  • The payment is made through a ‘missing trader’ or a bank established in an offshore region.
  • A person acquires, rents or leases funds for sumptuary expenses (such as luxury cars or vessels) for funds deriving from economically unjustifiable and/or cash transactions that are not related to business activities or from persons registered in an offshore area.
  • The person receives a payment in virtual currency from an account of a third person (other than a payment service provider or provider of a service of exchanging and mediating virtual currencies, whose activity involves the intermediation of such payments).
  • There are characteristics of an unusual transaction in an account other than those specified in this guideline that may indicate illegal activity.

2.3. Unusual transaction in virtual currency

  • The customer purchases virtual currencies worth more than EUR 32,000 in a single transaction.
  • A single large virtual currency purchase/sale using one or more services that make it difficult to identify the person making transactions concerning virtual currency, such as a tumbling or mixing service.

A politically exposed person (PEP) has bought or sold virtual currencies worth more than EUR 10,000.

  • In the case of a virtual currency transaction, the person uses the services of intermediaries guaranteeing/advertising the impossibility or difficulty of identifying a person (e.g. service providers who promise not to transmit personal data to law enforcement authorities).
  • Assets worth more than EUR 32,000 are purchased in virtual currency.

2.4. Unusual transactions in securities

  • The customer pays for securities in cash, in virtual currency or using an offshore area account.
  • The customer transfers, pledges or lends the purchased securities to a third party.
  • Bearer securities are involved in the transaction.
  • Transactions in securities where the payment is not received by the person who sold the securities or a person unrelated to that person and there is no logical economic or plausible explanation for it.
  • Multiple transactions are successively made in securities without a clear economic justification.
  • Unusual transactions in securities; the transaction is inconsistent with the general practice of making transactions in securities with no economic or plausible explanations.

2.5. Unusual activity during the transaction

  • The customer authorises a person unrelated to the company (suspected of being a straw man) to carry out a transaction that differs from their usual economic activity, is unusual or large-scale.
  • The customer provides obscure information about the transaction, changes their explanations, or does not know the details of the purpose of the transaction or the origin of the funds used in it.
  • The customer is in an unduly hurry to carry out the transaction.
  • The customer amends or wishes to amend the transaction following the request for additional documents or further clarification.
  • The person pays for their personal expenses by a credit and debit card of a legal person, governmental authority or an institution managed by a governmental authority, or by a card without any personal data.
  • The person informs that the funds have to be issued to a third party acting on his or her behalf and using their account.
  • The person sells back gaming chips or units of financial contribution (i.e. gaming tokens) with the intention of transferring the money to a bank account as winnings or cash out the winnings.
  • The person transfers/sells his or her tokens or winnings to another person.
  • The person tries to carry out a fictitious transaction.

After the person has played for a short time, he or she wants to convert their remaining credit back to money and requests a certificate from the operator of games to prove the money was issued to him.

2.6. Unusual transaction of immovable property

  • Property is paid for through a financial institution located in an offshore area or region where, according to reliable sources, such as peer reviews, reports or published follow-up reports, there are no effective anti-money laundering or terrorist financing prevention systems in place that are consistent with the recommendations issued by the Financial Action Task Force on Money Laundering or these systems are not being implemented.
  • A person not related to the transaction pays for the property or pays the commission.
  • The fee for the immovable property is paid to a person not related to the transaction.
  • Within a short period of time, a new transaction of the same property is made at a significantly different price from the previous transaction, unless this is attributable to a change in the overall property prices.
  • A politically exposed person (PEP) acquires property by funds that are not linked to known sources of legal assets.

UAR – Unusual Activity Report — Customer relationship may continue

UAR INDICATORS

Unusual activity is a long-term activity, where a recurrence of circumstances gives rise to suspicion, which under certain conditions may indicate a criminal offence. You can complete the act/transaction but must report it to the FIU. In the event of justified suspicion of a criminal offence, send an STR on the latest or pending transaction, suspend the transaction, if possible, and wait for feedback from the FIU.

1. Unusual behaviour of a person

  • The person opens an unreasonably high number of accounts (including virtual card accounts).
  • The person unexpectedly and unjustifiably increases their account limits to a significant extent.
  • The customer authorises unrelated parties to carry out large transactions or use a safe deposit box on his or her behalf.
  • The customer’s lifestyle and expenses do not correspond to his or her legal income.

2. Unusual cash transactions not linked to a person’s ordinary economic activity

  • A customer often makes cash deposits worth more than EUR 10,000.
 
  • A customer repeatedly makes cash transfers of more than EUR 10,000 to a foreign account.
  • A customer often makes cash transfers worth more than EUR 10,000 to another unrelated person’s account.
  • A customer, who may be involved in criminal activities, makes cash deposits worth more than EUR 10,000.
  • A customer visits their safe deposit box immediately before making cash deposits worth more than EUR 10,000 or after withdrawing cash.
  • Frequent deposits made to a customer’s account are withdrawn from an ATM abroad.
  • A customer regularly withdraws more than EUR 10,000 in cash from the company’s account, a behaviour which cannot be explained by the general business activities of this person or this area of activity.
  • The amounts paid to the account are withdrawn in instalments at various service points (ATMs, offices).
  • The customer often purchases investment gold for cash.
  • The person wishes to use a money remittance service to transfer money to many different parties.
  • Cash deposits are made to the person’s account. These are used to make loan payments, lease payments and to pay for other proprietary obligations, while ordinary activity on this account is non-existent or does not correspond to such activities.

3. Characteristics of the provision of unauthorised financial services

  • The person’s transactions indicate the provision of financial services but he or she does not have the required authorisation.
  • An unauthorised customer provides a virtual currency service, which requires an authorisation.
  • Large Initial Coin Offering (ICOs) is by definition a security (subsection 2 (1) of the Securities Market Act), but there is no authorisation.
  • Transactions in securities without the corresponding authorisation/registration.

4. Unusual transactions in virtual currencies

  • A customer buys virtual currencies for more than EUR 32,000 in several related transactions.
  • A customer sells virtual currencies worth more than EUR 32,000 in several successive transactions, while the origin of the virtual currencies is not known.
  • Regular purchase/sale of virtual currencies using the services of intermediaries guaranteeing/advertising the impossibility or difficulty of identifying a person (e.g. service providers who promise not to transmit personal data to law enforcement authorities).

Regular purchase/sale of virtual currencies using one or more services that make it difficult to identify the person making transactions concerning virtual currency, such as a tumbling or mixing service.

5. Unusual transactions in an account

  • A customer often carries out large transactions, which do not correspond to his or her legal income.
  • Several unrelated parties make payments to a single account within a short period of time followed by cash withdrawals, further transfers of the assets, or any other activities that do not correspond to the intended purpose for which the assets were collected.
  • Transactions between a natural person and a legal person are frequent and without clear justification.
  • A debit or credit card is used by a person unrelated to the holder of the card.
  • Frequent purchase or sale of cheques that is not in line with the customer profile.
  • Funds are transferred to several accounts, then grouped together and transferred abroad.
  • An inactive account receives a transfer or a series of transfers, followed by frequent cash withdrawals until the transferred funds have been withdrawn.
  • Large financial transactions carried out on a company account do not have a logical business link (for example, incoming funds for one commodity group and outgoing funds for another commodity group that are not economically logical or plausible).
  • Activities on an account are incompatible with the general practice concerning the stated business activity.
  • A legal person frequently spends on food, accommodation, transport, tourism enterprises, and hotels, which does not correspond to the ordinary economic activity of the company.
  • A person frequently carries out transactions and receives sums of money in amounts, which are narrowly below the amount leading to the application of due diligence measures or the submission of a report to the FIU.
  • A person wishes to divide the transaction into several cash transactions with the aim of not exceeding the limit amount leading to the reporting obligation.
  • Before entering into a loan or lease agreement, a typically low-income or no-income person’s account now receives a significantly higher number of receipts, which may indicate a suspicion of being a straw man.

6. Unusual transactions in securities

  • The customer often uses securities as a payment instrument to pay for goods or services.
  • The customer carries out transactions in bearer shares.
  • A politically exposed person acquires securities using funds, which are not related to known sources of legal wealth.
  • The customer directs funds received from securities transactions to an unrelated person.

7. Unusual foreign exchange transactions

  • A person regularly brings in different currencies in smaller banknotes and exchanges them into larger banknotes.
  • A non-resident exchanges large amounts of currency of the host state against euros or dollars on a number of occasions.

8. Unusual activity in gambling

  • A person systematically wins large sums.
  • A person often wishes to sell back gaming chips or units of financial contribution (i.e. gaming tokens) with the intention of transferring the money to a bank account as winnings or cash out the winnings.

9. Unusual business activities

  • References to the misappropriation of assets occur in the course of carrying out accounting services or auditing of the accounts.
  • The person often turns to various accounting service providers, either for no reason, for unclear circumstances or for the purpose of avoiding a correct and fair reporting.
  • Loans between a company and its shareholders are not in line with commercial activities.
  • Revision of reference documents reveals misstatements of business activities.
  • The company pays invoices to legal persons located in a country that does not have adequate anti-money laundering measures in place or is in offshore areas.
  • The company acquires large items of personal consumption (i.e. boats, luxury cars, residential buildings and houses), unless such transactions correspond to the ordinary business activity of the company or its particular industry.
  • The transaction involves politically exposed persons (PEP) or persons associated with them, who receive or send unusually large amounts by bank transfer or in cash.
  • The company is an obliged entity within the meaning of the Money Laundering and Terrorist Financing Prevention Act but fails to sufficiently meet the obligation to apply due diligence measures.
  • The company is an obliged entity within the meaning of the Money Laundering and Terrorist Financing Prevention Act but does not comply with the reporting obligation.

The person wishes to enter into transactions for which there is no economic justification, with the assistance of or on behalf of a lawyer.

CTR – Cash Transaction Report – involving amounts of cash exceeding the cash limit

This type of report has indicators to specify the description of the transaction. The first two indicate whether the threshold amount for the cash report was reached in a single transaction or in several related transactions. The following three specify a situation in which customs controls at the external border of the Community are required to report cash movements across the state border.

CTR INDICATORS:

1-2 for credit institutions for occasional transactions, unless they are dealing with a customer, and other obliged entities for all transactions

3-5 for the customs

  1. A cash transaction of more than EUR 32,000 in a single payment
  2. A cash transaction of more than EUR 32,000 in several related payments over a period of up to one year
  3. Cash at the border — declaration of cash worth more than EUR 10,000
  4. Cash at the border — undeclared cash worth more than EUR 10,000
  5. Cash at the border — if the criminal origin of it is known

TFR – Terrorist Financing Report for suspicions of terrorist financing

Indicators for the suspicion of terrorist financing are divided into two. Risk indicators describe situations in which the risk of terrorist financing exists but is low enough so as not to arouse a specific suspicion. You may continue carrying out transactions but by sending a report you refer to a potential risk for the competent authorities to check. Suspicion indicators already refer to a serious suspicion that the transactions constitute terrorist financing and the transaction must be postponed until the decision of a competent authority.

TFR INDICATORS

  1. Unusual transactions concerning high-risk countries A person or transaction is linked to a region with a high risk of terrorism (a high-risk country). In this case, you should select an indicator TFR 1.1-1.6 while one or more of the following indicators have to be present:
  • The execution of the transaction is supervised by an outsider.
  • Insufficient explanation regarding the origin of the money.
  • Insufficient knowledge of the counterparty.
  • The first transaction with a natural/legal person in a high-risk country.
  • Receipts are followed by systematic cash withdrawals and/or transfers.
  • A person transfers money to a high-risk country bank account to which he has not previously transferred any money.
  • One of the parties to a transfer is a credit or financial institution that has been registered in a high-risk country.
  • Receipts from a company registered in a high-risk country, a citizen of a high-risk country or a person born there, are withdrawn immediately as cash or transferred further, unless it is in accordance with the ordinary economic activity of the company.
  • The IP address of a customer’s computer indicates a high-risk country (when making payments, logging in to an account).
  • A person transfers money to an account of a non-profit association (an NGO, NPO) operating in a high-risk country or whose business is to provide assistance to high-risk countries.
  • The purpose of payment is not in accordance with the company’s economic activity or standard practice.
  • A transaction with a non-profit association operating in a high-risk country.
  • The purpose of payment of an international transaction indicates terrorist financing, cannot be understood, or translated (including references to donation or charity in Estonian or in another recognisable language).
  • The nature of international transactions refers to the collection of funds.
  • Bank cards associated with an account (an additional card) are simultaneously used in different countries.
  • Linking bank cards/accounts to international financial service platforms.
  • The purchase or sale of virtual currency in cash.
    • The natural person involved in the transaction was born in a high-risk country;
    • The natural person involved in the transaction holds the nationality of a high-risk country;
    • The natural person involved in the transaction has a place of residence in a high-risk country;
    • The natural person involved in the transaction is linked to a legal person or other association registered in a high-risk country;

1.5. The legal person or other association involved in the transaction is registered in a highrisk country;

1.6. The parent company of a legal person or other branch of an association involved in the transaction is registered in a high-risk country.

 
  1. Suspicion of terrorist financing The person collects or transfers funds or virtual currencies to a person associated with terrorist organisations or is located in areas known for terrorism.

2.1. According to public sources (the press, etc.), criminal proceedings have been initiated against the person in connection with supporting terrorism;

Criminal proceedings have been initiated against a party to the transaction under section 237 and subsections 237 (1-6) of the Penal Code.

2.2. Public sources (the press, social media user profile, website, etc.) indicate that a natural person is radicalised;

  • A competent authority has referred to a party to the transaction as a person with radical views and/or a person who supports the activities of a terrorist organisation.
  • Public sources refer to a party to the transaction as a person with radical views and/or a person who supports the activities of a terrorist organisation.

2.3. Public sources (the press, social media user profile, website, etc.) indicate that a legal person represents the views of terrorist groups;

  • A competent authority has referred to a party to the transaction as a person with radical views and/or a person who supports the activities of a terrorist organisation.
  • Public sources refer to a party to the transaction as a person with radical views and/or a person who supports the activities of a terrorist organisation.

2.4. Other circumstances refer to terrorism or terrorist financing.

  • The purpose of payment refers to the characteristics referred to under this type of report.
  • There are other circumstances referring to terrorism or terrorist financing.

ISR – International Sanctions Report – the transaction may not be completed without the permission of the FIU

The role of the indicator is to further subdivide the type of report by specifying the reason for reporting.

ISR INDICATORS:

  1. Implementation of an international sanction (the sanctioned person has been identified, the prohibition imposed by the sanction has been implemented)
  2. A person suspected of being a subject of an international sanction (natural persons, legal persons — whether you are dealing with a sanctioned person or not), if it has not been possible to determine whether you are dealing with a sanctioned person.

3. Suspicion of the need to implement international sanctions, (non-personal) sanctions

(prohibitions regarding goods, services, financing on territories, etc.)

[1] European Commission Delegated Regulation (EU) 2016/1675, see https://eur-lex.europa.eu/legal- content/EN/TXT/? aid = 1553086446597 & r = CELEX: 02016R1675-20181022

[2] A list of countries compiled by the obliged party based on their own area of activity and economic activity as a result of risk analysis.

[3]  Where an obliged entity is required to apply due diligence measures.

[4] Offshore countries (in the sense of this guideline) are third countries included in the list of countries compiled by the

                                    International    Monetary     Fund     (IMF).    “Offshore    Financial     Centers     (OCFs)    IMF    Staff                                    Assessments”. 

https://www.imf.org/extemal/NP/ofca/OFCA.aspx

[5] Opinion of the Council for the Prevention of Money Laundering: http://www.fatf-gafi.Org/countries/#high-risk