Evidence
Examples and case studies of evidence.
As the investigation progressed, it became apparent that cash in GBP was being collected by suspects acting under the instruction of the principal suspect. Upon collection, the cash would then be deposited into various UK business bank accounts which were under the control of the suspects before being electronically transferred to the United Arab Emirates (UAE). This Modus Operandi was being repeated across other corporate entities and business accounts also controlled by the OCG.
Business accounts were exploited because the crime group believed the level of scrutiny would be higher if they used personal bank accounts. Plus, business bank accounts can mask the movement of larger values of cash. Bank statements obtained via production orders demonstrated regular cash deposits of at least £50,000 going into the bank accounts on an almost daily basis over a 12 month period. Those depositing the cash were generally the directors of the businesses associated to the criminal activity under investigation, which was confirmed through enquiries with Companies House. Most of those directors also acted as cash couriers. A cash courier is a person who transfers funds in person, be it physically across a border or into a bank account and transferred onward via wire transfer. Typically, the courier is paid for services with a small part of the money transferred, a set fee or sometimes payment in kind.
The corporate entities existed only to facilitate the money laundering activities, with the cash disguised as legitimate trading funds and accompanying paperwork fabricated to support the transactions. Evidence obtained via the UK’s financial institutions established that two of the UAE based bank accounts in receipt of the funds were in the name of one of the suspect companies. The principal suspect claimed to be both part owner and the operations manager of this company. The transaction material evidenced that the UK business bank accounts transferred £11,015,260.08 over a 3 month period to the UAE company, which was also under the direct control of the principal suspect. An additional £14,917,335.41 was identified as moving through the UK accounts. In total £25,932,595.49 was transferred to the UAE, using the fake business documents to legitimatise the movement of funds. The transaction material also identified the amount in expenses the cash couriers were receiving to deposit the cash into the bank accounts.
Coercive Powers
Part 8 of the Proceeds of Crime Act sets out different types of investigations and evidence or information gathering powers including production orders, search and seizure warrants, customer information orders, account monitoring orders and disclosure orders.
When conducting a TBML investigation it is useful to consider the application of the tools available in part 8 of POCA. Any applications made for a POCA order or warrant, must be granted by a judge, ensuring they are considered necessary, justified and proportionate to the investigation.
Noncoercive powers
Cooperation with other law enforcement partners can provide information relevant to your investigation. For example, tax or customs administration should be able to provide information on the movement of shipments and goods. However, in operation A, HMRC, the UK’s tax and customs administration, was the law enforcement department progressing the criminal case. The Joint Money Laundering Intelligence Taskforce (JMLIT) is also a mechanism to consider, drawing on private sector partners to develop the intelligence picture.
The Economic Crime and Corporate Transparency Act 2023 reforms to information sharing allow certain businesses to share information amongst themselves to prevent and detect economic crime.
Suspicious Activity Reports (SARs)
Businesses in the regulated sector are obliged to submit Suspicious Activity Reports when they suspect illicit activity is occurring. SARs might provide bank account information in addition to customer details including contact details, alias identities, investment activity, business details and other information which can lead to the instigation of a new investigation or enhance on-going operations.
Strategic analysis of SARs can help identify changes in the nature or prevalence of types of organised crime for example, TBML. This enables detection and prevention activity including the issuing of alerts to businesses and organisations at risk from such activity.
Egmont group of financial intelligence units
The Egmont group of financial intelligence units is an international organisation that facilitates cooperation and intelligence sharing between national financial intelligence units to investigate and prevent money laundering.
Information which the Egmont Group can provide includes a search of the SAR/STR11 database, and a search of property and company registers. The results provided are for intelligence purposes only. If the results are required by another country for evidential purposes, an International Letter of Request will need to be submitted.
To make an enquiry with the Egmont Group you would need to speak with your Financial Intelligence Unit (FIU) who will provide you with the necessary information to assist with your enquiry.
Camden asset recovery interagency network (CARIN)
Is an informal network of law enforcement and judicial practitioners in the field of asset tracing, freezing, seizure and confiscation. It is an interagency network. Each member state is represented by a law enforcement officer and a judicial expert.
Overseas enquiries
In respect of making enquiries overseas, in addition to enquiries with the Egmont Group and CARIN, investigators in the UK can use section 444 to 447 Proceeds of Crime Act to use part 8 powers with external investigations into property obtained via criminal conduct.
When there is an international element to a case, which there often is in TBML investigations, prosecutors might require assistance from overseas authorities to obtain evidence and information to include in a court file during judicial proceedings. In these circumstances it is recommended to contact your prosecuting authority, to look at Mutual Legal Assistance, international agreements or treaties and possibly consider using the International Customs Co-operation and Mutual Administrative Assistance Agreements, a cooperation created to help customs authorities use tools for the control of trade flows and the fight against fraud and illegal activities.
Overseas liaison officers and the UK Interpol desk are also a valuable resource for obtaining information overseas. Early engagement provides the opportunity to check what evidence is available which can be secured whilst a formal request progresses. These colleagues can also advise on the type of information to request in an application, making it more specific to your investigation. However, consideration should be given about the potential of ‘tipping off’ potential suspects in a foreign jurisdiction.
In operation A, one significant challenge experienced by the case team was the submission of the International Letter of Request via the UK Central Authorities Unit. The case team submitted the request through the CPS representative, who passed the request to the Central Authorities Unit to obtain information from the UAE. For unknown reasons this request was never submitted to the country for actioning. This resulted in the case team being unable to evidence suspicions surrounding the principal suspect and his businesses in the UAE. This also provided defence counsel with the opportunity to potentially discredit the case and the evidence produced.
When making an application for an International Letter of Request, ensure you are in frequent correspondence with your representative legal teams and the Central Authorities Unit to ensure the request has been sent to the relevant overseas jurisdiction.
Companies House
Companies House might be able to provide information on the businesses involved. Companies House can provide evidence on the incorporation of a company, payment details, IP addresses, phone numbers and email addresses. This information may provide valuable evidence if the directors have been created or names of innocent third parties hijacked and used by crime groups to provide an air of legitimacy.
The evidence will be provided with an accompanying witness statement. Evidence not available via open source will need to be requested using either a Data Protection Act 2016 request and or an Investigatory Powers Act 2016 (as amended) request.
To obtain contact details for the Law Enforcement Liaison Team within Companies House, send an email to intel@companieshouse.gov.uk. If the investigation is still covert, ensure Companies House do not take any action without your knowledge.
Case Study: operation A, evidence from Companies House
A search of the suspects’ office addresses identified paperwork that showed the formation of new UK companies. These were thought to be formed to develop the money laundering network further.
The investigation team contacted Companies House to determine evidence in respect of the companies involved in the conspiracy. Although several documents are available as open source online, in order to retrieve papers such as the accounts filed and company history, a request was made to the Companies House Liaison Officer using the gateway under the Data Protection Act. For example, the principal suspect was, at the time, a disqualified director, but evidence demonstrated his footprint in most of the companies used to facilitate money laundering. The principal suspect was thought to have adopted a ‘shadow director’ role.
He engaged ‘foot soldiers’ who provided their details without direct knowledge they’d be used to establish and ‘run’ the companies involved. Digital device evidence supported their defence they were acting under the instruction of the principal suspect. He also hijacked the details of others, initially thought to be part of the money laundering conspiracy to create companies and increase the effectiveness of the laundering scheme.
The material received from Companies House proved invaluable to the investigation, proving links between the principal suspect and the companies, while also clarifying that some individuals were the subject of identity theft and not co-conspirators. The Companies House liaison officer was also able to provide a witness statement, allowing the evidence to be produced during the trial.
Companies House incorporate and dissolve limited companies. It registers company information, including details of directors, Persons with Significant Control, and annual accounts, and make it available to the public on its website. Companies House prosecutes offences under the Companies Act 1986 and may refer more complex cases to the insolvency service for investigation. It maintains the Disqualified Directors Register and the Register of Overseas Entities, entities who want to buy, sell or transfer property or land in the UK must register with Companies House and declare who their registrable beneficial owners or managing officers are.
Companies House capabilities and powers are further expanding thanks to changes introduced in the Economic Crime and Corporate Transparency Act 2023. Over the next few years, Companies House will be making significant changes to implement and take advantage of its new powers, including new information sharing powers.
Insolvency service
During operation A, it became apparent the principal suspect had been disqualified from acting as a director, albeit he was still controlling the businesses in the background. In such situations, the insolvency service can provide support to support investigations.
The insolvency service fulfils a range of statutory functions. The official receiver administers compulsory individual and corporate insolvencies and is accountable to the court as an officer of the court. As a statutory office holder, they are responsible to a company’s creditors and contributories or the bankrupt for the administration of the estate.
The insolvency service is also able to investigate the conduct of directors of recently dissolved companies. These investigations may lead to several outcomes including the disqualification of its directors, or the disclosure of information to criminal investigators and prosecution lawyers with the insolvency service, or other prosecuting authorities and regulators.
The insolvency service maintains and enforces an effective framework for commercial activity and:
- investigates the conduct of directors of companies
- carries out confidential fact finding investigations under the Companies Act 1985 into companies where it is in the public interest
- brings disqualification cases against unfit directors
- refers suspected criminal offences to the appropriate prosecuting authority, including the insolvency service’s in house criminal investigation and prosecution teams
- regulates the private sector insolvency profession
- manages insolvency funds
- advises ministers on insolvency issues
- assesses and pays statutory entitlement to redundancy payments when an employer cannot or will not pay its employees
- provides information to the public on insolvency, redundancy and investigation matters via website, leaflets, insolvency enquiry line and redundancy payments helpline
The insolvency service has the power to conduct confidential enquiries into a company’s affairs under the provisions of the Companies Act 1985 in cases where there is reason to believe the company’s activities are being conducted in a manner contrary to the public interest. This may include serious misconduct, fraud, scams or sharp practice in the way the company operates. The insolvency service may also petition for the winding up of companies, following the aforementioned confidential enquiries, where it is in the public interest to do so.
To seek assistance of the insolvency service, contact intel.team@insolvency.gov.uk providing the company name and company registration number, director full name and date of birth and the reason for the search. A response should normally be received within 72 hours.
More information on the insolvency service’s investigation and enforcement work can be found at investigations and enforcement: what we do, our outcomes and complaints.
Systems available for interrogation
Law enforcement agencies hold a lot of data on various systems. The following list, although not exhaustive, may be useful to consider in your investigation. It is important to note that these systems are used by investigators working in the UK, however equivalent data systems will be available in other countries, accessed via Egmont, Interpol or an International Letter or Request.
Carrying out these enquiries will help build a profile of the subject(s) to assist your investigation for example, is the suspect living outside of their means, are they directors of a company, what does the company trade in and does the company have an online presence. This will help you to strategize your investigation, identifying lines of enquiry to build your case and obtain the evidence needed for any prosecution.
In operation A, the case team used data obtained from the National Border Targeting Centre, via the Border Force National Intelligence Hub, to establish travel history relating to the subjects. This resulted in obtaining valuable evidence from the flight operators to show the suspect moving between the UK and the UAE. However, it should be considered how historic the requested material is, as the flight operators might only hold this data for 5 years.
Digital forensics
Digital forensics help in the seizure of digital devices, through to the forensic capture, preservation, and analysis of data.
Digital forensic practitioners can provide an explanation of forensic results to reveal and or advise on any further opportunities. They will provide the data in an evidential format suitable for presentation in court and provide an accompanying witness statement with supporting forensic reports as required.
Digital forensics can capture and preserve data from seized digital devices both on-site and post seizure in clean laboratory facilities. This data can be reviewed dependant on the case objectives.
Case study: operation A, evidence gathering forensics
Following the arrests of those suspected to be involved in money laundering, searches of both business and residential addresses were carried out and several electronic storage devices were seized along with cash counting machines, a notepad which was found to have handwriting indentations and business documentation.
Forensic analysis and review of the electronic storage devices evidenced that the business documents found included partially completed invoice templates, in both hard copy and electronic versions, for several companies. The total values on the paperwork were completed, yet the product description read ‘product ABC’ and ‘product XYZ’, rather than soft drinks or another type of good. This appeared to be in preparation for completion, as and when the documents were required.
The suspects were using these documents and templates to construct fictitious deal chains of the sale and export of ‘soft drinks’ in addition to a variety of electronic devices ranging in value. For example, some of the invoices related to the alleged sale of Red Bull energy drinks from the UAE to the Czech Republic. Investigations demonstrated there was little difference in the cost of Red Bull in both countries and so to ship these goods from the UAE to Czech Republic made no economic sense.
There were also purchase orders for USB pen drives, which appeared to relate to the shipping of over 7,000 pen drives with the value on the paperwork showing as millions of GBP. The subject shipping these was living out of council accommodation and the address the pen drives were to be delivered to was a residential address. There were no warehousing or storage facilities, or other commercial facilities which you might expect in a commercial enterprise.
Paperwork relating to the UAE based companies included several blank invoice templates for three companies, and invoices and purchase orders which had been completed to correspond to cash deposits made into the UK bank accounts. This paperwork existed purely to try and legitimise the funds being transferred to the UAE.
Other documents found on the electronic devices evidenced that the principal suspect was a 49% shareholder for the company in Dubai. This was done deliberately to avoid being shown as the main shareholder and to conceal his identity. The named person alleged to hold 51% shares in the company did not appear to exist. The principal subject was in full control of the businesses, his name was attributable to all company paperwork and the office he frequented was found to have devices which proved to contain vital evidence for the investigation when analysed.
A forensic download of the suspects’ mobile phones identified a text message that detailed an International Bank Account Number (IBAN) for another company. This allowed the investigation to progress even further.
Included in the phone download exercise, a voice message was retrieved concerning one of the suspects telling his mum that he ‘wasn’t up to anything like drugs, just sharab’ (Arabic for liquor).
Crime Scene Investigators (CSI) were used to fingerprint the cash, fingerprint cash wrappings, swab the handles of bags for DNA and swab rubber bands for DNA. The results of this analysis provided significant trace evidence which was produced in court. CSIs also discovered a notepad with annotations. The notepad was sent away for Esda forensic analysis to determine whether the annotations were relevant to the investigation.
Crime Scene Investigation (CSI)
The use of a Crime Scene Investigator (CSI) might not always be necessary, but consideration should be given as to whether they might enhance your investigation.
The function of a CSI is to attend and examine crime scenes to recover forensic trace evidence and carry out specialist photography. A CSI can also help submit items to be forensically tested. For example, in the case study, the investigation team uplifted a notepad during a premises search. It was submitted for forensic testing and evidence of money laundering retrieved. This evidence was used during the trial.
Case study: operation A, additional evidence
Other lines of enquiry which the case team found valuable to the investigation and subsequent prosecution is listed as follows:
- when checking the documents, the case team identified geographical and typographical errors for example, in a box titled Country of Origin, the content added read ‘Prague in Slovakia’
- evidence acquired from the police relating to a 999 call. enabled the case team to attribute the telephone number used in the 999 call to the principal suspect
- the principal suspect attended a bail application, informing the court that he had to go to Dubai as he had business dealings to do — the suspect had bought company documents with him, the case team shared these documents with the financial investigator and analyst who were able to acquire additional bank statements and check the VAT status of the business, building upon the financial profile and evidence surrounding the suspect
- the UK Financial Intelligence Unit (UKFIU) were able to make enquiries via the Egmont Group to ascertain the Director details for the companies in the UAE — as a result of this information, the case team were able to pursue evidence of the director for the companies they were already aware of, in addition to new directors and potential additional suspects under investigation
- the UKFIU assisted the case team by alerting them to Suspicious Activity Reports
- the National Border Targeting Centre (NBTC) were able to ascertain travel carried out by subjects, this enquiry provided the case team with flight details, resulting in the case team approaching the flight operators with a GDPR request to obtain the travel history of the case subjects
- Automatic Number Plate Reader (ANPR), although this information was not used in evidence, it did provide a good data set for surveillance teams to target the area(s) where cash deposits were occurring nationally — as a result of the surveillance the case team were able to target their production order applications more specifically in order to acquire the activity in an evidential format
- surveillance, the case team surveyed the suspects ahead of making an intervention, during the surveillance it was apparent that the suspects were using anti surveillance techniques to avoid law enforcement — anti surveillance techniques are an example of a factor that could contribute to an irresistible inference being drawn
- witness statements were taken from the owners of the serviced offices, who provided copies of the agreements made by the crime group, one such agreement was in the name of one of the suspects who had denied having any knowledge of the office
Law enforcement agencies hold a lot of data on various systems. The following list, although not exhaustive, may be useful to consider in your investigation. It is important to note that these systems are used by investigators working in the UK, however equivalent data systems will be available in other countries, accessed via Egmont, Interpol or an International Letter or Request.
Targeting systems
| Data system name | Benefits to investigation | More information |
|---|---|---|
| Cargo Targeting System | Targets cargo manifests | World Customs Organization |
| Customs Declarations Service | Movement of goods into and out of the UK | Customs Declaration Service |
Law enforcement systems
| Data system name | Benefits to investigation | More information |
|---|---|---|
| Police National Computer (PNC) and Police National Database (PND) | Criminal Record details. Each force has their own intelligence system for interrogation | Police National Computer |
| SARs Database - UKFIU | Identifies transaction suspicious activity | UK Financial Intelligence Unit - National Crime Agency |
| Egmont Group request | Identifies transaction suspicious activity overseas | Financial Intelligence Units - Egmont Group |
| Border Force National Intelligence Hub, also known as the Home Office National Intelligence Centre | Provides advice and assistance in targeting cross border movements | Partners can reach out to HMRCs Intelligence Bureau for advice and assistance in using the Border Force National Intelligence Hub. intelligence.bureau@hmrc.gov.uk |
| JARD | Provides details of previous law enforcement money laundering interventions | Joint Asset Recovery Database |
| FAME/DASH | Company information across the UK and Ireland | Fame |
| ORBIS | Provides company information on businesses overseas | Orbis |
| Dunn and Bradstreet | Company information held overseas | Dun and Bradstreet - Accelerate Growth and Improve Business Performance |
Government departments
| Data system name | Benefits to investigation | More information |
|---|---|---|
| ADD (Department for Work and Pensions Checks) | Can provide information on pensions and benefits claimed | Research at DWP |
| Land Registry | Informs on land ownership including the price paid | Land Registry UK – Access Land Registry Title Documents Online |
| Insolvency and Bankruptcy | Trading position of directors | Investigations and enforcement: what we do, our outcomes and complaints (Insolvency Service) |
| Companies House | Determine company directors | enquiries@companieshouse.gov.uk |
| Home Office Intelligence | This department can gain access to targeting systems to target TBML | HONIC@homeoffice.gov.uk |
Credit reference agencies
| Data system name | Benefits to investigation | More information |
|---|---|---|
| Equifax UK | Provides credit scores as well as address details | Equifax UK, Credit Scores and Credit Reports |
| Experian | Provides credit scores as well as address details | Experian, Credit Report, Free Credit Score and Comparison |
| GB Connexus (GBIQ) | Provides address details | GBG Investigate (gbgplc.com) |
Open source
| Data system name | Benefits to investigation | More information |
|---|---|---|
| House Price Index | Will provide a valuation on a property. Useful to determine if the subject is living beyond their means | UK House Price Index |
| Bank Sort Code Checker | Bank account enquiry using the sort code | Sort Code Checker: Find, Identify Bank and Validate Sort Code |