The role of forensics in anti-money laundering investigations

Forensic analysis plays a significant role in investigating money laundering and assessing its financial impact. The experience and expertise of investigators, forensic accountants, data analysts and damages specialists are crucial in applying appropriate, data-driven techniques to trace illicit funds, identify targets and estimate financial losses.

Advances in artificial intelligence (AI) and machine learning (ML) are beginning to enhance these efforts, allowing for greater efficiencies in the detection of suspicious activity. In October 2024, for example, the US Department of the Treasury (the Treasury) announced that it had leveraged AI solutions to recover over US$1 billion in check fraud in the 2024 fiscal year (FY) – close to three times the funds recovered in FY 2023.^[1]

While forensic analysis is typically applied retroactively to unravel a financial crime, forensic analysis can also help prevent illicit activities by identifying suspicious patterns early on, potentially saving companies from significant financial loss and reputational harm.

This chapter explores the role of forensics in criminal money laundering investigations, asset recovery and assessments of economic damage.

Representing companies in criminal investigations

When companies are implicated in a money laundering scheme, especially when they are unknowingly involved in processing illicit funds, a forensic review is essential to uncover irregular transactions and ascertain whether a company has sufficient anti-money laundering (AML) controls in place. Businesses with weak financial crime controls can face significant charges and penalties under the Bank Secrecy Act (BSA), which mandates that institutions report suspicious activity.

In October 2024, TD Bank announced it had paid more than US$3 billion to resolve Financial Crimes Enforcement Network (FinCEN) and US Department of Justice (DOJ) investigations relating to its BSA and AML compliance programmes, having pleaded guilty to conspiracy to commit money laundering.^[2] TD Bank also agreed to formal oversight through a monitorship, as well as other restrictions and remediation. According to Attorney General Merrick Garland, the bank’s lax practices ‘created an environment that allowed financial crime to flourish . . .[b]y making its services convenient for criminals, it became one’.^[3]

When filing charges against financial institutions for lapses in money laundering controls, it is not unusual for regulators to cite activity that has occurred over several years and encompasses billions of dollars in transactions. In the case of TD Bank, the DOJ cited ‘long-term, pervasive, and systematic deficiencies’ in its AML policies and controls over the course of nearly a decade, from January 2014 to October 2023.^[4]

Companies charged with money laundering need to understand the entirety of the activity cited by the government. Whether the allegation is negligence or conspiracy, a robust defence requires mapping transactions across jurisdictions and through correspondent accounts and reviewing these transactions while concurrently performing an analysis and remediation of the controls in place during the period in question. How transaction alerts were triggered, reviewed, escalated and resolved or reported should be meticulously documented. Similarly, the assessment of existing controls and any recommendations should be recorded.

These investigations and reviews take time – time that is often provided by deferred prosecution agreements (DPAs), settlement agreements that result from negotiations between the government and companies during criminal investigations. DPAs allow companies charged with money laundering violations to lessen potential penalties by paying fines and implementing remediation plans.

It is not just traditional financial institutions that need to implement strong AML programmes, as evidenced by the US$100 million fine imposed on cryptocurrency exchange BitMEX in January 2025.^[5] This fine came six months after the company, which is headquartered in the Seychelles but does business in the United States, pleaded guilty to violating the BSA.^[6]

Cash-intensive businesses, such as convenience stores, restaurants and launderettes, have also historically been used in the furtherance of money laundering. In these instances, fraudsters mix illicit funds with legal cash and, coupled with forged receipts, make funds appear legitimate. By reviewing inventory, payroll and customer data, forensic analysis can highlight discrepancies that will allow the company to identify and stop the fraud.

In addition to the BSA, companies with weak financial crime controls may also be in non-compliance with the International Emergency Economic Powers Act or the Trading with the Enemy Act, both of which relate to sanctions. In March 2023, for example, Wells Fargo agreed to pay a total of US$97 million for sanctions compliance failures at its predecessor, Wachovia Bank.^[7] Specifically, according to the Office of Foreign Assets Control (OFAC), the bank’s deficient oversight had enabled it to violate US sanctions by providing a trade finance platform to a foreign bank that used it to process more than US$500 million in prohibited transactions in violation of US sanctions against Iran, Syria and Sudan; however, it also reported mitigating factors that played a part in its assessment of financial penalties against Wells Fargo, including that the bank had immediately terminated the foreign bank’s access to the finance platform, voluntarily disclosed the matter to OFAC and commenced a comprehensive investigation.^[8]

While future enforcement of the Foreign Corrupt Practices Act (FCPA) in the United States is still to be determined following the Trump administration’s February 2025 announcement that it was pausing enforcement of the federal law,^[9] which makes it a crime for US companies to bribe foreign officials, authorities in individual US states and other countries can still enforce their anti-corruption statutes, including the UK Bribery Act, which applies in both public and private sectors. In addition, the statute of limitations for FCPA violations is at least five years, meaning that violations today will outlive the current administration.^[10] For these reasons, and because the priority shift at the DOJ does not extend to the Securities and Exchange Commission or the Commodity Futures Trading Commission, it is important to continue reviewing transactions in the context of the FCPA and other anti-bribery statutes.

In these instances, remedial transaction reviews remain necessary. After collecting and synthesising data, transactions can be run through filters designed to identify sanctioned parties or activity to or from sanctioned jurisdictions. In addition, investigative methods that are commonly used to detect money laundering can also identify illicit payments to government officials or that are activity designed to conceal sanctioned parties as recipients. Customer accounts should also be scrutinised, and accounts associated with suspicious activities require review, updates to risk ranking and customer profiles, and potential de-risking. These investigations require a mix of internal record review and public records research to determine the legal, reputational and regulatory profiles of customers. Once the findings of these investigations are disclosed, forensics experts may be asked to help create new policies and update deficient protocols.

AI and ML are increasingly being used to streamline these types of investigations. Firms can identify anomalous behaviours using outlier detection methods and natural language processing techniques. Specifically, AI and ML models can recognise outliers by analysing standard behaviour patterns and flagging significant deviations. Advanced analytics tools can also assist forensic analysts in mapping out complex financial networks, uncovering hidden connections between individuals and entities involved in potential money laundering schemes.

The use of these technologies is becoming more widespread: according to a study by Thomson Reuters, 45 per cent of public sector respondents believe they will see an increase in fraudulent activities over the next two years, but close to half of these respondents also believe that AI can be used to help them prevent and detect fraud and other deceptive actions.^[11]

Regardless of whether a company is directly accused of money laundering, has demonstrated insufficient compliance controls or is indirectly involved in a criminal investigation, forensic methodologies are critical in identifying historical activity and remediating current deficiencies.

Determining loss

In both criminal and civil proceedings, investigators attempt to determine the economic impact of money laundering on individual victims and, in significant cases, an entire financial system. The Treasury estimates that annual loss to fraud is in the billions, with victims including the US government, private companies and individuals.^[12] The Federal Bureau of Investigation estimated the potential loss from cyber fraud alone to have been US$10.2 billion in 2022 – a valuation than has grown exponentially since 2019.^[13]

A field of forensics known as financial forensics specialises in assessing economic damage in both criminal and civil proceedings. Financial forensics analysis is used in many types of civil lawsuits – not simply those involving fraud – such as matters alleging theft of trade secrets, anticompetitive behaviour and wrongful dismissal. In cases involving allegations of money laundering, calculating loss can be less straightforward than determining lost profits (i.e., profits that would have been achieved but for a given event) or unjust enrichment. Determining loss in money laundering cases requires an understanding of the economic harm caused by the predicate crime, as well as analysis of the economic harm caused by laundering the proceeds of the predicate crime. Findings produced by financial forensics specialists are used as a baseline for determining criminal forfeitures and civil judgments, as well as administrative penalties imposed in DPAs.

In criminal proceedings involving allegations of a predicate crime (e.g., fraud) and the subsequent laundering of those proceeds, the financial forensic analysis will focus primarily on the loss caused by the underlying crime. With a Ponzi scheme, for example, the financial forensics specialist will seek to determine the loss to each of the impacted investors. This analysis considers investments and redemptions, supported by account statements, certificates of deposit and other investment records. As Ponzi schemes typically include many inter-account transactions, detailed flow of funds analysis is key to determining the total loss to investors as well as the fair allocation of recovered assets.

Similarly, if a drug cartel is found guilty of laundering the proceeds of narcotics sales, the government will commonly seek forfeiture of all assets that can be linked to the convicted individuals, including account funds, real estate, securities or precious metals.

If a company is accused of operating an illegal money transmitting business, demonstrating lost profits or harm is less clear.^[14] In February 2025, Brink’s Global Services USA, an armoured car company and currency transporter, agreed to pay US$37 million to the DOJ and to FinCEN to settle allegations that it failed to register a money transmitting business and violated the BSA.^[15] FinCEN alleged that Brink’s failures allowed hundreds of millions of dollars to be transmitted to Mexico across the south-west US border on behalf of high-risk entities, including a Mexican currency exchanger that later pleaded guilty to violating the BSA. The consent order states that Brink’s lacked the policies, procedures and internal controls necessary to comply with the BSA, while its ‘know your customer’ (KYC) policy failed to include all transaction parties.^[16] In determining loss, FinCEN considered the remedies available for wilful violations of companies’ requirements to register as a money services business, to implement and maintain an effective AML programme and to file suspicious activity reports.

In a 2022 case, defendant Da Ying Sze was charged by federal prosecutors in New Jersey with operating an unlicensed money transmitting business and engaging in transactions derived from illicit activity. Sze was specifically accused of laundering US$653 million using various shell companies and accounts. The TD Bank investigations identified US$400 million worth of transactions that TD Bank facilitated for Sze, often in large sums of cash in bags that Sze brought into TD Bank branches.^[17]According to prosecutors, Sze received a commission of 1 to 2 per cent for his laundering services.^[18]

As part of a plea agreement, Sze was ordered to forfeit nearly US$3.9 million in seized cash, cheques and money orders, as well as a vehicle and the contents of 14 bank accounts totalling an additional US$2.2 million. In determining loss to reach a plea agreement, the government decided that the profits made by Sze from the scheme equalled the loss to be recovered in this matter.

Financial forensics is key in determining loss when financial institutions face allegations of lapses in AML compliance and violations of sanctions. In the past decade, numerous global financial institutions have paid billions in civil penalties and forfeitures for failing to maintain sufficient AML compliance controls or violating other financial crime regulations. In these matters, forensic analysis is critical in the adjudication of the penalties that should be paid.

In claims brought by the government for violations of the BSA, civil penalties are specified in US law (e.g., US Code, Title 31, Section 5321) and in guidance issued by regulatory bodies, including the Treasury and the Federal Deposit Insurance Corporation (FDIC). The FDIC’s instructions for BSA-related civil monetary penalties involve a tiered matrix that ranges from US$7,500 to US$1,375,000 per day, depending on the severity of the violations.^[19] In assessing civil penalties, forensic analysis is needed to tally instances in which an institution failed to abide by BSA reporting requirements, while also measuring the severity of the lapses and the duration in which an institution failed to maintain sufficient controls.

Similar to the forfeiture in the criminal case against Sze, civil forfeiture for violations of the BSA and other financial crime matters is also commonly based on an assessment of profits made from the illicit activity. The Treasury Executive Office for Asset Forfeiture (TEOAF) was established ‘to disrupt and dismantle criminal enterprises’.^[20] TEOAF has obtained billions in asset forfeitures that have been directed to the US Treasury Forfeiture Fund.^[21]

In its 2023 fiscal year report, TEOAF describes obtaining a more than US$2 billion asset forfeiture from Danske Bank after the bank acknowledged that it deliberately disregarded US law and its own internal controls and facilitated the laundering of criminal and other suspicious proceeds through US financial institutions.^[22] Danske Bank admitted it knew its Estonia entity’s AML programme and procedures did not meet Danske Bank’s standards and were not appropriate to meet the risks associated with its non-residents programme (NRP) customers.^[23] Danske Bank Estonia processed US$160 billion through US banks on behalf of its NRP customers.

In these situations, forensic analysis is needed to review the financial records of an institution and to identify the specific proceeds generated from the alleged activity. This process can be painstaking. A financial forensic specialist will need to separate fraud proceeds from funds originating from normal business activities to calculate a forfeiture amount. Determining loss following charges of money laundering can be complex. In many cases, there is a need to first understand the predicate crime. In others, it is the role of forensics specialists to determine the profits gained by money transmitters or global financial institutions through facilitating illicit financial activity.

Asset tracing and recovery

Once it has been confirmed that crime proceeds were funnelled through the financial system, it is crucial to track these funds and ultimately return what can be recovered to the victims. Tracing and recovering assets is a key part of forensic work, with accountants and investigators playing a vital role in finding out where the money went and how it was used.

Accountants are skilled at analysing financial statements and tracking the movement of funds. The process usually begins with reviewing bank statements and other transaction records. With access to these records, forensic accountants can track the flow and use of funds across different banks and countries: Were the funds quickly used to buy something like a mansion, artwork, a yacht or cryptocurrency? Or were they moved to another account?

In the case of an asset purchase, supporting records can be handed over to authorities to begin the recovery process. Investigators provide value by identifying details about opaque and unknown parties in the transaction records. After confirming funds have been transferred to a suspicious target account, investigators step in to gather all available information about these new parties of interest. For funds that have been sent to a company, investigators might leverage corporate records to determine whether any of the individuals linked to the alleged crime – or their family members or associates – are linked to the business. If the funds were sent to an individual, the investigator may use media research, social media analysis or even ‘boots on the ground’ investigative strategies to find connections between that person and the original criminal actor.

Once additional suspects are identified, the next step is to review relevant property and asset records. In the United States, real estate records can be accessed through county recorder offices and are sometimes compiled in public records databases. When reviewing these records, an extensive search of ownership details is essential as property assets can be hidden under the name of a relative, an associate or a shell company. If a shell company is involved, it is crucial to track down the beneficial owners behind all investments identified.

These tools and techniques have been successfully used to track how Central and South American drug cartels move money. For years, US investigators struggled to establish how the cartels managed to transport billions of dollars in cash made from selling drugs on American streets. The first clue came from an unrelated investigation into illegal gold mining in Peru.

Approximately 28 per cent of the world’s illegal gold mining happens in Peru.^[24] To sell the gold, illegal miners needed buyers who would pay only in cash: enter the drug cartels. Cash generated through drug sales in the United States – usually in bundles of small denomination bills – was being shipped to Peru. Cartel associates in Peru then used the cash to buy unrefined gold from miners deep in the Peruvian Amazon.

Forensic investigators soon realised that the cartels were buying gold with drug money. By analysing business records and talking to locals, they found that many nearby gold stores and refineries were run by cartel affiliates. These shops melted the unrefined gold into bars. Some bars were made entirely of illegal gold, while others were a mix of illegal and legal gold.

Although the cartels had converted cash into gold, they still needed to launder the gold to make it look legitimate. Investigative journalists at the Miami Herald found that a gold refinery in Miami had imported US$3.6 billion worth of illegal gold from Latin American criminal groups since January 2013.^[25] This refinery did not follow AML or KYC procedures to ensure that it was not purchasing illegally mined gold: reportedly, the refinery simply asked the sellers if the gold was legally mined without doing any further checks. Since US gold refiners bought the gold using wire transfers from legitimate bank accounts, the cartels successfully turned their drug money into what looked like legal profits from gold sales.

Once assets linked to criminal activity are found, prosecutors or lawyers can use forensic techniques to help recover them. In criminal cases, this usually means the government seizes the assets through forfeiture (e.g., when a forensic analysis shows that a luxury mansion was bought with laundered money). If bank accounts holding dirty money are identified, prosecutors can also freeze and seize those funds.

In civil cases, recovery can happen through either a court judgment or a settlement. If it is proven that an asset was bought with funds generated by illegal activity, the court can rule in favour of the plaintiff and place a judgment or lien on that asset. Sometimes, defendants may agree to pay a settlement to avoid going to trial. This allows plaintiffs to recover some of or all their stolen money while the defendants avoid admitting guilt.

Conclusion

Developing an effective AML system requires a comprehensive approach that combines various resources, skill sets and experience. By conducting thorough risk assessments and leveraging a mix of technologies, forensic techniques and expertise from forensic accountants and investigators, organisations can build a tailored system that effectively detects and mitigates AML risk, ensuring a robust, adaptive approach to safeguard against financial crime.

Acknowledgement

The authors would like to thank Emily Butler for her contributions to this chapter.

Endnotes

^[14] US Code § 1960 – Prohibition of illegal money transmitting businesses.