The Role of Forensics

This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

The role of forensics in investigating money laundering allegations and assessing the effects of financial crime is significant. By using methodical techniques and analytics to develop fact-based evidence, skilled professionals are able to follow the flow of illicit funds, assess damages, and trace and recover stolen assets. These professionals include forensic accountants, who employ accounting and auditing methods to analyse financial records; damages experts, who measure the financial harm caused by the concealment of illicit funds and criminal activity; and forensic investigators, who comb through public and internal records to establish the facts in each case.

Although forensic techniques are typically used retroactively – after red flags of financial crime have been discovered and even after charges have been brought — findings from forensic reviews can be leveraged proactively to prevent further proceeds of illicit activity from entering and flowing through the financial system. In this chapter, we discuss the role of forensics in representing companies in criminal investigations, determining loss from money laundering, and the tracing and recovery of assets laundered through the financial system.

Representing companies in criminal investigations

The forensic toolkit is very useful in establishing patterns of fact during criminal investigations. Forensic analysts can conduct transaction reviews, identify anomalous historical payments and uncover suspects of interest. By performing a review, a company accused of money laundering can attempt to prove that it played no active role in the laundering of illegal money and had sufficient controls in place, which were purposely evaded as part of a complex financial crime scheme. In this section, we first briefly discuss how forensic methodologies can be used while representing companies directly accused of money laundering. We then consider best practices when representing companies accused of unknowingly or unwittingly processing the proceeds of crime.

It is common for perpetrators of money laundering to execute schemes through an unlicensed money transmission business along with a web of related entities and shell companies. In these scenarios, indictments are filed against individual defendants and accompanying injunctions can be placed on entities to prevent them from continuing to transfer funds. An investigation into transacting parties can be useful in determining the merits of an injunction, bifurcating which entities were involved in the illicit movement of funds and which were transacting in a normal course of business.

Cash-intensive businesses, such as convenience stores, restaurants and launderettes, have historically been used for money laundering because of the lack of transaction records from third-party payment processors. Money launderers can easily mix illicit funds with legal cash and, coupled with forged receipts, can make funds appear legitimate. In criminal investigations into cash-intensive businesses, forensic techniques can examine a store’s inventory, accounts payable, payroll or customer foot traffic to determine whether the revenue reported by the store seems inflated.

Of course, not every party in a financial crime investigation is accused of a predicate offence (i.e., an offence from which illicit funds are derived, such as narcotics trafficking, tax evasion, fraud, larceny or public corruption). Financial institutions and payment processors are commonly accused of processing transactions involving proceeds from illegal activities. In the United States, these charges are usually brought under provisions of the Bank Secrecy Act (BSA), which requires regulated financial entities to have controls in place to detect and deter money laundering and report suspicious activity.[2] If companies are found to maintain weak financial crime controls, they can be charged with violating sanctions and export control laws, such as the International Emergency Economic Powers Act and the Trading with the Enemy Act, along with laws designed to prevent bribery, including the Foreign Corrupt Practices Act.[34]

Offences that have led to criminal charges include the use of banks by drug cartels and criminal enterprises. For instance, cartels in Mexico have laundered drug money through local banks by simply arriving at the bank with bags full of cash and pictures of the banker’s family members, threatening violence if the banker does not accept the cash. These cartels were notably able to launder nearly US$900 million through a global financial institution because the bank’s compliance department was severely understaffed and unequipped.[5] In another case, a bank in the United Kingdom was charged with failing to prevent British gangs and a gold dealer from laundering more than £400 million of illicit proceeds.[6] Government investigators had discovered that the bank’s compliance systems had properly alerted employees to the suspicious activity but the bank simply failed to take action.

When filing charges against financial services providers for lapses in money laundering controls, it is not unusual to cite activity that has occurred over several years and encompasses billions of dollars in transactions. Therefore, a diverse forensic approach is critical. When charges are brought, companies need to first understand all the activity in question. This requires potentially mapping trans­actions across jurisdictions and through correspondent accounts. The transaction review then needs to be coupled with an analysis and remediation of the controls in place during the period in question. How transaction alerts were reviewed, escalated, disposed of or reported needs to be meticulously documented and recommendations on updates to existing controls need to be made. These investigations and reviews take time – time that is often provided by deferred prosecution agreements (DPAs).

In filing charges against financial institutions, there has been a trend in the past two decades towards the use of DPAs. The US Department of Justice (DOJ) started to rely increasingly on DPAs after the collapse and subsequent criminal conviction of Arthur Andersen in 2002 (for obstruction of justice in the fraudulent activities and the subsequent collapse of Enron, an energy, commodities and services company based in Texas). The DOJ started to seek to avoid the economic effects on individual employees and investors, as well as the market impact, associated with an extended trial conviction of a large financial institution.[7][8] DPAs are settlement agreements that result from negotiations between the government and companies during criminal investigations. These agreements allow companies charged with money laundering violations to lessen potential penalties resulting from a conviction by paying monetary penalties and implementing remediation plans. Government investigations into suspicious transaction activity can take years and cost millions of dollars in taxpayer money. By entering into a DPA, the prosecutors can mandate a full forensic review of an institution conducted by an independent party to be paid for by the respondent institution, rather than from government coffers.

Although forensic reviews are inherently retroactive and are carried out in response to a legal or regulatory inquiry, assessments can be conducted proactively once internal compliance and legal teams uncover evidence of suspicious activity. In anticipation of potential criminal legal action, companies can commence internal investigations to determine the company’s complicity in money laundering. Proactive internal investigations and compliance control remediations can place a respondent company in a more favourable position during a criminal investigation and when negotiating the terms of a DPA.

Once a DPA is entered into by a respondent company, a complete forensic review can commence. Forensic investigations and concurrent compliance programme remediations are commonly mandated as part of a DPA. An initial step in a forensic anti-money laundering (AML) review is a complete historical transaction remediation encompassing all activity that occurred during the period in question. This is usually mandated if the respondent institution failed to identify and subsequently report suspicious activity occurring through its payment processing systems. Institutions are required under the BSA to report suspicious activity, in the form of suspicious activity reports, to the Financial Crimes Enforcement Network of the US Department of the Treasury within 30 days of initial detection of facts.[9]

When companies are charged with failing to detect and report suspicious activity, a forensic review can identify previously overlooked transactions and summarise suspicious patterns. This process can be meticulous. Transactions from disparate messaging systems (Swift, CHIPs, FedWire) and various jurisdictions must be linked and an independent alert review must be conducted. Institutions with robust correspondent banking relationships may need to request information from their correspondent customers about ultimate parties that originate and receive payments that are not in the respondent institution’s immediate customer base.

Remedial transaction reviews are also necessary when responding to claims that a financial institution failed to prevent payments that violated economic sanctions or other financial crimes, including facilitation payments. After collecting and synthesising data, transactions can be run through numerous filters designed to identify sanctioned parties or activity transmitted to or from sanctioned jurisdictions. Additionally, investigative methods that are commonly used to detect money laundering can also identify illicit payments to government officials or activity designed to conceal sanctioned parties that were not detected prior to charges being brought against the respondent institution.

Coupled with a transaction review, investigations into customer accounts must be conducted. Accounts associated with suspicious activities require review, updates to risk ranking and customer profile, and potential de-risking. Investigations into account holders require a mixture of internal record review, including an analysis of account opening forms and customer-provided documents, including corporate records and personal identification, as well as public records research into the legal, regulatory and reputational profiles of customers. As prosecutors focus their allegations on compliance deficiencies, comprehensive compliance reviews are conducted in unison with transactional remediations. Forensic analysts may be asked to help create new know-your-customer (KYC) procedures to replace deficient policies. Independent consultants may also be mandated to monitor these compliance programmes throughout the DPA period to ensure that the company has appropriately reformed and reported any irregularities.

Although financial institutions require forensic services in responding to criminal claims of AML programme deficiencies, institutions that appear tangential to money laundering may also require representation and forensic analysis during criminal investigations. Companies that operate in the gold, jewellery, precious metals and art industries – all of which contain materials or items with ‘inherent value’ – may be accused of transferring items that were obtained through illicit means. Precious metals can be melted down, reconstituted, transported across borders and sold to a dealer without the buyer having any knowledge of the goods’ origin. Artwork can be stolen or privately sold with no publicly available records being kept; even when artwork is sold through public forums, auction houses are notorious for ownership secrecy.[10]

Company executives themselves may become targets of money laundering charges after a company has been sold to a strategic investor or investment firm. In these circumstances, the purchasing entity or successor company will require a forensic analysis of their transaction due diligence. It will be critical for the successor company to delineate transaction activity before and after the acquisition, as well as analyse any changes in compliance and financial crime prevention controls during both periods.

Whether a company is directly accused of money laundering, enters into a DPA following an accusation of insufficient compliance controls, or is indirectly involved in a criminal investigation, forensic methodologies are critical in identifying historical activity and remediating current deficiencies.

Determining loss

In both criminal and civil proceedings, attempts are made to demonstrate the economic impact of money laundering on individual victims and, in significant cases, the entire financial system. A field of forensics, known as financial forensics, specialises in assessing economic damage. Financial forensics analysis is commonly used in many types of civil lawsuits, including matters alleging theft of trade secrets, anticompetitive behaviour and wrongful dismissal. In cases involving allegations of money laundering, calculating loss can be less straightforward than determining lost profits or profits that would have been achieved but for a given event. Rather, determining loss in money laundering requires an understanding of the economic harm caused by the predicate crime and a further analysis of the harm incurred by the laundering of the proceeds of the predicate crime. Findings produced by financial forensics specialists are used as a baseline for determining criminal forfeitures and civil judgments, as well as administrative penalties imposed in DPAs, as discussed above.

In criminal proceedings involving allegations of a predicate crime, such as fraudulent gains and subsequent money laundering of those proceeds, forensic analysts will focus primarily on the loss caused by the underlying crime. If an operator of a Ponzi scheme is found guilty of defrauding investors and laundering the proceeds from the scheme, a forensic review will include an analysis of certificates of deposits issued to investors, investor redemptions and inter-account transactions used by the scheme to determine the total loss to investors. Similarly, if a drug cartel is found guilty of laundering the proceeds of narcotics sales, the government will commonly seek forfeiture of all funds associated with accounts held by the suspects as well as any assets found to be controlled by the suspects, such as real estate, securities or precious metals. Tracing and recovery of assets is discussed further, below.

If a company is accused of operating an illegal money transmitting business, demonstrating lost profits or harm is less clear.[11] In a case in 2022, defendant Da Ying Sze (Sze) was charged by federal prosecutors in New Jersey with operating an unlicensed money transmitting business and engaging in monetary transactions in property derived from illicit activity. Sze was specifically accused of laundering US$653 million using various shell companies and accounts. According to prosecutors, Sze received commission of between 1 and 2 per cent for his laundering services.[12] As part of a plea agreement, Sze was ordered to forfeit nearly US$3.9 million in seized cash, cheques and money orders, as well as a vehicle and the contents of 14 bank accounts totalling an additional US$2.2 million. In determining loss to reach a plea agreement, the government decided that the profits made by Sze from the scheme equalled the loss to be recovered in this matter.

Financial forensics is key in determining loss when financial institutions face allegations of lapses in AML compliance and violations of sanctions. In the past decade, numerous global financial institutions have paid billions in civil penalties and forfeitures for failing to maintain sufficient AML compliance controls or violating other financial crime regulations. In these matters, forensic analysis is critical in the adjudication of the penalties that should be paid.

In claims brought by the government for violations of the BSA, civil penalties are specified in US law (such as US Code, Title 31, Section 5321), and in guidance issued by regulatory bodies, including the US Department of the Treasury (Treasury department) and the Federal Deposit Insurance Corporation (FDIC). The FDIC’s instructions for BSA-related civil monetary penalties involves a tiered matrix that ranges from US$7,500 per day to US$1,375,000 per day depending on the severity of the violations.[13] In assessing civil penalties, forensic analysis is needed to tally instances in which an institution failed to abide by BSA reporting requirements, while also measuring the severity of the lapses and the duration in which an institution failed to maintain sufficient controls.

Similar to the forfeiture in the criminal case against Sze discussed above, civil forfeiture for violations of the BSA and other financial crime matters is also commonly based on an assessment of profits made by an institution for engaging in illicit activity. The Treasury Department maintains an Office of Asset Forfeiture (OAF), which has a stated mission ‘to disrupt and dismantle criminal enterprises’. The OAF has obtained billions in asset forfeitures that have been directed to the Treasury Forfeiture Fund.[14] In its 2022 Fiscal Year report, the OAF disclosed that it obtained a US$71.85 million asset forfeiture from the Swiss branch of a global bank, after the branch admitted to assisting US clients to evade taxes. The forfeiture amount represented the gross fees the bank charged clients in assisting with the alleged tax evasion. In these situations, forensic analysis is needed to review the financial records of an institution and to identify the specific proceeds generated from the alleged activity. This process can be painstaking, as revenue can be generated through an individual account by a variety of means. A financial forensic specialist will need to separate the proceeds derived from normal business activity from the illicit activity to generate a forfeiture amount.

Determining loss following charges of money laundering can be complex. In many cases, there is a need to first understand the predicate crime. In others, it is the role of forensics to determine the profits gained by money transmitters or global financial institutions through facilitating illicit financial activity.

Asset tracing and recovery

After it is confirmed that the proceeds of crime were deposited and laundered through the financial system, it is critical that these funds are tracked and ultimately returned to the victims of illegal activity. Tracing and recovery of assets is a key instrument in the forensic toolkit, and accountants and investigators are needed to discover where this money went and how it was used.

Accountants are adept at analysing financial statements and flows of funds. This process typically starts with a review of bank statements. If access to these records is available, forensic accountants can analyse transfers and map financial activity across banks and jurisdictions. Were these funds immediately used to purchase an asset, such as a mansion, a piece of art, a yacht or even a form of cryptocurrency? Or were they transferred to another bank account? If an asset has been acquired, records supporting the transaction can be presented to relevant authorities to begin recovery efforts. If the funds were transferred to another account, legal requests can be made to acquire and access additional bank statements and records.

Forensic investigators become extraordinarily useful when there is a need to identify previously unknown parties who appear in transaction records. After it is established that funds were sent from a known bank account to a new company or individual, investigators are tasked with identifying all available information about new suspects. If the funds were sent to a company, the investigator may analyse corporate records to determine whether the individuals involved in the alleged criminal acts are the owners of this entity. It may be determined that a family member or close associate of the criminals controls this company. If the funds were sent to an individual, media research, social media network analysis or on-the-ground source work may be required to reveal whether that individual is connected to the original criminal actors.

Once subjects of interest are identified through a transaction analysis or an investigation into suspects in a criminal proceeding, the next step is a review of available property and asset records. In the United States, real estate property records are available through county recorder offices and are occasionally aggregated in proprietary public record databases. When reviewing real estate records, it is critical to conduct a deep dive into ownership. It is common for those with illicit funds to acquire properties under the name of a relative, associate or shell company. If the suspects have used shell companies, it is important to determine the ultimate beneficial ownership of real estate investment vehicles during the process of identifying and recovering assets.

Vehicle and watercraft registration records, which are widely available in US licensing records, should not be overlooked. Discovering that a suspect has an active pilot’s licence could prompt a search to determine whether they own any aircraft in their name or through a series of aviation holding companies. Outside the public record, forensic investigators are adept at combing through qualitative data obtained during the discovery period of a lawsuit. By analysing retrieved emails and text messages, the investigator may identify instances in which the criminal has communicated his or her intent to purchase a variety of assets or could even discover a new company tied to the suspect in question.

Authorities used these tools to trace revenue flows generated by central and south American drug cartels. For years, investigators in the United States were perplexed at how drug cartels in Mexico and south America were able to launder and transport billions of dollars of cash earned from selling drugs on US streets. The first lead came from an unrelated investigation into illegal gold mining in Peru.

Approximately 28 per cent of all illegal gold mining in the world occurs in Peru.[1516] To sell the gold they were mining, illegal gold miners in Peru needed to find buyers willing to pay exclusively in cash. The miners found a perfect buyer in drug cartels. As soon as cash was assembled from drug sales in the United States, cartels would immediately send that cash in massive bundles of US$1, US$5, US$10 and US$20 bills to Peru. Once received by cartel associates in Peru, these individuals would travel to illegal gold mining sites in the Peruvian Amazon to purchase unrefined gold with US dollars, which the miners happily accepted.

After realising that cartels would use cash from drug sales to buy gold, forensic investigators analysed available business records and conducted interviews with locals to discover that many nearby gold stores and refineries were owned by cartel affiliates. Once the gold was received at these jewellery stores, the unrefined gold was melted down and cast into gold bars. Sometimes these gold bars would be made entirely of illegally mined gold, and other times the illegally mined gold was mixed with legal gold during the refining process.

Although the illicit funds had now been transformed successfully from cash into gold, the cartels still needed a way to complete the ‘placement’ stage of the money laundering process, wherein the illegal proceeds of a crime are placed into the legitimate financial system.[1718] Investigative journalists working for the Miami Herald, using forensic investigative and accounting techniques, discovered that a gold refinery based in Miami, Florida, had ‘imported an astonishing $3.6 billion in illegal gold from criminal groups in Latin America’ since January 2013.[19]

This refinery failed to implement AML and KYC procedures to ensure that the gold it was buying was not derived from illegal sources. In fact, investigators found that the gold dealer’s employees would simply ask the sellers whether the gold was illegal, to which the sellers would affirm the metal’s legal origin, and no follow-up inquiry was conducted. Since gold refiners in the United States purchased gold from the cartel-owned stores using wire transfers from legal bank accounts, the cartels had now successfully transferred their illegal funds from drug sales into seemingly legal profits from gold sales.

Once assets are located, prosecutors or lawyers can use the information gleaned through forensic methods to recover assets. In criminal proceedings, this typically takes the form of a government forfeiture, as discussed above, wherein a forensic analysis demonstrates that the defendants had acquired assets, such as a luxury mansion, using laundered funds. In other cases, if bank accounts holding laundered money have been identified, prosecutors can seize the funds in those accounts.

In civil proceedings, recovery often occurs through either a civil judgment or a settlement. If it is successfully proven that an asset was purchased using illicit funds, a court can decide to place a judgment on that asset in the plaintiff’s favour. In other cases, the defendants may decide to pay a settlement to the plaintiffs to avoid a civil trial or court ruling, allowing the plaintiffs to recover some, if not all, the stolen funds while the defendants can maintain innocence.

As demonstrated in this chapter, forensics is a key part of legal negotiations, assessing economic damages and tracing assets. The forensic toolkit will continue to evolve to meet the challenges posed by sophisticated financial crime networks and the ever-changing legal and regulatory landscapes across the globe.


[1] G Elaine Wood is a vice president, Brad Dragoon is a principal and Noah Genovesi is a consulting associate at Charles River Associates.

[2] US Office of the Comptroller of the Currency, Bank Secrecy Act (BSA) (see (last accessed 7 July 2023)).

[3] US Department of Justice (DOJ) press release 12-1478, ‘HSBC Holdings Plc. and HSBC Bank USA N.A. Admit to Anti-Money Laundering and Sanctions Violations, Forfeit $1.256 Billion in Deferred Prosecution Agreement’ (11 December 2012).

[4] DOJ press release 21-23, ‘Deutsche Bank Agrees to Pay over $130 Million to Resolve Foreign Corrupt Practices Act and Fraud Case’ (8 January 2021).

[5] See footnote 3.

[6] ‘Bin bags of cash: NatWest fined for dirty money breaches’, Reuters (13 December 2021).

[7] ‘Deferred Prosecution Agreements – Justice delayed or Justice denied?’, Norton Rose Fulbright (March 2018).

[8] Deferred prosecution agreements (DPAs) have also become a popular tool outside the United States; the United Kingdom’s Serious Fraud Office entered into nine DPAs between 2014 and 2021. Commercial Dispute Resolution, ‘The SFO in 2021: Supreme Court, Brexit and DPAs’ (23 February 2021).

[9] BSA. If no suspect was identified on the date of detection of the incident requiring the filing, a financial institution may delay filing a suspicious activity report for an additional 30 calendar days to identify a suspect.

[10] ‘Has the Art Market Become an Unwitting Partner in Crime?’, The New York Times (19 February 2017).

[11] U.S.C. § 1960 – Prohibition of illegal money transmitting businesses.

[12] DOJ press release 22-062, ‘Queens Man Admits Orchestrating $653 Million Money Laundering Conspiracy, Operating Unlicensed Money Transmitting Business, and Bribing Bank Employees’ (22 February 2022).

[13] US Federal Deposit Insurance Corporation, ‘Instructions and Matrix for Bank Secrecy Act/Anti-Money Laundering Civil Money Penalties Against Institutions’.

[14] US Department of the Treasury, Executive Office of Asset Forfeiture, ‘Congressional Budget Justification and Annual Performance Report and Plan’ (2022).

[15] ‘Illicit Mining: Threats to U.S. National Security and International Human Rights’, US Senate Foreign Relations Committee, Subcommittee on Western Hemisphere, Transnational Crime, Civilian Security, Democracy, Human Rights, and Global Women’s Issues (5 December 2019).

[16] Javier Lizcano, ‘A Toxic Trade: Illegal Mining in Peru’s Amazon’, InSight Crime (2 June 2022).

[17] ‘Unveiling the Complexity of Layering in Money Laundering’, Tookitaki (12 March 2021).

[18] The three stages of money laundering are described as placement, layering (use of multiple transactions to move funds and conceal its ultimate source) and integration (receipt and use of funds which have been laundered and appear from a legitimate source). ‘Stages of Money Laundering explained’, St Paul’s Chambers (21 February 2021).

[19] Tristan Clavel, ‘Investigation Highlights Miami’s Role in Turning “Dirty Gold” Into “Clean Cash”’, InSight Crime (18 January 2018).

Unlock unlimited access to all Global Investigations Review content