You are on page 1of 24

Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 1 of 24

Affidavit of Ryan Lane

1. I am a Special Agent for the Federal Bureau of Investigation (“FBI”)

currently assigned to the Boston, Massachusetts Field Office. I am currently assigned to a

squad that investigates economic crimes, including investigating fraud and other white collar

crimes. I have a bachelor’s and master’s degrees in accounting and am a Certified Public

Accountant.

2. I make this affidavit in support of a criminal complaint charging FRANK

GREGORY CEDENO and LEONEL ALEXIS VALERIO SANTANA with wire fraud, in

violation of 18 U.S.C. § 1343 and conspiracy, in violation of 18 U.S.C. § 371.

3. The facts in this affidavit come from my personal involvement in this

investigation, interviews with witnesses, and my review of documents, records, and

information provided by others, including the Securities and Exchange Commission (the

“SEC”). In submitting this affidavit, I have not included every fact known to me about this

investigation. Rather, I have included only those facts that I believe are sufficient to establish

probable cause.

Background

4. The fraud scheme at issue involves the impersonation of employees of the

SEC and the misuse of the SEC seal as part of an advanced-fee fraud scam in which the

perpetrators trick victims into sending them money by pretending to be SEC officials. The

scheme principally targeted purchasers of binary options,1 especially purchasers who had, at

1
Binary options are financial options that pay out either a predetermined amount or
nothing at all, depending “entirely on the outcome of a yes/no proposition.” SEC Investor
Alert: Binary Options and Fraud (June 2013) at 1, available at
https://www.sec.gov/investor/alerts/ia_binary.pdf. Because of this pay structure, “binary
options are sometimes referred to as ‘all-or-nothing options’ or ‘fixed-return options.’” Id.
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 2 of 24

some point, purchased options from entities being sued by the SEC or the Commodity

Futures Trading Commission.

5. Frequently, victims of the scheme were people who had purchased binary

options from a company called Banc de Binary, the defendant in SEC v. Banc de Binary, 2:13-

cv-00993-RCJ-VCF (D. Nev.) and U.S. Commodity Futures Trading Commission v. Banc de

Binary, 2:13-cv-00992-MMD-VCF (D. Nev.). In those cases, filed on the same day in June

2013, the government plaintiffs alleged that Banc de Binary illegally recruited U.S. investors

to its binary options trading platform.Beginning no later than June 2015, former purchasers

of Banc de Binary securities began to receive e-mails and telephone calls from people

purporting to be SEC employees seeking money in connection with the investments they

made with Banc de Binary.

6. The solicitations to victims took various forms, but had several common

elements including the pseudonyms, phone numbers, and e-mail addresses used by the

fraudsters; the form of the documents attached to soliciting e-mails; and the nature of the

ruses used to swindle victims. In one common version of the scam, victims received e-mails

that used official-seeming documentation and the SEC seal to support a false claim that the

targeted investor must pay a fee in order to receive a portion of the settlement of the SEC’s

lawsuit against Banc de Binary. In another version, victims received e-mails and official-

seeming documents labeling the victim a defendant in a civil suit alleging that the victim

owed tens of thousands of dollars in supposed disgorgement, penalties, and fees. The

According to the SEC, shortly before the conduct at issue in this affidavit, “much of the
binary options market operates[d] through Internet-based trading platforms that [were] not
necessarily complying with applicable U.S. regulatory requirements and may [have been]
engaging in illegal activity.” Id. at 4.

2
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 3 of 24

documents gave the victim a choice of either appearing in court to contest the lawsuit or

paying a smaller fee, described as a bond.

7. From June 2015 through June 2017 there have been at least 95 victims

targeted by this fraud scheme, with solicitations exceeding $1.3 million. Since June 2015, at

least 25 of those targeted have sent money to the fraudsters, totaling more than $235,000.

The Targets and Their Co-Conspirators

8. Each of the individuals described in this section is discussed further below. I

discuss them here to introduce them and orient the reader to the role played by each in the

conspiracy described in this affidavit.

9. FRANK GREGORY CEDENO and LEONEL ALEXIS VALERIO

SANTANA are the targets of this complaint. Among other evidence—and as detailed

further below—there is evidence that CEDENO established an internet-based phone

number used to communicate with victims of the fraud scheme, and that he received victim

funds into his bank accounts, withdrew them, and distributed the money to other members

of the conspiracy. For his part, there is evidence that VALERIO communicated instructions

to members of the conspiracy and that he was paid portions of the proceeds of the fraud. I

believe that, during the period relevant to this complaint affidavit, CEDENO resided in or

near Orlando, Florida, and that VALERIO resided in the Dominican Republic (though I

believe he now resides in Boston, Massachusetts).

10. Co-Conspirator 1 – As described further below, among other things, there is

evidence that Co-Conspirator 1 received victim funds into his bank account, withdrew them,

3
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 4 of 24

and distributed the money to other conspirators.2 Based on my review of bank records,

Co-Conspirator 1 appears to have been employed at the same Orlando fast-food restaurant

as CEDENO during the period relevant to this affidavit. Bank records also show that

Co-Conspirator 1 opened an account at Bank of America on or about May 13, 2016 at the

same branch in Orlando, Florida, where CEDENO had opened an account two days before,

as described below. According to Co-Conspirator 1’s bank records, on or about August 16,

2016, he received an international wire transfer for $6,500.00 into his account from a person

I believe to be a victim of the fraud scheme described in this affidavit. The bank records

show that, on or about August 17, 2016, Co-Conspirator 1 (the only signatory to the

account), withdrew $6,200.00 in cash from the account that had received the victim’s

money. Western Union records reflect that, on or about August 17, 2016, Co-Conspirator 1

sent $1,921.00 via Western Union to an individual located in the Dominican Republic.

Western Union records also reflect that, on or about August 17, 2016, both CEDENO and

Co-Conspirator 4 (introduced below) also sent $1,921.00 each to individuals located in the

Dominican Republic.

11. Co-Conspirator 2 – Co-Conspirator 2 is VALERIO’s sister and resides in

Boston, Massachusetts. As described further below, among other things, there is evidence

2
In general and among other reasons, my belief that certain funds were victim funds
arises from factors including review of e-mail traffic preceding fund transfers; the origins of
the transfers (generally, the fraudulent transfers came from bank accounts outside the United
States held in the names of individuals, not business entities); and the handling of the
money once transferred to a person I have identified as a co-conspirator (frequently,
transferred funds were withdrawn shortly after they were transferred into the accounts of
co-conspirators). Not all these factors necessarily played a role in each of my determinations
that certain money represented victim funds, but frequently more than one factor was
present before I made such a determination.

4
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 5 of 24

that Co-Conspirator 2 received victim funds into her bank account, withdrew them, and

distributed the money to other conspirators.

12. Co-Conspirator 3 – As described further below, among other things, there is

evidence that Co-Conspirator 3 received victim funds into his bank account, withdrew them,

and distributed the money to other conspirators. During an interview with Co-Conspirator 2

in September 2016, she identified Co-Conspirator 3 as her uncle. According to

Co-Conspirator 3’s bank records, between approximately December 29, 2015 and May 17,

2016, he received approximately $24,238.30 from people I believe to be victims of the fraud

scheme described in this affidavit. In each case, a deposit by a victim was followed by a cash

withdrawal of nearly the entire victim deposit within a week of the deposit—in most

instances within two days of the deposit.

13. Co-Conspirator 4 – As described further below, among other things, there is

evidence that Co-Conspirator 4 received victim funds into her bank account, withdrew

them, and distributed the money to other conspirators. Based on my review of bank records,

Co-Conspirator 4 appears to have been employed at the same Orlando fast-food restaurant

as CEDENO and Co-Conspirator 2 during the relevant time period. Bank records also show

that Co-Conspirator 4 opened a personal account at Bank of America on or about June 7,

2016 and a business account on or about September 26, 2016. Both accounts were closed on

or around October 27, 2016. On or about September 26, 2015—the day she opened the

business account—Co-Conspirator 4 received three wires across the two accounts, totaling

$34,586, from another person I believe to be a victim of the scheme described in this

affidavit.

5
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 6 of 24

14. Co-Conspirator 5 – As described further below, among other things, there is

evidence that Co-Conspirator 5 received victim funds into his bank account, withdrew them,

and distributed the money to other conspirators, including by physically transporting money

from the United States to the Dominican Republic. Aside from the $3,800.00 in victim

funds he received from Co-Conspirator 2 (described below), based on my review of bank

records, I believe Co-Conspirator 5 directly received at least $14,984.29 from victims of the

scheme described in this affidavit between February 5, 2016 and May 10, 2016. According

to Co-Conspirator 5’s bank records, on or about February 5, 2016, he received two

international wire transfers for a total of $8,148.29 into his account from individuals I

believe to be victims of the fraud scheme described in this affidavit. The bank records show

that, on or about the same day, Co-Conspirator 5 (the only signatory on the account),

withdrew $6,927.00 in cash from the account that had received the victim’s money. In

addition, according to Co-Conspirator 5’s bank records, on or about May 10, 2016, he

received an international wire transfer for $6,836.00 into his account from a person I believe

to be a victim of the fraud scheme described in this affidavit. The bank records show that,

on or about May 11, 2016, Co-Conspirator 5 (the only signatory on the account), withdrew

$5,810.00 in cash from the account that had received the victim’s money. Western Union

records reflect that, on or about May 11, 2016, Co-Conspirator 5 sent $1,400.00 via Western

Union to an individual located in the Dominican Republic.

Illustrative Transactions

Victim 1

15. Victim 1 is a resident of the United Kingdom. Based on conversations with

Victim 1 and review of e-mail and bank records, I believe that, between approximately

6
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 7 of 24

December 29, 2015 and May 24, 2016 Victim 1 has sent approximately $8,480.00 to

members of CEDENO and VALERIO’s conspiracy, including sending approximately

$2,865.00 to CEDENO directly.

Victim 1 – The May 2016 Transaction

16. On or about April 30, 2016, Victim 1 received an e-mail from someone

identified as Ryan Sterling, ostensibly a counselor for the SEC, using the e-mail address

ryansterling@accountant.com, with the subject line “Invoice From Asset Forfeitures

Program.”

17. The name Ryan Sterling has appeared extensively in my investigation of this

fraud scheme, both in e-mail correspondence and in phone conversations recounted to

investigators by victims. “Sterling” was the purported sender of many fraudulent e-mails

sent using accounts other than ryansterling@accountant.com, including nsec@usa.com and

ussec@nusecc.net, both of which were also used to solicit victims in manners similar to

those described here.

18. Account records maintained by 1&1 Mail & Media, Inc., the host of

ryansterling@accountant.com, reflect that the account was registered to someone identified

as “Ryan Sterling” on or about July 15, 2015. The country code associated with the account

is DO, the code for the Dominican Republic. Using publicly available resources, I

ascertained that all of the logins to the account for which I had records, including logins

during May 2016, were from locations within the Dominican Republic.

19. The April 30, 2016 e-mail from “Sterling” to Victim 1 said:3

In this and other quoted text throughout this affidavit, I have left capitalization,
3

punctuation, and grammatical typographical errors as they appeared in the underlying


documents.

7
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 8 of 24

Dear [Victim 1]

I received this invoice from the Assets & Forfeitures department on the 28th if
the month, i have been disputing this however I honestly dont see any other
way around it

I hope u understand I am trying my best.

Sincerely,
Ryan Sterling
Counselor/SEC

20. Attached to Sterling’s e-mail to Victim 1 was an invoice purportedly from

“The Asset Forfeiture and Money Laundering Section, United States of America” stating

that Victim 1 owed a “Penalty Fee” of $2,900.00 to the “Department Asset Forfeiture,

International money laundering and asset forfeiture investigations.” The invoice bore the

seal of the Financial Crimes Enforcement Network (FinCEN—a legitimate government

agency within the Department of the Treasury) but contained text from the webpage of the

Money Laundering and Asset Recovery Section of the Department of Justice (formerly the

Asset Forfeiture and Money Laundering Section, or AFMLS). Along with these

government insignia, the purported invoice also included the number of the SEC’s lawsuit

against Banc de Binary, 2:13-cv-00993.

21. A few days later, on May 3, 2016, Sterling e-mailed Victim 1 wire

instructions, attaching a wire transfer form identifying the amount to be paid ($2,900.00)

and the recipient of the money, Co-Conspirator 1, whose address was identified as being in

Orlando, Florida. The second page of the wire transfer form, which was otherwise blank,

bore the SEC seal.

22. Approximately two weeks after sending the initial set of wire instructions, on

or about May 19, 2016, “Sterling” sent Victim 1 another set of wire instructions, this time

8
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 9 of 24

directing Victim 1 to send money to a Bank of America account with an account number

ending in 2982 held in the name of Frank G. Cedeno, who was identified on the instructions

as “escrow agent.” According to the form, the account was at a Bank of America branch on

Silver Star Rd. in Orlando, Florida. CEDENO’s address was listed as an apartment on

Woodhill Park in Orlando.

23. According to Bank of America records, CEDENO had opened two accounts

at the Silver Star Rd. branch a week earlier, on May 11, 2016, presenting his United States

passport as a means of identification. One of those was the 2982 account. CEDENO was

the sole signatory to both accounts. The 2982 account was closed on or about September 21,

2016—five days after I interviewed Co-Conspirator 2. (The other account was also closed in

or about September 2016.) During the four months the 2982 account was open,

approximately 93% ($19,782.00) of the deposits into the account were wires from people I

believe to be victims, based on e-mails sent to them as part of the fraud scheme described in

this affidavit. The remaining 7% (approximately $1,600.00) of the deposits were cash

deposits. Approximately 77% ($16,399.00) of the withdrawals were teller cash withdrawals

made a day or two after the victim funds were wired into CEDENO’s account; the

remaining 23% ($4,983.00) of the withdrawals were ATM withdrawals, debit card

purchases, and various service fees.

24. On or about May 24, 2016, Victim 1 wired $2,900.00 to CEDENO’s 2982

account. After a $35.00 transfer fee was deducted, the remaining $2,865.00 was deposited

into CEDENO’s account. According to bank records and records obtained from

MoneyGram (an international money transfer company), on the same day, CEDENO

9
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 10 of 24

withdrew $2,365.00 in cash from the 2982 account and then sent $2,317.00 via MoneyGram

to an individual in the Dominican Republic.

25. The solicitations of Victim 1 continued after this transaction, and was

ongoing when, on or about September 12, 2016, “Sterling” wrote to Victim 1, saying only:

Give us a call at 617-977-4301 if no payment is done this month i will transfer


your files over and mostlikely you will forfeit your case.

26. The phone number that Sterling included in the September 12 e-mail is a

VoIP (Voiceover Internet Protocol) number, not a typical land line or mobile number, and

one that appeared in other e-mails and documents I have reviewed that were sent to victims,

some of which are described below. VoIP is a methodology and group of technologies for

the delivery of voice communications and multimedia sessions over the Internet Protocol

(IP) networks, such as the Internet. Frequently, VoIP providers permit customers to

purchase phone numbers with area codes of their choosing, regardless of the customer’s

geographic location. VoIP is available on many smartphones, personal computers, and on

Internet access devices. Records obtained from the phone number’s provider,

PhonePower LLC, show that the 4301 phone number was established on or about April 19,

2016 by a caller identifying himself as CEDENO. According to a separate set of phone

records, the April 19 call originated from a phone number registered to a user whose address

on Woodhill Park Drive in Orlando matches the address given for CEDENO on the wire

transfer form sent to Victim 1 on May 19, 2016.

27. I have listened to an audio recording of the April 19, 2016 call establishing the

4301 phone number. On the call, after identifying himself as CEDENO, a caller with a male

voice stated that he wanted to establish a Massachusetts telephone number—area

code 617—and an international plan. (PhonePower offers different service packages,

10
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 11 of 24

including packages that permit international phone calls.) The caller gave the above-

mentioned address on Woodhill Park Drive as his home address. When asked for a phone

number at which he could be reached, the caller gave the telephone number from which,

records show, he was placing the call (the number registered to an address on Woodhill Park

Drive). When told by the PhonePower representative that he needed to establish a username

and password, the caller provided the username “SECUS”. According to records

maintained by PhonePower, the e-mail address ultimately associated with the 4301 phone

number was ryansterling@accountant.com.

28. PhonePower records also show that at least three different credit cards were

used to pay for the PhonePower account that CEDENO established on April 19, 2016. The

first payment on the account, on or about April 20, 2016, was made by a credit card in

CEDENO’s name. The second payment, made on or about April 24, 2016, was listed in

PhonePower’s records as being made by CEDENO; however, records obtained from the

credit card company show that the credit card number used belonged to a woman living in a

different state. That woman’s credit card records also reveal that, in or about May 2016, her

account was cancelled, with a new card and account number issued, because of fraudulent

activity in the account. Among the transactions credited back to the woman’s account were

two foreign transaction fees. PhonePower and separate credit card company records also

reveal that the two other credit cards used to pay for CEDENO’s PhonePower account

belonged to different men (not CEDENO) and were each closed in or about May 2016

because of fraudulent activity within the account, including fraudulent charges to

PhonePower.

11
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 12 of 24

29. Several later payments to PhonePower appear to have been made by members

of the conspiracy out of their own accounts. For example, CEDENO’s Bank of America

records show debit card payments to PhonePower.com in June and July 2016. Bank of

America records belonging to Co-Conspirator 1 show debit card payments to

PhonePower.com in August, September, and October 2016.

Victim 1 – The December 2015 Transaction

30. Victim 1 also sent money to at least one other member of CEDENO and

VALERIO’s conspiracy, approximately half of which was forwarded to VALERIO.

According to bank records, on or about December 29, 2015, Victim 1 wired $5,615.00 to

Co-Conspirator 3 in Boston, Massachusetts. The bank records show that, on or about

December 30 and 31, Co-Conspirator 3 (the only signatory to the account), withdrew

$2,500.00 and $2,900.00, respectively, from the account that had received Victim 1’s money.

Western Union records reflect that, on or about December 31, Co-Conspirator 3 sent

$2,700.00 via Western Union to VALERIO in the Dominican Republic.

Victim 2

31. Victim 2 is a resident of Canada. Based on conversations with Victim 2 and

review of e-mail and bank records, I believe that, between approximately August 16, 2016

and August 18, 2016 Victim 2 has sent approximately $6,890.00 to members of CEDENO

and VALERIO’s conspiracy, including sending approximately $4,790.00 to CEDENO

directly.

32. On or about August 9, 2016, Victim 2 received an e-mail from the e-mail

address NUSSEC@usa.com, with the display name “SEC USA” and with the subject line

12
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 13 of 24

“SECURITY EXCHANGE COMMISION OFFICIAL NOTIFICATION.” The e-mail

said:

Hereby we communicate you with the official notification of the SEC, we


would like you to know it is crucial for our agency for you to contact us,
please provide to us all documentation from Titan Trade, to start working on
the withdrawal of your funds.

This is a confidentiality agreement stating you agree to have the SEC and the
FTC represent you in the court of law for the Class Action Lawsuit.

Once the documents are completed please contact any of our agents
immediately.

Return the documents as soon as possible.

Thanks for understanding.

Sincerely,
Ryan Sterling/ Counselor SEC
[Victim 3]/ Accountant SEC
1-617-977-4301 EXT 101

33. Attached to the August 9 e-mail was a file named “Confidentiality Agreement

SEC. [Victim 2].pdf ”. Below the SEC seal at the top of the first page of the attachment,

there appeared the number of the SEC’s case against Banc de Binary (2:13-cv-00993-RCJ-

VCF) and an altered version of the case caption: Securities and Exchange Commission v. Banc de

Binary/Titan Trade & Forex P. Ltd. (The addition to the case caption references Titan Trade,

another online trading platform for binary options. In investing, the term forex means

“foreign currency.” The name derives from “foreign exchange.”)

34. The purported agreement contained several terms. After first identifying the

parties (“The Security Exchange Commission AND [Victim 2]”), the agreement turned to

“LEGAL SERVICES TO BE PROVIDED,” saying, “The legal services to be provided by a

Federal Attorney to client as follow.” Those supposed services included “Full representation

13
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 14 of 24

of case against Titan Trade & Banc De Binary as main branch.” The purported agreement

also addressed compensation, saying “Client is entitled to receive compensation from the

lawsuits and civil suits that are being applied against these Binary Option Companies that

were affiliated with Banc De Binary.” The agreement called for a signature from Victim 2,

along with the number of a government-issued ID and a copy of a photo ID. The agreement

also said:

Due to the lack of evidence remaining for the on-going investigation against
those individuals or (former company), it is eminent to maintain the
confidentiality agreement enabled to avoid any breech of information that
might jeopardize or forfeit the ongoing investigation.

35. Also attached to the August 9 e-mail to Victim 2 was a two-page file entitled

“INVESTOR ALERT.pdf ”. The attachment appears to have been derived from a five-page

June 2013 investor alert issued by the SEC warning investors about fraudulent promotion

schemes involving binary options and binary options trading platforms (Investor Alert:

Binary Options and Fraud (June 2013), available at https://www.sec.gov/investor/alerts/

ia_binary.pdf). In the version sent to Victim 2, however, various aspects of the alert had been

altered, including the investor assistance phone number displayed in the footer of each page.

In the version of the document sent to Victim 2, the listed phone number is one associated

with the fraud scheme, used as a “Toll Free” contact number in various e-mails sent to

earlier victims.

36. I have spoken with Victim 3, whose name was used in the August 9 e-mail

and in others I have reviewed in my investigation of CEDENO and VALERIO’s fraud

scheme. Victim 3 was an employee of the SEC, where he had worked since approximately

July 2014 as a financial economist for the Division of Economic and Risk Assessment

(“DERA”). Victim 3 left the SEC in or about July 2016. At the time of our interview, which

14
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 15 of 24

predated the August 2016 e-mail to Victim 2, Victim 3 denied any knowledge of or

involvement with e-mail solicitations described in this affidavit. He described occasional

contacts from fraud victims who had obtained his actual contact information. (According to

Victim 3, all economists in DERA have publicly available posts on the SEC website that

include a brief biography and contact information.) Victim 3 believed the victims who had

contacted him were from Australia and Canada.

37. On or about August 9, 2016, Victim 2 replied to NUSSEC@usa.com,

attaching a signed “SETTLEMENT AND CONFIDENTIALITY AGREEMENT” and a

copy of his driver’s license. Approximately two days later, Victim 2 forwarded

NUSSEC@usa.com records of his trading activity on TitanTrade.com and copies of his

online conversations with people he believed to be representatives of Titan Trade.

38. On or about August 11, 2016, in an e-mail from NUSSEC@usa.com to

Victim 2, “Ryan Sterling” wrote:

Dear Mr. and Mrs. [Victim 2]

We were able to authorize your file for the submission of the Class Action
Settlement for the compensation of the lawsuit taking place.

Please go over the paperwork, you will be contacted by one of the individuals
in-charge of the case.

Thanks for proving us with all evidence necessary, to proceed with best
outcome of the settlement.

Sincerely,
Ryan Sterling
SEC/Counselor
1-617-977-4301. ext 101

39. Attached to the August 11 e-mail was a document bearing the SEC seal on

every page. The footer of several pages of the document contained the SEC’s official

15
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 16 of 24

webpage, www.SEC.gov, but also referenced the “Economic and Risk Analyst Department”

and the 4301 phone number, again written as “1-617-977-4301”. The document, which was

similar in format and content to documents sent to other victims of this scheme, was

captioned as follows:

(Victim 2’s name appeared after the word “Defense” in the actual document, where a

redaction appears in the image above.) Robert C. Jones—described in the document as an

Administrative Law Judge—is the United States District Court judge who presided over the

SEC’s lawsuit against Banc de Binary, SEC v. Banc de Binary, 2:13-cv-00993-RCJ-VCF

(D. Nev.).

16
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 17 of 24

40. Among other things, the attachment to the August 11 e-mail said “U.S.

traders themselves will face legal action for trading Titan Trade Binary Options.” The same

paragraph went on to allege that “Defendants” violated various provisions of the Securities

Act of 1933, the Securities Exchange Act of 1934, and Rule 10b-5 promulgated thereunder.

Later pages of the attachment included two claims for relief and a set of prayers for relief

that included requests that “the Court” order the “Defendants” to “disgorge all funds from

their illegal conduct” and “pay civil penalties.”

41. Just under the final prayer for relief, the document contained this passage:

Under the United States court of law Jurisdiction and the Security Exchange
Commission [Victim 2] entitled to receive his liability claim from the class
action lawsuit for the amount not yet agreed by the D.A {District Attorney}
in-charge of the case. This agreement certifies [Victim 2] appear in court and
to use disclosed information evidence from previous transactions that were
made to the platform. The investor will also be an existing legal informant for
the entitlement of compensation gains and emotional distress during the
process of withdraw, along with the twenty four investors that are going
through the same legal procedure.

On the next page, there appeared a signature line for Victim 2 alongside a signature line for

“Robert C. Jones Administrative Law Judge,” which bore a signature that appears to match

the signature of the district court judge in the SEC’s case against Banc de Binary.

42. On or about August 15, 2016, Victim 2 e-mailed the signature page back to

NUSSEC@usa.com, with his signature affixed and the note, “here is my signature for the

class action.”

43. On or about the same day, Victim 2 received another e-mail from Sterling,

again using the e-mail address NUSSEC@usa.com, with the subject line “SEC, SURETY

BOND AGREEMENT”. The e-mail said:

17
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 18 of 24

Dear, [Victim 2]

Please Review both attachments, the amount was set by the District
Attourney from the civil suit, make sure you go over the paperwork.

Hereby I provide you with the Indeminity Bond Agreement approved by the
District Attourney, you do not have to come to the court trials that will be
taking place in Boston, Massachusetts.

However the District Attourney might request some sort of bond appearence
on your responsability during the court trials, witch will be re-entitle back to
you at the end of the hearings.

We were able to settle a finiacial settlement for over USD55,000$ due to the
evidence we were able to find in the data base and the information provided
by you.

Thanks for the information.

Sincerely,
Ryan Sterling
SEC/Counselor
1-617-977-4301. ext 101

44. Attached to the August 15, 2016 e-mail were two documents, “Civil Suit

settlement –[Victim 2]-.pdf ” and “Surety_Bond_Indeminity_Agreement_([Victim 2]).PDF”.

The “Civil Suit settlement” included the seals of the SEC and the Massachusetts

Department of Revenue, and required Victim 2’s signature alongside the signature of

“Robert C. Jones Administrative Law Judge” (who had apparently already signed the

document). The “Surety Bond Indemnity Agreement” also bore the SEC seal. The

agreement called for various promises by Victim 2 “[f]or and in consideration of

NATIONAL SECURITY EXCHANGE COMMISSION, hereinafter referred to as a

United States Federal Agency, securing the release of USD$ 63,367.00 SIXTY-THREE

THOUSAND THREE HUNDRED SIXTY-SEVEN , to [Victim 2] and referred as a civil

suit reward.” Among the promises was an agreement “to check-in each week by PHONE at

18
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 19 of 24

(1-617)-977-4301 during normal business hours of 8:00 am to 9:00 pm (EST) beginning of

next month and each day thereafter until all courts have been dismissed.”

45. Also on or about August 15, 2016, Victim 2 received another e-mail from

Sterling, again using the e-mail address NUSSEC@usa.com with the subject line “SEC,

INDEMNITY BOND AGREEMENT”. The e-mail said:

Dear, [Victim 2]

Hereby we provide to you the last step prior to the settlement that has been set
up between the prosecutor and the defendant, for you to be awarded for the
Class Action Lawsuit.

I would like to advise you it is important you complete this within the
scheduled time to avoid any inconvinience during the submition of your files,
I also need to request from you the scanned copy of the receipt after you
fulfilled submitting your bond.

You will be making a personal transaction to a escrow agent in-charge of


representing your interest in the Treasury Department on behalf of the SEC
since you will not be present during the hearings and procedures.

Sincerely,
Ryan Sterling/ Counselor SEC
[Victim 3]/Accountant SEC
1-617-977-4301. Ext 101

46. Attached to the August 15 e-mail were two documents: “Indemnity Bond To

Avoid Phisical Trial -[Victim 2]-.pdf ” and “Bank_Wire_Form.PDF”. The supposed

indemnity bond bore the SEC seal on each page and purported to require a bond payment

from Victim 2 of $6,900.00. Among other things, the agreement stated “Your Secure

Appearance of A Bond will be placed in the national Treasury Department, On behalf of

the Massachusetts Department of Revenue until the trial have been fulfilled, afterwards the

individual manifested from the Civil Suit ([Victim 2]) is fully entitled to receive

(1) COMPENSATION: of USD$63,367.00 from case No. 2:13-CV-00993 . . . .” The

19
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 20 of 24

footer of the document contained the phone number “(1-617-977-4301)”, the VoIP

telephone number established by CEDENO in April 2016.

47. The second attachment to the August 15 e-mail was a wire transfer form that

bore the SEC seal. It contained the account information for CEDENO’s 2982 account at

Bank of America (an account for which CEDENO was the only signatory) and listed an

address on Woodhill Park in Orlando, Florida. Where the form called for the “Name on

Account,” it listed “FRANK G. CEDENO {escrow agent}”. The amount listed on the

transfer form was $6,900.00.

48. On or about August 15, 2016, Victim 2 e-mailed Sterling, saying, among other

things, “I sent as much as I can because of the difference in the rates.” Attached to the

e-mail were several documents, including a completed version of the wire transfer form

reflecting a transfer of $4,800.00 to CEDENO’s 2982 account.

49. CEDENO’s bank records indicate that, on or about August 16, 2016,

CEDENO received a wire for $4,790.00. According to the records, on or about August 17,

2016, CEDENO (the only signatory to the account) withdrew $4,050.00 in cash. Western

Union records reflect that, on the same day as the withdrawal, CEDENO sent $1,921.00 via

Western Union to an individual in the Dominican Republic.

50. On or about August 18, 2016, Victim 2 forwarded NUSSEC@usa.com a copy

of a PayPal payment receipt reflecting the transfer of $2,100.00 dollars to Co-Conspirator 4.

(PayPal is an online payment system that permits online money transfers.) The $2,100.00

represented the difference between the $6,900.00 required by the so-called indemnity bond

and the $4,800.00 Victim 2 had transferred to CEDENO on August 16.

20
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 21 of 24

51. According to records obtained from PayPal, on or about August 18, 2016,

Victim 2 sent $2,017.80 U.S. dollars to Co-Conspirator 4. The transaction remained

pending, with the funds unavailable, until September 8, 2016. Between September 8 and 9,

2016, the entire amount was transferred to a personal account at Bank of America held in

Co-Conspirator 4’s name, as noted above. On or about September 13, 2016, the $2,017.80

was credited to Co-Conspirator 4’s personal bank account at Bank of America. On the same

day, a debit card purchase was made at a Bravo supermarket in Orlando, Florida from the

same account for $1,719.00. According to records obtained from Western Union, on or

about September 13, 2016, Co-Conspirator 4 sent $1,699.00 to an individual located in the

Dominican Republic using a debit card at a Bravo Supermarket location in Orlando,

Florida.

52. According to bank records, on or about September 12, 2016,

Co-Conspirator 2 (VALERIO’s sister) received a wire of $4,490.00 from Victim 2. Bank

records reflect that someone withdrew $3,800.00 from Co-Conspirator 2’s account the next

day from a location in Massachusetts.

53. In my interview with Co-Conspirator 2, I asked her about these two

transactions. Co-Conspirator 2 told me that she withdrew the $3,800.00 and gave the money

to Co-Conspirator 5 to take to VALERIO when Co-Conspirator 5 next traveled to the

Dominican Republic.

54. In a law enforcement database of border crossings, I encountered flight

records reflecting travel by Co-Conspirator 5 from Logan International Airport in Boston to

Las Americas International Airport in the Dominican Republic on or about September 18,

2016, a few days after Co-Conspirator 2 withdrew the $3,800.00 from her bank account.

21
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 22 of 24

Additional Evidence of VALERIO’s Participation in the Fraud Scheme

Interview with Co-Conspirator 2

55. In my interview with Co-Conspirator 2 (VALERIO’s sister), she described

several aspects of her and VALERIO’s participation in the fraud scheme. According to

Co-Conspirator 2, in approximately May 2015, she was introduced to a friend of

VALERIO’s she knows only by the nickname “Patelito.” (A database of border crossings

indicates that Co-Conspirator 2 flew from Boston to the Dominican Republic on or about

May 16, 2015, returning on or about June 6, 2015.) Patelito told Co-Conspirator 2 that he

was going to be making some money and all Co-Conspirator 2 needed to do was receive the

money for him and send it to him, for which she would typically be paid 15% of the money

deposited into her bank account. It was Co-Conspirator 2’s understanding, based on what

Patelito told her, that Patelito would call and e-mail victims from all over the world and

convince them to send money. She knew that the people sending money were from Australia

and the United Kingdom. She said she knew that Patelito created various e-mail accounts.

56. Co-Conspirator 2 denied that VALERIO knew the arrangements she had

made with Patelito, and she suggested VALERIO was ignorant of Patelito’s scheme. She

said that, at one point, she asked VALERIO about what Patelito was doing. VALERIO told

her that VALERIO did not have anything to do with it.

57. However, Co-Conspirator 2 also stated that she communicated with Patelito

through VALERIO and that she sent her banking information to VALERIO.

Co-Conspirator 2 said that she did not want to communicate directly with Patelito because

she was scared of him; when she spoke to him on FaceTime (a videotelephony mobile

device application), she did so with VALERIO present. Co-Conspirator 2 stated that,

22
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 23 of 24

whenever she received money into her account, she called VALERIO, who would respond,

“Okay, I’ll text or call you back.” VALERIO would then send a text telling

Co-Conspirator 2 where to send the money. Co-Conspirator 2 recalled VALERIO’s

girlfriend being one of the recipients.

Interviews with Additional Witnesses

58. During the course of this investigation, I interviewed two witnesses who

described a June 2017 conversation with VALERIO in which he admitted his participation

in a fraud scheme. Although the accounts of the two witnesses varied slightly, in substance,

the witnesses recounted the following: On or about June 8, 2017, VALERIO joined the two

individuals for a drink after work. While they were together, VALERIO told them that he

had been running a fraud scheme in the Dominican Republic. (One of the witnesses recalled

VALERIO saying he set up fake websites and would call investors and get them to send him

money; the other recalled VALERIO saying the scheme involved e-mails and calls to people,

at one point targeting elderly people for their retirement money.) VALERIO said he made a

lot of money from the fraud, which involved investments of some kind—enough money to

send some back to his sister in Boston. VALERIO also said that his sister had been

interviewed by the FBI. (One of the two witnesses recalled VALERIO saying that he told

his sister to tell the FBI the money was from a boyfriend who wanted her to move back to

the Dominican Republic.) VALERIO had not had much to drink that night—less than one

beer—and did not appear to be impaired when he told them about the fraud scheme.

Conclusion

59. Based on my knowledge, training, and experience and the facts set forth in

this affidavit, I have probable cause to believe, and I do believe, that, in or about and

23
Case 1:18-mj-07073-DLC Document 3-1 Filed 01/22/18 Page 24 of 24

between June 2015 and June 2017, FRANK GREGORY CEDENO and LEONEL

ALEXIS VALERIO SANTANA committed wire fraud, in violation of 18 U.S.C. § 1343,

and conspiracy, in violation of 18 U.S.C. § 371.

Sworn to under the pains and penalties of perjury,

_____________________________
Ryan Lane, Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on January 22, 2018

_____________________________
The Honorable Jennifer C. Boal
United States Magistrate Judge

24