?+g-q?o.

9-12'r+ ooz4 al61n,6\

Financial lntelligence Center
T
*

eot/+ive
a Date

Y '-,ff;if*'t €r@ +,rc |fleo.

Ref.No.
, , o ",

nrtozf u'ttz* 16 0?h

h/g,n hoq

noZ4a f*tT ??ttnl tp,Er fne*

u7g hn@nry- 'l*z,ttt ?f4lc*71+?
0??tt4t *c,g*? A@hilhAf ia#qmc n0q@ ar.F #rc 780/2005 h?*ft
17 ?*mC46 ArC* n'nnhn. d?44h /12.?ilo- att'C* htlht.T
src* df*4h"41,e+
atfb .ey'o.hrr. .
ll*moZdl, outl h"E Qrc h7*tr 15 70n hT*tr 4 ,?nhn. atrc*
h.faz *g'7+ iaoat* fzzafo fhrt^c ooad!
"&y'FD7
h?tl,.?ool 02!tlo- A*Z* '\nhn. Suspicious Transaction Detection and
reporting Guidelines No 2/2019 ,?oqo7 a-aolf *7q63 fr7,9,9Z? n'74n41
hnu ?fT .s,4lqtl 2c 21 ?s: h% h.cc?? P4h? axtTzz fr??A?/t?t t

hu',tfy' lC

*^{#"'
?6rQ6tr:

. tt{lrlv/^?, tl?h
h4.fr h0Q:
. nl-,efltt z,rtB* fi*aff +?+f $,eah*al'
*.9,*'7i
 Ethiopian Financial Intelligence Center

Suspicious Transactions Detection and Reporting

Guidelines for Financial Institutions Ozn0t9

April,2019
Addis Ababa, Ethiopia

PageT of 21
 Tahle of Contents
Pages
ToPics
I Abbreviatiotu and AcronYms
3

2 Definitions
4

3 Preface
5

4 Suspiciots Transactions
6
6
4.1. IdentiSing SuspiciousTransactions
7
4.2. How to Identiff Suspicious Transactions
4.3- Are cash transictions only to be reported as suspicious transactions? 8

4.4. What are some examples of suspicious transactions? 8

4.5. Can attempt transacti,ons also be reported as a suspicious 9

Transaction?
4.6. What protection is there for financial institutions and its employees 9

- for disclosing customer's information?

L7, Can a frnanci-iat institution or its emptoy6e discloie to anyone that it l0
has made a report'to the FIe? ' iF ,
l0
4.E Does financiai institutions is breaching customers confidentiality? l0
4.g can the FIC request further information on sTRs submit? ll
Administrative and Criminal Penalty
Appendices
ll
I Red flag indicators on account opening
ll
l2
u Red Flag Indicator on Cash Transactions
12
ilr Red Fla! Indicators on Transactions Through Existing Accounts
l3
iv Red Flag for Cross Border Wire Transactions
l4
Red Flag for lnsurance ComPanY
l4
vi During the Tern and End of the lnsurance Contract l4
vu Red Fiag Indicators for High Threat Offences
l5
vlu C.n"*ir"a flags indicatorl relating to TBML on financial institutions specially on
banking Products l6
Smuggling
Commin Red flag indicators on Illegal "Hawala", Goods and Cunency
and Tax evasion
16
x n"a nug indicators of under invoicing of imported goods and services t7
xi Red fla! indicators using over invoicing import goods
l7
xii Red flag indicators of multiple invoicing goods
t8
xii Red fla[ indicators for falsified invoicing import goods t8
xiv Red flaE indicators on fictitious /Phantom/ invoicing
l9
xv Additional red flag on tax evasion l9
xvi Additional red flaE indicators on lllegl "Hawala" l9
xvii eJOitiona red fla! indicators on Goods and Cunency Smuggling l9
xviii Human trafficking 20
xix Red flag indicators on Comrption 20
xx Red flag on different types of Frauds

Ptge2 of 27
 l. Abbreviations and Acronyms

AML/CFI: Anti-Money Laundering / Countering Financing of Terrorism

CTRs: Cash Transaction Reports

FIs: Financial Institutions

DNFBPs: Designated Nonfinancial Business and Professions

Ethiopian Financial Intelligence Center

lTra,
ML/TF: Money Laundering and Teriorist Finaniing ,' '
PEPs: Politically Exposed Persons

STRs: Suspicious Transaction Reports

UN: United Nations

PWMD: Proliferation Weapon and Mass Distractive

UNSCR: United Nation Security Council Resolution

AML/CFT: Anti Money Laundering and Combating the Financing of Terrorisnr.

FATF: Financial Action Task Forcc.

TBML: Trade Based MoneY Laundering

Page 3 of21
 2. Dcfinitions

In this guide line, unless the context othenvise requires

a) Money laundering m€ans, as per article 2ll of the proclamation no. 780, the offence as

defined under Article 29 of the Proclamation

b) Terrorist linancing means as per the proclamation 2/2 the offense as defined under Article
3l of this Proclamation
c) Predicate offense means any offense capable of generating proceeds of crime and punishable
at least with simple imprisonment for one year;
d) Broceeds of crime meannany fund.,or property di:rived <irbbtained, directly or indirectly,
from a predicate offense. 'r r
e) Itlegat harvala service is a service rvhich carryout money transfer or remittance business
activities in financial channels or outside financial channels without registered and licensed
by national bank of EthioPia.

0 lllegal foreign currency exchangc refers to carryout buying or selling of foreign curTency
by an individual or company with any person rvho has not registered and licensed under
National Bank of Ethiopia.
g) Virtual currency means a digital representation of value that can be digitally traded and
functions as a medium of exchange; and/or (2) a unit of account; and/or (3) a store of
(l)
value, but does not have legal tender status. It can be exchanged tbr real money or other
virtual currencies are potentially vulnerable to money laundering and terrorist financing
abuse for many of the reasons identified in the Guidance."

h) Money mule refers to someone who transfers illegally acquired money on behalf of or at the
direction of another. Criminals recruit nrules to move money electronically through bank
accounts, in person, or through a variety of other methods. Once received. the mule will rvire
the money into a third parry bank account; "cash out" the money received, possibly via
several cashier's checks; convert the money into a virtual cutTency'"
i) Trade based money laundering is defined as the 'lrocess of disguising the proceeds of
crime and moving value through the usc of trade transactions in an attempt to legitimize their
illicit origin. This can be achieved through the misrepresentation of the price, quantity or
qualit-v of imports or exports. This can atso involve abuse of the financial system through

Page 4 ofZl
 fraudulent transactions involving a range of money transmission instrunrents, such as wire
transfers. The basic techniques of trade-based money laundering are: over- and under-

invoicing of goods and services; multiple invoicing of goods and services; over- and under-
shipments of goods and services; and falsely described goods and services. (FATF Typology
2006)"
j) Proclamation means prevention and suppression of AML and CFT proclamation 780/2013
k) Targeted Financials actions means defined as per Article 2 sub article 8 and 9 of regulation
30612014 procedure for freezing of terrorist's asset council of ministers regulation.

3. Preface

According to FATF recommendation 34, financial intelligence center should prepare guidelines,
and provide feedback, which will assist financial institutions in applying national measures to

combat money laundering and terrorist financing in particular to detect and report suspicious
transactions.

Pursuant to article 219 of AML/CFT proclamation no. 780/2013 enlist Financial institution as a

bank, an insurance company, a microfinance institution, postal savings, money transfer

institution or any other institution designated as such by the National Bank pursuant to the
relevant law. Financial institutiofirs have the responsibility to prevent and combat ML/TF. This
includes assessing risk and mitigates their risks. According to Article 1l of the proclamation,
financial institution are required to develop internal policies, procedures and controlling
mechanisms plated to reporting obligations for the purpose of the AML compliance program.

In addition Pursuant to Article 17 of the AML/CFT Law, financial institutions are required to
report suspicious transactions when they have encountered a suspicion based on reasonable
grounds that a transaction or an attempted transaction is involved.

Ethiopia Financial Intelligence Center, as per article l3l4 of the proclamation no. 780/2013,
should prepare guidelines, and provide feedback, which will assist financial institutions in
particular,
applying national measures to combat money laundering and terorist financing and in
in detecting and reporting suspicious transactions. Thus, it deems necessary to prepare this
guideline to clarify the obligations of financial institutions to report suspicious transactions and

Page

#
to ease the challenge for the identification of suspicious transaction and to reduce the subjectivity
on the identification of suspicious transaction. It has also UN paralleled role to improve the
quality and number of suspicious transaction that has been reported by the financial institutions.

4. Suspicious Transactions

Pursuant to Article l7 of the AMLICFT Proclamation, Reporting entities are required to report
suspicious transactions when they have formed a suspicion based on reasonable grounds that a
transaction or an attempted transaction is involved in, linked to, or may be related to one of the
followings:

The suspicion also applies to offenses that are committed within Ethiopia or in a foreign
jurisdiction. Especially, the predicate offense which are listed in the national risk assessment,
are Corruption, tax fraud/evasion, human trafficking, and migrant smuggling, goods smuggling

(contraband), Illegal hawala and fraud. The reporting entities have focus on when the

identification of suspicious transactions. to prioritize the predicate offenses which are listed
above at their risk level because the offenses are labeled the high risk and they are a threat to our

country. Giving priority to the offenses helps to mitigate the risk and it ensures the effectiveness
to combat ML/TF crime. F

4.1. Identifying Suspicious Transactions

As a general rule, a suspicious transaction will often be conundrum in which it is inconsistent

with a customer's known activities and profile or with the normal business expected for that type
of delicate customer. Thus, the KYC/Account Opening fornts of the customers should at least be
updated annuallY.

By and large, reporting entities will be unaware as to what the actual criminal is since it has
complex and clandestine nature. Horvever, by screening transactions for indicators' typologies,
and unusual activity, suspicion of criminal offending may arise. A transaction may have many
attributes that, considered individually do not raise suspicion, but, considered collectively,
suggest criminal activitY.

profoundly, Reporting entities can seek guidance as to what could constitute an STR from the list

Page 6 of21
of indicators provided in the Appendix. Horvever, the list of indicators is lbr the guidance of

4.1.1. A Financial instirutions should report to the Financial Intelligence Center (FIC) any
suspicious transaction (including attempted transactions) rvhich reasonably suspects is
related to the commission of:

. A money laundering olfense:

. Financing of terrorisnr oflbnse:
. A predicate offbnse:
4.1.2.. A transaction or attempted transaction for which the customer refused to provide
" satisfactory evidence"of identity should alsp be reported as a suspicious transaction to
the FlC.

4.2. Horv to Identify Suspicious Transactions?

Put sinrply, a suspicious transaction is a transaction that is inconsistent u,ith a custoner's

known legitimate business or personal activities or with the norrnal business for that
type of account.

4.2.1. General Indicators

When considering rvhether a transaction is usual or unusual to a customer, a financial

institution and its employees must reasonably evaluate various factors surrounding the
customer and the transaction such as:

The customer's usual occupation. business or principal activity;

The customer's transaction history;
The customer's income level and source of income;
Reasons for the transactions as provided by the customer;

The customer's behavior or appearance;

The lrequenc5, of transactions:
The size and complexity of the transactiott;
The identity or location of any other person(s)involved in the transaction;
The usual or typical financial, business or operational practices or behavior of

Page7 ofZl
 customers in the similar occupation or business category;
The availability of identification documents and other docunrentation;
a Third-party deposits or transactions unde(aken by third parties.
a Client/accounts subject to previous STR reporting
a Attempt to open an account via non face to face contact
a Transferring money using mobile banking frequently

This list of factors is not exhaustive and may include in diflerent sectors bellow annexed.
AII the above surrounding factors of transaction and a customer should be assgsss6 before
reaching a conclusion that a transaction is suspicious and is likely to be a money laundering
or terrorist financing-related t&rnsaction. The decision that a transaction is suspicious should
be based on a combination of the above-listed factors and not juo on" factor regarding the
transaction or customer.

4.3. Are cash transactions only to be reportect as suspicious

transactions?

4.3.I. No, the requirement to report any suspicious transaction applies to all types of the
transaction regardless of whether cash is involved. Thus non-cash transactions, such
as telegraphic transfers. that may appear suspicious. should also be reported.

4.3.2. There is no minimum monetary threshold amount for reporting suspicious

transactions. Thus a transaction considered suspicious should be reported to the FIC
regardless of the cash amount ofthe transaction.

4.4. 'What are some examples of suspicious transactions?

4.4.1. The Appendices lists some examples of specific suspicious transaotions for
different types of financial institutions and high threat predicate offences, This list
is not exhaustive but illustrative which may include other types of transactions.

4.4.2. These transactions are considered to be suspicious transactions unless they are
found rational by the financial institution employee in view of the customer's
occupation, business details, explanations, and other factors.

Page 8 of 21

7,,_)J-{el
'-i\:,.J8riu:-:i, Yrz'
"'-].lYrqqr'cs
'!+-'s:; -
 4.4.3. Horv to Report a Suspicious Transaction?

4.4.4. This can be repo(ed to the FIC electronically or through paper repofts.

4.4.5. In cases where a financial institution must urgentty report on a suspicious

transaction, it may verbally report this to the General Director of the FIC or the
concemed director via telephone. This must be followed up rvith a formal rvritten
report.

4.4.6. Financial institutions and decidedly, provide their reports of suspicious transactions
to the FIC through their Anti-Money Laundering Conrpliance OfTicer. Clear
- 'internal reporting procedures should be in place to allow for this and strict
compliance of this rep'orting procedure is required by all erpployees.

4.4.7. When to Report a Suspicious Transaction?

4.4.8. A suspicious transaction must be reported to the FIC no later than I working day
after forming the suspicion or the receipt to the information being reported on.

4.5. Can attempt transactions also be reported as a Suspicious

Transaction?

4.5.1. Yes. As per article l7 of proclamation no. 780/2013 If a transaction has not
been completed but is found suspicious by an employee of the financial
institution, the transaction can still be reported as suspicious even if minimal
details of the customer has been obtained by the enrployee.

4.6. What protection is therc for financial institutions and its employees
for disclosing customer's information ?
4.6.1. Firstly, article 20 of proclamation no.780/2013 and the FTR Act prohibits the
disclosure of information that rvill identify or likely to identify an1' person who
has handled a transaction for rvhich a suspicious transaction rcport (STR) has
been raised or any person rvhich has prepared or made an STR.

4.6.2. Secondly, as pcr a(icle 24. proclamation no.780/2013 a financial institution its
employees are protected from any civil, criminal or disciplinary action taken

Pagc9 o[21
 against it for reporting a suspicious transaction in good faith.

4.6'3. If there is a prosecution in the courts for money laundering offense in relation to
a suspicious transaction they have reportcd on by a financial institution is
deenred that the financial institution and its entployees did not have possession
of information relating to that transacrion at any,time.

4.7. Can a financial institution or its employee disctose to anyonc that

it has made a report to thc FIC?
4.7.1. Article 20 of proclanration no.780 proclaimed that Financial institution and their
ernployees or agents must not disclose to any person:.

+.i-2. fney have reported or will bo reporting a suspicious tqansaction to the FIC;

4.7.3. The financial institution has countered a suspicion on a particular custonter's

transaction;

4.7.4. Any other information rvhich may cause the person to conclude that suspicion has
been formed or that a report has been or may be rnade to the FIC.

4.7.5. The financial institution, and its employees or agents, nlust not disclose to the
customer being reported on that it rvill be reporting (or has reported) his or her
transaction or information to the FIC as being suspicious.

4.8- Does the reporting of a customer's information and

transactions to the FIC mean that a financial institution is
breachin g custom cr confi dcntialiQr rcquirem en ts?

No. as per article 24 of proclanration no.78012013 A financial institution' obligation to

report customer's transactions or information under the AML/CFT larv overrides any
obligations and it has under any other larv or business requirement to protect the
confidentiality of its customer's information.

4.9. Can the FIC request furthcr information on STRS submit?

Yes. As per article 15 of proclanration no. 780/2013 The FIU nray, as part of its
analysis process. request a reporting institution to provide further information on a

' P"g" l0 ofZl

 suspicious transaction reported on.

5. Administrative and Criminal Penaltv

5.1. Reporting entities should ensure that they have adequate internal policies,
procedures, and controls for detecting, reporting and handling information related

to suspicious transact ions.

5.2. Reporting entity fails to comply with adequate internal policies, procedures, and
controls for detecting, reporting and handling information related to suspicious
.' transactions ,there is administrative and criminal sanbtion as per article 2213 and
article 30 of the proclamation respectivel),

Appendices

i. Red llag indicators on account opening

a) The customer attempts to open an account(s) in what appears to be a fictitious name or in
the name of other persons.

b) The customer submits copies of identification documents while refusing to present the
originals without any rational reasons.
c) The customer provides identification documents that are suspected to be forged or false.
d) The customer provides unclear or doubtful information during the account opening
proc€ss.

e) The customer refuses to present his or her personal identification docunrents without any
rational r€asons.

f; Transactions involving business accounts that are suspected of not being registered

companies. Accounts bearing the names of corporations must have incorporation or

company registration details.
g) Financial institution finds discrepancies in the identification data (e.g. address, business
details) or documents (e.g. passport, driver's license) of a customer after an account is
opened.

Pagc 11 of 21
 ii. Rcd Flag Indicator on Cash Transactions

a) The customer conducts a series of large deposits and rvithdrarvals rvithin a short period
of time in cash or by cheque. The customer kecps nraking withdrar;r,als until all funds
are deposited has been exhausted.

b) The stated occupation of the custonrer does not correspond to the level or type of
transactions undertaken. ( e.g. a student customer makes a series of large cash deposits
and u,ithdrawals at different locations)
c) The sudden increase in an account balancc through larse caslr deposits.
d) _ Customer deposits ver1, dirtl,or moist currency notes.
e) eustomer conducts several transactions on the sante day at the samc- branch but in
conducting the transactions the customcr deliberately ur., di'ki."nt tcllers.
Customer freqtrently conducts cash transactions for amounts just belorv the reporting
threshold of in an apparent attempl to avoid being reported on.
g) Company accounts that are dominated b.v cash transactions rather than other monetary
instruments nonnalll' associated rvith comrrrercial businesses such as chcques or credit
cards.
h) The customer presents uncounted funds for a transaction. On counting of the funds by
tlre financial institution cmployec, tlre customer rcduces tlre number of funds to be

kansacted to avoid activating tlre reporting requirements.

The customer makcs irrcgular large loan repavnlents exceeding the required
monthly/weekly repaynlent amount using cash or otlrer negotiable instruments.
j) The customer makes large cash payments which clear off his/her loan balance rvell
belbre the end of the loan ternr.

iii. Rcd FIag Indicators on Transactions Through Existing Accounts

a) Large deposits and withdrawals during a short period of timc into an account

imnrediately after being opened. 'fhe account is then closed or discontinued for any
other transaction.
b) Custonrer frequently conducts transactions at particular branches instead ol a branch

conveniently located to rvhere he/she resides or works.

Page 72 of 2l ,m
--*
.:l
':)
:.9
.i, <a
c,
c) Frequent telegraphic transfers of large sums into an account of customers.
d) The customer frequently receives large deposits into his/lrer account at a branch distantly
located from the branch at which the customer maintains his/her account.
e) Transactions involving an account that is used frequently to remit funds to a large
number of people.

0 An account receives frequent remittances from a large number of people followed by

large remittances or withdrawals from that accounts just after receiving the remittances.
g) An inactive account suddenly experiences significant activity with large deposits and
withdrarvals noted.
h) Thj customer gives conflicting information to different financial institution officials.
i) Multiple deposits into an u.lount by thirO parries.' Ir
j) Deposits into personal accounts of what appears to be proceeds from business-related
activities.
k) Lack of documentary evidence to support large transactions.
l) Large value term deposits for a customer, horvever, this is not supported by the
customerrs occupation or business activity.

iv. Rcd Flag for Cross Bordcr \Yire Transactions

a) Transactions where customers make frequent large overseas remittances within short
periods of time.
b) The customer receives large overseas remittances for economically unreasonable

purposes.
c) Information concerning the originator of a wire transfer is not provided.
d) High-risk countries. For the list refer to the Financial Action Taskforce website on:
www.fatf-gafi.org
e) Customers who decline to provide information or evidence in conducting a transaction.

f) The person conducting a ransaction at the counter using identification documents of

another person. This includes any dealing with an agent where the identity of the

uttimate beneficiary is undisclosed, contrary to the normal procedure for the type of
business concerned.

Pagc 13 of 21
 v. Red Flag for Insurance Company
a) An applicant is reluctant to provide the necessar\. identification information and
documentation or provides minimal infornration.
b) The applicarrt provides conflicting inlbrnration about his/her personal details and/or
provides identification docunrents which vou suspect to be fictitious.
c) The applicant appears to have insurance policies with several other institutions.
d) Application for a policy fronr a potential customer in a distant place where a
comparable policy could be provided '.closer lo honte.',
e) Customer requests an insurance product that has no apparcnt purpose and is reluctant to
' provide the reason fbr his/lrer investnrent.
f1 Thc applicant anenlprs to rise a third'party chcquE to purchasg the policl'.
g) The applicant seeks an insurance policy with prenriums that exceed the customer's
apparent means.

vi. During the Term and End of the Insurance Contract

a) Customer pays a large numbcr of premiums in cash or cheques which does not correspond
to the customer's background
b) Custorner changes from paying his/hcr premiunrs fortnightly or nronthly to annually or in
full.
c) Customer requests during the term of the insurance contract, that the ultirnate beneficiary is
replaced with another person u,ho has no apparcnt connection rvith the
custonrer/pol icyholder.
d) The customer cancels his/her policl.early without a reasonable reason.

vii. Red Flag Indicators for High Threat Offenccs

Ethiopia had conducted national risk assessment before two years .The assessment come up with
6 high threat predicate offbnces. These predicate offbnces should be given priority to mitigate
thcir risks. Ho$,evcr, tllcsc specific rcd flag indicators cannot replace the general red flag
indicators .these indicator uses as additional clues for the high threat predicate offences.

Pagc 1-l of 21
Yiii. General red flags indicators rclating to TBML on linancial institutions specially on
banking Products
a) Use of Letter of Credit to move monev betrveen t\\,o or more lrade relation countries, such
trade rvould not nornrally occur.
b) The method of payment requested by the client appears inconsistent with the risk
characteristics of the transaction.
c) 'fhe ransaction involves thc receipt of cash fronr third party entities that have no apparent

connection u,ith the transaction.

d) The transaction involves tront or shell compauies an{ the use of repeatedly amended
' l"tt.r, of credit rvithoutleasonablojustification.
,. -
e) Inrvard remittances in nrultiple accounts and paynrents made from multiple accounts for
trade transaction of same business entity are indicators for TBML.

0 In merchandizing trade, the trade finance mechanism should be in place for both export
support as well as import support of transaction.
g) The commodit,v is shipped to or from a jurisdiction designated as 'high risk' for ML
activities or sensitive/ non co-operative jurisdictions.
h) The commodity is transshipped through one or more such high risk / sensitive
jurisdictions for no apparent economic reason.
i) Use of corporate structure of shell companics located across the countries and registration
of a trading compan), in a tax haven even though its business relates to another
jurisdiction.
j) The transaction involves the use of front or shell companies, and both shell and front
companies can be used to cover TBML,
k) Sole proprietorship businesses/private limited companies set up by seenringly unrelated
people are found to be controlled by the same group of people.

l) Trade transaction reveals links betrveen representatives of companies exchanging goods

i.e. sanre owners or managenlent.
m) Transfer pricing rvith a related party transaction that is commonly used by transnational
corporation as part of the ir finaneial and tax planning strategy.
n) Patterns of goods are considered as red flag indicators where significant discrepancies
appear betrveen the description. quality and quantity on the documents such

Pagc 15 oi
 as bills
of lading, invoiccs etc.
o) In addition significant discrepancies appear betrveen
the value of the commodity reported
on the invoice and the conrmodity's fair markct value.
p) Relating Consignment size or type of commoditl, being shipped
appears inconsistent with
the scale or capacity of the exporter or importer's having regard
to their regular business
activities.
q) Disguising the owtrerslrip of assets and interest
in busilresscs- constructions rvith foreign
legal entities. e.g. off shore cornpanies or relatives as tegal olvner: price-manipulating
turnover/sales by conrmingling illicir and legal sources of income.

ix. Common Red flag indicators on Illegal *Hasuala", Goods and Currency
Smuggling
anrt Tax evasion

These rcd flag indicators have their own pattern as rvell as common panerns. Therefore, it is
n€cessary to put them in the same category.

x. Red flag indicators of under invoicing of imported goods and services

a) The importers took a permit rvhich contains a little value of foreign currency from
domestic
banks based on the submiting performa invoice to banks.
b) They collect additional foreign currencv from hawala and black market illegally abroad
and
nrixed it with the pernritted foreign currency by the domesric banks in order to bought
and
import more goods and services.
c) The foreign currency permitted by the domestic banks transfer to the seller bank using
Telegram transferring. or cash against document and Letter of credits.
d) They imported over shipment of goods and services for the same purpose of under
invoicing.
e) The relationship betrveen buyer and selter is a sister/affiliate company to the buyer.

0 They have been established Shell Company intentionally to receive price of the importer
company and to prepare bill of loading, certificate of origin, commercial invoice and other
documents I ike the lega I manu facturer/suppr ier/e.xporter/ company d id.
g) They comnrit tax evasion in domestic market on the imported goods such as Value Added
Tax and income taxes domestically.
r.r. ;l
Page 16 of21

'J
:'i
 xi. Red flag indicators using over invoicing import goods
a) The importers took a permit rvhich contains a more
value of foreign currency from
domestic banks based on submitting performa invoice to banks.
b) The foreign curency permiued by the domestic banks and
transfer to the seller bank
using Telegram transferring, or Cash against document and Letter of Credits.
c) They inrported under shipment of goods and services for the same purpose for
over
invoicing.
d) The relationship betrveen buyer and selter is a sister/affiliate company
to the buyer.
e) They have been established Shell Company intentionally to receive price of the importer
cpmpany and to prepare bilt of loading, certificate of origin, commercial invoice and
other documents like tlre legal manufacturer/supplier/expolter/ company did.
0 They took permit from domestic banks with excess foreign currency,
o\
5t Transfer the foreign qurrency by rvay of Letter of Credit, Telegram Transferring or
cash
against docunrent to the seller bank.
h) The importers bought and imported a little commodity and took excess foreign currency
abroad,
i) They paid excess custom duty in donrestic based on the comnrercial invoice.
j) The seller have a sister /affilia1e company to the buyer,
k) They used techniquc basically conrnritted two typcs of crinres. Such as
' First they transfer illicit financial florv or capital flight to abroad.
' Secondly they commit tax evasion donrestically by rvay claiming refund.

xii. Red flag indicators of multipte invoicing goods

a) The importers took a permit from different banks to transfer a foreign currency more than
once times based on submifting Performa invoice to banks.
b) Transfer the foreign currency by rvay of Letter of Credit, Telegram Transfer or cash
against document to the seller bank,
c) The importers bought a commodity only once.
d) They Transfer foreign currency to abroad again and again for the single commodity.
e) They use nrore tlratr one financial institution to take more foreign currencies,

Page77 of27
 0 They have been established Shell Conrpany intentionally to receive price of the importer
company and to prepare bill of loading, certificate of origin, commercial invoice
and
other documents like the legal manufacturerisupplier/exporter/ company did.
g) They have a sister /aftiliate company abroad.
h) The main purpose is to transfer of i[icit financiat flow or capital flight.

xiii. Red flag indicators for falsified invoicing import goods

a) The importers took a permit from domestic banks rvhich contain some value of foreign
currency based on subnritting performa invoice to banks.
-b) They transfer the foreign currency by way of'Letter of
Credit, Telegram Transfer or cash
against document to th€ seller bahk.
c) The importer bought a commodity with less quality or another conrmodity out of the
invoice,
d) They have been established Shell Company intentionallyto receive price of the importer
company and to prepare bill of loading, certificate of origin, commercial invoice and
other docutnents Iike the legal manufacturer/supplier/exporter/ company did.
e) They have a sister /affiliate company abroad.
0 They paid custom duty based on the commercial invoice.
g) The main purpose of tlris fraudulent action is lo transfer illicit financial florv

xiv. Red flag indicators on fictitious /lPhantom/ invoicing

a) The importers took a pemrit from domestic banks rvhich contain some value of foreign
currency based on submitting Performa invoice to banks.
b) They transfer the foreign currency by way of Lctter of Credit, Telegram Transfer or cash
against document to the seller bank,
c) Even though, the intporters took pcnuit to import goods and services, there are no goods
and services irnported.
d) They used fictitious or phantom invoicing to submit financial institution and national
bank as they intported the goods and services.
e) They have been established Shell Company intentionallyto receive price of the importer
company and to prepare bill of loading, certificate of origin, cornmercial invoice and
other docunrents like the legal manufacturer/supplier/exporter/ company did.

Page
l.x
:*,
1i{
a
r:iffiff
rr.
1"4
 0 They have a sister /affiliate company abroad.
g) The main purpose is transfer of illicit financial flow or capital flight.

xv. Additional red flag on tax evasion

a) The most of customer's comnrercial invoice has been least price.

b) The customer used personal accounts for their business transaction.
c) Most of the Transactions in good and service not fitting rvith companies profile.
d) Some of cash deposits of the tranbaction are not registered as turnover/sales.

xyi. Additional red flag indicators on Illegal..Haryala"

d) The customers frequently send money to differenf persons,.
.
b) The customer received money from abroad and re sends the money to different
customers
c) The customer counts the cash by different tellers
d) The custonrers always transact by cash
e) there is no relationship behveen the originator and the beneficiary

rvii. Additional red flag indicators on Gootls and Currency smuggling

a) 'l'he customer account deposited from the border area banks.
b) Quick deposit and rvithdrarv the cash
c) Transfer money from boarders'bank branches
d) Large cash ransfer and as soon rvithdrarv
e) Cash hansfer within two parties which don't has business relationship
f) Mixing the permitted foreign currency with unpermitted foreign currency to buy and
import more goods or they add more than trvo times foreign currency to the legally
permitted by the domestic bank illegally from hawala and black market.

xviii. tluman traflicking

a) The customers use mobile banking account
b) The customer's account deposited by unknown person or third party
c) Unusual origin of funds
d) Inegularity of cash Deposits

Paga 19 of 2l
 e) cash received fronr countries
which doesn't have business relation
0 Receivables of Foreign currency from the family of trafficking give to the importer
abroad and they receive Ethiopian birr in domestic.
g) They host the smuggling abroad and they collect
Ethiopian Birr from their family
domestically through banks.

xix. Rcd flag indicators on Corruption

a) While the customer is a g,overnnlent employee zurd if he/she deposits
- large amount of
_, rironey
b) Political exposed p"rron op.n u..dunt and transact large arirdunt of money
c) The customer open accounts using third party
d) The customer's opc'n bank account geographical far fronr his4rer resident
e) They may seek lottery winners and give money to the tottery rvinner and then
they collect
money from national lottery authority like they rvin ir.

0 They may collect foreign currency abroad from Ethiopians and they pay to ttre beneficial
owner in domestic lrom the money rvhich obtains from corruption.
g) Thel' ma.v bought foreign currency in thc black nrarkets and transfer
it abroad by the
helping of virtual currency or money mules.
lr) They nray collect foreign currcncies abroad liom the under invoicing sold export goods.

xx. Red flag on different typcs of Frauds

a) The customer uses forgery documents.
b) The customer gives dillbrent inforn,ation to different banks.
c) The customer refused disclosed the infornration to banks.
d) They open multiple accounts in differenr banks and branches.
e) The accounr holder uses rhe third party
0 Some criminals use ntoney mules to open bank accounts to receive money fronr a variety
of unknown individuals or busincsses for knorvn criminal or suspected criminal.
g) They are inherently added layers to the morle). trail/trace/ from a victim to a criminal
actor.
h) They May travel, as directed. to diflercnt countries to open financial accounts or register
conrpanies.

Page?O of 2l
"i

i) They May operate funnel accounts to receive fraud proceeds from multiple lower level
monev nrules.
j) They May try to recruit other money nrute -vou received an unsolicited email or contact
over social nredia promising easy monev for linte to no effort.
k) They use unusual patterns of transaction activity (e.g. volumes, vetocity. structuring to
avoid detection/reporl.ing obligations, source, destination)
l) They ransfer transacrions by anonymous digital currencies.
m) Give money as a loan for those rvho have no moncy in their hands by taking insufficient
cheque as a guarantee illegalll
'Sorne
n) criminals cornrfrit usury hnd they, can get more supports from bank officials in
different ways such as borrorv mone)'to use as usrrry, give advice and hide proceeds of
crime.
o) They can get support by larv enforcement such as investigators and prosecutors including
judges.

xxi. For further information please contact the Financial Intelligence

ccnter:

Phone: 251-l 16394064

Fax:251-l 16394059160
Website address wvw.F IC. sov.et

Postal address: FIC, 2803

Effective date April l5sr 20 t 9

K G/tsedik Hadera
Director General of Ethiopian Financial intelligence center

27 of 2l