The Dormant Account That Woke Up
A non-bank deposit taker has a customer who has held a term deposit account for eight years. Activity was minimal: annual rollovers, occasional interest withdrawals. The customer is a retired NZ resident, risk-rated low, and CDD was last reviewed five years ago. Last month the account received eleven inbound transfers totalling NZ$610,000 from four different overseas senders in three countries, each transfer between NZ$40,000 and NZ$75,000. Within days, $580,000 was transferred out to a single overseas account. The customer's stated occupation and income have not changed. When the branch queried it, the customer said it was 'family money from overseas' and declined to elaborate. The monitoring system flagged the activity at 'medium'.
1. What ongoing CDD and monitoring failures does this scenario reveal, and what does the 'medium' alert rating get wrong?
Read the worked answer
Ongoing CDD failures:
- CDD was last reviewed five years ago. For a low-risk customer, periodic review is still required; the passage of time plus a material change in activity should have triggered a trigger-event review.
- The customer's profile (retired, stable income) is now inconsistent with $610,000 of inbound overseas transfers. Ongoing CDD requires the provider to keep the customer's risk profile and understanding of the relationship current and to detect activity inconsistent with it.
Monitoring failure: the system rated the alert 'medium', but the combination of factors is high risk:
- Dormancy broken by sudden large flows;
- Multiple overseas senders in multiple countries (layering indicator);
- Rapid in-and-out movement ($610k in, $580k out within days) with little economic purpose;
- Unexplained source and an evasive response.
A rules-based 'medium' rating based on amount alone misses the pattern. The provider should apply judgement to override the automated rating, escalate, and reassess the customer's risk rating upward. The alert should be treated as high on the facts.
2. What should the provider do now, including reporting considerations, and what must it avoid saying to the customer?
Read the worked answer
Immediate steps:
- Escalate the alert to the compliance function and treat the customer as higher risk pending review.
- Conduct enhanced ongoing CDD: obtain independent evidence of the source of the inbound funds and the purpose of the outbound transfer; identify the overseas senders and the recipient.
- Reassess the risk rating and update the customer profile.
- Consider whether to restrict or freeze further activity pending clarification, consistent with the provider's procedures and legal advice.
Reporting:
- The rapid in-and-out movement of $610k/$580k through a previously dormant account, with multiple overseas senders and an evasive explanation, is a strong indicator of suspicious activity. A SAR to the FIU should be made promptly.
- Assess whether any prescribed transaction reports are also required (e.g., international wire transfers of NZ$1,000 or more, and cash transactions of NZ$10,000 or more). The overseas transfers here would engage the international transfer PTR threshold.
Tipping off: do not tell the customer that a SAR is being considered or has been filed, and do not reveal the basis of the query in a way that could tip them off. The customer's refusal to elaborate does not relieve the provider of its reporting obligation.