5 December 2014 Confidential FBME Bank Ltd. T ransaction Review and A ssessment W ith Respect to FinCEN's Notice o f Findings dated J u ly 1 5 ,2 0 1 4 December 5 ,2 0 1 4 1 FBME 5 Decemberzon Confidential Table of contents 1. Executive summary. 2. Scope and approach 3' Review Process and Finqus 'rn Response to NOF NOF Statement' "m 2008, an FBME customer received. H. NOF Statemen "Since at \easl early 201 1, the head of an mternahona HI. NOF Statement: 012008. a financier advisorfm a major" W. NOF Statement: "In 2009, FBME iamitated the transfer of over $100,000 . V. NOF Statemen has pmcessed payments for cvbercrime,.." V1. NOF Statemen "Several FBME accounts have been the recipient VH. NOF Statemen facthates U.S. sanctions Evasian. VIH. NOF Statement. October 2011, [he Denartmem uf Justrc . NOF Stalemen just the year "or" April 2013 through Apr" 2014 NOF Statemen was invoNed in at \east 4,500 susuldous. NOF St I XI. 5 eme "From Ju' 2007 In February 2013. at least 71 . Appende A - Results of dDue anaencel Appendix - Transactions Retated tn Tredwell Marketing. Appendix Transactiuns Related to Berkerey Trade. Appendix - Structuring and Surge Wrre Analysis. prendix Customers with Iranran or Svnan Nexus that Transacted with Bank's Address. 2 ram 5 December 2014 Executive summary EV is hereby revismg its DriDi Transaction Review and Wort dated 1' 201410 inciudc corrected mlurmatiorr related to a Notice Di Finding item. The amended information is reflected beiow on page 7, section 3 LA, paragraph 2. By ictler of engagement dated July 30, 2014 Hogan LoveHs US LLP ("Hogan LOVeii5") retained Emst 8 Young LLP or in Connection with the provision 0i ieqai advice to their ciienl' FBME Bank le the "Bank", or [he "Cllent") with tn Nmicc uf Flndings dated Juiy 15, 2014 as by me Frnarmai Crimes Enforcement Network in me reuerai Reglster on Juiv 22, 2014 5 December 2014 Confidential FOIA CONF rm. fir>> mathave mm mm 4m. yer i nullwi 3.55 <<1w or mm>> tun lvdwuaHv remam wen am 5 December 2014 Confidential Review Process and Findings in Response to NOF This Section reviews the eieven statements contained in the nor that are sufficiently specific to allow tor meaninglui review and that HL did not address in the Public Comment tiled in this matter on September 22, 2014. These eleven NOF statements are analyzed below in subsections Each at these subsections provides a summary of EY's findings (subsection A) roliowed by a more detailed discussion or as procedures and findings (subsection and it applicable subsection C). The statements are reviewed in this section according to the order that they appear in the nor. NOF StatemEn "In 2008, an FEME cuslumer received a deposit ol hundreds of thousands ol dollars from a financier Var Lebanese Hezbollaha" A Summary or Findings Following the issuance oi the NOF, FEME performed a screening of entire customer database and all remitting parties named on wire transactions during 2008 against the known iist ol Hezbollah financiers as set forth on the Specially Designated Nationals List maintained by the Treasury Department's Ollice of Foreign Assets Control and other sanctions lists). This exercise was in addition to standard transaction monitoring procedures. EV not identify based on its review of the screening portarmea by FEME any connection between an FEME customer and Lebanese Hezbollah or a known terrorist financing urganizatlnn, A summary of the screening conducted by FBME and reviewed by EV IS provided below (further details are provided in section 3.1 below): - On 08/12/2014 all customers were screened against the SDN List as well as sanctions lists maintained the EU UN, and HM Treasury. The screening yielded one result for an individualh added to the SDN List in May 2014, regular screening process had already iden ied this match in May 2014 at the time the individual was added to the SDN List. The Syrlan program sanctions imposed by OFAC on this individual are not related to Hezbollah and the Bank indicated that th? accounts associated with the entity have been closed or dormant Since 2007/2008. - On 08/14/2014. FBME screened the remitters associated with all 2008 wire transactluns against the SDN List as well as sanctions lists maintained By the E01 UN, and HM Treasury. The Search yielded no matches . On 08/25/2014. FBME also screened its customer list and all remitters, who consisted of customers, associated with ail 2003 erE transactions against the Japanese, Canadian. Australian, and Swiss sanctions lists, The exercise identified three time customers as potential matches against the sanctions list in Australia: however, upon lurlher analysis. Ev round that the dates or birth ior these parties did not match the persons who were ldentilled in the Australia sanctions list. The FBME Compliance Department had reached the same conclusion. in addition to the searbhes which FBME performed, EV performed internet research on a targeted of 52 FEME customers and counterparties highlighted in correspondent bank inquiries during 2008. as weli as the review or the customer tile provided tor a company called RRT Direct Limited (lar 3 The OFAC SDN list utilized in Us review was derived (rpm the Department at Treasury's website on 05/17/2014. 7 rev: 5 December Cominenha' rcasom (1:35:ku Scum hemww These searches am: am ml we'd a hm to HezbaHah or |ermfl5t fine 70 perav ab'e \Mormahm afid Descripfion 0! EV Review Process and 5 December 2014 conlmentual 5 December 2014 continentiai II. NOF stateme . ince at ieast early 2011, the head or an internationai narcotics trauiokino and money iaundering network has used shell companies' accounts at FBME to engage in tinanciai activity. In iate 2012, the head ot the same international narcotics trathckino and money iaundering network continued to express interest in conducting iinancial transactions through accounts with FBME in Cyprus." EY FBME's scrocninq to match the Bank's ciient |iSt(iricitlding UEO mwrmation) to the SDN List as weii as those names assoCIated with a DEA investigation Mat ied t0 OFAC demgnatioiis oi a Lebanese'based drug trarhckino and inoney iaunderino network. EV holed that comparison 0' 'itS customers and remitting parties resulted in no matches to Either the SDN List or Mr DEA investigation iist. Additionaiiy, based upon a mess release on the us Treasury Department's website.'l Ev identitied a totai of 29 parties. incitlding Lebanese narcutics traH'ickm Ayman Joumaa as well as 9 individuais and 19 entities connected to his drug traitickino and money iaunderino organization. EV conducted a starch (or the 29 parties related to the Lebanese drug trafficking network. as identified on the wehsite. aoainsl the iist of account closures. HotScan alerts and correspondent inouiries iroin 2011 and 2012; (I17 .3 \ist Of deciined account openings from 2011 to 2014; the \ist or customer names in Fiexume. and (iv) the Bank's Iraud register horn 2011 to 2014 The reView resuited 'in no matches. Ill, NOFStateme As oi 2005, a financial adwsor tora majortransnat'ionai organized crime figure who banked entirely at FBME in Cyprus maintained a reiationshio with the owners of A. Summary ot Findings Through discussions With tho Bank, --aii FBME Customcr. was identitiod as tho polentiai party reterenced in the NOF. During a routine audit in June 2014. the CBC iound. thiough its independent research. an articio rctoroncihq extradition his ihyoiyeinent in aileged traud and ralsiiyino documents. 4 .qovrgress'rpnter aspx E'i' FOIA CONFIDENTML TREATMENT REQUESTED BY FBME BANK LTD FBME60002455 5 December 2014 Camidenhm 5 December 2014 Communal v' my FDIA CONFIDENTIAL TREATMENT REQUESTED BY FEME BANK LTD FBME00002487 sDecemberzuM . nlidennal 5 December 2014 cunl-aential 5 December 2014 Confidential 5 Detembnr 1014 confidential 5 December 2014 Confidential on Endeavour and Mr. Moody on 1 1 /0 6 /2 0 1 2 yielding no negative results. VII. NOF S ta te m en t: "FBME facilitates U.S. sanctions evasion through its extensive custom er base of shell com panies. For exam ple, at least one FBME custom er is a front com pany for a U .S.-sanctioned Syrian en tity, the Scientific Studies and Research C enter ("SSR C "), which has been designated as a p ro liferato r of weapons of mass destruction. The SSRC front company used its FBME account to process transactions through the U.S. financial system . This SSRC front com pany also shared a Tortola, British Virgin Islands ("B V I") address with at least 1 11 other shell companies, including at least one other additional FBME custom er th a t is subject to international sanctions." A. Sum m ary of Findings In August and September 2014, EY in coordination with FBME conducted a detailed review to attempt to identify the FBME customer alleged by FinCEN to be a front company for the SSRC. In particular, EY reviewed the procedures performed by FBME to screen the entire FBME customer list against sanctions lists including the SDN List. The screening of the FBME customer list yielded no matches. In addition, EY reviewed documentation related to a targeted list of 425 FBME customers using the methodologies described below. EY did not identify through these additional searches any link between an FBME customer and the SSRC. • EY reviewed customer files and related transactions of 9 FBME customers with a BVI address. In particular, FBME informed EY that a Bank customer, Tredwell Marketing Ltd ("Tredwell"), was included on a list of 9 FBME customers provided by the Central Bank of Cyprus to FMBE on 0 8 /0 7 /2 0 1 4 in connection with the Central Bank's request to review those customers' files.7 FBME highlighted Treadwell in particular because the list of customers that the Central Bank provided to FBME included a handwritten comment next to Treadwell that read “SSRC?".8 FBME relayed this information to EY. EY reviewed the documentation for Tredwell as well as 6 other entities that transacted with Tredwell and shared the same BVI P.O. Box address (P.O. Box 3321, Drake Chambers, Road Town, Tortola, BVI) as Tredwell. Based upon a review in August and September 2 0 1 4 of available documentation and transactions, EY did not identify a link between the SSRC and either Tredwell or the 6 FBME customers transacting with Tredwell, with the exception of FBME customer Balec Ventures Limited ("Balec”), which is owned by Issa Al-Zeydi and was identified only after certain additions were made to the SDN List by OFAC on 1 0 /1 6 /2 0 1 4 . (See section B.l below for a description of this review.) • EY conducted internet research on 406 FBME customers with the same BVI address as Tredwell. For purposes of this review, EY obtained from FBME a list of 3 ,457 customers who hold or held a BVI address on file. EY identified 406 FBME customers who maintain or maintained the same P.O. Box address in the BVI as Tredwell. EY performed open source web searches on each of the 406 customers to identify any known connection to the SSRC. Also included in EY's open source web search exercise were the aforementioned customers (8 parties not including Tredwell) on the list generated by the CBC. The open source web searches conducted on the 4 0 6 FBME customers with the BVI address and the 8 additional FBME customers yielded no link to SSRC or Syria per available information and resources. (See section B.2 below for a description of this review.) 7 The additional companies noted were Glascom International Ltd, Delfina International Ltd., Yellow Sunrise Trading, Velcrown Ltd, IK Petroleum, Primo Holding, Morland Group Ltd, and Eveta International. All but one of these accounts are closed. 8 An additional hand-written notation of "SSRC" was identified above a reference to "Syrian Lebanese Commercial Bank". According to the Bank, the account application for "Syrian Lebanese Commercial Bank" was declined in 1997. Based upon the information regarding the declination of the account opening, EY did not conduct a further review of "Syrian Lebanese Commercial Bank". 20 fBME 5 December 2014 • Confidential EY reviewed customer files and related transactions of Petrolium Megatrade Ltd and Petroleum Mega Trade Ltd due to possible matches to a company named on the SDN List known as ‘Megatrade'. OFAC added Megatrade to the SDN List on 0 7 / 0 9 /2 0 1 4 as a Syrian company that operates as a cover for the SSRC. EY observed that FBME received several inquiries in 2006 related to EUR denominated payments for Petrolium Megatrade Ltd, an FBME customer. The inquiries did not specifically mention sanctioned entities but inquired as to the commercial purpose of the transactions and information pertaining to the counterparty. As EY noted a partial match to the recently sanctioned entity was contained in the inquiry, EY reviewed the transactions and customer files of Petroleum Mega Trade Ltd and a company with a slight spelling variation, Petrolium Megatrade Ltd. The UBO of both companies, Fares Haddad, was born in Syria. The account opening application in the file listed a Russian address for Mr. Haddad. Petroleum Mega Trade Ltd is registered in the BVI and Petrolium Megatrade Ltd is registered in Virginia, USA. Based upon a review of available documentation and transactions provided by the Bank, neither company could be linked to the SSRC or the companies recently sanctioned by OFAC (i.e., Piruseti Enterprises Ltd and Frumineti Investments Ltd). (See section B.3 below for a description of this review.) Based upon the reviews and searches conducted above with available information as well as the Bank's screening against World-Check listings, no link was found to the SSRC. EY conducted a further review following additions to the SDN List implemented by OFAC on 1 0 /1 6 /2 0 1 4 . Two of the entities (neither are FBME customers) added to the SDN List on 1 0 /1 6 /2 0 1 4 were Piruseti Enterprises Ltd ("Piruseti") and Frumineti Investments Ltd ("Frumineti”). Two individuals, Issa Al-Zeydi and loannis loannou were designated for acting for or on behalf of Piruseti and Frumineti.9 EY focused on these parties because the press release issued by OFAC at the time of designation indicated that Piruseti and Frumineti were known to have been illicit procurement agents of the Central Bank of Syria and the SSRC. The additions to the SDN List were announced after the close of business hours in Cyprus on 10 /1 6 /2 0 1 4 , so FBME performed screening procedures on 1 0 /1 7 /2 0 1 4 to identify if any of the newly sanctioned parties held accounts with the Bank. Issa Al-Zeydi was identified as the UBO of FBME customers Balec and Argus Construction Ltd (“Argus"). After Issa Al-Zeydi was identified as an FBME customer through the Bank's screening process, the Balec and Argus accounts were immediately frozen on 1 0 /1 7 /2 0 1 4 . The Bank provided to EY the transaction details for both companies to review for any potential impact regarding the NOF items. With the exception of the earlier review that EY performed on the Balec customer file as a result of transacting with Tredwell, the detailed review of Balec, Argus and related companies based on information that only became apparent after the October 2014 changes to the SDN List referenced above, included the following steps: • • • Review of the transaction details related to Balec from account opening through when the account was frozen, as well as a review of the FBME customer file for Balec and FBME accounts that conducted transactions with Balec. Review of the transaction details related to Argus from account opening through when the account was frozen, as well as a review of the FBME customer file for Argus and FBME accounts that conducted transactions with Argus. Review of the 342 non-FBME counterparties who transacted with Balec or Argus, including screening these counterparties against the OFAC, EU, UN, HMT, Australian, Swiss, Canadian and Japanese sanctions lists on 11 /0 4 /2 0 1 4 . This screening did not result in any 9 http://www.treasury.gov/press-center/press-releases/Pages/jl2666.aspx. 21 FBME 5 December 2014 • Confidential matches. Review of the procedures performed by FBME to screen the entire FBME customer list against the above-referenced restricted party lists. This screening did not result in any matches. The results of this review conducted after the October 2 0 1 4 changes to the SDN List are provided in Section C below. Based upon the reviews and searches conducted with available information as well as the Bank's screening against World-Check listings, EY did not identify any connection between FBME customers and the SSRC other than through Issa Al-Zeydi, who was just added to the SDN List on 1 0 /1 6 /2 0 1 4 . B. Description of EY Review Process and Findings Prior to October 2 0 1 4 Changes to SDN List 1. R e v i e w o f C u s t o m e r F ile s a n d R e l a t e d T r a n s a c t io n s o f 9 F B M E C u s t o m e r s w it h a B V I A d d re s s a. T r e d w e ll The Bank identified Tredwell from a list of 9 FBME customers for which the CBC requested past files from FBME on 0 8 / 0 7 / 2 0 1 4 10. FBME noted that on the list received from the CBC. the comment "SSRC?" was written next to Tredwell.11 EY reviewed the documentation for Tredwell, whose account at FBME is currently closed. The file states that Tredwell is registered in the BVI and contains KYC documentation including copies of the former director's (Ruden Nadra) passport and World-Check search results. Ruden Nadra has a Russian passport with Syria noted as the country of birth and a residence address in Moscow, Russia. The file also contains information on the party who received a Share Transfer on 1 2 /0 2 /2 0 1 3 of Tredwell and is also the UBO, Fadel Rubbuz. In addition, a letter of resignation from the former director Ruden Nadra was sent to FBME on 1 2 /0 2 /2 0 1 3 . EY observed that information obtained by the Bank during the on-boarding stage listed Mr. Nadra’s residential address as Moscow and the Share Transfer documents and letter of resignation contain a residential address for Mr. Nadra in Damascus, Syria. The file for Tredwell otherwise contained no references to business transactions involving Syria and contained no information that resulted in matches to the SSRC or any entity subject to international sanctions, except for transactions between Tredwell and Balec. The business profile on file for Tredwell identifies its purpose as trading equipment, home appliances, food, consumer goods, textiles, furniture, as well as marketing and promotion of these products. An additional business purpose is listed on the account application as investments in property estate. Invoices and contracts in the file appear to be consistent with the stated business purpose. An account closure checklist dated 0 3 / 1 9 /2 0 1 4 states the reason for closure as 'transfer to other FBME account'. The account to which the funds were transferred was Armas Marketing Ltd. (“Armas") (see below for findings). Armas is an open account. The account closing process and transfer of funds occurred almost 5 months before FBME received an inquiry from the CBC regarding Tredwell on 10 The additional companies noted were Glascom International Ltd, Delfina International Ltd, Yellow Sunrise Trading, Velcrown Ltd, IK Petroleum, Primo Holding, Morland Group Ltd, and Eveta International. All but one of these accounts are closed. 11 An additional hand-written notation of ‘■SSRC' was identified above a reference to “ Syrian Lebanese Commercial Bank". According to the Bank, the account application for “Syrian Lebanese Commercial Bank" was declined in L997. Based upon the information regarding the declination of the account opening, EY did not conduct a further review of "Syrian Lebanese Commercial Bank". 22 FBME Confidential 5 December 2014 0 8 /0 7 /2 0 1 4 . b. FBME customers sharing the same BVI address as Tredwell EY identified and reviewed the customer files of 6 parties transacting with Tredwell and sharing the same BVI address. As described below, with the exception of Balec which is owned by Issa Al-Zeydi, EY's review of these FBME customers did not identify any matches to an entity subject to international sanctions, a link to the SSRC or business transactions otherwise involving Syria (after August 2011). Entity Name Account Status Closed/Frozen Date Operation Location Beneficial Owner Maribo Group LtdCMaribo") Closed by FBME Compliance Frozen by FBME Compliance Open 04/10/2014 Russia Ammar Jbeili/ Dzhbeyli 10/17/2014 Russia N/A Russia Closed by Customer Open 05/10/2011 Russia N/A Russia Frozen by FBME Compliance 05/29/2014 Russia Balec Ventures Inc (“ Balec") Paramia Limited (“ Paramia") GloBalance Group ("GloBalance”) Sunhouse Consulting ("Sunhouse") Osborn Holdings Inc ("Osborn") UBO City of Residence UBO Passport Country Russia UBO Country of Birth Syria Issa Al-Zeydi Russia Syria Moscow, Russia Anastas Asadov Shapoval Sergey Olga Kozan Russia Russia Russia Russia Belarus Belarus Moscow, Russia Moscow, Russia Moscow, Russia Mikhail Nedogovorov Russia Russia Moscow, Russia Penza Region, Russia A description of information identified by EY in relation to each of these six accounts is set forth below. 1. Maribo: The stated reason for closing the account was ‘DB List Client’ as this customer had a large number of inquiries from Deutsche Bank. An overview of the relevant bank SWIFT inquiries regarding Maribo and Syria are set forth below. These inquiries are unrelated to Issa Al-Zeydi and the SSRC. • An inquiry from JP Morgan Chase, N.A. ("JPMC") sent by Deutsche Bank was for a SWIFT payment of $ 2 5 0 ,0 0 0 on 0 5 /1 1 /2 0 1 2 between Maribo and Mallah Yammine Trading (''Mallah”) and asks about any relation between Syria and Mallah. Following the inquiry, FBME’s Customer Service Department contacted the UBO of Maribo, Ammar Jbeili, to obtain information on Mallah. Email correspondence in the file dated 0 5 / 1 8 /2 0 1 2 from Mr. Jbeili to FBME's Customer Service and Compliance Departments identifies the address and ownership of Mallah. FBME then responded to the SWIFT inquiry by noting as follows: (i) the corporate address of Mallah is Principal Propriety St, Building No. 2 8 0 6 (Wakef Maronite), Muaalem Center, Office No., Kabelias, Almonzania, Lebanon; (ii) the beneficiary's bank should be contacted regarding company ownership; and (iii) the word Mallah has no specific meaning. • FBME received an additional message on 0 5 /2 8 /2 0 1 2 advising that JPMC was still withholding funds to complete the attempted 0 5 /1 1 /2 0 1 2 transaction due to a possible OFAC issue. FBME responded to the additional message on 0 5 /2 9 /2 0 1 2 by stating that Mallah did not have any relation to Syria. This response also gave the names and nationalities of the shareholders (2 Lebanese and 1 Saudi Arabian). • Another inquiry from JPMC for a transaction occurring on 0 6 / 1 1 /2 0 1 2 for $2 1 1 ,0 0 0 was similar to the previous inquiry asking for any relation between Syria and Mallah. FBME 5 December 2014 Confidential FBME's response to the JPMC inquiry stated that there was no Syrian interest in Mallah. • Additional inquiries were received on 0 7 /2 3 /2 0 1 2 for $ 2 7 5 ,0 0 0 and 0 8 /0 7 /2 0 1 2 for $ 1 9 8 ,0 0 0 both of which asked about possible Syrian interests in or relations to Mallah. FBME responded to both of these inquiries by stating that the referenced entity did not have any interest in or relation to Syria. Invoices in the file indicate that Mallah is based in Lebanon. FBME requested confirmation of the address and ownership of Mallah from the UBO of Maribo to include in the response to the inquiry. The inquiry response also stated that Mallah had no specific meaning and no link to Syria. Separate from its review of the bank inquiries described above, EY reviewed the following information and made the following observations in relation to Maribo: 34 • EY conducted a World-Check search and a check against the SDN List for Maribo with no matches. • There is supporting documentation in the file that FBME responded to all received inquiries within a few days of receipt but there Is no indication that FBME refreshed its due diligence checks/updates on Maribo or Mallah. However, the Bank noted that Mallah did not return a full or partial match to any entry on the SDN List. There was activity on the Maribo account through 0 4 /0 2 /2 0 1 4 and Maribo continued to send outgoing payments to Mallah through 1 2 /0 7 /2 0 1 2 . During 2011 and 2012, a total of 8 payments were made to Mallah for S1.7M. • The customer file contained 2 contracts dated 0 8 /1 0 /2 0 1 0 and 0 9 /2 0 /2 0 1 0 between Maribo and a buyer, Husam Alden Farwati Bn Mohammad ("Husam") based in Aleppo, Syria. Invoices in the file dated 1 1 /1 0 /2 0 1 0 and 1 1 /2 0 /2 0 1 0 where Maribo is the seller and Husam is the buyer are for polyester textured yarn. This is consistent with the business purpose of 'textiles' stated on the profile. The dates of the contracts and invoices are prior to the August 2011 issuance of comprehensive Syrian sanctions. • One of the aforementioned invoices to Husam dated 1 1 /1 0 /2 0 1 0 for $1.04M contains a hand written transaction number. Using this transaction number, EY compared the invoice to the transaction details spreadsheet maintained by the Bank and found an incoming transaction for $ 9 9 9 ,9 5 0 five days after the invoice date. The order party on this transaction is Kamal Exchange Co LLC (‘‘Kamal"), a financial intermediary, and the payment details include Husam's name. The address in the transaction details spreadsheet is not the Syrian address found on the invoice but instead a P.O. Box in Amman, Jordan. The transaction went through a correspondent bank in the U.S., DBTCA. EY then reviewed all incoming transactions from Kamal to Maribo and found a total of 4 additional transactions using the address in Jordan: 3 went through DBTCA and 1 went through a non-US correspondent bank. The payment details for the 4 additional transactions can be linked to counterparties found in the file, 2 of which have a Syrian address, 1 a Lebanese address and 1 lists Mr, Jbeili, All transactions reviewed by EY involving Kamal occurred in 2010, prior to the issuance of comprehensive U.S. economic sanctions against Syria. • There are additional transactions totaling $ 1 4 .8M from Kamal between 0 5 /1 0 /2 0 1 0 and 1 1 /1 5 /2 0 1 0 , prior to the issuance of comprehensive U.S. economic sanctions against Syria. EY did not note any transactions listing Syria in the address or related to Kamal after the issuance of comprehensive U.S. economic sanctions against Syria on 0 8 /1 8 /2 0 1 1 . Transaction details provided by FBME are contained in Appendix B. TBME Confidential 5 December 2014 • A response from FBME to a Commerz Bank inquiry stated that there is a relationship between the Ministry of Finance of Russia and Maribo. Maribo signed commission agreements with Russian companies to buy Syrian made consumer goods for the settlement of the debt of Syria to Russia. The outgoing total to the Ministry of Finance of Russia was $ 3 3 .6M and occurred between 0 2 /0 2 /2 0 1 0 and 1 1 /2 4 /2 0 1 0 , prior to the issuance of comprehensive U.S. economic sanctions against Syria. 2. Param ia: There are several inquiries in the file pertaining to Antares Shipping and Forwarding Services LLC and one transaction for $ 1 1 ,5 5 0 on 1 0 /2 2 /2 0 1 0 . The counterparty is similar in name to an entity on the SDN List (Antares Shipping Company). The address of the Antares Shipping Company on the SDN List is Noorderlaan 139, B2030, Antwerp, Belgium. FBME responded to the inquiry with the address of the counterparty which was not the same address as the one related to the entry on the SDN List. A supporting document in the file relating to Antares Shipping and Forwarding Services LLC reflects a legal address in Wilmington, DE. The legal address was confirmed with the Director of Antares Shipping and Forwarding Services LLC, Martin Alberto Lucas. The transaction details for Antares Shipping and Forwarding Service LLC has a beneficiary country listed as Denmark but no other address information. Following FBME's response, the inquiring bank processed the transaction and subsequently closed the inquiry. 3. GloBalance Group: The file contains supporting documents for transactions including invoices and contracts. GloBalance. There are no additional items to note in relation to the file of 4. Sunhouse: The file contains supporting documents for transactions including invoices and contracts. There are no additional items to note in relation to the file of Sunhouse. 5. Osborn: 6. Balec: See section C below for details related to EY’s review of Balec. The file contains supporting documents for transactions including contracts and invoices. There also is a "frozen marker" placed on the file on 0 5 /2 9 /2 0 1 4 for KYC noncompliance. c. O t h e r F B M E c u s t o m e r s a s s o c ia t e d w ith T r e d w e ll EY identified and reviewed the customer files of 2 other parties associated with Tredwell, both of which have a large number of transactions with Tredwell. EY did not identify In its review of these files any connection between these entities and the SSRC, any references to business transactions involving Syria, or other entities subject to international sanctions except for Maritina's transactions with Balec. 25 1. Armas: EY reviewed the file for Armas, an FBME customer whose UBO (Ruden Nadra) is the same as the former director of Tredwell. EY ran a World-Check search on Mr. Nadra and no results were returned. Documentation in the file lists the current residence of Mr. Nadra as Moscow, Russia. The address of Armas is in the Seychelles and the company does not share a BVI address with Tredwell. 2. M aritina: Maritina is a Moscow based company that is registered in the BVI at a different address than Tredwell. The file contains KYC documentation including copies of the beneficial owner's (Elias Aboud) passport, and World-Check search results. KYC documentation in the file lists the residence of Mr. Aboud as Moscow, Russia. Mr. Aboud has a Russian passport with Syria stated as his country of birth. FBME Confidential 5 December 2014 The file contains supporting documents for contracts and invoices related to the transactions conducted between Maritina and its counterparties. Additionally, a Mantas alert was generated relating to a large transaction between Maritina and Tredwell. FBME had previously collected and retained the contract between Tredwell and Maritina supporting large transactions between the two parties. The business profile states that Maritina is involved in real estate, interior design, and apartment renovations and is consistent with the contracts and supporting documents in the file. 2. O p e n s o u r c e w e b s e a r c h e s w e r e p e r f o r m e d o n 4 0 6 F B M E c u s t o m e r s w it h t h e s a m e B V I a d d r e s s in c lu d in g t h e 8 F B M E c u s t o m e r s i d e n t i f i e d b y t h e C B C d u r in g t h e i r J u n e 2 0 1 4 a u d it EY reviewed a list provided by FBME of 3,457 customers who hold or held a BVI address on file. EY identified 406 FBME customers who maintain or maintained the same P.O. Box address in the BVI as Tredwell. EY performed open source web searches on each of the 406 customers to identify any known connection to the SSRC. Also included in EY's open source web search exercise were the aforementioned customers (8 parties not including Tredwell) on the list generated by the CBC. EY did not identify through its open source web searches on the 406 FBME customers with the BVI address and the 8 additional FBME customers any connection between these entities and the SSRC or other entities subject to international sanctions or any references to business transactions involving Syria. 3. R e v i e w o f c u s t o m e r f ile s a n d r e l a t e d t r a n s a c t io n s o f 2 p a r t i e s d u e to p o s s ib le m a t c h e s t o a c o m p a n y n a m e d o n t h e O F A C S D N L is t EY performed a review of 2 other FBME customers, Petrolium Megatrade Ltd and Petroleum Mega Trade Ltd, due to a partial name match with an entity on the SDN List referred to as Megatrade. Based upon a review of available documentation provided by the Bank, neither company could be linked with the SSRC or companies sanctioned by OFAC. In addition, EY did not identify during its review any references to business transactions related to Syria involving these entities. Petrolium M egatrade Ltd: EY reviewed the inquiries received by FBME from Deutsche Bank - Greece in 2006 relating to transactions between Petrolium Megatrade Ltd and Albert Management Ltd (a non-FBME customer). The 8 transactions within the inquiries occurred between 1 2 /2 0 /2 0 0 5 and 1 2 /2 9 /2 0 0 5 and totaled EUR 5,892,167. In response to the inquiries, FBME provided Deutsche Bank - Greece with the registered and business addresses, business purpose and supporting contracts and invoices for the transactions. The contract between Petrolium Megatrade Ltd and the counterparty Albert Management Ltd was for EUR 70M and consistent with the business purpose of the transactions provided by FBME. Petroleum Mega Trade Ltd: EY noted that Petroleum Mega Trade Ltd's account was opened in April 2 0 0 6 and registered in the BVI with a business address listed as Moscow, Russia. The business profile contained within the customer file specifies the business activities as trading in metal sheets, building materials, electronics, plastic materials and other goods as well as investments in real estate. The account opening application in the file listed a Russian address for the UBO (Fares Haddad) and the file contained a Syrian passport for Mr. Haddad. Outgoing, incoming, and internal wire transfers were reviewed for Petroleum Mega Trade Ltd. No outgoing payments to non-FBME customers were identified and two incoming wire transfers were identified for this FBME customer. One incoming wire credited Petroleum Mega Trade Ltd's Euro account for EUR 78,992 and one incoming wire credited the USD 26 FBME Confidential 5 December 2014 account for $390,673. Both wires were remitted to Petroleum Mega Trade Ltd on 0 6 /1 5 /2 0 0 6 from non-FBME accounts titled to Petroleum Mega Trade Ltd. Twelve transfers were identified for Petroleum Mega Trade Ltd to other FBME customers. No incoming Euro denominated transfers from FBME customers were identified, but six outgoing Euro denominated transfers totaled 7 8 ,9 7 0 to other FBME customers were identified. Five outgoing transfers to other FBME customers denominated in USD totaled $3 9 0 ,6 2 2 were identified, as well as one incoming transfer from another FBME customer denominated in USD totaled $100. The incoming USD transfer occurred on 0 5 /0 5 /2 0 0 6 , and the outgoing transfers to other FBME customers occurred from 0 7 /0 6 /2 0 0 6 to 0 4 /1 8 /2 0 0 7 . Transfers were identified from Petroleum Mega Trade Ltd to Petrolium Megatrade Ltd. Two transfers were observed totaling EUR 4 2,485 and one transfer totaling USD 11,656. All three transfers credited FBME accounts titled to Petrolium Megatrade Ltd. These transfers occurred from 0 8 / 2 3 /2 0 0 6 to 0 4 /1 8 /2 0 0 7 . The following FBME customers received transfers from Petroleum Mega Trade Ltd and had addresses in Tortola, BVI: Am ount Simrik Oil Company Ltd Matrix Continental Ltd Kunal Trading Ltd $ 3 0 0 ,0 0 0 $ 5 6 ,9 6 6 $ 1 0 0 ,0 0 0 D ate 0 7 / 2 6 /2 0 0 6 0 8 /1 8 /2 0 0 6 0 5 / 0 5 /2 0 0 6 All three FBME customers have addresses in the BVI. However, no customer's address exactly matched Petroleum Mega Trade Ltd’s address on file: 90 Main Street PO Box 3099 Road Town Tortola, VG. C. List Description of EY Review Process and Findings A fte r O ctober 2 0 1 4 Changes to SDN 1. R e v i e w o f c u s t o m e r f ile s a s s o c i a t e d w it h t r a n s a c t io n s f o r B a le c The account for Balec was opened on 12 /0 4 /2 0 0 6 . The UBO of Balec is Issa Al-Zeydi. Balec's account was immediately frozen on 1 0 /1 7 /2 0 1 4 after Issa Al-Zeydi was added to the SDN List. Issa Al-Zeydi is the sole ultimate beneficiary on the account, holds a Russian passport, was born in Syria and maintains a Russian address. A review of the Balec file revealed identification documents for Issa Al-Zeydi in the form of a Russian passport. The passport indicated that Issa was a Russian citizen and was born in Syria. Issa Al-Zeydi also listed his personal residence address as Moscow, Russia. A review of the transaction details related to Balec from account opening through when the account was frozen yielded the following: • Balec conducted 2,037 USD transactions from 1 2 /0 5 /2 0 0 6 to 0 7 /1 8 /2 0 1 4 with 50 entities and individuals who are or were FBME customers totaling $ 255,399,350. • Balec conducted 1,711 USD transactions from 1 2 /0 4 /2 0 0 6 to 7 /1 7 /2 0 1 4 with 342 nonFBME counterparties totaling $252,571,203. Balec is registered at P.0. Box 3321, Drake Chambers, Road Town, Tortola, BVI and maintains an 27 FBME Confidential 5 December 2014 operating location at Office 31, House 14, Gubkina Street, Moscow, Russia. The business operates in the dealings of securities and shares and has reflected an expected turnover on the account of approximately $ 1 0 ,0 0 0 ,0 0 0 annually since account inception. In addition to the business operations listed in the company's business profile, Balec is part of a number of contracts for the wholesale trade of goods including textiles, steel, construction equipment supplies and other goods. EY reviewed the customer file and it did not contain any contracts, transaction information, business relationships or invoices related to Syria (after August 2011) or with the SSRC or any party who was named in the October 2 0 1 4 OFAC press release other than Issa Al-Zeydi. The file contains numerous inquiries from correspondent or other transacting banks with multiple references to counterparties potentially subject to OFAC sanctions but unrelated to Issa Al-Zeydi or the SSRC. One inquiry from JPMC with respect to a SWIFT payment on 0 8 /2 7 /2 0 0 8 between Balec and Cesar Group states that the name of the counterparty was similar to a name on the SDN List (Caesar's Park Hotel, which was designated under the SDNTK program). FBME responded to this inquiry with information regarding Cesar Group, including company purpose and location. Another inquiry referencing the same counterparty was received from the correspondent Deutsche Bank for a SWIFT payment on 1 0 /0 7 /2 0 1 0 . FBME responded to this inquiry with details on the beneficial owner. The transaction details list Lebanon as the address for Cesar Group. The file contains due diligence documentation including counterparty details, invoices and contracts from 2006 to 2014. EY could not find any correspondence with the client in the file regarding the possibility of a counterparty being subject to OFAC sanctions. Also contained in the file was a Mantas alert and documents supporting the business purpose of, and transactions related to, Balec. A Mantas alert was generated on 0 2 /0 5 /2 0 1 4 for high risk counterparty transactions and large reportable transactions. The Mantas report investigation states that the remitters involved in the transactions in question are known to FBME and the remitters had already been investigated by the FBME Compliance Department as the counterparties were declared by the customer on his business profile. The file also contains supporting documentation from the client as requested by the Bank. EY also noted from the file that the source of incoming funds on the account opening application lists several entities including Maritina, a company that transacts frequently with Tredwell (see above). 2. R e v i e w o f c u s t o m e r f ile s a s s o c i a t e d w it h t r a n s a c t io n s f o r A r g u s The account for Argus was opened on 0 4 /1 8 /2 0 1 2 . Argus is a subsidiary of Balec and its UBO is Issa Al-Zeydi. Argus' account was immediately frozen on 1 0 /1 7 /2 0 1 4 after Issa Al-Zeydi was added to the SDN List. A review of the transaction details related to Argus from account opening through when the account was frozen yielded the following: • Argus conducted twelve EUR transactions to either Balec or one other FBME customer, Taurus Equipment Limited ("Taurus") from 0 3 / 1 1 /2 0 1 3 to 0 5 /0 5 /2 0 1 4 . Eleven of the twelve transactions were between Balec and Argus. • Argus conducted a total of eleven USD and EUR transactions to accounts which it holds with other banking institutions from 1 1 /2 7 /2 0 1 2 to 1 1 /2 2 /2 0 1 3 .12 Argus has a registered address at P.0. Box 556, Main Street, Charlestown, Nevis, St. Kitts and Nevis, and maintains an operating location at Office 1, Floor 5, 1 Sharikopodshipnikovskaya Str, Moscow, 12 Argus also holds accounts at GAZPROMBANK and UNIVERSAL CREDIT OPEN JOINT STOCK COMMERCIAL BANK. 28 FBME Confidential 5 December 2014 Russia (having previously operated out of 14-6 Gubkina Street, Moscow, Russia). The business operates in the buying and selling of construction materials and equipment and noted expected turnover in 2 0 1 4 to be approximately $ 1 ,500,000. EY reviewed the customer file and it did not contain any contracts, transaction information, business relationships or invoices related to Syria (after August 2011) or with the SSRC or any party who was named in the October 2 0 1 4 OFAC press release other than Issa Al-Zeydi. 3. R e v i e w o f a c c o u n t f ile s f o r c u s t o m e r s w h o t r a n s a c t e d w it h B a le c o r A r g u s EY reviewed the account files for the fifty FBME customers who transacted with either Balec or Argus in order to identify any matches to the customer associated with NOF items. These fifty customer files were reviewed and EY did not identify any active FBME accounts reflecting signatories or beneficial owners maintaining current Syrian addresses on file with the Bank. In addition, no active accounts reflected current Syrian operating addresses on file with the Bank. No file contained any contracts, transaction information, business relationships or invoices related to Syria (after August 2011) or with the SSRC or any party who was named in the October 2 0 1 4 OFAC press release other than Issa AlZeydi. The following trends for these customers are noted below: a. Common Operating Address The physical operating addresses associated with the fifty FBME customers were reviewed to identify any potential links to the SSRC or other sanctioned entities per the NOF items. Balec lists its physical business address as 14 Gubkina St., Moscow, Russia, 117312. Sixteen of the fifty FBME customers also list the same street address in Moscow, Russia as their physical business address. No link to the SSRC or activity subject to international sanctions was identified outside the link to Issa Al-Zeydi via the 14 Gubkina St., Moscow, Russia address. b. Common Account Referrals Argus was referred to the Bank by Balec as it was a subsidiary of Balec per account documentation. Balec was referred to the Bank by VICO Ltd, a company whose signatories were listed as Imad Khuri and Mudalal Khuri. Of the fifty FBME customer accounts reviewed, twenty-two FBME customers were also referred to the Bank by VICO Ltd and/or vouched for by Imad or Mudalal Khuri. In addition, fourteen of the fifty FBME customer accounts reviewed reflect that an individual with a surname of Khuri, Khoury or Khouri was the beneficial owner or signatory on the account. VICO Ltd had a registered address in Homs, Syria and maintained FBME's address (90 Archbishop Makarios III AVE, P.O. Box 25566, 1391 Nicosia, Cyprus) as its correspondence address, but did not transact with any external party from 1 1 /0 2 /2 0 0 9 to 0 1 / 1 7 /2 0 1 4 (date of account closure). The only account activity for VICO Ltd during this timeframe was fees and payments against FBME issued credit cards. No link to the SSRC or activity subject to international sanctions was identified outside the company's link to Issa Al-Zeydi. c. Transactions between Balec and Hesco Engineering and Construction Co. EY observed USD transactions from May 2013 through August 2013 between Balec and Hesco Engineering and Construction Co ("Hesco"). While Hesco is an FBME customer, EY's review did not identify any connection between Hesco and Issa Al-Zeydi (outside of the Balec relationship), the SSRC or any other entity subject to international sanctions. The account file for Hesco reflected Building No. 2, Jijara Street, Damascus Syria as its business address and was updated to Office 185, 1 Kaluzhskaya Square Moscow, Russia. Hesco is registered in London, UK according to the customer file, FBME's internal systems and the Companies House Direct 29 FBME Confidential 5 December 2014 listing for Hesco. A letter from Hesco to FBME dated 0 3 / 0 6 /2 0 1 3 stated that its office in Syria was closed in 2011 and the company now operates out of Moscow, Russia. This letter was signed by one of the two beneficial owners of Hesco, Youssef Arbach, a national of Russia who resides in Russia. The other beneficial owner of Hesco is Georges Hesswani who (based on the Companies House Direct listing for Hesco) is a national of Russia with a Russian passport who, at the time of his appointment, maintained a residence in Syria. An updated document provided to the Bank on 0 3 /0 6 /2 0 1 3 reflects that Mr. Hesswani now resides in Russia. The company website for Hesco identifies that the company conducts business activities in Syria, as well as other countries including Russia.13 The company's business profile in January 2 0 1 4 reflects expected transactions with several of the same entities as the version from February 2009. Several of the contracts and transactions on file reflect business agreements with Russian entities from 2008 through 2 0 1 4 and are notated in Russian. An annual return from an entity identified as 'Companies House' notes an electronic filing on 0 9 /1 9 /2 0 1 1 and the service address for Hesco as Syrian. d. Additional Observations EY performed open source web searches on a population of 196 of the 342 non-FBME counterparties who transacted with Balec or Argus in order to identify potential connections with NOF items. The population of 196 individuals and entities consisted of counterparties who transacted with Balec or Argus in USD totaling $1 0 0 ,0 0 0 or more since the accounts were opened on 1 2 /0 4 /2 0 0 6 . The remaining counterparties transacted in minimal amounts and had no more than 12 transactions over the same timeframe. As described below, the searches conducted on the 196 counterparties yielded negative news results for two entities, but did not yield a known connection to Syria, the SSRC or other entities subject to international sanctions: • Q uartell Trading Ltd ( “Q u artell") Quartell, a company registered in the BVI, and Nomirex, a company registered in the UK, were involved as intermediary offshore companies for the movement of funds as a result of a 5.4 billion ruble (USD 230 million) Russian tax fraud. A false tax refund was filed on behalf of Hermitage Capital Management on 1 2 /2 4 /2 0 0 7 , and the refund was granted on the same day to individuals identifying themselves as officers of Hermitage Capital Management. The funds from this false return were then transferred to various offshore entities including Quartell and Nomirex.14 From a review of open source media, it appears the funds received by Quartell were transferred to Baikonur Worldwide Ltd, which in turn transferred the funds to a Cyprus company, Arivust Holdings Ltd. A review of FBME's internal systems did not indicate that Arivust Holdings Ltd or Quartell were customers of the Bank. • Nomirex Trading Lim ited ( “N om irex”) Nomirex was incorporated by Meridian Companies House Ltd, whose director is Erez Mahara. According to public media, from 2 0 0 7 to 2009, Nomirex filed annual reports with UK regulatory authorities indicating that it had a balance of zero. The director of Nomirex 13 Website for Hesco Engineering & Construction Co: http://www.hescoco.com/. 14 Media sources which identified these counterparties are as follows: Nomirex: http://online.barrons.com/articles/SB50001424052970204569604576259313266852054 Quartell: http://www.stuff.co.nz/business/8029015/Fears-sheil-company-supergrass Tax Fraud: http://www.forbes.com/sites/kellyphillipserb/2013/07/17/dead-men-tell-no-tales-deceased-russian-lawyer-foundguilty-of-tax-evasion/ US Reaction to Fraud: http://www.forbes.com/sites/kenrapoza/2013/02/ll/billion-dollar-hedge-fund-mgr-goes-after-putinand-russia-this-time-in-europe/ 30 FBME EY Building a b e tte r working world FOIA C O N FID EN TIA L T R E A T M E N T R E Q U E S TE D BY FBME BANK LTD FB M E 00002505 5 December 2014 Confidential has been identified as Cypriot Lana Zamba. Neither Nomirex, Erez Mahara nor Lana Zamba were identified as customers of FBME. Ouartell was the remitter associated with four USD transactions to Balec totaling $ 2 ,0 3 2 ,1 6 0 from 0 1 / 2 5 /2 0 0 8 to 0 2 /1 3 /2 0 0 8 . Nomirex remitted one USD transaction to Balec totaling $2 3 4 ,4 4 8 USD on 1 2 /2 4 /2 0 0 7 . The negative news identified for the counterparties transacting with Balec was only available as early as 2011 and would not have been available for FBME to document at the time the transaction activity with Balec occurred. A review of the search results for the 196 counterparties did not yield a link to the SSRC, Syrian transactions (after August 2011), any entity or individual associated with the October 2 0 1 4 OFAC press release or other activity subject to international sanctions. VIII. NOF S tatem en t: "In October 2 0 1 1 , th e D epartm ent of Justice ( “D O J") filed civil fo rfe itu re complaints against approxim ately $ 7 0 .8 million in real and personal property alleged to be the proceeds of foreign corruption offenses p erpetrated by the President of Equatorial Guinea, Teodoro Obiang’s son and his associates and laundered through th e United S tates. Subsequently, between Decem ber 2 0 1 1 and July 2 0 1 2 , th e Treasury of Equatorial Guinea wired over $ 4 7 million to several Cypriot banks and entities in a p attern of transactions th a t was identified as being consistent with the allegations in the DOJ com plaint. This included $ 7 .2 million wired to a British shell company using an FBME account." A. Sum m ary of Findings EY reviewed documentation related to Berkeley Trade LLP ("Berkeley"), the FBME customer identified as the recipient of a payment of $7 ,2 5 8 ,3 8 5 from Tresor Public, the public treasury department in Equatorial Guinea, on 0 2 / 1 2 /2 0 1 2 for the purpose of building the Malabo Highway to the airport in Equatorial Guinea. Through review of the customer file, EY noted that FBME had collected and retained due diligence documentation relating to a construction contract between the government of Equatorial Guinea and Berkeley. FBME also collected KYC documentation at the time of account opening for Gimmy Ricci. The documentation shows that Mr. Ricci owns an Equatorial Guinea-based construction company and is the UBO of Berkeley. Supporting documents also include a project materials breakdown, business plans, newspaper articles relating to Mr. Ricci and the construction project, and pictures of the construction site. Based upon a review of available documentation, no link could be found between the funds transferred to Berkeley from Tresor Public and proceeds of foreign corruption offenses perpetrated by the President of Equatorial Guinea, Teodoro Obiang's son and his associates. B. Description of EY Review Process and Findings EY reviewed the civil forfeiture complaints referenced in this NOF statement. EY also reviewed the customer file and transactions related to Berkeley. Additionally, EY reviewed documentation and transactions of additional companies related to Berkeley, including AB Systems and SFX International, as Mr. Ricci is the UBO of each of these entities. Based upon a review of available documentation, no link could be found between the funds transferred to Berkeley from Tresor Public and proceeds of foreign corruption offenses perpetrated by the President of Equatorial Guinea, Teodoro Obiang's son and his associates. EY's review of the business profiles and KYC documentation related to Berkeley, AB Systems and SFX International is described below. 31 FBME 5 December 2014 Cnnlidenfial mmunkw-ww mm nmv'rC--mm Wm mum um i" mum, ifl'umilhuw veg." ram: a NOF statement In rust ttre year 1mm Aprli 2013 lhraugtr Auril 2014, rams conducted at least $357 million in wire transiers through the u.s. irnancral system that exhibited lnaraators at high-risk money laundering typologies, including widespread sheli :ompanv activity, snort-term "surge" wire actnrity, structuring, and hlqn-risk business customers" A. Summary nl Findings in urnor to address Nor Ev renewed the Bank's wiiC tlallsicr detali irom 04/01/2013 through 04/30/2014 mi 5" di'JiW amounts, dormant atmuhffi aim accounts and div-tied trle av tour types tluttutlng, surge activityl hiqh'iISR customers rind Shi'li Companies AS holed in the Eaiik' response tu "Assessment FBME Be'rrik Ltd's Ahtr Money Laundering iAMLi/Sanrtruns arograrn' dated 09/22/2014, trre Bank ls taking a numner or steps to entrance eonrpiruner>> program For oxampin, tne Bank 'Ins advised that lt is currently worilng Oiricie tn upgiadi' tne >>.urlenl versron oi Manlas aim tu two new stenar'm carnnat'lng and etasranr and the go ilve date is the End of Match 2015 - Structuring: ahaiyws uf lidhkai'fin'ls idL'ntifif'd 40 FBME exhibiting palartl'iai Sliutlulihf} Di'iIaViUi ALtDiqu FEMC the Bank hd9 iifll munltured ier structuring, as FBME does not transart rn phyucr)' 'in Cynrus and 'Ielther Us, rim regulatory cpl/9r vnre transters strueturrng behavim EV Uimmstaiids that FBME is enhancing its AML (omniiani'o program [0 add a siiuctui stenarru for transiers EV [Ohflutled a review or transattlons assuoated wrin tile 40 parties and oilserved trial Mahiax and or HUtSrah aiWiS had qchl'iated for 13 n' lhE IlidiCSy these alerts were not in response to the slietlir: trarlsattlurls ill Ev's il'viPW. Further details 0' the analysis dre' in Appendix . surge activity: EV 15 Dailies associatud with potential surge arliVily. at these 15 parties, Ev ttrat 12 rrarlres trad prevruusly generated Manta; or HolSmn alerts on [ital Mre part or tile aierts identified by Ev Furtircr doiaris or the surge are iilciuded rn Appendix or raw has estalrirsilud trrteria ior 5 December 2014 Confidential addressing activity related to surge activity and captured 80% of the parties related to EY sampled transactions in their standard Mantas/HotScan processes. • B. High-risk and shell company indicators: According to FBME, the Bank addresses the risk and activity associated with its customer base through conducting initial due diligence at account opening and ongoing due diligence for all FBME customers. FBME customers are also designated as high or normal risk. High risk customers are subject to enhanced compliance screening/monitoring. Customers can be designated as high risk if they operate out of a high risk jurisdiction among other factors. EY's assessment of the process in which FBME conducts due diligence for customers is provided in the "Customer Identification and Due Diligence” section of EY's "Assessment of FBME Bank Ltd's Anti-Money Laundering (AML)/Sanctions Compliance Program” dated 09/22/2014. Description of EY Review Process and Findings 1. Structuring Scenario The Bank's monitoring software does not currently contain a structuring scenario but EY understands that FBME is enhancing its AML compliance program to include such a scenario for wire transfers. For purposes of this review, EY established the range of $7,000 to $10,000 to be the structuring typology thresholds. Two or more transactions within this value range for the same party, within a time frame of two weeks or less could pose higher risks to institutions as the parties may be attempting to conduct transactions in a way that avoids a perceived threshold on wire transactions (i.e., cash transactions in the United States over $10,000 reportable in a Currency Transaction Report), EY obtained from the Bank a listing of all USD denominated transactions between $7,000 and $10,000. To identify higher risk structuring transaction patterns, all incoming and outgoing instances where a customer transacted in 3 or more round USD transactions (i.e., 8,000; 9,000, etc.) were sampled In addition to all customers who were involved in 40 or more $7,000 to $10,000 transactions during the period of review. These criteria cover approximately 25% of FBME's population of $7,000 to $10,000 transactions and identify the higher risk transactions associated to 92 customers of FBME. EY conducted a manual review of the transactions associated to the 92 parties identified under the structuring scenario. According to FBME, the Bank does not transact in physical currencies in Cyprus and no regulatory requirement in the country exists to monitor wire transmittals for patterns of structuring behavior. Nevertheless, monitoring for patterns of activity that reflect structuring type behavior is in line with US regulatory expectations and US industry practices. As a result, FBME may continue to find itself in a position where exposure to such activity through US correspondent banking activity may result in future inquiries or missed monitoring of irregular transaction activity through structuring type behavior. Each customer transaction was reviewed during the time period noted above to identify if: • • • The same counterparties are involved in the transactions; The time period between round dollar transactions was two weeks or less; and There was limited documentation in the payment details to support various transactions (i.e., references to invoices, agreements). Off the 92 parties, 40 were subjected to additional review due to meeting these criteria. Certain trends and additional information identified during this review are provided below: • 34 Of the 40 parties, 13 had transactions that were previously identified in HotScan alerts and 4 were previously identified under Mantas alerts (see Appendix D). These Mantas and HotScan alerts did not result in the submission of any STRs with MOKAS in 2013 or 2014 FBME 5 December 2014 Confidential and all of the Mantas and HotScan alerts were closed clear. Although the alerts were closed clear, none of the alerts in Mantas or HotScan were generated based on the transactions included in this review. Through discussions with FBME, the Bank represented that their accounts are mostly corporate in nature, and many of their corporate clients deal in larger transactions in addition to the transactions noted in this structuring scenario review. The Bank added that these accounts are large in nature; smaller transactions are uncommon and structuring scenarios have not been implemented to test for these types of transactions. The Bank indicated that there is no threshold for reporting wire transactions in Cyprus, but there are capital controls for transferring funds out of Cyprus. - An assessment of capital controls assessed through "The Enforcement of Restrictive Measures on Transactions in case of Emergency Law of 2013" indicated that during the period of review starting in April 2013, payments to other credit institutions for transactions that fall within the normal business activity of up to EUR 25,000 per day are not subject to any restrictive measures. The threshold for transactions that fell within the normal business activity throughout the period of review increased from EUR 25,000 ending with EUR 1,000,000 as the minimum threshold for reporting in April 2014. FBME provided detailed information regarding a sub-sample of two customers noting that no approval would have been needed for the outgoing payments involving those customers for transactions that met the criteria for review. Given the criteria noted above to assess structuring against perceived U.S. thresholds for wire transactions under $10,000, it does not appear that Cyprus capital controls during this period affected the parties and transactions associated with this portion of the transaction review. » Of the 40 parties, 5 were classified by FBME as high risk clients. All 6 maintain active accounts with FBME and two of the parties had transaction details referencing payments for contracts or loan agreements. Three of the customers were part of previous HotScan alerts and two of the customers were part of previous Mantas alerts, but none of these alerts related to the transactions associated with this portion of the transaction review. • To gain a better understanding of the transactions for risk of structuring behavior, EY provided FBME with the transactions and parties associated with 5 of the 40 customers noted under the criteria listed above. FBME was able to provide detailed information for 4 of the 5 parties and their associated transactions noting that; • 35 a Non-internal transactions were supported by invoices and explanations from the customer that the round amounts were due to down payment 'prepayments' of the total amount as per the contract. o Round dollar amounts were mixed in with contextual transactions that were non-round and over $10,000 and the business profile was consistent with the explanation in the wire details. o One customer noted for round dollar amount transactions that they were charges of $1,000 per day for consultancy services, which explained the round amounts invoiced monthly. o A beneficial owner of a customer performed two payments on the same day: one for covering living and working expenses in South Africa and a second payment for family and personal expenses (private expenses in the UK) and savings. For one party, BATSI AND SON LIMITED, no information could be found to explain the two $8,000 transactions received from the same party within a week of each other. FBME 5 December 2014 Confidential 2. Surge Activity Scenario FBME provided EV with an understanding of how the current rapid movement of funds scenario is run within their automated monitoring system to identify alerts for transaction activity. For new clients (less than a year old), the Bank implements a minimum threshold of $50,000 for an alert to be triggered. The threshold for established customers is $250,000. In addition, any transaction activity that would result in an amount that is 50% or greater of the balance of the account or the net worth identified for the customer would also trigger an alert under this scenario. EY utilized this information and identified all round dollar transactions for $100,000 or greater to assess the riskiest transactions in the overall transaction population for the period of review. Most of the clients identified are established, but setting the threshold at $100,000 helps identify those transactions that may make up 50% or more of net worth for the Bank's smaller clients and individual base. This threshold was applied to the US correspondent, Deutsche Bank - New York as this US correspondent bank processed the most USD transactions during the period of review. As explained above, all round USD transactions for $100,000 or more involving Deutsche Bank - New York make up the population of transactions identified for potential short-term surge activity involving a US financial institution. An initial sample was conducted to identify customers who were involved in 10 or more transactions during the period of review as the number of transactions could represent spikes from expected activity. These criteria cover approximately 41% of the population and identify the higher risk transactions for 59 customers of FBME. A review of the 59 parties resulted in a consolidated number of 51 due to duplicates caused by spelling variations or parties who were part of both incoming and outgoing transactions that met the criteria listed above. A manual review of the transactions associated with the surge activity typology was used to identify instances where funds may have rapidly moved through an account in a manner that is not consistent with previous activity and/or the customer's business profile. All of the transactions falling within the review period for each of the 51 customers were reviewed to identify if: • The transactions occurred over a short period of time (i.e. two weeks or less); • There were any repeating parties receiving or sending the funds moving through the account; • There were instances where outgoing and incoming transactions were identified for the same customer; and • There was limited documentation in the payment details to support various transactions (i.e., references to invoices, agreements, etc.). Fifteen parties were identified as meeting these four criteria and having minimal information on file to support the relevant transactions. The following trends and additional analysis were observed by EY: 36 • Of the 15 FBME customers who met the criteria above, 12 were associated with transactions that were previously identified in HotScan alerts and 6 were previously identified under Mantas alerts which makes up 80% and 40% of the sample respectively (see Appendix D). These Mantas and HotScan alerts did not result in the submission of any reports to MOKAS in 2013 and 2014 and were closed clear. • Of the 51 customers, 20 held closed and dormant accounts and 14 of these were flagged by FBME Compliance in Flexcube. These markers indicated that the accounts were subject to monitoring, restrictions by the correspondent bank or needed file updates, or that FBME 5 December 2014 Confidential closure was requested by the FBME Compliance Department. Out of the 14 accounts marked, one customer did not alert in either Mantas or HotScan. • Of the 51 FBME customers identified in the sample, 9 were classified by FBME as high risk customers (approximately 18% of the group). All 9 high risk customers had transactions that alerted previously in either HotScan or Mantas and all alerts were closed. Five of the customer accounts remain active while 4 are dormant. The 4 dormant accounts have been noted by the FBME Compliance Department for monitoring or have been designated as a party restricted by a correspondent. 3. Shell Company Activity FBME conducts initial due diligence at account opening and ongoing due diligence for all FBME customers. This process includes identifying the source of wealth, obtaining a business plan, conducting World-Check searches on relevant parties, screening relevant parties against sanctions lists, identifying the UBO of corporate customers, and conducting internet searches of relevant parties for negative media. UBO information is obtained for every corporate customer. All FBME customers are also designated as high or normal risk (see below). FBME's process for conducting customer due diligence is further described in the "Customer Identification and Due Diligence" section of EY's Assessment of FBME's AML/Sanctions Compliance Program as previously submitted to FinCEN. 4. High-Risk Business Customers FBME internally designates customers as either normal or high risk at the inception of the client relationship. High risk customers include the following as defined by FBME: • • • • • • • • • Non-face-to-face clients Companies with bearer shares Trusts and foundations Client/pooled accounts Politically Exposed Persons (PEPs) Correspondent accounts for a bank outside of the European Union Customers from high-risk jurisdictions Private banking customers (e.g., Investment Desk clients) Clients involved in electronic gambling/gaming FBME performs periodic due diligence on all customer accounts. High-risk customers are reviewed annually and normal-risk customers are reviewed every three years. All high-risk customers require approval (sign-off) from the MLCO or Alternate MLCO prior to account opening. Further, the MLCO must approve any downgrades from high to normal risk. This review process for high-risk customers can be found in the "Enhanced Due Diligence" section of EY's Assessment of FBME’s AML/Sanctions Compliance Program as previously submitted to FinCEN. FBME monitors transactions of high-risk customers via HotScan. The names of high-risk customers are manually uploaded into HotScan. Suspicious transactions are reviewed in accordance with the process described in the EY AML/ Sanctions Program Assessment. This information can be found in the "Alert Investigations" section of EY's Assessment of FBME's AML/Sanctions Compliance Program as previously submitted to FinCEN. X. NOF Statement: “ FBME was involved in at least 4,500 suspicious wire transfers through U.S. correspondent accounts that totaled at least $875 million between November 2006 and March 2013. The FBME customers involved in these wire transfers exhibited shell company attributes, and other financial institutions involved in the transfers reported that they were unable to verify the identities of FBME's customers. A lack of transparency for such significant wire activity involving 37 FBME 5 December 2014 Confidential FBME's customers makes it extremely difficult for U.S. and other financial institutions involved in these transactions to verify the bona tides of all of the parties to these transfers." A. Summary of Findings FBME provided EY a listing of all US correspondent bank inquiries from November 2006 to March 2013. Inquiries related to 13 FBME clients and $820,327,652 in transactions, as well as 14 non-FBME counterparties who were identified as the remitters of the activity were examined in greater detail as noted in section B below. FBME responses to the inquiries provided business information and a purpose for the transactions that appeared to be consistent with 12 of the 13 customers' business profiles reviewed by EY. One customer did not have a business profile on file at account inception as, at the time the account was opened, FBME's account opening forms did not have a separate business profile section. However, the business profile was obtained during a subsequent KYC update. The FBME companies' business profiles at account inception were supported by contracts or agreements between the customers and the counterparties who were identified in the inquiries. As noted below, other negative information and suspicious behavior were noted by the Bank in some cases and resulted in FBME closing 3 accounts. B. Description of EY Review Process and Findings Of the total number of correspondent inquiries identified by FBME, JPMC was identified as the primary US institution for 175 and requested information from FBME for transactions incoming to FBME customer accounts which totaled $820,327,652 from 01/28/2008 to 12/19/2008. This dollar value represents approximately 47% of the value for all transaction inquiries sent to FBME that year ($1,743,074,977). An additional 60 inquiries were identified from Dresdner Bank - New York in 2007 that aggregated to approximately $3.5 million. A total of 13 customers of FBME were associated with the $820,327,652 in US correspondent transactions15 as well as 14 non-FBME counterparties17 (remitters of the transactions). EY requested the customer files for all 13 FBME parties associated with the US correspondent banking transactions. Within these files, EY reviewed the inquiry questions and FBME responses for transactions covering $452,119,434 or approximately 52% of the amount referenced in the NOF, 1. Trends identified in review of customer files The following trends have been identified for the accounts and US correspondent transactions noted above: • FBME response times to JPMC correspondent inquiries ranged from 12 to 41 days, with responses for 10 of the 13 customers occurring after 14 days. In some instances, e-mail correspondence from JPMC providing the inquiry occurred after the date noted on the 16 FBME Clients Receiving Transactions INVESTMENT LIMITED, ROYAL WINNER ALLIANCE CORP., PARAGRAPHICS Ltd, GLOBAL INC, BERMONALT SERVICES INC, through JPMC Correspondent Banking: ZENITH HOLDINGS GROUP LIMITED, QUANTUM TRADING LIMITED, FANTFO INVESTMENTS LIMITED, ECO FINANCIAL INC, PREVENTOR CONIX COMPANY, STRATEX ALLIANCE Ltd, SEOMEST DEVELOPMENT INC, ROTAVEST MELTOVERT GROUP INC. 17 Non-FBME Counterparties Remitting Transactions through JPMC Correspondent Banking: LLC MICRON, NORMA LLC, LLC PEGAS, RENAISSANCE CAPITAL INVESTMENT MANAGEMENT Ltd, FOND SB, FOREKS, VENERA Ltd, BAGULNIK Ltd, IMPLANTA ZAO MOSCOW, OUADRO-TRANS Ltd, INTER 0 0 0 , TROIKA Ltd, TECHCAPITAL Ltd, ADORY Ltd. 33 FBME 5 December 2014 Confidential formal inquiry document. Responses to inquiries provided business information and a purpose for the transactions that appeared to be consistent with 12 of the 13 customers' business profiles reviewed by EY. One company, Conix Company, did not have a business profile on file at account inception because, at the time, FBME's account opening forms did not have a separate business profile section. However, the inquiry response and associated agreement noted that Conix Company and the counterparty were involved in medical equipment and devices. The FBME customers' business profiles at account inception were supported by contracts or agreements between the customers and their counterparties. The remaining responses to inquiry questions represented more standard language in regard to identifying beneficial owners and due diligence performed on the account. • For at least 7 of the 13 FBME customers, the amount affiliated to the U.S. correspondent transactions would exceed the value noted in contracts and/or agreements in the customer file and/or be greater than the expected turnover for the company for the year of inquiry as noted on the most recent business profile. Of the 13 FBME customers, 12 had contracts and/or agreements that corresponded to the business purposes for the entities as noted in the inquiry responses and/or business profiles. For the one company account (Fantfo Investments Limited) that did not did contain a contract with the counterparty identified in a 2008 inquiry, a reference to an agreement from 2006 between the parties was noted separately in the customer file. • Due diligence for all 13 FBME customers was mostly conducted at account inception. However, for 1 of the aforementioned 13 client relationships, Zenith Holdings Group Limited, there was no documentation present in the file related to watch list screening (e.g., sanctions, PEP, negative news) for relevant stakeholders (directors, signatories, etc.). FBME introduced World-Check searches for parties involved in account opening in mid-2007; therefore, an account that was opened in 2007 or earlier would not have a World-Check search on file at account inception. Zenith Holdings Group Limited was opened on 06/16/2006 and was closed on 11/25/2008. EY performed World-Check and internet searches for Zenith Holdings Group Limited and associated parties (signatories, directors, UBOs, etc.) and no results were found except for one director/nominee shareholder, Sean Lee Hogan. Sean Lee Hogan was identified through public media as running a "Cyprus nominee operation". This individual was found to have put his name to nearly 100 BVI and 743 UK companies.18 The date of the article is 11/25/2012 while the Zenith Holdings Ltd account at FBME has been closed since 11/25/2008. Further, in 11 of the accounts, there was no indication that consistent ongoing due diligence (e.g., updated World-Check searches, updated business profiles) was conducted, but 10 of these accounts were closed within two years of their open dates. • Eleven of the 13 FBME customers' accounts are currently closed and a majority of them were closed in 2009 or earlier. This is approximately the time that JPMC ended its correspondent relationship with FBME. On 05/13/2008, George Rodger, former head of FBME's Compliance Department, sent an email to request the closure of 29 accounts associated with the Balashov Group. A risk assessment that was documented by Mr. Rodger on 07/10/2007 stated that the risk to the Bank of these accounts outweighed the possible return. Two of the 13 accounts were closed through this process as a result of the email and a third account related to the Balashov Group, Zenith Holdings Group Limited, was closed by the Bank in November 2008 due to dormancy. Based upon documentation received from FBME, 6 additional accounts were closed by the Bank because the accounts were in a dormant status. Finally, one account was closed by the Bank after internet 18 http://w w w .thequardian.com /uk/2012/nov/25/offshore-secrets-sark-lark-britons. 39 FBME EY Building a better working world FOIA CONFIDENTIAL TREATMENT REQUESTED BY FBME BANK LTD FBME00002514 5 December 2014 Canhdential scarrh rewm mmcalsa that :hm Company was to tn, and an tELu \nLqus a: mum nu tong the a um. Three of the And 49 U505 ur'talones' WtU't them: 12 FBME Euslnmers avertap and there IS at least one mstahw where (hm: t3 nurumantatmn at the Lompanmi tn mgnamn and dHeuurs. 2. Observaflans "om Customer accounts (elm at mans of [he FBME Luslomevs ate Set betaw. XI. 5 Determine! 2014 Confidential 2. Implementahan the Per/Icy \rv through 2009' Duulsthe Bank Ihal FBME the [uslmmer's address any messages processed lmauqh the uhswad or the Bank's address, 1H 2009' FEME \mplemcnlod [he Pohrv (O Hulude rogrstered LI operalmq Cusmmer addresses wire transactions chry FEME who renewen USD Iransachms GHECNV through a US banking rmahanshru user} Um Banh's to vcmmance from Hm \mp'cmcmatrun (If We Pahcy (12/31/2009) {0 03/01/2013 0V omy 160 lrahsaclronstomhng 32574823 durinqmalumerramr FBME has a (N 45 customers Mal wuhmm malnlam the Bank's address as [her (onespondence address Frextuhe as rimmed Cueplruns tn the Funny or |hcsr 25 are dmve and an: hem by customers who have a drred relalrunshlu [n9 Bank, EV, me he'poi the Bank's VKE President of Campfianm reviewed these 25 :usrnmer arrnurfls and Idenhhl'd "mm as homq FBME These names hmruae: . rnterhar accounts [rm Bank holds anecny. accounts marntarnea ny emproyees or shareholders uftrw Bank where we aduress rs reflected as "m care or" FEME bank, and - Acmuflls comnames drrecuy assocrateu hank ownm Wu The remarnmg 20 or these as warm; - hated as dormant by FBME. These 20 accounts were not amend or: reflect the adriwss a! me mun/Mum or hommg me due therr "dormant" sums an wrra payment were to he requested by any at lnese names rt waum 3' Mae 3 mt Nm um Tam Lsurlel T'admu 2m Hwy mm mum 5 December 2014 Confidential be FBME's procedure to update the address in the system to the customer's address and remove the Bank's address. 3. Customers with an Address Associated with OFAC Sanctioned Countries who Transacted with the Bank’s Address EY reviewed documents to identify customers who transacted using FBME's address in Cyprus and also had an Iranian or Syrian passport, beneficial owners related to Iran or Syria or an operating address in Iran or Syria on file. Documentation reviewed for this purpose includes the following: • EY reviewed the list of 45 customers identified by the Bank as having FBME's address as the correspondence address in Flexcube. EY identified 7 of these customers as having an Iranian passport or operating address on file. Three of these seven accounts are active (1 USD / 2 EUR) as identified in Flexcube. All identified customers' account files were reviewed for transactions associated for the time period of 07/01/2007 to 03/01/2013 utilizing FBME's address. • FBME provided, at EY's request, a list of all open and closed FBME accounts that had an Iranian or Syrian passport, beneficial ownership relationship or an operating address in Iran or Syria on file. (EY did not apply any completeness procedures against the lists provided.) These lists were compared against the list of parties transacting with the Bank's address. This resulted in the identification of additional FBME accounts related to Iran and Syria which transacted with the Bank's address. Based on this data, EY identified 12 accounts that had Iranian passports, beneficial ownership relationships or operating addresses on file and two accounts that had Syrian passports, beneficial ownership relationships or operating addresses on file and transacted using FBME's address in Cyprus. The outcome of this review is described below and in the table included at Appendix E. Syria • The two Syrian FBME customers did not transact in USD with FBME's address after August 2011. One of these accounts was closed in March 2011. The other account only maintains an active status in Flexcube because the customer maintains a credit card relationship with the Bank but there has not been an Incoming or outgoing transaction from this account since a EUR transaction on 11/14/2013. This account has a EUR balance of €23,194 and USD balance of $419. • Each of these customers only had one transaction using the Bank's address after the Policy was implemented: one customer transacted in USD in March 2011 on the day on which the account was closed (outgoing payment of $911) and the other transacted in November 2013 in EUR (outgoing payment of €3,690). The November 2013 transaction is included in the analysis even though it occurred after 03/01/2013. Iran 47 • Only one of the USD accounts maintains an active status in Flexcube due to an internal transfer between personal and business accounts held at FBME. This account has not had any incoming or outgoing transactions in USD using the Bank's address since December 2012 and the balance on this account is $161.79. • After implementation of the Policy, using the Bank's address, nine of the twelve Iranian customers performed a total of 83 transactions in USD totaling $260,377 and eight of the FBME 5 December 2014 Confidential twelve Iranian customers performed a total of 74 transactions in EUR totaling €490,902. The USD transactions occurred between 01/06/2010 and 12/14/2012. The EUR transactions occurred between 01/27/2010 and 02/18/2013. 48 • The 12 Iranian customers remitted at least $408,469 and €1,236,975 from 09/14/2007 to 02/18/2013 in outgoing wire transactions from their FBME accounts using FBME's address. In addition to the outgoing transactions, the above mentioned Iranian customer accounts received at least $217,285 and €846,173 from 03/12/2008 to 05/08/2012 in incoming wire transactions while utilizing FBME's address in the transaction details. • A review was conducted of the 12 Iranian accounts to identify if any additional transactions occurred after 03/01/2013. No such transactions were identified. • No USD denominated transaction was identified as occurring in 2013 or 2014. Only one EUR denominated transaction was identified as occurring in 2013 and no EUR denominated transactions were identified as occurring in 2014. FBME 5 December 2014 Conlmential 5 December 2014 Conliaential FOIA CONFIDENTIAL TREATMENT REQUESTED BY FBME BANK LTD 2525 m" mm mm mu 5 DecemberZDlA Conlidenfia' Appendix A Resu'ts we Diligence (Com.y FOIA CONFIDENTIAL TREATMENT REQUESTED BY FEME BANK LTD 5 December 2014 Confidential Appendix B - Transactions Related to Tredwell Marketing O rd e r D a te Am ount Husam AldenFarwati BN Mohammad (Syrian Address) 1 1 /1 5 /2 0 1 0 $999,950 Deutsche Bank - New York Ammar Mahmound Jbeili (UBO of Maribo) 1 1 /0 8 /2 0 1 0 $1,949,950 Kamal Exchange - Amman, JO Deutsche Bank - New York Zaher Antabi Bin Mohad Ali Comm R (Syrian Address) 1 1 /0 3 /2 0 1 0 $1,499,950 Incoming Kamal Exchange • Amman, JO N/A MYTC Offshores (Lebanese Address) 1 1 /0 3 /2 0 1 0 $1,999,950 Incoming Kamal Exchange • Amman, JO Deutsche Bank - New York Zaher Antabi Bin Mohad Ali Comm R (Syrian Address) 1 0 /2 5 /2 0 1 0 $ 1,600,050 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York Hasan Hajhamada Bin Mohammad 1 0 /1 2 /2 0 1 0 $399,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York MYTC Offshores (Lebanese Address) 0 8 /2 5 /2 0 1 0 $699,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York MYTC Offshores (Lebanese Address) 0 8 /2 3 /2 0 1 0 $799,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York Jbeili Pass (UBO of Maribo) 0 8 /2 3 /2 0 1 0 $699,912 Incoming Kamal Exchange - Amman, JO Raiffeisen Ahmend Fadel Hetalani (unknown address) 0 8 /1 9 /2 0 1 0 $213,823 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York MYTC Offshores (Lebanese Address) 0 8 /1 8 /2 0 1 0 $499,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York MYTC Offshores (Lebanese Address) 0 8 /1 7 /2 0 1 0 $499,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York MYTC Offshores (Lebanese Address) 0 8 /1 2 /2 0 1 0 $349,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York Jbeili Pass (UBO of Maribo) 0 7 /2 9 /2 0 1 0 $589,961 Incoming Kamal Exchange - Amman, JO Raiffeisen MYTC Offshores (Lebanese Address) 0 7 /2 1 /2 0 1 0 $1,349,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York Ragheb (unknown address) 0 6 /1 7 /2 0 1 0 $469,950 Incoming Kamal Exchange - Amman, JO Deutsche Bank - New York Ragheb Awny Masoud (unknown address) Com pany P a r t y /B e n e f ic ia r y U S C o r re s p o n d e n t P a y m e n t D e t a ils * Incoming Kamal Exchange • Amman, JO Deutsche Bank - New York Incoming Kamal Exchange - Amman, JO Incoming M a rib o 0 5 /1 0 /2 0 1 0 Total •Address was confirmed through a review of the customer file but was not listed in the transaction details. 57 FBME $179,950 $ 1 4 ,8 0 3 ,0 9 6 5 December 2014 Confidential Appendix B - Transactions Related to Tredwell Marketing (Cont.) In q u iry C om pany O r d e r P a r t y /B e n e f ic ia r y U S C o r re s p o n d e n t Outgoing Mallah Yammine Trading - Beirut Lebanon Outgoing R e c e iv e d ? D a te Am ount Deutsche Bank - New York No 1 2 /0 7 /2 0 1 2 $ 230,000 Mallah Yammine Trading - Beirut Lebanon Deutsche Bank - New York No 0 9 /2 4 /2 0 1 2 $ 198,000 Outgoing Mallah Yammine Trading - Beirut Lebanon Deutsche Bank - New York Yes 0 8 /0 7 /2 0 1 2 $ 198,000 Outgoing Mallah Yammine Trading - Beirut Lebanon Deutsche Bank - New York Yes 0 7 /2 3 /2 0 1 2 $ 275,000 Outgoing Mallah Yammine Trading - Beirut Lebanon Deutsche Bank - New York No 0 7 /0 9 /2 0 1 2 $ 249,100 Outgoing Mallah Yammine Trading - Beirut Lebanon Deutsche Bank - New York Yes 0 6 /1 1 /2 0 1 2 $ 211,315 Outgoing Mallah Yammine Trading - Beirut Lebanon Deutsche Bank - New York Yes 0 5 /1 1 /2 0 1 2 $ 250,000 Outgoing Mallah Yammine Trading - Beirut Lebanon Deutsche Bank - New York No 11 /1 1 /2 0 1 1 $ $ 1,781,415 Maribo Total 58 FBME 170,000 5 December 2014 C o n fid e n tia l Appendix B - Transactions Related to Tredwell Marketing (Cont.) Company Maribo Order Party/Beneficiary Outgoing Ministry of Finance of the Russian Federation 1 1 /2 4 /2 0 1 0 $355,500 Outgoing Ministry of Finance of the Russian Federation 1 1 /2 4 /2 0 1 0 $250,000 Outgoing Ministry of Finance of the Russian Federation 1 1 /1 9 /2 0 1 0 $8,860,000 Outgoing Ministry of Finance of the Russian Federation 1 0 /2 6 /2 0 1 0 $2,371,908 Outgoing Ministry of Finance of the Russian Federation 1 0 /1 8 /2 0 1 0 $3,473,000 Outgoing Ministry of Finance of the Russian Federation 0 9 /3 0 /2 0 1 0 $306,434 Outgoing Ministry of Finance of the Russian Federation 0 9 /2 7 /2 0 1 0 $2,338,000 Outgoing Ministry of Finance of the Russian Federation 0 9 /1 5 /2 0 1 0 $1 ,017,907 Outgoing Ministry of Finance of the Russian Federation 0 8 /2 6 /2 0 1 0 $734,990 Outgoing Ministry of Finance of the Russian Federation 0 8 /2 5 /2 0 1 0 $1,570,000 Outgoing Ministry of Finance of the Russian Federation 0 8 /2 3 /2 0 1 0 $3,770,000 Outgoing Ministry of Finance of the Russian Federation 0 7 /3 0 /2 0 1 0 $578,906 Outgoing Ministry of Finance of the Russian Federation 0 7 /2 9 /2 0 1 0 $1,157,811 Outgoing Ministry of Finance of the Russian Federation 0 7 /2 3 /2 0 1 0 $1,779,785 Outgoing Ministry of Finance of the Russian Federation 0 6 /2 2 /2 0 1 0 $660,187 Outgoing Ministry of Finance of the Russian Federation 0 6 /2 1 /2 0 1 0 $1,400,000 Outgoing Ministry of Finance of the Russian Federation 0 6 /1 7 /2 0 1 0 $1 ,100,000 Outgoing Ministry of Finance of the Russian Federation 0 6 /1 6 /2 0 1 0 $71,787 Outgoing Ministry of Finance of the Russian Federation 0 5 /2 7 /2 0 1 0 $1,399,865 Outgoing Ministry of Finance of the Russian Federation 0 4 /1 3 /2 0 1 0 $279,385 Outgoing Ministry of Finance of the Russian Federation 0 2 /0 3 /2 0 1 0 $25 Outgoing Ministry of Finance of the Russian Federation 0 2 /0 2 /2 0 1 0 $151,223 Date Total Amount $ 3 3 ,6 2 6 ,7 1 3 Note: Above chart included for illustrative purposes. Transactions are consistent with the contractual relationship between Maribo and the Ministry of Finance of Russia. 59 FBME EY Suiitiirtv a Dtttar workl»?g world FOIA CONFIDENTIAL TREATMENT REQUESTED BY FBME BANK LTD FBME00002534 5 December 2014 Confidential Appendix C - Transactions Related to Berkeley Trade Berkeley Trade LLP Com pany O r d e r P a r t y /B e n e f ic ia r y D a te Am ount Berkeley Trade LLP Incoming Transaction Tresor Public 0 2 /0 2 /2 0 1 2 $ 7,258,385 Internal Transfer Saab Financial 0 3 /1 4 /2 0 1 2 $ (5,000,000) Internal Transfer AB Systems 0 3 /2 2 /2 0 1 2 $ (1,600,000) AB Systems Ltd Internal Transfer Outgoing Transaction Berkeley Trade LLP 0 3 /2 2 /2 0 1 2 $ 1,600,000 Baratta, Baratta and Aidala LLP (for purchase of MAve hotel) 0 3 /2 2 /2 0 1 2 $ (1,500,000) Note: The above table contains the large dollar amount transactions associated with Berkeley Trade LLP and is comprehensive aside from a few smaller transactions related to earned interest not shown in the table. 60 FBME Confidential 5 December 2014 Appendix D - Structuring and Surge Wire Analysis Total 7-10k Structuring Analysis Sampled Amount Percentage of Total Number of Parties $ 3 ,2 9 6 ,7 1 8 .2 0 21.04% 18 3 5 ,2 1 8 ,4 8 5 .5 4 $ 5 ,9 0 7 ,2 6 4 .3 4 16.77% 36 $ 1 ,1 9 0 ,3 6 6 .1 8 $ 5 2 0 ,4 7 6 .1 2 43.72% 13 Outgoing 7-10k - Dormant (2) $ 3 ,9 4 5 ,8 0 6 .1 5 $ 6 5 1 ,6 7 6 .4 1 16.52% 8 Incoming 7-10k - Closed (3 ) $ 1 0 ,6 8 6 ,9 1 5 .6 0 $ 5 ,9 3 9 ,0 2 9 .5 0 55.57% 11 Outgoing 7-10k - Closed $ 5 ,2 1 9 ,2 9 3 .1 6 $ 2 ,0 9 1 ,2 8 0 .3 5 40.07% 6 Totals $ 7 1 ,9 2 8 ,4 9 5 .1 8 $ 1 8 ,4 0 6 ,4 4 4 .9 2 25.59% 92 Incoming 7-10k - Active (1) $ Outgoing 7-10k - Active $ Incoming 7 -1 0 k - Dormant 1 5 ,6 6 7 ,6 2 8 .5 5 (1) To capture a greater percentage of the incoming active account transaction population, instances where three or more round dollar transactions associated to one entity were included along with parties who were associated to 20 or more total transactions during the period of review (2) To capture a greater percentage of the outgoing dormant account transaction population, instances where two or more round dollar transactions associated to one entity were included along with parties who were associated to 30 or more total transactions during the time period of review (3) To capture a greater percentage of the incoming closed account transaction population, instances where two or more round dollar transactions associated to one entity were included along with parties who were associated to 40 or more total transactions during the period of review Type of Account Customers Sampled Customers Met Structuring Criteria Active 54 23 $ Dormant 21 5 $ Closed 17 12 $ Totals 92 40 $ 61 FBME Mantas % of Sample HotScan Alerts Cleared (2 0 1 3 2014) HotScan % of Sample High Risk Clients % of HR Clients in Sample MOKAS Reports Filed Mantas Alerts (2 0 1 3 2014) 6 15.00% 0 4 10.00% 9 22.50% 0 0.00% 0 0 0.00% 1 2.50% 6 ,9 1 9 ,2 4 4 .2 4 0 0.00% 0 0 0.00% 3 7.50% 9 ,1 6 9 ,3 2 0 .9 5 6 15.00% 0 4 10.00% 13 32.50% Value of Potentially Structured Activity 2 ,1 0 6 ,0 9 8 .2 6 1 4 3 ,9 7 8 .4 5 Confidential 5 December 2014 Appendix D - Structuring and Surge Wire Analysis (Cont.) High Risk Surge Analysis Total 100k+ Sampled Amount Percentage of Total Number of Parties Incoming 100k - Active $ 2 6 1 ,8 3 6 ,0 0 0 .0 0 $ 9 7 ,9 8 2 ,0 0 0 .0 0 37.42% 18 Outgoing 100k - Active $ 4 6 6 ,9 3 7 ,0 0 0 .0 0 $ 1 8 3 ,8 7 9 ,0 0 0 .0 0 39.38% 21 Incoming 100k - Dormant (1 ) $ 2 5 ,4 2 9 ,0 0 0 .0 0 $ 1 5 ,3 7 5 ,0 0 0 .0 0 60.46% 3 Outgoing 100k - Dormant (1) $ 4 5 ,4 5 0 ,0 0 0 .0 0 $ 1 9 ,6 4 5 ,0 0 0 .0 0 43.22% 9 Incoming 100k - Closed $ 3 8 ,1 5 0 ,0 0 0 .0 0 $ 2 1 ,5 0 2 ,0 0 0 .0 0 56.36% 4 Outgoing 100k - Closed $ 3 5 ,6 5 3 ,0 0 0 .0 0 $ 2 3 ,4 9 5 ,0 0 0 .0 0 65.90% 4 Totals $ 8 7 3 ,4 5 5 ,0 0 0 .0 0 $ 3 6 1 ,8 7 8 ,0 0 0 .0 0 41.43% 59 (1) To capture a greater percentage of the incoming and outgoing dormant account transaction population, instances where four or more round dollar transactions were associated to one entity were included in the sample. High Risk Clients % of HR Clients in Sample $101 ,5 99 ,0 00 .0 0 2 4 $ 16,830,000.00 8 1 59 15 Type of Account Customers Sampled (2) Customers Met Surge Activity Criteria Value of Potential Surge Activity Active 39 10 Dormant 12 Closed Totals Mantas % of Sample HotScan Alerts Cleared (20132014) HotScan %of Sample 4 40.0% 8 53.3% 0 2 50.0% 3 20.0% 0.0% 0 0 0.0% 1 6.7% 33.3% 0 6 40.0% 12 80.0% MOKAS Reports Filed Mantas Alerts (20132014) 13.3% 0 3 20.0% $1 2,50 0,00 0.00 0 $130 ,9 29 ,0 00 .0 0 5 (2) A review of the 59 parties resulted in a consolidated number of 51 due to duplicates caused by spelling variations or parties who were part of both incoming and outgoing transactions 62 FBME Confidential 5 December 2014 Appendix E - Customers with Iranian or Syrian Nexus that Transacted with Bank's Address C o n firm e d Ira n ia n /S y r ia n FBME A ccount S a n c tio n e d A ccount C u s to m e rs Num ber C o u n try B a lan ce A ccount Closed D a te /S t a t u s as per EUR EUR D a te o f Last USD USD D e n o m in a te d D e n o m in a te d T ra n s a c tio n In com in g O u tg oin g T ra n s a c tio n s T ra n s a c tio n s Incom in g O utg oin g Flexcu b e 0 7 /2 2 /2 0 1 0 0 7 /1 9 /2 0 1 0 - 1 2 /2 9 /2 0 1 1 0 7 /1 7 /2 0 0 9 Iran ■ 1 0 /1 9 /2 0 1 2 0 2 /1 6 /2 0 1 2 50581 Iran - 1 1 /1 6 /2 0 1 0 SAEED SANIEPOUR ISFAHANY 556 45 Iran 161 .79 MEHDI A POSHTKOUHI 46 4 6 0 Iran NAHID HAMIDIAN 59 7 1 7 MOHAMMAD REZA MAHMOUDI BEHROOZ AGHARAZY 59191 Iran VAHID SIROUS KABIRI 593 83 Iran GEVORK BOHDJALIAN 663 14 MAHMUD AGHA ZIA or GEVORK BOHDJALIAN 2 5 ,310 - 1,429 - $ 2 2 ,2 0 9 $ 5,700 116,682 148,000 0 3 /1 6 /2 0 1 0 $5,052 - 161 ,665 2 33 ,000 Active USD 1 2 /1 4 /2 0 1 2 $ 19 0,02 4 $11 6 ,0 7 6 2 ,3 2 0 1,652 13.02 EUR Dormant 1 1 /2 3 /2 0 1 1 $16 9 ,4 6 0 186 ,191 116 ,785 Iran 1,361.01 EUR Dormant 0 2 /1 8 /2 0 1 3 - 2 1 ,8 4 4 32,190 599 55 Iran 6 2 2 .4 0 EUR Active EUR 0 5 /2 6 /2 0 1 1 - 31,323 - SHAHROKH SHAHI BEHNOOSH 586 65 Iran 0 8 /0 9 /2 0 1 1 0 8 /0 9 /2 0 1 1 - 27,864 WILNA LTD 46 0 5 2 Iran FIROUZ FARAHMAND 53 7 1 7 Iran (8 5 .4 1 ) EUR / Active EUR / ($ 8 6 .1 5 ) USD Dormant 11,715.39 EUR/ Dormant $ 5 7 ,5 7 3 72,674 1 1 /1 3 /2 0 1 2 - 0 7 /2 4 /2 0 0 8 ■ 0 9 /0 1 /2 0 1 0 - $ 5 9 ,6 6 0 ■ 0 3 /0 2 /2 0 1 1 ■ $911 - 3 24 ,719 2 99 ,500 $ 2 ,6 3 7 .5 4 CYRUS FARAHMAND YAHYA FALLAHA or MOHD FADEL FALL YAHYA and ALAA-ELDIN FALLAHA 466 32 509 90 549 44 (1 0 ,4 8 6 ) EUR/ Active EUR / ($ 3 3 .0 0 ) USD Dormant Syria - 0 3 /0 2 /2 0 1 1 Active EUR / Syria 2 3 ,1 9 3 .5 7 EU R / $ 4 1 8 .5 9 Active USD Iran 1 1 /0 4 /2 0 1 3 ■ FBME 4,0 0 8 $ 2 1 7 ,2 8 5 $4 0 9 ,3 8 0 8 4 6 ,1 7 3 1,240,983 USD Total $6 2 6 ,6 6 5 Euro Total 2 ,0 8 7 ,1 5 6 Notes: AM wire transactions contain FBME’s address as the address associated with the Customer and occurred from 0 9 /1 4 / 2 0 0 7 to 1 1 / 0 4 /2 0 1 3 . Account status derived from FBME's core banking system , Flexcube. 63 2 80 ,000 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. © 2 0 1 3 Ernst& Young LLP All Rights Reserved. In line with EY's commitment to minimize its impact on the environment, this document has been printed on paper with a high recycled content. This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice. ey.com FOIA CONFIDENTIAL TREATMENT REQUESTED BY FBME BANK LTD FBME00002539