Approved: 17? system J. c. RICHENTHAL A sistant United States Attorneys Before: HONORABLE GABRIEL W. GORENSTEIN United States Magistrate Judge . . . Southern District of New Yorkgl, glgi; u? '1 "1 COMPLAINT UNITED STATES OF AMERICA Violations of - v. 31 U.S.C. 5322, 18 U.S.C. 371 and 2 NATALIE MAYFLOWER SOURS EDWARDS, a/k/a ?Natalie Sours,? a/k/a ?Natalie May Edwards,? a/k/a ?May Edwards," Defendant. SOUTHERN DISTRICT OF NEW YORK, 35.: EMILY P. ECKSTUT, being duly sworn, deposes and says that she is a Special Agent with the Federal Bureau of Investigation and charges as follows: COUNT ONE (Unauthorized Disclosure of Suspicious Activity Reports) 1. From_at least in or about October 2017, up to and including in or about October 2018, NATALIE MAYFLOWER SOURS EDWARDS, a/k/a ?Natalie Sours," a/k/a ?Natalie May Edwards,? afk/a ?May Edwards,? the defendant, an employee of a federal government authority, willfully violated subchapter II of Title 31 and a regulation and order prescribed thereunder, namely Section of Title 31 of the Code of Federal Regulations, by disclosing Suspicious Activity Reports and information that would reveal the existence of a BAR, which disclosure was not necessary to fulfill official duties, to wit, EDWARDS knowingly disclosed and described BARS, which she obtained by virtue of her position as a Senior Advisor at the United States Department of Treasury, Financial Crimes Enforcement Network including by electronically sending images of such SARs to a member of the news media (?Reporter?1") via an application. (Title 31, United States Code, Section 5322(a}; Title 18, United States Code, Section COUNT TWO (Conspiracy to Make Unauthorized Disclosures of Suspicious Activity Reports} 2. From at least in or about October 2017, up to and including in or about October 2018, NATALIE MAYFLOWER SOURS EDWARDS, a/k/a ?Natalie Sours,? a/k/a ?Natalie May Edwards," a/k/a ?May Edwards," the defendant, and others known and unknown, willfully and knowingly did combine, conspire, confederate, and agree together and with another to commit an offense against the United States, to wit, to make unauthorized disclosures of SARs and the existence of SARs, in violation of ~Title 31, United States Code, Section 5322 and Title 31, Code of Federal Regulations, Section 3. It was a part and an object of the conspiracy that NATALIE MAYFLOWER SOURS EDWARDS, a/k/a ?Natalie Sours," a/k/a ?Natalie May Edwards," a/k/a ?May Edwards,? the defendant, and others known and unknown, would and did knowingly disclose and describe SARs, which EDWARDS obtained by virtue of her position as a Senior Advisor at OVERT ACTS 4. In furtherance of the conspiracy and to effect the illegal object thereof, the following overt acts, among others, were committed and caused to be committed: a.On or about August 2, 2018, NATALIE MAYFLOWER SOURS EDWARDS, a/k/a ?Natalie Sours,? a/k/a ?Natalie May Edwards,? a/k/a ?May Edwards,? the defendant, exchanged approximately 541 messages with Reporter?l via a certain application (the Application?). kL On various ocoasions between in or about October 2017 and in or about October 2018, EDWARDS transmitted files containing or describing SARs to Reporter?l via the Application. CL Between on or about August 24, 2018 and October 2, 2018, a co?conspirator not named as a defendant herein exchanged approximately 301 messages with Reporter?1 via the Application. (L On or about October 16, 2018, in an interview in the Eastern District of Virginia with federal law enforcement agents (the ?Interviewing Agents"), EDWARDS initially concealed her relationship with Reporter?1 and denied having any contacts with the news media. {Title 18, United States Code, Section 371.) The bases for my knowledge and the foregoing charges are, in part, as follows: 5. I am a Special Agent with the FBI and have been so employed for approximately four years. Within the FBI, I am assigned to a squad focused on public corruption crimes committed by government officials and others. 6. I have been personally involved in the investigation of this matter. This Affidavit is based upon my personal participation in the investigation, my review of law enforcement records, and my conversations with other law enforcement agents. Because this Affidavit is being submitted for the limited purpose of demonstrating probable cause, it does not include all the facts I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. Suspicious Activity Reports, and Relevant Statutes 7. The mission of is to ?safeguard the financial system from illicit use and combat money laundering and promote national security through the collection, analysis, and dissemination of financial intelligence and strategic use of financial authorities."1 Among other things, manages the collection and maintenance of suspicious activity reports (more commonly known as under the Bank Secrecy Act of 1970 United States financial institutions and other parties are required by law to generate SARs in order to report potentially suspicious financial transactions, and to deliver the SARs to in turn maintains a centralized 3 database of the SAR data, which it makes available to law enforcement pursuant to regulations and procedures that protect the confidentiality of the information. 8. Under the BSA and its implementing regulations, disclosure of a SAR or its contents is unlawful. Specifically, 31 C.F.R. 102D.320{e) provides that ?[aJ SAR, and any information that would reveal the existence of a BAR, are confidential and shall not be disclosed.except as authorized [by law].? Subsection prohibits employees or agents of government authorities from ?disclos[ing] a SAR, or any information that would reveal the existence of a SAR, except as necessary to fulfill official duties consistent with Title II of the Bank Secrecy Act.? Title 31, United States Code, Section 5322(a} imposes criminal penalties for willful violations of the BSA and its implementing regulations, including the disclosure of a SAR. Unauthorized SAR Disclosures 9. Together, the FBI and the United States Department of Treasury?Office of Inspector General (?Treasury?DIG?) have been investigating a series of unauthorized disclosures of SARs and SAR information occurring between in or about October 2017 and continuing into at least mid?October 2018. 10. From my participation in the investigation and my conversations with other law enforcement agents involved in the investigation, I have learned the following, in substance and in part: a.Treasury-OIG agents have identified a pattern of unauthorized disclosures of SAR information appearing in the media starting in or about October 2017 and continuing until in or about the present (collectively, the Disclosures?). Each of the SARs Disclosures related to matters relevant to investigations being conducted by the Office of the Special Counsel, the United States Attorney?s Office for the Southern District of New York, and/or the National Security Division. of the United States Department of Justice, such as suspicious transactions relating to Paul Manafort, Richard W. Gates, Russian diplomatic accounts, and other matters. in The SARs Disclosures included the following: i. Between October 2017 and March 2018, a news organization {the ?News Organization"), headquartered.in New York, 4 New York, published_approximately twelve news articles containing detailed information that appeared to track the contents of SARs protected by the BSA (collectively, the Disclosure Articles?). ii. The articles were published on or about October 29, 2017 (the ?October 2017 Article?); November 14, 2017 (the ?November 2017 Article?); January 2018 (the ?January 2018 Article"}; February 19, 2018 (the ?February 2018 Article"); and March 16, 2018 (the ?March 2018 Article"); July 31, 2018 (the ?July 2018 Article"); August 10, 2018 (the ?First August 2018 Article"); August 29, 2018 {the ?Second August 2018 Article"); September 12, 2018 (the ?First September 2018 Article"); September 21, 2018 {the ?September 21, 2018 Article?); and October 15, 2018 (the ?October 2018 Article?). Reporter?1 was listed as an author (though not always the only author] of all of the SARs Disclosure Articles. The October 2017 Article claimed that the News Organization ?has learned specific details about 13 wire transfers? related. to Paul. Manafort ?all of 'which. took: place between 2012 and 2013," and described that ?[t]he transfers were first flagged by US financial institutions, which are required by law to tell an office within the Treasury Department about any transactions they' deem. suspicious? ill the fornL of ?suspicious activity reports.? iv. The November 2017 Article was entitled ?Secret Finding: 60 Russian_Payments To Finance Election Campaign Of 2016,? and also referenced. ?suspicious activity reports" and their findings. v. Similarly, the January 2018 Article referred to detailed financial ?[r]ecords reviewed exclusively by [the News Organization]? related in) financial transactions involving 'the Russian Embassy, stating that ?[t]he Treasury Department turned over the suspicious activity reports to the after ?[e]ach of these transactions sparked a ?suspicious activity report? sent to the. US Treasury?s financial crimes unit [that is, by Citibank, which handles accounts of time Russian Embassy," and citing to a official with knowledge of the inquiry.? vi. The February 2018 Article and March 2018 Article likewise specifically referenced ?suspicious activity reports? associated with Paul Manafort in detail, and the March 2018 article specifically discussed actions taken by with respect to the reports. vii. The July 2018 Article was entitled ?Russian ?Agent? And.a GOP Operator Left a Trail of Cash, Documents Reveal.? The July 2018 Article described in extensive detail a series of financial transactions derived from bank records allegedly involving a political consultant and Mariia Butina, who was indicted on or about July 17, 2018 in the United States District Court for the District of Columbia for acting as an unregistered foreign agent and conspiracy to commit the same. The July 2018 Article described ?suspicious transactions cited by the bank and federal investigators,? ?none of which have been made public.? Based.upon.my training, experience, and.my conversations with other law enforcement agents involved in the investigation, I believe that these references indicate that the data in the July 2018 Article was obtained from SARS. The First; August. 2018 Article: was entitled Operative Made ?Suspicious' Cash Withdrawals During Pursuit of? Clinton. Emails." The First .August. 2018 .Article discussed specific financial transactions made by an individual who purportedly launched.an independent effort in 2018 to obtain emails belonging to Hillary Clinton from Russian hackers. For example, the First August 2018 Article claimed that ?[a]fter scouring nine accounts that [the individual] controlled, Northern Trust turned over documents showing 88 suspicious cash withdrawals totaling about $140,000 between January 2016 and April 201?, including a $3,000 withdrawal six days after the election? and noted that ?the bank sent a report to Treasury?s financial crimes unit, which shared its findings with the FBI, special counsel Robert Mueller, and Senate Intelligence Committee investigators.? Based upon my training, experience, and my conversations with other law enforcement agents involved in the investigation, I believe that the data in the First August 2018 Article was obtained from BARS. ix. The Second August 2018 Article was entitled ?Here's Why the FBI and Mueller Are Investigating ?Suspicious' Transactions by Russian Diplomats." The article, which discussed suspicious transactions by, among others, a previous Russian ambassador to the United States, noted that ?Citibank sent information. that is: compiled. about [the ambassador?s] and. the [Russian] embassy's accounts to the US Treasury Department's financial crimes unit [that is, and the FBI in early 2017,? and discussed the details of two specific financial transactions - one approximately 10 days after the 0.8. presidential election, and another five days after the 0.3. presidential inauguration. The article cited ?three federal law enforcement sources with direct knowledge of the matter? as its sources. Based upon my training, experience, and my conversations with other law 6 enforcement agents involved in the investigation, I believe that these references indicate that the data in the Second August 2018 Article was obtained from SARs. x. The First September 2018 Article was entitled Series of Suspicious Money Transfers Followed the Trump Tower Meeting." The article discussed ?secret documents reviewed by [the News Organisation],? and specifically referenced ?two bursts of transactions that bank examiners deemed suspicious? involving a wealthy Russian family-one of whom had allegedly arranged a meeting at Trump Tower between a Russian national and representatives of the Trump campaign during the 2016 presidential campaign.(the ?Trump Tower their business associates in the aftermath of the Trump Tower Meeting. The article revealed the dates, amounts, and parties involved in the transactions in extensive detail, specifically stating that the transactions were identified after ?bankers filed ?suspicious activity reports? to the Treasury Department?s Financial Crimes Enforcement Network [that is, which in turn shared them with the FBI, the IRS, congressional committees investigating Russian interference, and members of special counsel Robert.Mueller?s team.? The article cited ?four federal law enforcement officials? as its sources. Based upon.my training, experience, and.my conversations with other law enforcement agents involved in the investigation, I believe that these references indicate that the data in the First September 2018 Article was obtained from SARs. xi. The September 21, 2018 Article was entitled ?The Planners Of' The Trump 'Tower' Meeting J?oved. Millions, And Mueller Is Now Investigating.? Referring to ?[d]ocuments reviewed by [the News Organization]," the September 21, 2018 Article described ?suspicious transactions? of approximately $3.3 million relating to ?a billionaire real estate developer close to both Vladimir Putin and President Donald Trump,? among others, occurring in or around June 2016, close in time to the Trump Tower Meeting. The September 21, 2018 Article specifically noted ?[tJhe details unearthed by bankers were compiled in ?suspicious activity reports? sent to the Treasury Department's Financial Crimes Enforcement Network [that is, which shared.them.with other 1aw- enforcement agencies investigating Russian interference.? Based upon.my training, experience, and my conversations with other law enforcement agents involved in the investigation, I believe that these references indicate that the data in the September 21, 2018 Article was obtained from SARs. xii. The October 2018 Article was entitled ?Here's How a Major Western Bank Enabled. A. Suspected Russian. Money Launderer.? The October 2018 Article related.to Prevezon_Alexander (?Prevezon?), an entity charged in a previous civil forfeiture case in the Southern District of New York relating to an alleged Russian money laundering scheme in which an investment company (the ?Investment Company") was among the victims, among other things. The October 2018 Article discussed a loan made by 51 particular banking institution.to a Prevezon subsidiary, and noted that ?[t]he records of this transaction, which have never been publicly reported, were unearthed by the US Treasury Department's financial crimes unit [that is, during investigations by Congress and special counsel Robert Mueller, both :xE are digging into Russia?s interference in the 2016 election.? Based upon my training, experience, and my conversations with other law enforcement agents involved in the investigation, I believe that these references indicate that the data in the October 2018 Article was obtained from SARs. 11. Based upon my conversations with other law enforcement agents who have reviewed the SARs Disclosure Articles described above, I have learned that several of the SARs Disclosure Articles described various transactions occurring in or through New York, New York, and refer to reports made by financial institutions with offices in New York, New York. Overview of Access to and Unlawful Disclosure of SARs 12. As described in more detail below, there is probable cause to believe that NATALIE MAYFLOWER SOURS EDWARDS, a/k/a ?Natalie Sours,? a/k/a ?Natalie May Edwards," a/an ?May Edwards,? the defendant, without authorization, provided some or all of the SARs Disclosures to Reporter?1 for publication, and was aware that a purpose of at least certain of such SARs Disclosures was for publication by the News Organization. Specifically, for the reasons set forth below, I believe that: a. EDWARDS began communicating with Reporter?1 in or about July 2017. b. EDWARDS had access to all of the SARs implicated by the SARs Disclosures. Between in or about October 2017 the .month when the SARs Disclosures began - and January 2018, EDWARDS saved thousands of files, including all of the SARS implicated by the SARs Disclosures, to a flash drive provided to her by c. Throughout the course of 2018, EDWARDS engaged in hundreds of electronic communications with Reporterel, many via an application. A review to date, pursuant to a judiciallyeauthorized search warrant executed today, of EDWARDS's personal cellphone has revealed that that cellphone contains the substance of many of these communications, including, as described in greater detail below, communications in which EDWARDS transmitted or described SARs or other protected information to Reporter-1. d. When questioned by law enforcement officials earlier today, EDWARDS confessed that she had provided SARs to Reporter?l via an application, though falsely denied knowing that Reporter?l intended to or did publish that information through the News Organization. At the time she was questioned, EDWARDS was also in possession of a flash drive that appeared to be the same drive on which she saved the SARs related to the SARs Disclosures, among other files. Access to SAKS 13. Based on my conversations with other law enforcement agents who have reviewed emails obtained from a government email address assigned to NATALIE MAYFLOWER souas EDWARDS, a/k/a ?Natalie Sours," a/k/a ?Natalie May Edwards,? a/k/a ?May Edwards,? the defendant {the Work Account?) and electronic files maintained by I have learned that EDWARDS has access to certain electronic folders maintained on network that contain many, if not all, of the SARs at issue in the SARs Disclosures. 14. Based upon my conversations with other law enforcement agents who have consulted with Treasury who conducted a forensic review of government computer usage by NATALIE MAYFLOWER SOURS EDWARDS, a/k/a ?Natalie Sours," a/k/a ?Natalie May Edwards,? a/k/a ?May Edwards," the defendant, and certain records from.Treasury?s networks, and Treasury staff regarding the electronic equipment issued by to EDWARDS, I have learned the following, among other things: a. Prior to in or about January 2017, at least one government?issued external flash drive {the ?Flash Drive?) was provided to EDWARDS for work purposes. b. Through forensic analysis to date, has been able to identify records reflecting that more than 24,000 files were saved to the Flash Drive between approximately January 2017 and approximately January 2018 (the ?Flash Drive Files"). The majority of the files were saved to a folder on the Flash Drive 9 entitled ?Debacle - Operation?CF,? and subfolders bearing names such an; ?Debacle\Emails\Asshat.? EDWARDS not. known tn) be involved.in any official project or task bearing these file titles or code names. c. Based upon my conversations with other law enforcement agents who have spoken with who have in turn, reviewed the names of the Flash Drive Files, and conducted a comparison of those file names/sizes to records contained on network, the Flash Drive Files appear to contain thousands of SARs, along with other highly sensitive material relating to Russia, Iran, and the terrorist group known as the Islamic State of Iraq and the Levant {more commonly known as or ?1818"), among other things. Multiple files also bear labels referencing Paul Manafort and Reporter?1?s name. d. Based.upon the same, it appears that the Flash Drive Files include all of the SARs implicated by the SAR Disclosures published.by the News Organization. Available data indicates that these SARs were first saved to the Flash Drive by at least on or about. October 18, 201? - approximately 11