A criminal is engaged in chain hopping while trying to launder ransomware payments. The criminal will likely:

• A. convert the funds to a different type of cryptocurrency.
• B. store the funds in a cold wallet.
• C. obscure the funds using a mixer.
• D. move the funds to an offshore cryptocurrency wallet.

SAR/STR NARRATIVE
A SAR/STR has been submitted on five transactions conducted on the correspondent banking relationship with ABC Bank.
Client Information:
Remitter information: DEF Oil Resource Ltd. is the oldest member of the DEF Group. It was founded in 1977 as a general trading business with a primary focus on exports from Africa and North America. The group has business activities that span the entire energy value chain. Their core field of endeavor is centered within the oil and gas industry and its associated sub-sectors.
Beneficiary Information:
As per the response received from ABC Bank, it was determined that the beneficiaries are related to DEF Oil Resource Ltd. These were created by DEF Oil Resource Ltd. to purchase property in a foreign country on behalf of their senior management as part of a bonus scheme. The purpose behind this payment was for purchase of property in another country.
Payment Reference:
ABCXXXXX31PZFG2H
ABCXXXXXX51PQGEH
ABCXXXXXX214QWVG
ABCXXXXXX41PSXA2
ABCXXXXXX815QWS3
Concerns:
* We are unsure about the country of incorporation of the beneficiaries.
* We are concerned about the transactional activity since the payment made towards entities (conducted on behalf of individuals) appears to be possible tax evasion.
* There appears to be an attempt to conceal the identity of individuals (senior management), which again raises concerns about the source of funds.
* Referring to the response received from ABC Bank, we are unclear about the ultimate beneficiary of funds.
* The remitter is involved in a high-risk business, (i.e., oil and crude products trading), and the beneficiary is involved in a real estate business which again poses a higher risk.
The monitoring system of the correspondent institution flags the transaction as suspicious activity. The correspondent bank needs to send a request for information to the respondent bank. Which elements should be included in the request? (Select Three.)

• A. Full transaction history of the correspondent bank's customer
• B. Details of DEF Oil Resource Ltd parent company and the name(s) of the beneficial owner(s)
• C. The last 6 months of transactional history
• D. The respondent bank's customer's senior management bonus plan
• E. The contract pertaining to the purchase of property in another country
• F. The account profile of the customer and their KYC data

In a review of the account activity associated with Nadine Kien, an investigator observes a large number of small- to medium-size deposits from numerous individuals from several different global regions. The money is then transferred to a numbered company. Which is the next best course of action for the investigator?

• A. No further action is required as the customer is already rated at high-risk and the monthly spending is within expectations.
• B. File a SAR/STR on the account activity in relation to a potential funnel account.
• C. Recommend the account for exit due to frequent global transactions.
• D. Complete the monthly review and note the activity for next month's review.

A client with many personal and business deposits with the financial institution (Fl) seeks a business loan. The client wants to guarantee the loan with a trust for which they are the beneficiary.
An investigator examines the trust. The trust has many layers, including shell companies in known tax havens.
The client's ultimate beneficial ownership claim cannot be validated, and the loan is denied.
Two months later, the Fl receives a law enforcement (LE) request on one of the client's business accounts.
While reviewing the business account, the Fl receives another LE request on the same account from another agency. The requested information is shared.
Three months later, a branch manager receives a request to open a business deposit account related to a complex trust. The manager forwarded the request because of the complexity. The trust was the same as the previously examined trust, but the request came from a different client. The second client also has many accounts with the Fl. Further inspection finds links between the second client and the Paradise Papers. The Papers state the client led illegal activities and committed tax evasion.
What steps should the investigator perform in reference to the first client's existing accounts? (Select Three.)

• A. Review all client-signed documents relating to all accounts.
• B. Review Fl approved policies regarding the existing accounts to ensure regulatory requirements were followed.
• C. Prepare a relationship flow chart of all existing accounts to better understand the client's activities.
• D. File SARs/STRs for all accounts at the beginning of the discovery phase and amend later as necessary.
• E. Inform Fl management of all processes used to investigate the client due to LE inquiry.
• F. Perform secondary scans of the client's other owners/authorized signers