Anatomy of an Investigation

How did journalists working on the FinCEN Files use innovative techniques to trace financial crime globally?

Darkes Lane is a pretty little street in Potters Bar, a small town in the south of England. Red-brick buildings line the two-­lane road; storefronts on the ground level entice shoppers with offers of everything from pizza to cards to shoes. At one end of the street is the train station, where passengers gather each morning to zip the roughly 20 kilometres south to London for the workday. At the other end stands a three-storey building. Its red brick matches the rest of the buildings on the street, its architectural style dates to a period sometime after the Tudor-style row houses. It is the kind of building you might not register if you passed by, just another little office building trying to justify its existence in a town chock full of commuters.

Potters Bar isn’t the type of town one would associate with a crime syndicate that hides billions of dollars. But, as it turns out, Suite 2B at 175 Darkes Lane is home to just that, the location that ties a maze of shell corporations and tax havens that disguise the proceeds of dirty money.

Between October 2017 and October 2018, while investigating Russian interference in the 2016 U.S. election, Buzzfeed News received a leak of more than 2,100 Suspicious Activity Reports (SARs) that had been filed with the United States Treasury Department’s intelligence unit. These reports detailed numerous suspicious transactions and odd practices. Practices like more than 1,000 companies listing “Suite 2B, Brosnan House, 175 Darkes Ln, Potters Bar, UK” as their main address, then wiring thousands of dollars through the bank accounts tied to these companies. “My reporting partner, Jason Leopold, and I obtained these records ages ago,” says Anthony Cormier, an investigative journalist at Buzzfeed News based out of New York. “We were initially covering the Trump administration, and we wanted to follow the money. We realized that we had obtained something much larger than that.”

Cormier and his team connected with the International Consortium of Investigative Journalists (ICIJ) and put together a team of 110 media organizations, which analyzed the documents and shed light on a small piece of the web of anonymous shell corporations. The result of their collaborative work and investigations, known as the FinCEN files, is an exposé of an industry where global banks—the very organizations tasked to lead the world’s defence against money laundering and the movement of funds connected to crime—profit from allowing these transactions to occur.

In the U.K., the backlash from this revelation was quick and intense. The government immediately announced reforms to the Companies House, an executive agency under the Department for Business, Energy and Industrial Strategy that registers new companies, and set a new mandate: directors of companies will not be registered until their identity has been verified. The agency was also given new powers to investigate registration information provided and verify its accuracy.

As it turned out, the stories that resulted from the leak of information about global financial ties had consequences far beyond the borders of the United Kingdom.

The boom in technology and the increased ability to hide illicit activity sometimes feel as if they are in lockstep with shrinking newsrooms and disappearing funding for long-term investigative work. Journalism, however, has always been a craft that requires resilience and ingenuity. Adapting work to meet the demands of harsh and ever-changing environments is the rule, not the exception. To push back against the reduced resources available to them, journalism organizations are reaching out to one another for support and forming networks that seek to harvest the pool of talent spread across the world. The result has been unprecedented collaborations and ambitious multi-faceted stories that connect trends across the globe. “Things are getting more and more complex, corruption is getting more complex, money laundering is getting more complex,” says Emilia Diaz-Struck, the research editor for the ICIJ. “Having data and resources to explore and having the local expertise with the coordination capacity and the data capacity from ICIJ allows that magic to happen.”

One of the more famous international stories in recent memory is that of the Panama Papers, an investigation by the ICIJ and journalism organizations that found 140 politicians and public officials had offshore accounts—many for the purpose of fraud or tax evasion. The Pulitzer Prize-winning investigation was linked to approximately $1.2 billion USD in recovered taxes, investigations into at least 82 companies, and the resignation of scores of politicians, one of the most high-profile being Iceland’s prime minister, Sigmundur Davíð Gunnlaugsson.

Separate from the ICIJ, in 2017 a group of journalists formed Forbidden Stories, a network of independent news organizations that takes on investigations if local reporters have been threatened, imprisoned, or killed. Their Green Blood investigation brought together 40 journalists across 15 countries to investigate environmental abuse by mining corporations, a beat that has played a role in the deaths of at least 13 journalists since 2009. The result of their investigation prompted technology companies such as Apple, Nokia, and Canon to re-evaluate their connections to a Tanzanian gold mine and the court of justice in Guatemala to temporarily suspend the operations of Fénix mining corporation.

Local collaborative projects following the same model include the State of Change, an investigation into the barriers rural communities in New Mexico have to developing internet connections.

“I’ve been in newsrooms where people would mislabel their Rolodex so some other reporter can’t come over and steal their sources,” says Agustin Armendariz, a senior data reporter for the ICIJ who welcomes the spirit of collaboration among newsrooms. “The culture of journalism is changing. It used to be very competitive, but now people are realizing, no, we don’t want to compete on access to information. We want information to be in everybody’s hands—we want to compete on stories.”

The result of forming such a rich network of journalists has also added a level of depth and context to stories that a single newsroom would be hard put to create. “You have people who know and understand how to find the best sources in their own countries and make sense of those documents, what is relevant in each country,” says Diaz-Struck. “At the same time, we can put together and connect all this data.”

“We were initially covering the Trump administration,” says a BuzzFeed News reporter, “and we wanted to follow the money. We realized that we had obtained something much larger than that”

“When you think about an individual story,” adds Armendariz, “or an individual reporter doing one thing, that can have a lot of impact. But when you think about distributing that work among people across the world, it really starts to get interesting quick, and things can become very powerful.”

Jason Leopold has a calming and balanced presence. As he talks to hosts Ben Wittes and Kate Klonic on a September 2020 episode of the YouTube show In Lieu of Fun, he is seated in front of a white bookcase overflowing with books stacked in piles that tower over his head. Titles such as Reclaiming Parkland and Meme Wars are interspersed with baby photos and memorabilia.

Leopold was an early member of the FinCEN investigation. He doesn’t seem interested in skewering FinCEN for bureaucratic laziness or arrogance in regards to the problems this leak has exposed. Instead, he and Cormier both acknowledge that “FinCEN gets millions of these suspicious activity reports per year and this is an agency that just doesn’t have enough personnel to go through everything,” Leopold tells the web audience. “We felt that we needed to inform the public about what essentially has been happening and what continues to go on as it relates to illicit financing.”

Established in 1990, the Financial Crimes Enforcement Network, called FinCEN, is a bureau of the U.S. Department of the Treasury that supports the detection, tracking, and prosecution of money laundering and financing illegal activity. FinCEN is part of a global network of over 100 national financial intelligence units, which work to share data on suspicious activities throughout the world.

The Bank Secrecy Act (BSA), also known as the Currency and Foreign Transactions Reporting Act, requires financial institutions report to the IRS any deposit, withdrawal, or payment over $10,000. Any suspicious transaction made in U.S. funds, regardless of where the banks reside, must be reported to FinCEN. The BSA also requires that banks must notify FinCEN of any suspicious activity, including a customer making multiple transactions just below the $10,000 IRS limit, using a third party to make the transactions or making suspicious enquiries about BSA reporting requirements. “It began to dawn on us that the Western banks were allowing, facilitating, and profiting from the actions of folks that they knew were up to no good,” says Cormier. “That was sort of the first blinking red light, like, wait a second. As long as you tell them [FinCEN] that you’re banking a terrorist, you’re okay, you can’t get into any trouble. You don’t have to cut them off, you don’t have to stop the transaction—this is deeply problematic.”

The researchers also noticed that over several months, banks would file multiple reports on the same person or on a specific group of companies tied to a person. But even the high volumes of reports were not enough for the banks to stop the activity. “The bank is doing business with the person they’re looking at,” sums up Delphine Reuter, a data journalist and researcher with the ICIJ.

In principle, once alerted, FinCEN is meant to investigate these Suspicious Activity Reports (SARs), combining what was reported with other information the bureau may have on the circumstances surrounding the event. The final intelligence report is then sent to the appropriate law enforcement agency for further investigation. At least, that is what should happen. In reality, the volume of reports coming in far outstrips the investigative capacity of the 300-person team at FinCEN. Most of these reports simply end up languishing. “They just sit in a vault or on a computer system, and no one ever looks at them. Until folks like us come along,” says Cormier.

In their reporting on the FinCEN files, Leopold and Cormier never mention the source by name, even though a press release on the Department of Justice’s website states that a former FinCEN employee, Natalie Mayflower Sours Edwards, has pleaded guilty to conspiring to unlawfully disclose suspicious activity reports. Edwards was charged with unauthorized disclosure of the SARs after a joint investigation by the FBI and the U.S. Department of Treasury into a suspected leak at FinCEN.

Edwards, who holds a PhD in education, was in graduate school during the events of 9/11. A sentencing memo reveals that she wanted to play a role in some aspect of national security work, so she entered public service, where she spent time working for the CIA and the Office of the Director of National Intelligence. In 2016, when working at FinCEN, Edwards became concerned that it might have provided incomplete information to the congressional committee investigating Russian interference in the 2016 election.

Cormier explains the strange turn of events that led to the cache of documents being leaked: “These documents that the Senate committees and Mueller’s team were requesting, they were going to the Treasury Department and were saying, ‘Look, we want to follow the money. What do you got? What are the banks telling the Treasury Department about? What are they watching happen? Did any Russians send money to the Trump campaign or its associates to the campaign?’ They were looking for that very targeted kind of financial information. And what happened was, Congress wasn’t receiving the documents. They were being stymied. And we don’t understand why Treasury never turned them over. We know they didn’t, in many cases. And there were whistleblowers who thought this was problematic and it was in the public’s interest that it be reported. And they turned to us.”

The FinCEN files expose an industry in which global banks—the very organizations tasked to lead the world’s defence against money laundering—profit from allowing these transactions to occur

Edwards allegedly saved thousands of files to a flash drive and texted pictures of the SARs to a reporter over an encrypted application. She also pleaded guilty to sending the reporter emails pertaining to the SARs, as well as investigative memos and intelligence reports. Before she was arrested, court documents attest, Edwards sent Buzzfeed News more than 2,100 Suspicious Activity Reports filed between 2011 and 2017. Convincing the whistleblower to act, however, was only step one of the investigation. With thousands of unverified documents in front of them, the journalists’ real work had just begun.

As the scale of investigations ramps up across the world, so, too, has the demand for journalists to be part investigator and part programmer. Large corporations, especially in the financial sector, can afford to hire armies of computer scientists to hide their digital footprints, beginning a digital arms race between these sectors and their watchdogs.

Journalists must also be wary of their subjects looking into them. In the summer of 2020, it is believed that actors in Saudi Arabia and the U.A.E. hacked the phones of 36 reporters and editors at Al Jazeera, according to a report from Citizen Lab at the University of Toronto. The program recovered from journalist Tamer Almisshal’s phone by Citizen Lab had the ability to record audio from the phone’s microphone, take pictures, track the location of the device, and access passwords. Sharing documents online is just as dicey. Each cloud-sharing system has its own vulnerabilities that hackers and governments can use to their advantage.

Programs like Datashare, the open-source technology the ICIJ developed to facilitate journalists securely sharing information across borders, are designed to help keep evidence and communications secure from these sorts of attacks. The program is also designed to comb through extensive amounts of information necessary for the FinCEN investigation, as Buzzfeed News had collected nearly 2,100 reports from nearly 90 different institutions, categorizing more than $2 trillion in transactions. The data team also compiled 17,600 additional records—banking reports, shipping info, ownership documents—to verify the information they were seeing and put the information into context. “If we have a data leak of a certain size, it would take forever to check,” the ICIJ’s Delphine Reuter explains about Datashare. “If you have a list of the names of people in parliament, heads of states, businessmen, et cetera, you can run it through the system. It’s much easier than putting the search box, one name after the other, which would take a while.”

The program can also extract and search through text found in images, slides, emails, and PDFs, while an optical character recognition program automatically extracts names, emails, locations, and organizations. As the main program that runs Datashare is installed locally on a computer, and not in a cloud system, journalists can share these files and give other reporters access to them, or can keep them private.

Each SAR from the FinCEN leak came with a document explaining the suspicious activity, as well as a spreadsheet that could contain hundreds of lines of transactions. The quality and detail of these reports varied: more than 20 percent of the files were missing some or all of the addresses for flagged clients. Armendariz says that in half of the files, the banks were missing identifying information about one or more of the clients involved in the money transfer. Often, the SAR was missing either the narrative document or the spreadsheet of transactions, creating extra work to understand what the suspicious activity was and to track the flow of money. “All data is dirty in some way or another, and as journalists, we don’t typically get the comprehensive data set,” he says. “We typically get these windows into things, and this was a window into a system. So, what you have to do is design and run all these different experiments. We’ll do a two-person double-data entry to see if we both come up with the same thing.”

Other computer programs tried to organize the hundreds of thousands of transactions this data leak contained, but Diaz-Struck says the complexity of information made it difficult for these programs to capture the entire story. Each bank attached a spreadsheet in its own format, so the fields were not uniform. Some would explain what the transactions were and why they had been included in the report, while others didn’t. They would explain the fraudulent activity in the narrative report, but the transaction information would be missing from the spreadsheet. Follow-up reports would often contain information found in the initial report as well, so journalists had to take extra steps to make sure they weren’t counting the transactions twice. “We tried machine learning, for instance, to extract information about transactions,” says Diaz-Struck. “We got some details, but it was not perfect.” The documents usually had the tables first and then the narrative, where the bank would describe what had happened with the transactions, what had gone wrong, and the amounts. But one of the greatest problems they faced was a lack of consistency. “They were written by people,” Diaz-Struck says, “and each one had its own shape and format.”

It quickly became evident that a wider effort was needed to parse the information. To do so, the ICIJ threw a “data extraction party” and created a network of 85 journalists in 30 countries. Journalists were divided into teams, each overseen by a regional coordinator who reported to a project manager. Researchers kept in touch through a communications platform called the Global iHub. These researchers manually reviewed the transaction data, entered the information into their own Excel files, and uploaded the documents to the iHub. In the end, 400 spreadsheets mapping 100,000 suspicious transactions throughout the world were made into a database for the researchers to use. Other tasks, like data entry, required the team to make judgment calls that computers couldn’t. “With the computer program, [I can’t] say, ‘Is this report here based on the financial transaction software? Does the compliance officer looking at that have all primary source information? Or is this based on random Google searches that the compliance officer was doing?’” explains Armendariz.

Fact checking was also a behemoth of a project. Each transaction was fact checked three times, a process that took several months. By ensuring that different journalists on different teams could come to the same conclusions, even if they employed slightly different methods to look into the transactions, the team was confident in what they had produced. “We used different implementation details,” says Armendariz, “but we still came to the same conclusions, literally down to the detail.”

Making sense of the SARs was only the first step in the investigation. Layers of transactional data may be impressive, but won’t go far in demonstrating that illegal activity is, in fact, ongoing. Local journalists then had to take the information prepared by the data team and turn it into a story that the public would understand and care about.

Moreover, just because a SAR was filed did not mean a crime was committed. Before publishing, the journalists had to make absolutely sure that the transactions and people they were making public, like the story of the owner of a real estate firm that millions of dollars passed through, were undoubtedly connected to a crime. To do this, the investigative team would pull all the information they could: shipping records, office structure, business records. They also conducted interviews with associates and employees to verify the information. “We looked for their connections to other criminal actors or criminal entities to say definitively these transactions had gone beyond suspicion and they had, in fact, facilitated terror, narco financing, money laundering, theft of state funds,” says Cormier. “There are tons and tons of these records that we’ve just never done anything about because we have our own questions. We don’t have it dead to rights and so we can’t be out there speculating.”

In the summer of 2019, a meme began floating around social media referencing the Panama Papers, the massive global investigation into offshore bank accounts and the people in positions of power who use them. It shows an image of a tweet by Colin Taylor, which reads: “hey remember when the panama papers came out and revealed that all the rich people in the world are part of an enormous criminal conspiracy to dodge taxes and hoard stolen wealth in offshore accounts and literally nothing happened.” Underneath the image of the tweet is a response by another user, saying, “That’s not quite true. The reporter behind the story, Daphne Caruana Galizia, was murdered.” As of January 2021, the iteration of the meme hosted on the iFunny platform had 112,400 likes. Many others liked and shared the meme on other platforms as well.

This underlying sentiment, that multinational journalism is impressive and entertaining but ultimately doesn’t change a thing, is misleading. The belief persists, however, because the mark that these in-depth investigations leave is often missed due to their diffuse rollout. Investigations like the Panama Papers and FinCEN Files are often released in a coordinated manner across news organizations, making the findings hard to ignore. The results then slowly begin to trickle in, a few at a time over the years, making them easy to miss or misunderstand after the massive media rollout. What’s more, many media entities shy away from touting the impact of their investigations out of concern they might be labeled activists versus objective watchdogs.

That’s not to say, however, that these investigations don’t impart lasting change on the institutions they write about. Politicians caught with connections to tax havens or concealed assets through the Panama Papers, for example, like Icelandic Prime Minister Sigmundur Gunnlaugsson; the Spanish minister of industry, energy and tourism José Manuel Soria; and Ukrainian Prime Minister Arseny Yatsenyuk all stepped down amid the backlash. As of March 2019, the Panama Papers were also connected to substantive reforms in at least 16 countries or international bodies, including changes to banking rules related to anonymous shell companies in the United States, according to a study released by the Reuters Institute for the Study of Journalism at Oxford University.

Journalistic entities tracking the impact of their investigations are also becoming more common. NewsLynx, an analytics platform created by the Tow Center for Digital Journalism at Columbia’s Graduate School of Journalism, seeks to track and categorize the real-world impact of stories, through clip searches, social-media monitoring, and other sources. The Center for Investigative Reporting has also released the open-source coding for its impact tracker, allowing newsrooms to visualize the impact of their stories over time.

“Journalism is changing. It used to be very competitive, but now people are realizing, no, we don’t want to compete on access to information. We want information to be in everybody’s hands”

On January 1, 2021, the Chamber of the U.S. Senate is a hub of activity. Politicians and aides, scattered behind the dark mahogany desks that adorn the room, accent their business attire with masks in an attempt to stem the raging COVID-19 outbreak. The group has gathered on the national holiday to discuss overturning President Trump’s veto of the 2021 National Defense Authorization Act. (Trump objected to a provision in the bill that would rename army bases honouring Confederate generals and complained that Democrats would not sign onto a bill that removed legal protections for big tech companies.)

Tucked into the bill is also a law that attempts to make investigations into cash flows more feasible. The Corporate Transparency Act requires that beneficial or controlling parties in corporations and LLCs must be identified to FinCEN. This legislation would essentially ban anonymous shell corporations from operating in the U.S. financial system and address one of the fundamental problems with global finance: the web of anonymous shell corporations makes it expressly difficult to know who is moving money into and out of their vaults. “Most of the entities that we’re talking about in the SARs are shell companies,” says Cormier. “They’re very grey, it’s very murky—it’s almost impossible to know who these folks are.”

The Corporate Transparency Act also extends protections for whistleblowers who flag indiscretions and puts the burden on different entities to be aware of who they are getting into business with. Everything from auction houses, which are constantly under fire for selling priceless goods that are potentially connected to looting or theft, to the banks that allow these flows of money, would be included under the law.

Senator Sherrod Brown, a member of the Senate Banking Committee, acknowledged that the FinCEN investigation published by the ICIJ and Buzzfeed News was a catalyst in pushing the law into reality after years of negotiation. Illustrating how money connected to human trafficking, terrorism, fraud, and other crimes can flow uninhibited was a needed reminder. For Cormier, this is a step in the right direction. He thinks it will help in the U.S. because all businesses, including small operations, must report the names of their owners to the Treasury. But finance is global. Cormier thinks it will open up the state of Delaware, for instance, which is known for financial secrecy. But until efforts are internationally coordinated, it won’t affect clandestine operators in places such as the Isle of Man, the Cayman Islands, and Switzerland. “I don’t want to look a gift horse in the mouth,” he says. “I feel very, very grateful that we were able to do something—have some impact—but I don’t think the riddle is all the way solved.”

Until it is, a global network of journalists keeps watch.