Forensic techniques to investigate emerging trends

In this article, we explore cryptocurrencies and ESG in the context of fraud and compliance investigations. While not intended to be a fulsome discussion of current regulations, we briefly touch upon pertinent aspects of the evolving regulatory framework in the Americas that investigators should be aware of. We then discuss specific nuances, considerations and investigative tools that practitioners should consider when conducting investigations in these areas, including examples of how they have been applied in recent investigations.

Cryptocurrencies

Regulatory guidance and enforcement trends in cryptocurrencies

DOJ

SEC

OFAC

FinCEN

According to FinCEN, users who obtain cryptocurrency to purchase goods or services are not generally considered money transmitters subject to FinCEN’s authority. However, issuers, redeemers and exchangers of cryptocurrency fall within the realm of FinCEN’s regulatory authority, requiring them to adhere to applicable AML and KYC statutes.

Cryptocurrency investigation considerations

While regulators continue to develop cryptocurrency-specific regulations, the enforcement actions to date make a clear statement that US government agencies will use its enforcement authorities, particularly pertaining to AML, on the cryptocurrency industry. That being said, the practice of using datasets to determine the ultimate source or destination of funds should be familiar to practitioners and is still the ultimate goal in most investigations.

In this section we explore nuances that practitioners should consider in cryptocurrency investigations and the power of utilising blockchain analysis tools in concert with traditional investigative techniques.

Planning for the investigation

There are several considerations that investigative teams should evaluate carefully during the planning and scoping phases of a cryptocurrency investigation. Investigative teams need to consider the varying levels of regulations, across jurisdictions, that may be applicable. For example, if a practitioner is investigating suspicious transactions that have occurred within a virtual asset service provider (VASP) as defined within US regulations, the practitioner should consult the BSA as the updated guidance indicates that VASPs are considered money transmitters and are, therefore, subject to compliance with AML requirements under the BSA. To that end, determining what fiat currencies were involved in an investigation can also help investigators determine what regulations may apply.

As cryptocurrency investigations involve analysing the flow of funds on one or multiple blockchains, the investigation team should determine any required involvement of subject matter experts. These investigations should be staffed with experts who are well versed in the elements that make up a cryptocurrency transaction, including cryptocurrency addresses, wallets, exchanges and analysing data on the blockchain.

Identifying information relevant to the investigation

For cryptocurrency-related investigations, data collection and analysis will be a major component of the overall investigative procedures, with the core data points being the applicable cryptocurrency blockchains. Although anyone can trace specific transactions on the blockchain, additional data is required to identify the details of real-world actors associated with cryptocurrency addresses identified on the blockchain. Information such as emails, text messages and other structured or unstructured data stored on devices could potentially help identify the owners of cryptocurrency wallet addresses or provide information on wallet private keys or passwords associated with the addresses.

There are also identity and access management data points to consider, such as knowledge of private keys, code update permissions or access to company-controlled cryptocurrency accounts. These are key facts for investigators to consider if a party claims that they could not have authorised a transfer of funds or if an account with elevated privileges was accessed without authorisation.

Investigative procedures

Cryptocurrency investigations often involve tracing assets to identify the ultimate source or destination of funds and what parties were involved. Instead of traditionally tracing funds through the general ledger and corresponding bank statements to investigate a crime committed using fiat currency, practitioners will investigate the flow of funds by analysing activity recorded on the blockchain.

Complications can arise when cryptocurrencies maintained on different blockchains are used to facilitate the illicit activity. If multiple cryptocurrencies were used at any point in the payment process, it will likely be necessary to perform tracing across blockchains. To this end, investigators need to be aware of cryptocurrency-swapping services and cross-chain bridges. While these services are not nefarious themselves, actors seeking to obfuscate the true source or destination of their funds can utilise these swapping services for illicit purposes.

In these complex situations, blockchain analytics tools streamline the review as they collate copious amounts of blockchain data, across multiple blockchains, and provide innovative data visualisations that allow for methodical asset tracing and effective reporting of findings. By utilising blockchain analytics tools in tandem with the information collected in the data collection phase to identify owners of cryptocurrency addresses, practitioners will be able to capture and analyse blockchain and cross-chain cryptocurrency transactions in a more tactical manner.

While cryptocurrency schemes are typically complex, we present below two simplified case studies featuring fictitious companies to demonstrate how practitioners could combine cryptocurrency tracing with traditional investigative techniques to create a statement of facts from multiple datasets.

ESG

ESG continues to be a topic of focus as investors, consumers, employees and activists place pressure on companies and individuals to meet growing expectations to demonstrate good corporate citizenship. Regulators worldwide have responded, placing more scrutiny and higher expectations of transparency on how companies govern these topics. As regulators enforce more ESG matters, companies may feel more incentivised to subvert regulations and investor expectations by committing fraudulent acts, delivering false, inaccurate or manipulating and misleading disclosures in ESG-related data (eg, ‘greenwashing’ information related to emissions, supply chain or activities-related sustainability).

Regulatory guidance and enforcement trends in ESG

With the global prevalence of ESG issues and the broad scope across an entity’s operations (eg, engineering, manufacturing, finance and marketing), multiple regulators have jurisdiction over various aspects of ESG.

The CBP has already been active in governing the sourcing and importing practices of companies operating in the United States. Certain key US regulators, including the DOJ and the SEC, have committed resources and are in the process of issuing meaningful ESG guidance, likely for adoption in 2024. We highlight below recent enforcement activity of these regulators and key elements of the current (and expected) guidance that are most pertinent for investigative professionals to consider in fraud and compliance investigations.

DOJ

SEC

CBP

European legislation

ESG investigation considerations

Practitioners investigating potential ESG-related violations will need to be acutely aware of their company’s ESG risks and controls within the supply chain –particularly considering the increased reputational risk accompanying perceived indifference or recklessness in the court of public opinion. While practitioners will still rely on many standard investigation techniques, they should expect to supplement those with more nuanced approaches that will aid in navigating the new complexities that they may encounter in ESG investigations, as we explore in this section.

Planning for the investigation

When investigating ESG matters, practitioners should take additional care during the planning and scoping phases. Particularly with the evolving regulatory landscape this year, investigators should actively engage with subject-matter experts to understand applicable regulations, jurisdictions, compliance requirements and expectations of the various regulators. These individuals can be instrumental in supporting the investigation by, for example, designing nuanced testing procedures, interpreting complex regulatory requirements in different jurisdictions and evaluating highly technical manuals and procedures.

Identifying information relevant to an investigation

In an ESG investigation, the nature of the allegations may necessitate reviewing information beyond the traditional data sources relevant to many investigations (eg, financial records and general ledger data). Companies may develop home-grown systems to adapt to new needs for data in areas beyond those that have traditionally been tracked, analysed, reported on and audited. For example, this may include centrally tracking contractual requirements pertaining to business partners’ Scope 3 greenhouse gas emissions. Further, companies may not track certain data points and data may not even be accessible without involving third parties. Data analytics experts, with the ability to understand the back-end database design of non-standard systems, will be essential in assessing what data exists and extracting the relevant data to prepare for the analysis.

In the Dieselgate case, data sets of testing results from multiple vehicle models, along with data gathered from vehicles while in operation, would be critical. If automotive manufacturers performed this type of testing internally, these data sets would likely reside in a system within their emission testing or inspection facility. The data may require scrubbing, formatting and organising to a standard and optimised format before practitioners could use it for analysis. It would also be important to obtain the source code from the software, along with any audit logs and approval records for changes to the code.

We have included two additional examples of the types of data relevant to certain ESG allegations, along with the related challenges that the practitioners may need to address.

• Human rights and labour practices abuses, or around the use of unsustainably sourced ingredients: the scope likely requires delving into a company’s complex global supply chain. Practitioners may encounter limitations in the data they can reasonably gain access to given the likelihood that multiple third parties, whose data the company has no control over, form part of this chain. Targeted analysis of unstructured datasets may turn up documents (eg, emails, attachments to emails such as invoices or shipping documents, and meeting invitations), or even structured data extracts (supplier transaction extracts, raw material pricing data, etc) can provide insight and fill gaps where information is not forthcoming from third parties.
• Greenwashing related to investments: relevant sources will include information about the fund’s ESG rating or scorecard, the basis upon which the determination of its ESG rating was made, and the conditions that had to be met to achieve classification as an ESG fund. Further, fund prospectuses should be identified to consider whether statements made have been misstated or could potentially mislead investors.

Investigative procedures

ESG investigations necessarily require a variety of investigative techniques and procedures, given the potential breadth of scope. Investigation teams will need to take a creative approach to crafting procedures for testing and analysis, considering how to leverage available data that is not historically monitored and gathered or tested for investigative purposes. Variable factors such as the size of the data and the scope of the matter can influence the analysis and sampling techniques employed. As referenced earlier in the article, it may be helpful to seek assistance from skilled data analytics specialists in collecting and organising data for practitioners to review.

The following examples of allegation-specific procedures illustrate additional types of techniques that practitioners could employ in an ESG investigation:

• discrimination and police brutality: analysing metrics around the number of traffic stops involving persons of colour, and the outcome of those stops, compared with the overall statistics for the police department’s traffic stops;
• greenwashing related to investments: tracing statements made in marketing and investment materials back to working papers, analysis and raw data to assess whether environmental impact disclosures made to potential investors are appropriate and reasonable based on source information;
• falsified emissions reporting: utilising software engineers and developers to analyse audit logs of software programming changes and to ascertain whether there are corresponding approved change orders; and
• supply chain investigation: leveraging due diligence records with sophisticated supply chain traceability technologies to scientifically identify the source of materials included in a finished good or to assess whether the raw materials originated from a region where human rights violations (eg, child or slave labour) are known to be commonplace.

Conclusion

As cryptocurrencies and ESG continue to be top of mind for investors and regulators alike, bad actors will continue to look for opportunities and incentives to defraud and deceive stakeholders. Multiple regulators in the Americas identify these areas as priorities and practitioners should remain aware of the trends and regulatory developments. As we have described in this article, many of the necessary techniques will be familiar to experienced practitioners, although often requiring a slight nuance or incorporation of different technologies to adapt to the nature of the allegations subject to investigation.

Notes