Case Studies

A White Collar Forensic practitioner gave expert testimony as a rebuttal witness to the plaintiff's expert who opined that an internal investigation performed at the direction of the audit committee of a public company was insufficient. The expert report submitted in rebuttal set out the accounting and certified fraud examiner standards for internal investigations of allegations of accounting irregularities as well as the performance of "shadow investigations" and found that the audit committee's investigation was performed consistent with industry standards for this category of investigation.

In connection with a dispute alleging that a major technology company had been knowingly supporting a criminal enterprise, a White Collar Forensic practitioner gave expert testimony on the very limited know your customer obligations of a U.S. based enterprise software provider to perform vetting of a domestic software licensing customer. Testimony was to rebut that of the opposing expert who asserted that the defendant company had know your customer obligations that were not supported by any U.S. law or legal precedent.

In connection with a check theft investigation and related civil litigation, a White Collar Forensic practitioner prepared a sworn declaration in support of a Temporary Restraining Order on the evidence collected in the matter indicating check fraud, and the three stages of money laundering (placement, layering and integration) and the methods employed by check theft rings and money launderers. The declaration was successfully filed and the matter is ongoing.

A White Collar Forensic practitioner provided expert testimony in an arbitral proceeding between a Paycheck Protection Program lender and a financial technology company. At issue was which party was responsible to perform anti-money laundering and know your customer procedures in connection with numerous PPP loans which subsequently went into default. The testifying expert provided testimony on the loan underwriting requirements of the U.S. Small Business Administration which is the government agency through which the PPP was administered.

In connection with a guilty plea and prior to sentencing, White Collar Forensic was retained by outside counsel for the defendant in a health care fraud prosecution. Our work was to analyze the government's calculations as to the losses the defendant was accused of causing to the government. The White Collar Forensic team included health care billing experts. Within a very tight window, the team was able to determine that the government's loss computation was three times higher than what could be supported by their own supporting documentation. This information played a role in the negotiations with the government prior to sentencing.

The general counsel of a publicly traded services company realized that they had been defrauded by one of their employees and a White Collar Forensic LLC professional who deployed a small team of investigators and forensic accountants and they jumped right in. The entities received sales commissions and broker fees and also were used to divert revenues away from the company in favor of the employee. In some instances, the expenses associated with the agricultural business were borne by the company and the bulk of the proceeds of the business were diverted to one or more of the employee’s businesses. The investigation revealed that the employee was in fact the owner of the businesses, secured a confession from him and his ongoing cooperation including the voluntary production of his personal and business banking records which enabled the quantification of the loss. This calculation was then used to enter into a settlement agreement between the parties in which the former employee agreed to pay back the money he had improperly diverted away from the company.

An owner of an investment and management company had recently fired their controller for poor performance issues and then discovered unusual wire transfers and checks payable to accounts set up in names similar to the company name. They retained a White Collar Forensic LLC executive who conducted background investigations, a forensic accounting review of the company's operating accounts, surveillance of the former controller and eventually, interviewed the former controller. The former controller had previously said that he had inherited money from his grandmother years earlier. He had also claimed that he was a part owner of a "gentlemen's club" which is why he spent so much time there. The background investigation revealed a great deal of unexplained wealth including a mansion in a very affluent community, 5 high end automobiles and other assets that indicated he was living well beyond his known sources of income even if he had inherited money from his grandmother - a story that was quickly falling apart. The forensic accounting work revealed that the controller had been falsifying bank reconciliations and concealing numerous payments made to bank accounts with names that were very similar to the company name and company properties but were actually deposited into accounts held by the controller and established fraudulently. In total, the investigation revealed that the controller had embezzled nearly $10 million over the course of a few years and had spent it on his house, a very expensive strip club habit, numerous gambling junkets to Las Vegas, Cartier jewelry, and 7 high end cars two of which he had gifted to exotic dancers. When interviewed, the controller admitted to the theft, voluntarily transferred title to his home and consented to the review of his personal financial records and bank statements. The controller was subsequently investigated by the FBI and eventually, convicted of bank fraud and theft and sentenced to 72 months in jail. At the time of his arrest, he was apprehended while trying to climb out of his bedroom window. The company was able to recover some of its losses in civil litigation with its bank since the controller was not an authorized signatory of any of the company's bank accounts and yet was able to divert nearly $10 million.

A board member of an educational institution realized that its CFO may be embezzling from the organization and contacted a a White Collar Forensic LLC practitioner who immediately launched an investigation. The investigation revealed several, particularly unusual things. When the CFO was first hired, the institution's finances were in terrible shape and he was able to turn things around significantly. The CFO was working under an alias. The return address on his resume was a state correctional institution where he was incarcerated at the time he applied for the position. And yes, he went to work as CFO immediately upon his release from prison where he had been serving a 5 year sentence for fraud and embezzlement. The investigation further revealed that after turning the company around, he systematically began embezzling money through a combination of fraudulent vendor payments and misuse of corporate purchasing cards. The investigation included background investigations, surveillance (to ensure he didn't flee before he was charged), forensic accounting analyses of accounting and banking records and liaison with law enforcement. The school's suspicions about the CFO were well-founded and the investigation provided them with the clarity they seeking and the ability to implement a series of improvements to the institution's internal controls that had been exposed by the investigation as insufficient or missing altogether.

The legal department of a global company with an Eastern European subsidiary discovered it been losing intellectual property, raw materials and inventory. They retained a White Collar Forensic LLC professional who assembled a team of investigators, accountants and forensic technology experts. The team learned that the client had acquired the manufacturing company following it's privatization from government ownership. It subsequently scaled back its payroll significantly and automated much of what had been largely manual manufacturing and quality control processes. The team also learned that some of its most sensitive, proprietary technology was being offered for sale by several, much smaller manufacturers in the local market. Through a combination of the use of undercover operatives, background investigations and analysis of the telephone records, the companies selling the proprietary technology were identified. The companies had each been established by former company engineers who had been displaced and some of whom were still in regular contact with the plant manager. In addition, the investigation revealed that finished product and raw materials were been systematically stolen and shipping to a neighboring country for resale. As a result of the investigation, the company was able to make personnel, legal and internal controls changes to secure its intellectual property, inventory and raw materials, regain its equilibrium and recoup market share.

The general counsel of an investment conglomerate with a joint venture (J.V.) investment in the Caribbean suspected management of having an inappropriate relationship with government officials, FCPA violations and embezzlement and engaged a White Collar Forensic LLC practitioner to investigate. Device imaging and the examination of emails is often a good starting point. After imaging the devices and exfiltrating data from the company servers and email system, the data was ready for review. The investigators performed a high level review of some of the different files brought into the review platform. This is often done to get a feel for the type of files in the population. One of the investigators came across child pornography. Shortly thereafter, so did the other investigator. The challenge was multi-fold. A bribery and embezzlement investigation just triggered a child pornography investigation. The original allegations still had to be investigated but now another investigative workstream has just been opened. And the company felt it had a moral and legal obligation to disclose the existence of the inappropriate material - the scale of which was unknown - to law enforcement agencies in two countries. There was tens of thousands of photographs amongst the data that was recovered. We used software that could detect different colors in images. By tuning the software to detect flesh tone colors comprising greater than 50% of the total image, we were able to isolate the offending images without having to look at each. The investigation revealed that the employees involved in the bribery and embezzlement were also responsible for the horrifying collection of photos. While the client may have gotten more than they bargained for, they able to move from a chaotic situation to having clarity. Clarity allows for swift personnel actions and law enforcement referrals. Investigations are sometimes neither desirable nor pretty. When facing allegations though, they are always necessary.

The CEO of a major, Asia-based conglomerate learned that his company CFO - who is also a family member - wired himself $5 million and then left the country. He subsequently retained a White Collar Forensic LLC professional and requested assistance in locating the wayward CFO who was believed to be hiding somewhere in the U.S. The investigation revealed that the CFO had several relatives and friends living in an area of Queens, New York. Using information we had about the CFO and the approximate location of his friends and family members, we took the unusual step of creating the private sector equivalent of wanted posters and posted them throughout the surrounding community offering a reward for information leading to his location. The posters generated a number of leads and subsequent witness interviews who knew the fugitive and had seen him recently. After several days of interviews following up on leads, the subject contacted the client and agreed to voluntarily return to his home country and accept responsibility for his actions. The client started its journey with a number of unknowns. Where is the stolen money? Where has the CFO fled to? Will we be able to hold him accountable? What they ended up with was clarity.

The Chief Information Security Officer of a global company learned that their accounts receivable were being targeted by threat actors in a business email compromise scheme. They retained a White Collar Forensic LLC team member who immediately deployed a team of investigators to support the investigation in several European locations. The investigation revealed that the threat actors used a combination of social engineering and malware attacks to gain access to the email accounts of several members of the EU sales organization. At the time, sales team members were responsible for invoicing their customers and most simply emailed customers their invoices. This enabled the perpetrators to access a cross section of customer names and the company's invoice template. The fraudsters altered the payment instructions of each intercepted invoice to include a bank account under their control. It wasn't until a number of customers' accounts were past due did the company learn that fraudsters had been intercepting customer payments. The biggest challenge facing the client and the investigative team was the fact that they didn't know which or how many customers had been targeted. The team created two investigative workstreams. One in which the compromised sales team members email accounts were scrutinized for clues and a second in which the entire customer base across the affected geographic region were proactively contacted by phone and email. 👓 At the outset of the investigation, the client was faced with multiple unknowns. At the end, the small number of customers who had been victimized were known and the client was able alert their sales force and customers of the scheme.

The board chair of a major cultural institution retained a White Collar Forensic practitioner to perform a FCPA risk assessment and program review. Recently, another board member - a practicing attorney and board member of a number of public companies - pointed out that although they are U.S. based, the organization had potential risk under the Foreign Corrupt Practices Act. The team implemented a plan consisting of an analysis of written policies and procedures, an examination of financial transactions including disbursements, receipts and executive expenses and reimbursements and interviewed a cross section of the executive and management teams. The assessment confirmed that there was indeed some degree of FCPA risk based upon the institution's activities. Members of the executive team meet with cultural institutions in other countries and those meetings often include senior government officials; The organization often hosts visiting cultural institution executives, delegations of foreign governments and high net worth donors from overseas; Some of the exhibits and talent showcased by the institution includes representatives of foreign governments or public international organizations; and some major donors included high net worth individuals based in foreign countries and little was known about their source of wealth. At first glance, a private, U.S. based cultural institution may not seem to have any exposure under the U.S. Foreign Corrupt Practices Act. This project identified specific activities that posed risks of violations of the FCPA and also greatly assisted in raising awareness of those risks amongst the board, executive leadership and middle management. The project provided this client with clarity as to their specific activities that pose risk. With this clarity, they were able to strengthen their policies and procedures, enhance their internal controls including those relating to foreign travel, acceptance and giving of gifts, hospitality considerations when hosting foreign dignitaries and the importance of understanding individual donors' source of wealth. Risk assessments such as those focused on FCPA or money laundering risk can end up radically altering the ethical culture, understanding of potential risks and ultimately, can lead to an organization's transformation into one that is much more resilient and less susceptible to the things that go bump in the night.

Retained in connection with an investment in a proposed roll-up of nursing homes and assistive living facilities.  The proposed investment target was requesting  $100 million to acquire and combine multiple nursing home and assistive living facilities to bring them under a common ownership structure and brand. Comprehensive open source and public record background investigations were performed to provide the investor with negative assurance there were no problems that would prevent the proposed transaction from going forward. One individual who had been identified as the person who had provided the venture with its seed capital had some issues in his background. These initial findings included an indication that his claimed net worth was not consistent with the multiple liens, judgements and bankruptcy proceedings that were ongoing.  Most concerning was a finding that someone with the same name had been indicted by a state Grand Jury in Northern California but for which no further details were available. This finding came 48 hours before the deal was scheduled to close. The closing was postponed pending further investigation.  A field investigator was deployed to attempt to gather further information. The investigator confirmed that the indicted individual was the same person seeking investment capital.  The investigation further revealed that the indictment was in connection with this person's law practice in which he was charged with absconding $3 million in funds held in escrow for his law clients, that his law practice had recently declared bankruptcy and the state's criminal case was on hold pending the forthcoming federal indictment for fraud and money laundering.  During the pendency of the investigation, a federal grand jury did in fact charge the attorney with fraud and money laundering. The investment bank cancelling the transaction avoiding a potential $100 million loss.

In connection with a law suit brought against a financial institution, White Collar Forensic worked together with a team of AML compliance, investigative, legal and technology subject matter experts to assist a testifying expert in connection with a report about anti-money laundering failures that allowed a pattern of criminal conduct to continue unchecked. The work revealed evidence of substantive non-compliance, management override of controls and other acts that allowed a pattern of criminal conduct to go on for several years.  The team's work contributed to counsel's ability to enter into a favorable settlement before trial.

On behalf of a major global transportation company, White Collar Forensic performed an internal investigation of the suspected theft of equipment.  The investigation included in-depth background investigations of suspect employees, the acquisition and analysis of over 4 million emails and electronically stored evidence, imaging and analysis of computer hard drives, witness and admission-seeking interviews, forensic accounting and loss quantification analyses, and preparation of a detailed investigative report in support of a fidelity insurance proof of loss. The matter also entailed the making of a criminal referral to the U.S. Attorney's Office and Federal Bureau of Investigation and the joint performance of a root cause analysis together with an ad hoc team assembled by the chief compliance officer to identify internal control gaps for remediation. The investigation documented the theft of nearly $7 million of equipment, led to a successful criminal referral and an insurance claim which was paid at its maximum face value.

As part of a 10 country initiative to provide anti-bribery and corruption training to senior leadership and middle management in designated high corruption risk countries, we developed and delivered ABAC training that was tailored to the type of corruption scenarios that could negatively impact the client's operations in each of the 12 countries. WCF professionals developed and led the training sessions in Moscow and Kuala Lumpur.  Other countries where other practitioners delivered training included Bulgaria, Romania, Poland, Turkey, Netherlands, Belgium, Hong Kong, China, Singapore and India.

In connection with a U.S. manufacturer's acquisition of a China-based competitors, a FCPA-themed due diligence investigation was performed that revealed inappropriate relationships with members of the Chinese military including a series of improper payments.   The team worked with the client's General Counsel, Internal Audit executives and outside counsel to develop and implement a series of compliance remediation steps as part of a Compliance Action Plan (CAP).  The CAP required the acquisition target to take a series of steps to remediate its internal controls, compliance program and business operation and included severing customer ties with the Chinese military.   Subsequent to the implementation of the Compliance Action Plan, a specialized audit was performed to measure if the agreed upon remediation steps had been taken.   The audit confirmed that the acquisition target had largely complied with the remediation plan and the deal was able to move forward to closing.

The CFO of a major global company based in Korea was alleged to have embezzled the equivalent of $5 million of company funds and then fled to the United States where he was suspected of staying with relatives.   An investigation was conducted in Flushing Queens where there is a large Korean population.  Investigators visited several addresses identifiable with the subject's family, performed neighborhood canvasses and circulate "wanted poster" style flyers in the neighborhood offering a reward for information leading to the subject's voluntary return to Korea.  The investigation resulted in the subject surrendering to a local police precinct and eventually agreeing to return to Korea to face criminal charges.

In response to an action taken by the Federal Reserve Bank of New York and the New York State Department of Financial Services, provided investigation, financial analytical and project management resources to one of the first-ever "transaction lookbacks" performed in connection with a bank regulatory action related to the institution's systemic failures to detect and report suspicious activity.  The project consisted of an exhaustive review of U.S. based transactions spanning multiple years seeking to identify and report previously unreported suspicious activity.  The project enabled the bank to avoid severe penalties and restrictions being imposed on the bank and led to widespread improvements to the bank's transaction monitoring, investigation and suspicious activity reporting processes.

A publicly traded consumer products company was suspected of having inflated its revenues by relaxing its return policy to the point where many of its sales looked more like consignment goods than actual sales where it would be permissible to record them as such.   The investigation included collecting and analyzing millions of internal communications, accounting records, shipping invoices, bills of lading, delivery manifests, returns, rebates and other documentation of sales and the movement of finished goods inventory to its distributors.  The investigation and forensic accounting work performed provided outside counsel with sufficient information to demonstrate that the allegations of channel stuffing were unfounded and the SEC closed its investigation with no action.

In connection with the proposed acquisition of a gas turbine manufacturing company, we were asked to assess the physical security of the campuses, buildings and information technology system servers of manufacturing plants in France and Germany.   The project consisted of interviews and process walkthroughs with key executives, a physical review of the grounds, building exteriors and interior spaces and the server rooms at the two facilities. The culmination of the reviews included a detailed listing of security vulnerabilities that were noted and a budget estimate of the costs needed to bring the acquisition target's two facilities into alignment with the security standards of the client organization.

Assisted a global manufacturer in connection with an investigation of suspected intellectual property theft of proprietary manufacturing technology and inventory.   The investigation included background investigations of former employees, legal entities identifiable with these employees, examination of outbound telephone calls from the plant to these employees which showed ongoing interaction between current and former employees.  The investigation also involved use of the undercover technique to engage directly with individuals suspected of offering the client's reverse engineered machinery for sale.  The investigation revealed that numerous former employees who possessed the requisite engineering expertise used the company's designs to create manufacturing machinery and offer it for sale at well below its market value.  The investigation also revealed that finished product and raw materials were being systematically stolen by insiders who then provided the stolen goods to a network of former employees who transported them to neighboring Ukraine for sale in the black market.  The results of the investigation enabled the company to identify employees who were involved in the IP and property thefts and take action to shut down the theft ring and strengthen their controls.

A major mutual fund company was concerned that they did not have complete visibility into what extent their various mutual fund investments included state-owned companies and/or investments in industries or entities with operations that were subject to U.S. Department of Treasury restrictions as enforced by the Office of Foreign Assets Control.  The team worked with a vendor that specialized in public company data aggregation and was able to query their entire repository of publicly traded companies on each stock exchange in the world and batch process the entire list against OFAC's various restrictive trading lists and a proprietary list of state-owned companies.   The results of this intensive batch processing exercise provided the Chief Compliance Officer with critical information about the state of the company's OFAC and Foreign Corrupt Practices Act compliance programsand enabled him to strengthen those compliance programs based upon what was learned.

On behalf of a federal financial regulator,  performed comprehensive background investigations of applicants to receive federal funds in connection with efforts to restart the country's asset-backed securitization markets by infusing capital into various types of consumer and commercial mortgage lenders. Hundreds of organizations applied for funding including numerous institutions that were eventually charged criminally in relation to the widespread mortgage-backed securities fraud that triggered the financial crisis in the first place.  Through our efforts, the regulator was able to prevent the program from lending to ineligible borrowers such as those that were under investigation.

In connection with a dispute between two mining companies over the ownership of a  foreign mining concession, a comprehensive investigation of the client's legal adversary was performed to include an examination of publicly available information, manual public records and a wide range of human intelligence assets.  The investigation revealed potential improper payments paid to one or more government officials, the involvement of a notorious mining concession broker, unsanctioned logistical support provided a paramilitary group, the unlawful displacement of indigenous people to enable the construction of a country club and a bribe paid to a tribal elder.  The information assisted the company's outside counsel is connection with his ongoing investigations with opposing counsel and the country from whom the concession was granted.

Following revelations that it had been defrauded in a Ponzi scheme with exposure of over $80 million, a major hedge fund requested a comprehensive review of its investment due diligence processes including its use of investigative due diligence of potential investment deals.   The project consisted of a detailed review of the entities and individuals through whom the fund had invested, prior investigative due diligence performed, its sufficiency, how the fund responded when there were adverse findings and the extent to which these reports factored into their overall investment decision.  Upon the issuance of our report, the fund made numerous changes to its investment due diligence processes and investment governance.

In connection with ongoing negotiations with U.S. and Brazilian law enforcement and regulators, a Brazil-based aerospace and defense company needed assistance in the design, implementation and administration of their third-party anti-corruption program, the centerpiece of their newly revamped anti-bribery and corruption compliance program.  The team worked with compliance leadership to inventory the various categories of third party, isolate the intermediaries, harmonize the taxonomy used to describe the various intermediaries and develop a tailored risk scoring methodology that considered country, relationship, relationship size, nexus to government officials and state-owned entities and government agencies, watchlist findings and adverse disclosures.  The team also designed the entire onboarding work flow to include business sponsor forms, third party questionnaires, risk scoring, watchlist screening, investigative due diligence requisitions and fulfillment, interpretation of results, follow-up actions and decisioning.  The company's third party anti-corruption program and other actions it took enabled them to enter into a favorable settlement with Brazilian and U.S. enforcement authorities.

On behalf of a Swiss headquartered investment bank, a due diligence investigation was performed of the investment group seeking investment banking investment in connection with the planned roll-up of numerous assisted living and nursing home facilities.   One of the individuals who had been described in the prospectus as the primary investor, had one item in the initial background check showing a recent criminal charge in the State of California.  State public records have a limited amount of information that is available electronically.   Consequently, a field investigator was deployed to review the manual court records and to make inquiries.  The field investigation revealed that the state prosecution was being held in abeyance in an anticipation of a forthcoming federal indictment charging embezzlement and criminal money laundering.   Further investigation revealed that this individual was an attorney who was charged with embezzling over $3 million from escrow monies on deposit with his law firm and using that money to fund his lifestyle.   It further revealed that his law practice had recently been closed down and filed for bankruptcy liquidation.  The investigation enabled the investment bank to deny the investment which in all likelihood would have been used to assist the main borrower to flee the jurisdiction along with the bank's investment.

A European metals manufacturer received a series of allegations via its confidential reporting hotline and in emails to the audit committee, customers and other key stakeholders in which the reporter alleged that the general manager of their Chinese manufacturing plant was involved in vendor kickbacks, improper dismissals to create opportunities for friends and family members and sexual harassment and assault.  The ensuing investigation included background investigations of the China GM, a review of email communications, human resources employment and dismissal records and employee onboarding and ultimately, an interview with the GM.  None of which served to corroborate the allegations.  The investigation concluded with a report listing out the various investigative steps performed in an effort to corroborate the allegations which served to support the decision to close the investigation with no further action.  It also included an outbound email to the whistleblower dignifying his allegations, explaining the fact that the company took his allegations seriously and investigated them but was not able to prove what he had alleged.   No further allegations were received from this whistleblower.

A U.S. based outsourced IT help desk and IT consulting firm’s many suppliers of computer hardware, software and peripherals were being defrauded by several theft rings who were submitting fraudulent purchase orders as though the purchases were for the company when in fact the “ship to” address was for addresses that were not identifiable with the company. This misuse of the company’s lines of credit with its various suppliers resulted in numerous suppliers being victimized and unwittingly shipping items like laptop computers, printers and other valuable items to private homes of individuals who were unknowingly participating in the receipt and reshipment of stolen goods to destinations in West Africa. The investigation identified all of the victim suppliers and assisted the company in proactively communicating with each supplier reminding them of their procurement procedures and warning them of the ongoing purchase order and reshipping schemes targeting them.

The U.S. subsidiary of a European company requested an internal investigation of its former CEO who had recently been fired for acting without Board authority. The investigation revealed the CEO had taken several additional steps without the knowledge of the board including firing its sales force and replacing them with independent sales agents, diversion of its proprietary product formulations to a joint venture partner without a licensing agreement or other protections of their IP and the payment of bribes to several customers’ employees in exchange for their specifying company products for use in the automobile manufacturing process. The bribes included paying the monthly mortgage of one of the plant employees and cash payments for a second employee. The results of the investigation helped the audit committee to better understand the former CEO’s actions and implement several changes to the internal controls and compliance program.

A pharmaceutical supplier requested assistance in the evaluation of their Office of Foreign Assets Control compliance out of concern that some of their procurement activity may entail importing from countries that may have restrictions over certain categories of product. The scope of the project was expanded to include not only export controls and sanctions, but also compliance with the U.S. Foreign Corrupt Practices Act. Further, it was recommended that the project be overseen by counsel since such a review could reveal instances of non-compliance that could give rise to liability. Ultimately, a project team reviewed policies and procedures, procurement and importation operations, government licensing and other substantive interactions with foreign government officials and delivered a report which gave the client a much clearer picture of their OFAC, sanctions, export controls and FCPA risk and their current risk mitigation capabilities. This led to the development of an action plan to assist the company to utilize internal resources to strengthen its export controls, sanctions and FCPA compliance programs.

A major private equity firm with a fund that included numerous parcels of commercial real estate in its investment portfolio was defrauded by its fund manager. The manager was charged with the operations and maintenance of the various properties including the receipt of rent, improvements, tax payments and maintenance. The employee mischaracterized several million dollars of personal expenses as business expenses instead using company funds to pay for his lavish lifestyle that included several homes, luxury travel and a collection of ultra-expensive luxury vehicles such as Lamborghinis and Ferraris. The investigation was able to separate the legitimate property management expenses from the personal living expenses that were being misidentified as business-related.

In certain states in India, companies that retain contractors to perform a project onsite such as a construction project assume the liability for the payment of payroll withholding taxes of the contractor’s employees for the period of time they are working on the company’s behalf. This unusual circumstance gave rise to a category of consultant in India known as a Labor License Consultant or “LLCs”. LLCs take responsibility for the payroll withholding associated with contractors, remit payments to state taxation authorities and complete all of the necessary paperwork. During a routine anti-bribery and corruption audit being performed by the company’s internal audit department, auditors were told the local human resources director “we pay bribes” all the time. In the ensuing investigation, the records of several LLC companies were reviewed, witness interviews were performed and background investigations were completed. The investigation results led the company to conclude that the allegations of bribes paid by LLC contractors were unfounded.

A publicly traded solid waste company realized that they had been defrauded by one of their employees. The employee had been brought in to head up a specialized division of the company specializing in agricultural waste from farming operations. Unbeknownst to the company, this individual had several companies set up in his name which he mischaracterized as important business partners in the company’s pursuit of agricultural waste customers. The entities received sales commissions and broker fees and also were used to divert revenues away from the company in favor of the employee. In some instances, the expenses associated with the agricultural waste disposal were borne by the company and the bulk of the proceeds of the business were diverted to one or more of the employee’s businesses. The investigation revealed that the employee was in fact the owner of the businesses, secured a confession from him and his ongoing cooperation including the voluntary production of his personal and business banking records which enabled the quantification of the loss. This calculation was then used to enter into a settlement agreement between the parties in which the former employee agreed to pay back the money he had improperly diverted away from the company.

Counsel for a U.S. based gaming company requested assistance in reviewing expense records and other documentation of the company’s third party lobbyist in an Asian country following allegations that certain public officials may have received improper payments in exchange for their support of pending litigation legalizing casino gaming. The review enabled the company and its counsel to respond to public inquiries about these purported payments and determine whether they should move forward with their plans to expand into the country in question.

On behalf of the one the largest restaurant chains in the world, performed recurring comprehensive due diligence investigations of proposed “Superfranchisers” that represented the company’s planned expansion into certain new geographic markets including Morocco, Russia, Saudi Arabia and China. These proposed superfranchisers already owned multiple franchises of other restaurant chains and the investigations were performed in an effort to assist the company in determining whether they represented suitable business partners. Issues such as unusually close relationships with the Kremlin, a contaminated food outbreak in Morocco and other issues assisted the company to have productive discussions with their proposed business partners prior to contract.

A development bank whose mission is the encourage commerce between the U.S. and Indonesia was defrauded by one of its customers in connection with a $5 million loan which was subsequently defaulted on. The borrower was involved in the importation and sale of a commodity which was then sold through U.S. based distributors. The investigation revealed that the founder and chief executive of the company in default had established an alter ego business in a neighboring state under a different name but had continued to sell to the same customers he had identified to the bank in his loan application. This finding enabled the bank to place liens against the receivables and inventory of this newly established venture and ultimately recover the full amount of them money judgement against the borrower.

The U.S. Attorney’s office for the Southern District of New York charged a 14-store specialty retail chain of listening devices and other surveillance equipment with the illegal importation of listening devices which included the appointment of a monitor. The role of the monitor was to oversee the continued operation of the store during the pendency of the indictment, take steps to ensure that the criminal activity that gave rise to the indictment was not continuing and to ensure that the assets of the company were not dissipated. The monitorship continued until the company and it’s key executives were convicted at trial after which title vested to the government which then liquidated the company’s assets.

A large private sanitation company charged with acts of racketeering was placed under a court-appointed monitor by means of a post-indictment restraining order. The entity had a total of 33 separate legal entities, each of which was placed under a separate monitorship. The monitoring process had several objectives. Preserve the government’s future ownership interest in the company by putting controls in place to protect against the dissipation of assets. Undertake procedures to ensure that the criminal activity giving rise to the indictment is not continuing. Review and approval of all non-recurring expenses prior to disbursement. The monitorships continued until after the government secured criminal convictions at which point the companies were forfeited to the government and thereby ending organized crime’s control over the companies.

A client was experiencing a high incidence of inventory theft at a warehouse location in Juarez, Mexico – one of the most dangerous cities in the world. The acceptance of the client matter was contingent on including operational security in the investigative budget. The security detail determined that the investigative team should use as its base of operations, a U.S. city that bordered Juarez rather than overnight in Mexico. Each day, the investigative team was escorted to a bridge leading to Mexico where they were handed off to a second team in a non-descript vehicle who were responsible for the protectees while on the ground in Juarez. At the end of the workday, the team returned to the bridge where the U.S. based security detail escorted the team to their hotel where they provide overnight security.

As part of its business continuity planning, a major consulting firm physically relocated it data center to a more secure location. One day prior to the event, leadership became concerned that their most sensitive non-public and client data would be less secure while it was in transit and requested a security detail. A vehicular security detail was arranged involving several vehicles, each manned with 2 security operatives. Prior to the day of the move, an advance was performed so that the security detail could understand the planned route and make whatever changes to the planned route to avoid any particularly problematic choke points that would make the motorcade vulnerable during the trip. The relocation of the data center went as planned with no security incidents.

The CEO of a U.S. publicly traded professional services firm had a planned trip to an Asia-based subsidiary. Shortly before the trip, the Asian subsidiary received an anonymous threat of violence from what was believed to either be a former employee or an aggrieved spouse of an employee. The CEO was determined not to cancel but agreed to a personal security detail. The CEO and the other executives with whom he was travelling were met at the airport, escorted by specially trained executive protection operators and drivers and accompanied at all public events while in country. At the request of the CEO, the protective team maintained a low profile while attending meetings, dinners and several receptions but still ensuring that the CEO and his team were secure.

Most commercial relationships and partnerships entail putting assets and your reputation at risk. It is therefore a common practice to perform background investigations of entities and related individuals to provide clients with some assurance that the representations that they have made are truthful and that there is nothing in their background that reflects negatively on the character, integrity and history conduct that would make them ill-suited as business partner. Some examples of findings from such investigations include involvement in human trafficking; a pending indictment for theft of client escrow money; a murder-for-hire conviction; one party to the deal was incarcerated in federal prison at the time of the proposed transaction; one of the subjects had a criminal conviction for embezzlement; a potential private wealth management client had a prior conviction for running a stock boiler room operation for an organized crime family; a former employee who was listed as an Office of Foreign Assets Control Specially Designated National for having sold two naval surplus attack patrol boats to the Sadam Hussein regime in Iraq; and an SEC debarment from serving as an officer of a public company due to previous accounting fraud violations while serving as CFO. Not all investigations lead to such findings, but it is better to know these things before you put assets at risk and your reputation.

In a meeting with the SEC, a major software company was asked a series of questions about its customers. Which of your customers is state-owned? How do you come to those conclusions? What heightened standard of care do you hold those state-owned customers to once they’ve been identified? At the time, the client was not able to answer any of the SEC’s questions. A WCF executive subsequently devised a methodology to investigate all 1400 of the company’s customers following a defined scope intended to answer the SEC’s questions and provide further information to assist the client in ensuring each customer was well-suited for a commercial relationship and that there weren’t any other historical or ongoing issues that could prove problematic to the client organization. Within 10 days, the team was able to provide a report on all 1400 customers identifying which was a government agency or state-owned company, other issues that could impact their suitability as a customer or may suggest the need for enhanced controls, and a recommended course of action for each customer. The timely completion of the project enabled the customer to have a much more productive dialogue with the SEC in their next meeting and help set a much more positive tone for subsequent discussions.

The U.S. Foreign Corrupt Practices Act includes two notable exceptions in which it is permissible to provide something of value to foreign public officials: promotional payments and facilitating payments. Promotional payment exceptions make it permissible to pay the travel, lodging and incidental expenses of government officials if the travel is to attend or speak at a conference, tour a company facility, or view a product demonstration. The planned event was a combination of each of these exceptions, but the client wanted to have a clear understand as to which of its invited guests met the definition of a foreign public official, employee of a foreign government or instrumentality of a foreign government or public international organization. A WCF professional was asked to assist a global organization to review thousands of invited guests to a global conference they were hosting at their corporate headquarters to assist the company in determining which of their guest list was a government official, employee of a state-owned company or public international organization, perform a high level background investigation of any of those individuals who met the definition and also enable the client to submit those individual names for compliance review and pre-approval as required under their anti-bribery and corruption policy. This review enabled this important, annual event to proceed as planned and created a framework for it to operate within the constraints of their anti-bribery and corruption policy.

A global manufacturer with a prior FCPA enforcement action in its past learned that its third-party business partners in multiple countries may have been making improper payments to foreign government officials to secure the award of government contracts. WCF personnel oversaw a company-wide review of its business intermediaries consisting of the collection of vendor master file and disbursement records from over 500 ERP systems, devising and implementing a risk scoring framework and the performance of over 5000 investigative due diligence reports many of which included in country investigations and site visits spanning over 60 countries. This retroactive review was performed in parallel to the creation and implementation of a much more rigorous vendor onboarding process that included the designation of business sponsors, questionnaires, a sophisticated risk scoring process that considered inherent, relationship, geographic, disclosure and financial risk and an adjudication process in which business sponsors engaged directly with intermediaries seeking clarity on any findings resulting from due diligence investigations. This third-party corruption risk program continues to serve as a gold standard that many organizations have sought to replicate. It was also the centerpiece of the company’s presentation to the DOJ and the SEC which enabled them to enter into a very favorable settlement.

On behalf of a major investment bank, a WCF executive oversaw a significant number of recurring, in-depth background investigations of SPACs, their sponsors, and directors to assist the bank in complying with bank and stock exchange requirements to authenticate these individuals and identify any potential red flags that could negatively impact the public offering and/or the investing public.

In connection with a Securities Investor Protection Corporation liquidation matter, a WCF executive oversaw the analysis and disposition of assets belonging to the broker dealer and its executives who were involved in insider trading and a series of pump and dump schemes. The team used data analytics to analyze over 10 million outbound phone calls in an effort to identify assets recoverable to the trustee who could then return assets to victims. The phone records analysis revealed that hundreds of calls were placed to banks, law and accounting firms located in several offshore, money laundering safe haven countries enabling the investigative team to identify financial institutions where some of the proceeds of the fraud had been transferred. This effort enabled the trustee to pursue the repatriation of those assets through Mutual Legal Assistance Treaty requests and letters rogatory procedures.

A WCF executive had a leadership role in one of the largest data analytics investigations ever conducted. A major technology company which makes apps available to its customers via its platform performed a large-scale investigation of how app developers using its platform utilized customer data. An initial review of app developer behavior centered on the number of users, the volume of data being consumed by those users and the apps potential for abuse. A subset of those developers were then subject to a more intensive technical analysis of their activity on the platform. This signal analysis then led to certain developers being subjected to more rigorous technical reviews, the requirement that they complete in-depth questionnaires, and be subjected to public record background investigations. Given the high public profile of the investigation, the company and its outside counsel used the results of the data analysis and background investigations to provide updates to the public, its customers, regulators and law enforcement agencies and provided ultimately enabled the company to enter into settlements with consumer protection and regulatory agencies.

On behalf of a medical equipment manufacturer and their counsel, a WCF executive oversaw a forensic accounting investigation of an elaborate fraudulent scheme in which two company executives based in Europe improperly entered into leasing agreements of medical equipment in which they provided 100% financing of medical facilities that were constructed to house the medical equipment and 2 different versions of the leasing agreement. The English language version submitted to corporate headquarters approval contained the company’s standard terms and conditions whereas the foreign language version of those agreements contained very generous terms that favored the customer leaving the company with little to no recourse or collateral in the event of a default. These fraudulent lease agreements caused the company to incur a huge amount of defaults and a loss of over $50 million. The resulting investigation and forensic analysis revealed that the two employees had entered into side agreements with these customers in which they received kickbacks with the understanding that the customers would receive the medical equipment and facility and then default knowing that the company had no recourse. The investigation included intensive data analytics and forensic accounting, dozens of data visualization charts and graphs showing improper relationship and money flows and enabled the company to recover $56 million of their $60 million loss in an insurance claim.

A WCF professional oversaw a private bank’s investigation of the embezzlement of $66 million from a bank customer who had corrupted and conspired with the private bank’s general manager. This customer ultimately was able to open numerous private banking accounts that included substantial lines of credit secured by fraudulent collateral, drew down all of the lines of credit to their maximum and then defaulted. The investigation included an extensive review and analysis of numerous private banking accounts, millions of dollars of foreign transfers to related parties and individuals, including public officials, background investigations of the beneficiaries of those transactions and surveillance of the general manager’s residences once it had been determined that he was attempting to flee the jurisdiction. The culmination of these forensic accounting analyses was a criminal referral to the FBI and a successful insurance claim against the bank’s fidelity policy enabling them to recover most of their losses.

A global services provider was alleged to have made improper payments in multiple Latin American countries in exchange for the award of government contracts. These payments were alleged to have been made through a series of business intermediaries and other vendors in an effort to disguise them as legitimate business expenses. WCF personnel oversaw a retroactive review of vendor disbursements in each country and also devised, implemented and administered a review of payment requisitions prior to any payments being made a going forward basis. This payment requisition review team also identified numerous internal control shortcomings which they were able to share with the finance team enabling them to make timely remedial actions. After several months of performing this vital payment requisition review function, the team successfully transitioned the process to a full-time team in each country. This work, together with several other work streams, enabled the company and outside counsel to successfully negotiate settlements with the DOJ, SEC and several foreign government agencies.

A global manufacturer of highly engineered products retained WCF personnel after an acquisition due diligence report of a proposed merger revealed that an acquisition target may have made improper payments to various government officials in exchange for the award of lucrative government contracts. The work included a review of policies, procedures and internal controls, background investigations of key individuals, an extensive review of vendor disbursements and gifts, travel and entertainment expenditures and other forensic, investigative and compliance risk assessment procedures. The culmination of our work was the joint development of a Management Action Plan of steps that the acquisition target was required to take prior the transaction’s closing and then a follow up audit to determine that each step in the action plan had been taken as agreed. This work enabled the client to complete its purchase of a strategically important target while avoiding undue risk of successor liability.

Subsequent to their acquisition of a European subsidiary, a global operator of a chain of entertainment venues took steps to eliminate the Italian subsidiary of the target and consolidate it under the Spain-based operation. The company’s European CFO was subsequently physically threatened by two individuals outside his Italy residence that if the company continued with its plans to close down the Italy operation, he would spend the rest of his life in a wheelchair. The investigation revealed that prior to the purchase, a local crime boss and member of the Camorra crime family had a great deal of influence over what movies were shown in the company’s Italy-based theaters, which vendors the company used to services and regularly could be found inside the company’s offices where he apparently conducted business from a private office. The culmination of this project were several different potential strategies to distance themselves from the crime boss and sever the relationship without any further threats of violence.

A non-US development bank retained WCF personnel through outside counsel to perform forensic accounting analyses, compliance reviews, background investigations, image and analyze over 100 devices and email accounts in connection with allegations that develop loans and investments were made improperly because of a corrupt relationship between one or more public officials and bank executives. The investigation provided vital evidence to outside counsel enabling them to successfully argue defend the bank in criminal and civil proceedings.

The South Korean subsidiary of a global aerospace and industrial supplies company requested an investigation of their general manager who was suspected of expense fraud, undisclosed conflicts of interest and bribery of public officials. The investigation revealed that the executive used on of his direct reports as a proxy to misuse the company’s purchasing card to pay for Karaoke, gentlemen’s clubs and other forms of entertainment for himself, other employees and local government officials in violation of the firm’s code of conduct and possibly the U.S. Foreign Corrupt Practices Act (FCPA). In addition, the investigation revealed that the general manager had implemented a mortgage lending program for employees in which the company provided private mortgages for key executives. This alone would have been cause to fire the executive but it was subsequently learned that the borrowers had no knowledge of the mortgage loans attributed to them. Instead, the proceeds of this unsanctioned mortgage loan program went directly to the general manager. The investigation led to the dismissal of the GM and enabled the company to implement a series of improvements to their internal controls.