The work of SAMLIT has been commended by His Royal Highness, The Duke of Cambridge, Prince William, in his role as President of the Royal Foundation’s United for Wildlife, which has supported the expert working group on illegal wildlife trade.

In a letter to SAMLIT, Prince William wrote:

“This report and related initiatives by SAMLIT and the expert working group are great examples of how – by bringing the public and private sectors together – we can deliver a significant blow to the growing illegal trade in wildlife that is such a threat to our planet.

I hope other countries will follow the leadership and commitment shown by you and your colleagues in South Africa, and I look forward to our continued partnership.”

INTRODUCTION AND BACKGROUND

Valued at anywhere between $7- and $23 billion per annum1, illegal wildlife trade is quoted by the World Economic Forum as one of the most profitable criminal enterprises worldwide, alongside arms dealing, drugs, and human trafficking, yet it lacks prominence as a financial crime.

In South Africa, by way of example, between January and December 2019, 332 arrests were made, and more than 57 major investigations completed for rhino poaching and rhino horn trafficking alone. These investigations led to 139 convictions, with sentences ranging from two to 15 years, with another six convicted felons receiving sentences of over 15 years2. From January to December 2020, however, rhino killings declined sharply by 33%3, arrests dropped to 156 and investigations to 25. It is understood that the reason for this trend was that Covid-19 hard lockdowns curtailed the movement of products, within South Africa and internationally. On a positive note, convictions for 44 out of 45 verdict cases were obtained – a 98% conviction rate. Between January and June 2021, however, the Kruger National Park alone experienced

715 poacher incursions, resulting in the poaching of 132 rhino and one elephant, and leading to the arrest of 40 alleged poachers. Countrywide, arrests for rhino poaching and trafficking for the same six month period already stand at 125, with a loss of 249 rhinos. During this time, 14 cases were completed, leading to 20 convictions – a 93% conviction rate.4

Until recently, there has been limited attention given to investigating and understanding financial flows associated with IWT. Instead, offenders have been prosecuted for predicate offences such as poaching, possession, or trafficking of wildlife products. As a result of this limited focus on the financial side of IWT, authorities have not been effective in identifying and disrupting illegal networks, or in prosecuting higher-level offenders who operate in criminal organisations involved in IWT.

The South African Anti-Money Laundering Integrated Task Force (SAMLIT) was established in December 2019 as a collaborative public-private partnership between the regulatory authorities, represented by the Financial Intelligence Centre (FIC), the Prudential Authority of the South African Reserve Bank, and the domestic and international financial institutions registered in South Africa. SAMLIT’s objectives include assisting in combatting financial crime, effectively and efficiently, and enhancing a collective understanding of financial crime trends.

In June 2020, SAMLIT established an expert working group (EWG) on IWT, with a view to increasing the knowledge about the financial flows linked with IWT supply chains among financial institutions, law enforcement and prosecuting authorities.

In setting its objectives, the EWG elected not to include flora in their investigation to limit the scope of the research. The EWG recognises
the devastation caused by illegal logging, cycad trading and the rapidly escalating succulent trade, amongst others, and the significant value of these illegally traded products.

The work done by the EWG was not intended to repeat the work already done by various bodies or interest groups, and it drew its insights from a number of reports, most prominently those presented by ESAAMLG5, OECD6, FATF7 and TRAFFIC8, details of which are included in Annexure 1.5.

SNAPSHOT OF WILDLIFE TRADE IN SOUTH AFRICA
PRODUCT FLOWS
Wildlife and wildlife products from South Africa are in high demand globally, with China and other Asian countries representing the largest markets. Criminal networks have established a supply chain on the movement of illegal wildlife products through various stages, from source to poaching, and then through various transit points until reaching the consumer at its destination. Ultimately, the end-user is the enabler of the whole chain, as the demand for these products drives the crime and related prices. Organised crime groups operate as global multinational businesses, connecting local resources to global markets through complex and interlinked networks. These networks facilitate the movement of illegal trade in wildlife through various channels from source to destination.
Wildlife criminals use a variety of concealment and smuggling techniques, relying on complex routes to avoid detection. Trade in illegally obtained wildlife also converges with other illegal products, such as narcotics or arms, and other criminal activities, for example, collusion and bribery.

ACTORS

The organised crime ecosystem comprises many layers in the supply chain. Role players extend from local and professional poachers, to intermediaries working alongside corrupt government or municipal officials and informants, to source and facilitate the flow of illegal commodities along various routes. Logistical networks, including politically connected export firms, coordinate the consolidation, shipment and onward international export, clearing or import of the illegal commodity.

Often, the product is co-mingled with other commodities such as sugar, maize, or fuel to disguise the wildlife product. A combination of individuals and businesses facilitate trade at all levels, from local middlemen and women dealing in small quantities, or corrupt officials taking advantage of bribes to supplement their income, to small-scale exporters seeking extra profits by including a consignment of the illegal goods in their regular activities.

FINANCIAL FLOWS

The range of financial flows varies immensely, depending on where in the supply chain the transaction takes place. The key observations cited in this report provide further context on the most common mechanisms used to transfer funds between actors in the supply chain.

RESEARCH METHODOLOGY

In addition to conducting research into existing reports and reference documents to understand existing available literature on financial flows connected to IWT, the EWG’s approach included four main streams:

INTERVIEWS

Interviews with a selection of individuals and organisations, ranging from informed sources and investigators

in the wildlife industry, to government organisations such as the Department of Forestry, Fisheries and the Environment (DFFE), the South African Police Service’s Directorate of Priority Crime Investigation (DPCI)
and non-profit organisations investigating IWT, such as TRAFFIC and Global Initiative. The intention was to better understand the wildlife crimes and gather any insights on associated financial flows.

SURVEY

A survey among South African banks and money remitters to gain insight into their understanding of IWT and identify the extent to which their existing anti-money laundering (AML) control frameworks have been adapted to detect and mitigate the risk of IWT.

ANALYSIS

In-depth analysis of suspicious and unusual transaction and activity reports (STRs/SARs) conducted by the FIC, to gain insight into the characteristics of actors, sources of funds, financial flows and payment methods associated with wildlife crime. The objective was to inform the profiles that could be used by accountable institutions to calibrate their transaction monitoring capabilities to better detect potential IWT-related transactions and improve intelligence.

CASE REVIEWS

Retrospective case review workshops of past IWT cases with the FIC, DPCI and financial institutions, to test the effectiveness of such workshops as a mechanism to identify trends, profiles, or typologies, as well as transfer knowledge and foster collaboration between the financial institutions and law enforcement.

KEY OBSERVATIONS

While this research did not seek to explore the actual wildlife crimes that precede any financial crime, many engagements led naturally to a discussion on how wildlife and wildlife products are poached and trafficked from South Africa.

What was striking were the views expressed by contributors to this research as to the simplicity and ease with which both wildlife and financial crimes are committed.

The latter can be ascribed to an incomplete understanding around
IWT and its associated financial flows, the suspected use of informal financial schemes such as Hawala, and payment with mechanisms that evade the formal financial system such as barter trade, casino chips, or simply the use of cash. The extent to which front companies are implicated in IWT crimes is alarming, especially those linked to import and export activity and cash-intensive businesses.

Survey respondents and interviewees named the accurate identification of IWT-related financial flows as the biggest challenge facing financial institutions, given the similarities with other crime types, and the co-mingling of transactions associated with legitimate business. Much reliance is placed on adverse media screening, at best a reactive control.

The research done by the EWG, particularly the mining of previously filed suspicious and unusual transaction and activity reports by the FIC, was vital in developing our understanding of the profiles and financial behaviour of IWT criminals. By combining this information with other data sets, the EWG gained insight into the profile of the IWT criminal (e.g. occupations, industries and entity types), an idea of transactional behaviour and transaction values, and IWT location hotspots. These are included in this report as annexures. As the EWG applied its learnings, it became clear that using the indicators in a single dimension would likely produce too many results, and so users of this report and its annexures are encouraged to test combinations of these indicators to create multi-dimensional views of potential criminals, and identify which combinations are most effective. Some examples have been included in the annexures.

Transaction monitoring and analysis, combined with related financial investigations, are essential in understanding the financial flows associated to IWT. Although not yet at optimal levels this plays an important part in identifying the role-players and complex structures operating in South Africa. It further assists in helping to establish the relationships and links across the supply chain – for example, individuals or businesses conducting financial transactions on behalf of the main syndicate members.

It is, however, reassuring to see the extent to which this transnational crime has been elevated in both public and private sector, in recent years. We note:

The EWG also collaborated with the FIC to expand the environmental crime categories on the FIC’s reporting system, goAML, to enable better categorisation, by accountable and reporting institutions of STRs/SARs related to such crimes, which includes IWT.

One of the biggest gains made by the EWG was enabling collaboration between law enforcement and the private sector. Even within the private sector, there is little collaboration between different industries – for example logistics companies and financial institutions. Many contributors support the idea to create a broader, ongoing interest group to foster such ongoing collaboration. Members of the EWG have begun to explore the mechanics to facilitate such collaboration.

COMMODITIES

Africa is one of the world’s richest suppliers of IWT, and South Africa plays a devastating role as both source and transit country for the trafficking of illegal wildlife products every year. The most popular products originating in the country include rhino horn, abalone, and pangolin, with ivory being moved through South Africa in transit to the East.

RHINO HORN

Most of the illegal rhino horn entering the market originates in South Africa, which holds approximately 80% of the world’s last remaining rhino. According to the DPCI, the methods of smuggling rhino horn out of South Africa have, to date, not been sufficiently exposed, with most poaching incidents identified as having occurred in the Kruger National Park. This is contiguous with Limpopo National Park in Mozambique, where many rhinos were taken by Mozambican poachers easily entering, traversing, and exiting the two parks.

The market for rhino horns is greatest in Far Eastern countries, specifically China and Vietnam. Live animal traffickers tend to use direct flights to transport the animals, but rhino horn traffickers are more likely to move contraband through circuitous routes and airports, which they regard to have inadequate detection methods and insufficient knowledge on smuggling methods. Rhino horn traffickers are also able to exploit legal loopholes for the import and export of trophies, smuggling rhino horn or other illegal wildlife products as legal wildlife commodities. Poachers and traffickers in the Xaysavang Network (an international wildlife trafficking syndicate facilitating the killing of endangered elephants, rhinos, pangolins, and other species, for products such as ivory and rhino horn9) had horns from poached rhinos mounted as hunting trophies for export by taxidermists. The trophies provided the cover for getting the horn from South Africa into Asia, where it entered the black market as rhino horn for medicinal purposes.10

PANGOLIN

Pangolins are currently the most trafficked wild animal. Their meat is considered a delicacy, their scales are used in traditional medicine and their skin processed into leather products. Little information exists on the global trafficking routes used to transport these pangolins, but leading non-governmental organisation, TRAFFIC, identified China and the United States of America to be the most common destinations for international pangolin trafficking, while Europe was identified as an important transit hub for African pangolins. Whole animals were significantly more likely to be transported by land, relative to the other transport modes and commodities, and large-quantity shipments involving whole animals tend to be exclusively traded within Asia.11

ABALONE

Abalone is easily smuggled out of South Africa thanks to the porous borders between the country and its neighbours, enabling large volumes of contraband to be transported without detection. Abalone, whether obtained legally or illegally is in high demand in East Asia, where it is considered a status symbol and a delicacy. Hong Kong forms the epicentre of the international trade, importing shipments from South Africa, Australia, Indonesia, Japan, and a handful of other countries to supply a booming local market, with secondary importers occurring in markets like China, where there is increasing demand for high-end products such as abalone.12 Lesotho is a high priority for the transportation of abalone in bags, disguised to resemble a bag of potatoes. The abalone are then transported to Zimbabwe, and on to the Far East, notably China and Vietnam.

PRODUCT FLOWS

South Africa’s biggest wildlife reserve, the Kruger National Park, is home to many of the largest populations of wildlife and endangered species in the world. As such, it is confronted with an alarmingly high rate of illegal activity, suffering devastating wildlife losses to poaching, despite the implementation of expensive and intensive protection measures. This is due, in part, to the extreme poverty of those living alongside the Kruger National Park, as well as widespread corruption.

Poachers target animals in demand by higher-level syndicate members. Once the animal has been captured, or the animal part poached, it changes hands, often many times, before reaching its ultimate destination.

When the contraband is being transported to its destination, it moves through various routes to avoid detection and obscure its origin. It can be disguised in various ways, being wrapped in tin or aluminium foil, to prevent X-ray scanners from producing clear images and obfuscating ivory, rhino horn, weapons and ammunition. Contraband can also be concealed with legitimate cargo, hidden in luggage, in taxidermy, inside logs, in the trunk of a car, in public transport or air freight, and has even been found disguised inside boxes of wine, custom-made clothing or hair rollers. Containers holding illegal products are frequently switched from one vessel to another, with the illegal trade of the contraband taking place at various ports.13 Large shipments are less likely to be scrutinised and allow the IWT to move more freely, evading custom controls through fraud, forgery, and bribery of officials.

IWT is often blended with various other crimes for the supply chain
to operate undetected while maximising profitability. In South Africa, Chinese Triad gangs active in trafficking abalone to Asia also have longstanding drug and human trafficking operations. Abalone trafficking has become intertwined with other forms of organised crime though a transnational market.14

In some countries, wildlife laws only protect animals indigenous to their jurisdictions, and thus wildlife
or plant products originating from other countries
can be moved legally. This creates a haven for traffickers to use these destinations as transit hubs. Routes used by other illicit networks are also used for wildlife trafficking, where it is often found together with weapons or drugs. In some instances, goods are bartered as payment (e.g. the sale of illegal wildlife for drugs) making it very difficult to trace illicit activity unless it is picked up by public officials at ports of entry or exit. Syndicates frequently rely on a network of complicit officials, including custom officials, immigration, or port personnel, across source, transit and destination countries in order to avoid detection. Syndicates often engage with prospective buyers through private groups on social media platforms or via encrypted mobile messaging platforms.

ACTORS IN THE VALUE CHAIN

Through research and interviews, approximately six levels, or actors, in the end-to-end IWT supply chain have been identified.

Variations of these actors occur all the time – in some instances, levels three and four can appear to be a joint venture with level three organising the IWT and level four exporting the goods. At other times, levels four and five will be involved in export. One exception highlighted in the interviews was the notorious Ndlovu gang15, which comprised a syndicate of about five family members, who conducted all roles themselves, with devastating success, and without any formal syndicated support.

Syndicate leaders seldom source the product, relying rather on local controllers in source countries, who oversee the illegal sourcing of wildlife from local poachers, breeders, or farmers. The paymaster, not the kingpin, manages the sourcing, collection and payment to the poachers and all lower-level facilitators.

POACHERS

Poachers make relatively high returns for their illegal activity but are the lowest paid in the entire value chain, despite the high risks involved. At this level, poverty is a major driver for wildlife crime, with poachers poorly educated, and living in poor communities, unable to sustain and support their families. Social pressure exists to join gangs and gang members’ lifestyles become aspirational. These individuals tend to operate within the reserves and are solicited to assist in sourcing products. Syndicates have been known to offer loans to poachers for their families, luring them in and allowing them to accumulate debt to sustain their loyalty.

According to the DPCI, gangs of poachers are known to often enter through the western border of the Kruger National Park, with the assistance of South African citizens who know the area. To avoid army patrols, some poachers cross legally from Mozambique, and stay with relatives or accomplices in South Africa, before entering the park.16 Poachers operate mostly at night, in groups of three and four, with full moon a favourite time to be out looking for wildlife. A typical group would comprise one man carrying a rifle (borrowed or hired, and fitted with a silencer if available), a second with an axe or machete and a
third with a few provisions. Occasionally, they may include a member armed with an AK-47 assault rifle. In most instances they carry cell phones, but no radios or night vision equipment. They hunt in jeans and t-shirts, some barefoot or wearing running shoes and sandals instead of boots.17 Poachers from poor communities do not have the resources of professional poachers, and will usually attack the wildlife from up close, immobilising the animal and removing the horns roughly using an axe or similar tool. Professional poachers have well-structured operations, using high technology methods such as tranquiliser guns, helicopters, veterinary drugs, cyanide poison and high calibre weapons, including firearms with silencers. These poachers rely primarily on middlemen higher up in the value chain for weapons, ammunition, and night goggles. These intermediaries also support the poachers with transport and intelligence.

Illegal abalone harvesting in South Africa is highly organised and usually controlled by organised crime groups managing drug trafficking too. Abalone poachers are colloquially called divers. Recently, there has been an increase in divers in the Eastern Cape, a major source of supply for illicit abalone.18 Throughout the Western and Eastern Cape, abalone poacher networks appear to be very structured, with buyers and middlemen paying divers, and divers paying their own assistants and service providers. These would include carriers and spotters and, in the case of boat-based operations, skippers, deck assistants, and boat owners.19

TRANSPORTERS

FRONT OR SHELL COMPANIES

Transporters typically involve intermediaries, who often act as a connector, collecting product from multiple poachers, packaging them, and passing them to national centres for processing or export. To collect the raw product, they coordinate poaching events, maintain radio contact with poachers, collect horns and carry or transport them through secret routes to the point at which they pass them on to the next person in the distribution chain.

Domestically, common modes of transport noted at a municipal or provincial level include game reserve vehicles (game viewers and staff vehicles), and official or private vehicles of corrupt municipal staff and officials. Goods moved between provinces tend to move by road. Cash-and-carry vehicles are frequently used, usually accompanied by a “pilot vehicle” as a lookout along the road, as well as other, more inventive methods such as ambulances, hearses or funeral parlour vehicles. Motorcycles, car-hire and diplomatic vehicles are often quoted as chosen forms of transport.

Local intermediaries, such as packers and transporters, help to move the wildlife and prepare it for export. Local port facilitators ensure that the shipments make it through custom controls. The paymasters usually deal with the poachers and handle payments to the various role-players involved, ensuring funds are received and dispersed. These intermediaries usually organise the crime groups and facilitate the international smuggling, by using front companies and corrupt authorities.

Internationally, goods travel via air or sea shipment – often falsely labelled or declared as other merchandise. The product is often processed into items such as jewellery, carried in hand luggage, or concealed with other products such as engine parts, wine boxes, artwork or electronics. A favourite practice is to hide items with strong smelling products such as animal hides, dried fish or coffee, to conceal the aroma of the wildlife product or confuse sniffer dogs. Rhino horns tend to be moved to foreign countries through shipping containers by mainly Chinese and South African nationals who set up structures to move horns via the Congo and to China as the destination.

Front or shell companies are mainly used in both source and destination countries by criminals for the IWT. Organisations operating and claiming to be engaged in protecting wildlife through a legal structure have,
in some cases, been linked to IWT. These include zoos, wildlife farms, endangered species breeding facilities and captive breeding operations, that traffic in both legitimate and illegitimate products from South Africa. Legal breeders are known to launder wild animals through their facilities, contributing to the difficulty in pinpointing illicit transactions and illegal activities. This can be for various reasons, such as a higher demand for wildlife than the quota of the legal trade allows. Demand is the driver of the crime and the high demand for these wildlife products will continue to drive illegal trade simply because of the lucrative nature of the business. Buyers also place higher value on illegal wildlife products when they are considered rare and uncommon, further driving up prices.

DESTINATION OR CONSUMER MARKET

The destination or consumer market is where the animals and their derivatives are sold to the end user, which typically involves catering and jewellery sectors, as well as food markets, farms, circuses, and pet stores, to name a few.

Many contributors to this research commented on the role of corruption as a major enabler for IWT. In a few cases in South Africa, rangers entrusted with safeguarding wildlife were found to have killed, dehorned rhino, and transported the horns to the traffickers. It was said that by moving in government vehicles, they often were not subjected to searches. Corrupt facilitators enable the illegal trade in wildlife to occur by accepting bribes, issuing fake or forged CITES permits or licenses – or simply turning a blind eye to illegal activities.

STAKEHOLDER INTERVIEWS

The EWG interviewed representatives of 19 organisations spanning various industries and sectors involved in countering wildlife trafficking. The interviews focussed on understanding product flows and financial flows and explored the interviewees’ perceptions of the effectiveness of control measures in place to combat IWT in the public and private sectors.

KEY LEARNINGS FROM THE SURVEY

The most salient outcome from the survey responses provided was the reliance placed on external intelligence to support the identification of potential IWT risks within the financial institutions.

Institutions felt one of the best practices to address IWT was the collecting and sharing of intelligence. In contrast, cooperation, feedback, and pro-active intelligence sharing have been cited by respondents as a major challenge for investigation and prosecution, followed by perceptions of corruption and resource constraints.

The biggest challenge facing financial institutions was accurate identification of IWT-related financial flows, given the similarities with other crime types, and the co-mingling of transactions associated with legitimate business.

Most financial institutions have between one and five investigators focusing on IWT-related cases, but none have investigators solely dedicated to IWT. Of the financial institutions surveyed, 55% mentioned that they have not investigated any IWT-related cases over the last three years, with only 18% confirming that the cases reported led to successful prosecution of IWT offenders.

The primary detection control noted by the financial institutions was the screening of clients and parties to a transaction against adverse media databases. Some financial institutions emphasised the use of existing transaction monitoring technology to identify suspicious transactions that could potentially relate to IWT. However, the majority responded that they did not have a specific system in place to detect IWT.

Training and awareness have not been fully utilised to upskill investigators, with only 41% of financial institutions confirming the use of bespoke IWT awareness training to upskill staff tasked with detecting and investigating money laundering associated with IWT.

Finally, 27% of financial institutions responded that they had no strategies currently in place to encourage the reporting of IWT to the appropriate authorities.

The survey showed that some progress has been made in addressing IWT as a financial crime risk. However, it is not consistently prioritised across the industry, and further upskilling is required to effectively detect, disrupt, and deter IWT.

DATA MINING OF SUSPICIOUS AND UNUSUAL TRANSACTION AND ACTIVITY REPORTS

The FIC analysed suspicious and unusual transaction and activity reports (STRs/SARs), hereinafter referred
to as “reports” in this section, filed by accountable and reporting institutions relating to IWT, to uncover the characteristics of actors, sources of funds, financial flows and payment methods associated with wildlife crime.

The Financial Intelligence Centre Act, 2001 (Act 38 of 2001) prohibits the FIC from sharing the contents of the regulatory reports it receives from financial and non- financial institutions. As such, the FIC provided only its observations and intelligence as an input into this report and at no time was the content of any STR/SAR report shared with other members of the EWG.

THEMES FROM THE DATA MINING

Data mining of the STRs/SARs provided insights into wildlife trade actors and business entities, but also highlighted gaps in the understanding of who the criminals were and the payment methods they used.

During the interviews, most interviewees shared a strong sense that the use of cash by perpetrators was the main reason that IWT transactions are difficult to trace in the financial system. The absence of substantial financial flows in reported transactions corroborated this notion.

Transactions that were reported and could be attributed to IWT were limited in terms of revealing flows between level one actors (typically poachers) and any interactions higher up the chain. The most useful information arose from reports where specific actors known to be involved in IWT were identified, and where the FIC could then scan the database for any related parties or accounts.

It was also noted that the submission of many of the reports were triggered by adverse media. The reporting person may be suspicious of a transaction or activity in a client account but has no corroborating evidence to report the crime as being related to IWT.

Closer collaboration between non-profit organisations and authorities may assist in obtaining richer data regarding perpetrators and their activities, and ultimately identifying the proceeds of crime more quickly and accurately.

It was very conspicuous that few reports on politically influential persons (domestic and international) appeared in the analysis conducted by the FIC. Information obtained from the interviews indicated that corruption was a major facilitator in committing IWT crimes. However, regional organisations dealing across southern African countries state that proving the flows to be linked to IWT is significantly more complex in regions that see high volumes of cash transactions.

The data mining exercise indicated that the uptake of crypto currency transactions in relation to IWT crimes is still relatively low. This evolving technology is becoming more popular amongst criminals, however, and should be monitored for future trends.

The analysis of individuals, entities and the types of transactions indicated slight differences when it came to rhino poaching, broader IWT or endangered species cases.

Analysis by the FIC into rhino poaching cases revealed perpetrators to be primarily Chinese, with some Vietnamese, and occupations were most often listed as self-employed or unemployed. Farm employees in
South Africa were also noted to be involved, albeit to a lesser extent. Analysis of business accounts showed little business-related expenditures – such as salaries or tax – corroborating the concern raised in the stakeholder interviews over the use of front or shell companies. Personal accounts often showed no salary credits, living expenses or debit orders.

Cases of suspected smuggling or poaching of endangered species also featured Chinese and Vietnamese nationals. Notably, occupations tended to be listed as managerial or in engineering. This could be explained by the Northern Cape’s prominence as a mining region, as well as its being the source of many trafficked plant species. References to businesses included travel and estate agents, and employers included trading businesses such as China Town, wholesalers, cash and carry, and Chinese restaurants.

Interestingly, none of the cases reflected the involvement of a politically influential person.

Bank account analysis featured deposit references that tended to include Asian names or long codes. Incoming funds were most commonly cash, in large or round amounts, from multiple locations
and frequent transactions, while outgoing funds tended to be via ATM cash withdrawals and point of sale purchases, including excessive card spending locally and abroad. Endangered species cases also referenced LUNO and VALR, indicating possible crypto currency payments. All crime types reflected the trend of rapid disposition of payments.

For detailed analysis please see Annexure 1.4.
PROFILING OF STRS/SARS LINKED WITH IWT-RELATED

KEYWORDS OR INDICATORS

The characteristics of reported persons or entities, and their transacting patterns in STRs/SARs containing IWT-related keywords, are summarised in Annexure 1.4.

Information on entities appearing in reports related to IWT keywords or indicators seemed primarily to be connected to rhino and abalone poaching, with some references to other forms of wildlife trafficking.

Many of these STRs/SARs were submitted after the reporter had noted adverse media relating to the perpetrator, by which time the perpetrator would have been arrested, convicted, awaiting conviction, or released on bail.

Individuals named in the reports were noted to be South African or Zimbabwean, but in most reports submitted, nationality was not stated. Their occupations were listed as self-employed or unemployed, while vulnerable parties such as students, pensioners and home executives were connected to rhino and abalone transactions. Farming and company directors, again, were occupations connected to rhino poaching, as was one police constable. In most instances the employer of the reported person was unknown, although many of them appeared to be employed on game farms, ranches, plant nurseries, and holiday resorts. Officials from SANPARKS, DFFE, SAPS, SIU, as well as a municipality appeared in various STRs/SARs, as facilitators in abalone, rhino poaching and other wildlife crimes.

Business accounts involved featured no business-related expenditures such as salaries, or tax, and personal accounts showed no salary credits, living expenses or debit orders. Funds moved quickly in and out of accounts, some minors’ accounts were used, and people were unable to explain the source of their funds or wealth. Few reports reflected the suspected involvement of a politically influential person.

Reported deposit references included some of the following keywords: secret, moola, mampies, happy, hunting package, villa payments, taxidermy, hunting trophies, names of individuals or entities involved in crime or code references with long alpha-numeric values.

A variety of payment methods were identified for incoming transactions into suspicious accounts. The most common was through cash deposits (24% of reported transactions), via ATM and branch cash deposits, primarily in round or large amounts, and multiple transactions, conducted from various locations in South Africa, but many of which were made at airports.

Incoming funds mostly occurred via electronic payments (16%), RTC (11%), immediate transfer credits, SWIFT payments (1%), cheques (1%) and money received from gambling institutions (1%). Internal transfers from different account holders of the same bank (9%) featured prominently. It was also noted that funds were often sent in the same amount to different individuals on a regular basis.

Funds exited reported accounts most frequently via ATM cash withdrawals (16% from different regions in SA) and point of sale purchases (14%).

Other transaction types also frequently noted included electronic transfers (8%), debit orders (5%), internal transfers to account holders at the same bank (4%), casino spend (1%), airtime and prepaid purchases (1%), Western Union and Moneygram transactions (1% of payments described as gifts) and cash send (1%).

Other indicators relating to payments included funds disposed of
in short succession after receipt, disbursed in different geographical regions, high value payments, regular card purchases from the same place and gambling accounts. Transfers to investment accounts featured alongside immediate large cash withdrawals after deposits.

PROFILING OF STRS/SARS LINKED TO RELATED ROLE PLAYERS

The FIC analysed individuals with occupations matching to IWT-related keywords. These were occupations typically associated with IWT, for example individuals working in tourism or hospitality such as game lodges or hunters, as well as veterinarians, pet shops, butchers, taxidermists, mining, managers or diplomats.

Specific attention was given to diplomats, who could potentially pose a higher risk for the IWT category. Most reports about these individuals indicated involvement in the movement of funds, however, it could
not be confirmed that funds deposited or received resulted from IWT. This was because the intelligence received in the STRs/SARs does not always contain sufficiently clear information on whether the clients, entity or account is involved in IWT. As mentioned previously, the EWG subsequently collaborated with the FIC to expand the IWT-related categories on the FIC’s reporting system, go-AML, to improve the categorisation of STRs/SARs.

Among the channels used for movement of money were money remitters and foreign exchange dealers. The analysis conducted by
the FIC revealed that tourism or hospitality staff often received money remittances from multiple individuals and different offshore jurisdictions, and the funds were often received in multiple orders consecutively. It was also frequently reported that the funds were then wired to another jurisdiction shortly after receipt.

Foreign exchange transactions showed individuals in occupations mentioned in the opening paragraph above exchanging large amounts of funds into foreign currency or exchanging large foreign currency for rand with no apparent reason. It was also observed that several tour and travel guides exchanged large values of foreign currency (mainly USD) for rands.

When the source of funds was queried by the institution filing the report, the reason provided by the client was that the funds received were gifts. Some individuals were seen to exchange high value foreign currency amounts after returning from foreign travel or having purchased foreign currency without a clear description of purpose of the purchase, or frequent consecutive exchanges of foreign currency. These transactional behaviours cannot be linked directly to illegal wildlife trafficking, but the patterns, together with the behaviour of the individuals, raise suspicions, and could be construed to be indicators of IWT, given their profession and the influence they exercise.

The FIC extracted data from STRs/SARs on business entities matching to IWT-related keywords. Common trends and role players identified showed many transactions to be conducted through multiple ATM cash deposits and EFTs. Transactions for entities were also identified to be usually conducted by company directors, the majority of whom were South African nationals. The FIC observed in its analysis of reports that often, shortly after the funds were received, they were immediately withdrawn through cash withdrawals, point of sale purchases, multiple debit orders or EFT payments.

None of the reports linked to these business entities could be confirmed to be connected to IWT, as the intelligence received from these STRs/SARs did not conclusively indicate that the funds transacted through these businesses and its accounts, or by its directors, were as a result of IWT.

IDENTIFICATION OF REPORTS CONTAINING ROLE PLAYERS IN OPEN-SOURCE MEDIA

The FIC identified certain individuals who were reported by accountable or reporting institutions, whose names appeared in adverse media connected
to IWT. Through the FIC’s STR/SAR database, 39 individuals from various nationalities were identified and profiled. Most of the individuals’ profiles were stated as self-employed, with the minority employed by companies involved in marine conservation or birding. The method of payments noted in the STRs/SARs were multiple electronic banking transfers coupled with multiple cash deposits. Many of the reports received related to adverse media and were analysed by the FIC and disseminated to the law enforcement agencies where appropriate.

COMMON METHODS OF LAUNDERING PROCEEDS FROM IWT IN SOUTH AFRICA

All of our research pointed to cash still being highly prevalent in the trafficking of wildlife and wildlife products. The overall theme observed by the EWG aligns to that of previous research reports which concluded that methods of payment and laundering become more sophisticated higher up in the supply chain, and that basic cash or barter tends to happen at the lower levels.

CROSS BORDER

When questioned as to how funds entered the financial systems, common responses from survey respondents and interviewees included the use of front companies and enablers. Many of these businesses appeared to be legitimate, but analysis of their transactions pointed to large incoming flows, and showed few legitimate business expenses, such as rent, salaries, insurance and income tax or VAT payments to or from the South African Revenue Service (SARS). Co-mingled funds in the transactional accounts of implicated persons or businesses were noted in numerous investigations, as well as payments from known or suspected syndicate members linked to IWT. Transactions associated with illicit activity were noticed amongst seemingly legitimate business-related transactions.

Often, a network of front companies is created, and accounts established with local banks to move money via the formal banking system. These funds are disguised as legitimate income from the front company’s activities or sometimes use the international trade system (trade-based money laundering). One example featured trade in marine products

to mask ivory shipments, used by a Chinese ivory smuggling group operating out of Tanzania. Locally registered companies held accounts at two different banks in both USD and Tanzanian shillings. In other instances, illicit shell trading companies were used to receive incoming funds or money mules were used to accept deposits and move across borders with bank cards.

Money mules are individuals paid by a syndicate member to either allow them to take over their bank account or, in some instances, open an entirely new bank account in their own name, after which they hand over the card and banking information to the syndicate member to use at will. This way the syndicate can transact without being directly linked to crime. The person being paid deploys a sense of wilful blindness and often does not know why, or to what extent, their account is being used.20 21

It is not uncommon for the money flows associated with IWT to be linked to other crimes, such as fraudulent documentation or paperwork, trade- based money laundering including over-, under-, or fictitious invoicing, as well as corruption to facilitate the inflow of funds into South Africa.

The most common responses as to how IWT-related funds move across the borders was through the money transfer system, such as EFTs, money service businesses (MSBs), and informal remittance systems (particularly into offshore accounts). Casinos and retail stores are often used to transfer funds back into South Africa. Currency coming back into South Africa is often USD or Euro.

Funds leaving South Africa are predominantly in USD, Canadian dollars, Euro or Thai Baht, and are moved out of the country through suspected cash smuggling and money transfer systems. Money remitters and other similar services are used to transfer smaller amounts of money from Asia to China to cover additional expenses such as shipping costs. The use of money transfer systems (also known as money remitters) and bulk cash smuggling has been noted – especially in Central Africa. Money changers often have accounts at local banks in Africa, and money is deposited as Chinese Renminbi in China and paid out in US dollars in the African country.

An analysis performed by DFFE noted that far more funds were being sent out of South Africa by wildlife traffickers, than were coming into the country, but they did caution that co-mingling of legal and illegal trade can skew the results. In the ESAAMLG region, the suspicion is that funds are moved in the form of cash or via Hawala payments.

WITHIN SOUTH AFRICA

Unusual cash deposits and EFTs into park rangers and other informers’ accounts, and unusual cash spending for flashy or expensive items such as cars and houses (or boats in the
case of abalone poachers) – particularly in areas close to the Kruger National Park or reserves – should ring alarm bells. In many instances, the need for lifestyle audits was repeatedly emphasised. Suspects caught for poaching or trafficking wildlife or wildlife products can seldom afford legal counsel or pay bail, but often end up doing so through support from higher levels in the syndicate.

Many respondents noted that traffickers mask IWT activities under the cover of seemingly legitimate wildlife- or animal- based businesses. The use of the legal wildlife industry to mask illegal trade is prevalent in South Africa. This includes wildlife breeders, hunting, taxidermy, and legal wildlife trade exporters. The link to corruption allows some of this activity to occur using under-declared or prohibited species alongside legal exports.

Given the intermingling of illicit and legitimate businesses, and the high use of cash, it was noted that often only after the apprehension of the criminal smuggling the actual goods, can a money trail be created, working backwards from the end point. Specific mention was made of balance sheets and income statements not matching up to the cash flows in the bank accounts.

Another respondent mentioned examining more closely lodges or private reserves that advertised rhino, or spent money on dehorning rhino, but did not have high security expenses. Two syndicates in Mpumalanga and Limpopo were said to have strong connections into construction and transport businesses, as well as cash-in-transit businesses

CASH

Cash remains one of the most prominent methods of transferring value amongst IWT actors, which remains difficult to track as, in many ways, the transfer of ownership circumvents the formal financial system altogether. Law enforcement agencies often find large amounts of cash when raiding homes or offices linked to suspected IWT cases.

Poachers are mostly paid in cash or “send-cash” options that create vouchers, redeemable at selected retail till-points or ATMs. Cash is the preferred and most frequently used method of payment as it minimises the risk of detection and allows for easier flows between legal and illegal economies. Cash transactions make it difficult to trace the linked role- players because this greatly limits the financial footprint. Entry level poachers earn between R2 000 and R5 000, receiving payment after the goods have been delivered. As the levels in the value chain rise, so too do the earnings, depending on the species being traded.

Cash is often laundered through the purchase of vehicles or boats (abalone), and via the construction industry, where building materials
are purchased through cash, after which completed houses are sold legitimately. Cash-in-transit and transport industries feature heavily in the IWT industry. Cash intensive businesses such as Chinese shops or markets easily combine illegal cash with other legitimate cash deposits.

BANK TRANSFERS

EFTs are primarily associated with actors involved higher up in the supply chain.

Syndicate leaders may also make payments to members for miscellaneous expenses, including vehicle hire and domestic accommodation, which makes it difficult to establish links to those involved, based on transaction descriptions or references. It is difficult to establish the main person controlling the entire syndicate because of the complexity of the transactions, where various business and personal accounts are used to co-mingle funds, as well as the use of a spouse or relative’s account on the main member’s behalf.

GIFT OR PAYMENT CARDS AND VOUCHERS

Three interviewees noted the use of gift and payment cards to make payments to level two or three intermediaries, as an alternative to moving value through the IWT value chain. One respondent noted a case where vouchers (iTunes and Google Play) were purchased from a supermarket with cash, to be sold online. On raiding a property, the police confiscated rhino horns, as well as R2.7 billion worth of vouchers, which had been originally purchased via one supermarket. Prepaid cards (iTunes, Visa, phone cards) provide a convenient and portable currency whereby traffickers can pay for poaching and related services in source jurisdictions, and transfer funds internationally. Unlike bulk cash shipments that can be detected by scanning equipment or sniffer dogs, prepaid cards are easy to move across international borders undetected, and can be sold globally via e-commerce platforms, or used to purchase high-end electronics, which can be resold for ‘clean’ cash.

Airtime vouchers were also noted to be easily moved across borders. These airtime purchases conducted via EFT are critical to investigations. A paymaster is used to distribute payments to various accounts and accomplices – big cash deposits are paid into a paymaster account, who then transfers funds quickly out of the account, via EFT, ATM withdrawals or cell phone money transfers. Numerous small amounts are often moved to several different accounts, particularly minor accounts, via payments to partners, children, or other family members.

CELL PHONE PAYMENTS/MOBILE MONEY

Mobile money payments are very prominent in the lower levels of the value chain and often physical cell phones, with their sim cards, swap hands between the criminals to further create confusion for anyone attempting to analyse and profile the users’ behaviour and transactions.

ATTORNEY TRUST ACCOUNT PAYMENTS

During the EWG’s interviews, several respondents mentioned the suspected use of attorney trust accounts, to conceal the proceeds of IWT. It was not possible to confirm this through the analysis done by the FIC in its mining of STRs/SARs, due to such reports not having been made to the FIC. It was speculated that intermediaries in the IWT-chain transfer funds or even cash to attorneys, who then allegedly move such funds
into the respective trust accounts, from where they can be refunded legitimately. The purchase of properties either through cash or the attorney trust account has also been noted, with the result that funds do not reflect in the personal bank statements of the suspect.

THE ROLE OF CASINOS

Casinos appear to feature in various roles.

The use of casino chips as payment, particularly to level two and three intermediaries, was highlighted in several interviews and many of the individuals discussed in the case reviews were known to frequent gambling institutions. The casinos have dutifully reported any large cash deposits and suspicious behaviour, but it is clear from the reports submitted by casinos that many individuals return to the same casino believing that their behaviour has gone undetected.

As mentioned in our case review comments, these parties appear to be active gamblers who visit the same casino multiple times. The imbalance between the value of purchased chips and that “cashed-in” later, raises suspicions that chips may be used to pay actors in the IWT supply chain rather than making more traditional payments, a fact supported by the interviews with conservationists and law enforcement. Actors appeared to be laundering money by depositing cash at the casino to convert into chips or put onto a casino card, and then withdrawing similar, and sometimes lesser amounts shortly thereafter.

OTHER RED FLAGS

One indicator that came up repeatedly was references to “flashy” lifestyle expenses, especially when featured in high-risk industries. For example, purchasing expensive jewellery, diamonds or gold linked to businesses such as wildlife breeding or hunting.

Other references were made to stokvels and funeral services, receiving large or frequent deposits, and not reflecting corresponding business expenses.

In the Western Cape, level two or three players were noted to be boat owners or diving companies, hiring out rubber ducks and other boats, which were used by poachers diving for abalone. Many of these individuals were said to be involved in, or connected to, poachers and gangs, who traded in both abalone and drugs.

In many instances, bartering for small items of wildlife products in exchange for drugs, weapons, or sometime food or cattle, were noted to take place.

PAYMENT AMOUNTS AND TRANSACTION DETAILS

The EWG’s research and experience in analysing accounts has shown repeatedly that these indicators are most effective when looked at holistically, in conjunction with one another. For example, looking at the lifestyle of a municipal worker, receiving regular funds in specific amounts over and above his or her salary, and with strange payment references to IWT keywords such as “pet shop” or “moola”.

IDENTIFYING SUSPICIOUS BEHAVIOUR

It has become quite evident that there is no singular lens that can be applied when looking for financial flows associated to potential illegal wildlife crimes. Applying only profile types such as industry codes or occupations delivers far too wide a range of results to analyse and understand. Similarly, using only the amounts listed earlier in this report, delivers far too many examples to investigate and often includes many examples of legitimate transactional behaviour.

Instead, we have found that combining the factors with one another often leads to a far more focused, and therefore smaller range of clients or transactions to investigate.

For example, looking for cash deposits of R5 000 will deliver far too many transactions to investigate. But when combining the R5 000 with one of the hotspots in this report (listed in Annexure 1.2 for ease of reference), and/or one of the occupations mentioned (listed in Annexures 1.3 and 1.4 for ease of reference), one is able to narrow down the search for suspicious behaviour. A further enhancement of such data may be the inclusion of toll gate and fuel services transactions to identify individuals travelling to the hotspots and then conducting suspicious transactions around the time they are in these locations.

Due to the existence of the previously mentioned “paymasters” in
South Africa, monitoring for bursts in payment activity – either one account receiving money and making many smaller payments, or one account suddenly receiving a large volume of receipts – becomes critical, especially where the activity occurs around one of the IWT hotspots. Similarly, traditional flow-of-funds rules, where an account receives and disburses almost all the funds in short succession, again combined with hotspots, industries or occupations mentioned earlier, may lead to strong alerts for potential suspicious behaviour for IWT.

OTHER OBSERVATIONS

Unsuccessful prosecuting of IWT, lack of centralised reporting and the lack of information sharing are critical challenges that require a structured process to stimulate cooperation.

CHALLENGES TO PROSECUTION

When discussing the challenges to successfully prosecute IWT, respondents identified multiple obstacles. There were some overarching themes throughout the responses. Five individuals noted legal limitations and insufficient legislation, as evidenced by weaknesses in the judicial processes, including the inability to convict offenders, weak legal penalties, and insufficient evidence. Five individuals also noted corruption as a challenge when it comes to prosecution. Corruption was noted at all levels from police, park rangers, airline staff, shipping companies, politically involved individuals and within the judiciary. Mention was made of the indiscriminate closing of the Skukuza rhino court at the time, which hindered the judicial process, prosecutions, and convictions, and made it dangerous for witnesses to testify.

Respondents noted a lack of cooperation between various countries. Some government organisations mentioned that their jurisdiction did not extend outside the borders of the country and, thus, the investigations fell outside their remit.

Other reasons cited include the failure to investigate large seizures, non-use of intelligence in investigations and prosecutions and the challenges of finding information and intelligence. Another issue mentioned is the failure to prioritise wildlife trafficking as a serious crime in the manner that was suggested in the National Integrated Strategy to Combat Wildlife Trafficking in 2017.22

A theme emerged around the poor quality of investigations, and the failure of law enforcement and prosecutors to conduct thorough investigations, particularly of higher-level criminals. Some respondents stated that various departments and provincial authorities were working in silos, where not all stakeholders had access to the same information, hampering investigations. Lack of visibility of successful prosecutions were cited as reasons why criminal activity was often not reported in the first instance. Proving the guilt of, and connecting, offenders was hard to do, especially with low level poachers, who would not be convicted, and were easily replaced.

Identifying where cash entered the system or changed to forex was not clear, and one respondent noted a need to facilitate cooperation not just on financial flows, but also on asset forfeiture and disrupting product flow. The co-mingling of legal business with illicit trade was highlighted, especially where cash-intensive businesses, such as casinos or Chinese shops, lacked financial trails.

REPORTING OF WILDLIFE CRIMES

Many interviewees stated that the lack of centralised reporting was a hindrance to clamping down on wildlife crime. Less-informed people who stumbled upon or became aware of these types of crime are unlikely to know where to report these matters.

The Australian Department of Agriculture, Water, and the Environment, launched an online portal and published a toll-free telephone line for the public to use to report suspected wildlife crimes.23 The online portal allows for text and images to be added to a report and, while only launched in July 2021, receives approximately 50 allegations each month.

As an add-on to its current environmental crime hotline (0800 205 005), it is recommended that South Africa find a similar method to make it easier for the public to report wildlife crimes.

Interestingly, some reserve employers in protected areas stated during their interview with the EWG that they had their suspicions as to who were involved in wildlife crimes, but insufficient evidence for arrest or dismissal, and that the ability to report these centrally and anonymously would enable the investigation of these individuals.

SHARING OF INFORMATION AND INTELLIGENCE

Throughout the course of the EWG’s work, it became evident that multiple organisations collect and
keep information about suspected wildlife crimes. During our interviews, four people mentioned the lack of information sharing, including between police departments, amongst law enforcement and across borders. Many of the organisations interviewed indicated that they keep lists or databases with information about individuals or organisations suspected of having some form of involvement in wildlife crimes. Due to these parties being disconnected from one another, and in some instances traces of mistrust, information is often
not shared.

Many of these organisations indicated an interest in understanding other organisations’ data collection and intelligence processes. Where possible, the EWG assisted in making these connections. There is a need for a more structured process, beyond the work of the EWG, to stimulate cooperation in this regard, and the EWG is in discussion with various parties to formulate such a structure, outside of the ambit of SAMLIT.

ANNEXURES

Throughout the course of the EWG’s work, it became evident that multiple organisations collect and keep information about suspected wildlife crimes. Due to these parties being disconnected from one another, and in some instances traces of mistrust, information is often not shared.

ORIGINAL REPORT; https://www.fic.gov.za/Documents/SAMLIT_IWT%20Report_November2021.pdf