Financial Crime, AML and Sanctions Compliance

Introduction and Context

Insurance is exposed to financial crime because it moves substantial funds, relies on complex intermediaries, operates across jurisdictions, and sometimes involves products that permit rapid movement or concealment of wealth. Life insurance, investment-linked policies, reinsurance, claims payments, premium refunds, brokers, managing general agents, and captive arrangements may all be misused for money laundering, terrorist financing, proliferation financing, fraud, bribery, corruption, tax evasion, and sanctions evasion.

Financial-crime compliance is therefore not merely a documentation exercise. It is a governance system through which an insurer identifies risk, applies proportionate controls, detects unusual activity, reports where legally required, protects the integrity of investigations, and continuously improves its framework. The central principle is risk-based governance: controls should be sufficiently rigorous to address material risks without creating indiscriminate exclusion or ineffective administrative burden.

This chapter uses international principles associated with the Financial Action Task Force (FATF), United Nations sanctions frameworks, and widely adopted supervisory practice. Because laws differ, the applicable statute, regulator, financial-intelligence unit, sanctions authority, reporting threshold, and privacy regime in the relevant jurisdiction must always be verified.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain money laundering, terrorist financing, proliferation financing, fraud, bribery and sanctions risk in insurance.
2. Design a risk-based customer due-diligence and enhanced-due-diligence framework.
3. Identify and verify beneficial owners and control structures.
4. Distinguish suspicious-transaction indicators from proof of criminal conduct.
5. Explain suspicious-transaction reporting, sanctions screening and reporting obligations.
6. Evaluate anti-bribery, fraud-control and third-party risks.
7. Assess the roles of the board, senior management, compliance, internal audit and business functions.
8. Critically evaluate technology, artificial intelligence and the limitations of compliance models.

1. The Financial-Crime Risk Landscape in Insurance

1.1 Money laundering

Money laundering is commonly analysed through three overlapping stages:

• Placement: introducing proceeds of crime into the financial system, for example through premiums, investment products or purchases of policies.
• Layering: using transactions, policy assignments, loans, intermediaries or transfers to obscure the origin of funds.
• Integration: making criminal proceeds appear legitimate, including through policy maturities, surrender proceeds, claims, commissions or asset purchases.

The stages are analytical rather than mandatory. A transaction may involve only one stage, and modern digital transfers can combine them almost instantaneously.

Insurance products vary substantially in exposure. Long-term life products with surrender value, single-premium policies, annuities, investment-linked contracts, private placement life insurance, reinsurance and claims payments generally require closer attention than simple, low-value property policies. However, non-life insurance can also be abused through staged accidents, inflated claims, fictitious losses, premium fraud and collusion with service providers.

1.2 Terrorist financing and proliferation financing

Terrorist financing concerns the provision or collection of assets for terrorist acts, organisations or individuals. Unlike money laundering, the funds may originate from lawful income. Consequently, a small transaction, charitable payment, premium, refund or claim can be relevant even where the source of wealth appears legitimate.

Proliferation financing concerns the financing of activities related to the development, acquisition or transfer of weapons of mass destruction and their delivery systems. It often involves trade-based techniques, front companies, dual-use goods, maritime structures, complex ownership and evasion of export controls or sanctions.

1.3 Fraud and internal misconduct

Insurance fraud may be committed by policyholders, claimants, intermediaries, employees, repairers, medical providers, assessors or organised networks. Examples include application misrepresentation, staged losses, duplicate claims, phantom policies, premium diversion, false invoices, inflated repair costs, collusive claims and manipulation of underwriting or reserving data.

Fraud and money laundering can intersect. Fraud proceeds may be laundered through insurance products, while an apparently fraudulent claim may also reveal sanctions evasion, corruption or organised crime. Controls should therefore avoid treating fraud, AML and sanctions as isolated departments.

1.4 Bribery and corruption

Bribery risk is heightened where insurance depends on public procurement, licences, politically exposed persons, state-owned enterprises, claims access, large infrastructure projects, medical networks or intermediaries. Improper payments may be disguised as commissions, consulting fees, discounts, sponsorships, charitable donations or inflated service contracts.

2. The Risk-Based Approach

A risk-based approach allocates resources according to the nature, scale and complexity of identified risks. It does not mean that high-risk customers are automatically rejected or that low-risk customers receive no controls. It requires a defensible assessment, documented rationale, proportionate measures and continuing review.

A useful conceptual model is:

Here, threat refers to the likelihood or capability of a criminal actor; vulnerability refers to weaknesses in products, channels, geography, systems or controls; and consequence refers to potential legal, financial, operational, prudential and reputational harm. This is a governance model, not a universal statistical law. It supports structured judgment but does not produce an objectively precise risk score unless variables are defined and calibrated.

An insurer may classify risk using customer, product, geographic, delivery-channel and transactional dimensions:

Risk assessment should occur at enterprise, business-line, product, customer and transaction levels. The board approves risk appetite; management implements controls; compliance provides independent advice and monitoring; internal audit gives assurance.

3. Customer Due Diligence

Customer due diligence (CDD) is the process of identifying and understanding a customer and monitoring the relationship. It normally includes:

1. Identifying the customer and verifying identity using reliable, independent information.
2. Understanding the purpose and intended nature of the relationship.
3. Identifying beneficial owners and persons who control the customer.
4. Establishing, where appropriate, source of funds and source of wealth.
5. Conducting sanctions, PEP and adverse-media screening.
6. Applying ongoing monitoring and updating records.

CDD must be applied not only to the policyholder but also, according to applicable law and product risk, to beneficial owners, controlling persons, payers, beneficiaries, assignees, trustees, settlors, protectors, directors, authorised representatives and relevant counterparties.

3.1 Customer identification and verification

For an individual, information may include full name, date and place of birth, nationality, residential address, identification number and occupation. For a legal person, it may include legal name, registration number, registered office, business activity, directors, ownership and control structure, and authority of the representative.

Verification should be completed before or within the legally permitted period after establishing a relationship. Reliance on a third party is not the same as outsourcing responsibility: the insurer must be satisfied that the third party is regulated, competent, able to provide information promptly and subject to appropriate arrangements.

3.2 Beneficial ownership

The beneficial owner is the natural person who ultimately owns or controls a customer, or the natural person on whose behalf a transaction is conducted. Legal ownership is not always beneficial ownership. A company may be owned by another company, a nominee, a trust or several entities across jurisdictions.

A practical identification sequence is:

1. Identify natural persons with ultimate ownership, applying the relevant legal threshold where one exists.
2. Identify natural persons exercising control through voting rights, agreements, board appointment rights or other means.
3. If no natural person can reasonably be identified through ownership or control, identify the relevant senior managing official, while documenting the analysis.
4. Understand the entire ownership chain and retain evidence.

The fallback to a senior managing official is not a substitute for investigating ownership. It is used only after reasonable steps have failed to identify another controlling natural person.

Trusts require analysis of the settlor, trustee, protector, beneficiaries or class of beneficiaries, and any other person exercising ultimate effective control. Foundations, partnerships and similar arrangements require equivalent functional analysis.

3.3 Simplified and enhanced due diligence

Simplified due diligence may be permitted in genuinely lower-risk situations where law and supervisory guidance allow it. It never permits the insurer to ignore sanctions screening, suspicious activity or fundamental identity requirements.

Enhanced due diligence (EDD) is appropriate where risk is elevated. Measures may include:

• obtaining additional identity and ownership documents;
• establishing source of wealth and source of funds;
• obtaining senior management approval;
• increasing monitoring frequency;
• limiting products, payment methods or jurisdictions;
• independently verifying information;
• obtaining information about the rationale for complex transactions.

A PEP is not automatically a criminal or prohibited customer. PEP controls recognise increased exposure to bribery and corruption. They commonly require risk assessment, source-of-wealth and source-of-funds enquiries, senior approval and enhanced ongoing monitoring. Similar controls may apply to family members and close associates under applicable law.

4. Suspicious-Transaction Detection and Reporting

A suspicious transaction is one that gives rise to a reasonable suspicion, based on facts and context, that funds or assets may involve criminal conduct, terrorist financing or another legally reportable offence. Suspicion is a threshold for reporting, not a finding of guilt.

4.1 Indicators in insurance

No indicator is conclusive. Relevant patterns may include:

• premiums paid by unrelated third parties without a credible explanation;
• early surrender shortly after a large single premium;
• repeated policy loans or assignments lacking economic purpose;
• requests for refunds to accounts different from the payer;
• claims inconsistent with the policyholder’s financial profile;
• rapid changes in beneficiaries or ownership;
• opaque structures involving nominees or unnecessary jurisdictions;
• use of sanctioned or high-risk jurisdictions;
• reluctance to provide ownership or source-of-funds information;
• unusually high commissions or unexplained payments to intermediaries;
• multiple customers linked to the same address, bank account, telephone number or claims provider;
• transactions designed to avoid internal thresholds or review.

Detection should combine rules, scenarios, staff judgment, customer information, transaction data, claims data and external intelligence. The insurer should document why activity is or is not escalated.

4.2 Investigation and reporting

A sound investigation process separates initial alerting from final disposition. Typical stages are:

1. Generate an alert from monitoring, screening, staff referral, audit or external intelligence.
2. Triage the alert according to urgency and risk.
3. Gather customer, policy, payment, claims, ownership and communication records.
4. Analyse the activity against the customer profile and plausible business purpose.
5. Escalate to the MLRO or equivalent responsible officer.
6. Decide whether to close, continue monitoring, restrict activity, exit the relationship or submit a report.
7. Preserve an auditable rationale.

A suspicious-transaction report (STR) or suspicious-activity report (SAR) is submitted to the legally designated financial-intelligence unit in the required form and timeframe. Reporting duties, thresholds and confidentiality rules vary by jurisdiction. The insurer must not inform the customer or another person when such disclosure would constitute prohibited tipping-off.

Reporting does not ordinarily replace commercial or legal decisions. An insurer may need to continue, restrict or terminate a relationship based on risk, law, contractual duties and supervisory expectations. It should avoid automatic de-risking that denies legitimate services without individual assessment.

5. Sanctions Compliance

Sanctions are legal restrictions imposed by states or international organisations. They may target countries, governments, individuals, entities, vessels, aircraft, sectors, goods, services, assets or transactions. A sanctions programme may include asset freezes, prohibitions on making funds or economic resources available, financial restrictions, trade controls and travel restrictions.

Sanctions compliance has three linked questions:

1. Is a person, entity, vessel, country, transaction or activity within the scope of a prohibition?
2. Does the insurer have a legal obligation to block, reject, freeze, report or refrain from processing?
3. Is a licence, exemption or authorisation available, and has it been verified?

Screening should cover customers, beneficial owners, payers, beneficiaries, claimants, assignees, counterparties, intermediaries and relevant payment details. It should occur at onboarding, before payment, on list updates and periodically thereafter. Name-only screening creates false positives and false negatives; effective review considers date of birth, nationality, address, registration details, ownership, control and other identifiers.

A crucial principle is that sanctions obligations may apply to ownership and control, not merely to names appearing on a list. An entity may be restricted because it is owned or controlled by a designated person even if its own name is absent. The applicable regime must be analysed carefully, particularly for multinational insurers subject to several legal systems.

Potential matches should be placed on hold where lawful and necessary while the insurer verifies identity. Staff should never resolve a possible match merely by changing spelling or ignoring an alert. Confirmed matches require action prescribed by the relevant law and regulator, including blocking, rejection, reporting and record retention where applicable.

6. Anti-Bribery and Corruption Controls

An effective anti-bribery programme combines prevention, detection, response and culture. Core elements include:

• a board-approved anti-bribery policy;
• risk assessment by country, product, customer and intermediary;
• rules for gifts, hospitality, travel, facilitation payments, donations and sponsorships;
• due diligence on agents, brokers, consultants and vendors;
• written contracts with compliance obligations and audit rights;
• transparent remuneration and approval of commissions;
• segregation of duties and payment controls;
• accurate books and records;
• confidential reporting channels and non-retaliation;
• investigation, discipline, remediation and lessons learned.

Third-party due diligence should examine ownership, reputation, qualifications, government connections, services actually provided, compensation, bank-account location and refusal to provide information. Excessive or success-based compensation without a credible service rationale is a warning sign, not automatic proof of bribery.

7. Fraud Risk Management

Fraud control is a cycle rather than a single software tool:

1. Identify fraud schemes and vulnerabilities.
2. Prevent through underwriting, authentication, segregation and contract design.
3. Detect through analytics, claims review, whistleblowing and staff controls.
4. Investigate fairly and preserve evidence.
5. Respond through recovery, disciplinary action, reporting and legal proceedings.
6. Feed lessons back into products, systems and training.

Controls should balance fraud prevention with fair treatment of customers. Excessive suspicion can delay legitimate claims, discriminate against vulnerable groups and damage trust. Fraud analytics should support—not replace—qualified investigation.

8. Governance, Accountability and the Three Lines Model

The first line consists of business and operational teams that own customer, product, claims and payment risks. They perform controls in daily processes.

The second line includes compliance, financial-crime risk and AML officers. It establishes policy, advises the business, performs monitoring, challenges decisions, manages regulatory communication and reports material issues.

The third line, internal audit, independently evaluates governance, risk management and controls. External auditors, regulators, law enforcement and the board provide additional oversight but do not replace management responsibility.

The board should approve risk appetite, receive meaningful management information, ensure adequate resources and challenge persistent weaknesses. Useful metrics include overdue CDD reviews, alert volumes and ageing, false-positive rates, STR timeliness, sanctions-screening effectiveness, training completion, high-risk relationships, audit findings and remediation ageing. Metrics should not reward superficial closure of alerts or high reporting volume alone.

Records should be accurate, retrievable, protected from unauthorised access and retained for the legally required period. Privacy, data minimisation, cross-border transfer and employee-access rules must be integrated into financial-crime processes.

9. Technology, Data and Artificial Intelligence

Technology can improve screening, network analysis, transaction monitoring, document verification, claims analytics and case management. Machine-learning models may identify relationships that simple rules miss, such as shared bank accounts, addresses, devices, intermediaries or beneficiary patterns.

However, technology creates risks:

• poor-quality or incomplete data;
• biased training data;
• opaque model outputs;
• excessive false positives;
• model drift as criminal behaviour changes;
• cyberattack and data leakage;
• over-reliance on automated decisions;
• inability to explain an alert to a regulator or court.

Model governance should define purpose, data lineage, validation, performance thresholds, human review, change controls, access rights, testing for bias, documentation and independent assurance. Generative AI should not independently decide whether to file an STR, freeze assets or terminate a customer without controlled human judgment, legal review and an auditable basis.

10. Applied Case: The Unusual Life Policy Payment

This is an illustrative fictional case.

Background

A life insurer receives a single premium of equivalent value to 2 million monetary units for an investment-linked policy. The policyholder is a newly incorporated company owned through two foreign holding companies. The stated business is logistics. The premium is paid by an individual who is neither the policyholder nor the named beneficiary. Three months later, the policyholder requests surrender and asks that proceeds be paid to an account in a different jurisdiction.

Problem

The transaction presents possible money-laundering, beneficial-ownership, third-party-payment, sanctions and tax risks. It does not prove criminal conduct. The insurer must decide whether to accept the payment, investigate, report and/or process surrender.

Analysis

The customer-risk factors include a newly formed entity, opaque ownership and a complex cross-border structure. Product risk is elevated because the policy has investment value and surrender rights. Transactional indicators include a large third-party premium, short holding period and payment to a different jurisdiction. The insurer should identify the natural persons who ultimately own or control the structure, understand the logistics business, verify the payer’s relationship and establish source of wealth and source of funds. It should screen all relevant parties and jurisdictions, including the proposed receiving account where legally and operationally possible.

The insurer should also examine whether the policyholder, payer or beneficiary is a PEP, whether adverse information exists, whether the transaction is consistent with the stated business, and whether any sanctions ownership or control issue arises.

Approach and solution

The case is escalated to the MLRO. Processing is paused only to the extent permitted and necessary under law and policy. EDD is conducted, including independent corporate records, bank evidence, contracts supporting the source of funds, ownership analysis and senior-management approval. The insurer documents the customer’s explanations and tests them against external evidence. If reasonable suspicion remains, an STR is submitted without tipping off the customer. Sanctions concerns are handled under the applicable sanctions regime, separately from the AML suspicion decision.

Outcome

Suppose the ownership evidence is incomplete, the payer cannot explain the transfer, and adverse information links a controller to procurement corruption. The insurer files an STR, maintains confidentiality, reviews whether the relationship can lawfully continue, and reports or freezes funds if a sanctions obligation is confirmed. It also reviews the broker’s onboarding and commission arrangements.

Learning points

The case demonstrates that risk arises from the combination of product, customer, channel, geography and transaction factors. A single red flag rarely determines the result. The correct response is structured investigation, independent judgment, documentation, proportionate action and coordination among AML, sanctions, fraud, legal and business functions.

11. Challenges and Limitations

Financial-crime controls face several persistent limitations. Criminals adapt quickly, while legal rules and supervisory expectations may differ across jurisdictions. Beneficial ownership information can be inaccurate or unavailable. Screening databases may contain incomplete, duplicated or outdated information. High alert volumes can overwhelm investigators. De-risking may exclude legitimate customers, particularly charities, migrants, small businesses and customers in developing markets.

A risk-based system also involves judgment. Two competent investigators may assess the same facts differently. This makes training, escalation standards, quality assurance and clear documentation essential. Compliance cannot eliminate crime; it reduces exposure and improves detection, disruption and accountability.

12. Best-Practice Implementation Framework

A mature insurer should:

1. Conduct documented enterprise and product financial-crime risk assessments.
2. Define board-approved risk appetite and escalation criteria.
3. Map legal obligations by jurisdiction and business activity.
4. Integrate CDD, beneficial ownership, PEP, sanctions, fraud and bribery controls.
5. Use risk-sensitive onboarding and periodic review.
6. Maintain reliable customer, ownership and transaction data.
7. Test screening and monitoring systems against realistic scenarios.
8. Provide role-specific training and assess competence.
9. Protect whistleblowers and investigate impartially.
10. Report suspicious activity and sanctions matters promptly where required.
11. Apply independent testing, internal audit and remediation tracking.
12. Review controls after incidents, regulatory changes, acquisitions and new technology deployment.

Chapter Summary

Insurance financial-crime compliance protects policyholders, markets and institutions from money laundering, terrorist financing, proliferation financing, fraud, bribery and sanctions violations. The foundation is a documented, risk-based approach supported by customer due diligence, beneficial-ownership analysis, source-of-funds enquiries, PEP controls, ongoing monitoring and proportionate enhanced due diligence. Suspicious-transaction reporting is based on reasonable suspicion rather than proof of guilt, and confidentiality rules prohibit tipping off in applicable circumstances. Sanctions compliance requires accurate screening, ownership-and-control analysis, timely holds or reporting, and careful treatment of licences and exemptions. Anti-bribery and fraud controls must extend to intermediaries and claims ecosystems. Effective governance depends on board oversight, accountable business functions, independent compliance, internal audit, reliable data, human judgment and continuous improvement. Technology can strengthen controls but must be governed for accuracy, fairness, explainability, privacy and resilience.

Key Terms

Anti-money laundering (AML): Laws, policies and controls designed to prevent and detect money laundering and related offences.

Beneficial owner: The natural person who ultimately owns or controls a customer or transaction.

Customer due diligence (CDD): Identification, verification, risk assessment and monitoring of customers and relevant parties.

Enhanced due diligence (EDD): Additional controls applied to higher-risk relationships or transactions.

Financial-intelligence unit (FIU): Public authority that receives and analyses suspicious-transaction reports.

Fraud: Intentional deception to obtain financial or other unlawful advantage.

Layering: Transactions designed to obscure the origin or ownership of illicit funds.

Money laundering: Concealing or disguising criminal proceeds so they appear legitimate.

MLRO: Money Laundering Reporting Officer or equivalent responsible officer.

PEP: Politically exposed person with a prominent public function, including relevant family members and close associates where law provides.

Placement: Introduction of criminal proceeds into the financial system.

Proliferation financing: Financing connected with the development, acquisition or transfer of weapons of mass destruction and delivery systems.

Risk-based approach: Allocating controls and resources according to assessed risk.

Sanctions: Legal restrictions imposed on persons, entities, countries, sectors, goods or transactions.

Source of funds: The origin of the particular money used in a transaction.

Source of wealth: The origin of a customer’s overall wealth.

Suspicious-transaction report (STR): A report submitted to the competent authority concerning suspected unlawful activity.

Tipping off: Improperly disclosing that a suspicious-activity report or investigation exists.

Terrorist financing: Providing or collecting assets for terrorist acts or organisations.

Three lines model: Governance structure dividing operational ownership, compliance oversight and independent internal audit.

Review Questions

Short Answer Questions

1. Distinguish placement, layering and integration in money laundering.
2. Why is beneficial-ownership identification important for an insurer?
3. What is the difference between source of funds and source of wealth?
4. Why is a suspicious-transaction report not equivalent to proof of criminal conduct?
5. Identify three responsibilities of the board in financial-crime governance.

Long Answer Questions

1. Explain how an insurer should design a risk-based customer due-diligence framework.
2. Discuss the principal sanctions-screening and ownership-and-control challenges for multinational insurers.
3. Analyse the relationship between AML, fraud, anti-bribery and sanctions controls.
4. Explain the role of the first, second and third lines in financial-crime governance.
5. Evaluate the benefits and limitations of artificial intelligence in transaction monitoring and claims fraud detection.

Analytical / Application Questions

1. A policyholder pays a large premium through an unrelated company and requests early surrender to an overseas account. Identify the relevant risks, investigations and possible actions.
2. An insurer’s sanctions system produces a high number of false positives but misses an entity controlled by a designated person. Design a remediation plan.
3. A broker refuses to disclose its ultimate owners and proposes unusually high commissions for public-sector business. Assess the anti-bribery, AML and governance implications.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a beneficial owner?

A. The person who introduces a broker to an insurer

B. The natural person who ultimately owns or controls a customer

C. Any employee authorised to sign a policy

D. The regulator supervising the insurer

Correct Answer: B. The natural person who ultimately owns or controls a customer

Question 2

Which AML measure is most characteristic of enhanced due diligence?

A. Removing all monitoring requirements

B. Accepting identity information without verification

C. Obtaining source-of-wealth information and senior approval

D. Automatically rejecting every foreign customer

Correct Answer: C. Obtaining source-of-wealth information and senior approval

Question 3

A suspicious-transaction report generally indicates that the insurer has:

A. Proved the customer committed a crime

B. Established civil liability in court

C. Formed reasonable suspicion requiring or permitting reporting under applicable law

D. Obtained a sanctions licence

Correct Answer: C. Formed reasonable suspicion requiring or permitting reporting under applicable law

Question 4

Which activity is most closely associated with the layering stage of money laundering?

A. Introducing cash into a bank account

B. Using multiple transfers to obscure the origin of funds

C. Purchasing legitimate goods with disclosed salary

D. Reporting a suspicious transaction

Correct Answer: B. Using multiple transfers to obscure the origin of funds

Question 5

Which statement about a politically exposed person is correct?

A. Every PEP is prohibited from obtaining insurance

B. PEP status automatically proves corruption

C. PEP status normally requires risk-sensitive enhanced controls

D. PEPs do not require beneficial-ownership checks

Correct Answer: C. PEP status normally requires risk-sensitive enhanced controls

Question 6

Sanctions screening should generally consider:

A. Only the policyholder’s first name

B. Customers, beneficial owners, payers, beneficiaries and relevant counterparties

C. Only claims above a fixed amount

D. Only entities located in the insurer’s home country

Correct Answer: B. Customers, beneficial owners, payers, beneficiaries and relevant counterparties

Question 7

Which line of the three-lines model performs independent assurance?

A. The first line

B. The second line

C. The third line

D. The sales line

Correct Answer: C. The third line

Question 8

Why can terrorist-financing risk differ from traditional money-laundering risk?

A. Terrorist financing always uses large cash deposits

B. Terrorist-financing funds may originate from lawful sources

C. Terrorist financing never involves insurance

D. Terrorist financing is identified solely through credit scoring

Correct Answer: B. Terrorist-financing funds may originate from lawful sources

Question 9

Which is the strongest reason not to rely exclusively on automated sanctions screening?

A. Automation cannot process any names

B. Automated systems may produce false positives, false negatives and unexplained results

C. Manual review is prohibited by law

D. Sanctions lists never change

Correct Answer: B. Automated systems may produce false positives, false negatives and unexplained results

Question 10

A third party pays a customer’s large premium without a credible explanation. This should primarily lead the insurer to:

A. Ignore the payment because the policy is valid

B. Conduct risk-based investigation of the payer, purpose and source of funds

C. Guarantee immediate surrender of the policy

D. Delete the payment record

Correct Answer: B. Conduct risk-based investigation of the payer, purpose and source of funds