Interbank connections in full view. Or what you can learn from the publicly available FinCen data leak

Bank secrecy, like doctor-patient confidentiality, is the basis of our modern world professional ethics. Of course, acting upon law, government establishments regularly get access to information on private and corporate accounts and their transactions. But whenever such information is leaked, it automatically becomes a sensation. This is exactly what happened to the recent USA Financial Crimes Enforcement Network (FinCen) data leak.

What’s inside the leak and why haven’t it been fully reported (yet)

Information, which was leaked to mass media, contains reports on suspicious transactions in the total sum of more than 2 trillion dollars. Such reports are usually filed, when bank officers are concerned about certain transactions carried out between people or companies.

It took about 16 months and people from around 90 countries to analyze the documents from this leak. The data was unstructured and scattered so the analysts spent a lot of time sorting it out, sometimes by developing their own data extraction mechanisms.

Journalists haven’t shared anything yet — it’s unsurprising, as law enforcement agencies might still have ongoing investigations — but there is a small fragment of processed data (containing no names) available to download from the International Consortium of Investigative Journalists website.

How to research FinCen data leak in Lampyre

The format of the leaked data is CSV, so it can be uploaded to Lampyre without any prior processing. Let’s dive into this with the download_transaction_map.csv file of the available dataset. (You might want to check out our other tutorial, where we show how to work with structured data in Lampyre.)

Uploading offline data files to Lampyre

Viewing the contents of the uploaded data files

As you see, this data contains information on suspicious activity reports, banks that filed these reports, transaction initiators and recipients, sums and so on.

Using the Content window, it’s easy to see the most popular report filer — filer_org_name:

Statistics on the filer_org_name column in the Content window

Then the country of the most frequent transaction initiator — originator_bank_country

Statistics on the originator_bank_country column in the Content window

And the most frequent recipient bank — beneficiary_bank:

Statistics on the beneficiary_bank column in the Content window

You can see the statistics on any of the field type of your file.

Let’s map the fields. This will allow us to make shallow analysis of this data, more precisely — to analyze the countries of the banks.

Field mapping

As we see, Latvia is in the top, judging by the number of its links.

Viewing the mapped data in a graph

Latvian connections in a table view

Let’s select all the Latvia links and transfer them to a new graph (by clicking Ctrl + N) for further analysis.

Selecting only links in a graph

Only links selected in a graph

Copying selected objects and links to a new graph (Ctrl+N)

Now let’s select only the most stable connections, setting the stability rate as more than 40 links between countries, for example.

Setting up a filter for links

Filtered results selected

Filtered results copied to a new graph (Ctrl+N)

Now it will be interesting to take a look at the interaction between Latvia and Switzerland as it is well known for its level of banking sector. For this let’s do a more detailed mapping, taking into consideration not only countries but also bank info in the filler_org_name, originator_bank and beneficiary_bank fields.

Setting up a more detailed mapping

So we get back to our search criteria. As we are only interested in the interactions between two countries, we’ll use the Filter Editor tool:

Using the Filter Editor tool to filter the interactions

Now we can add the filtered results to our graph:

Adding the filtered interaction data to the graph

Adding new data (as per the previously set up mapping template) to the same graph

We see that the biggest element on our graph is The Bank of New York Mellon Corp., which is the author of SAR reports on transactions between the chosen two countries. This is the bank, that filed reports on suspicious transactions to the FinCen. Let’s delete it from our graph to eliminate any third parties. Changing the layout to Forced Lin-Log here will make our results more readable — the transactions and interbank connections are clearly visible now.

Viewing the needed information on transactions and interbank connections

Conclusion

In this small tutorial, we showed you how to analyze a publicly available piece of FinCen leak in Lampyre. We were able to highlight the biggest transaction clusters and interbank connections between Latvia and Switzerland.

Selecting different countries or banks in a similar way, you can carry out your own analysis of this infamous data leak.

Needless to say, that it is more interesting to work with a dataset containing names and companies. If such data becomes available — as it happened with the Panama Papers leak — we will demonstrate how to analyze it and maybe even find something new and unpublished by reporters. :-)

If you have any ideas for shared research please do not hesitate to contact us.

Go to our website https://lampyre.io to try Lampyre.

Check out our video tutorials on our YouTube channel: https://youtube.com/lampyre