Financial Crime Investigation: A 6-Step Methodology from a Central Bank Investigator
Financial crime in Indonesia continues to grow in both volume and complexity. PPATK records a significant annual increase in suspicious transaction reports, while losses from banking fraud run into trillions of rupiah. Yet investigative capability in Indonesia's financial sector still lags well behind the sophistication of the perpetrators' methods.
As a former central bank financial investigator who spent more than a decade investigating financial crime across the Asia-Pacific region — including assignments in financial intelligence units and multinational banks — I have handled everything from straightforward embezzlement to cross-border laundering networks spanning multiple jurisdictions. This article sets out a methodology tested in the field.
The Reality of Financial Crime in Indonesia
Before the methodology, it is worth understanding the current landscape:
- Internal banking fraud remains the largest single threat — the perpetrator is often an employee with high system access
- Investment fraud using Ponzi and pyramid schemes continues to claim victims, now dressed up as cryptocurrency and fintech
- Trade-based money laundering through export-import over- and under-invoicing is increasingly hard to detect
- Cyber-enabled financial crime — data theft, business email compromise, and account takeover
- Corruption and bribery involving complex layering to conceal the flow of funds
Each type demands a different investigative approach, but all follow the same underlying methodology — the one we teach in the Financial Crime Investigation course.
A 6-Step Financial Crime Investigation Methodology
This methodology grew out of direct experience handling hundreds of cases and was refined against international standards including ACFE, the IIA, and the Wolfsberg Group. Each step maps to a course module.
Step 1: Predication and Initial Assessment (Module 1)
Module 1: Financial Crime Investigation Fundamentals stresses that a good investigation begins with strong predication — a sufficient basis for opening one at all.
Predication can come from many sources:
- An internal suspicious transaction report from the compliance unit
- A whistleblower report
- An internal audit finding
- An alert from the transaction monitoring system
- Information from law enforcement or a regulator
- A media investigation or customer complaint
From the field: In one major case I handled, the investigation began with something apparently trivial — a teller who always processed large cash transactions right at the end of the operating day, just before batch processing ran. That pattern was spotted not by the AML system but by a supervisor who noticed their team's working habits. The initial assessment took two weeks before we had enough predication to open a formal investigation, which went on to uncover a structuring network worth billions of rupiah.
The initial assessment must answer four key questions:
- Is there sufficient indication that a crime has occurred?
- What is the estimated loss or the value of funds involved?
- Who are the potentially involved parties?
- Is the evidence still available, or is there a risk of destruction?
Step 2: Financial Profiling and Transaction Analysis (Module 2)
Module 2: Financial Profiling and Transaction Analysis is the heart of a financial investigation. This is where the investigator builds a full picture of the subject and the flow of their funds.
Financial profiling covers:
- Wealth profile: Known income against apparent lifestyle (lifestyle analysis)
- Entity network: Companies, bank accounts, assets, trusts, and nominees connected to the subject
- Financial timeline: Significant changes in the subject's financial position over the investigation period
- Source of wealth versus source of funds: Distinguishing legitimately accumulated wealth from the specific funding of the transaction under investigation
Transaction analysis techniques:
- Fund flow analysis: Mapping the movement of money from origin to final destination, including every transit point
- Pattern recognition: Identifying repeating patterns such as round-tripping, structuring, or layering
- Anomaly detection: Comparing actual transactions against a baseline of normal behaviour
- Network analysis: Surfacing hidden relationships between accounts and entities that appear unconnected
An example from practice: In an embezzlement investigation at a financing company, fund flow analysis revealed that the stolen money was not transferred directly to the perpetrator's account. Instead it passed through 7 accounts at 3 different banks, each transfer disguised as a vendor payment. Only at the seventh account was it moved to the personal account of the perpetrator's spouse, at yet another bank. Without systematic fund flow analysis, that connection could never have been identified.
For technology-assisted investigation, the AI for Fraud Detection and AML/CFT course explains how machine learning and AI accelerate transaction analysis.
Step 3: Identifying Red Flags and Typologies (Module 3)
Module 3: Trends, Typologies and Red Flags equips investigators with knowledge of current methods.
Red flags fall into several levels:
Transaction-level red flags:
- Large cash transactions structured to stay under the reporting threshold
- Round-trip transactions with no clear economic purpose
- Payments to high-risk jurisdictions with no evident business relationship
- Transaction patterns that shift drastically from the baseline
Customer-level red flags:
- A mismatch between the business profile and the account activity
- Unexplained changes of beneficial owner
- Refusal to provide additional information or documentation
- Excessive use of nominees and corporate vehicles
Employee-level red flags (for internal fraud):
- A lifestyle inconsistent with salary
- Reluctance to take leave or delegate work
- System access outside working hours or beyond the scope of the role
- An unusual relationship with particular customers
Step 4: Evidence Collection and Investigative Interviewing (Module 4)
Module 4: Evidence Collection and Investigative Interviewing is the most critical step, and most often where investigations in Indonesia fall down.
Principles of evidence collection:
- Chain of custody: Every item of evidence needs complete documentation from discovery through to use in court
- Best evidence rule: Always favour the original over a copy
- Legal admissibility: Evidence must be gathered under proper legal procedure to be accepted in court
- Digital evidence handling: Electronic data requires specific forensic procedure to preserve integrity
Investigative interviewing technique:
Interviewing in a financial investigation differs sharply from an ordinary interview. We teach techniques adapted from financial intelligence unit practice:
- The cognitive interview technique: Helping a witness recall detail through context and shifted perspective
- The PEACE model: Planning, Engage, Account, Closure, Evaluate — a structured approach that avoids undue pressure
- Statement analysis: Identifying indications of deception through linguistic analysis of written and spoken statements
- Financial questioning: Specific questioning technique for financial topics — how to ask about source of wealth, particular transactions, and business relationships without handing the subject material for an alibi
A common mistake: Many investigators in Indonesia move to a confrontational interview far too early. In one case I supervised, the team interviewed the principal subject before securing all the documentary evidence. The subject then destroyed key records on realising they were under investigation. Our principle: interview the principal subject last, once all other evidence is secured.
A grounding in KYC and due diligence helps enormously at this stage. The Advanced KYC and Due Diligence course builds skill in digging into customers and entities in depth.
Step 5: The Investigation Report and Litigation Support (Module 5)
Module 5: Investigation Reporting and Litigation Support covers turning findings into a document that is both actionable and legally sound.
An effective investigation report follows this structure:
- Executive summary: The main findings for decision-makers (two pages maximum)
- Scope and methodology: What was investigated, over what period, and by what method
- Findings of fact: The facts established, supported by evidence — no opinion or assumption
- Analysis: Interpretation of those facts against the applicable regulation, policy, and standards
- Fund flow diagram: A visualisation of the money movement at the heart of the case
- Conclusions: Conclusions on the preponderance of evidence
- Recommendations: Recommended steps — legal action, asset recovery, control improvements
- Appendices: Supporting evidence, timeline, and detailed documentation
Litigation support covers:
- Preparing to serve as an expert witness
- Coordinating with the legal team and law enforcement
- Building a case chronology a judge and prosecutor can follow
- Calculating financial loss in a defensible way
Step 6: High-Level Case Studies and Lessons Learned (Module 6)
Module 6: High-Level Investigation Case Studies takes participants through complex, anonymised cases from real investigative experience.
The case studies cover:
- Insider trading involving multiple accounts and nominees
- Embezzlement layered through cross-border shell companies
- Trade-based money laundering in the commodities sector
- Insurance fraud through coordinated fictitious claims
- Procurement corruption using kickbacks routed through offshore structures
Tools and Technology in Modern Financial Investigation
Modern financial crime investigation can no longer rely on spreadsheets and manual analysis. Practitioners with experience in multinational financial institutions understand that technology has fundamentally changed how investigations run.
The tools professional investigators use:
- i2 Analyst's Notebook: For network visualisation and link analysis — connecting entities, accounts, transactions, and individuals in a single readable diagram
- Palantir / SAS: Large-scale data analysis platforms letting an investigator process millions of transactions to find anomalous patterns
- OSINT tools: For open source intelligence gathering — tracing a subject's digital footprint across the internet, social media, and public databases
- Blockchain analytics: Chainalysis, Elliptic, or Crystal for tracing cryptocurrency transactions, increasingly common in laundering
- E-discovery platforms: Relativity and Nuix for processing large volumes of electronic documents and email in corporate investigations
The AI for Fraud Detection and AML/CFT course covers how artificial intelligence compresses analysis that once took weeks into a matter of hours.
An evolution I have watched: When I began investigating in the early 2010s, fund flow analysis for one complex case could take 3-4 weeks of manual work. With the right tools and AI-assisted analysis, the same work now takes 3-4 days. But tools without a fundamental grasp of how money moves and why a perpetrator chose a particular method are useless. Our course stresses both: the fundamentals and the ability to use modern technology.
Cross-Border Investigation: Challenges and Solutions
From handling cases across Asia-Pacific banking and various cross-border assignments, international investigation carries distinct challenges:
- Divergent regulation: What is illegal in one jurisdiction may not be in another
- Bank secrecy laws: Some countries still maintain strict banking secrecy legislation
- Mutual Legal Assistance Treaties (MLAT): Requesting mutual legal assistance can take months
- Time zones and language: Coordinating a multinational investigation team takes careful management
- Data protection laws: Cross-border transfer of personal data must comply with each country's data protection regime
Understanding cross-border regulatory frameworks matters greatly here. The POJK Cybersecurity course complements investigative competency with the cyber dimension of modern financial crime.
What the Course Covers
Our Financial Crime Investigation course is designed by a practitioner with investigative experience in a central bank, multinational financial institutions, and a financial intelligence unit. Every module pairs theory with direct practice:
- Module 1 — Financial Crime Investigation Fundamentals: The legal framework, predication, initial assessment, and investigation planning
- Module 2 — Financial Profiling and Transaction Analysis: Building a financial profile, fund flow analysis, and network mapping with professional tooling
- Module 3 — Trends, Typologies and Red Flags: Current methods, FATF typologies, and red flags by category of financial crime
- Module 4 — Evidence Collection and Investigative Interviewing: Chain of custody, digital evidence, the PEACE interview model, and statement analysis
- Module 5 — Investigation Reporting and Litigation Support: Writing legally sound reports, expert witness preparation, and coordinating with law enforcement
- Module 6 — High-Level Investigation Case Studies: Analysis of anonymised real cases and an end-to-end investigation simulation
The course takes a learn by doing approach — participants work a case study from opening through to writing the report, with direct feedback from an instructor experienced in the field.
Related Courses
- AML/CFT Anti Money Laundering — The AML foundations underpinning every financial crime investigation
- AI for Fraud Detection and AML/CFT — How AI accelerates fraud detection and investigation
- Advanced KYC and Due Diligence — Due diligence technique that supports investigation
- POJK Cybersecurity — The cyber dimension of modern financial crime
FAQ: Financial Crime Investigation
What is the difference between financial crime investigation and internal audit?
Internal audit is preventive and evaluates control effectiveness systematically. Financial crime investigation is reactive — it begins when there is an indication a crime has occurred. Investigation uses more assertive techniques (investigative interviewing, surveillance, forensic analysis) and its output can support legal proceedings. The two are complementary, though: audit findings frequently provide the predication for an investigation.
How long does a financial crime investigation usually take?
It varies widely with complexity. A straightforward internal fraud case can close in 2-4 weeks. A laundering case spanning multiple jurisdictions can run 6-18 months. The key to efficiency is thorough planning at the outset and prioritising the most critical evidence.
Does a financial investigator need a legal background?
Not necessarily, but a working grasp of criminal law, criminal procedure, and financial regulation is important. Many successful investigators come from accounting, banking, or audit backgrounds. What matters most is analytical ability, attention to detail, and understanding how money moves through the financial system.
How do you start a career in financial crime investigation?
The most common route: (1) start in compliance or internal audit at a bank or financial institution, (2) obtain a professional certification such as CFE (Certified Fraud Examiner) or CAMS (Certified Anti-Money Laundering Specialist), (3) take specialist training of the kind we offer, (4) build experience on real cases. Our course provides the practical foundation certification alone cannot.
What is the biggest challenge for financial crime investigation in Indonesia?
In our experience, three stand out: (1) access to financial information remains fragmented across institutions, (2) too few trained investigators understand modern financial products and transactions, (3) lengthy legal processes mean digital evidence can become obsolete. Our course is designed to address the second — building competent investigative capacity.
Is this course suitable for law enforcement?
Very much so. Many of our participants come from the police (cyber and economic crime units), the prosecution service, the anti-corruption commission, and PPATK. The methodology is compatible with law enforcement needs, and the case studies cover scenarios relevant to formal criminal investigation. The financial intelligence unit practitioners who teach it understand what law enforcement specifically requires.