AP clerk changes a beneficiary
Preserve ERP logs and bank files before the interview. Employment and possible crime are both live.
Skip to guide content
01 02 03
AML, Fraud · 06 Editorial guide
Corporate Fraud, AML Indicators and Cross-Border Evidence in China
Route AML/fraud indicators and investigation data across financial-crime, privacy, cyber and criminal-procedure boundaries. This topic routes; it does not decide the legal outcome on your facts.
First job Route AML/fraud indicators and investigation data across financial-crime, privacy, cyber and criminal-procedure boundaries.
Decision railindicator → asset/trace → legal tracks → local preserve → transfer decision → escalate or remediate
See routing factsStart here
Key considerations
The first questions are about urgency, governance and preservation — before collection expands or interviews begin.
- What transaction, asset movement, identity mismatch or control failure triggered concern, and which entities and jurisdictions are involved?
- Is this primarily internal fraud, an AML/KYC issue, suspected crime, sanctions or trade risk, or a data-transfer problem?
- Where is the evidence held, who controls access and would collection, review or transfer cross an employment, privacy, secrecy or criminal-procedure boundary?
Direct answer
What this page decides
Owner
02
02
This page owns the fork when the issue looks like fraud, asset movement, identity mismatch or an AML/KYC alert — including whether evidence can move offshore. It does not own a full AML programme design, sanctions list maintenance (export-controls centre), or criminal defence once police are in. Employee fraud, procurement kickbacks, expense fraud and customer-payment fraud are classified here, then investigated under Internal Investigations. Asset freezing and preservation are fact-specific court or police tools — do not invent a DIY freeze. Cross-border review of China investigation data is a Data/PIPL gate.
At a glance
Which fact changes the next route
Use the fact that changes ownership or urgency to decide the next move.
| Question | Why it matters | Next route |
|---|---|---|
| Internal thief or external counterparty? | Employment vs commercial recovery vs crime. | Taxonomy first; then investigations L4. |
| Need to stop a payment today? | Bank recall vs legal preservation are different. | Treasury + counsel; no informal intercept. |
| AML/KYC alert on a customer? | Financial-crime process, not an HR interview. | Stay on this page for routing; programme detail stays with compliance ops. |
| Want HQ in the US to review the mailbox? | Transfer is a data gate. | Data Privacy; do not upload first. |
| Kickback looks like bribery? | Dual track. | Commercial bribery L4 plus this fraud taxonomy. |
| Police referral? | Criminal Defense owns the person-risk. | Counsel before a report. |
Scope
What this page owns — and what it does not
WhoGC, CCO, finance crime, internal audit on a China fraud or AML indicator.
Eventsuspected diversion, false invoices, identity mismatch, suspicious payment — not a dawn raid.
This page owns fraud taxonomy and cross-border evidence routing.
Exclusionsfull sanctions programme (export-controls centre); PIPL legal basis drafting (Data); labour dismissal math (Employment).
No invented STR filing clocks on this page.
Practical workflow
Action, evidence, legal gate, output
| Action | Documents / evidence | Legal gate | Output |
|---|---|---|---|
| Name the fraud type | Invoice, inventory, expense, customer, payroll | Do not start with a confession interview | Taxonomy |
| Trace assets and approvals | Bank, fapiao, vendor master, inventory | Preserve, do not ‘correct’ entries | Chronology |
| Split legal tracks | Employment, civil recovery, crime, AML, data | One evidence file, many owners | Track map |
| Preserve locally | Devices, ERP, CCTV, WeChat protocol | Internal investigations evidence map | Hold log |
| Decide cross-border review | Data map, reviewer location, vendor | Data Privacy owner | Transfer or local-review decision |
| Escalation choice | Loss amount, people, regulator touch | Counsel before police/bank narrative | Remediation vs referral brief |
Documents
What to gather before the next call
These items help clarify the file; they are not a legal requirement list.
| Item | Why needed | Who holds it | Risk if missing |
|---|---|---|---|
| Vendor master and change log | Procurement fraud | Procurement / IT | Cannot show who added the payee |
| Bank beneficiary vs contract party | Diversion | Treasury | Paid a stranger |
| Inventory / GRN vs invoice | Quantity fraud | Warehouse / finance | Paper-only loss |
| KYC/AML alert pack | Customer-side crime risk | Compliance | Tipping off / incomplete file |
| Data location map | Export of the investigation | IT / privacy | Unlawful offshore dump |
Common failure points
Where files usually break
Calling it ‘an accounting error’ to avoid a hold.
Uploading the live mailbox to a global e-discovery tenant the same afternoon.
Confronting the suspect in a room with no plan and no witness protocol.
Freezing a customer’s goods without a legal basis.
Letting local finance ‘reclassify’ the kickback as marketing.
Copying a US SAR timeline onto a PRC file.
Mixing AML customer exit with employee dismissal in one letter.
Illustrative forks · not case advice
Moments where sequence matters
US forensic vendor wants China WeChat
Stop. Internal investigations + Data Privacy. This page flags the transfer; it does not authorise it.
Distributor over-invoicing plus cash back
Fraud taxonomy here, bribery classification on IC01, third-party exit on IC07.
FAQ
Narrow follow-ups owned by this page
Is every false fapiao a crime?
Not automatically. Tax, accounting, fraud and criminal tracks can diverge. Do not announce a crime on the intake email.
Can we freeze the employee’s bank account?
Not as a self-help step. Preservation and police/court tools are counsel questions.
Who owns sanctions screening?
The export-controls / sanctions centre. Link out; do not rebuild it here.
When is cross-border evidence allowed?
Only after a Data/PIPL (and possibly state-secrets) analysis. This page routes; it does not clear a transfer.
Decision map
Keep the question bounded.
- Trace the event and assetsBuild a chronology of accounts, counterparties, approvals, invoices, devices and movements. Separate confirmed facts from alerts, assumptions and unresolved identity questions.
- Assign the legal tracksRoute financial-crime, employee misconduct, criminal exposure, asset preservation, trade controls and privacy questions to their owners before promising a single response.
- Map custody and transferIdentify systems, custodians, data types, access rights, location and intended reviewers. Preserve locally while the lawful review and cross-border path is assessed.
- Coordinate holds and escalationDocument payment or access holds, reporting decisions, authority contact, asset-protection steps and remediation ownership. Do not let an internal review prejudice a live authority process.
Curated resources
Open the asset that matches this job.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
AML investigationfraudKYCsuspicious transactionscross-border dataasset freezing
Related legal file
Stay in this practice; send neighbouring questions to their owner.
Counsel hand-off
What to bring when you instruct
Instruct investigations counsel, with criminal and data counsel on standby. Bring: fraud type, loss estimate, asset trace, people already spoken to, and where the data physically sits.
Local context
Add the city only when it changes implementation.
National routing first. Local notary, court or bureau practice second.
Open city and province guidesCounsel hand-off
Need qualified counsel?
Investigations counsel can define scope, preserve evidence, manage interviews and privilege, and coordinate internal findings with reporting or enforcement risk.
Find investigations counselLegal review
Who reviewed this guide
Need qualified counsel?
Move carefully. Move with a record.
Use the portal to identify counsel for this practice and related China-side issues.