Affidavit in Support of Criminal Complaint and Arrest Warrant — United States of America v. Rose-Marie Nsahlai, Case No. 1:21-MJ-318 (Dkt. 2, E.D. Va.)

Summary

IRS-CI Special Agent Charles W. Sublett's affidavit supports a criminal complaint charging Rose-Marie Nsahlai with conspiracy to commit bank fraud (18 U.S.C. § 1349) over two Paycheck Protection Program loans from Bank of America. It says Didier Kindambu, Nsahlai's estranged husband, applied on April 3, 2020 for Papillon Holdings, Inc. and Papillon Air, Inc. with payroll spreadsheets the agent describes as false; the bank disbursed $375,000 and $2,126,753, and at least $427,627 went toward the down payment on a Leesburg property titled to both. Kindambu pleaded guilty to bank fraud on January 28, 2021 and is cooperating. The affidavit quotes a covert recording, an April 6, 2020 email ('we grossly exaggerated monthly') and WhatsApp messages attributed to Nsahlai, and says spreadsheet metadata names Rose-Marie Nsahlai as last modifier. It was sworn on September 23, 2021.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 1 of 12 PageID# 2

IN THE UNITED STATES DISTRICT COURT FOR THE

EASTERN DISTRICT OF VIRGINIA

Alexandria Division

UNITED STATES OF AMERICA

v. Case No. 1:21-MJ-318
),/('81'(56($/
ROSE-MARIE NSAHLAI

AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT AND ARREST WARRANT

I, Charles W. Sublett, being first duly sworn, hereby affirm and state:

INTRODUCTION AND AGENT BACKGROUND

1. I am currently employed as a Special Agent with Internal Revenue Service-

Criminal Investigation (IRS-CI) and have held this position since August 2019. I am currently

assigned to IRS-CI’s Washington, D.C. post of duty where I investigate complex financial

crimes. I have duties that include investigations of, among other things, tax evasion, Bank

Secrecy Act (BSA) violations, money laundering, and other financial crimes.

2. I have received 26 weeks of training in general law enforcement and criminal

investigations involving violations of the Internal Revenue Code, financial crimes, and money

laundering. In addition to my law enforcement training, I am a Certified Public Accountant,

Certified Fraud Examiner, and hold a master’s degree in Accounting and Information Systems

from Virginia Tech. Prior to working for IRS-CI, I served as a Senior Forensic Accountant for

Deloitte Financial Advisory Services where I advised federal law enforcement agencies

regarding complex third-party money laundering investigations. In the course of my training and

experience and in the course of conducting criminal investigations, I have interviewed subjects
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 2 of 12 PageID# 3

and witnesses, conducted physical surveillance, analyzed financial records, traced funds and

illegal proceeds, and prepared and executed seizure, search, and arrest warrants.

3. As a federal agent, I am authorized to investigate violations of the Internal

Revenue Code, other financial crimes, and money laundering. I am the IRS-CI case agent

assigned to the investigation of ROSE-MARIE NSAHLAI (“NSAHLAI”).

4. I respectfully submit this affidavit in support of an application for a criminal

complaint charging NSAHLAI with one count of conspiracy to commit bank fraud, in violation

of 18 U.S.C. § 1349, and for an arrest warrant for NSAHLAI, pursuant to Federal Rule of

Criminal Procedure 4(a).

5. This affidavit is intended merely to show that there is sufficient probable cause

for the requested complaint and arrest warrant. Since this affidavit is submitted for the limited

purpose of obtaining the complaint and arrest warrant, I have not set forth each and every known

fact pertinent to this investigation and have included primarily those facts that I believe are

necessary to establish probable cause. The information provided is based on my personal

knowledge and observations during this investigation, information conveyed to me by other

officials, law enforcement officers, and my review of records, documents, and other evidence

obtained during this investigation.

6. Based on my training and experience and the facts set forth in this affidavit, I

submit that there is probable cause to believe that NSAHLAI has engaged in conspiracy to

commit bank fraud, in violation of 18 U.S.C. § 1349.

7. The criminal conduct under investigation relates to a suspected fraud committed

in connection with the Paycheck Protection Program (“PPP”) administrated by the Small

Business Administration (“SBA”). In or around March 2020, Congress passed the Coronavirus

2
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 3 of 12 PageID# 4

Aid, Relief, and Economic Security (“CARES”) Act, of which the PPP was one component.

Through the PPP, Congress authorized the award of hundreds of billions of dollars in forgivable

loans to small businesses, for the purpose of enabling those businesses to continue to pay salary

or wages to their employees. To apply for a forgivable loan under the PPP, a business must

submit an application to a participating financial institution. If a PPP loan application is

approved, the participating lender funds the PPP loan using its own money. The SBA, in turn,

guarantees the repayment of the loan.

8. An applicant seeking a PPP loan is required to disclose to participating lenders,

among other things, the applicant’s number of employees and average payroll expenses. At the

time of the loans under investigation, the applicant also was required to agree to use any funds

disbursed through the program only “to retain workers and maintain payroll or make mortgage

interest payments, lease payments, and utility payments as specified under the Paycheck

Protection Program Rule.”

9. As described in more detail below, the government’s investigation indicates that

NSAHLAI, with the assistance of her now-estranged husband, DIDIER KINDAMBU

(“KINDAMBU”), fraudulently applied for and obtained two PPP loans from Bank of America,

N.A. (“BOA”), and that the co-conspirators then used the proceeds of those loans, in part, for

items unconnected to payroll or any permissible expense.

10. On or about April 3, 2020, KINDAMBU, or someone acting at his direction,

submitted a PPP loan application to BOA on behalf of Papillon Holdings, Inc. (At all times

relevant to this investigation, the deposits of BOA were insured by the Federal Deposit Insurance

Corporation (“FDIC”); BOA therefore constituted a “financial institution” for purposes of 18

U.S.C. §§ 20 and 1344.) That application claimed that Papillon Holdings, Inc. had eighteen full-

3
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 4 of 12 PageID# 5

time employees with an average monthly payroll of $702,450. As a part of that application

process, KINDAMBU, or someone acting at his direction, supplied BOA with an Excel

spreadsheet file that purported to be payroll records for employees of Papillon Holdings, Inc.

This spreadsheet purported to identify eighteen employees of Papillon Holdings, Inc. and listed

total payroll expenses of $7,181,522 for 2019.

11. There are several indications that these records are false, and that many if not all

of the claimed employees are fictitious. First, the spreadsheet claims that Papillon Holdings, Inc.

made over $600,000 in unemployment contributions in 2019 to the Commonwealth of Virginia,

but the Virginia Employment Commission has no record of any payments being made on behalf

of that entity. Second, the spreadsheet uses precisely the same formula to calculate the amount

of money allegedly withheld on behalf of each supposed employee. Legitimate payroll records

typically reflect varying rates of withholding, as employees often fall into different tax brackets

or elect different withholdings or exemptions. The spreadsheet also overstates the amount of

Social Security withholdings and contributions that legitimately would have been assessed

against employees making the amount of money claimed in the spreadsheet. Third, the

spreadsheet claims a total of over $7,000,000 in payroll expenses for Papillon Holdings, Inc. in

2019. But the total cumulative disbursements in 2019 reflected in all accounts identified so far

in this investigation held in the name of Papillon Holdings, Inc., was less than $2,500,000.

Fourth, the spreadsheet claims that Papillon Holdings, Inc. withheld $ 2,513,543.20 in federal

income taxes from its supposed employees for 2019, and further claims that it withheld

$128,992.06 in federal income taxes from its supposed employees for the first quarter of 2020.

But the IRS has confirmed that, as of September 29, 2020, Papillon Holdings, Inc. had not filed a

quarterly payroll return, known as a Form 941, for any quarter in 2019 or 2020, and had not filed

4
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 5 of 12 PageID# 6

an annual unemployment tax return, known as a Form 940, for 2019 or 2020. (A Form 941 is a

quarterly return through which an employer reports the amount of federal income taxes, Social

Security taxes, and Medicare taxes withheld on behalf of its employees, and pays those amounts

over to the IRS. A Form 940 is an annual unemployment tax return wherein an employer lists,

among other things, the total payments it made to its employees for the reported year.)

12. Also on or about April 3, 2020, KINDAMBU, or someone acting at his direction,

applied for another PPP loan from BOA, this time on behalf of Papillon Air, Inc. That

application represents that Papillon Air, Inc. had twenty-seven full-time employees with an

average monthly payroll of $1,980,000. As a part of that application process, KINDAMBU, or

someone acting at his direction, later supplied BOA with an Excel spreadsheet file that purported

to be payroll records for employees of Papillon Air, Inc. The supporting Excel spreadsheet states

that the employees were employed by Papillon Air Inc. and were receiving wages as of March

27, 2020.

13. The evidence indicates that these records also are fraudulent. First, the

spreadsheet represents that Papillon Air, Inc. made over $400,000 in unemployment

contributions in 2019 to the Commonwealth of Virginia, but the Virginia Employment

Commission has no record of any payments being made on behalf of that entity. Second, the

spreadsheet uses precisely the same formula to calculate the amount of money allegedly withheld

on behalf of each supposed employee and overstates the amount of Social Security withholdings

and contributions that legitimately would have been assessed against employees being paid the

asserted amounts. As noted above, this is not consistent with legitimate payroll records. Third,

the spreadsheet claims a total of over $10,000,000 in payroll and independent contractor

expenses for 2019. But the total cumulative disbursements in 2019 reflected in all accounts

5
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 6 of 12 PageID# 7

identified so far in this investigation held in the name of Papillon Air, Inc., was approximately

$800,000. Fourth, the spreadsheet claims that Papillon Air, Inc. withheld $1,806,749 in federal

income taxes from its supposed employees for 2019, and further claims that it withheld

$451,687.25 in federal income taxes from its supposed employees for the first quarter of 2020.

But the IRS has confirmed that, as of September 29, 2020, Papillon Air, Inc. had not filed a Form

941 for any quarter in 2019 or 2020, and had not filed a Form 940 for 2019 or 2020.

14. On or about May 6, 2020, BOA disbursed approximately $2,126,753 in PPP loan

funds to a BOA account held in the name of Papillon Air Inc. On or about May 14, 2020, BOA

disbursed approximately $375,000 in PPP loan funds to a BOA account held in the name of

Papillon Holdings Incorporated. An analysis of bank and other financial and business records

shows that, after receiving these proceeds, KINDAMBU spent a substantial portion of the

proceeds on items unrelated to payroll, mortgage interest payments, lease payments, or utility

payments. For example, bank and mortgage company records show that KINDAMBU used at

least $427,627 in fraud proceeds towards the down payment for the purchase of real estate at

43464 Calphams Mill Court, Leesburg, VA 20176, which upon purchase was titled jointly in the

name of both KINDAMBU and NSAHLAI. Financial records also show that KINDAMBU used

the fraud proceeds towards the purchase of all or part of a Lexus automobile, and all or part of a

Cessna 172S aircraft, and numerous other items that are not allowed under the PPP program

rules.

15. Financial records show that KINDAMBU also transferred some of the fraud

proceeds into an account in the name of “Papillon Air Maintenance,” where both he and

NSAHLAI are signatories. Bank records show that some of these funds subsequently were spent

on payroll for that entity. But records from the Virginia Corporation Commission show that

6
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 7 of 12 PageID# 8

Papillon Maintenance Services, Inc. was not formed by NSAHLAI until April 28, 2020, after

KINDAMBU applied for both loans from BOA. Payroll records from Paychex, a payroll

processing company, further show that the payroll disbursements made by KINDAMBU through

Papillon Maintenance Services, Inc. were for employees who do not appear to have been hired

until June 2020, whose names do not match the suspected fraudulent names in the spreadsheets

provided to BOA, and who were being compensated far less than the salaries represented for the

suspected fraudulent spreadsheets.

16. On or about October 16, 2020, KINDAMBU was charged by criminal complaint

with one count of bank fraud, in violation of 18 U.S.C. § 1344. See United States v. Didier

Kindambu, 1:20-mj-286 (E.D. Va.), Dkt. No. 1.

17. On or about October 20, 2020, I arrested KINDAMBU pursuant to an arrest

warrant that had issued on the criminal complaint. After being arrested, KINDAMBU was

advised of his Miranda rights and agreed to speak with investigators. During that interview,

which was audio-recorded, KINDAMBU made numerous false statements to investigators,

including, for example, that he had used funds from outside the United States to purchase the

Calphams Mill Court property, and that he had not used the PPP loan proceeds to pay for

personal expenses.

18. In or about September 2020, in a state investigation unrelated to this case,

KINDAMBU was charged in Loudoun County Juvenile and Domestic Relations Court with

felony strangulation and misdemeanor assault on a family member. NSAHLAI is the alleged

victim in that case.

19. On or about October 20, 2020, other investigators also conducted a non-custodial

interview of NSAHLAI. During that interview, NSAHLAI claimed, among other things, that:

7
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 8 of 12 PageID# 9

(a) she was not involved in the day-to-day operations of Papillon Air, Inc., and knew very little

about Papillon Holdings, Inc.; (b) that Papillon Air, Inc. could have had between 10 and 50

employees; (c) she cautioned KINDAMBU that proceeds from the PPP loan should not be used

to purchase the Calphams Mill Court property, that she did not want any part of the transaction if

he used PPP proceeds for that purpose, and that KINDAMBU assured her that the money for the

down payment came from a different source; and (d) at one point she helped KINDAMBU use

BOA’s online portal for submitting PPP loan applications, but claimed that she was not

otherwise involved in the application, that all of the information submitted to BOA came from

KINDAMBU, and that she was not involved in preparing any spreadsheets submitted to BOA.

20. On November 18, 2020, KINDAMBU was indicted with two counts of bank

fraud, in violation of 18 U.S.C. § 1344, nine counts of unlawful monetary transactions, in

violation of 18 U.S.C. § 1957, and one count of false statements, in violation of 18 U.S.C.

§ 1001, in connection with the above-described scheme. See United States v. Didier Kindambu,

1:20-CR-260 (E.D. Va.), Dkt. No. 23.

21. On January 28, 2021, KINDAMBU pled guilty to one count of bank fraud, in

violation of 18 U.S.C. § 1344, for his role in the above-described scheme. See United States v.

Didier Kindambu, 1:20-CR-260-RDA (E.D. Va.), Dkt. No. 39. KINDAMBU admitted in his

signed statement of facts that, among other things, he “submitted and caused to be submitted” the

two fraudulent loan applications described above, that the applications falsely claimed payroll

expenses that did not exist, and that in truth, Papillon Holdings, Inc. and Papillon Air, Inc. had

“few if any payroll expenses.” Id. Dkt. No. 40. KINDAMBU further admitted that he

misappropriated the PPP loan proceeds by spending a substantial portion of those funds on

unauthorized expenses, including to pay for the down payment towards the purchase of the

8
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 9 of 12 PageID# 10

Calphams Mill Court property. Id.

22. KINDAMBU has agreed to cooperate with law enforcement as a part of his plea

agreement. KINDAMBU also has provided written consent to law enforcement to search his

iPhone, his laptop, and his email account, and has waived in writing any spousal testimonial

privilege and any confidential communication privilege he may have regarding communications

with NSAHLAI.

23. Pursuant to this cooperation agreement, KINDAMBU and his counsel also agreed

to provide law enforcement with a copy of a recorded conversation covertly made by

KINDAMBU’s adult daughter of a conversation she had with her step-mother, NSAHLAI, on or

about September 24, 2020. According to the adult daughter, she and her minor brother, who are

both from a prior marriage of KINDAMBU’s, reside at the Calphams Mill Court property, while

NSAHLAI continues to reside at another location with NSAHLAI’s children from a prior

marriage. The adult daughter advises that she covertly recorded the conversation when

NSAHLAI came to the Calphams Mill Court property. At various points in that recording,

NSAHLAI made references to her involvement in the PPP fraud scheme, including the

following:

i. In reference to the funds used for the down payment for purchase of the
Calphams Mill Court property, “Did your dad tell you that I got $2.5
million from the government for loans that he has been using around?”
NSHALAI also stated that she obtained the financing for the house
because KINDAMBU would not have been approved.

ii. “You say it was your dad’s money, your dad should be careful, we have
all the evidence. Your dad could not have bought this house without me.
He’s not a citizen, he is not a resident. But you do not understand where
the money came from, sometimes you guys talk money but you don’t
know where the money come from, even your mom does not know where
the money comes from. Who made it happen?”

9
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 10 of 12 PageID# 11

iii. “I have done all these things. By the way, the loan, he says he is going to
give it back, he is not going to give it back, that money is going to be scot-
free because of how I did it.”

iv. “Let’s forget about that. He does not even give me an allowance for all I
did. Did you know your dad doesn’t even do it? He told me he gives me a
job. Who does that job? Your dad has never logged onto a computer, he
doesn’t know anything about a job.”

v. “I work everything, I worked for the loan, you saw how I was going
crazy.”

vi. “How can you call the cops on your wife? And tell her to leave a house
she made happen.”

24. A preliminary search of KINDAMBU’s iPhone, conducted pursuant to his written

consent, has also identified email communications that reflect NSAHLAI’s knowing

participating in the PPP loan fraud scheme. For example, on or about April 6, 2020, NSAHLAI

sent an email from rnsahlai@yahoo.com to didier@kindambu.com. The email includes a link to

a YouTube video regarding the PPP and Bank of America, N.A. In that email, NSAHLAI stated:

“Hello Didier,

Saw this. To get our numbers, we grossly exaggerated monthly. The first, Papillon
we did the monthly was approx. $700,000 to get a loan of $1.7 million.

The next I went up close to what [Individual A] suggested $5 million loan. Which
meant the numbers were super high.

The loan is your monthly * 2.5

I’ve asked [Individual A] locate your application to get exact information. I recall
what was done for the most part.

Offset can be done with Contractor issued 1099 we can claim creates the
discrepancy. Can indicate was included in payroll.”

25. NSAHLAI referenced loan amounts of $1.7 million and approximately $5

million. While the loans obtained for Papillon Holdings, Inc. and Papillon Air, Inc. were

$375,000 and $2,126,753, respectively, information from the SBA and Bank of America, N.A.

10
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 11 of 12 PageID# 12

shows that the initial applications for the entities requested $1,496,155 for Papillon Holdings,

Inc. and $4,950,000 for Papillon Air, Inc.

26. An additional email was obtained from rnsahlai@yahoo.com to

didier@kindambu.com sent on or around April 8, 2020. That email contains what appears to be a

copy of the fraudulent spreadsheet submitted to BOA in support of Papillon Air, Inc.’s PPP loan

application.

27. I also uncovered a WhatsApp instant messaging thread on KINDAMBU’s iPhone

with NSAHLAI. NSAHLAI made several references to her involvement in the fraud including:

i. “At this point, we’ll create the payroll reports for the periods stated by
employee. SBA us not IRS so if you’re ready to take a leap of faith and a
chance, we’ll figure it out.” NSAHLAI went on to correct “us” to “is”
saying, “SBA is not IRS”.

ii. “I’ll generate the reports from free templates. Current: figure how
payments can be justified. Future: We know the risks, lay low on SBA
initiatives, do taxes etc.”

iii. “The report is a lot and not even 5% done since 7. I need to manually
figure fed tax, state, Medicare etc plus the spreadsheet has a macro which
was disabled creating formula issues.”

iv. “I’m finishing PA 2019 and hope to do 1st qtr 2020…” Based on my
knowledge of this investigation, I suspected “PA” is an abbreviation for
Papillion Air.

28. I also have examined the metadata embedded in the fraudulent spreadsheets

submitted to BOA in support of the Papillon Air, Inc. and Papillon Holdings, Inc. applications.

The metadata embedded in the spreadsheet submitted in support of the Papillon Holdings, Inc.

application shows that the spreadsheet was last modified by “Rose-Marie Nsahlai.” The metadata

embedded in the spreadsheet submitted in support of the Papillon Air, Inc. application shows that

the spreadsheet was last modified by “DK.” The “Company” listed in the metadata is

“HHS/ITIO.” HHS/ITIO is a common abbreviation for Health and Human Services (“HHS”)

11
Case 1:21-mj-00318-IDD Document 2 Filed 09/23/21 Page 12 of 12 PageID# 13

Information Technology Infrastructure and Operations. Currently, and at the time of the

fraudulent applications, NSAHLAI was employed at HHS’s Office of the National Coordinator

for Health Information Technology.

29. Based on the forgoing, as well as the training and experience of other law

enforcement agents with whom I have spoken and my own experience, I respectfully submit that

there is probable cause to believe that ROSE-MARIE NSAHLAI conspired to commit bank

fraud, in violation of 18 U.S.C. § 1349.

Respectfully submitted, Digitally signed
Sublett byW
Sublett Charles

Charles W Date: 2021.09.22
14:29:26 -04'00'

Charles W. Sublett
Special Agent
IRS-CI

Subscribed and sworn to in accordance with Fed. R. Crim. P. 4.1 via telephone
on September 23, 2021.

Digitally signed by Michael S.
Nachmanoff
Date: 2021.09.23 11:59:55 -04'00'
___________________________________
Honorable Michael S. Nachmanoff
United States Magistrate Judge

File and source

File: 2-complaint.pdf
Size: 182,716 bytes
SHA-256: c20416f715903a80eb505eddf66f762ebbc550457ef6dcdff95d08bf049e104e
Our copy: 2-complaint.pdf
Original: No public link identified.