DEA OCDETF Target Profile: Cross-Referencing "Operation Chain Reaction" Against the Full Epstein Corpus
Executive Summary
On February 23, 2026, CBS News reported the existence of a 69-page DEA document (EFTA00173953) — an OCDETF Fusion Center Target Profile dated May 18, 2015, prepared under the operation name "Chain Reaction" (OCDETF case NY-NYS-0829). The document reveals a multi-agency drug trafficking investigation targeting 15 individuals, including Jeffrey Epstein, involving approximately $50 million in suspicious wire transfers linked to "illicit drug and/or prostitution activities" in the U.S. Virgin Islands and New York City.
CBS reported the document's existence and key contents. This report cross-references every non-redacted entity, account number, shell company, bank, law enforcement query, and linked investigation from the DEA profile against the full 2.73-million-page EFTA corpus. The cross-referencing reveals operational infrastructure CBS could not have identified from the single document alone — including a seven-year shell company used for payroll (438 documents), an aviation entity integrated into a constellation of eight controlled companies (3,802 documents), unexplained same-day NCIC queries from two Secret Service divisions, and evidence that Epstein's legal team was actively attempting to circumvent the federal sex offender travel notification system.
The Document
EFTA00173953 is classified "SENSITIVE BUT UNCLASSIFIED" and titled "Target Profile: EPSTEIN" (report number OFC-TP-15-12392 / SODOFC-15.12392). Key metadata from page 0:
- Date of Report: May 18, 2015
- Date of Request: April 28, 2015 (FBI Guardian Incident)
- Case File Number: C1-11-0049 / GDEP: YNL3B (DEA)
- OCDETF Case Number: NY-NYS-0829
- Operation Name: Chain Reaction
- Requesting Agency: DEA New York, NY
- Participating Agencies: ATF, CBP, DEA, FBI, ICE, IRS-CI, USMS, USPIS, USSS, FinCEN
The report profiles 15 targets. Only Target 4 — Jeffrey Epstein — is identified by name in the unredacted portions. The remaining 14 targets' names, dates of birth, and Social Security numbers are redacted throughout.
Analytical Findings (Page 6)
The OCDETF Fusion Center states:
"DEA reporting indicates the above individuals are involved in illegitimate wire transfers which are tied to illicit drug and/or prostitution activities occurring in the U.S. Virgin Islands and New York City."
The financial overview identifies suspicious activity reports totaling tens of millions of dollars across the 15 targets:
- Multiple targets are subjects of 2015 USARs totaling $4,193,637 each
- Additional targets are subjects of 2015 USARs totaling $4,079,102 each
- One target is subject of USARs totaling $2,754,983
- Jeffrey Epstein is subject of eight CTRs (2 in 2011, 6 in 2010) totaling $233,397
- Other targets are subjects of 22 CTRs (2010-2013) totaling $730,000
These recurring USAR amounts ($4,193,637 and $4,079,102) appear in zero other documents in the 2.73M-page corpus, indicating the underlying Suspicious Activity Reports were not included in the EFTA production.
Cross-Reference Findings
1. SLK Designs LLC — The Payroll Shell (438 Documents)
The DEA profile lists SLK DESIGNS LLC as one of Epstein's businesses (page 19, FinCEN BSA ID 31000053179085) and notes:
"EPSTEIN and SLK DESIGNS LLC are listed as subjects together in a 2014 USAR. FinCEN indicates EPSTEIN sent SLK DESIGNS LLC $20,000 from an external bank account in 2014." (page 21)
CBS reported this as a single $20,000 transfer. The corpus reveals SLK Designs was a functioning seven-year operational entity:
Incorporation: SLK Designs LLC was incorporated
September 15, 2009, with EIN 80-0844023. This information was shared in a July 25, 2013 email from Lesley Groff (with Bella Klein copied) (
EFTA02131473).
Banking: A Deutsche Bank email from October 16, 2014 discusses opening a checking account for SLK Designs LLC, with banker Aracely Sanchez coordinating and Paul Morris (Managing Director, Deutsche Bank Private Bank) copied. The account opening was placed "on hold" pending an amendment to the LLC agreement to "reflect the new ownership structure" (
EFTA01423319). SLK Designs also maintained accounts at Citibank, through which JP Morgan processed wires of $5,744.57 (March 13, 2012;
EFTA01580774) and $30,000 (August 28, 2012;
EFTA01580588).
Payroll Function: An April 20, 2013 email exchange with Epstein reveals SLK Designs' true purpose. An associate writes:
"I'm not quite sure how it all works.. I will have to ask Rich K. I know my paycheck comes from NES,LLC. [Redacted name] is on payroll through SLK Designs which we have a bank account set up for SLK that you fund and Bella takes care of her payroll from that. Since I'm the owner of SLK, they can consider me as an employee for insurance purposes." (EFTA01893906)
The same email notes that at least two people were on a health insurance plan "through SLK Designs as it required at least 2 employees to be on a plan."
SLK Designs had no business cards. When asked in September 2013, the response was "No we have never had" any (EFTA02130337).
2. Hyperion Air, Inc. — The Aviation Entity (3,802 Documents)
The DEA profile lists HYPERION AIR, INC. as Epstein's business (page 19, FinCEN BSA ID 31000031627861) and notes:
"FinCEN indicates this company provides aircraft maintenance. Accurint indicates this business consists of one 2001 Bell 430 aircraft (S/N: 49078) which was registered on 09/06/2013." (page 21)
The corpus reveals Hyperion Air was far more than a maintenance company. A JP Morgan Account Control Team (ACT) Tracking document shows Hyperion Air as part of a constellation of entities under unified account control:
"JEFFREY EPSTEIN: JEGE INC., HYPERION AIR, RANCH LAKE II, RANCH LAKE III, PLAN D INC., FINANCIAL TRUST CO., NES LLC, COLL Q FDN" (EFTA01583574)
JP Morgan Online Administration records show both Richard Kahn (EFTA01583578) and Harry Beller (EFTA01583582) as account managers for the full entity constellation. Both were associated with HBRK Associates Inc. and Financial Trust Company.
The Bell 430 Helicopter: The aircraft (S/N 49078) was located in Farnborough, England, listed on controller.com for $2,600,000, with 1,660 hours and 7 seats (
EFTA01845034). After acquisition, it was registered as
N331JE. A wire instruction memo from Harry Beller directs JP Morgan to send $95,758.50 to Edwards Rotorcraft Solutions, Inc. for "Hyperion Air — Bell 430 Serial Number 49078 / Registration N331JE — Windshield" (
EFTA01579568). A separate wire of
$1,481,070 from the Hyperion Air account to Insured Aircraft Title Service via International Bank of Commerce, Laredo, TX was processed on March 5, 2012 (
EFTA01588882).
Even from jail, Epstein's aviation finances remained active. In a message to Epstein's jail email account, a correspondent writes about "another wire for pilot services for Hyperion air" and advises that "it would also be safer if the transfer did not come from the account that only contains your name" (EFTA01755638).
Deutsche Bank Daily Deposit Report: A December 12, 2013 report from RM CODE 81851 shows the full constellation of Epstein entities held at Deutsche Bank, with Hyperion Air maintaining balances across two accounts — HYPERION AIR, LLC ($100,268.92) and HYPERION AIR, INC ($407,750.00) — alongside Jeffrey Epstein's personal account 35266976 ($1,319,266.98) and 20+ other entity accounts including Southern Trust Company ($26,714,393.28) (
EFTA01450526).
3. The OCDETF Designation Gap
The DEA profile reveals that Operation Chain Reaction was designated as an OCDETF case (NY-NYS-0829), opened December 17, 2010. This raises a critical question: why was Epstein's original prosecution not designated as OCDETF?
2006 Indictment Cover Sheet (
EFTA00214563): The SDFL "Indictment/Information/Rule 20 Approval Cover Sheet" for "JEFFREY EPSTEIN, et al" (LIONS USAO NO. 2006R01181) contains a checklist of case designations. The
OCDETF checkbox is blank. The estimated number of victims is listed as 19 persons, with 40 witnesses subpoenaed. AUSA King participated in the case.
2009 Sealed Indictment Cover Sheet (
EFTA00224444): A second cover sheet dated June 8, 2009, accompanied by a motion to seal and sealed order, again shows the OCDETF checkbox
blank. However, the
PSC (Project Safe Childhood) checkbox is marked with an X. The estimated number of victims has increased to
33 persons. The case was presented on "Tuesday, June 16, 2009."
The OCDETF designation carries significant investigative implications — it triggers multi-agency coordination, access to the OCDETF Fusion Center's databases, and enhanced federal funding. The 2006-2009 prosecution proceeded without these resources. The DEA's 2015 target profile under a separate OCDETF case number (NY-NYS-0829) represents an entirely different investigative track that apparently ran parallel to — and unknown to — the SDNY prosecutors who brought the 2019 case.
A third OCDETF case also appears in the corpus. An FBI Guardian Complaint Form (dated October 8, 2021) references case "245D-NY-307101" and "OCDETF #NY-NYS-0879" with the operation name "NEW BLOOD" (EFTA00067077). This appears to be a separate OCDETF/RICO investigation with Epstein connections.
4. The Secret Service Double-Query (August 12, 2014)
The NCIC query log on page 23 of the DEA profile contains an unexplained finding. On August 12, 2014, two separate divisions of the United States Secret Service queried Jeffrey Epstein in the National Crime Information Center database:
| Agency | Queries | First Date | Last Date |
| -------- | --------- | ------------ | ----------- |
| US SECRET SERV UNIFORM DIV WASHINGTON | 1 | 08/12/2014 | 08/12/2014 |
| U S SECRET SERVICE WHITE HOUSE DIVISION | 1 | 08/12/2014 | 08/12/2014 |
The Uniform Division protects the White House complex and foreign diplomatic missions. The White House Division (now part of the Presidential Protective Division) protects the President and Vice President. Both divisions queried a registered sex offender on the same day during the Obama administration.
No document in the 2.73-million-page corpus explains why these queries occurred. Possible explanations include advance screening for an event involving a protectee, a name appearing in connection with White House visitor logs, or a referral from another agency. The simultaneous query from two separate divisions suggests a coordinated check rather than a routine screening.
5. NCIC Query Log — Full Law Enforcement Interest
Beyond the Secret Service, the DEA profile's NCIC log reveals extensive law enforcement interest in Epstein. Notable entries include:
| -------- | --------- | ------------ |
| CUSTOMS AND BORDER PROTECTION | 57+ | 2013–2015 |
| DHS ICE INVEST (multiple offices) | 3+ | 2015 |
| HARVARD UNIVERSITY CAMPUS POLICE | 1 | 11/06/2013 |
| VIRGIN ISLANDS POLICE DEPARTMENT | 1 | 06/28/2013 |
| DOI U.S. ATTORNEY GENERALS OFFICE ST THOMAS | 1 | 01/08/2014 |
| CBSA ASFC HQ IBQ (Canada) | 1 | 03/17/2014 |
The Harvard University Campus Police query on November 6, 2013 is notable given Epstein's known Harvard connections. The corpus contains related documents: iMessage conversations referencing "David Burns is the main contact at Harvard Police" (EFTA01614858, EFTA02660576), and a separate Harvard PD Criminal Investigation Division correspondence with Richard Kahn (EFTA02370532).
6. Angel Watch — Active Circumvention Efforts
The DEA profile lists a linked ICE investigation:
"ICE/ Paris, France, PA07QK13PA0002, 06/07/2013, Closed/10/03/2013, OPERATION ANGEL WATCH/RCSO PRESENSE/TRANSITING INFO SHARING" (page 21)
The Angel Watch Center, established under the International Megan's Law (IML), provides sex offender travel notifications to destination countries. The corpus reveals Epstein's legal team was actively attempting to navigate — and potentially circumvent — this system.
April 8, 2016: Epstein emails former
White House Counsel Kathy Ruemmler: "Snoop smart office angel watch center stays of regs?" (
EFTA02465774). This appears to be an inquiry about the SMART Office (Office of Sex Offender Sentencing, Monitoring, Apprehending, Registering, and Tracking) and Angel Watch Center's regulatory authority.
April 8, 2019: Darren Indyke emails Epstein:
"Got [redacted] voice mail twice more. Called SMART Office three times got a [recording] and request to leave a message each time. Tried Angel Watch by using a number I got from a Sex Offender advocacy website, but there is no answer at the extension. I called again and Dialed 0 and got ICE Child Exploitation Cybercrimes and asked for Angel Watch and was told there are no 'warm bodies' to speak with at angel watch and I could send an email to the general inquiry mailbox [email protected]." (EFTA02633922)
This was 89 days before Epstein's July 6, 2019 arrest. His attorney was actively calling Angel Watch — the federal office tasked with notifying foreign countries about traveling sex offenders — apparently trying to address travel restrictions.
The State Department revoked Epstein's passports on February 22, 2019 (EFTA00809833), and a court filing explains that "The IML tasks the Angel Watch Center with 'provid[ing] a written determination to the Department of State regarding the denial of a passport'" (EFTA01130803).
7. Foreign Banking Architecture
The DEA profile lists Epstein's financial accounts across seven institutions in five countries (page 25). The corpus allows reconstruction of the full operational details:
Valartis Bank AG, Zurich (70 documents): On January 3, 2012, Epstein emailed Harry Beller: "lets cash out in the valartis acct. give her the instrunctions to liquidate carefully but out by the end of the week" (
EFTA01844154). The account held 14,000 shares of China Superpower stock valued at EUR 1.84/$33,455 (
EFTA01845589). After relationship banker Bernard Andersen left the bank, Patrizia Favaretto (Associate Director, Valartis Bank SA, 2-4 Place du Molard, Geneva) assumed management, writing: "Bernard Andersen left the Bank and has as from yesterday no more influence on the account" (
EFTA01857340).
Fortis Banque, Paris (3 documents): Located at 80 Avenue Marceau, Paris 75008. FBAR transcripts reveal account number
00037331814 with values of $30,030 (2008) growing to $202,270 (2009) — a nearly sevenfold increase in one year (
EFTA01656576).
BNP Paribas, Paris (501 documents): Epstein maintained an active personal account receiving regular EUR 75,000 transfers (
EFTA01450163). The account was also used for third-party payments, including EUR 4,000 to "MLLE ZHU WANDI" (
EFTA01365988 —
OCR text). An iMessage introduction connected Epstein to "Jean-Christophe Durand, BNP Paribas" (
EFTA01614264).
Highbridge Capital Corporation, Grand Cayman (607 documents): This was
Glenn Dubin's hedge fund. An email is signed by Dubin as "Chairman and Chief Executive Officer, HIGHBRIDGE CAPITAL MANAGEMENT, LLC, 40 West 57th Street - 33rd Floor" (
EFTA01866715). Credit Suisse statements show a joint "HIGHBRIDGE CAPITAL MANAGEMENT - FTC / FINANCIAL TRUST COMPANY INC" account with trading activity in European monetary units (
EFTA01581994). A Highbridge employee, Kipp Mohr, coordinated personal errands with Epstein's assistant Lesley Groff (
EFTA02190567).
Deutsche Bank Trust Company Americas: Account
35266976 appears in 774 documents. Daily deposit reports reveal the full entity constellation — over 20 accounts ranging from personal ($1.3M) to Southern Trust Company ($26.7M) (
EFTA01450526).
The DEA profile also lists HSBC Private Bank SA, Geneva (securities account), HSBC Paris (personal account), and JP Morgan Chase (multiple personal and business accounts).
8. The Nonimmigrant Visa Pattern (1992–2015)
The DEA profile states on page 26 that a redacted associate's "name was listed on the DOS NIV application as the sponsor of [Target 6]." This fits a broader pattern visible across the corpus.
1992: Jeffrey Epstein petitioned the INS (now USCIS) for an
H-1B nonimmigrant worker visa on behalf of
Ghislaine Maxwell. The Petition for a Nonimmigrant Worker (Form I-129) was approved on November 5, 1992, valid through November 4, 1995, class H1B, with the consulate designated as London. The petitioner is listed as "J EPSTEIN" and the beneficiary as "MAXWELL, GLISLAINE" (Case No. 96-EU-00021510) (
EFTA01306524).
2015: Darren Indyke, as Vice President of "Enhanced Education a/k/a J. Epstein Virgin Islands Foundation Inc.," filed an
O-1 nonimmigrant petition on June 9, 2015 — one month after the DEA target profile was prepared (
EFTA01193034). The petition describes the Foundation's philanthropic activities and its $35 million gift to establish the Program for Evolutionary Dynamics at Harvard University.
The corpus also contains FBI guidance on T-visa eligibility for trafficking victims in the Epstein case (EFTA01651712), and communications about O-1 visas and EB-1 green card processes (EFTA01980226).
9. The "Recruiter and Facilitator" Assessment
Page 26 of the DEA profile contains a FinCEN assessment about one of Epstein's associates:
"[Redacted name] and Jeffrey EPSTEIN are subjects together in a 2014 USAR. FinCEN indicates [redacted name] was EPSTEIN's personal assistant and would act as a recruiter and facilitator for EPSTEIN's illicit activities."
This language — a federal financial intelligence assessment characterizing an Epstein associate as an active "recruiter and facilitator" — was written in a 2014 Unified Suspicious Activity Report, five years before the SDNY's July 2019 indictment.
10. Linked Investigations
The DEA profile lists five linked law enforcement investigations on page 21:
| Agency | Case Number | Opened | Status | Operation |
| -------- | ------------- | -------- | -------- | ----------- |
| DEA, New York | C1-11-0049 | 12/17/2010 | Pending Judicial | Chain Reaction |
| FBI, Miami | 31E-MM-108062 | 07/25/2006 | Active | EPSTEIN, JEFFREY |
| ICE, Paris | PA07QK13PA0002 | 06/07/2013 | Closed 10/03/2013 | OPERATION ANGEL WATCH |
| ICE, Las Vegas | LV15HT09LV0009 | 02/02/2009 | Pending 01/27/2010 | — |
The FBI Miami case (31E-MM-108062) opened on July 25, 2006, was still listed as Active as of May 2015. The DEA profile notes: "FBI reporting indicates Jeffrey EPSTEIN and Ghislaine MAXWELL are companions (FBI FD-302, 31E-MM-108062, 07/08/2013)."
The ICE Las Vegas case notes: "Jeffrey EPSTEIN pled guilty on 06/30/2008 on charges relating to solicitation of prostitution and procurement of minors to engage in prostitution."
11. Operation Chain Reaction — Zero Cross-References
The operation name "Chain Reaction" appears in zero other documents across the 2.73-million-page corpus. This suggests the investigation was fully compartmented — its existence was not referenced in any other federal document included in the EFTA production.
Timeline
| 07/25/2006 | FBI Miami opens case 31E-MM-108062 | EFTA00173953 p.21 |
| 06/30/2008 | Epstein pleads guilty in Florida | EFTA00173953 p.21 |
| 09/15/2009 | SLK Designs LLC incorporated | EFTA02131473 |
| 12/17/2010 | DEA New York opens Operation Chain Reaction (C1-11-0049) | EFTA00173953 p.21 |
| 01/03/2012 | Epstein orders Valartis account liquidation | EFTA01844154 |
| 03/05/2012 | $1.48M wire from Hyperion Air for aircraft purchase | EFTA01588882 |
| 04/20/2013 | Email reveals SLK Designs used for payroll | EFTA01893906 |
| 06/07/2013 | ICE Paris opens Operation Angel Watch case | EFTA00173953 p.21 |
| 07/08/2013 | FBI FD-302 identifies Epstein and Maxwell as companions | EFTA00173953 p.21 |
| 11/06/2013 | Harvard University Campus Police queries Epstein in NCIC | EFTA00173953 p.23 |
| 12/12/2013 | Deutsche Bank daily deposit report shows 20+ entity accounts | EFTA01450526 |
| 08/12/2014 | Both Secret Service divisions query Epstein in NCIC | EFTA00173953 p.23 |
| 10/16/2014 | Deutsche Bank opens SLK Designs LLC checking account | EFTA01423319 |
| 04/28/2015 | FBI Guardian Incident triggers OCDETF profile request | EFTA00173953 p.0 |
| 05/18/2015 | OCDETF Fusion Center completes target profile | EFTA00173953 p.0 |
| 06/09/2015 | Indyke files O-1 visa petition via Epstein Foundation | EFTA01193034 |
| 04/08/2016 | Epstein emails Ruemmler about Angel Watch regulations | EFTA02465774 |
| 02/22/2019 | State Department revokes Epstein's passports | EFTA00809833 |
| 04/08/2019 | Indyke attempts to contact Angel Watch Center | EFTA02633922 |
| 07/06/2019 | Epstein arrested by SDNY | Public record |
Significance
1. Investigative Compartmentalization: The DEA's Operation Chain Reaction existed from December 2010 through at least May 2015 — overlapping with but apparently unknown to the SDNY prosecutors who brought the 2019 case. CBS reported that the SDNY team did not know of this investigation. The operation name appears in zero other documents in the corpus, confirming full compartmentalization.
2. The OCDETF Gap: The original 2006-2009 SDFL prosecution was deliberately not designated as OCDETF, despite involving multiple victims, multi-state activity, and potential organized crime elements. The OCDETF checkbox is blank on both indictment cover sheets. The 2015 DEA case brought Epstein into the OCDETF framework under an entirely different case number and agency.
3. Shell Company Infrastructure: SLK Designs LLC and Hyperion Air, Inc. — listed in the DEA profile as Epstein's businesses — are extensively documented in the corpus as operational entities with banking relationships, payroll functions, and asset management roles. The DEA's single-line references to these entities vastly understate their significance as visible in the broader record.
4. Financial Architecture: The DEA profile's list of seven foreign bank accounts represents a snapshot of a larger financial infrastructure documented across thousands of corpus pages, including daily deposit reports, wire transfer memos, FBAR filings, and portfolio activity statements.
5. Sex Offender Travel Notification: The linked ICE/Angel Watch investigation, combined with corpus evidence of Epstein's legal team's efforts to contact Angel Watch in 2016 and 2019, reveals active engagement with the federal sex offender travel notification system.
Methodological Notes
- All EFTA citations were verified against the
full_text_corpus.db database. Dataset assignments were confirmed via SQL query.
- Document counts (e.g., "438 documents" for SLK Designs) represent distinct EFTA numbers containing the search term, not page counts.
- Redacted names and identifying information from the DEA profile are not reproduced here. Where the profile redacts a name, this report uses "[redacted name]" or describes the individual by role.
- Quoted passages from the corpus are drawn from OCR-processed text. Where OCR artifacts are obvious (e.g., garbled street numbers, transposed letters in names), corrections are made silently when the intended text is unambiguous from context. Original OCR text is preserved in the database and can be verified at
epstein-data.com/full_text_corpus/pages?efta_number=EFTA....
- The recurring USAR amounts ($4,193,637 and $4,079,102) and Operation Chain Reaction's name returned zero cross-references outside EFTA00173953, which limits the ability to connect the DEA investigation's financial findings to specific transactions elsewhere in the corpus.
- CBS News first reported on this document on February 23, 2026. This cross-reference analysis was conducted the same day.
This analysis relies on automated corpus search and Claude Code running Opus 4.6, which can make mistakes. All citations should be verified against the source documents.