Securing against fraud - UK Financial Conduct Authority review on money mule prevention

Why should I read this?

Fraud accounts for 40% of all UK crime, and the ease with which fraudsters can use money mules is a serious barrier to addressing fraud. Firms have a key role to play in disrupting money mule activities.

Firms are required to take a proportionate and risk-based approach to ensure that customers are not at risk from criminal groups and to reduce the amount of fraud in the UK.  This briefing looks at ways identified by the FCA in dealing with the risk of money mule activity.

The findings of the FCA review into preventing money mule activities will be of fundamental importance to Money Laundering Reporting Officers (MLROs) and industry practitioners working in financial crime and fraud roles within the financial services sector.

What is a money mule?

A ‘money mule’ is a reference to someone who is recruited by criminals to move illegally obtained money, and in doing so, becomes knowingly or unknowingly involved in fraud and/or money laundering. Sometimes a mule is unaware of any illegality in the transaction, and is deceived by criminals who present seemingly legitimate opportunities or plausible explanations for their crimes. In contrast, knowingly-involved money mules are fully aware of the illegality and criminality of their actions, looking for financial gain in furthering the fraud and/or money laundering.

What has the FCA done?

The FCA has conducted a review into payment account providers’ systems and controls against money mule activities, and in sharing its key findings from that review has provided guidance, highlighted areas of risk and set out areas for improvement. 

What did the court decide?

The summary of the FCA findings is shown at Proceeds of fraud - Detecting and preventing money mules which provides guidance for payment account providers including:

1. making use of technology to combat fraud and money mule activity in a proportionate way.  Examples of good practice include

• investing in AI such as machine learning systems to know your customers and to better identify and prevent money mule activity
• using reporting systems to analyse the flow of funds between firms and adopting lawful data sharing with other firms to combat the issue of money mules
• using facial recognition systems, device profiling and geolocation
• working collaboratively with other firms, for example by using reporting systems to notify and alert other firms when a potential money mule is identified    

2. providing regular and dedicated training for staff on financial crime and specifically fraud. Good quality training is designed to help to ensure staff are kept up to date with new criminal typologies and enables staff to be better able to detect and prevent money mule activity

3. employing more senior managers and providing better MI reporting. It was considered that there is a lack of senior management oversight and MI reporting. The FCA expects a more proactive strategy to protect firms’ regulatory compliance, reputation and its customers

4. ensuring there are better onboarding processes to detect potential red flags and identify potential money mules. Robust controls may include:

• conducting further investigations into customers who provide virtual addresses, or where their proposed new customer is using a device which is accessed by multiple individuals
• capturing more details about their customer such as salary and turnover at the onboarding stage
• incorporating device profiling, geo-location and behavioural biometrics into onboarding control

5. detecting more quickly and investigating common mule characteristics (such as high value payments into new or previously dormant accounts). This may be achieved by, for example

• focussing on inbound transaction monitoring to the same extent that firms are focussing on outbound transaction monitoring. Focusing only on outbound transaction monitoring often means that mule accounts cannot be detected until it is too late and after funds have left the mules’ accounts
• understanding how machine learning models work, i.e. what the inputs and expected outputs are. For example, machine learning tools require historical data to assess a customer’s behaviour, so may not be as effective for new customers
• improving recording narratives and rationales in investigations, to improve machine learning (and which is required for a clear audit trail)
• quickly implementing changes to monitoring rules, including to encompass emerging risks

6. reporting mule activity more quickly and efficiently through relevant reporting systems, such as through Suspicious Activity Reports and though UK data sharing initiatives

7. educating customers about money mule risks. In particular, this can be done by firms improving their communication strategies and awareness initiatives for its customers who  may be particularly vulnerable during the cost of living crisis, and whom might be more susceptibility to pressure from money mules

Expectations of the FCA and Next Steps

The FCA is encouraged by the awareness of firms around the issues and the use and development of technology. However, the FCA also believes that better processes within firms can help to combat a huge source of UK financial crime.

It is clear that the FCA believes there is a lack of consistency between firms’ approaches in addressing money mules and wider fraud combating. It therefore expects firms to consider their own processes in line with its findings, and to take action against any internal weakness.

The FCA has made clear that it will use its full regulatory and enforcement powers to take action against firms which continue to allow their services to be exploited by fraudsters, and we therefore recommend that all firms review their fraud-prevention processes in this regard. 

Contributors 

Deborah Williams and Amir Azam