FCA money mules review: closing accounts is not enough

Reported offboarding of suspected mule accounts increased to 238,396 in 2025. Whilst that reflects increased detection activity, the FCA's findings indicate that criminal networks continue to operate at scale, often using accounts repeatedly and across multiple fraud typologies.

Rising offboarding volumes should not be mistaken for success. The review suggests criminal groups are adapting rather than retreating, reinforcing the need for firms to focus on prevention and network disruption as well as account closures.

Fraud proceeds were typically cashed out between the second and fifth mule account in the payment chain, with the highest concentration occurring at the second account.

As funds move through multiple accounts they become harder to identify, trace and recover. Firms should therefore focus on detecting suspicious activity as early as possible, particularly at the start of the payment chain where intervention is most effective

The FCA found that card payments are commonly used to monetise fraud proceeds, often through multiple low-value purchases or higher-value spending with merchants and retailers.

Because these transactions can closely resemble legitimate consumer activity, firms should ensure their monitoring frameworks are capable of identifying suspicious spending behaviours rather than relying solely on traditional red flags.

The review highlights opportunities for firms to share more intelligence relating to suspected mule activity, including through the voluntary information-sharing provisions introduced by the Economic Crime and Corporate Transparency Act 2023 ("ECCTA"). The FCA's findings suggest that information-sharing remains an underutilised tool in the fight against fraud and money laundering.

Timely information-sharing can help firms identify linked accounts, recurring laundering methodologies and common cash-out routes before funds disappear from the financial system. It can also improve firms' understanding of wider criminal networks, enabling earlier intervention and more effective disruption of fraudulent activity.

Firms should consider whether their governance, legal and compliance frameworks enable them to make effective use of these powers. The publication of UK Finance's guidance on information-sharing under ECCTA has provided firms with practical examples of how these provisions can be used in practice whilst managing legal, regulatory and data protection considerations. Firms that have not yet assessed how they might operationalise these powers may wish to do so.

The FCA identified recurring overseas destinations for mule-related funds, including jurisdictions in South Asia, West Africa and the Middle East. Whilst crypto-related cash-outs were lower in volume, they tended to be higher in value.

Firms with cross-border payment activity or crypto-related exposure should ensure that these risks are appropriately reflected within their financial crime risk assessments, controls and monitoring frameworks.

Customers aged 26 to 39 continued to account for the largest proportion of offboarded mule accounts. However, the fastest growth was seen in the 40 to 49 age group.

The findings suggest firms should regularly reassess customer risk models and avoid assuming that mule activity is predominantly associated with younger customers. Risk indicators should evolve alongside criminal behaviour.

The review found increasing levels of suspected mule activity involving business accounts, charities, non-profits and other legal entities.

Although overall volumes remain relatively low, the trend suggests firms should review whether onboarding, monitoring and enhanced due diligence controls adequately capture risks associated with non-personal customers, particularly SMEs and third-sector organisations.

Whilst firms submitted more than 113,000 National Fraud Database filings over the review period, the proportion of offboarded customers reported to the database decreased during the most recent year.

The FCA's observations suggest firms should review their internal governance, evidential thresholds and processes relating to Cifas reporting to ensure that the National Fraud Database is being used effectively as part of a broader anti-fraud strategy.

The review found that different types of firms experience different patterns of mule activity. Retail banks generally see higher transaction volumes, while other firms often encounter fewer but higher-value transactions.

A one-size-fits-all approach is unlikely to be sufficient. Firms should ensure that monitoring, governance and investigative controls are calibrated to their own risk profile and customer base.

The FCA has indicated that it will continue working with the National Economic Crime Centre and will use supervisory activity to assess how firms are responding to evolving mule risks.

Firms should treat the review as an opportunity to assess the effectiveness of their current framework rather than waiting for direct regulatory engagement.