According to the regulator a key issue is that “the proportion of identified money mules being reported” to the National Fraud Database (NFD) varies considerably between firms.

It has identified a number of key weaknesses in the utilization of the NFD by market participants including:

• firms not conducting real time checks against the NFD post onboarding;
• firms not submitting their own cases to the NFD despite utilizing the NFD for customer screening;
• firms not filing customer details to the NFD without adequate justification for the non-reporting; and
• firms not responding to information requests from counterparts about the source of funds.

The absence of real-time checks is particularly problematic as it means that accounts can remain open for “extended periods” even when other financial institutions have identified the account holder as a mule and submitted their details to the NFD.

A key challenge reported by firms is meeting the standard of proof for the filing of cases to the NFD because only “confirmed cases of fraud” can be added to the database.

Vulnerable customers

The issue is that many of those who opt to become money mules fall into the category of “vulnerable customers” and can often claim to have been unknowing or unwitting victims of fraud.

The FCA would like firms to record the detail of such vulnerabilities and circumstances when they conclude their investigations and provide a clear rationale for why such customers are not reported to the NFD.

The regulator makes clear that while it expects improvements, in this instance it sees its role as an enabler and facilitator and wants the impetus for any changes to come from industry players.

Firms’ use of a money mule account detection tool also varies in terms of effectiveness. The FCA has identified key indicators that can be used to effectively calibrate such a fraud monitoring system:

• unexpected or unexplained deposits into accounts;
• rapid dispersal of funds through network of accounts (often within minutes of receipt);
• the movement of funds to international jurisdictions; and
• the rapid withdrawal of funds from ATMs.

Finally, the regulator wants firms to be more proactive in employing internal measures to detect money mule activity by consistently identifying abnormal transactions such as:

• customers receiving large deposits shortly after opening accounts that either exceeded or nearly exceeded their stated annual income or turnover; and
• unusual account activity not aligned with the nature of the business alongside multiple rapid transactions within a short period.

And the FCA reiterated that firms must have clear recordkeeping obligations when it comes to demonstrating robust risk management in this area.

The FCA found that firms struggled to produce customers’ proof of identification and address because “the documentation was archived and took time and effort to retrieve, or the firm did not have access because a third party had carried out the identity verification.”

While highlighting these challenges and shortcomings the FCA was much more positive about the filing of Suspicious Activity Reports (SARs), stating that, while some improvement was needed, it had observed a “high incidence” of such reporting in connection with suspected mule accounts.