How it works
Mobile-money agents, usually small shops and kiosks, exchange cash for electronic value and back on behalf of the provider. They are the point where digital proceeds become untraceable cash. Criminals moving scam takings, fraud proceeds or stolen wallet balances withdraw through agents, often splitting the balance across several agents and wallets to stay within transaction and daily limits.
Some agents are complicit. They process withdrawals for wallet holders who are not present, use customers' identity documents to register extra wallets, take a fee to skip identity checks, or transact on a customer's behalf using their PIN. A complicit agent's activity can look like a busy, successful outlet unless it is compared with peers in the same area.
Agents rebalance their float through a bank or super-agent, so laundered cash can also flow back into the formal system through the agent's own accounts. Monitoring therefore has to cover both the wallets cashing out and the agent's own float and settlement activity.
Red flags
- Many wallets receiving funds and cashing out at the same agent shortly afterwards
- Withdrawals from newly registered wallets, often registered at the same agent
- Cash-outs at an agent far from the wallet holder's usual location, immediately after an inbound transfer
- Agent volumes well above peers in the same area, concentrated in a small set of wallets
- Repeated withdrawals just under the transaction limit across several agents on the same day
Signals the engine evaluates
- Cash-out volume per agent against peer agents in the same area and against the agent's own baseline
- Time from inbound transfer to cash-out per wallet, and the share of wallets that withdraw almost everything they receive
- Wallets registered at the agent that entity resolution links through shared identity documents, phones or devices
- Distance between a wallet's usual location and the agent where it withdraws
- Agent float and settlement movements compared with the transaction volume the agent reports
Investigation and response
- 01Review the agent's transaction history together with the wallets it served, starting with those subject to fraud reports or linked to mule networks.
- 02Check the registration records of wallets onboarded at the agent for reused identity documents or missing verification.
- 03Suspend or restrict the agent pending review where policy allows, and coordinate with the super-agent or aggregator.
- 04File suspicious transaction reports on the agent and the linked wallets with the financial intelligence unit, such as the FRC in Kenya or the FIC in South Africa.