Money mules and the SMB: where laundered money meets your business

Most founders treat fraud as something that happens to them: a scam invoice, a compromised card, a chargeback. Money laundering feels like someone else’s problem. It isn’t. Criminal proceeds have to leave the financial system somewhere, and a large share leaves through ordinary purchases from ordinary businesses. The cost is practical: an account frozen without explanation, a reserve imposed by your acquirer, a refund that quietly completes someone else’s laundering cycle. This lesson explains how a mule chain works, where an SMB sits inside it, and what to change in your own payment operations.

How a mule chain moves money

Laundering runs in three stages. Placement puts criminal money into the financial system. Layering moves it around to hide where it came from. Integration brings it back out looking legitimate. A money mule is a person or business whose account receives criminal funds and passes them on, knowingly or not. In a typical fraud, the victim’s payment lands in a first mule account, gets split and forwarded through further accounts, and is then cashed out.

The FCA’s September 2026 multi-firm review puts numbers on the UK mechanics. Firms closed 238,396 suspected mule accounts in 2025. A public/private cell of 22 firms traced 140 fraud cases and found cash-out concentrated between the second and fifth account, by which point the money had been broken into smaller, less conspicuous payments. Card payments were the most common cash-out route: many low-value purchases, or larger payments to local businesses and retailers.

Three terms carry the rest of the lesson. Cash-out is the point where criminal funds turn into goods, cash or crypto. Offboarding is a provider closing an account it suspects. De-risking is a provider withdrawing service from a type of customer it judges high-risk, often with little explanation, because the rules on disclosing suspicion reports restrict what it can tell you.

Where your business sits

An SMB touches a mule chain in three places.

• As a cash-out endpoint. When a mule spends criminal funds with you, the sale is real and the goods leave your premises. Your acquirer then sees your merchant flow as part of the pattern. High-value first purchases, payments split just under round numbers and refund requests to a different card are what monitoring systems flag. Refunds are the sharpest exposure: a refund to a new instrument turns spent money back into clean funds somewhere else, with your business as the laundering step.
• As an account holder. Business account closures for suspected muling were 10% higher in 2025 than in 2023, and challenger banks carried around half of them. Providers that onboard fastest attract mule accounts, and are quickest to close them. A legitimate business with an unusual month can get caught in the same net.
• Where it does not bite. Your rights as an APP fraud victim, your supplier payments and your borrowing are untouched by the mule findings.

Diagnostic

Answer yes or no.

1. Do you sell goods that resell easily: electronics, gift cards, vouchers, luxury items?
2. Can a customer get a refund to a card or account other than the one they paid with?
3. Does more than one payroll cycle of your cash sit with a single provider?
4. Could a cluster of high-value first-time orders go unnoticed for a week?

Two or more yes answers mean your business is structurally attractive as a cash-out point, exposed to a freeze, or both.

What to do this week

1. Foundation: lock the refund route. In Stripe, Square, SumUp or whichever PSP you use, confirm refunds return only to the original payment method, and route every exception to one named approver. Applies to any business taking card or Open Banking payments.
2. Layering: set one velocity rule. Using your PSP’s risk tools (Stripe Radar rules, for example) or a weekly export reconciled in Xero, flag first-time customers whose order exceeds three times your average ticket. The multiple is a starting heuristic, not a benchmark; tighten it if you answered yes to diagnostic question 1.
3. Optionality: split the banking. Hold a secondary operating account with a different provider and keep one payroll cycle in it. Applies if you answered yes to diagnostic question 3. The test: could you pay staff and your key suppliers if the primary account froze tomorrow?

Why this matters now

Fraud controls are moving outward, from the victim’s bank to every account and merchant the money touches. The FCA now expects firms to look beyond the receiving account to payment characteristics and transaction context. The Economic Crime and Corporate Transparency Act 2023 lets firms share intelligence on suspected mules. The Home Office Fraud Strategy 2026–29 names mule networks directly. Each step widens the set of transactions a provider scrutinises, and SMB merchant flows sit inside that set. The 2028 financial literacy baseline assumes operators understand the system they trade inside, not just their own books. An operator who can explain their payment patterns, refund policy and banking concentration answers a provider’s question in a day. One who can’t learns what a frozen account costs.

Tomorrow: how UK fraud reimbursement splits the cost between the sending and receiving firm, and what that means when your business is the one that got paid.