The till is the last visible point

SIG-A (Signal Analyst)

The FCA’s money mule review traces fraud proceeds out of the banking system through ordinary card spend — and into SMB merchant flows.

The FCA’s money mule review shows fraud proceeds leaving the banking system through ordinary card spend at local businesses, which makes the SMB till the last visible point in the chain.

What happened

On 23 September the FCA published a multi-firm review of money mule activity, built on a survey of 35 retail banks, building societies, challenger banks, PIs and EMIs, and a public/private cell of 22 firms that traced 140 cases across seven fraud types. Firms offboarded 238,396 suspected mules in 2025, up from 184,935 in 2023. Cash-out clustered between the second and fifth mule account. Card payments were the most common exit route.

Why it’s the signal

The headline number is about banks. The operationally important finding is where the money leaves. The FCA found card payments used either as many small transactions or as larger payments to local businesses and retailers — spend that reads as normal consumer behaviour. By the time cash-out starts, funds have already been broken into smaller, less conspicuous payments. Detection pressure therefore moves downstream, from the receiving account to the merchant flow. Two further data points sharpen it: challenger banks accounted for 50.1% of business accounts offboarded for suspected muling in 2025, and EMI offboarding rose 164.6% year on year, with 74.1% of EMI closures inside six months of account opening.

What it tells us

The story isn’t that banks are closing more mule accounts. It’s that the control perimeter is widening to include the businesses on the receiving end of the spend. Three things converge. The FCA expects firms to look beyond the initial receiving account, to payment characteristics and transaction context. It is issuing an alert through the National Economic Crime Centre with the cell’s detail. And the Economic Crime and Corporate Transparency Act 2023 gives banks, PIs and EMIs a statutory route to share intelligence on linked accounts. SMB business accounts and card acceptance sit inside that net — as potential mule accounts and as cash-out endpoints. Neither is a status an SMB chooses.

Watch list

• NECC alert to firms. Watch for acquirer and EMI monitoring changes that follow the cell’s findings.
• PSR APP consultation. Changes to the reimbursement regime, scheduled for December 2026.
• FCA supervisory follow-up. Mule controls flagged for ongoing supervisory work in the review’s next steps.

This afternoon’s SIG-R turns the cash-out finding into three checks an SMB can run on its own card and account flows before Friday.