Agent abuse
Ce contenu n’est pas encore disponible dans votre langue.
In short
Section titled “In short”Mobile money agents are the shops and kiosks where customers turn cash into e-money (cash-in) and e-money back into cash (cash-out). They are the point where cash, which leaves little trace, enters and leaves the system. That makes them attractive to launderers and fraudsters, sometimes with the agent’s help and sometimes without the agent knowing.
This playbook covers patterns where the agent is central: either abusing their position, or being used by customers.
What it looks like
Section titled “What it looks like”An agent in Kasoa records cash-in of GHS 1,900 into a customer’s wallet at 10:02. At 10:09 the same wallet cashes out GHS 1,850 at the same agent. This happens 40 times in a month across 14 wallets. The agent earns commission on both legs; no real customer money moves.
Common patterns:
| Pattern | What is happening |
|---|---|
| Split cash-in | A customer deposits a large sum through several agents to avoid limits (see Structuring) |
| Cash-in then immediate cash-out at the same agent | Commission farming, or cash being “washed” through e-money with no real purpose |
| Agent volume far above peers | The agent may be serving a laundering network, or recording fake transactions |
| Agent using customers’ wallets | The agent performs transactions on wallets they control, or on customers’ wallets without consent |
| Direct deposit instead of cash-in | The agent sends e-money from their float as a P2P transfer to avoid customer-side limits or KYC checks |
| Reversal abuse | Fake “wrong transfer” reversals used to pull funds back or confuse the trail |
Which rules surface it
Section titled “Which rules surface it”| Rule | What it catches |
|---|---|
| G1 Agent cash-in volume anomaly vs peers | An agent far busier than similar agents in the same area or tier |
| G2 Cash-out straight after cash-in | Same wallet, same agent, short window |
| G5 Reversal or refund abuse | Unusually many reversals |
| B2 Split cash-in across agents | One wallet loaded through many agents |
| D5 Shared device, phone or ID | One device operating many wallets, which may be the agent’s |
G1 runs once a day over the last week, and compares each agent only with agents in the same peer
group, so it needs a region (or tier) attribute on your agents’ records or cash-ins. See
G1.
Red flags and innocent explanations
Section titled “Red flags and innocent explanations”| Red flag | Possible innocent explanation | How to tell them apart |
|---|---|---|
| Agent volume far above peers | A busy location: a lorry station, a market, a university | Does the location justify it? Is the growth gradual? Is the customer base varied? |
| Cash-in then cash-out on the same wallet | The customer changed their mind or made a mistake | Once is a mistake; repeated across many wallets is a pattern |
| Same few wallets transacting repeatedly at one agent | Regular customers living nearby | Do the amounts and timings look like real life (varied), or mechanical (repeated, near-identical)? |
| Many wallets operated from the agent’s device | Agent helping customers who have no phone | Agent-assisted transactions should be recorded as such; customer wallets used on the agent’s own device are a concern |
| Many reversals | Genuine wrong-number errors | Are reversals concentrated on certain wallets, or followed by fresh transfers? |
How to investigate
Section titled “How to investigate”- Profile the agent. Location, tier, how long they have been an agent, their super-agent or aggregator, and their usual volume.
- Compare with peers. How does their volume, average transaction size and customer count compare with agents of the same tier in the same area?
- Look at the customer list. How many distinct wallets does the agent serve? Are a few wallets responsible for most of the volume?
- Look at timing. Cash-in and cash-out pairs minutes apart, transactions at unusual hours, or bursts at month-end commission cut-offs are all worth noting.
- Look at devices. Are customer wallets being operated from the agent’s device?
- Check the wallets involved. Open the most active ones: do they show mule or structuring patterns themselves?
- Talk to your agent network team, not to the agent, about what they know: complaints, previous warnings, field visit notes. Keep the conversation inside your institution.
- Decide and document.
What to record
Section titled “What to record”- Agent profile and peer comparison (with the figures).
- The specific transactions that show the pattern.
- The wallets involved and any links between them.
- Information from the agent network team, with names and dates.
- Whether the agent appears to be a participant, negligent, or unaware.
When to escalate or report
Section titled “When to escalate or report”- Escalate any pattern suggesting the agent is a participant, any large-scale commission farming, and any links to mule or fraud cases.
- Report where you have reasonable grounds to suspect laundering or fraud through the agent, whether by the agent or by customers using them.
- Commercial actions (suspending the agent, terminating the contract) are business decisions for your institution under its own procedures. Coordinate them with the MLRO so they don’t tip off anyone before a report is filed.