Payments, EMIs and Acquiring

High inbound velocity from unrelated personal accounts, same-day outbound to newly added payees, values clustered just under the threshold.

Third-party cash deposits into an ordinary customer's account, in values below the reporting threshold, made by people with no relationship to the accountholder, matching an expected inbound remittance that never arrives.

Merchant acquiring data, utilisation meters, headcount or occupancy flat while account credits multiply. The business has not grown; only the account has.

Newly opened accounts with immediate inbound-outbound throughput and no other life, device and IP reuse across unconnected customers, and a demographic skew toward students and young adults.

Settlement legs only: periodic net transfers between broker accounts, trade invoices used to square positions, and cash aggregation ahead of settlement.

Sequences of small value-varying transactions preceding a step change in volume, activity that settles just below alerting thresholds across several distinct rules at once, and customers whose behaviour changes within days of a rule being retuned.

Funnel accounts taking cash deposits below the reporting threshold in one location and withdrawn immediately in another; multiple unrelated accountholders sharing an address, device or telephone number; wage payments returned to the employer shortly after credit; customers who never attend alone and whose account is operated by a third party.

Small repeated payments, often at unusual hours, to money transfer beneficiaries in a small number of jurisdictions with no family or trade connection to the customer; use of prepaid instruments or virtual assets by a customer with no other digital activity; and payment values clustered in narrow bands.

Money service business accounts with corridor concentration inconsistent with any diaspora trade, third-party cash payments made on behalf of individuals with no relationship to the payer, and settlement transfers between broker accounts along known routes.

The banking exposure sits either side of the movement: aggregation of cash before departure through connected accounts and businesses, and placement afterwards in the destination jurisdiction with no corresponding trade.

Operator settlements to customers whose deposits and withdrawals net close to zero over time, betting patterns designed to minimise variance rather than to win, and third-party funding of accounts.

An established account whose entity no longer exists at the registry. Detectable only by re-verifying incorporation status across the existing book, which is a batch job most firms have never run.

Statements with no fees or charges across months, running balances consistent to the penny, logos at incorrect aspect ratio, institution codes in the wrong format, identity photographs internally inconsistent or inconsistent with stated age, third-party webcam plugins during liveness checks.

Emulator and virtual-camera artefacts in the capture stream, device and app-integrity signals that contradict a genuine handset, repeated onboarding attempts from the same device fingerprint under different identities, and capture metadata inconsistent with the phone the customer claims to hold.

Thin-file customers who behave impeccably for months, clusters sharing partial attributes such as address, device or contact details, credit files that begin abruptly in adulthood, and accounts whose only real purpose emerges long after onboarding.

A corporate customer or merchant whose entire evidenced existence post-dates its application, imagery and copy that cannot be traced to any real premises or product, a domain registered shortly before onboarding, and referees who exist only online.

Voice authentication passing on a call whose channel or device signals are inconsistent with the customer, callbacks answered on newly registered numbers, and instructions confirmed by voice that the customer later disputes entirely.

Multiple urgent same-day transfers to new beneficiaries authorised by one employee, outside normal approval patterns, following a confidential instruction the payer cannot corroborate internally.

Payments to an EMI incorporated months earlier with no filed accounts, no plausible commercial relationship to the payer, and volumes out of line with its stated business.

Counterparty IBANs whose country differs from the customer's stated location, payments that appear domestic but settle cross-border, and beneficiary names that cannot be reconciled to the underlying account.

Processing volumes implausible against the merchant estate, concentration in gambling, foreign exchange and pharmaceutical categories, and offshore IBCs onboarded as merchants.

Concentration of unusual activity at particular agents, agents whose volumes are disproportionate to their location, and onboarding files completed to a materially lower standard than the principal's own.

Royalty or licensing receipts from a platform with no corresponding audience, and licence fees between connected entities with no arm's-length benchmark.

Bulk purchases of stored-value products at retail, card-load patterns inconsistent with any consumer use, and programme manager settlement accounts with volumes exceeding the plausible cardholder base.

Payment volumes and corridors inconsistent with the respondent's own customer base, beneficiary and originator fields naming institutions that are not the respondent, and activity in currencies or jurisdictions outside the stated relationship.

Platform settlements to a merchant whose sales concentrate among a small set of repeat buyers, pricing that discourages genuine customers, and shipping weights and destinations inconsistent with the goods described.

Transaction sequences with machine timing and sizing characteristics, activity that reshapes itself shortly after a control is changed, and volumes of small movements that exceed what any manual operation could sustain.

For a VASP: deposits whose immediate provenance is a bridge or DEX contract rather than an identifiable counterparty, and short holding times between receipt and onward swap. For a bank: fiat settlement from an exchange whose own inbound provenance cannot be evidenced.

Fiat on-ramp and off-ramp volumes at exchanges and OTC desks, and customers whose banked income disappears while spending continues. The settlement itself never touches the banking system.

Exposure is indirect and sits at the fiat edges: payment institutions, exchanges and correspondent relationships with entities in the group's network. The prohibition itself is the compliance obligation.

Victim-side outbound payments escalating over weeks to newly added payees and exchange accounts, followed by indemnity claims and recall requests once the victim realises. The collection accounts show inbound from many unconnected individuals.

A single institutional customer whose deposit and withdrawal counterparties number in the thousands, activity patterns inconsistent with a single beneficial owner, and onward flows to jurisdictions the customer does not operate in.

Marketplace settlement receipts where buyer and seller are ultimately the same interest, and gaming or marketplace platform accounts with volumes unrelated to any player base.

Card accounts repaid in cash or by unrelated third parties, purchase volumes far exceeding personal use, and paired domestic flows in two jurisdictions with no instrument connecting them.

Merchant accounts with high chargeback and dispute rates against a narrow product range, settlement to beneficiaries unrelated to the listed merchant, and rapid rotation of storefronts under the same banking relationship.

The same tooling signature across customers with no other connection: identical document templates, shared device or capture characteristics, and mule accounts appearing in coordinated batches rather than individually.

Platform settlements to a venture with no product history, funding concentrated among connected contributors, and a rapid orderly wind-up.

Small recurring outbound payments to campaigns, appeals or virtual asset addresses associated with proscribed causes; a charity whose disbursement pattern does not match its stated programme; and clusters of small transfers converging on a single beneficiary.

Donation inflows inconsistent with any visible fundraising activity, grant disbursements to unverifiable overseas partners, trustee turnover with no succession, and cash withdrawals in conflict-adjacent jurisdictions.

Large numbers of newly incorporated companies sharing directors, addresses or formation agents, each running modest payroll, appearing and dissolving on a cycle.

Payroll and contractor payments to accounts whose device and location signals contradict the stated worker location, several apparently unrelated contractors sharing payment infrastructure, and rapid onward transfer of net pay.