The Mule Economy: Deconstructing the Financial Architecture Behind the Laundering of Fraud Proceeds
Fraud does not end when money leaves the victim’s account. The proceeds must be received, moved, dispersed, withdrawn or converted, creating a financial infrastructure that investigators may be able to trace. This article examines the money mule networks that support that process, how recruitment and fund movement expose relationships across accounts and jurisdictions, and what evolving regulatory and enforcement responses reveal about opportunities to detect, investigate and disrupt the wider laundering architecture.
Key Points
Money mule accounts should be understood as financial infrastructure within the movement and laundering of fraud proceeds, rather than merely as an incidental feature of the originating scam. Examining how that infrastructure operates can reveal relationships that are not visible from the victim transaction alone.
The UK, EU and US are strengthening enforcement, supervisory and disruption responses to money-mule activity, but their legal tests, institutional responsibilities and enforcement frameworks differ. Approaches or terminology from one jurisdiction should not automatically be treated as applicable in another.
Mule networks can move value through conventional bank accounts, cash withdrawals, digital-payment services and cryptocurrency, sometimes across several accounts, intermediaries and jurisdictions. Investigators therefore need to examine the movement of value as a sequence rather than treating individual transactions in isolation.
A mule indicator is not proof of knowing participation in fraud or money laundering. Effective assessment requires investigators to combine onboarding information, transactional behaviour, account history, counterparties, devices and other relevant intelligence while testing credible alternative explanations.
Network analysis can be particularly valuable because repeated beneficiaries, shared identifiers, common counterparties or recurring movement patterns may connect accounts that initially appear unrelated. Those associations should generate investigative hypotheses rather than automatic conclusions about coordination or culpability.
Cross-institutional and cross-border intelligence sharing is increasingly important because the victim, mule account, intermediary, conversion point and ultimate beneficiary may be distributed across different institutions and jurisdictions. No single organisation may hold enough information to reconstruct the complete movement of fraud proceeds.
The investigative objective should extend beyond identifying and closing an individual mule account. Where the evidence permits, investigators should seek to understand the wider financial architecture: how funds enter the network, how they are dispersed or layered, where they are converted or withdrawn, and what relationships may lead towards organisers or beneficiaries.
Introduction
Every fraud scheme, from a business email compromise targeting a law firm's client account to a romance scam draining a pensioner's savings, eventually encounters the same operational problem: stolen funds must be received, moved, dispersed, withdrawn or converted before they can be enjoyed. Money mule accounts provide critical infrastructure for that process. They are therefore not merely an incidental feature of the originating fraud; they form part of the financial architecture through which criminal proceeds are moved away from the victim and towards other participants, conversion points or ultimate beneficiaries. The connection between fraudulent advertising and downstream value movement is examined in Scam Ads and Online Fraud, which follows the operation from advert exposure through payment routes to mule-network activity.
UK Finance's Annual Fraud Report 2026 recorded payment fraud losses of £1.28 billion across its member banks in 2025 alone, with an average of eight people defrauded every minute. Those figures describe a broader payment-fraud environment rather than the scale of money-mule activity itself, but they illustrate the volume of criminal proceeds that fraud ecosystems can generate. The investigative question does not end with how the victim was deceived or how the payment was authorised. It extends to what happened after the money left: which account received it, how quickly it moved, whether it was divided between destinations, where it was withdrawn or converted, and what relationships become visible when those movements are examined together.
This changes the way mule activity should be approached. An individual receiving account may appear to be the endpoint of a victim's transaction, when in fact it may represent only one node within a wider movement-of-value network. Funds can pass through multiple accounts, payment services, cash withdrawals or cryptocurrency conversion points, potentially crossing institutions and jurisdictions before reaching those controlling or benefiting from the activity. Following that sequence can expose counterparties, recurring beneficiaries, shared identifiers and movement patterns that are not visible when each transaction or account is assessed in isolation.
At the same time, financial movement should not be confused with proof of culpability. Evidence that an account received and transferred fraud proceeds may establish an important part of the financial trail without resolving what the account holder knew, suspected or intended. Unwitting, exploited, recruited and knowingly complicit participants may present different investigative and legal questions, while the applicable tests for criminal liability differ between jurisdictions. A mule indicator or network association should therefore generate an investigative hypothesis, not an automatic conclusion about knowledge or participation.
This article examines how the mule economy is recruited and organised, how fraud proceeds move through its financial infrastructure, and how regulatory and enforcement responses are developing across the United Kingdom, European Union and United States. It considers what transaction patterns, behavioural information and network relationships can establish; where corroboration and alternative explanations remain necessary; and why cross-institutional and cross-border visibility increasingly matters. Its central proposition is that identifying a mule account should not be treated as the end of the investigation. Where the evidence permits, it should become a starting point for reconstructing and disrupting the wider financial architecture through which fraud proceeds move.
Understanding the Money Mule Account
A money mule account is a bank account, e-wallet or payment card used to receive, hold and forward funds derived from crime on behalf of someone else, in return for a fee, a favour, or under coercion. The account holder may be a knowing participant, a person who has been groomed and only partly understands what is happening, or a victim who has been threatened into compliance.
Witting, Unwitting and Coerced Mules
These categories carry different moral and legal significance. Criminal exposure depends on the offence, the evidence and the participant's state of knowledge, suspicion or intent. In the UK, section 328 of the Proceeds of Crime Act 2002 applies where a person enters into or becomes concerned in an arrangement knowing or suspecting that it facilitates another person's acquisition, retention, use or control of criminal property. That is not the same as saying that a person is criminally liable merely because investigators suspect them. The position also should not be generalised across jurisdictions: US federal offences apply their own knowledge and intent requirements, while authorities distinguish unwitting, witting and complicit mules. EU criminal-law implementation likewise depends on the applicable EU framework and national law. For investigators and compliance teams, account behaviour should therefore be assessed alongside evidence of knowledge, exploitation, coercion and control rather than treated as proof of culpability.
Money Mules Are Not Professional Money Launderers
The Financial Action Task Force distinguishes money mules from professional money launderers, who are specialists offering laundering as a standing service to multiple criminal clients, often drawing on legitimate professional backgrounds in law, accountancy or company formation. Money mules are the lower-skilled, higher-volume layer beneath them, supplying a constant stream of disposable accounts. Disrupting a mule account interrupts one transaction chain; dismantling a professional laundering network can remove laundering capacity for many unrelated criminal clients at once.
The Regulatory and Legal Framework Across Three Jurisdictions
Money mule accounts do not respect borders, but the legal tools used against them are still largely national or regional, which is itself part of the challenge. Understanding the framework in the United Kingdom, the European Union and the United States is essential for any compliance professional expected to operate across them.
United Kingdom
UK enforcement rests on the Proceeds of Crime Act 2002, discussed above, which captures a mule account holder even where the individual did not commit the underlying fraud. In March 2024, the UK Government published a 22-point cross-sector Money Mule and Financial Exploitation Action Plan, led by the National Crime Agency's National Economic Crime Centre alongside UK Finance, Cifas and The Children's Society, targeting public awareness, intelligence sharing on complicit mules, and safeguarding for financially exploited young people. The Crown Prosecution Service updated its prosecution guidance to reflect the spectrum between knowing mules, exploited victims, and organisers described in enforcement circles as 'mule herders'. Cifas estimated that around 37,000 UK bank accounts displayed muling-related behaviour in 2023, and the National Crime Agency estimates that more than £10 billion in illicit funds is estimated to be laundered through UK money-mule activity annually.
European Union
The EU's approach has been substantially rebuilt. The 2024 AML/CFT legislative package includes Regulation (EU) 2024/1624, the directly applicable Anti-Money Laundering Regulation (AMLR); Directive (EU) 2024/1640 (AMLD); and Regulation (EU) 2024/1620 (the AMLA Regulation), which established the Authority for Anti-Money Laundering and Countering the Financing of Terrorism. AMLA began its operational build-out in Frankfurt in 2025. Its first selection of up to 40 directly supervised high-risk cross-border financial institutions is due in 2027, with direct supervision beginning in 2028. Europol separately coordinates the European Money Mule Action with law-enforcement and private-sector partners, giving the EU both a more harmonised regulatory framework and a recurring operational mechanism.
United States
US enforcement relies on the Bank Secrecy Act framework administered by FinCEN, which requires financial institutions to file Suspicious Activity Reports on mule-linked transactions, combined with federal money laundering statutes under Title 18 of the US Code that carry sentences of up to twenty years per count, alongside separate charges for identity theft and false statements to a financial institution that frequently accompany mule-account prosecutions. FinCEN's advisories, including its 2020 guidance on pandemic-era imposter scams and its 2025 advisory on Chinese money laundering networks, give banks red-flag indicators to apply at account opening and during transaction monitoring. Prosecutions are typically brought by US Attorneys' Offices working with the FBI and Secret Service, and, as the case studies below show, US courts have imposed some of the longest custodial sentences of any jurisdiction for mule-account operators who use fabricated identities at scale.
At-a-Glance Jurisdictional Comparison
|
Dimension |
United Kingdom |
European Union |
United States |
|
Core framework |
POCA 2002 and wider UK AML regime |
AMLR 2024/1624, AMLD 2024/1640 and AMLA Regulation
2024/1620 |
Bank Secrecy Act framework plus federal criminal statutes |
|
Institutional emphasis |
Enforcement, prevention and safeguarding |
Harmonisation, national supervision and growing AMLA
coordination |
Federal financial intelligence, investigation and
prosecution |
|
Professional lesson |
Separate exploitation, suspicion and knowing facilitation |
Account for cross-border supervisory and
information-sharing requirements |
Analyse identity, account and network evidence against the
elements of the relevant offence |
Why It Matters: Impact on Financial Institutions
The consequences of mule-account activity extend beyond the individuals involved. A bank that repeatedly onboards or fails to detect mule accounts faces regulatory scrutiny, enforcement fines, and correspondent banking relationships that can be withdrawn if a counterparty judges its controls weak. Under the EU's AMLA framework, the highest-risk institutions will face direct supervision rather than assessment solely by national regulators. In the UK, reimbursement rules for authorised push payment fraud now split liability between sending and receiving banks, giving receiving institutions a direct incentive to close mule accounts before funds are withdrawn. In the US, the reputational cost of a mule-account failure is compounded by possible civil penalties under the Bank Secrecy Act. For compliance teams, mule-account detection is a measurable component of regulatory exposure in all three jurisdictions, not a discretionary enhancement to an existing programme.
How the Laundering Process Works
Mule accounts are deployed across the three classical stages of money laundering. In placement, stolen or scammed funds land in a first-tier mule account, often opened by a genuine account holder, which gives the money an initial appearance of legitimacy. In layering, funds are split and moved rapidly through additional mule accounts, e-wallets and cryptocurrency exchanges to obscure their origin, a process FinCEN's 2025 advisory on Chinese money laundering networks describes as including mirror transactions and trade-based laundering alongside conventional transfers. In integration, funds are consolidated through cash withdrawal, international wire transfer, or asset purchase, re-entering the economy as apparently clean value. Each additional layer adds distance from the original crime and complicates the audit trail investigators must reconstruct. These transactional patterns may generate monitoring alerts, but understanding their significance requires investigators to examine the wider context and relationships, a distinction explored further in The Alert Is Not the Investigation. In relationship-based fraud, this tracing can extend the enquiry beyond the victim–fraudster interaction to the beneficiary accounts, payment channels and wider network infrastructure examined in Romance and Investment Scams: Investigating the Networks Behind Relationship-Based Fraud.
Recruitment: Turning Individuals Into Infrastructure
Source: Fraud Intelligence Lab (F.I.L.) original analytical
framework. It is not a statutory test, regulatory model or law-enforcement
investigation standard.
International Case Studies and Enforcement Examples
The five examples below are drawn from official court, prosecutorial, regulatory and law-enforcement records across the United States, the United Kingdom and the European Union. They illustrate different forms of mule-account activity and enforcement response. They are illustrative examples rather than prevalence estimates and should not be read as showing how frequently any particular typology occurs.
Case Study 1 (United States): A Fabricated Identity Network Behind a $2 Million BEC Scheme
What Happened
In the Western District of North Carolina, Chukwudi Michael Okwara was convicted by a federal jury in June 2021 of running a network of money mule bank accounts opened using false and stolen identity documents. Beginning in November 2018, the accounts received and laundered proceeds of business email compromise scams totalling roughly $2 million from six victim companies. Within days of each fraudulent wire landing, Okwara withdrew or moved the funds using additional false identities to break the audit trail. He was sentenced to 13 years in prison on charges including money laundering, false statements to a financial institution, and aggravated identity theft.
Why It Matters
A single, well-resourced operator can service several unrelated fraud schemes at once, acting as a laundering utility for multiple criminal clients rather than a one-off participant.
Professional Lesson
Treat a mule account as a potential access point into wider laundering infrastructure, and check whether its identity documents show signs of fabrication or reuse elsewhere.
Case Study 2 (United States): A $13 Million Multi-Account Laundering Operation
What Happened
In the Eastern District of Virginia, Onyewuchi Victor Ibeh and Jason Eugene Joyner were sentenced to a combined total of over 14 years for laundering approximately $13 million in business email compromise proceeds between July 2016 and May 2020. Ibeh managed the account infrastructure, arranging for conspirators to open dozens of directly and indirectly controlled bank accounts used to move funds domestically and internationally, while Joyner's role was to withdraw laundered proceeds in cash for physical delivery to other members of the network. Part of the proceeds funded luxury purchases, including a custom jewellery piece costing close to $40,000.
Why It Matters
Prosecutors used the luxury spending as evidence of personal enrichment rather than incidental involvement, a common approach when direct proof of knowledge is harder to establish.
Professional Lesson
Role separation between account management and cash extraction recurs in larger networks; the account controller is usually more valuable to an investigation than those handling withdrawals.
Case Study 3 (United Kingdom): A £53 Million Post Office and Cryptocurrency Mule Network
What Happened
Leicestershire Police's Operation Kilo, a four-year investigation concluding in 2025, dismantled a cash-based laundering network that moved more than £53 million between 2019 and 2021 by combining a recruited mule network with the Post Office's cash-handling infrastructure and cryptocurrency conversion. Criminal cash was physically transported into Leicester and introduced into the banking system through Post Office branches across the county, then dissipated through business accounts and crypto assets. Five defendants were sentenced to a combined total of more than 35 years. Rajul Patel received an eight-year term and a ten-year disqualification from acting as a company director, while the network's identified head pleaded guilty once presented with the weight of the evidence gathered during the investigation.
Why It Matters
UK mule networks increasingly blend traditional cash placement through retail and postal infrastructure with modern digital layering through cryptocurrency, rather than relying on either method alone.
Professional Lesson
Cash-based and crypto-based typologies are not mutually exclusive; detection strategies built around only one channel will miss the other half of the operation.
Case Study 4 (European Union): Coordinated International Enforcement Through EMMA
What Happened
Individual prosecutions address single networks; the European Money Mule Action (EMMA) targets the layer beneath them at scale. Coordinated annually since 2016 by Europol, Eurojust, the European Banking Federation and national police forces, EMMA brings together law enforcement and hundreds of financial institutions in a short, intensive operational window. In its seventh iteration, running across 27 countries plus partners in Asia, North America, Colombia and Australia, the operation identified more than 18,000 money mules, led to 1,803 arrests, and enabled financial institutions to prevent an estimated €67.5 million in losses. A later phase, EMMA 9, added a further 1,013 arrests across 26 countries.
Why It Matters
EMMA shows mule recruitment is industrialised at a scale individual prosecutions cannot address; only coordinated, multi-country, public-private action can disrupt supply at the volume networks now require.
Professional Lesson
Institutions participating in EMMA-style intelligence sharing consistently identify more mule accounts than those relying solely on internal data, underlining the value of cross-border collaboration.
Case Study 5 (United States): The Professionalisation of Mule-Based Laundering
What Happened
Not every mule scheme fits the classic profile of a single recruited individual. FinCEN's August 2025 advisory on Chinese money laundering networks describes organisations that combine money mule accounts with trade-based laundering and underground banking to move proceeds for drug trafficking organisations and fraud networks alike. Mules in these networks frequently misstate low-transaction occupations, such as student, homemaker or labourer, when opening accounts, use counterfeit identity documents supplied by the network, and in some cases are placed as complicit insiders inside financial institutions. FinCEN also documents structuring across multiple bank branches to avoid reporting thresholds.
Why It Matters
This pattern, echoed in the Financial Action Task Force's 2026 findings on underground banking and hawala-based laundering, shows mule infrastructure evolving into an outsourced, fee-for-service layer of organised crime.
Professional Lesson
Occupation-to-transaction-volume mismatch is a useful contextual red flag because it can be tested against information already collected during onboarding. It should be corroborated with transaction patterns, source-of-funds information and other relevant indicators before any adverse conclusion is reached.
Detection: Where Compliance Teams Can Intervene
Money mule activity can leave a recognisable signature across the account lifecycle when institutions combine onboarding data, transaction behaviour and context rather than relying on any single indicator. A genuine, previously unremarkable customer can become a mule account after onboarding, so static, one-off risk scoring is insufficient on its own. Ongoing behavioural monitoring is therefore an important complement to customer due diligence and account-opening controls.
 |
| Figure 3. Red-flag indicators across the mule-account lifecycle. Detection is strongest when account-opening, transactional and behavioural/contextual indicators are assessed together rather than in isolation. |
An indicator is not proof. A student receiving an unusual transfer, or an account with a burst of activity, may have a legitimate explanation; one red flag normally justifies further enquiry rather than an automatic conclusion of wrongdoing. Effective controls combine several signals rather than relying on any one rule. Practical measures, consistent with FinCEN's published red-flag guidance and the European Banking Authority's risk factor guidelines, include:
- Calibrating transaction-monitoring thresholds to flag rapid pass-through activity rather than absolute value alone.
- Cross-checking stated occupation and expected activity at onboarding against actual transaction volume.
- Screening for identity documents and application patterns consistent with known mule-recruitment typologies.
- Filing Suspicious Activity Reports promptly once mule indicators cluster, rather than waiting for a single conclusive signal.
- Coordinating with peer institutions and law enforcement, in the manner EMMA has demonstrated at international scale.
Why Cross-Border Coordination Now Matters More Than Ever
The jurisdictional handoff problem. A single fraud flow may pass through four distinct locations: victim jurisdiction → mule-account jurisdiction → conversion jurisdiction → beneficiary jurisdiction. Each handoff can introduce delay, fragmented evidence, different reporting rules and different legal powers. The practical challenge is therefore not only detecting the mule account, but preserving and sharing enough information quickly enough to follow the value across those handoffs.
The case studies above span three distinct legal systems, yet the underlying typology is almost identical: a recruited or coerced account holder, a chain of rapid transfers, and a consolidation point usually several jurisdictions removed from the original victim. The UK's Proceeds of Crime Act, the EU's AMLR and AMLA framework, and the US Bank Secrecy Act each give domestic authorities the tools to prosecute mule-account holders and organisers, but a network moving funds from a UK victim through an EU-based e-wallet to a US cash-out point can only be fully disrupted where these regimes interoperate. That is precisely the gap that operational mechanisms such as EMMA are designed to close. The direction of travel across all three jurisdictions is nonetheless the same: broader supervisory powers, faster information sharing, and a growing willingness to prosecute the mule-account layer as seriously as the fraud that generates its proceeds.
Practitioner Guide
When a suspected mule account is identified, investigators should look beyond the individual transaction or account and ask where the funds came from, where they moved next and what other accounts, counterparties or channels may form part of the same movement of value. Mule accounts function as infrastructure for receiving and dispersing fraud proceeds, so the investigative opportunity lies not only in identifying the account but in reconstructing the wider financial architecture around it.
Start by establishing the account's behavioural and transactional context. Examine onboarding information, account age, historical activity, changes in transaction volume or value, incoming payment sources, payment velocity, new beneficiaries, cash withdrawals, digital-payment activity and cryptocurrency exposure where relevant and lawfully available. Temporal sequencing is particularly important: a sequence of incoming victim payments followed by rapid dispersal, withdrawal or conversion may present a materially different investigative picture from the same activities occurring independently over a longer period.
Connections should then be examined across accounts and channels. Repeated beneficiaries, shared counterparties, common devices, addresses, telephone numbers, IP information or other identifiers may reveal relationships between accounts that initially appear unrelated. Investigators should consider whether funds converge on common destinations, pass repeatedly through the same intermediaries or move from conventional banking into cash, digital payments or cryptocurrency. Link analysis in money-laundering investigations provides a structured way to examine these relationships, reconstruct the wider financial network and test what the identified connections actually establish. These relationships can generate valuable investigative hypotheses, but association alone does not establish coordination, knowledge or criminal responsibility.
The investigator should also distinguish the movement of funds from the mule's state of knowledge. A single red flag is an indicator, not proof, and apparently suspicious behaviour may have competing explanations. Onboarding, transactional and behavioural information should therefore be assessed together, with relevant information sought to corroborate or refute the suspected explanation. Evidence that an account received and transferred fraud proceeds does not, by itself, resolve what the account holder knew, suspected or intended.
That distinction is particularly important across jurisdictions. Criminal exposure is offence- and jurisdiction-specific: relevant UK provisions may apply knowledge or suspicion tests, while US offences and EU and national frameworks can contain different legal elements. Investigators should therefore avoid treating unwitting, exploited, reckless and knowingly complicit mule activity as legally interchangeable. Cross-border cases should be assessed against the applicable legal and evidential framework rather than importing terminology or thresholds from another jurisdiction.
Finally, disruption should not necessarily end with closure of the first mule account identified. Where lawful information sharing and investigative powers permit, investigators and control owners should consider what the account reveals about recruitment channels, linked accounts, payment routes, conversion points and potential downstream beneficiaries. Confirmed cases and false positives should also feed back into detection controls so that recurring patterns can inform typologies, thresholds and investigative enrichment. The objective is not simply to remove one account from the system, but to understand and, where possible, disrupt the financial architecture that enabled the proceeds to move.
Conclusion
Money mule accounts function as connective infrastructure within the modern fraud economy, moving criminal proceeds across accounts, institutions and jurisdictions while leaving potentially significant traces in account-opening information, transaction behaviour and wider financial relationships. This matters because it reframes the mule account from a peripheral fraud-prevention concern into a core anti-money laundering challenge with direct regulatory, financial and reputational consequences for institutions across the UK, the EU and the US.
For compliance and investigations professionals, the practical implication is clear: mule-account detection cannot end at onboarding. Institutions need behavioural monitoring capable of identifying changes in account activity, stronger connections between fraud and AML intelligence, and mechanisms for escalating suspicious relationships across accounts rather than assessing transactions in isolation. Cross-border information sharing is equally important, particularly where recruitment, account operation, conversion and ultimate beneficiaries sit in different jurisdictions.
The response must also distinguish between the criminal networks controlling mule infrastructure and the individuals they recruit. Some account holders act knowingly, while others may be deceived, groomed or coerced. Effective intervention therefore requires both evidential discipline and appropriate safeguarding, rather than assuming that suspicious account behaviour alone establishes culpability.
The challenge now is to move intervention further upstream — from tracing criminal proceeds after they have dispersed to identifying and disrupting the mule infrastructure that makes their movement possible. For financial institutions, regulators and investigators, that means treating mule networks not simply as accounts to close, but as intelligence to exploit, networks to dismantle and channels of criminal finance to disrupt. The earlier that infrastructure is identified and interrupted, the less opportunity organised fraud networks have to convert successful fraud into usable criminal profit.
Methodology and Evidential Note
This article is a practitioner analysis of money mule activity and the financial infrastructure used to receive, move, disperse, withdraw and convert fraud proceeds. It draws primarily on legislation, regulatory and supervisory publications, government material, law-enforcement releases, prosecutorial records and international financial-crime guidance from the United Kingdom, European Union, United States and relevant cross-border institutions. These sources are used to examine documented mule typologies, recruitment methods, movement of funds, enforcement responses and the investigative opportunities created as fraud proceeds move through financial systems.
Examples and enforcement cases were selected to illustrate different manifestations of mule-account activity and institutional responses rather than to establish the prevalence of a particular typology. A prosecution involving cryptocurrency, fabricated identities, cash withdrawal or a particular recruitment method does not demonstrate that the same characteristics are representative of the wider mule economy. Similarly, differences in the number or type of publicly reported enforcement actions between jurisdictions should not be interpreted as direct measures of the relative scale of money-mule activity in those jurisdictions.
The article distinguishes between the movement of suspected fraud proceeds and the knowledge, suspicion, intention or other mental element that may be required to establish a particular offence. Evidence that an account received, transferred, withdrew or converted fraud proceeds may be highly relevant to an investigation, but it does not automatically establish what the account holder knew or intended. References to unwitting, exploited, recruited or complicit mules are therefore analytical descriptions of potentially different circumstances and should not be treated as interchangeable legal classifications.
Legal rules and enforcement frameworks are considered within their respective jurisdictions. UK legislation and policy, EU legislation and coordinated enforcement activity, and US statutory, regulatory and prosecutorial approaches may address overlapping conduct while applying different legal tests, institutional responsibilities and evidential requirements. The article therefore does not assume that terminology, criminal-liability thresholds or enforcement approaches in one jurisdiction can be transferred directly to another. Readers should consider the applicable legislation, case law, regulatory requirements and organisational procedures when assessing a specific matter.
The article also distinguishes indicators and network associations from evidential conclusions. Rapid movement of funds, unusual payment velocity, multiple incoming payments, common beneficiaries, shared identifiers, cash withdrawals, cryptocurrency conversion or other behavioural characteristics may justify further enquiry without independently proving money-mule activity or knowing participation in fraud or money laundering. Their investigative significance depends on context, provenance, data quality, temporal sequencing, corroboration and the availability of credible alternative explanations.
Network relationships are treated with the same caution. A shared beneficiary, device, address, telephone number, account, digital identifier or transaction pathway may connect apparently separate activity and generate an investigative hypothesis. It does not, without further evidence, establish coordination, control or common criminal purpose. Where several indicators arise from the same underlying transaction, dataset or source, they should not automatically be treated as independent corroboration merely because they appear as separate analytical signals.
Cross-border and cross-institutional analysis in the article reflects the fragmented nature of the financial trail. A victim, receiving account, intermediary mule, cash-out point, cryptocurrency conversion point and ultimate beneficiary may be located across different institutions or jurisdictions, meaning that no single organisation necessarily holds a complete view of the movement of funds. References to information and intelligence sharing therefore describe an important investigative and disruption capability, but any sharing must take place within the applicable legal, regulatory, data-protection and organisational framework.
Any original Fraud Intelligence Lab analytical proposition, framework or visual presented in the article is intended to support practitioner understanding of the mule economy and the movement of fraud proceeds. Unless expressly identified otherwise, it should not be interpreted as a statutory test, regulator-issued methodology, legal definition or law-enforcement investigative standard. Illustrative figures that synthesise the article's analysis should likewise be distinguished from formal analytical models and from diagrams reproduced or adapted from external sources.
Finally, the article treats disruption as broader than the identification or closure of an individual mule account. Tracing upstream sources, downstream beneficiaries, linked accounts, recurring counterparties, recruitment mechanisms and conversion points may reveal elements of the wider infrastructure supporting the movement of fraud proceeds. The methodological principle underpinning the analysis is therefore that a mule indicator generates an investigative question; corroborated transactional, behavioural and network information can strengthen or weaken the resulting hypothesis; and any conclusion about participation, knowledge or criminal responsibility should go no further than the applicable evidence and legal framework can support.
References and Further Reading
- Financial Crimes Enforcement Network. (2025). Advisory on the Activities of Chinese Money Laundering Networks (FinCEN-Advisory-CMLN-508). U.S. Department of the Treasury.
- Financial Crimes Enforcement Network. (2020). Advisory on Imposter Scams and Money Mule Schemes Related to Coronavirus Disease 2019 (COVID-19) (FIN-2020-A003).
- United States Attorney's Office, Western District of North Carolina. (2022). Money Mule Involved in a Business Email Compromise Scheme Is Sentenced to 13 Years in Prison. U.S. Department of Justice.
- United States Attorney's Office, Eastern District of Virginia. Two Men Sentenced for Laundering Proceeds of a Business Email Compromise Scheme. U.S. Department of Justice.
- Europol. (2021). European Money Mule Action Leads to 1,803 Arrests.
- Europol. (2023). Global Operation Targets Money Mules (EMMA 9), as reported by the Organized Crime and Corruption Reporting Project.
- Official Journal of the European Union. (2024). Regulation (EU) 2024/1620 Establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA).
- European Parliament Legislative Observatory. (2024). Anti-Money Laundering Authority (AMLA), Procedure 2021/0240(COD).
- UK Government / Home Office. (2024). Money Mule and Financial Exploitation Action Plan; Biggest Ever Crackdown on Money Mules in the UK.
- National Crime Agency (UK). Money Mules — Don't Be Used.
- Crown Prosecution Service (UK). (2025). Economic Crime Strategy 2025 — Final Progress Report.
- Leicestershire Police (UK). (2025). Detectives Uncover Major Money Laundering Operation (Operation Kilo).
- UK Finance. (2026). Annual Fraud Report 2026; Fraud Remains a National Security Threat as Criminals Steal Almost £1.3 Billion.
- Financial Action Task Force. (2018). Professional Money Laundering.
- Financial Action Task Force. (2026). Investigating Professional Money Laundering, Underground Banking, and the Use of HOSSPs.
