Money Mules at EMIs: What the FCA Now Expects

The FCA has told payments and e-money firms, in two documents five weeks apart, that money mules are now their problem as much as the banks'. Its 23 September 2026 multi-firm review found that e-money institutions had the steepest rise in suspected mule offboarding of any firm type: up 164.6% in 2025. On 23 October 2026 it followed with consultation paper CP26/38, a rewrite of the Financial Crime Guide that names monitoring outbound payments only as poor practice and expects firms to watch money coming in. The Guide creates no new rules. It does show what the FCA expects to see, and it lands just as the PSR prepares to revisit APP fraud reimbursement in December.

This article covers what the FCA found, what the draft guidance asks of EMIs and PIs, what mules cost a receiving firm under the APP reimbursement rules, and what to change before the consultation closes on 24 December 2026.

What the FCA published, and why it matters now

Two publications set the agenda:

• The money mule review (23 September 2026). The FCA surveyed 35 retail banks, building societies, challenger banks, PIs and EMIs about suspected mule accounts from 2023 to 2025. It also ran a public/private "cell" with 22 regulated firms that traced the highest-value payments in 140 cases, across 7 fraud types, from account to account until the money could no longer be followed.
• CP26/38, Financial Crime Guide updates (23 October 2026). The consultation proposes changes to the fraud, sanctions, proliferation financing, data security, systems and controls and AML chapters, plus new material for cryptoasset firms ahead of the authorisation regime that starts on 25 October 2027. Feedback is due by 24 December 2026; the final text will follow in a policy statement.

The FCA is explicit that the Guide "does not contain rules nor impose any new requirements". It also says it expects firms to consider it, and the CP (paragraph 2.2) says the fraud material comes from its assessment of APP fraud and mule controls at payment service providers, "including retail banks, and payments and e-money firms". Departing from the Guide does not, of itself, breach FCA rules (the CP says so in Annex 2), but its good and poor practice examples show how the FCA assesses systems and controls, so an unexplained gap against them is hard to defend in a supervisory review.

For EMIs and PIs there is one extra hook. The draft fraud chapter reminds readers that e-money and payment institutions must satisfy the FCA that they have robust governance, effective risk procedures and adequate internal control mechanisms (regulation 6 of the EMRs 2011 and of the PSRs 2017). That is a condition of authorisation, not a matter of style.

Why EMIs are in the frame: the numbers

The survey figures are the FCA's own, and they explain the regulator's focus:

Two caveats from the FCA itself. First, rising offboarding at EMIs, PIs and challenger banks "doesn't necessarily mean mules are making up a higher proportion of their business"; it may reflect customer growth and better detection. Second, filing to the Cifas National Fraud Database needs "clear, relevant and rigorous evidence", a higher bar than closing an account, so filings will always trail closures.

Even so, the pattern is hard to miss. EMIs had the fastest-growing offboarding numbers yet filed 105 cases to the shared database in 2025. Three in four of the EMI accounts closed were less than six months old, so the typical mule passed onboarding, was used, and was caught afterwards. Both points line up with what CP26/38 calls poor practice.

How a mule chain moves money

The cell's tracing work is the most useful part of the review for anyone designing controls. Criminals usually cashed out between the second and fifth mule account, with the highest concentration at the second. By then the money had been split into smaller payments. Card payments were the most common cash-out method, because they look like ordinary spending. International and crypto cash-outs were typically higher in value, though crypto was used less often. Non-retail firms saw lower volumes but higher-value transactions than retail banks. Some accounts had been used repeatedly across different fraud types, which the FCA reads as organised infrastructure rather than opportunistic misuse.

How an APP fraud payment moves through mule accounts

1. A fraudster persuades the victim to send money. The sending PSP can warn, check the payee name and, with reasonable grounds to suspect fraud, delay the payment up to the end of D+4.
2. The payment lands in the first mule account. This is the receiving firm's best chance: the FCA found cash-out was most concentrated at the second account in the chain.
3. Funds are split and moved on through further accounts, then cashed out by card spending, ATMs, crypto or international transfers.
4. The sending PSP reimburses the victim and can claim 50% of the in-scope cost from the receiving PSP.
5. Inbound monitoring at the receiving firm raises alerts; confirmed cases go to fraud databases and peers so the next firm can stop the network earlier.

Simplified from the FCA's September 2026 mule review and the PSR reimbursement rules. Real chains vary in length and route.

The design point is simple. The receiving firm sees the money before it splits. Every hop after that makes the funds harder to trace, so a control that only looks at what customers send is looking at the wrong end of the account.

What CP26/38 changes in the fraud chapter

The draft rewrites Chapter 4 of the Guide around APP fraud and money mules and sorts the material into onboarding, monitoring and reporting. It folds the separate investment fraud section into APP fraud as one typology and absorbs four earlier FCA publications, including the 2023 work on detecting and preventing money mules.

Onboarding

Good practice is a "holistic view of the customer" that informs an assessment of mule risk, not just identity. The draft lists customer profile indicators (age, gender, location, employment status, income sources, expected turnover) and digital ones (device identifiers, IP addresses, geolocation, biometric data). Firms should also use industry fraud databases at onboarding and afterwards, and act on what they find.

Two poor practice examples matter for fast-growing EMIs. One is doing too few checks to understand expected behaviour, which can then drive up false positive alerts. The other cuts the opposite way: declining business across the board because of a historic database marker, "without considering the wider context of the customer's profile". The FCA wants judgement, not a blunt filter, which matters given its wider focus on fair access and the Consumer Duty.

Monitoring

This is where most EMIs will find gaps. The draft lists mule indicators, including:

• unexpected or unexplained deposits;
• changes in expected account turnover;
• rapid dispersal of funds through networks of accounts, "often within minutes of receipt";
• movement of funds abroad and rapid ATM withdrawals;
• changes in dormant accounts;
• changed online banking credentials, new devices or contact details that do not fit what the firm knows, "potentially indicating that accounts have been sold after opening".

Good practice includes monitoring inbound and outbound transactions; checking whether more than one customer uses the same device, whether access comes from locations other than those seen at onboarding, and whether "virtual addresses" are used without a valid explanation; looking beyond the first receiving account to linked accounts; investigating alerts promptly with trained, properly resourced teams; and written policies for responding to suspected and confirmed mules (offboarding, restrictions, or enhanced monitoring where the relationship is kept).

Poor practice includes focusing on outbound monitoring "with no, or limited, consideration of inbound transactions"; not testing and calibrating thresholds, or taking too long to change them; closing alerts without feeding lessons back into rules; and relying on machine learning tools that are not properly joined up with the rest of the firm's controls.

Reporting

The draft separates three things that firms often blur: suspicious activity reports to the NCA, which remain a legal duty for the nominated officer; reporting fraud to Report Fraud or law enforcement; and contributing to industry databases and data-sharing schemes. Good practice is assessing mule cases individually and promptly reporting all relevant ones to the database you use. Poor practice includes using a shared database to check customers while failing to upload your own confirmed mule cases on time, failing to keep records of decisions to file or not to file, and failing to act quickly on intelligence from peers or law enforcement.

Inbound monitoring: the change most EMIs will feel

Fraud monitoring at many payment firms grew up around what customers send. The FCA now treats that design as incomplete. Practically, inbound monitoring needs three things that outbound rules often lack:

1. A baseline per customer. "Unexpected deposits" only means something against an expected turnover recorded at onboarding. If your onboarding flow never asks what the account is for and how much will move through it, your monitoring has nothing to compare against.
2. Velocity across the in-and-out pair. The signature mule pattern is money in, money out, fast. A rule that looks at inbound credits and outbound debits separately will miss it.
3. Device and access signals linked to the ledger. Account resale shows up as a new device, new credentials or a new location shortly before an unusual inbound payment. Those signals usually live in a different system from the payment data.

Be clear about what the law lets you do with a suspicious inbound payment. The 2024 amendment to regulation 86 of the PSRs 2017 lets the payer's PSP delay an outbound sterling payment within the UK up to the end of the fourth business day after receipt (D+4) where it has reasonable grounds to suspect fraud, established by the end of D+1. It does not give the receiving firm a matching power. For inbound funds, the FCA's FG24/6 sets out its view of the force majeure provision in regulation 96(2): a PSP is not liable for breaching execution timescales, for example by delaying making incoming funds available, where it has to do so to comply with other law, including financial crime law. Where and how that applies is a question for your MLRO and counsel, case by case.

What a mule account costs you: the receiving-side bill

Since 7 October 2024, the PSR's reimbursement rules for Faster Payments and CHAPS have put the cost of APP fraud on both ends of the payment. Once the sending PSP has reimbursed its customer, it can ask the receiving PSP for 50% (paragraph 5.12 of Specific Requirement 1 for Faster Payments; the Bank of England's CHAPS rules mirror it). The cap is £85,000 per claim. The consolidated policy statement PS25/5 says the 50:50 split is calculated on the assumption that the £100 maximum excess was applied, whether or not the sending firm actually charged it.

So each mule account that receives an in-scope APP fraud payment becomes a liability for the firm that opened it. The calculator below gives a rough idea of the scale.

Your receiving-side APP reimbursement exposure

Reimbursed APP claims landing in your customers' accounts per month(claims)

Average APP scam loss per claim (before any excess)(GBP)

Share of these claims earlier inbound detection would stop(%)

Your share per claim

£1,200.00

Monthly receiving-side liability

£24,000.00

Annual receiving-side liability

£288,000.00

Annual liability avoided by earlier detection

£57,600.00

Based on PSR Specific Requirement 1 para 5.12 and PS25/5 (50:50 split on the assumption of a £100 excess, £85,000 cap per claim). Excludes investigation costs, multiple receiving PSPs, repatriation and voluntary reimbursements, which receiving PSPs do not share.

Illustrative estimate. Assumes one receiving PSP per claim, full reimbursement by the sending PSP and no repatriated funds.

With the defaults, 20 claims a month at £2,500 each costs a receiving firm £24,000 a month, or £288,000 a year, before staff time. A fifth fewer mule-routed claims saves about £58,000 a year. These are illustrative figures, not market data, but they show how quickly receiving-side losses can outweigh the cost of better inbound controls.

The numbers may move. The PSR's APP scams policy roadmap plans a formal consultation in December 2026 on claims that cannot be resolved within 35 business days, "returns from investment", the consumer standard of caution, civil disputes and me-to-me payments, with a decision and revised legal directions in May 2027 and implementation within six months. The roadmap does not list the £85,000 cap or the 50:50 split among the consultation topics. Separately, the government plans to fold the PSR into the FCA through the Financial Services and Markets Bill, which Bratby Law reported was awaiting second reading in the Commons as at 7 October 2026.

Sharing data without breaching confidence

The review and the CP both push information sharing, and the FCA points firms to the information-sharing provisions in sections 188 and 189 of the Economic Crime and Corporate Transparency Act 2023, in force since 15 January 2024.

• Direct sharing (section 188) between firms in the AML-regulated sector removes liability for breach of confidence and civil liability to the customer, if either the request condition (the other firm asked, with reason to believe you hold relevant information) or the warning condition (you have decided to take safeguarding action, such as exiting or restricting the customer, because of economic crime concerns) is met.
• Indirect sharing (section 189) through a third-party intermediary is available to a narrower group that includes deposit-takers, EMIs and PIs, according to the government's ECCTA factsheet.

The protections are civil only. They do not override UK GDPR, they do not authorise sharing for commercial reasons, and the draft Guide warns against using shared data to exclude customers inappropriately. Tipping-off risk under POCA still applies. Sharing does not replace SARs. A firm that plans to rely on these sections will find it easier to evidence its position with a written decision path showing which condition applied and why, agreed with its MLRO and legal advisers.

Third-party tools, AI and BaaS: you still own the control

Three proposals affect firms that buy rather than build their financial crime stack, which is most EMIs:

• Explainability. Draft FCG 3.2.5 lists as poor practice using third-party technology "and is unable to explain or evidence the basis for findings made or scoring applied". Paragraph 2.27 of the CP says AI and other third-party tools must be governed, proportionate to the firm's risk profile and "subject to testing and validation". If your vendor's mule score is a black box, that is now your problem.
• Banking-as-a-service and embedded finance. The CP (paragraph 2.26) proposes guidance on how financial crime obligations apply where the BaaS user is regulated or unregulated, and says regulated firms "are accountable for maintaining effective systems and controls across the delivery chain", including where activities are outsourced, white-labelled or embedded. For an EMI that issues accounts behind a partner's brand, the partner's onboarding is your onboarding.
• Sanctions screening settings. The rewritten sanctions chapter asks whether firms using screening tools with "limited oversight of vendor-implemented settings" have assessed whether that could undermine compliance. Good practice is documenting calibration decisions such as the lists used, suppression rules and fuzzy matching thresholds.

These sit on top of the FCA's existing outsourcing notification duties for authorised EMIs and PIs, which we covered in our guide to outsourcing and vendor rules under DORA, the EBA and the FCA.

If you also hold an EU licence

CP26/38 is UK guidance, but the direction of travel is the same in the EU. The AML Regulation applies from 10 July 2027, and AMLA's draft customer due diligence standards describe how onboarding information should feed ongoing monitoring (see our AMLA CDD guide). PSD3 moved a step closer on 23 October 2026, when the Council published its first-reading position on the directive. Our PSD3 and PSR explainer covers the fraud liability and data-sharing changes in the accompanying Regulation. A group that builds inbound mule monitoring once, on shared data, will meet both regimes more cheaply than one that runs two programmes.

A practical plan before 24 December

Money mule controls: gap check against CP26/38

• Expected turnover and account purpose captured at onboarding

  Without a baseline, 'unexpected deposits' cannot be detected.

• Inbound transaction rules live, not only outbound

  Including fast in-and-out velocity and changes in dormant accounts.

• Device, IP and credential changes linked to payment monitoring

  Shared devices across customers and new devices before unusual credits are classic resale signals.

• Linked accounts reviewed when one account alerts

  The FCA expects firms to look beyond the initial receiving account.

• Thresholds tested and recalibrated on a set cadence

  Record how long it takes to deploy a new rule; slow change is listed as poor practice.

• Written response policy for suspected and confirmed mules

  Offboarding, restrictions or enhanced monitoring, with the legal basis for any delay recorded.

• Confirmed cases uploaded to your fraud database on time

  Keep records of every decision to file or not to file.

• ECCTA sharing decisions documented

  Which condition was met (request or warning), who approved, and the UK GDPR check.

• Vendor scores and screening settings explainable

  You can show how a third-party mule or sanctions score is produced and how it was tested.

• Receiving-side APP reimbursement losses reported to the board

  Track claims where your customer was the payee, and trend them against onboarding cohorts.

Based on the draft good and poor practice examples in FCA CP26/38 (Appendix 1, FCG 4.2.1J to 4.2.1L). Progress is saved on this device.

Most of these items are data problems, not policy problems. The CP keeps returning to joined-up information: onboarding data feeding monitoring, monitoring feeding databases, and alerts feeding rule changes. Firms whose KYC, transaction monitoring and case management sit in separate tools that do not share a customer record will find this hardest. That is the design idea behind compliance built into the banking stack.

Consider responding to the consultation, too. The FCA asks whether its drafting is right and which chapters of the Guide need work next. A firm that sees mule activity from the receiving end knows which indicators are workable at its scale, and that view is worth putting on record.

This article explains published guidance and draft guidance; it is not legal advice. Confirm how the rules apply to your business with your MLRO, legal advisers or the FCA.

Our view

The FCA has done EMIs a favour by being specific. Mules are opening accounts at e-money firms, getting through onboarding and being caught months later, after the money has gone. Under the 50:50 reimbursement split, the receiving firm pays half of each in-scope claim. The draft Guide reads as a description of what a competent receiving firm already does: know what normal looks like for each customer, watch money coming in as closely as money going out, and give back to the shared databases it draws on.

The firms that struggle will not be the ones with weak policies. They will be the ones whose onboarding data, device signals, ledger and alerts sit in different systems that cannot answer one question: does this inbound payment fit this customer? Fixing that is engineering work, and it is worth starting before the PSR's December consultation and the FCA's final Guide arrive.

Fyora's platform keeps the client portal, back office (KYC, KYT, risk scoring, audit log) and integrations hub on one customer and ledger record, and our custom development team builds the jurisdiction-specific pieces around it. See how firms use it on our solutions page, or tell us what you're building.

FAQ

Is the FCA Financial Crime Guide binding on EMIs and payment institutions?

No. The FCA says the Guide contains no rules and imposes no new requirements. It does expect firms to have read and considered it. Departing from it is not of itself a breach, but its examples show how the FCA views adequate systems and controls, which for EMIs and PIs are a condition of authorisation under regulation 6 of the EMRs 2011 and PSRs 2017.

When does the CP26/38 consultation close?

Feedback is due by 24 December 2026. The FCA will then publish feedback and the final Guide text in a policy statement; it has not given a date for that.

How much does a mule account cost the receiving firm under APP reimbursement?

For in-scope Faster Payments and CHAPS claims, the sending PSP reimburses the victim and can then claim 50% from the receiving PSP. The split is calculated as if the £100 maximum excess had been applied, and the reimbursement cap is £85,000 per claim.

Can a receiving EMI delay a suspicious inbound payment?

The 2024 change to regulation 86 of the PSRs 2017 lets the payer's PSP delay outbound payments up to D+4. For inbound funds, FCA guidance FG24/6 explains that the force majeure provision in regulation 96(2) removes liability for breaching execution timescales where a PSP must delay to comply with other law, such as financial crime law. Whether it applies is a case-by-case question for the MLRO and counsel.

Can UK payment firms share information about suspected mules with each other?

Yes, voluntarily. Sections 188 and 189 of the Economic Crime and Corporate Transparency Act 2023, in force since 15 January 2024, remove liability for breach of confidence and civil liability to the customer for qualifying disclosures, directly or via an intermediary. UK GDPR still applies and the sharing does not replace SARs.

Sources

1. FCA: Money mules: mule activity and cashing out findings (23 September 2026)
2. FCA: CP26/38 Financial Crime Guide updates (23 October 2026)
3. FCA: CP26/38 consultation paper (PDF)
4. FCA: Proceeds of fraud – detecting and preventing money mules
5. FCA: FG24/6 Guidance for firms that enables a risk-based approach to payments (PDF)
6. PSR: Specific Requirement 1 (FPS APP scam reimbursement rules, July 2024)
7. PSR: PS25/5 APP scams reimbursement requirement, consolidated policy statement (May 2025)
8. PSR: APP scams policy roadmap
9. Economic Crime and Corporate Transparency Act 2023, section 188
10. GOV.UK: Economic Crime and Corporate Transparency Act information sharing measures factsheet
11. Bratby Law: Modernising Payment Services Regulation and the RPIB
12. Global Regulation Tomorrow (Norton Rose Fulbright): October 2026 – PSD3 Council first reading position