Traditional anti-money-laundering reporting may be too slow to stop the proceeds of industrialised online scams that can pass through mule accounts, payment systems, and virtual asset wallets within minutes, the Financial Action Task Force (FATF) has warned.
The FATF uses “scam compounds” as an umbrella term for these criminal operations. Although the term is associated with large, controlled sites where trafficked or coerced workers may be forced to defraud people online, the FATF uses it more broadly. It also covers smaller or dispersed cells and specialist service providers connected through common controllers, technology, financial infrastructure, and operational dependencies.
In its new report, Combating End-to-End Illicit Financial Flows Linked to Scam Compounds, published on 5 November 2026, the FATF calls for conventional suspicious transaction reporting to be supplemented by faster fraud-detection and intervention mechanisms.
Its recommendations point to closer information sharing among financial institutions, virtual asset service providers, telecommunications companies, technology platforms, and public authorities. They also place greater emphasis on disrupting criminal networks before victims pay or before the proceeds can be moved beyond recovery.
Victims on both sides of the scam
The best-documented scam-compound model involves people recruited through fraudulent job advertisements and trafficked into controlled physical sites, particularly in Southeast Asia. Recruits may be promised legitimate work, including purportedly well-paid customer-service or IT jobs, before being transported across borders and forced to conduct online scams.
The FATF says people working under coercion may be subjected to debt bondage, document confiscation, confinement, threats, violence, torture, or sexual exploitation. Criminal groups may also impose targets and punish workers who fail to generate enough money from victims.
This creates two categories of victims: the people defrauded online and the people trafficked or coerced into carrying out the scams.
However, the physical compound is only one manifestation of the criminal business model. Large operations may occupy or repurpose casinos, hotels, former online gambling facilities, and other commercial premises. The FATF says enforcement pressure has also caused some networks to fragment into smaller operations using rented rooms, apartments, coffee shops, and moving vehicles.
Scam operations may also outsource key functions to specialist service providers. These functions can include recruitment, advertising, victim profiling, telecommunications, fraudulent online platforms, the provision of bank and virtual asset accounts, payment collection, virtual asset conversion, and money laundering.
How the proceeds move
Scam-compound networks operate as criminal businesses. They incur operating costs, generate revenue from victims, move and conceal the proceeds, and reinvest some of their profits to maintain or expand their activities.
Victims may be induced to pay into bank accounts, payment applications, digital wallets, or virtual asset wallets. Mule accounts provide an important link between the initial payment and the subsequent laundering of the proceeds. Funds can then be distributed among multiple accounts, converted into virtual assets, transferred across borders, or passed through informal and professional laundering networks.
The accounts may be held in the names of individuals or companies. Some are obtained through recruited money mules, while others may be opened using stolen or fraudulently obtained identities. Professional laundering providers can supply accounts, wallets, payment gateways, underground banking arrangements, virtual asset conversion, and cash-out services.
The FATF identifies virtual assets as a central laundering channel. In some cases, dedicated over-the-counter counters have operated inside scam compounds to facilitate virtual asset exchange and domestic fund transfers.
In a case study included in the report, Chainalysis said identifying information supplied through its partnership with the International Justice Mission was used to analyse virtual asset wallets attributed to the KK Park scam compound. Chainalysis mapped more than US$100 million in victim inflows to the associated wallet cluster and traced the funds through laundering layers towards cash-out points.
The FATF cautions that wallet attribution should be supported by transparent methodologies and corroborated with information from outside the blockchain.
The proceeds may eventually be invested in property, businesses, or other assets. Some of the money is also recycled into recruitment, telecommunications, fraudulent advertising, technology, corruption, money laundering, and other infrastructure needed to continue the scams.
Reporting remains important, but may come too late
The FATF does not argue that suspicious transaction reports should be abandoned. They remain an important source of financial intelligence and can help authorities to identify connected transactions, accounts, individuals, companies, and criminal networks.
The problem is that suspicious transaction reporting was not designed primarily as a real-time fraud-intervention mechanism.
The FATF says instant payments, wallet-to-wallet transfers, and virtual asset transfers can move funds onwards within minutes. In some reported cases, the funds were moved within two minutes of the victim’s payment.
The proceeds may pass through several mule accounts, institutions, asset types, and jurisdictions before a suspicious transaction report is filed, analysed, and connected with other available intelligence.
A response that depends mainly on victim complaints and post-event reporting is therefore unlikely to keep pace with financial flows moving through accounts, virtual assets, and cross-border channels within minutes or hours. The FATF says reporting should be complemented by faster preventive and operational mechanisms capable of delaying or rejecting suspicious payments, restricting access to accounts or wallets, and preserving assets before the proceeds disappear.
The FATF’s operational framework identifies opportunities for upstream intervention, action during the payment window, and downstream disruption and recovery.
Upstream intervention seeks to identify and disrupt a scam before the victim pays. Relevant indicators may include fraudulent advertisements, malicious domains, suspicious recruitment activity, telephone numbers associated with scams, and telecommunications data.
Before payment, institutions may use beneficiary checks, tailored warnings, enhanced verification, transaction limits, cooling-off periods, temporary holds, delays, or rejection where warranted. These controls should be risk-based, proportionate, and supported by the relevant legal and regulatory framework.
Once a payment has been made, rapid-response arrangements may support recalls, restrictions on accounts or wallets, tracing, and asset-preservation measures. Downstream action can also include identifying connected infrastructure, investigating the broader network, recovering victims’ funds, and prosecuting those responsible.
Speed is critical. The FATF says the first 24 to 72 hours after a scam is detected or reported are particularly important for identifying and preserving funds. The opportunities to locate and recover linked assets may be significantly reduced after a week.
No institution sees the full network
Scam compounds depend on financial and non-financial infrastructure spread across different sectors and jurisdictions. This means the information needed to identify the full network is unlikely to be held by one institution.
A bank may see linked accounts, common beneficiaries, unusual payment patterns, or repeated transfers associated with known fraud. A virtual asset service provider may see the conversion and onward movement of the proceeds. A telecommunications company may detect suspicious telephone numbers, device or call patterns, bulk-SIM activity, or indicators associated with SIM-farm infrastructure. Technology companies may identify fraudulent advertisements, fake profiles, malicious domains, or accounts under common control.
Public authorities may hold additional information connecting these indicators to trafficking networks, company structures, organised criminal groups, corrupt facilitators, or previously identified laundering operations.
The FATF says no single actor sees the complete attack and financial-flow chain. It therefore calls for the partial views held by financial institutions, virtual asset service providers, technology and telecommunications companies, financial consumer protection authorities, financial intelligence bodies, law-enforcement agencies, and civil-society organisations to be connected.
The report supports clearer legal gateways for information sharing, public-private partnerships, shared fraud-data systems, and rapid-response networks. It also says domestic co-ordination should connect AML/CFT authorities with bodies responsible for fraud, financial consumer protection, cybercrime, human trafficking, corruption, financial intelligence, supervision, law enforcement, and asset recovery.
South African networks may not resemble conventional compounds
The report contains two examples that demonstrate the issue’s relevance to South Africa.
Research by the Global Initiative Against Transnational Organized Crime, cited in the FATF report, describes Nigerian confraternity-based criminal networks operating small, highly networked scam cells in South Africa. These cells reportedly comprise up to six people operating from houses, hotel rooms, and apartments.
According to the cited research, the micro-cells share technology, expertise, and resources within wider collaborative networks. This enables the networks to conduct scams on an industrial scale without the visible footprint of a large physical compound.
A second example concerns co-operation among law-enforcement agencies, financial institutions, and telecommunications providers.
An anonymised member of the Institute of International Finance reported that co-ordinated action by South African and international law-enforcement agencies, banks, and mobile-network operators disrupted seven SIM-farm operations and three rogue call-centre syndicates. Interventions against three of the call centres reportedly resulted in 65 arrests.
The recurring infrastructure reportedly included bulk-messaging platforms, GSM routers, large volumes of SIM cards, and outbound-calling systems.
Implications for accountable institutions
The report does not, in itself, create new legal obligations for South African accountable institutions. It applies the existing FATF framework to scam-compound risks and says responses should be targeted, proportionate, and based on each jurisdiction’s exposure and role in the wider criminal ecosystem.
Its practical direction is nevertheless relevant to how institutions organise their fraud and AML controls.
The FATF says fraud-prevention and AML or financial-crime functions should work together through intra-institutional data flows, compatible classifications, and escalation pathways.
The report also points to the importance of connecting apparently isolated victim payments with mule accounts, common beneficiaries, devices, wallets, corporate structures, and other identifiers. Monitoring only the account from which a victim sends money may provide an incomplete picture. The receiving accounts, subsequent transfers, linked beneficiaries, and cash-out points may reveal the broader network.
The FATF cautions against treating the closure of an individual account or the termination of a customer relationship as disruption of the wider laundering network. Before or alongside closure, institutions may need to preserve intelligence and consider tracing, restrictions, payment holds, or other asset-preservation measures.
Closing one mule account may displace the activity without identifying connected accounts, tracing the proceeds, or disrupting the people and infrastructure controlling the network.
The report does not diminish the importance of suspicious transaction reporting. Its warning is that reporting after the event cannot, on its own, keep pace with criminal networks capable of moving and converting victims’ money within minutes.
Effective intervention may have to begin before the transaction, continue during the narrow payment window, and extend beyond the individual account. It also depends on financial institutions, technology platforms, telecommunications providers, and public authorities connecting information that none of them holds in full.
