Where Fraud Ends and Money Laundering Begins: Why Fraud and AML Teams Need to Talk

Where does fraud end and money laundering begin?

Fraud is deception used to get money or cause a loss. Money laundering is what happens to that money afterwards: moving it, splitting it and disguising it so nobody can trace it back. Fraud is one of the crimes that feed laundering, a predicate offense, so a single payment can carry both.

The law draws the line at the money itself. In the UK, any crime can produce criminal property, because POCA s340 only asks whether the conduct is an offense somewhere in the UK. Every fraud qualifies. In the US, the main fraud statutes are listed among the crimes that make laundering possible (18 U.S.C. 1956(c)(7) and 1961(1)).

In practice, the line I watch is the first outbound transfer. Until the money leaves the victim's account, it is my case as a fraud analyst. Once it lands in another account and starts moving again, it is already a laundering problem, whether anyone has called it that yet or not.

Why do the two teams see the same payment differently?

Take a common case. A caller posing as the bank persuades a customer to move savings to a "safe account". That account belongs to a money mule, a person who moves proceeds for someone else. The UK's national risk assessment of 2025 names retail bank accounts and money mules among the usual routes.

At the victim's bank, the fraud team wants to stop the payment and call the customer. At the bank holding the mule account, the AML analyst watches the funds come in and go straight back out, and the question there is whether to file a report. Both teams are right, and they are working on the same money from opposite ends.

Their duties pull in different directions too. Under 31 CFR 1020.320, a US bank must report a suspicious transaction of $5,000 or more once it has reason to suspect the funds are illegal. It may not tell anyone involved that the report was filed (31 U.S.C. 5318(g)(2)). The UK punishes tipping off with up to two years in prison (POCA s333A). The fraud side's first instinct is to phone the customer. In a shared case, that call has to be agreed with the AML side first.

Table 1. One payment, two teams

The table is not a list of who is right. It is a list of what each team cannot see from its own seat.

Where does the hand off break?

In the banks and payment companies I have worked in, the break rarely comes from bad intent. It comes from three gaps.

• The fraud case closes, the money trail does not. A fraud case is closed when the loss is stopped or refunded. The accounts that received the money are still open, and the AML team often never hears about them.
• Each team holds half the signal. Fraud sees the device, the session and the social engineering. AML sees the account turnover, the counterparties and the pattern over weeks. A mule account can look clean to each team alone.
• Nobody owns the customer contact. Fraud wants to call now. AML may need silence. Without an agreed rule, one of them gets it wrong.

The mule accounts I worked on most often looked ordinary for weeks, then received several incoming payments from unrelated people within a day and sent them out almost at once.

The fix was never a new system on day one. It was a weekly half hour where the fraud lead and the AML lead went through every account both teams had touched.

Which signals should fraud pass to AML?

A fraud team sees signals that an AML team will only find weeks later, if at all. These are the ones I would pass across the same day, because each points at the receiving account rather than at the victim:

• A new payee added during or right after a phone call. Social engineering leaves a trace on the sending side. The payee account on the other end is the lead.
• Several unrelated senders paying one account in a short window. One victim is a fraud case. Five victims paying the same account is a laundering pattern.
• Money out almost as soon as it lands. An account that keeps nothing and forwards everything within hours is doing someone else's work.
• A quiet account that suddenly turns busy. Mule accounts are often older accounts, recruited after months of ordinary use, so account age alone proves little.
• The same device or contact details behind different customers. Fraud tools see device and session data that AML monitoring usually does not.
• Cash out through crypto or cash withdrawals. The last hop often leaves the regulated payment system altogether. When money leaves through crypto, a quick look with a crypto wallet risk check shows whether the destination wallet carries known risk.

None of these signals proves laundering on its own. Together, and passed on early, they give the AML analyst a head start that no monthly review can match.

How should a shared mule case run?

This is the sequence I would want in any bank or payment company, written as one case moving between two desks.

1. The fraud alert fires. A customer sends an unusual payment to a new payee after a phone call. The fraud analyst holds the payment and opens a case.
2. The receiving account goes to AML the same day. The fraud analyst records the payee account, the amount and the reason for the hold, and passes the account to the AML team as a lead. No customer contact has happened yet on the receiving side.
3. AML checks the account's history. The AML analyst looks at turnover, other incoming payments and the account holder's profile. In my experience, this is where a mule usually shows itself: several unrelated senders, money out within hours, no ordinary spending.
4. The two teams agree on contact. The fraud analyst calls the victim to stop the loss. Nobody contacts the receiving account holder until AML decides whether to report.
5. Each team makes its own decision. Fraud decides on the hold, the recall and any refund. AML decides on the report and on whether to keep the account open.
6. The outcome goes back to both. If AML files a report, the fraud team learns which signals mattered. If the account turns out clean, AML tells fraud so the payee is not blocked next time.

None of these steps needs a merged team. They need a shared case record, a named owner at each step and a rule for who speaks to the customer.

What are regulators asking for?

The standard setters have already said it. In November 2023 the FATF published Illicit Financial Flows from Cyber-enabled Fraud, which points to "the need to break down siloes and accelerate and enhance collaboration across various sectors". Its first priority area is "enhancing domestic co-ordination across the public and private sectors".

Money now follows the same logic. Under the UK Payment Systems Regulator's reimbursement rules for authorized push payment scams, sending and receiving firms split the cost "50:50" (PSR). The bank that received the money into a mule account now pays for the fraud as well. That turns mule detection into a fraud cost and an AML duty at the same time.

For a receiving firm, that changes the business case. A mule account caught early is a report filed on time and a reimbursement avoided. A mule account caught late is both a regulatory finding and a bill.

What changed for me in 2026

• I moved from a bank to a payment institution. In 2026 I joined a payment company, where payments settle faster and the window to stop a fraudulent transfer is shorter.
• Mule signals became a shared list. The accounts we flag for fraud now go to the AML team the same day, instead of waiting for a monthly review.
• Customer contact got a rule. Any account linked to an open AML case is contacted only after AML agrees.

What does a working fraud and AML link look like?

You do not need one team. You need one view of the customer and a few agreed rules. This is what I would put in place first:

• One customer record. Fraud alerts, AML alerts and case notes on the same customer, so neither team investigates the same person twice. complead calls this FRAML, fraud and AML on one platform.
• A shared mule list. Every account the fraud team links to a victim's payment goes to AML as a lead, the same day.
• One rule for customer contact. If an account is in an open AML case, the fraud team checks with AML before calling.
• Shared monitoring scenarios. Velocity and pass through patterns belong to both teams.
• A feedback loop. When AML files a report on a fraud lead, the fraud team learns which signals mattered.

In my experience, the first shared case is the slowest. After a few, both teams start asking each other the right questions before anyone has to escalate.

Fraud and AML will always measure success differently. Fraud counts losses stopped. AML counts reports that hold up. The criminals do not care about that line, and the teams that share what they see catch more of the same money.