Prepaid card money laundering: risks, red flags and checks

A supervisor or a card network reviewing a prepaid card program starts with one question: which party sees the loads, the cards and the cash outs, and which party acts on them. Often that is several firms. The Wolfsberg Group's guidance on prepaid and stored value cards counts up to nine distinct roles, though one party may hold several. It also rejects the "widely held perception" that every prepaid arrangement is high risk. For Wolfsberg, the risk sits in each program's features, from how cards are funded to how many cards one person can hold.

A prepaid card holds money paid in advance. It is spent through a card network or at one retailer. Money laundering through these cards follows the placement, layering and integration stages.

Who carries the AML duty in a prepaid card program?

The rulebook decides which firm carries the duty under anti money laundering (AML) and countering the financing of terrorism (CFT) rules. The setup decides who holds the data. That can be banks, electronic money issuers or the payment firms that run cards for others.

Wolfsberg's nine roles include the program manager, the issuer, the processor that handles loads, the distributor or seller and the reload agent. Its own example is a payroll manager that acts as program manager and contracts a bank to offer payroll cards to staff.

An open loop card carries a network brand and works wherever that brand is accepted. A closed loop card works at one retailer or a group of outlets. A general purpose reloadable (GPR) card takes value through load channels such as cash at a counter, a bank transfer or direct deposit, and it may allow ATM cash out.

US rules name one owner. FinCEN's term is "prepaid access": funds paid in advance that can be retrieved or transferred later through a card, code or number. The participants in each program must pick one provider of prepaid access. Without a registration, the provider is the party with "principal oversight and control", the one that organizes the program and chooses its issuing bank, processor or distributor (31 CFR 1010.100).

Are anonymous prepaid cards still allowed?

In the EU and the UK, only in a narrow low value tier, kept because general purpose prepaid cards serve "social and financial inclusion", in the EU's words. The US asks for ID under any prepaid program.

• US. Providers and sellers collect name, date of birth, address and an identification number from anyone who obtains prepaid access under a prepaid program (31 CFR 1022.210).
• EU. 5AMLD lets member states waive some checks for cards holding at most €150, never for cash redemption or remote payments above €50.
• UK. Regulation 38 sets £150 and £50, and the issuer must still monitor the relationship and the card's transactions.

Each rulebook adds conditions to the electronic money exemption, such as goods and services only. Outside the tier, UK regulation 37 still allows simplified checks for a lower risk customer, and those still identify the customer.

How are prepaid cards used to launder money?

Criminals use prepaid cards to turn cash into card value, spread it across cards and people, then take it out where the source no longer shows. Each stage leaves a data point, and usually a different party holds it.

Table 1. Prepaid card laundering, stage by stage (Wolfsberg Group 2011; US v. Jun Wang, 2026)

Wolfsberg calls this the segmentation of services: the number of parties creates a risk of "loss of information", worse when important services sit with unregulated third parties or abroad. Neither the seller nor the issuer sees a whole row of Table 1. Transaction monitoring for a card program starts by joining load, card and ATM records, so one rule can read the row.

What are card testing and card cracking?

Both are fraud schemes that leave traces a prepaid program can see. Card testing is what Visa's rules call an enumeration attack: the systematic or routine submission of card absent transactions "to fraudulently obtain or validate payment information". It shows up as bursts of small authorizations from one merchant or device. Numbers that pass then feed card not present fraud.

Card cracking recruits account holders. A sentencing release of 6 February 2025 from the Southern District of Indiana describes holders who answer an online offer of "easy money" and hand over a debit card for "withdrawal of fake check deposits". The criminal then empties the account at an ATM or by transfer. On a prepaid or debit card that takes deposits, you see a deposit followed at once by a withdrawal.

Which red flags show prepaid card laundering in the data?

The flags differ across card types, but each one below names the data that shows it.

1. Many cards on one identifier. One ID number, address, phone or device sits behind several active cards. No central register shows what each issuer has issued, so only the program's own data can show it.
2. A load, then cash out within hours. ATM withdrawals soon after a load, above all abroad, match three items on Wolfsberg's monitoring list: unusual ATM use, high velocity and unexpected or high risk countries.
3. Cash loads at many retail points in a day. Cash is where the source of funds is hardest to establish.
4. Loads kept just under a limit. Repeated loads below the program's ID or load threshold follow the logic of structuring.
5. Card to card transfers to unrelated holders. Wolfsberg lists value transfer between unrelated cardholders among its program risk factors.
6. Reloads from outside the stated funding source. On payroll or benefit cards, Wolfsberg calls monitoring the load channel a key control.
7. Redemption within hours of purchase, across registers and stores. This was the pattern in the 2026 gift card conviction below.
8. Bulk gift card purchases. A US retailer that sells more than $10,000 of prepaid access to one person in a day, without procedures to prevent it, becomes a seller of prepaid access.

These flags refine older lists. The FATF's 2013 guidance on prepaid cards, mobile payments and internet payment services is still on the FATF's site, which notes that it does not reflect the 2025 revisions to Recommendation 1. The NBPCA, founded in 2005, renamed itself the Innovative Payments Association in 2019.

A flag turns into a transaction monitoring rule once it has a threshold and the data it needs.

How does gift card money laundering work in closed loop programs?

A gift card is usually closed loop: the retailer that sells it also issues it and takes it as payment. The rules treat small closed loop cards as low risk. FinCEN excludes closed loop prepaid access of up to $2,000 a day per card or device from the definition of a prepaid program. Recital 58 of the EU's AMLR names prepaid gift cards and vouchers among products that "might present low risks". Low limits mean a launderer needs many cards.

Jun Wang's case shows how. Between June 2019 and June 2021, Wang redeemed $2,285,039.81 in gift cards bought by defrauded victims. The card details came electronically from accomplices overseas. Wang spent the value on other gift cards at Walmart and Sam's Club stores in Florida. To hide the volume, Wang often switched registers and frequently drove from store to store, redeeming cards "just hours, and sometimes minutes" after victims bought them. After a bench trial in the Northern District of New York, Wang was found guilty of money laundering conspiracy, announced on 18 February 2026.

Every data point sat with the retailer: activation time, redemption time, register and store. A closed loop issuer that compares activation with redemption, and links redemptions across registers and stores, puts together what each register saw one transaction at a time.

What AML checks should a prepaid card program run?

Five measures cover the stages in Table 1, from the first load to the cash out:

1. Customer due diligence at issue and at reload. Verify the cardholder under customer due diligence (CDD) rules before a card leaves the low value tier. On higher risk programs, Wolfsberg adds nationality to the data captured, and a scheme partner rated high risk gets enhanced due diligence (EDD).
2. Sanctions screening of cardholders and partners. On standard and higher risk programs, Wolfsberg says cardholder screening should take place "both before the account is opened and during the lifetime of the account". It also recommends screening scheme partners and their beneficial owners.
3. Monitoring rules scoped per program. A payroll card and a reloadable retail card need different thresholds, and on complead, formerly Sanction Scanner, rules are scoped per product, segment or jurisdiction.
4. Records that rebuild every transaction. US providers keep, for five years, the records needed to "reconstruct prepaid access activation, loads, reloads, purchases, withdrawals, transfers" (31 CFR 1022.420).
5. A suspicious activity report on time. Providers and sellers of prepaid access, as US money services businesses, must file when a suspicious transaction involves or aggregates at least $2,000. They have 30 calendar days from first detecting facts that may be a basis for filing (31 CFR 1022.320).

How would one monitoring rule catch a load and cash out ring?

Picture an illustrative reloadable program. In one day, 25 cards registered on 2 devices each take $480 in cash at 9 retail points. That is $12,000 in total, and no single load comes near $10,000. Within 2 hours, 21 of the cards (84 percent, $10,080) are emptied at ATMs in one foreign city.

No transaction breaks a limit on its own. The rule therefore joins three conditions: more than 5 active cards on one device, a first ATM withdrawal less than 2 hours after the load, and an ATM country unlike the load country. Before it goes live, you backtest it against 30, 60 or 90 days of real history in the rules engine and read the alert volume, clearance rate and true positives it shows.

What do card networks expect from a prepaid issuer?

Under rule 4.13.1.1 of the Visa Core Rules and Visa Product and Service Rules of 24 October 2026, a prepaid issuer must get Visa's approval before launching a program and follow AML and anti terrorist financing requirements. It must also prohibit unauthorized resale and never issue the cards as a consumer credit program. Since 25 July 2026 a prepaid card's expiry may be up to 10 years after issuance, up from 5.

Every Visa member must keep an AML program "reasonably designed to prevent the use of the Visa system to facilitate money laundering" (1.9.1.7). On request, it gives Visa its written policy, its training records and its latest independent AML and sanctions audit, which "must be less than 2 years old" (1.9.1.8). A prepaid issuer completes a self assessment questionnaire on entry and at least once a year, accepts periodic evaluation of its operations, and holds its agents to Visa's prepaid issuer risk standards (10.19.1.2). US issuers report enrollments, loads, reloads and fraud to the Prepaid Clearinghouse Service (10.5.1.1).

Wolfsberg counts a short card life as a factor that can lower risk, since the value must be spent rather than stored. A 10 year card lets value sit longer. Dormant cards that reload deserve a rule. If your program also issues on Mastercard or Discover, evaluate each company's own network rules beside Visa's; this page quotes Visa only.

Which 2026 court cases and rule changes reach prepaid card programs?

• 18 February 2026. Jun Wang's conviction over $2,285,039.81 in redeemed gift cards was announced; the 70 month sentence was announced on 7 July.
• 30 June 2026. S.I. 2026/621 put UK regulation 38 in sterling: £150 and £50 instead of 150 and 50 euros.
• 22 July 2026. The Justice Department announced an indictment alleging that stolen gift cards bought electronics later shipped to China.
• 25 July 2026. Visa's longest prepaid card expiry rose from 5 to 10 years (rules edition of 24 October 2026).
• Next, 10 July 2027. The AMLR applies. Supervisors may then exempt only cards up to €150 that cannot be reloaded, cashed out or swapped for crypto (art. 19(7)). EU acquirers "shall not accept payments carried out with anonymous prepaid cards issued in third countries" unless Commission standards allow it (art. 79(2)).

Who owns the joining rule. In a typical split, the issuer bank sees the cards and the funds. The program manager sees the cardholders and partners, the processor each load. Wolfsberg asks that "some party in the value chain takes responsibility for compliance", and it warns that splitting services loses information. So write down two names: the party that owns the rule joining a load, a card and a cash out, and the person who works its alerts.

Sources. All read on 7 November 2026. They are 31 CFR 1010.100, 1022.210, 1022.320 and 1022.420; Directive (EU) 2018/843 and Regulation (EU) 2024/1624; UK regulation 38 and S.I. 2026/621; the Wolfsberg Group's 2011 guidance on prepaid and stored value cards; the Visa rules of 24 October 2026; and the Justice Department releases linked above; Mastercard's and Discover's rules were not reviewed. Javid Khasayev fact checked it. Last reviewed: 8 November 2026.