KYC Onboarding Automation: What The FCA’s Money Mule Findings Mean For Payment And E-Money Firms

238,396 - Suspected money mule accounts offboarded in 2025 (FCA, 23 September 2026)  ·  164.6% - Rise in offboarding at e-money institutions compared with 2024 (FCA, 23 September 2026)  ·  35 - Firms surveyed, including payment and e-money institutions (FCA, 23 September 2026)  ·  20 Nov - Closing date for the ICO’s call for evidence on agentic AI (ICO, 8 October 2026)

What did the FCA find about money mules?

A money mule is a person whose account is used to receive and move the proceeds of crime, often fraud. On 23 September 2026 the FCA published the findings of a multi-firm review, based on a survey of 35 regulated firms including retail banks, building societies, challenger banks, payment institutions and e-money institutions.

Firms closed more suspected mule accounts each year: 184,935 in 2023, 233,269 in 2024 and 238,396 in 2025, a total of 656,600 over three years. The FCA noted that the rise slowed in the final year.

The money rarely stops at the first account. Cash-out activity was “mainly concentrated between the second and fifth mule accounts”, with the highest concentration at the second. Steve Smart of the FCA said: “Money muling is a crime and it’s not victimless.”

Why are payment and e-money firms under more pressure?

The review singled out one group. The FCA said “e-money institutions (EMIs) recorded the largest year-on-year increase, with offboarding volumes rising by 164.6% compared with 2024.” A rise in offboarding can mean better detection as well as more mules, but either way it means more cases to review, more files to check and more decisions to record.

A week earlier, on 16 September 2026, the FCA said it had opened a criminal investigation into Euro Exchange Securities UK Ltd under the Money Laundering Regulations 2017, for the period from 1 February 2020 to 4 June 2026. The areas listed included “customer due diligence”, “ongoing monitoring controls” and “record-keeping and escalation/reporting mechanisms”. The FCA said: “We have not yet reached any conclusions in this investigation”.

The same notice records that the FCA had earlier required the firm to “ensure that all relevant funds are appropriately ringfenced in a designated safeguarding account”. Onboarding, monitoring and safeguarding are separate obligations, but they draw on the same customer data, and weaknesses in one tend to show up in the others. We cover the safeguarding side in our guide to reconciliation automation.

What is KYC onboarding?

KYC stands for know your customer. Onboarding is the point where a firm collects and checks the information it needs before opening an account or taking on a client: identity, address, the nature of the business or the source of funds, and any screening results. The output is a customer file that shows a person had what they needed to make the decision.

It matters because everything after it depends on it. Transaction monitoring, fraud controls and suspicious activity reporting all work better when the onboarding file is complete, consistent and up to date.

What does the FCA expect beyond the first account?

The review’s central message is about connections. The FCA said firms “should consider indicators beyond the initial receiving account”, including linked accounts, payment characteristics, transaction context and the customer. It also asked firms to use the information-sharing provisions in the Economic Crime and Corporate Transparency Act 2023 where appropriate, and to keep revisiting their controls as new mule patterns emerge.

For a payment or e-money firm with 10 to 250 people, that is a data problem as much as a judgement problem. The signals sit in different places: the onboarding file, the transaction history, the payment details and the customer’s other accounts. Someone has to pull them together before an analyst can decide anything.

Where does KYC onboarding automation help most?

The most useful automation does the assembly and the checking, and stops there. In practice that means:

• Building the file. Collecting each required document and data point, and listing what is missing before anyone starts the review.
• Checking each document. Confirming it is present, legible, in date and consistent with the application, such as a name or address that differs between the form and the proof of address.
• Preparing linked-account context. Pulling the account’s payment patterns and links to other accounts into one view, so an analyst can see beyond the first account as the FCA asks.
• Drafting the request. When something is missing, preparing the message to the customer for a person to approve and send.
• Refreshing files on schedule. Flagging files due for periodic review and preparing them with the latest data.

This is how our agents prepare client onboarding files. The agent prepares and a person approves, and the decision on whether to take on or keep a customer stays with the firm’s people.

What does the ICO expect when agents handle onboarding data?

Onboarding files are full of personal data, so data protection applies to any AI that touches them. On 8 October 2026 the ICO opened a call for evidence on agentic AI, open until 20 November 2026, covering security, transparency, accountability, automated decision-making, fairness and lawful use of data. Its Director of Technology Regulation, Richard Nevinson, said: “the fact AI agents act with autonomy is not an excuse for poor compliance.”

For an onboarding agent that means a data protection impact assessment before go-live, access only to the data the check needs, and a person making any decision that affects the customer. Our guide to AI agents for financial firms covers the wider controls.

What should a payment or e-money firm do now?

1. Read the FCA’s money mule findings against your own offboarding data for 2023 to 2025.
2. Time your onboarding and periodic review files today, from first document to decision, so you have a baseline.
3. Map where linked-account signals sit, and whether an analyst can see them in one place.
4. Check your use of the ECCTA information-sharing provisions with your compliance lead.
5. Pilot automation on file preparation only, read-only, with a person approving every outcome, and measure the result against your baseline.

AI for payments firms in the UK pays back first where volumes are high and the checking is repetitive. Onboarding and periodic reviews fit that description, alongside the daily safeguarding reconciliation. For London firms weighing AI automation, our explainer on the Bank of England’s AI warning covers the wider context.

How can a firm test onboarding file checks on its own data?

BraivIQ’s 14-day Proof Run works read-only on a sample of a firm’s own onboarding files. It lists every gap and inconsistency, times the checking on real cases and gives the firm a signed baseline before anything is built. Client data is never used to train models.