FATF ¦ Combating End-to-End Illicit Financial Flows Linked to Scam Compounds

Scam compounds are criminal enterprises, and their money flows are the weak point

Fraud costs an estimated USD 500 billion a year worldwide, and the industrial-scale scam compound has become one of its fastest-growing engines. The Financial Action Task Force (FATF) has applied its anti-money laundering toolkit to these operations and treats them as transnational criminal businesses that generate, move, launder and reinvest proceeds through modular, high-velocity financial chains. The analysis is the first step in the FATF’s wider anti-fraud roadmap and sets out six principles and an operational toolkit for detection, information sharing, investigation, asset recovery and victim protection.

For anti-financial crime (AFC) teams, fraud behaves differently from most predicate offenses. In scam compound typologies the laundering is woven into the fraud itself, victims frequently authorise the payments themselves, and funds can leave the regulated system within minutes. Transaction monitoring on its own will rarely see the whole picture.

A predicate offense that launders as it is committed

Ninety percent of jurisdictions assessed by the FATF identify fraud as a major money laundering risk, and fifth-round mutual evaluations discuss fraud and scams roughly two and a half times as extensively as fourth-round reports. Malaysia’s fifth-round evaluation is the first to name scam compounds in neighbouring jurisdictions as a risk driver.

Scam compounds concentrate on investment fraud, typically preceded by romance or confidence-based grooming. Victims are steered onto fake trading platforms with fabricated dashboards, small initial payouts and repeated “tax”, “unlock” or “withdrawal” fees. Some operations use approval phishing: the victim is induced to sign a blockchain approval that lets the scammer pull tokens from the wallet without any further transfer by the victim.

Because the victim initiates and authorises the payment, the transaction often looks legitimate to the sending institution. The contextual fraud signals usually sit elsewhere – an ongoing call, a recently changed SIM, a beneficiary account receiving money from many unrelated people. That is why the FATF frames its response around the whole financial flow and treats individual suspicious transactions as one input among many.

Bastian Schwind-Wagner _Follow

"Scam compounds show how far fraud has moved from opportunistic crime to organised industry. The money leaves the victim’s account in minutes, while the people who typed the messages may themselves be trafficking victims held against their will. For AFC teams, this is an organised crime and money laundering problem first, and only secondarily a consumer fraud issue.

The practical message is speed and connection. Fraud prevention and AML functions need to work from the same data, payment holds and recalls must be possible around the clock, and suspicious transaction reports should show the network rather than single victim payments. In Luxembourg, the new power of the CRF to share fraud indicators directly with banks, payment institutions and VASPs makes that internal readiness urgent."

Industrialised fraud built on human trafficking

The model expanded rapidly from around 2020. Pandemic-era casino closures and travel restrictions pushed organised crime groups in Southeast Asia to convert gambling infrastructure into large-scale fraud operations. Scam compounds combine cyber-enabled fraud with trafficking in human beings, including for the purpose of forced criminality, and with corruption and money laundering.

The result is a dual-victim model. People from at least 80 countries and territories have been identified in Southeast Asian compounds, recruited through false job offers and then subjected to debt bondage, confinement, violence and quotas. In 2023, credible sources indicated that at least 120,000 people in Myanmar alone may have been forced to carry out online scams. On the other side, victims in more than 100 jurisdictions have been targeted, with narratives tailored by language, platform and demographic.

Scam proceeds are only one revenue stream. Compounds also earn recruitment fees and sell trafficked workers on to other compounds. Families pay ransoms for release, and some groups accept “headcount” arrangements under which a victim recruits a replacement instead. Earlier victims are targeted again with recovery and clearance-fee scams, and illegal online gambling serves both as income and as a laundering channel. Profits go back into land, premises, bribes, mule accounts and new campaigns, so the business finances its own growth.

From fortified compounds to mobile cells

The large fortified compound remains the best-documented model, but enforcement pressure is pushing operators towards smaller, dispersed structures. The Philippines reports boiler-room operations of 20–300 people on leased office floors and mobile cells of 5–50 persons in rented houses that can be abandoned at short notice. Japan, the UAE, Cambodia and Lao PDR describe operations in condominiums, hotel rooms, vehicles and coffee shops.

The geographic footprint is widening as well. Activity has been reported in Africa, the Middle East, Central America and Europe, including trafficking-linked call centre operations in several OSCE participating States. Austria sees itself mainly as a destination, transit and laundering jurisdiction, with local bank accounts, money mules and telephone numbers in use. Germany reports call centre operations that moved from Türkiye to Lebanon after successful enforcement action.

Fewer visible compounds therefore say little about the networks behind them. Operations close, rebrand and reappear while the same controllers, financial infrastructure and service providers stay in place.

The seven-stage financial flow model

The FATF describes scam compound finance as a circular, modular cycle. Upstream, operators set up sites and infrastructure, acquire workers and victims, and run the scams. The payment window follows with collection and initial placement. Downstream, proceeds are layered, cashed out and integrated, and profits are extracted and reinvested. Not every operation passes through every stage, and decentralised networks can enter the cycle at different points.

Each stage leaves a financial footprint. Set-up generates payments for premises, construction, telecommunications equipment, recruitment, transport, documentation, security and bribes. Large compounds need continuous electricity, connectivity, food and transport, so unusually high utility and internet spending, bulk purchases of pre-paid SIM cards and electronic equipment, and payroll settled through the regulated financial system can all serve as indicators. Locally held land, buildings, vehicles and companies are often more persistent targets for freezing and forfeiture than fast-moving victim funds.

Collection runs through personal, corporate and mule-controlled bank accounts, e-money and mobile wallets, virtual asset (VA) wallets, cash and, less often, gold or gift cards. Layering uses mule chains, virtual IBANs, unlicensed money or value transfer services, peer-to-peer and OTC brokers, offshore virtual asset service providers (VASPs), DeFi bridges, mixers and chain-hopping. Cash-out ends in real estate, luxury goods, vehicles, precious metals, front companies and hawala.

Crime-as-a-service and the infrastructure behind it

Scam compound networks are increasingly vertically integrated, yet they also buy from a professionalised crime-as-a-service economy. Specialised providers supply mule accounts, payment gateways, VA conversion, underground banking, synthetic identities, fake investment platforms, scam scripts and AI-generated content. When one provider is disrupted, another is bought in.

Telegram-based guarantee marketplaces show how this layer works. They act as advertising venue, escrow agent and dispute resolver for scam operators, money launderers and cybercriminals. One such marketplace, targeted by US authorities in September 2026, had reportedly processed more than USD 24 billion since around 2022, and activity had shifted to it after action against a predecessor platform. In another case, a Cambodia-based conglomerate launched its own USD-backed stablecoin, blockchain, wallet and exchange, advertised as resistant to freezing, and later moved its business to a successor payment entity to escape a US special measure.

Stablecoins, particularly USDT on the TRON network, dominate scam-related laundering in Southeast Asia, and Telegram-advertised “U-merchants” swap USDT and fiat for launderers outside standard KYC controls. Cash nonetheless remains the most widely observed channel in questionnaire responses, followed by informal value transfer and underground banking.

For investigators, the FATF maps 54 functional dependencies across the lifecycle and flags 14 of them as potentially critical. Two questions matter most: is a capability shared across several operations, and how quickly can the network replace it? Scarce expertise, trusted access, concentrated infrastructure and established criminal relationships offer the highest-value disruption points.

Corruption, opaque ownership and professional enablers

Large compounds depend on protection. Corrupt police, border, immigration and licensing officials can ease land acquisition and cross-border movement and give advance warning of raids. Cases have linked scam networks to politically exposed persons through shell companies, real estate deals, foreign exchange activity and the construction of compounds.

Opaque beneficial ownership and multilayered corporate chains are identified as a primary means of laundering scam proceeds. Controllers use nominees, complicit travel and employment agencies, real estate and logistics firms, and professional intermediaries – trust and company service providers, lawyers, accountants and residence advisers – to set up structures, acquire assets and gain mobility, including through citizenship- and residence-by-investment schemes. Licensed or apparently regulated entities can give a fraudulent investment scheme the look of legitimacy.

Corporate-link analysis has produced results. In one Philippine case, financial, corporate and ownership analysis tied two apparently separate compounds to the same enterprise through nominee incorporators, PEP-linked structures, shared contact details and property transactions. In a Turkish forex fraud case, investigators traced about USD 13 million from 269 victims through mule cash-outs and 76 shell companies into VA exchanges and on to petroleum, energy and gas distribution companies.

Why detection keeps arriving too late

Speed and visibility are badly mismatched. Thailand reports that illicit funds can travel from a victim’s account to an exit point from the financial system within three to five minutes, while victims take around 20 hours on average to realise they have been scammed. Some mule transfers move on within two minutes.

Detection is also fragmented. The sending bank sees an apparently legitimate authorised payment, the receiving institution sees repeated incoming payments to a mule or corporate account, a messaging platform sees fraudulent advertisements or recruitment, and a telecommunications provider sees SIM-box traffic. Nobody holds the full chain. The hardest gap is the trust-building phase between first contact and the first significant payment, when neither the victim nor the financial system has any reason to raise an alert.

Most scam compound investigations start with victim reports, not suspicious transaction reports (STRs). STRs remain important intelligence, but they were never designed for real-time disruption. Classification creates another blind spot: many jurisdictions have no separate scam compound category, so the activity is recorded as generic fraud, cybercrime, gambling, trafficking or money laundering, and a jurisdiction that has identified no cases may simply not be looking for them. Under-reporting adds to the problem, with an estimated 70% of scam victims never reporting at all.

Some nodes move slowly. Wolfsberg Group members report scam-linked front companies and professional laundering nodes that keep a legitimate profile for months or years while processing substantial volumes. These persistent nodes leave a longer investigative window and make good targets for network analysis.

Six principles for an end-to-end response

The FATF condenses its findings into six principles. The first is to target the wider criminal ecosystem, including leadership, controllers, beneficial owners and specialised service providers, with priority for capabilities that are shared or hard to replace. The second is to disrupt the flows end-to-end, upstream against expenditure and enabling infrastructure and downstream against victim payments and proceeds. The third asks jurisdictions to connect intelligence across the financial, technology and telecommunications sectors and route reliable signals to whoever can act. The remaining three call for speed across borders through rapid-response arrangements agreed in advance, a response centred on both groups of victims, and continuous adaptation measured by outcomes.

On measurement, the FATF wants interventions judged by losses prevented, time to intervention, assets preserved and returned, and lasting damage to criminal capabilities. Counts of alerts, account closures, arrests or takedowns are intermediate outputs. Monitoring must also separate real disruption from displacement and rebranding, and improved detection may at first push recorded fraud volumes up.

Where scam compound fraud is a significant national threat, jurisdictions may consider treating fraud as a national security priority to strengthen whole-of-government coordination.

Payment intervention belongs to the institution that controls the payment

The report is explicit about roles. The primary operational role in payment intervention lies with the financial institution or VASP that has direct control over the payment, account or wallet and can act in real time. Anti-scam centres, financial intelligence units (FIUs) and other authorities support that action with intelligence, coordination, escalation and formal powers; they are not expected to intervene transaction by transaction.

The first 24 to 72 hours after detection or reporting are critical. Opportunities to preserve linked assets drop sharply after that and may be much smaller after a week. Where domestic law allows, holds, recalls, account or wallet restrictions and outreach to centralised stablecoin issuers may begin before final attribution, before an STR is complete and before a full investigation, without displacing reporting obligations.

Preventive payment controls should be built into payment products, particularly in instant payment environments. They include pre-payment warnings and verification of payee – mandatory for euro SEPA credit transfers since 9 October 2025 under Regulation (EU) 2024/886 – combined with behavioural and cross-sector signals. Generic warnings wear off through alert fatigue and fail once grooming has led the customer to trust the scammer more than the bank. Higher-risk situations call for tailored warnings, checks on whether the customer understands the transaction, cooling-off periods, limits or holds. In the UK, real-time mobile network signals at the point of payment authorisation have been associated with a 41% reduction in people scammed and a 55% reduction in false positives.

Offboarding alone does not disrupt a laundering network. Before or alongside closing the account of a suspected front company or laundering node, institutions should preserve the intelligence and consider tracing, holds or restrictions, so that the activity does not simply move to successor accounts.

Mule networks, shared data and the Luxembourg dimension

Money mules connect victims, payment channels and laundering. Mule acquisition increasingly involves buying, selling or stealing identities to open several accounts across providers. The FATF recommends clustering accounts by identity, device, IP address, location and cash-out pattern, graph analytics to uncover multi-generation mule chains, and risk-based controls on pass-through behaviour. Responses should distinguish knowing facilitation from deception or coercion and avoid permanently excluding people who were exploited.

Shared fraud data infrastructures extend that view across institutions. A register managed by the Banque de France lets payment service providers share IBANs linked to suspected fraud. In a Singapore trial, each scam-linked bank account shared by police helped banks find at least one further account that had not been reported. The FATF encourages clear legal gateways, safe-harbour protection for good-faith sharing and repeatable private-private models that can send one warning to many institutions.

Luxembourg appears in the report directly. Following a legislative amendment adopted in July 2026, the Cellule de Renseignement Financier (CRF) may share fraud-related tactical and operational information, including bank account and SWIFT identifiers with the associated fraud type, directly with specified credit institutions, payment-sector entities and VASPs. The aim is to move from ex-post fraud detection to earlier preventive intervention. Luxembourg institutions will need internal processes to receive, validate and act on such indicators quickly. Hungary’s FIU runs a comparable mechanism with a 90-day limit on the use of transaction-related information.

Tracing, investigating and recovering across borders

Parallel financial investigations should run alongside fraud, trafficking and cybercrime cases, as Recommendation 30 requires for major proceeds-generating offences, and draw together victim statements, STRs, VASP records, blockchain analytics, device evidence and ownership data. The prosecutions with the greatest strategic value go after leadership, financial facilitators, professional money launderers and recruitment networks rather than low-level workers.

On-chain analysis should never stand alone. Attribution needs transparent, testable methods corroborated by off-chain information such as Travel Rule data and fiat on- and off-ramp records. Where funds reach a VASP or a centralised stablecoin issuer, timely outreach can freeze them. Around USD 225 million in USDT linked to a Southeast Asian scam compound laundering network was frozen voluntarily and later burned and reissued to wallets controlled by US authorities, and a Namibian court ordered forfeiture of 112,334.50 USDT held at a Seychelles-linked VASP.

Cross-border tools are maturing. INTERPOL’s I-GRIP has processed some 2,700 requests and intercepted around USD 130 million, Europol launched a Rapid Response Protocol pilot in July 2026, and the Egmont Group’s cyber-enabled fraud rapid response programme links FIUs directly. INTERPOL Silver Notices help locate assets abroad, although they give no legal basis for freezing. Coordinated action against one Cambodia-based conglomerate since October 2025, combining sanctions with the seizure of more than USD 15 billion in assets, shows what multi-jurisdictional pressure can achieve.

Recovery remains the weakest link. The FATF calls for non-conviction-based confiscation where perpetrators are unavailable or unidentified, interlocutory sale of depreciating assets and recovery workflows that keep claimant and loss data, so that assets can go back to identifiable victims.

Victims are not intelligence sources first

People trafficked into compounds may be forced into acts that look criminal in isolation. Treating them as offenders or irregular migrants harms them and throws away intelligence on recruiters, compounds and financial flows. The FATF calls for trafficking screening before any punitive treatment, application of the non-punishment principle and support that never depends on cooperation.

Information from victims is still valuable when it is gathered safely. A debrief of a British national who escaped a Cambodian compound supported a police raid, and an SOS from Indian nationals led to the rescue of 81 people within two days. Reporting systems should work on a “no-wrong-door” basis, capture wallet addresses, account identifiers and platform handles even when victims cannot name the perpetrators, and pass high-confidence data quickly to institutions that can still stop payments. The FATF describes consumer education as a supporting measure, not a sufficient line of defence on its own.

What this means for obliged entities

For banks, payment institutions, e-money issuers and VASPs, the expectations are concrete. Institutions should assess whether they are exposed as sending, receiving, transit or cash-out points and connect their fraud prevention and AML functions through shared data, compatible classifications and common escalation. STRs should carry network-level context such as linked beneficiary accounts, wallets and recurring payment patterns, scam campaigns should be tagged with structured identifiers like wallet addresses, phone numbers, domains and IP addresses, and contact points for holds and recalls should be reachable around the clock.

Gatekeepers carry their own exposure. Trust and company service providers, lawyers, accountants, real estate professionals and residence advisers can unknowingly provide the corporate shells, property and mobility that controllers depend on. Ownership chains that change after enforcement action, successor entities, common directors and addresses across unrelated companies, and clients seeking investment-linked residence with opaque funding all deserve close scrutiny.

The FATF will use the report in the next phase of its fraud work, which includes reviewing whether the existing Standards are being applied effectively to scam compound risks.

Dive deeper

• FATF ¦ Combating End-to-End Illicit Financial Flows Linked to Scam Compounds: Applying the FATF Toolkit to the Fraud Epidemic ¦ Link