Cash, informal value transfer and mobile money

A cash-intensive business is not, by itself, a laundering vehicle. Spaza shops, taxi ranks, car washes, small restaurants and informal traders across South Africa and its neighbours generate genuine cash turnover because their customers pay in cash, and I am careful in every training session to say this before anything else, because officials who treat cash intensity itself as a red flag end up harassing legitimate small traders while missing the businesses that matter. What converts a legitimate cash business into a laundering vehicle is comminglingComminglingMixing illicit cash with a legitimate business's genuine takings so the two streams become indistinguishable once banked.: the deliberate mixing of illicit cash with the business's genuine daily takings so that, once banked, the two streams become indistinguishable in the bank statement. A shebeen owner who nets on average R4,000 a day in genuine trade can, with almost no additional operational risk, deposit R7,000 a day and declare it all as trade income, provided nobody checks the declared turnover against the business's actual physical capacity to generate that revenue.

That capacity checkCapacity checkAn indirect audit method reconstructing plausible turnover from a business's physical inputs (space, stock, staff-hours) to test declared revenue. is by some distance the most useful analytical tool available to a tax or FIU official confronted with a suspected front. It requires reconstructing, independently of the taxpayer's own books, what the business could plausibly have earned given its physical inputs: square footage and seating capacity for a restaurant, the number of chairs and average service time for a hair salon, litres of fuel purchased against litres notionally resold for a filling station, or airtime and product stock purchased against declared retail sales for a spaza shop. SARS auditors have used exactly this style of indirect method — sometimes called the "unit and mark-up" method or, in South African income tax practice, an estimated assessment under section 95 of the Tax Administration Act 28 of 2011, for decades in ordinary tax enforcement, and the technique transfers directly into laundering investigations because a front businessFront businessAn operating enterprise, often with genuine trade, used principally to give illicit cash a plausible declared source. inflating turnover to launder cash produces the same statistical signature as a business simply inflating turnover for its own tax reasons: declared revenue that its physical throughput cannot support.

Structuring, colloquially "smurfing," is the deposit-side discipline that keeps a front businessFront businessAn operating enterprise, often with genuine trade, used principally to give illicit cash a plausible declared source.'s banking pattern beneath supervisory thresholds. South Africa's Financial Intelligence Centre Act 38 of 2001, as amended in 2022, requires accountable institutions to file cash threshold reports for transactions above a prescribed amount and suspicious transaction reports regardless of amount where suspicion exists; the structuring response to a threshold regime is to break large cash sums into a sequence of deposits, each individually below the reporting trigger, made across multiple branches, multiple accounts, or multiple days, occasionally by a coordinated network of "smurfs"; low-level depositors, often family members, employees or paid runners, each holding an account into which a modest sum is fed. The 2022 amendment to the FIC Act, part of South Africa's response to its October 2021 FATF mutual evaluation deficiencies and central to its exit from the FATF grey list in October 2025, sharpened beneficial-ownership disclosure obligations precisely because structuring through nominee accounts had proven so resilient against threshold-based detection alone; a bank that only watches the size of individual transactions misses a network of ten accounts each moving amounts that look unremarkable in isolation.

The mechanics of building a durable front businessFront businessAn operating enterprise, often with genuine trade, used principally to give illicit cash a plausible declared source. follow a fairly standard pattern in casework I have reviewed across the region. The business must have a real trading history, ideally several years old, so that a sudden appearance immediately before large deposits begin does not itself trigger scrutiny; it must have plausible physical premises and at least some genuine trade, because a business with declared turnover but no observable customers, stock movement or employees is a far weaker cover than one that does modest legitimate business alongside its laundering function, and its books must be prepared by someone competent enough to produce internally consistent VAT returns, PAYE submissions and financial statements, because inconsistency between what is declared to SARS for tax purposes and what is declared to a bank for account-opening or credit purposes is one of the most reliable analytical seams an investigator can exploit, cross-referencing a business's SARS VAT201 filings against its bank-declared turnover and its municipal trading licence category will frequently expose a front that looks entirely convincing on any single one of those documents in isolation.

Investigators should also pay close attention to trade-based variants of comminglingComminglingMixing illicit cash with a legitimate business's genuine takings so the two streams become indistinguishable once banked., where a cash-intensive front is paired with genuine or semi-genuine import activity — a used-car dealership, a scrap-metal exporter, a construction-materials supplier — because these give the front an additional plausible channel for large, lumpy transactions that would look anomalous in a pure cash-retail business, and because customs and trade documentation (bills of lading, commercial invoices, SARS customs declarations) provide an independent, harder-to-manipulate cross-check against declared business activity that pure domestic cash businesses do not generate. Building a case therefore typically layers three independent data sources against each other, bank records, tax filings and physical/trade evidence of actual capacity; because a front businessFront businessAn operating enterprise, often with genuine trade, used principally to give illicit cash a plausible declared source. can falsify any one of these individually but rarely all three consistently over an extended period, and it is in the inconsistency between them, not in any single suspicious document, that the case is made.

HawalaHawalaA trust-based informal value transfer system in which value is settled through instructions between counterpart brokers rather than physical movement of funds per transaction., and its regional cousins, hundi in South Asia, fei ch'ien historically in China, and various unnamed trust-based networks operating among diaspora communities across East and Southern Africa — is best understood by officials not as an anomaly to be eradicated but as a settlement technology that predates formal banking and that continues to serve a genuine, large-scale remittance function precisely where formal banking is expensive, slow or absent. The mechanics are elegantly simple and depend on trust rather than physical movement of value. A customer in Johannesburg who wants to send money to a relative in Mogadishu pays cash to a local hawaladar, who instructs a counterpart hawaladar in Mogadishu, typically by phone, message or an entry in a paper or spreadsheet ledger, to pay the relative an equivalent sum in local currency, often within hours. No money physically crosses the border at the time of the individual transaction. What crosses, periodically, is a net settlementNet settlementThe periodic reconciliation of reciprocal obligations between two hawaladars, often via trade invoices, compensating bank transfers or bulk cash. between the two hawaladars, who over time will owe each other reciprocal amounts as remittance flows run in both directions, and who settle that net position through whatever channel is available to them — a trade invoice, a shipment of goods that is over- or under-invoiced by the settlement amount, a compensating movement through a legitimate bank account, or occasionally a physical bulk cash movement.

The system persists for reasons that are largely legitimate and well documented by the World Bank and by academic studies of Somali and Ethiopian remittance corridors. Formal correspondent banking access to fragile or conflict-affected states has been thinned by the de-risking dynamics discussed in this module's companion unit on correspondent banking, formal money transfer operators charge fees that can run into double-digit percentages on small remittances, and hawalaHawalaA trust-based informal value transfer system in which value is settled through instructions between counterpart brokers rather than physical movement of funds per transaction. networks reach villages and neighbourhoods that no bank branch or formal MTO agent serves. The Somali remittance corridor, in particular, has been the subject of sustained policy attention since Western Union and several UK and US banks moved to close or restrict accounts held by Somali money-service businesses in the early-to-mid 2010s over AML concerns, a move the World Bank and Oxfam both warned risked cutting off a remittance flow estimated at the time to exceed Somalia's combined foreign aid and foreign direct investment, illustrating starkly the tension between AML risk-aversion and the developmental value of the very channel under suspicion.

The laundering risk within hawalaHawalaA trust-based informal value transfer system in which value is settled through instructions between counterpart brokers rather than physical movement of funds per transaction. arises not from its existence but from its capacity to be exploited for value transfer with essentially no transaction-level audit trail, and from the fact that the same settlement mechanism used for remittances can just as easily settle the proceeds of narcotics trafficking, human smuggling fees or sanctions-evasion payments, with the hawaladar frequently unable, and sometimes unwilling, to distinguish a legitimate remittance customer from an illicit one. Trade-based settlementTrade-based settlementUsing mispriced or fictitious trade invoices between associated trading entities to transfer the net settlement value owed between hawaladars. is the specific mechanism most useful for an investigator to understand: because hawaladars settle net positions partly through trade flows, an invoice for a shipment of textiles or electronics between the hawaladar's associated trading companies in two countries can be deliberately mispriced to transfer the exact settlement value under cover of a plausible commercial transaction, meaning that hawalaHawalaA trust-based informal value transfer system in which value is settled through instructions between counterpart brokers rather than physical movement of funds per transaction. investigations frequently converge with trade-based money laundering investigations at the settlement layer even though the retail-level remittance activity looks nothing like TBML.

Reconstructing a hawaladar's ledger is a specialised but learnable skill, and I encourage FIU analysts to build relationships with financial forensic accountants who have done it, because the ledgers themselves, where seized, are often the single richest piece of evidence in an entire investigation. A traditional hawalaHawalaA trust-based informal value transfer system in which value is settled through instructions between counterpart brokers rather than physical movement of funds per transaction. ledger records each transaction not as a full audit-quality entry but as a compressed notation, a name or code, an amount, sometimes a reference number; designed to be intelligible to the hawaladar and his counterpart but opaque to an outsider, and frequently written in a script or shorthand specific to the community involved. Reconstruction requires establishing the notation convention first, usually through cooperating witnesses or comparison against a smaller set of transactions that can be independently corroborated (a known remittance from a cooperating sender matched against its corresponding ledger entry), then applying that convention across the full ledger to identify counterparty codes, running balances between hawaladars, and settlement events. Modern hawaladars increasingly keep these records digitally, in spreadsheets, encrypted messaging app chat logs or basic accounting software, which has made reconstruction faster where seizure is possible but has also allowed remote deletion and cloud-based backup outside the investigating jurisdiction, complicating cross-border evidence gathering under mutual legal assistance frameworks.

FATF's regulatory response has been to require hawaladars and other money or value transfer services (MVTS) to register or license as money-service businesses and comply with the same customer due diligence, record-keeping and suspicious transaction reporting obligations as formal remittance companies, a requirement embedded in FATF Recommendation 14. Compliance across the region is uneven: South Africa's FIC Act brings MVTS operators within its accountable institution regime, but enforcement against informal, unregistered hawaladars operating below the regulatory radar in diaspora communities remains difficult, and I tell officials that the realistic policy objective is not to eliminate hawalaHawalaA trust-based informal value transfer system in which value is settled through instructions between counterpart brokers rather than physical movement of funds per transaction., which would simply drive remittances further underground or cut off vulnerable communities from remittance access altogether — but to bring registered MVTS operators into a reporting relationship with the FIU while reserving criminal enforcement resources for hawaladars demonstrably settling the proceeds of predicate crime rather than ordinary remittances.

Mobile money has done more to advance financial inclusion in Sub-Saharan Africa over the past fifteen years than any single formal-banking initiative, and any AML training that treats it primarily as a laundering risk without first acknowledging that achievement misunderstands both the technology and the policy environment in which it operates. Kenya's M-Pesa, launched by Safaricom in 2007, is the paradigm case: a mobile-network operator, rather than a bank, provides a value-storage and transfer service accessed through a basic handset and a network of physical agents who convert cash to electronic value ("cash-in") and electronic value back to cash ("cash-out"). The model has since been replicated, with local variations, across Tanzania, Uganda, Ghana, Rwanda, Zambia, Mozambique and beyond, and mobile money accounts now substantially outnumber traditional bank accounts in several of these markets, particularly among rural and lower-income populations that formal banks had never profitably served.

The agent network is simultaneously the model's greatest strength and its principal AML vulnerability. Agents are typically small independent retailers — a general dealer, an airtime kiosk, a pharmacy, recruited and trained by the mobile money operator or its network of aggregators, and it is at the agent level, not at the mobile network operator's head office, that most customer-facing know-your-customer activity actually happens in practice. Regulatory frameworks across the region generally require tiered KYCTiered KYCA regulatory design permitting minimal identification for low-value accounts and progressively fuller verification as balance or transaction limits rise., under which lower transaction and balance limits require only minimal identification (frequently just a national ID number and phone number, no proof of address or income verification), while higher limits or additional services require fuller documentary verification, an approach the GSMA and financial-inclusion advocates argue correctly balances inclusion against risk, since requiring full bank-grade KYC for a farmer topping up airtime and receiving occasional remittances would exclude exactly the population mobile money was designed to serve. The vulnerability is that agents, working on thin commission margins and under commercial pressure to process volume, are the weakest KYC enforcement point in the entire system: agents in a range of documented enforcement actions across the region have been found registering SIM cards and mobile money accounts using photocopied or borrowed identity documents, registering multiple accounts under a single identity at a customer's request for a fee, or simply failing to verify the identity presented against the person actually transacting.

SIM-swap fraudSIM-swap fraudFraudulently obtaining a replacement SIM card for a victim's number to seize control of accounts and authentication channels tied to it. compounds this vulnerability by attacking account control rather than account registration. A fraudster who can persuade or bribe a mobile network agent to issue a replacement SIM card for a victim's registered number; typically by presenting fabricated identification or exploiting weak agent-level verification procedures, gains control of any mobile money account, banking one-time-password channel or two-factor authentication tied to that number, and this technique has been used both for direct account theft and, relevantly for this module, to acquire control of "mule" accounts that can then receive and rapidly disperse laundered funds without the true account holder's knowledge. Mule-account layering in mobile money ecosystems typically involves recruiting or defrauding a large number of individuals into registering accounts (or surrendering control of existing ones) that receive incoming transfers from a criminal source and immediately cash out or forward the funds through several further mobile money hops before the underlying scheme is detected, exploiting the fact that individual transactions at each hop sit comfortably within tiered-KYC thresholds even where the aggregate flow through a coordinated mule network would look highly anomalous if analysed collectively.

Agent-level cash-out is the final and most consequential vulnerability, because it is the point at which electronic value re-enters the cash economy and effectively achieves the same integration function that a bank withdrawal or a front-business deposit achieves in other typologies discussed in this module. An agent handling unusually high cash-out volumes relative to the demographic profile of the community they serve, or an agent whose transaction pattern shows a small number of large cash-outs rather than the many small transactions typical of ordinary retail mobile money use, is a strong analytical signal, and mobile network operators' own transaction-monitoring systems — which sit on vastly larger and more granular datasets than most traditional banks, given the sheer transaction volume mobile money platforms process — are increasingly capable of generating exactly this kind of agent-level behavioural analytics, provided the operator has built the monitoring capability and the FIU has the technical capacity to receive and analyse the resulting suspicious transaction reports.

Regulators across the region, coordinated substantially through the ESAAMLG mutual evaluation process and through central bank e-money regulations (the South African Reserve Bank's electronic money guidelines, the Bank of Tanzania's and Central Bank of Kenya's respective mobile money regulations among them), have converged on broadly similar tiered-KYC and agent-oversight models: caps on maximum balances and daily transaction values at each KYC tier, mandatory agent training and periodic compliance audits, requirements that mobile network operators maintain centralised transaction-monitoring systems capable of flagging structuring and mule-account patterns across their agent network as a whole rather than agent-by-agent, and increasingly, requirements for biometric SIM registration to reduce identity-document fraud at the point of account opening. The policy challenge that remains unresolved in most of the region is supervisory capacity: central banks and FIUs in several ESAAMLG member states have neither the staff nor the technical tooling to meaningfully supervise agent networks numbering in the tens or hundreds of thousands, which means that in practice the primary line of defence against agent-level KYC failureAgent-level KYC failureBreakdown of identity verification at the point of account registration or transaction, typically at commission-incentivised retail agents rather than at the operator's head office. remains the mobile network operator's own compliance function, creating a reliance on private-sector self-policing that mirrors, in a different sector, the correspondent-banking de-risking dynamics discussed elsewhere in this course.

Physical cash remains, despite every technological advance in the layering typologies covered elsewhere in this module, one of the most resilient laundering instruments available, precisely because it leaves no electronic trail until it re-enters the formal financial system, and bulk cash smugglingBulk cash smugglingThe physical cross-border movement of large cash sums, typically by courier, to move illicit proceeds beyond the reach of the originating jurisdiction's financial controls., the physical movement of large cash sums across a border by courier, concealed in vehicles, cargo, or on the person — is the mechanism by which illicit proceeds generated in one jurisdiction are moved to another for either integration or further layering through a jurisdiction with weaker controls. FATF Recommendation 32FATF Recommendation 32The FATF standard requiring jurisdictions to implement a declaration or disclosure regime for cross-border cash and bearer negotiable instrument movements above a threshold. on cash couriers, most recently interpreted through detailed guidance issued alongside the broader FATF standards, requires member jurisdictions to implement either a declaration systemDeclaration systemA cross-border cash control model requiring travellers to proactively declare amounts above a threshold regardless of whether asked, producing a record for every above-threshold movement. or a disclosure systemDisclosure systemA cross-border cash control model requiring travellers to state carried amounts only when directly questioned by customs, relying on officer-initiated interdiction. for cross-border movements of currency and bearer negotiable instruments above a threshold, and the distinction between these two regulatory models matters considerably in practice.

Under a declaration systemDeclaration systemA cross-border cash control model requiring travellers to proactively declare amounts above a threshold regardless of whether asked, producing a record for every above-threshold movement., every traveller carrying cash or bearer instruments above the threshold, commonly USD 10,000 or its equivalent, the figure adopted by South Africa, the United States and most FATF members — must make a written declaration to customs authorities regardless of whether they are asked, and failure to declare is itself an offence even where the funds are entirely legitimate. Under a disclosure systemDisclosure systemA cross-border cash control model requiring travellers to state carried amounts only when directly questioned by customs, relying on officer-initiated interdiction., by contrast, travellers are required to state the amount they are carrying only when asked directly by a customs officer, placing the onus on border authorities to identify and question travellers rather than on travellers to proactively declare. FATF guidance treats both models as compliant provided they achieve equivalent practical effect, but declaration systems are generally regarded as producing more complete and more useful data for FIU analysis, since they generate a paper or electronic record for every cash movement above threshold rather than only for those travellers a customs officer happens to stop, and South Africa's South African Revenue Service customs declaration regime, administered under the Customs and Excise Act alongside the FIC Act's cross-border reporting obligations, follows the declaration model, requiring the South African Reserve Bank's Exchange Control Regulations and SARS Customs to be notified of amounts above the prescribed threshold on both entry and exit.

The practical value of declaration data to a financial intelligence unit is limited by two persistent weaknesses that every ESAAMLG mutual evaluation of the region has flagged in some form. The first is under-declaration and outright non-compliance: a courier caught with undeclared cash faces seizure and, in many jurisdictions, forfeiture proceedings even without proving the specific predicate offence generating the funds, which creates an incentive to attempt concealment rather than accept even a modest risk of detection, and enforcement therefore depends heavily on the second element — border interdiction analyticsBorder interdiction analyticsThe combination of travel-pattern, customs-declaration and FIU data used to risk-score travellers for targeted physical search rather than random selection., rather than on voluntary compliance alone. The second weakness is data quality and system fragmentation: several regional customs administrations still process cash declarations on paper forms that are not digitised, matched against FIU databases, or cross-referenced with the traveller's other border-crossing history, meaning that a courier making repeated smaller trips below the threshold, or declaring accurately but never having that declaration compared against other declarations by the same individual over time, can move very substantial aggregate sums without ever generating an analytically useful pattern.

Border interdiction analyticsBorder interdiction analyticsThe combination of travel-pattern, customs-declaration and FIU data used to risk-score travellers for targeted physical search rather than random selection., where they function well, combine several data streams that individually are unremarkable but collectively produce a strong risk profile: passenger manifest and travel-pattern data (a traveller making frequent short trips to a specific corridor with no plausible business or family reason), customs declaration history matched against known typologies (cash amounts just below the threshold, repeated trips by the same individual or group, inconsistency between declared occupation/income and the cash amount carried), canine and physical search targeting informed by risk-scoring rather than random selection, and increasingly, cooperation with financial intelligence units to check whether a detained courier's identity connects to any prior suspicious transaction report or known predicate investigation. The Egmont Group's secure information-sharing channel between FIUs is particularly valuable here, because bulk cash smugglingBulk cash smugglingThe physical cross-border movement of large cash sums, typically by courier, to move illicit proceeds beyond the reach of the originating jurisdiction's financial controls. is inherently cross-border by definition, and a courier interdicted in one jurisdiction frequently has counterpart activity; either the source deposit or the destination account, visible only to a foreign FIU that the interdicting jurisdiction has no independent means of identifying without a formal or informal information request.

Southern African corridors present specific interdiction challenges that regional training programmes, including work supported by UNODC and the World Bank's Stolen Asset Recovery Initiative, have documented repeatedly: long, porous land borders with limited fixed customs infrastructure at many crossing points, high volumes of legitimate small-scale cross-border trade that provides cover for cash-courier movement, and resource-constrained customs services that must balance interdiction effort against the much larger volume of ordinary trade facilitation they are also responsible for. The realistic policy response, which I encourage officials to internalise rather than resist, is that bulk cash interdiction will never be a comprehensive control on its own; its value lies in raising the cost and risk of physical cash movement enough that criminal networks are pushed toward channels — banking, mobile money, hawala, trade-based settlement — that, whatever their own vulnerabilities, at least generate the kind of transactional data trail this module's other lessons have shown investigators how to exploit.