{ "moduleCode": "IFF609", "title": "Cash, informal value transfer and mobile money", "levelCode": "L-02", "levelName": "Layering", "nqf": 6, "credits": 15, "notionalHours": 150, "lessons": [ { "id": "l2m5-1", "title": "Cash-intensive businesses and commingling", "readingMinutes": 30, "objectives": [ "Distinguish genuine cash intensity from commingling as a laundering technique.", "Reconstruct plausible turnover from physical capacity indicators to test declared business income.", "Explain how structuring defeats threshold-based cash transaction reporting under the FIC Act.", "Assess why cross-referencing tax, banking and trade records exposes fronts that any single record conceals." ], "keyTakeaways": [ "Cash intensity alone is not a red flag; commingling of illicit cash with genuine takings is the laundering act.", "Indirect capacity checks, long used in ordinary SARS estimated assessments, transfer directly into front-business investigations.", "Structuring through networks of smurfed deposits is designed specifically to defeat threshold-triggered reporting under the FIC Act." ], "keyTerms": [ { "term": "Commingling", "definition": "Mixing illicit cash with a legitimate business's genuine takings so the two streams become indistinguishable once banked." }, { "term": "Structuring (smurfing)", "definition": "Breaking large cash sums into multiple deposits below reporting thresholds, often across several accounts or depositors, to avoid triggering mandatory reports." }, { "term": "Capacity check", "definition": "An indirect audit method reconstructing plausible turnover from a business's physical inputs (space, stock, staff-hours) to test declared revenue." }, { "term": "Cash threshold report (CTR)", "definition": "A mandatory report filed by an accountable institution under the FIC Act for cash transactions above a prescribed value, regardless of suspicion." }, { "term": "Front business", "definition": "An operating enterprise, often with genuine trade, used principally to give illicit cash a plausible declared source." } ] }, { "id": "l2m5-2", "title": "Hawala and other informal value transfer systems", "readingMinutes": 30, "objectives": [ "Explain the settlement mechanics of hawala and distinguish the retail remittance leg from the net settlement leg.", "Assess the legitimate remittance function of informal value transfer systems in de-risked corridors.", "Reconstruct the logical steps required to decode a seized hawaladar ledger.", "Evaluate the FATF Recommendation 14 MVTS registration model against enforcement realities in diaspora communities." ], "keyTakeaways": [ "Hawala's core mechanic is trust-based instruction and periodic net settlement, not physical cross-border movement of individual remittances.", "Formal-sector de-risking of Somali and other fragile-state remittance corridors has increased reliance on informal channels rather than reduced it.", "Hawaladars frequently settle net positions through trade invoices, causing hawala and trade-based laundering investigations to converge at the settlement layer.", "FATF Recommendation 14 pushes MVTS registration, but enforcement against unregistered hawaladars in diaspora communities remains a persistent capability gap." ], "keyTerms": [ { "term": "Hawala", "definition": "A trust-based informal value transfer system in which value is settled through instructions between counterpart brokers rather than physical movement of funds per transaction." }, { "term": "Net settlement", "definition": "The periodic reconciliation of reciprocal obligations between two hawaladars, often via trade invoices, compensating bank transfers or bulk cash." }, { "term": "Money or value transfer service (MVTS)", "definition": "The FATF Recommendation 14 category covering both formal money transfer operators and informal value transfer networks like hawala." }, { "term": "Trade-based settlement", "definition": "Using mispriced or fictitious trade invoices between associated trading entities to transfer the net settlement value owed between hawaladars." }, { "term": "Ledger reconstruction", "definition": "The forensic process of decoding a hawaladar's compressed transaction notation to identify counterparties, balances and settlement events." } ] }, { "id": "l2m5-3", "title": "Mobile money and agent networks in Africa", "readingMinutes": 32, "objectives": [ "Explain the cash-in/cash-out agent model and why it constitutes the principal AML vulnerability in mobile money.", "Evaluate the trade-off tiered-KYC regimes strike between financial inclusion and laundering risk.", "Distinguish SIM-swap account takeover from mule-account recruitment as layering techniques.", "Assess regional regulatory convergence on agent oversight and identify the remaining supervisory capacity gap." ], "keyTakeaways": [ "Mobile money's agent network, not the mobile network operator's head office, is where most real-world KYC failure occurs.", "Tiered KYC is a deliberate and largely justified inclusion-risk trade-off, not a regulatory loophole.", "SIM-swap fraud and mule-account recruitment are distinct techniques that both exploit weak agent-level identity verification.", "Supervisory capacity, not regulatory design, is the binding constraint on effective agent-network oversight across most ESAAMLG member states." ], "keyTerms": [ { "term": "Cash-in/cash-out (CICO)", "definition": "The agent-mediated conversion between physical cash and electronic mobile money value that anchors the entire mobile money model." }, { "term": "Tiered KYC", "definition": "A regulatory design permitting minimal identification for low-value accounts and progressively fuller verification as balance or transaction limits rise." }, { "term": "SIM-swap fraud", "definition": "Fraudulently obtaining a replacement SIM card for a victim's number to seize control of accounts and authentication channels tied to it." }, { "term": "Mule account", "definition": "An account, often registered by or coerced from an unwitting individual, used to receive and rapidly disperse illicit funds across several transaction hops." }, { "term": "Agent-level KYC failure", "definition": "Breakdown of identity verification at the point of account registration or transaction, typically at commission-incentivised retail agents rather than at the operator's head office." } ] }, { "id": "l2m5-4", "title": "Cash couriers, bulk cash smuggling and cross-border declaration regimes", "readingMinutes": 29, "objectives": [ "Distinguish declaration and disclosure regimes under FATF Recommendation 32 and assess their relative analytical value.", "Explain how South Africa's SARS customs declaration model integrates with the FIC Act's cross-border reporting obligations.", "Evaluate the data-quality and enforcement weaknesses that limit the usefulness of cash declaration data to FIUs.", "Construct a border interdiction risk-scoring approach combining multiple independent data streams." ], "keyTakeaways": [ "Declaration systems generally produce more complete FIU-usable data than disclosure systems, though FATF treats both as compliant if practically equivalent.", "Under-declaration incentives mean voluntary compliance alone cannot be relied upon; interdiction analytics must carry the enforcement burden.", "Fragmented, non-digitised customs data across the region undermines pattern detection against repeat couriers moving sums below the threshold." ], "keyTerms": [ { "term": "Bulk cash smuggling", "definition": "The physical cross-border movement of large cash sums, typically by courier, to move illicit proceeds beyond the reach of the originating jurisdiction's financial controls." }, { "term": "Declaration system", "definition": "A cross-border cash control model requiring travellers to proactively declare amounts above a threshold regardless of whether asked, producing a record for every above-threshold movement." }, { "term": "Disclosure system", "definition": "A cross-border cash control model requiring travellers to state carried amounts only when directly questioned by customs, relying on officer-initiated interdiction." }, { "term": "FATF Recommendation 32", "definition": "The FATF standard requiring jurisdictions to implement a declaration or disclosure regime for cross-border cash and bearer negotiable instrument movements above a threshold." }, { "term": "Border interdiction analytics", "definition": "The combination of travel-pattern, customs-declaration and FIU data used to risk-score travellers for targeted physical search rather than random selection." } ] } ], "caseStudy": { "title": "The taxi-rank remittance chain", "jurisdiction": "Composite, Southern African corridor", "summary": "A composite investigation traces proceeds from a cross-border smuggling operation as they move through a chain of a spaza-shop front, an unregistered hawaladar, and a mobile money agent network before a courier is interdicted attempting to carry the final settlement across a land border.", "facts": [ "A spaza shop with declared monthly turnover of R180,000 shows stock purchases and floor capacity consistent with roughly R60,000 in genuine trade.", "The shop's owner makes structured cash deposits across four accounts held by family members, each below the FIC Act cash threshold.", "A portion of the excess cash is handed to an unregistered hawaladar operating from a nearby cellphone repair kiosk, who instructs a counterpart in a neighbouring country to pay a beneficiary in local currency.", "The hawaladar settles his net position partly through an under-invoiced consignment of secondhand clothing shipped to his counterpart's associated trading company.", "A separate portion of funds is layered through twelve mobile money accounts registered using photocopied identity documents obtained from a compromised network agent, before being cashed out at three different agents in a border town.", "A courier is stopped at a land border crossing carrying undeclared cash equivalent to USD 42,000, having made six similar crossings in the preceding four months according to passport stamps." ], "investigativeQuestions": [ "What capacity-check evidence would establish that the spaza shop's declared turnover is inconsistent with its physical throughput?", "What corroborating evidence would you seek to confirm the structured deposits originate from a common source rather than independent family income?", "How would you use the under-invoiced clothing shipment to establish the hawala settlement leg evidentially?", "What agent-level indicators at the compromised mobile money kiosk should have triggered a suspicious transaction report before the twelve accounts were used?", "What information would you request from a foreign FIU via the Egmont Group channel regarding the interdicted courier's prior six crossings?" ], "learningPoints": [ "A single laundering scheme can move value sequentially through commingling, hawala, mobile money and bulk cash channels, each covered by a different regulatory regime.", "Capacity checks and structured-deposit analysis at the front-business stage can interdict a scheme before it reaches the harder-to-trace informal and mobile channels.", "Trade mispricing frequently underlies hawala net settlement and should be investigated jointly with customs and trade-finance data.", "Cross-border FIU cooperation is essential once value moves into bulk cash or informal settlement channels that generate no domestic electronic record." ] }, "quiz": [ { "number": 1, "type": "multiple_choice", "points": 1, "question": "What converts a legitimate cash-intensive business into a laundering vehicle?", "options": [ "High customer volume", "Commingling illicit cash with genuine takings", "Operating without a trading licence", "Accepting only cash payments" ], "correctIndex": 1, "correctAnswer": "Commingling illicit cash with genuine takings", "rationale": "Cash intensity alone is normal for many legitimate businesses; commingling illicit funds with genuine turnover is the specific laundering act." }, { "number": 2, "type": "multiple_choice", "points": 1, "question": "Which South African statutory provision underpins the indirect capacity-check estimated assessment method?", "options": [ "Companies Act 71/2008 s.7", "Tax Administration Act 28/2011 s.95", "POCA 121/1998 s.4", "FIC Act 38/2001 s.29" ], "correctIndex": 1, "correctAnswer": "Tax Administration Act 28/2011 s.95", "rationale": "Section 95 of the Tax Administration Act provides the statutory basis for estimated assessments used in indirect audit methods." }, { "number": 3, "type": "multiple_choice", "points": 1, "question": "In a hawala transaction, at what point does value actually cross the border?", "options": [ "At the moment the customer pays the originating hawaladar", "It never crosses individually; only the periodic net settlement between hawaladars does", "When the beneficiary collects payment", "Simultaneously with the customer's payment via SWIFT" ], "correctIndex": 1, "correctAnswer": "It never crosses individually; only the periodic net settlement between hawaladars does", "rationale": "Individual hawala transactions are settled locally on each side; only the net position between hawaladars is periodically settled, often via trade or compensating transfers." }, { "number": 4, "type": "multiple_choice", "points": 1, "question": "Why did major banks' withdrawal from Somali money-service business accounts in the early-to-mid 2010s concern the World Bank and Oxfam?", "options": [ "It reduced bank profitability", "It risked cutting off a remittance flow exceeding Somalia's combined aid and FDI", "It violated FATF Recommendation 16", "It increased hawala transaction fees only marginally" ], "correctIndex": 1, "correctAnswer": "It risked cutting off a remittance flow exceeding Somalia's combined aid and FDI", "rationale": "The World Bank and Oxfam warned that de-risking Somali MSBs threatened a remittance channel larger than the country's combined foreign aid and investment inflows." }, { "number": 5, "type": "multiple_choice", "points": 1, "question": "What is the primary AML vulnerability in the mobile money agent model?", "options": [ "Excessive head-office compliance staffing", "KYC enforcement occurring at commission-incentivised retail agents rather than centrally", "Mandatory biometric registration", "Overly restrictive balance caps" ], "correctIndex": 1, "correctAnswer": "KYC enforcement occurring at commission-incentivised retail agents rather than centrally", "rationale": "Agents, working on thin margins under volume pressure, are the weakest KYC enforcement point, since most customer-facing verification happens at agent level." }, { "number": 6, "type": "multiple_choice", "points": 1, "question": "SIM-swap fraud is significant for laundering typologies primarily because it allows:", "options": [ "Direct manipulation of SWIFT messages", "Seizure of control over mobile money and authentication channels tied to a victim's number", "Bypassing customs declaration thresholds", "Falsification of trade invoices" ], "correctIndex": 1, "correctAnswer": "Seizure of control over mobile money and authentication channels tied to a victim's number", "rationale": "SIM-swap fraud gives an attacker control of accounts and one-time-password channels tied to the victim's number, enabling mule-account layering." }, { "number": 7, "type": "multiple_choice", "points": 1, "question": "What is the key practical difference between a declaration system and a disclosure system under FATF Recommendation 32?", "options": [ "Declaration systems apply only to bearer instruments", "Declaration systems require proactive traveller reporting above a threshold; disclosure systems require reporting only when asked", "Disclosure systems generate more complete FIU data", "There is no meaningful difference recognised by FATF" ], "correctIndex": 1, "correctAnswer": "Declaration systems require proactive traveller reporting above a threshold; disclosure systems require reporting only when asked", "rationale": "Declaration systems place the reporting onus on travellers regardless of questioning, generally producing more complete data than officer-initiated disclosure systems." }, { "number": 8, "type": "multiple_choice", "points": 1, "question": "What cash threshold do South Africa, the US and most FATF members commonly apply to cross-border declaration requirements?", "options": [ "USD 1,000", "USD 5,000", "USD 10,000", "USD 50,000" ], "correctIndex": 2, "correctAnswer": "USD 10,000", "rationale": "USD 10,000 or its equivalent is the threshold most commonly adopted across FATF member jurisdictions for cross-border cash declaration." }, { "number": 9, "type": "multiple_choice", "points": 1, "question": "Why does bulk cash smuggling interdiction have inherent limits as a standalone control?", "options": [ "It is prohibited under UNTOC", "Non-declaration incentives and fragmented customs data mean voluntary compliance and detection alone cannot capture most flows", "FATF Recommendation 32 discourages physical searches", "Cash is no longer used by criminal networks" ], "correctIndex": 1, "correctAnswer": "Non-declaration incentives and fragmented customs data mean voluntary compliance and detection alone cannot capture most flows", "rationale": "Under-declaration incentives and fragmented, non-digitised customs data limit both voluntary compliance and pattern-based detection." }, { "number": 10, "type": "multiple_choice", "points": 1, "question": "What channel does the Egmont Group provide that is particularly valuable in bulk cash courier investigations?", "options": [ "A public cash-declaration database", "A secure FIU-to-FIU information-sharing network for cross-border source/destination tracing", "A centralized customs enforcement authority", "A standardized cash threshold across all member states" ], "correctIndex": 1, "correctAnswer": "A secure FIU-to-FIU information-sharing network for cross-border source/destination tracing", "rationale": "The Egmont Group's secure channel allows FIUs to trace counterpart source or destination activity invisible to the interdicting jurisdiction alone." } ], "essayPrompts": [ { "number": 1, "prompt": "Argue whether tiered-KYC regimes for mobile money strike the correct balance between financial inclusion and laundering risk, drawing on at least one specific regional regulatory framework.", "wordGuide": "1200-1500", "weightingPercent": 30 }, { "number": 2, "prompt": "Assess whether hawala should be regarded primarily as a laundering vulnerability or as a legitimate financial-inclusion mechanism that AML policy has systematically undervalued.", "wordGuide": "1200-1500", "weightingPercent": 30 }, { "number": 3, "prompt": "Evaluate whether declaration-based cross-border cash reporting regimes meaningfully outperform disclosure-based regimes given the data-quality weaknesses documented across the Southern African region.", "wordGuide": "1200-1500", "weightingPercent": 30 }, { "number": 4, "prompt": "To what extent can capacity-check audit methods developed for ordinary tax enforcement be relied upon as primary evidence, rather than merely investigative leads, in laundering prosecutions involving front businesses?", "wordGuide": "1200-1500", "weightingPercent": 30 } ], "assignment": { "prompt": "Produce an 1,800–2,200 word investigative memorandum, addressed to a hypothetical FIU director, analysing a composite case in which a cash-intensive front business, an informal value transfer arrangement and a mobile money agent network are suspected of jointly laundering the proceeds of a cross-border predicate offence of your choosing. The memorandum must include a capacity-check analysis of the front business with supporting calculations, an assessment of what evidence would be needed to reconstruct the informal settlement leg, an evaluation of the mobile money agent-level red flags present, and a prioritised set of investigative steps and information requests (including at least one Egmont Group or mutual legal assistance request) with a justified sequencing rationale.", "wordGuide": "2000-2500", "weightingPercent": 35 }, "rubric": { "criteria": [ { "criterion": "Legal and regulatory accuracy", "weight": 25 }, { "criterion": "Typology and mechanism analysis", "weight": 25 }, { "criterion": "Evidence and application to the facts", "weight": 20 }, { "criterion": "Investigative or policy judgement", "weight": 15 }, { "criterion": "Structure, referencing and professional expression", "weight": 15 } ], "bands": [ { "band": "Distinction", "range": "75-100" }, { "band": "Meritorious", "range": "65-74" }, { "band": "Competent", "range": "50-64" }, { "band": "Marginal", "range": "40-49" }, { "band": "Not competent", "range": "0-39" } ], "subMinimum": "40% in the assignment component" }, "exportedAt": "2026-08-14T13:05:13.196Z" }