Card-based Money Laundering: Are Issuers Seeing the Transactions but Missing the Connections?

An issuer can have good customer data, established transaction monitoring and experienced investigators. It can still be missing part of the picture.

Its customers’ card activity may form part of a wider pattern involving cards issued by other institutions. Each issuer sees its own activity, but the connections between those transactions may only become apparent when viewed across the network.

That creates a practical challenge for financial crime teams: how do you identify potentially suspicious behaviour when some of the context sits outside your organisation?

In a recent LinkedIn recent post, I used a cash machine example to explain why this matters.

An individual issuer might see one of its cards used at cash machines say three times in a day. Depending on the customer, the amounts and their usual behaviour, that may not look particularly unusual.

A wider network view could show that 20 cards, issued by different institutions, have each been used at the same small group of cash machines several times that day.

The transactions have not changed... but the context has!

That wider pattern does not prove money laundering. But it gives an investigator a reason to ask questions that might never arise from looking at one card in isolation.

The challenge extends beyond cash withdrawals

Similar visibility challenges can arise across online gambling, digital merchants and marketplaces.

Consider these two illustrative scenarios.

Gambling and digital merchants - Repeated low-value payments are made across online gambling and digital entertainment merchants using numerous prepaid and debit cards.

For an individual issuer, the activity on its cards may provide little reason for concern. Across the wider network, however, similar spending patterns involving many cards at a common group of merchants could warrant investigation.

If activity is deliberately fragmented across cards and institutions, each issuer may only see a small part of a potentially coordinated pattern.

The wider connections can change how that activity should be assessed.

Online marketplaces - A second scenario involves repeated low-value purchases and refunds across online marketplaces.

An issuer may see what appears to be ordinary consumer activity on a small number of cards. Viewed across multiple issuers, recurring connections between cards and merchants, combined with similar purchase and refund patterns, could raise different questions.

Is the activity consistent with legitimate spending? Are the same patterns recurring across a wider group of cards? Does the customer information held by the issuer support what is happening?

There may be legitimate explanations in both scenarios. The value of the additional context is that it helps investigators decide where to look and what to examine.

Good monitoring depends on the information available

Issuers bring essential knowledge to an investigation. They understand their customers, the purpose of their accounts and the activity taking place across their own systems.

However, that internal view has boundaries.

Existing monitoring may identify repeated withdrawals, unusual spending or changes in customer behaviour. Recognising that those transactions form part of a wider pattern across institutions requires additional information.

This is where network intelligence can help.

Financial crime teams also need to manage the operational consequences. Additional notifications need to provide enough value to justify the time spent reviewing them.

The objective should be to identify potentially higher-risk activity and give investigators a better basis for prioritising their work.

Where Mastercard AML Account Risk fits

Mastercard’s AML Account Risk capability is designed to help issuers identify and prioritise potential card-based money laundering by drawing on activity across the Mastercard network.

It monitors approved authorisation transactions processed through that network and uses AI and machine learning to assess patterns associated with potential money laundering.

Activity is assessed over time and aggregated at the individual card account number level, known as the primary account number, or PAN. Cards exceeding the relevant risk thresholds are flagged for review.

Issuers can receive risk-scored notifications with supporting transaction information to help their teams assess whether further investigation is warranted.

This gives investigators a practical starting point: potentially higher-risk cards, prioritised for review, with information to support their assessment.

The scope is very important. The capability draws on transactions processed through the Mastercard network. The issuer then brings its own customer knowledge and wider account information to the investigation.

A risk score still needs investigative judgement

A higher risk score indicates that activity deserves further attention. The issuer must still assess what happened and whether it makes sense for that customer.

An investigator can consider the supporting transactions alongside the customer’s profile, expected behaviour, source of funds and other relevant information held internally.

They can also establish whether existing monitoring identified the same activity.

An overlap may provide additional context for an investigation already under way. Activity that was not identified internally may highlight an opportunity to review existing monitoring coverage.

In either case, the intelligence becomes more useful when assessed alongside what the issuer already knows.

AML Account Risk complements existing controls and supports investigative judgement. Responsibility for assessing the activity and deciding what action to take remains with the issuer.

Access to intelligence is only the beginning

For firms considering the capability, the operating model deserves as much attention as the technology.

Who owns the notifications? How will they be prioritised alongside existing cases? What happens when a card has already triggered an internal alert? What information must an analyst review before closing or escalating a case?

AML Account Risk provides a user interface and an API, giving issuers options for accessing the intelligence and incorporating it into their workflows.

Whichever approach is chosen, firms need clear ownership, investigation standards, escalation routes and records of the decisions made.

They also need a way to measure whether the capability is adding value.

Useful measures could include:

• Additional cases identified as worthy of investigation.
• Overlap with existing transaction monitoring.
• Time taken to triage and assess notifications.
• Gaps identified in current monitoring and opportunities to improve coverage.

Establishing a baseline helps firms assess the contribution of the additional intelligence and make informed decisions about how it should be used.

Turning wider visibility into value

The issuer’s customer knowledge and Mastercard’s network perspective bring different information to the same problem.

Together, they can help financial crime teams assess card activity with a fuller understanding of the potential risk.

At Brighter Consultancy, we help firms work through what this means in practice: assessing where the capability could add value, defining ownership and workflows, supporting adoption and agreeing how improvement will be measured.

If you would like to explore what Mastercard AML Account Risk could mean for your organisation, please get in touch.