BA003 · Correspondent Banking

Mule Accounts

A mule account is a personal account used purely as a pass-through point: it receives illicit funds from one or more originators and forwards them onward almost immediately, retaining little or nothing for itself. It is the personal-account mirror of BA002 Funnel Accounts — where funnelling hides behind volume and dispersion on the collection side, muling hides behind an individual's identity and a thin personal-banking profile, moving money at a controller's instruction rather than the account holder's own initiative.

The finding lives in four places: how closely outbound funds track inbound funds (near-zero retention), how recently the account was opened relative to when the illicit flows begin, how far the account's throughput departs from the holder's declared income or profile, and whether the account shares a device or downstream beneficiary with other accounts already known to be mules.

Risk indicators

Pass-through Ratio

• Outbound transfers landing within hours or days of the matching inbound funds
• Balance held on the account never accumulating despite regular large inflows

Account Youth

• Account opened in the weeks immediately before illicit flows begin
• No prior transaction history consistent with genuine personal banking

Behavioural Mismatch

• Monthly throughput many multiples of the declared salary or stated income
• Transaction profile inconsistent with the account holder's declared occupation

Network Linkage

• Shared device or IP address with other accounts already flagged as mules
• Shared downstream beneficiary or forwarding destination across multiple accounts
• A controller instructing multiple, apparently unrelated account holders

Investigation actions

1. Resolve the mule account, its originators, its controller, and its forwarding destination.
2. Compute the pass-through ratio (total outbound / total inbound funds).
3. Compute the account's age in days since opening.
4. Compute the behavioural mismatch ratio (monthly throughput / declared monthly income).
5. Count the shared-device/shared-beneficiary links to other known mule accounts.
6. Score each of the four components against its band cut-lines.
7. Aggregate the weighted exposure score; escalate at or above the threshold.

Detection logic

1. Resolve the mule account, its originators, its controller, and its forwarding destination. 2. Compute the pass-through ratio (total outbound / total inbound funds). 3. Compute the account's age in days since opening. 4. Compute the behavioural mismatch ratio (monthly throughput / declared monthly income). 5. Count the shared-device/shared-beneficiary links to other known mule accounts. 6. Score each of the four components against its band cut-lines. 7. Aggregate the weighted exposure score; escalate at or above the threshold.

Related typologies

Curated from fc-06-correspondent-banking-analytics-toolkit/typologies/BA003_Mule_Accounts.md