Introduction
For an AML investigator, a transaction alert is often designed to make you uncomfortable.
A customer receives multiple payments from different individuals. Money enters an account and leaves shortly afterwards. Cash deposits appear regularly. A small business receives transfers from several countries. A customer with no traditional payslip suddenly shows significant account activity.
On a monitoring system, these patterns can look suspicious.
But in many African markets, they can also be completely normal.
This creates one of the most difficult challenges for AML teams operating across Africa: how do you distinguish genuine financial crime from legitimate financial behaviour that simply does not fit the assumptions built into conventional transaction-monitoring models?
The answer is not to lower AML standards.
It is to understand the context behind the transactions.
The FATF has increasingly recognised that AML controls need to be proportionate and risk-based, particularly where financial exclusion and informal economies are significant. Its 2025 guidance explicitly highlights the importance of avoiding unnecessary exclusion from the formal financial system.
For investigators, this means one thing: an unusual transaction is not automatically a suspicious transaction.
The problem with the “European customer” template
Many transaction-monitoring scenarios are designed around assumptions that work reasonably well in highly formalised economies.
A customer receives a salary from one employer.
They pay rent through a bank transfer.
They use a debit card for everyday purchases.
Their income is relatively predictable.
Their financial activity is concentrated around their country of residence.
That customer profile is useful — but it does not describe everyone.
Consider a market where a person may combine several sources of income:
- a formal salary;
- income from a small shop;
- agricultural activity;
- freelance work;
- family contributions;
- remittances from relatives abroad;
- mobile-money payments;
- occasional cash-based trading.
The resulting transaction history can look chaotic.
But chaotic does not necessarily mean criminal.
The FATF specifically notes that informal economies, cash usage and informal financial services are important contextual factors when assessing money-laundering risks. It also warns that inappropriate AML controls can contribute to financial exclusion and push activity towards less regulated channels.
This is where the investigator’s judgement becomes critical.
When multiple senders are perfectly normal
One of the simplest examples is an account receiving money from many different individuals.
A monitoring system may interpret this as potential structuring, mule activity or an unexplained source of funds.
But imagine the customer is a small business owner.
Customers pay them directly.
A relative abroad occasionally sends money.
Friends contribute to a community event.
A family member sends money to cover household expenses.
The customer also operates a side business.
Suddenly, twenty incoming payments from fifteen people no longer look quite as mysterious.
The key question is not:
“Why are there so many senders?”
It is:
“What relationship does the customer have with these senders, and does the overall activity make economic sense?”
That distinction is fundamental.
Remittances can create misleading alerts
Cross-border transfers are another area where context matters.
African economies have significant remittance flows, and money-transfer services play an important role in financial inclusion. The FATF recognises that money or value transfer services are important to international finance and financial inclusion, while also acknowledging their vulnerability to misuse.
For an investigator, a customer receiving several international payments can therefore represent very different scenarios.
It could be:
- legitimate family support;
- payment for goods or services;
- diaspora income;
- educational expenses;
- medical or household support;
- a genuine remittance business.
Or it could be money laundering.
The transaction itself does not provide the answer.
The investigator needs to consider the customer’s occupation, geography, relationships, expected activity, transaction purpose and behaviour over time.
A €300 transfer from a relative may be completely ordinary for one customer and completely unexplained for another.
Cash is not automatically a red flag
Cash creates another difficult situation.
In many AML environments, repeated or substantial cash deposits naturally attract attention.
And they should.
Cash can reduce transparency and create opportunities for criminals to introduce illicit proceeds into the financial system.
But cash can also be an ordinary part of legitimate economic activity.
A market trader, restaurant owner, taxi operator, small retailer or agricultural trader may legitimately handle significant amounts of cash.
The investigator should therefore avoid the simplistic conclusion:
Cash = suspicious.
A better question is:
Does the customer’s business model reasonably generate this level and pattern of cash activity?
The FATF’s work on informal economies specifically highlights the importance of understanding how cash and informal economic activity function within a particular country rather than applying assumptions without considering local context.
The mobile-money challenge
Africa’s financial ecosystem also makes traditional banking assumptions increasingly problematic.
Mobile money has transformed how millions of people send, receive and store value.
A customer may have transactions involving agents, merchants, wallets, banks and other individuals without having the conventional banking footprint an investigator might expect.
This creates an interesting paradox.
The same transaction pattern can be a sign of financial inclusion or financial crime depending on the context.
A rapid movement of funds through several wallets could indicate layering.
But it could also reflect the normal operation of a small merchant or mobile-money agent.
A high volume of low-value transfers could indicate mule activity.
Or it could simply be the customer’s business.
FATF guidance on financial inclusion recognises digital financial services, including mobile-based services, as important tools for bringing underserved populations into regulated finance. It also highlights technologies such as digital identity and transaction analytics as tools that can strengthen AML controls.
The challenge is therefore not to monitor less.
It is to monitor more intelligently.
The danger of false positives
False positives are not just an operational inconvenience.
They can have real consequences.
If legitimate African customers are repeatedly flagged because their financial behaviour does not resemble the behaviour expected by a monitoring model, institutions may begin to restrict accounts, reject customers or terminate relationships.
That can become a form of unintended de-risking.
And there is a wider problem.
If legitimate customers cannot access formal financial services, they may increasingly rely on cash or informal channels — precisely the environments where financial transparency can be weaker.
FATF has explicitly recognised this problem, noting that financial exclusion can push activity towards unregulated channels and potentially undermine AML objectives.
In other words, an AML system can become counterproductive if it treats legitimate difference as suspicious behaviour.
So, what should investigators actually do?
The solution is not complicated, but it requires discipline.
1. Start with the customer, not the alert
Before analysing individual transactions, understand who the customer is.
What do they do?
Where do they live?
What is their occupation?
What businesses do they operate?
What countries are connected to their economic activity?
What level of financial activity would reasonably be expected?
The transaction-monitoring alert is only the starting point.
2. Understand the local economic environment
A pattern that looks unusual from London, Paris or Madrid may be completely normal in Lagos, Accra, Dakar or Nairobi.
Investigators working with African customers need to understand local payment practices, informal businesses, remittances, mobile money, community financing and cash-based commerce.
This does not mean accepting every explanation.
It means asking better questions.
3. Look for inconsistencies, not simply unusual activity
Unusual does not equal suspicious.
What should concern an investigator is unexplained inconsistency.
For example:
A customer claims to be a salaried employee but receives millions through unrelated commercial accounts.
A small retailer reports modest turnover but suddenly receives large international transfers unrelated to its business.
A customer claims family remittances but cannot explain why the same funds repeatedly move through unrelated third parties.
These patterns deserve deeper investigation because the activity does not fit the customer’s stated profile.
4. Combine transaction data with other information
Transaction monitoring becomes much stronger when combined with KYC, customer communications, adverse media, sanctions screening, geographic information and previous investigations.
One transaction rarely tells the full story.
A pattern over six or twelve months can tell you much more.
5. Document the rationale
Perhaps the most important skill is documenting why an apparently unusual pattern is legitimate.
If an investigator closes an alert because the customer is a legitimate trader receiving payments from customers, that rationale should be recorded.
Likewise, if the explanation does not make economic sense, that should be documented.
Good AML is not simply about generating SARs or STRs.
It is about producing defensible decisions.
The investigator’s real dilemma
The difficult part of AML investigations in Africa is that investigators often operate between two risks.
On one side:
Under-investigation can allow criminals to exploit informal economies, mobile-money networks, remittance channels and cash-intensive businesses.
On the other:
Over-investigation can turn ordinary economic behaviour into a permanent source of false positives and unnecessary account restrictions.
Neither approach is good enough.
The answer lies in a genuinely risk-based approach.
That means understanding that a street trader, a salaried professional, a mobile-money agent and a multinational company will naturally produce very different transaction patterns.
Their financial behaviour should not be expected to look the same.
Conclusion
Africa does not need weaker AML controls.
It needs better-contextualised AML controls.
The investigator’s job is not to prove that a transaction looks unusual.
The job is to determine whether the activity is consistent with the customer’s circumstances, economic reality and known source of funds — and whether there are indicators that suggest criminality.
That distinction becomes increasingly important as African economies become more digital, mobile and financially connected.
The strongest AML investigator is therefore not necessarily the one who generates the most alerts.
It is the one who can look at an unusual pattern and ask:
“Is this suspicious because it is criminal — or simply because I do not yet understand the customer’s economic reality?”
That question can be the difference between effective financial crime prevention and simply filtering out customers who do not fit the model.
Leave a Reply