When business happens in chats, payments happen elsewhere, and the compliance picture becomes harder to see

A customer sees a product on WhatsApp.

They send a message.

The seller replies with a price.

A payment is made through mobile money or a bank transfer.

The seller confirms receipt.

The product is delivered.

There is no website.

No online checkout.

No formal e-commerce platform.

And sometimes, no obvious digital record connecting the conversation, the payment and the underlying commercial transaction.

Welcome to what could be described as the WhatsApp economy.

Across many African markets, business does not always happen through traditional online stores. Small businesses and informal entrepreneurs increasingly use messaging platforms, particularly WhatsApp, alongside mobile money and bank transfers to communicate with customers, promote products and arrange transactions.

This can create enormous opportunities.

But it also creates an important challenge for AML, fraud and compliance professionals:

How do you understand commercial activity when the business relationship begins in a private conversation and the payment happens somewhere else?

The answer is not to treat every informal digital business as suspicious.

The answer is to understand the context.

---

A different model of digital commerce

When people think about digital commerce, they often imagine a familiar model.

A customer visits a website.

They select a product.

They enter payment details.

The platform records the transaction.

There is a clear connection between the merchant, the customer and the purchase.

But commerce does not always work this way.

A small trader may use WhatsApp to:

• Show products
• Communicate with customers
• Receive orders
• Negotiate prices
• Share payment instructions
• Confirm deliveries
• Maintain customer relationships

The payment itself may then happen through:

• Mobile money
• Bank transfer
• Cash
• A payment link
• A digital wallet

The business may therefore be digital without looking like traditional e-commerce.

That distinction matters.

The absence of a website does not mean the absence of a real business.

At the same time, the lack of a conventional commercial trail can make customer and transaction assessment more complicated.

Mobile technology is already deeply connected to African economic activity. GSMA reported that mobile technologies and services contributed an estimated $220 billion to Africa’s economy in 2024, while mobile money increasingly supports business activity, including retail, e-commerce, agriculture and logistics.

---

The WhatsApp economy is not necessarily informal in the way we imagine

It is important to avoid a common mistake.

A business using WhatsApp is not automatically an unregistered or informal business.

A formally registered company may use WhatsApp as its main customer communication channel.

Equally, a very small informal trader may use WhatsApp to run a genuine business.

The platform itself tells us very little about the underlying risk.

The more relevant questions are:

Who is operating the business?

What is being sold?

How are payments received?

Where do the funds come from?

Does the financial activity make sense?

Can the business activity be reasonably understood and verified?

This is where AML professionals need to avoid confusing a lack of traditional digital infrastructure with suspicious activity.

---

Where the AML challenge begins

The difficulty arises because the commercial and financial records may be disconnected.

Imagine this:

A clothing seller receives €5,000 through 40 separate mobile-money payments.

The customer names are different.

The payment references are inconsistent.

Some customers send money directly.

Others pay through friends or relatives.

The seller then transfers most of the funds to a supplier.

From a transaction-monitoring perspective, the activity could appear unusual.

Multiple incoming payments.

Different counterparties.

High transaction frequency.

Rapid movement of funds.

But it could also represent a perfectly legitimate small business.

This is the central challenge:

The transaction pattern alone may not explain the commercial reality behind it.

A traditional rule-based monitoring system could generate an alert.

A human investigation is then needed to understand whether the activity is consistent with the customer’s actual economic circumstances.

---

When legitimate business looks unusual

Consider three businesses.

Business A: The traditional online retailer

It has:

• A website
• Card payments
• Formal invoices
• A registered company
• A business bank account

Business B: The WhatsApp merchant

It has:

• A WhatsApp Business profile
• Mobile-money payments
• A physical shop
• Repeat customers
• Limited formal accounting records

Business C: The informal social seller

It has:

• No website
• No registered company
• A personal mobile-money account
• Hundreds of customer interactions
• Payments from numerous individuals

All three may be selling legitimate products.

But their financial footprints can look completely different.

If an institution applies the same expectations to all three businesses, it may generate unnecessary friction.

The compliance objective should be to understand risk—not simply identify which business looks most familiar.

This is particularly relevant to financial inclusion. FATF has increasingly emphasised proportionate, risk-based approaches that allow financial institutions to consider the realities of underserved customers while still applying appropriate AML/CFT controls.

---

Personal accounts used for business activity

One of the most important risks in informal digital commerce is the use of personal accounts for commercial transactions.

A customer may officially appear to be:

An individual.

But their account activity suggests:

A small business.

For example:

• Frequent incoming payments
• Numerous unrelated counterparties
• Regular transactions during business hours
• Repeated payments of similar amounts
• Regular transfers to suppliers
• Frequent cash withdrawals

The issue is not necessarily that the customer is doing something criminal.

But the institution may have an incomplete understanding of the customer relationship.

The customer’s KYC profile says:

Personal account.

The account behaviour says:

Commercial activity.

That creates a KYC and monitoring gap.

The appropriate response is not always immediate account closure.

It may begin with a simpler question:

Can you help us understand the purpose of this activity?

Sometimes the answer will reveal a legitimate microbusiness.

Sometimes it may reveal an undeclared commercial activity.

And sometimes, it may reveal something more concerning.

---

The difficulty of distinguishing commerce from money movement

This is where the risk becomes more complicated.

Criminals can exploit legitimate-looking payment patterns.

Suppose an account receives:

£100
£80
£150
£120
£90

from multiple individuals.

A legitimate seller may receive exactly this type of pattern.

But so could someone collecting:

• Fraud proceeds
• Payments from victims
• Illegal gambling funds
• Mule-network transfers
• Proceeds of an investment scam

The pattern alone is not enough.

Context becomes essential.

An AML investigator may need to consider:

• The customer’s stated occupation
• Account history
• Payment frequency
• Counterparty relationships
• Geographic patterns
• Communication or supporting information where lawfully available
• Links between transactions
• Evidence of an underlying business
• The ultimate destination of funds

The key question is:

Are these payments consistent with a genuine economic purpose?

---

Mobile money makes the ecosystem even more connected

The WhatsApp economy often does not exist separately from mobile money.

The two can complement each other.

A customer discovers a product through a message.

The seller provides a mobile-money number.

Payment is sent instantly.

The seller confirms the transaction through WhatsApp.

Mobile money is increasingly central to Africa’s wider commercial ecosystem. GSMA reported more than $1.1 trillion in mobile-money transaction value in Sub-Saharan Africa in 2024, with services increasingly supporting retail, enterprise operations and SME activity.

More recently, GSMA reported that global mobile-money transactions exceeded $2 trillion in 2025 and that most new registered and active accounts came from Sub-Saharan Africa.

This growth creates enormous economic opportunities.

But scale also creates more opportunities for abuse.

INTERPOL has warned that organised criminals have exploited weaknesses in identification systems and regulation around mobile-money ecosystems for offences including fraud and money laundering.

The challenge is therefore not whether digital informal commerce should exist.

It already does.

The challenge is how financial institutions can understand it without confusing legitimate economic activity with criminal behaviour.

---

Fraud can hide behind a legitimate-looking sales model

Imagine someone creates a WhatsApp catalogue.

They advertise electronics at attractive prices.

Customers send payments.

The products never arrive.

From the fraudster’s perspective, the model is simple.

Social media or messaging attracts the customer.

A direct payment is requested.

The money moves quickly.

The account may then transfer the funds elsewhere.

The account activity may initially resemble a genuine small business.

Multiple incoming payments.

Different customers.

Similar transaction amounts.

But further analysis may reveal:

• Customer complaints
• Rapid movement of funds
• No evidence of real suppliers
• Frequent changes to payment accounts
• Multiple accounts connected to the same individual
• Unusual device or identity links

This is why fraud and AML teams increasingly need to work together.

The fraud team may identify the victim.

The AML team may identify where the money went.

Neither team necessarily has the complete picture alone.

---

WhatsApp can also be part of the mule economy

The same messaging infrastructure used by legitimate businesses can also be used to recruit money mules.

A message may promise:

• Easy remote work
• A commission for receiving payments
• A job as a “local payment representative”
• Income for allowing temporary use of an account

The individual may then receive funds and transfer them elsewhere.

Again, the transaction pattern may resemble commercial activity.

Multiple incoming payments.

Rapid transfers.

Different counterparties.

The difference may only become visible through broader analysis.

This reinforces an important lesson:

Financial crime rarely exists inside one platform.

The recruitment may happen through messaging.

The payment may happen through mobile money.

The funds may then move through a bank.

A final portion may enter a cryptocurrency platform.

The financial crime investigation must follow the activity across the ecosystem.

---

Why traditional transaction monitoring can struggle

Many traditional monitoring rules were designed around relatively clear expectations.

For example:

Large cash deposit.

Unusual international transfer.

Transaction above a specific threshold.

But informal digital commerce can generate more ambiguous patterns.

A legitimate trader may:

• Receive money from 100 customers
• Use a personal account
• Pay several suppliers
• Move funds rapidly
• Withdraw cash regularly
• Operate across multiple payment channels

A poorly calibrated rule could generate repeated alerts.

The result?

More false positives.

More manual reviews.

And potentially more unnecessary friction for legitimate customers.

This does not mean transaction monitoring rules should be removed.

It means they should be combined with better customer understanding.

A risk-based approach should ask:

Is this unusual for this customer?

not simply:

Does this transaction look unusual in isolation?

---

KYB also needs to adapt

This issue creates a major challenge for business onboarding.

Traditional KYB expectations may look for:

• A website
• Corporate email
• Formal accounts
• Digital business records
• Online marketing

But a small African business may have:

• A physical location
• A registered business
• A mobile phone
• A WhatsApp Business account
• Supplier relationships
• Mobile-money history

The absence of a website should not automatically become a risk conclusion.

The relevant question is whether the business can be reasonably understood and verified through appropriate sources.

This may include:

• Company registration
• Business licences
• Tax information
• Physical premises
• Supplier invoices
• Customer records
• Transaction history
• Beneficial ownership information

The objective is not to make every SME look like a multinational corporation.

It is to establish whether the business is real and whether its financial behaviour makes sense.

---

What should fintechs and financial institutions do?

The answer is not simply to introduce more rules.

A better approach could include several principles.

1. Understand the business model

Ask how the customer actually operates.

Where do customers come from?

How are orders received?

How are payments made?

Who are the suppliers?

2. Distinguish commercial activity from unexplained activity

Multiple incoming payments are not automatically suspicious.

The institution should assess whether there is a credible underlying economic explanation.

3. Connect KYC, KYB and transaction monitoring

The customer profile should not remain frozen after onboarding.

Transaction activity can reveal information that was not visible initially.

4. Avoid digital-footprint bias

A website is useful.

But it is not proof of legitimacy.

And the absence of one is not proof of criminality.

5. Connect fraud and AML intelligence

A suspicious payment may be part of a broader fraud scheme.

Information should not remain isolated between teams.

6. Focus on behaviour over assumptions

The strongest indicators often come from inconsistency.

Does the activity make sense for the customer?

Does the money move in a logical way?

Is the explanation supported by evidence?

---

Final Thoughts

The WhatsApp economy represents something important.

Digital commerce does not always look like traditional e-commerce.

In many cases, business begins with a conversation.

A product is discovered in a chat.

The price is negotiated through a message.

Payment happens through a mobile wallet or bank account.

The transaction is completed offline.

For millions of legitimate businesses, this model is practical, accessible and affordable.

But for compliance professionals, it creates a challenge.

The financial transaction may be visible.

The commercial context behind it may not be.

This means the future of AML cannot depend entirely on whether a customer has the digital footprint we expect.

The better question is:

Can we understand the economic reality behind the transaction?

Because in Africa’s evolving digital economy, a WhatsApp message can be the beginning of a legitimate sale.

It can also be the beginning of a fraud.

The difference may not be visible in the transaction alone.

And that is why effective financial crime prevention will increasingly depend on understanding context, behaviour and the wider ecosystem behind the money.