FinCrime Africa

The hidden financial crime risks of embedded finance, payment aggregators and bank-fintech partnerships in Africa.

A customer downloads a fintech application, opens an account and starts making payments.

The experience feels simple. The customer interacts with one brand, uses one application and expects one financial service.

But behind the scenes, several organisations may be involved.

A fintech company may manage the customer interface. A licensed bank may provide the underlying account. A payment processor may handle transactions, while another provider supplies the technology, customer verification or fraud monitoring.

From the customer’s perspective, this is one service.

From an AML perspective, it can be a much more complicated arrangement.

Who identifies the customer? Who verifies the beneficial owner? Who monitors the transactions? Who investigates suspicious activity? And who is responsible when information held by one organisation is not available to another?

These questions are becoming increasingly relevant as African financial services move towards partnerships, payment aggregation and embedded finance.

The problem is not necessarily that nobody has AML responsibilities. It is that responsibilities can become fragmented across several organisations.

1. The customer sees one service. The financial system sees several entities.

Embedded finance allows financial services to be integrated into platforms that are not traditionally banks.

For example, a customer might access payments, credit or a digital wallet through an e-commerce platform, telecommunications company or financial technology provider.

The underlying financial infrastructure may be supplied by a regulated bank or another licensed institution.

Payment aggregators create a similar challenge. They connect merchants, payment service providers, banks and other financial institutions, sometimes across several jurisdictions.

The International Monetary Fund’s 2025 paper, Digital Payment Innovations in Sub-Saharan Africa, describes the role of payment aggregators in connecting financial service providers to local payment infrastructure and cross-border networks.

These arrangements can improve access, reduce costs and make financial services available to customers who have traditionally been underserved.

But they also introduce additional relationships that financial crime teams need to understand.

The AML risk assessment cannot stop at the organisation whose logo appears on the customer’s screen.

2. The responsibility gap

Consider a hypothetical arrangement involving three organisations:

• Fintech A: owns the application and manages the customer relationship.
• Bank B: provides the regulated account and holds customer funds.
• Processor C: processes payments and provides transaction infrastructure.

Each organisation may hold different information.

Fintech A knows how the customer registered and interacts with the platform.

Bank B holds account information and may have access to the wider financial activity.

Processor C sees payment instructions, transaction references and merchant relationships.

The problem emerges when these organisations do not have a sufficiently clear understanding of one another’s responsibilities.

For example:

A customer is onboarded through the fintech application. The identity checks are completed by an external provider. The bank receives customer information, but limited information about the customer’s expected activity. The payment processor sees transactions moving through the system, but does not have access to the customer’s full risk profile.

An unusual transaction pattern develops.

Each organisation may see part of the activity, but nobody initially has the complete picture.

This is not simply a technology problem. It is a governance and AML control problem.

3. Who is actually the customer?

One of the first questions should be whether each organisation understands the customer relationship it is responsible for.

A fintech platform may describe someone as its customer, while the bank providing the underlying account has a separate contractual and regulatory relationship.

A payment processor may also have a direct relationship with a merchant, while the bank sees the processor as its immediate business partner.

These distinctions matter.

A financial institution should understand the nature of the arrangement, the parties involved, the products being provided and the relevant customer and merchant relationships.

The Financial Action Task Force’s standards allow certain forms of reliance on third parties for customer due diligence, subject to specific conditions.

However, reliance is not the same as transferring accountability. Under FATF Recommendation 17, the financial institution relying on a third party remains ultimately responsible for customer identification and verification requirements.

For AML professionals, this raises practical questions:

• Is the third party appropriately regulated and supervised?
• Can customer identification information be obtained without delay?
• Are supporting documents accessible when required?
• Does the institution understand the third party’s verification process?
• Are responsibilities documented clearly?
• Can the institution conduct ongoing monitoring effectively?

A contractual agreement alone does not demonstrate that these controls work in practice.

4. The merchant problem: knowing the platform is not enough

Payment aggregation introduces another important challenge.

A bank may establish a relationship with a payment aggregator that processes transactions for hundreds or thousands of merchants.

The bank may have completed due diligence on the aggregator.

But does it understand the businesses operating underneath that relationship?

Imagine a payment aggregator processing transactions for:

• Online retailers;
• Digital service providers;
• Subscription businesses;
• International merchants;
• Small businesses operating across several markets.

The aggregator’s business may be legitimate, but individual merchants could present very different financial crime risks.

A merchant might suddenly experience a substantial increase in transaction volumes, receive payments from unexpected jurisdictions or generate a high level of customer complaints and refunds.

If the aggregator does not perform appropriate merchant due diligence and ongoing monitoring, these developments may not be identified in time.

This is particularly relevant where nested relationships exist: one payment intermediary processes transactions for another intermediary, which in turn serves the underlying merchant.

The more layers involved, the more important it becomes to understand who the ultimate merchants are and how their activity is monitored.

5. When transaction monitoring becomes fragmented

Traditional transaction monitoring often focuses on the activity visible within a particular institution.

However, fintech partnerships can distribute information across several systems.

Consider this hypothetical example:

A merchant receives a large number of payments through a fintech platform.

The payments are processed by an aggregator and settled through a sponsoring bank.

Over several weeks:

• Transaction volumes increase significantly.
• Payments originate from unexpected customer locations.
• Refund activity rises.
• Funds are transferred rapidly between accounts.
• The merchant changes its settlement arrangements.

The fintech may recognise the change in customer behaviour.

The aggregator may see unusual payment patterns across merchants.

The bank may observe the settlement flows.

But if the relevant information is not shared, each organisation may interpret the activity differently.

This is why monitoring arrangements should consider the complete payment relationship, rather than only the transactions visible to one participant.

It is also important to distinguish between an unusual pattern and actual suspicion. Increased activity, international payments or higher refund volumes are not automatically evidence of money laundering.

They require investigation in context.

6. Africa’s regulatory landscape is evolving

These questions are not purely theoretical.

African regulators are increasingly addressing the changing structure of payment services and the participation of non-bank providers.

On 23 June 2026, the South African Reserve Bank announced work towards a coordinated regulatory approach for cross-border payment facilitators.

The announcement highlighted the growth of arrangements in which payment transactions are aggregated and acquired in South Africa for offshore merchants.

It also identified the importance of applying regulatory requirements consistently and reducing opportunities for regulatory arbitrage.

This is a particularly interesting development because it illustrates how payment business models can evolve faster than existing regulatory categories.

The broader African context is also important.

The IMF’s 2025 research identifies substantial differences in digital payment development across sub-Saharan African countries. It highlights the opportunities created by digital payments, alongside challenges involving infrastructure, institutional capacity and regulatory frameworks.

There is no single African embedded-finance model, and regulatory requirements differ between jurisdictions.

For compliance professionals working across multiple markets, understanding the local regulatory position is therefore essential.

7. What should AML teams actually do?

The solution is not to assume that every fintech partnership creates unacceptable risk.

Partnerships can be legitimate, commercially valuable and beneficial for financial inclusion.

The objective is to ensure that the AML framework reflects how the service actually operates.

There are several practical areas worth examining.

1. Map the complete relationship

Identify the regulated institution, fintech provider, processor, payment aggregator, merchants and relevant subcontractors.

Understand where customer information is collected, where funds are held and which organisation performs each activity.

2. Establish clear responsibilities

Document who performs customer identification, verification, beneficial ownership checks, transaction monitoring, investigations and suspicious activity reporting.

Avoid vague contractual language that leaves important responsibilities unclear.

3. Assess third parties properly

Due diligence should cover ownership, licensing, governance, AML controls, technology, information security and the ability to provide relevant information.

The level of scrutiny should reflect the nature and risk of the relationship.

4. Ensure access to information

The institution responsible for AML compliance should be able to obtain relevant customer and transaction information when necessary.

This includes supporting documents, merchant information, beneficial ownership details and investigation records.

5. Monitor the relationship continuously

Due diligence should not end when the partnership is signed.

Changes in business activity, customer profiles, geographical exposure, transaction volumes and subcontracting arrangements may alter the original risk assessment.

6. Test the arrangements

Compliance teams should periodically test whether the agreed controls actually work.

For example, can an institution obtain the underlying merchant information quickly? Can it reconstruct a suspicious transaction? Can it identify who made the relevant decision?

These are practical questions that reveal weaknesses that may not be visible in a policy document.

Final thoughts

Fintech partnerships are changing how financial services are delivered across Africa.

They allow organisations to combine banking infrastructure, technology, payment processing and customer-facing platforms in ways that would have been much more difficult to achieve in the past.

But innovation also creates new dependencies.

A customer may interact with one organisation, while their funds and financial information move through several others.

For AML professionals, understanding these relationships is becoming just as important as understanding the customer or the transaction itself.

The key question should not simply be whether each organisation has an AML policy.

It should be whether the entire arrangement works as a coherent financial crime control framework.

Because when several organisations participate in one financial service, the risk does not necessarily sit with just one of them. And neither should the investigation.