FATF's November 2026 report maps the money flow behind Southeast Asian scam compounds, from setup and recruitment to the payment window, layering and cash-out. A bank or e-money issuer cannot see the compound, but it can see three stages: the victim's payment, the mule receipt, and the off-ramp to virtual assets. Those are where fraud and AML controls catch it.
The stage names below come from FATF's report and from regulatory coverage of it; the FATF page did not render for direct citation, so confirm the exact stage labels and figures against the report before quoting them. The Philippines is not named in the coverage reviewed.
This guide is for heads of AML, fraud leads and monitoring teams at banks and EMIs. It maps scam-compound flows to the scenarios their own systems can fire on.
What did the FATF scam-compound report find?
That scam compounds run an end-to-end operation, from setting up and recruiting workers to acquiring victims and laundering the proceeds, with virtual assets as a central channel.
The FATF report, published on 6 November 2026, traces the full financial flow behind cyber-enabled fraud run from compounds in Southeast Asia. AML Intelligence's coverage reports that people from at least 80 jurisdictions have been identified working in these compounds, and that social media drives the early stages. Regulatory coverage describes the money side in stages: setup, worker recruitment, victim acquisition, the payment window, layering, and cash-out and reinvestment. Virtual assets are named as a central laundering channel, with over-the-counter desks operating inside compounds. This matters to a Philippine institution because it sits on the payment rails the proceeds cross, a point our post on scam compounds and money mules develops.
Which stages can a financial institution actually see?
Three: the victim's outbound payment, the mule account that receives it, and the conversion point where funds leave for virtual assets or another rail.
The early stages happen outside the financial system. Setting up a compound, recruiting workers and grooming victims through social media leave no trace in a bank's data. The institution's visibility begins at the payment window, when the victim sends money. It continues through the mule layer, where the proceeds are received and moved on, and it ends at the off-ramp, where value converts to crypto or cash. A control programme should concentrate on those three, because effort spent trying to detect the ungovernable early stages is wasted. The transaction monitoring guide covers the aggregation that the mule stage needs.
What can you see at the payment window?
The victim's own outbound transfer, which often breaks the victim's normal pattern and moves fast on an instant rail.
FATF's report notes that illicit funds can leave the financial system within minutes of the victim paying. Victims take around 20 hours on average to realise they have been scammed, according to regulatory coverage. That gap is the problem. The payment leaves before anyone reports the fraud. The signals sit on the paying side. A customer who has never sent large instant transfers suddenly moves funds to a new payee, often after a change of device or a recent contact-detail update, over InstaPay, PESONet or QR Ph. This is where fraud and AML monitoring overlap, because the same transfer is both a fraud loss and the first visible step of laundering. AFASA already requires real-time fraud monitoring and a short transaction pause after key account changes, which is the control that can hold a payment in that window.
What can you see at the mule stage?
Accounts that receive proceeds from many victims and pass them on, with the fan-in, fan-out signature a single-transaction rule misses.
The mule account is the clearest view a receiving institution gets. Proceeds from several victims arrive, then leave quickly to one or two onward accounts or an off-ramp. A rule written on individual transactions will clear each transfer on its own and miss the shape. The control is aggregation: count or sum of inbound transfers from distinct senders over a rolling window, checked against outbound concentration, which our money mule scenario library sets out in rule form. A mule account used for scam proceeds is a reportable suspicion. The money-mule offence under the Anti-Financial Account Scamming Act makes the receiving side a focus, as our digital bank AML guide describes.
What can you see at the off-ramp?
The conversion of funds to virtual assets or cash, where a VASP, an EMI or a cash-out agent is the last regulated point before the money disappears.
FATF names virtual assets as a central channel and reports over-the-counter desks inside the compounds themselves. For an institution, the off-ramp is the last chance to act. A bank funding a crypto purchase, a VASP receiving a transfer, or an EMI processing an agent cash-out sits at the exit. The signals are rapid movement from a receiving account to a VASP or exchange, structured cash-outs across agents, and counterparties that match published scam or sanctions data. This is also where proliferation-financing and sanctions screening meets fraud, because some proceeds move through the same crypto infrastructure as sanctioned flows.
Why is this a fraud and AML problem at once?
Because the victim's payment is a fraud event and a laundering step at the same time, so FRAML, the convergence of fraud and AML, is the operating model that catches it.
Treating fraud and AML as separate queues loses the connection between a scam loss and the mule network that absorbs it. The difference between fraud and AML is one of vantage, not of data: fraud looks at the victim losing money, AML at the proceeds moving. The same transaction sits in both views. A converged approach lets a fraud alert on an outbound payment inform the monitoring of the account that receives it, and lets a mule pattern surface the victims upstream. FATF's principles call for acting inside the 24-to-72-hour window after a scam is detected, which only a joined-up team can meet. Our comparison of rules-based and AI monitoring covers the detection layer this needs.
What should a team build against this flow?
Scenarios tuned to the three visible stages, a shared view across fraud and AML, and a case record that can move inside FATF's freeze window.
Four priorities follow. First, build payment-window scenarios that compare an outbound transfer with the customer's own history and flag breaks tied to recent account changes. Second, run aggregation scenarios for the mule stage, segmented by customer type. Third, watch the off-ramp for rapid movement to VASPs and structured cash-outs, screened against published lists. Fourth, hold fraud and AML signals in one case per customer so the connection is visible and a freeze or report can be actioned fast. Each scenario needs thresholds taken from your own data and tested above and below the line, as our guide to threshold tuning sets out.
How does Fyscal ARCX support this?
Fyscal ARCX lets a team build monitoring scenarios for each visible stage against its own data and hold the result in one case per customer. A compliance team defines its own variables, such as inbound sender counts, time-to-off-ramp or payee-change flags, and tests them against historical data before activation. One case per customer keeps the fraud signal, the mule pattern and the screening hit together, with a timestamped trail for a freeze or report. Named parties and counterparties are screened against sanctions and watchlists, and Regulatory Reporting tracks the suspicious transaction report deadline.
Frequently asked questions
- Combating Illicit Financial Flows Linked to Scam Compounds, Financial Action Task Force, 6 November 2026 (page did not render; stage labels confirmed via secondary coverage)
- Landmark FATF report outlines how social media enables scam compounds, AML Intelligence, 5 November 2026
- FATF report traces scam-compound money flows, identifies virtual assets as primary laundering channel, Fintech Garden, 6 November 2026
- AML roundup, 6 November 2026: FATF sets principles for disrupting scam-compound proceeds, KYC360, 6 November 2026