Money mule detection built for personal accounts misses the corporate version. A corporate mule is a company, often newly formed or dormant, used to move illicit funds through a business account where large and varied flows look normal. Catching it needs scenarios tuned to business behaviour, not the pass-through rules written for individuals.
This is a live supervisory concern, not a hypothetical. In October 2026 a regional regulator flagged a measured rise in corporate mule accounts and took enforcement action over missing and late suspicious transaction reports, so examiners are now asking how business accounts are monitored.
This guide is written for heads of AML and monitoring leads at banks, digital banks and e-money issuers growing their SME, merchant and business-wallet books, who need scenarios that fit corporate behaviour.
What is a corporate mule account?
It is a company account used to receive and move criminal proceeds, exploiting the fact that a business is expected to have high and varied transaction volumes.
A personal mule account stands out because an individual's pass-through activity breaks a simple profile. A company does not offer that contrast. Large inbound and outbound flows, many counterparties and round-number transfers are ordinary for a trading business, and that cover is the point. At BNM's DNFBP Compliance Conference on 22 October 2026, Deputy Governor Marzunisham Omar called corporate mules an emerging risk, citing National Fraud Portal data showing a rise in corporate mule accounts and criminal networks exploiting corporate entities to conceal illicit flows. The money-mule definition itself is broad: Republic Act 12010, the Anti-Financial Account Scamming Act, covers a person who opens or uses an account to move illicit funds, and a company is a person in law.
Why do personal-account rules miss corporate mules?
Because they test a single customer's behaviour against an individual profile, and a business profile absorbs the same behaviour without tripping an alert.
Three assumptions behind personal-account monitoring break for companies. Pass-through value that would be unusual for a salaried individual is expected for a trading company, so a flat velocity rule produces either noise or silence. A single account is assumed to represent a single actor, but one network can control several shell companies with shared directors or addresses. And onboarding is assumed to settle identity, when a corporate customer's real risk sits in its ownership and the intermediary that formed it. Monitoring that does not aggregate across related entities, and does not reach back to the onboarding record, will treat each shell as a clean customer. Our transaction monitoring guide covers the aggregation principle that corporate scenarios depend on.
Which scenarios catch a corporate mule?
Scenarios built around incorporation age, pass-through behaviour, related-entity overlap, and turnover that does not match the declared business.
Six scenarios cover most corporate mule behaviour. Each needs thresholds taken from your own portfolio and tested above and below the line.
Newly incorporated, fast pass-through. A recently registered company receives and forwards value soon after onboarding, holding little balance.
Many unrelated payers into one business wallet. A merchant or business account collects from numerous unconnected individuals, inconsistent with its stated model.
Dormant company that wakes up. An inactive entity suddenly processes significant volume.
Shared identifiers across entities. Several companies share directors, addresses, devices or contact details.
Turnover inconsistent with the declared business. Flows far exceed, or do not match, the nature and scale the customer described.
Round-tripping between related accounts. Value cycles between companies under common control with no clear economic purpose.
The behaviours in our money-mule scenario library still apply, but these corporate variants add the entity and ownership dimension that personal scenarios leave out. Each one needs calibration, as our guide to threshold tuning describes.
What role does onboarding play?
A large part of corporate mule risk is set at onboarding, where know-your-business checks, beneficial ownership and the introducer relationship decide what monitoring later has to work with.
Monitoring can only use what onboarding captured. For a corporate customer, that means the beneficial owners behind the entity, the nature and expected scale of the business, and how much the bank relied on the agent or intermediary that formed or introduced the company. A shell set up to launder funds often has clean-looking paperwork and a thin real presence, so the signals are in the ownership pattern and the introducer concentration, not the certificate of incorporation. This is why identity verification does not settle due diligence, a point our piece on why identity verification is not KYC makes, and why digital banks onboarding business accounts at speed should expect the same examiner questions, as our digital bank AML guide covers.
What does the enforcement signal mean for reporting?
That supervisors are treating missing and late suspicious transaction reports on business customers as an enforcement matter in their own right.
The October 2026 enforcement actions turned on failures to file suspicious transaction reports and on due diligence deficiencies, not only on the underlying laundering. The read-across for a BSP-supervised institution is direct: a corporate mule detected late, or detected and not reported on time, is itself a finding. In the Philippines, the suspicious transaction report is due the next working day from the determination of suspicion, a clock our STR versus CTR guide sets out. A monitoring programme that catches the corporate mule but cannot file on time has solved only half the problem.
How should a lean team add corporate scenarios without adding noise?
Segment business accounts from personal ones, aggregate by related entity, and calibrate each corporate scenario against closed outcomes.
A team of five to fifteen cannot run a second full rule set by hand. Three moves keep it manageable. Segment the portfolio so corporate customers are judged against a business baseline, not a personal one. Aggregate across entities that share directors, addresses or devices, so a network of shells is investigated as one case. And calibrate each corporate scenario against closed-case outcomes, retiring the variants that only produce false positives. The vendor questions that bear on business-account monitoring are in our AML software buyer's guide.
How does Fyscal ARCX support corporate mule detection?
Fyscal ARCX lets a compliance team build and run business-account scenarios without an engineering ticket. In Transaction Monitoring, the team defines its own variables, such as the sum, count or average of an attribute over a window, segments thresholds by customer type so corporate and personal accounts are judged separately, and tests a scenario against historical data before activation. Related alerts consolidate into one case per customer, so a network of connected entities is investigated together, and Regulatory Reporting tracks the filing deadline once suspicion is determined.