The FCA's latest multi-firm review, published on 23 September 2026, is significant not for the numbers it puts on money mule activity, though those are striking, but for the conclusion it reaches. In its analysis of how criminal funds actually move through the UK financial system, the FCA states plainly that what regulated firms are seeing is "an established criminal infrastructure rather than isolated or opportunistic misuse."

That single line is worth pausing on. For years, money muling has often been framed publicly as a problem of vulnerable individuals being drawn into low-level crime. The FCA's data tells a more uncomfortable story. Fraud proceeds moving through UK bank accounts are typically cashed out between the second and fifth mule account in a chain. Some accounts have been used repeatedly, across multiple different fraud types. This is not opportunistic. It is coordinated, industrial, and increasingly sophisticated.

The scale supports the point. UK-regulated firms offboarded 238,396 suspected money mule accounts in 2025, up from 184,935 in 2023. Across the three years, more than 656,000 customers have been closed for suspected mule activity. That is not a fringe problem for the sector. That is a systemic one.

For any regulated firm operating in the UK, the operational lesson from the FCA's cash-out analysis is important. Funds moving through the mule network are broken into smaller, less conspicuous payments as they pass through each subsequent account. By the time they reach the fifth account in the chain, they are much harder to identify. This means the tools that catch mule activity earliest are the most effective ones, and firms working in isolation, looking only at what happens inside their own institution, are catching a fraction of the picture.

For years, money muling has often been framed as an opportunistic problem of vulnerable individuals. The FCA's own data now confirms what compliance teams working in the sector have long suspected: this is organised, industrial financial crime infrastructure. The single most important shift regulated firms can make is to stop treating money mule activity as an isolated incident and start treating it as a network to be traced and disrupted.

Our own 2026 UK Compliance Reality Check, based on a survey of 1,000 senior decision-makers across UK regulated sectors, found that 54% of identity verification checks are still being done manually, and 52% of firms struggle to verify beneficial ownership across complex ownership structures. Those two numbers matter here. Manual processes cannot trace a fund chain across 22 firms in a public-private cell, let alone across the wider payments system. Beneficial ownership complexity is exactly what mule networks exploit to obscure their control of accounts that look, on paper, entirely legitimate.

The FCA's own conclusion is that firms should use the information-sharing provisions available under the Economic Crime and Corporate Transparency Act 2023 more actively. That is a call to action worth taking seriously. The infrastructure the FCA describes won't disappear on its own. It will move faster than any single institution can track by itself. The response must be equally coordinated, built on continuous monitoring rather than periodic checks.

The FCA's data confirms what many in compliance already know. The firms that will hold up under increasing scrutiny are the ones that have already moved from onboarding-only verification to continuous monitoring, and that are using every information-sharing lever available to see beyond their own institutional walls.