Ecommerce and Marketplace Risks

1. Why Ecommerce and Marketplace Risks Matter for the CAMS Exam

Ecommerce has become one of the largest and fastest-moving channels for the flow of money worldwide. Trillions of dollars pass through online storefronts, digital marketplaces, payment facilitators and merchant acquirers every year. Wherever money moves quickly, across borders, with limited face-to-face contact and through many intermediaries, criminals follow. For this reason, ACAMS treats ecommerce and online marketplaces as a distinct sector risk within the broader topic of Financial Crime Risks by Sector.

The topic matters for several reasons:

- Scale and speed: Online sales can be set up in hours, operate 24/7 and reach a global customer base. A criminal can create a convincing storefront, process illicit funds and disappear before anyone notices.
- Layered intermediaries: A single online purchase may involve a buyer, a seller, a marketplace operator, a payment facilitator (PayFac), a payment service provider (PSP), an acquiring bank, a card network, an issuing bank and a logistics company. Each layer can obscure who is really paying whom and for what.
- Non-face-to-face relationships: Merchants, buyers and sellers are onboarded remotely, which weakens traditional identity verification and increases the risk of synthetic identities, stolen credentials and straw-man accounts.
- Regulatory focus: FATF, FinCEN, the European Supervisory Authorities, card networks such as Visa and Mastercard, and national regulators have all issued guidance or rules targeting third-party payment processors, merchant acquirers and online platforms. Enforcement actions against acquirers and processors for facilitating illegal online activity are a recurring theme.
- Convergence of fraud and money laundering: Ecommerce is where consumer fraud, cybercrime, counterfeit goods, tax evasion, sanctions evasion and money laundering intersect. The CAMS exam expects you to recognise how proceeds of one crime are laundered through another channel.

2. What Ecommerce and Marketplace Risk Is

Ecommerce refers to the buying and selling of goods and services over the internet, with payment typically made electronically through cards, bank transfers, digital wallets, buy-now-pay-later products or, increasingly, virtual assets.

An online marketplace is a platform operated by a third party that allows multiple independent sellers to list goods or services and transact with buyers. Examples include large general marketplaces, niche craft or secondhand platforms, app stores, gig-economy and freelance platforms, classified-advertising sites, ticket resale sites and peer-to-peer rental platforms.

From an AML perspective, ecommerce and marketplace risk is the risk that these channels are used to:

- Place and layer criminal proceeds by disguising them as legitimate sales revenue.
- Sell illegal or restricted goods (counterfeits, narcotics, weapons, wildlife products, stolen goods, child sexual abuse material, fraudulent documents) while appearing to sell lawful products.
- Move value across borders in a way that evades sanctions, export controls or currency controls.
- Commit and monetise fraud against consumers, merchants, platforms and financial institutions.
- Evade tax by under-reporting or disguising sales.

Key participants and their AML exposure

- Merchant / Seller: May be legitimate, may be a front for illegal activity, or may be an unwitting vehicle for mule activity. The merchant is the primary subject of Know Your Merchant (KYM) or Know Your Business (KYB) due diligence.
- Marketplace operator / Platform: Controls onboarding of sellers, listing rules, dispute resolution and often the payout of funds to sellers. Depending on jurisdiction, the platform may itself be a regulated payment institution or electronic money institution, or may rely on a licensed partner.
- Payment facilitator (PayFac) / Aggregator: Signs up sub-merchants under its own master merchant account with an acquirer. This creates a risk of undisclosed aggregation, where the acquirer cannot see the true underlying merchants.
- Payment service provider / Third-party payment processor (TPPP): Routes transactions, often across several acquirers and networks. FinCEN and other regulators have highlighted TPPPs as a high-risk category because they can insert distance between the bank and the actual merchant.
- Acquiring bank: Holds the merchant account, settles funds and bears card-network and regulatory responsibility for the merchants it sponsors. Acquirers are frequently the obliged entity expected to detect transaction laundering.
- Card networks: Set rules (brand protection programmes, merchant category code requirements, chargeback thresholds) and can fine acquirers for illegal or miscoded merchant activity.
- Issuing bank and cardholder: The source of funds; issuers monitor for stolen card use, account takeover and unusual spending.
- Logistics and fulfilment providers: Shipping records are key evidence in distinguishing real trade from fictitious sales and in detecting sanctions and export-control evasion.

3. How Ecommerce and Marketplace Laundering Works: Core Typologies

3.1 Transaction laundering (also called undisclosed aggregation, factoring or electronic money laundering)
A merchant that has been approved by an acquirer processes card payments on behalf of another, unapproved business. The front merchant appears to sell something innocuous such as clothing, software or consulting, while the real business behind it sells illegal drugs, unlicensed pharmaceuticals, unlicensed gambling, counterfeit goods, adult content or weapons. The illegal operator receives settlement funds through the front merchant, who keeps a commission. Card networks treat this as a serious violation; from an AML standpoint, it is a classic layering technique because illicit proceeds enter the banking system labelled as legitimate retail sales.

3.2 Fictitious sales and self-dealing (sales laundering)
A criminal sets up an online store or marketplace seller account, then uses illicit cash, prepaid cards or mule accounts to buy his own goods or services. No real product is delivered, or a token item is shipped to create a paper trail. The payouts arrive as clean sales revenue. A common red flag is the listing of ordinary items at absurd prices, for example a used book or a digital file priced at several thousand dollars, with a handful of buyers who never complain.

3.3 Shell and front merchants
A criminal incorporates a company, builds a plausible website, opens a merchant account and processes a limited volume of real transactions to establish history before ramping up illicit volume. The beneficial owner is hidden behind nominees or complex ownership structures. Websites may be cloned templates with stock images, no working contact details and products that do not match the declared merchant category code (MCC).

3.4 Counterfeit, stolen and restricted goods
Marketplaces are used to sell counterfeit luxury goods, fake pharmaceuticals, pirated software, stolen electronics, protected wildlife products and dual-use items. The proceeds are predicate-offence proceeds, and the seller payouts constitute money laundering. Listing text may use coded language, misspellings or images to evade keyword filters.

3.5 Carding, triangulation fraud and card testing
Stolen card data is monetised through ecommerce. In triangulation fraud, a fraudster lists a product cheaply on a marketplace, receives payment from a genuine buyer, then orders the product from a legitimate retailer using a stolen card and has it shipped directly to the buyer. The fraudster keeps the clean payment; the retailer suffers the chargeback. In card testing, criminals run many very small transactions through a merchant or donation page to identify which stolen card numbers are still active.

3.6 Refund, chargeback and return abuse
Criminals make a purchase with one payment instrument and request the refund to a different instrument or account, effectively converting illicit funds. Collusive buyer-and-seller pairs may generate deliberate chargebacks or refunds to move value. Excessive refund ratios and refunds exceeding original sales are warning signs.

3.7 Mule and account-takeover schemes
Legitimate seller or buyer accounts are hijacked, or individuals are recruited to open seller accounts and pass on payouts. Changes to payout bank details shortly after onboarding or after a period of dormancy, and payouts directed to third parties unrelated to the seller, are classic indicators.

3.8 Gift cards, vouchers and stored value
Gift cards purchased with illicit funds are resold on marketplaces or used to buy goods for resale, breaking the audit trail. Gift cards are also the preferred payment demanded in many scams, and the proceeds are then laundered through online resale.

3.9 Sanctions and export-control evasion
Goods are purchased online and shipped to intermediaries in third countries for onward delivery to sanctioned jurisdictions or designated persons. Sellers located in high-risk or sanctioned regions may disguise their location using VPNs, foreign payout accounts or nominee sellers. Dual-use goods such as electronic components, drones or specialised software are of particular concern.

3.10 Human trafficking, exploitation and illegal services
Classified-advertising and gig platforms can be used to advertise sexual services, forced labour or fraudulent job offers. Payments for these services, and the laundering of their proceeds, may pass through platform payment systems.

3.11 Tax evasion and under-reporting
Sellers split activity across multiple accounts, use foreign payout accounts or deliberately miscode products to avoid VAT, sales tax or income tax. Many jurisdictions now impose reporting obligations on platforms specifically to counter this.

3.12 Darknet marketplaces
Although hidden from the surface web, darknet markets rely on the same laundering concept: proceeds, usually in virtual assets, are eventually converted and may be injected into legitimate ecommerce or exchanged for goods that are resold online.

4. How the Controls Work: Managing Ecommerce and Marketplace Risk

4.1 Risk-based approach
Institutions must assess inherent risk by merchant type, product, geography, delivery channel and customer base. Higher-risk categories (gambling, pharmaceuticals, adult content, nutraceuticals, travel, virtual assets, firearms-related products, debt collection, high-ticket digital goods) warrant enhanced due diligence and closer monitoring. The exam consistently rewards answers that apply a risk-based approach rather than blanket prohibition or blanket acceptance.

4.2 Know Your Merchant / Know Your Business
- Verify legal existence, registration, licences and beneficial ownership.
- Verify the principals and screen them against sanctions, PEP and adverse-media lists.
- Review the website or storefront: does it exist, is it functional, does the product range match the stated business and MCC, are terms and conditions, refund policies and contact details present, is the domain registration consistent with the stated owner?
- Establish expected activity: projected monthly volume, average ticket size, customer geography, delivery timeframes and refund expectations.
- Conduct test purchases or use website-crawling tools where justified.
- For PayFacs and aggregators, require visibility of sub-merchants and periodic sub-merchant data.

4.3 Ongoing monitoring
- Compare actual volume and ticket size with onboarding projections.
- Monitor chargeback and refund ratios against card-network thresholds and peer benchmarks.
- Flag velocity anomalies such as sudden spikes, round-number transactions, repetitive identical amounts, or transactions clustered just below thresholds.
- Detect geographic mismatches between seller location, buyer location, shipping address, IP address and payout account country.
- Review payout changes, especially new beneficiary accounts in different names or jurisdictions.
- Re-crawl websites periodically to detect content changes, hidden pages or redirection to undisclosed sites.
- Monitor for related accounts sharing devices, IP addresses, bank accounts, phone numbers or addresses.

4.4 Sanctions screening
Screen sellers, buyers where available, payout beneficiaries, shipping destinations and logistics counterparties. Pay attention to geolocation data, shipping to free-trade zones or transshipment hubs, and goods that are export controlled.

4.5 Governance and cooperation
- Written policies for merchant acceptance, prohibited business lists, high-risk categories and exit criteria.
- Clear allocation of AML responsibility between platform, PayFac, PSP and acquirer, documented in contracts.
- Information sharing with law enforcement, card networks and, where legally permitted, other institutions.
- Suspicious activity reporting on merchants and sellers, not just on retail customers; and strict adherence to tipping-off prohibitions when exiting or investigating a merchant.
- Training for merchant underwriting, risk and operations staff on ecommerce-specific red flags.

5. Red Flags to Memorise

- Website content does not match the declared business or MCC.
- Products priced far above or below market value with few or no customer reviews.
- Sales volumes inconsistent with the size, age or web traffic of the business.
- Very high or very low refund and chargeback ratios relative to peers.
- Many transactions of identical or round amounts, or many tiny transactions in a short period (card testing).
- Buyer, seller and shipping locations in different jurisdictions without commercial logic, or in high-risk jurisdictions.
- Payouts requested to third-party accounts, to accounts in a different country from the seller, or to accounts changed shortly after onboarding.
- Multiple seller accounts linked by shared bank accounts, devices, IP addresses or contact details.
- Merchant reluctant to provide beneficial ownership, licences or proof of inventory.
- Rapid growth immediately after approval, especially after a quiet initial period.
- Use of templated or cloned websites, non-functioning contact details, or recently registered domains with privacy protection.
- Listings for ordinary goods using coded words, misspellings or image-only descriptions.
- Shipping records that do not exist or do not match transaction volumes (fictitious sales).
- Merchant in a prohibited or restricted category trying to classify itself under a low-risk MCC.

6. Regulatory and Industry Context

- FATF guidance on new payment products and services, virtual assets and the risk-based approach for payment institutions emphasises that non-face-to-face onboarding and cross-border reach are high-risk factors.
- FinCEN advisories identify third-party payment processors and merchant acquirers as potential conduits for fraud proceeds, and money services business registration applies to many payment intermediaries in the United States.
- EU payment and electronic money legislation, together with the AML Directives and the newer AML Regulation framework, brings many platforms and PSPs within scope as obliged entities, while platform tax-reporting rules require reporting of seller income.
- Card network rules require acquirers to know their merchants, to code them correctly and to prevent illegal transactions; networks impose fines and can terminate acquirers for repeated violations.
- Several high-profile enforcement cases have involved acquirers and processors fined for knowingly or negligently processing payments for illegal online pharmacies, unlicensed gambling, fraudulent telemarketing and transaction-laundering schemes. The exam does not require case names, but it does expect you to recognise the lesson: the regulated institution is responsible for the merchants and sub-merchants it brings onto the payment system.

7. Exam Tips: Answering Questions on Ecommerce and Marketplace Risks

Tip 1: Identify the typology first. Read the scenario and ask: is this transaction laundering, fictitious sales, counterfeit goods, carding, refund abuse, mule activity or sanctions evasion? Once you name the typology, the correct red flag or control usually becomes obvious.

Tip 2: Know who the obliged party is. Questions often describe an acquirer, PayFac or PSP. Remember that the acquirer carries responsibility for its merchants and sub-merchants, and a PayFac cannot hide undisclosed aggregation behind a master account. If the question asks who should perform due diligence, the answer is normally the institution that onboarded and settles funds to the merchant.

Tip 3: Choose the risk-based answer. Options that say refuse all online merchants or accept all merchants with standard checks are almost always wrong. Look for the option that applies enhanced due diligence, website review and ongoing monitoring proportionate to the risk.

Tip 4: Mismatch is the strongest red flag. When asked which indicator is MOST suspicious, prioritise mismatches: website versus MCC, volume versus business size, price versus market value, seller location versus payout account location, sales versus shipping records. Mismatch between stated and actual activity is the heart of ecommerce laundering.

Tip 5: Separate fraud from money laundering, but see the link. A stolen-card purchase is fraud; the sale of the resulting goods and the payout of proceeds is money laundering. If the question asks about the laundering element, focus on how proceeds move and are disguised, not on the initial theft.

Tip 6: Remember the correct escalation path. When a compliance officer identifies a suspicious merchant, the expected sequence is: gather and review information, document findings, escalate internally, file a suspicious activity report if warranted, consider exit or restriction, and never tip off the merchant. Options involving confronting the merchant with the suspicion, or closing the account before investigating, are distractors.

Tip 7: Watch for the absurd-price clue. Scenarios describing cheap items sold at very high prices with a small number of repeat buyers are signalling fictitious sales or self-dealing. Do not be distracted by the fact that the goods were technically shipped.

Tip 8: Payout changes equal risk. Any option mentioning a change of payout account to a third party, a different name or a different country shortly after onboarding should be treated as a high-priority indicator of mule activity or account takeover.

Tip 9: Use elimination. CAMS questions typically contain one clearly wrong option, one partially correct option, one plausible but secondary option and one best option. Eliminate anything that ignores beneficial ownership, ignores ongoing monitoring, or treats a single transaction type as proof of innocence.

Tip 10: Read the qualifier. Words such as MOST, BEST, FIRST and LEAST change the answer. For a FIRST step, think investigation and information gathering; for a BEST control, think the one that addresses the root cause (for example, website and MCC verification for transaction laundering rather than merely lowering a transaction limit).

8. Practice Question

An acquiring bank onboards an online retailer declaring sales of handmade candles with an expected monthly volume of 20,000 dollars. Within two months the merchant processes 600,000 dollars per month, the average ticket is 1,900 dollars, chargebacks are near zero, and most cardholders are located in a jurisdiction with no apparent connection to the merchant. The merchant has requested that settlements be redirected to a newly opened account in a different country in the name of a different company. Which action should the compliance officer take FIRST?

A. Immediately close the merchant account and notify the merchant of the suspicion.
B. Approve the payout redirection because chargebacks are low, indicating satisfied customers.
C. Review the merchant website, compare actual activity with onboarding projections, obtain shipping and inventory evidence, and escalate for a suspicious activity report determination.
D. Increase the chargeback threshold so the merchant can continue to grow.

Correct answer: C. The scenario shows multiple mismatches (volume, ticket size, geography, payout beneficiary) consistent with transaction laundering or fictitious sales. The FIRST step is investigation and escalation, not termination with notification (which risks tipping off) and certainly not approval of the suspicious change. Low chargebacks are not reassuring when buyers may be the launderer himself.

9. One-Page Summary

- Ecommerce and marketplaces are high-risk because of speed, scale, remote onboarding and multiple intermediaries.
- Core typologies: transaction laundering, fictitious sales, shell merchants, counterfeit and restricted goods, carding and triangulation, refund abuse, mules and account takeover, gift cards, sanctions evasion, human trafficking, tax evasion.
- Core controls: risk-based Know Your Merchant, website and MCC verification, beneficial ownership, sanctions screening, ongoing monitoring of volume, ticket size, geography, refunds and payouts, governance between platform, PayFac, PSP and acquirer, SAR filing without tipping off.
- Exam mindset: name the typology, identify the obliged party, prefer the risk-based option, treat mismatches and payout changes as the strongest red flags, and follow the investigate-escalate-report sequence.