Payment Service Providers and E-Money

1. Why This Topic Matters

Payment Service Providers (PSPs) and electronic money (e-money) sit at the heart of the modern payments landscape. Billions of transactions each year move through digital wallets, prepaid cards, mobile money platforms and third-party payment processors rather than through traditional bank accounts. For an anti-money laundering (AML) professional this is significant for three reasons:

- Speed and reach: Funds can be loaded, moved across borders and cashed out in minutes, compressing the placement, layering and integration stages into a very short window.
- Reduced face-to-face contact: Many products are onboarded online or through agents, weakening identity verification compared with a branch-based bank relationship.
- Regulatory focus: The Financial Action Task Force (FATF), FinCEN, the European Banking Authority and other bodies have issued specific guidance on new payment products and services (NPPS), and the ACAMS CAMS examination treats this as a core element of the Financial Crime Risks by Sector domain.

In the exam you will be expected to recognise the typical vulnerabilities of these products, know which controls mitigate them, identify red flags, and apply a risk-based approach. This guide covers all of that and then explains how to tackle the question styles you are likely to meet.

2. What Are Payment Service Providers and E-Money?

Payment Service Providers (PSPs) are non-bank (and sometimes bank-affiliated) entities that enable the transfer of value between payers and payees. They include:
- Online payment platforms and digital wallets (for example PayPal-style services).
- Third-party payment processors (TPPPs) that process card and ACH payments on behalf of merchants.
- Payment gateways and merchant acquirers.
- Money or value transfer services that operate through digital channels.
- Mobile network operators offering mobile money (for example M-Pesa-type services).

E-money is monetary value stored electronically, issued on receipt of funds, and accepted as a means of payment by parties other than the issuer. Common forms include:
- Prepaid cards (also called stored value cards). These may be open-loop (network-branded, usable anywhere the card scheme is accepted, often reloadable and ATM-enabled) or closed-loop (usable only with a specific merchant or group, such as a gift card).
- Digital wallets holding a balance that can be spent online or in store.
- Mobile money accounts linked to a phone number, heavily used in emerging markets for remittances and bill payments.
- Payroll, travel, government benefit and general purpose reloadable (GPR) cards.

In the European Union, issuers are typically licensed as Electronic Money Institutions (EMIs) under the E-Money Directive and payment institutions under the Payment Services Directive (PSD2). In the United States, many PSPs and prepaid programme managers are regulated as Money Services Businesses (MSBs) by FinCEN and must register, implement an AML programme and file Suspicious Activity Reports. FinCEN's 2011 Prepaid Access Rule specifically brought providers and sellers of prepaid access within the Bank Secrecy Act framework.

3. How These Products Work

Understanding the mechanics helps you see where criminals exploit gaps.

Typical prepaid card value chain:
- Issuer (usually a bank) holds the pooled funds.
- Programme manager designs and markets the card, often handling customer onboarding.
- Distributor or seller (retailers, kiosks, agents) sells and loads cards.
- Processor authorises and settles transactions.
- Card network provides acceptance.
Because responsibility is spread across several parties, a frequent weakness is the assumption that someone else is doing the know-your-customer (KYC) work.

Typical digital wallet or PSP flow:
- Customer registers online, often with minimal information for low-value accounts.
- Funds are loaded via bank transfer, card, cash at an agent, or peer-to-peer transfer.
- Value is transferred to other users, merchants or withdrawn to a bank account or at an ATM.
- Many providers operate tiered KYC: low limits with light verification, higher limits once full identification is completed.

Third-party payment processors: TPPPs aggregate payments for multiple merchants and settle through a single bank relationship. The bank therefore sees the processor as its customer and may have limited visibility of the underlying merchants, creating a form of nested relationship similar to the correspondent banking concept.

Mobile money: Agents (often small shops) perform cash-in and cash-out. The network operator may not be a traditional financial institution, and agent supervision is a key control point.

4. Money Laundering and Terrorist Financing Risks

FATF's 2013 Guidance for a Risk-Based Approach to Prepaid Cards, Mobile Payments and Internet-Based Payment Services identifies the following risk factors. Memorise these; they appear repeatedly in exam questions.

- Anonymity: Weak or absent identity verification, especially for low-value or closed-loop products, allows criminals to hold value without being identified. Cards can be purchased with cash and given to third parties.
- Non-face-to-face onboarding: Online registration makes it easier to use false or stolen identities and synthetic identities.
- Speed and cross-border reach: Value loaded in one country can be withdrawn at an ATM in another almost instantly, bypassing cash declaration requirements. Prepaid cards are portable alternatives to bulk cash smuggling.
- Segmentation and structuring: Criminals buy many cards or open many wallets, each below reporting or verification thresholds (smurfing), then consolidate.
- Funding methods: Cash loading and funding from other anonymous instruments (such as other prepaid cards or virtual assets) heighten risk; funding only from a verified bank account lowers it.
- Reloadability and unlimited value: Reloadable open-loop cards with high or no limits are far riskier than single-load, low-value closed-loop cards.
- ATM and cash access: Products that permit cash withdrawal enable the final integration or cash-out step.
- Agent and distributor risk: Agents may be poorly trained, complicit, or insufficiently supervised, and may conduct cash transactions on behalf of unidentified customers.
- Fragmented responsibility: Multiple parties in the value chain can lead to gaps in CDD, record keeping and suspicious activity reporting.
- Nested and TPPP risk: Banks servicing processors may not know the underlying merchants, which may include illegal online gambling, unlicensed pharmaceuticals, fraud rings or sanctioned parties.
- Use in specific crimes: Prepaid cards and wallets are heavily used in tax refund fraud, romance scams, ransomware payments, human trafficking (paying for advertisements and travel), drug trafficking proceeds, and terrorist financing for low-value operational funding.

5. Key Red Flags

- Purchase of multiple prepaid cards in a single visit or across several nearby locations, especially with cash and just below thresholds.
- Rapid loading followed by immediate ATM withdrawals, particularly in a different country from where the card was loaded.
- Numerous wallets linked to the same device, IP address, email domain or phone number.
- Accounts receiving many small peer-to-peer payments from unrelated senders, then consolidated and withdrawn (funnel activity).
- Customers reluctant to provide identification or who abandon onboarding when asked for verification documents.
- Agents whose cash-in volumes are inconsistent with the local economy or who process transactions outside business hours.
- Merchants under a TPPP with high chargeback rates, inconsistent business descriptions, or activity inconsistent with their stated industry.
- Use of the product in high-risk jurisdictions or in patterns consistent with sanctions evasion.
- Card loads funded by other prepaid cards, money orders or virtual assets rather than bank accounts.

6. Controls and Mitigation

The CAMS exam emphasises the risk-based approach. Controls should be proportionate to the product's risk profile.

Customer due diligence:
- Verify identity at onboarding, with enhanced due diligence for high-value, reloadable or cash-accessible products.
- Tiered KYC with hard limits on value, velocity and functionality until full verification is completed.
- Electronic identity verification, document authentication, device fingerprinting and biometric checks for non-face-to-face channels.

Product design controls:
- Caps on load amounts, balances, number of loads per period, and ATM withdrawals.
- Restrict or prohibit cash loading, card-to-card transfers and cross-border ATM access for lower-tier products.
- Limit the number of cards or wallets per customer.
- Geographic restrictions where appropriate.

Monitoring and reporting:
- Automated transaction monitoring tuned to NPPS typologies (velocity, structuring, geographic anomalies, rapid load-and-withdraw).
- Link analysis to detect common identifiers across accounts.
- Suspicious activity reporting obligations apply to the PSP or EMI as a regulated entity.

Third-party and agent oversight:
- Due diligence on agents, distributors and programme managers; written agreements defining AML responsibilities.
- Training, periodic reviews, mystery shopping and termination for non-compliance.
- For banks servicing TPPPs: understand the processor's merchant base, review its AML programme, monitor returns and chargebacks, and treat the relationship with the same caution as a correspondent account.

Regulatory framework points worth knowing:
- FATF Recommendation 15 (new technologies) requires countries and institutions to assess risks of new products and delivery mechanisms before launch.
- FATF Recommendation 14 requires licensing or registration of money or value transfer services.
- FATF Recommendation 16 (wire transfers / travel rule) applies to many PSP transfers.
- In the US, prepaid access providers must register as MSBs, maintain AML programmes, and collect and retain customer information for most open-loop and reloadable products; certain low-value closed-loop products are exempt.
- In the EU, EMIs and payment institutions are obliged entities under the AML Directives, with simplified due diligence permitted only for strictly limited low-risk e-money within defined thresholds.

7. How to Answer Exam Questions on This Topic

CAMS questions are scenario-based and ask for the best answer. Work through them as follows:

Step 1: Identify the product type. Is it open-loop or closed-loop? Reloadable or single-load? Does it allow cash loading or ATM withdrawal? Is it cross-border? Higher-functionality products equal higher risk.

Step 2: Identify the role of the institution in the scenario. Are you the issuer, the programme manager, the agent, the bank hosting a TPPP, or the compliance officer at a PSP? The correct answer depends on whose obligations are in question.

Step 3: Match the facts to a typology. Multiple purchases below thresholds equals structuring. Many unrelated senders into one wallet equals funnel account or mule activity. Load in one country and withdraw in another equals cross-border layering or cash smuggling alternative.

Step 4: Choose the risk-based, proportionate control. The exam rarely rewards extreme answers such as prohibiting the product entirely or ignoring the risk. It rewards answers that assess risk, apply tiered controls, enhance monitoring, and escalate or report where suspicion exists.

Step 5: Eliminate distractors. Wrong options often: assume another party in the chain is responsible for CDD; propose controls that do not address the specific risk described; confuse closed-loop gift cards with open-loop reloadable cards; or suggest tipping off the customer.

8. Exam Tips: Answering Questions on Payment Service Providers and E-Money

- Know the FATF risk factors cold: anonymity, non-face-to-face, speed, cross-border reach, funding method, reloadability, cash access, segmentation, and third-party involvement. If an answer option directly reduces one of these, it is probably correct.
- Open-loop beats closed-loop for risk. If a question asks which prepaid product poses the greatest ML risk, look for the open-loop, reloadable, cash-fundable, ATM-enabled, cross-border option.
- Thresholds are a clue to structuring. Any scenario describing amounts just below a verification or reporting limit, repeated across cards, days or locations, points to structuring and a reporting obligation.
- TPPP scenarios are nested-relationship scenarios. The best answer for a bank onboarding a payment processor is to understand the processor's merchant portfolio, review its AML controls and monitor its activity, not simply to rely on the processor's assurances.
- Agents do not remove the principal's liability. When agents or distributors perform onboarding or cash handling, the PSP or issuer remains responsible for oversight, training and monitoring.
- Watch for the phrase 'risk-based approach'. Options that calibrate controls to risk (tiered limits, enhanced monitoring, EDD for high-value accounts) are generally preferred over blanket prohibitions or blanket exemptions.
- Remember Recommendation 15. If the scenario involves launching a new payment product, the first step is a risk assessment before launch, with controls designed into the product.
- Never tip off. If the scenario involves suspicious wallet activity, the correct sequence is investigate, escalate, file a suspicious activity report where warranted, and consider account restrictions, without informing the customer of the report.
- Link analysis matters. Shared devices, IP addresses, emails or phone numbers across many accounts is a classic e-money red flag; answers proposing linkage or network analysis are strong.
- Distinguish fraud from AML, but recognise the overlap. Prepaid cards used to receive scam proceeds are a fraud issue for the victim's bank and an AML issue for the card issuer; questions may test whether you recognise that the laundering of fraud proceeds triggers AML reporting.
- Read the question stem for the word 'most' or 'best'. Several options may be partially correct; pick the one most directly tied to the specific risk described and most consistent with FATF guidance.

9. Worked Example

Scenario: A compliance analyst at a prepaid card programme manager notices that over two weeks, 40 open-loop reloadable cards were purchased with cash at six retail locations in the same city, each loaded with an amount slightly under the identification threshold. Within 48 hours of each load, the full balance was withdrawn at ATMs in a neighbouring country. What should the analyst do first?

Analysis: The product is high-risk (open-loop, reloadable, cash-funded, cross-border ATM access). The pattern shows structuring, rapid movement and cross-border cash-out. The analyst's role is at the programme manager, a regulated entity with reporting obligations.

Best answer: Conduct link analysis to determine whether the cards are connected, document the findings, escalate to the money laundering reporting officer and file a suspicious activity report, while considering restrictions on the implicated cards. Options such as contacting the cardholders to ask about the activity (tipping off), assuming the retailer is responsible, or simply raising the identification threshold would be incorrect.

10. Summary

Payment service providers and e-money deliver financial inclusion and convenience but concentrate several classic ML and TF vulnerabilities: anonymity, speed, cross-border reach and fragmented accountability. The CAMS exam expects you to classify products by functionality, recognise the typologies of structuring, funnel accounts, rapid cross-border cash-out and nested processor relationships, and select proportionate risk-based controls grounded in FATF guidance and national MSB or EMI regulation. Anchor every answer in the risk factors, the institution's actual role, and the principle that responsibility cannot be outsourced to agents or other parties in the payment chain.