The Agent Network Blind Spot: Cash-Intensive Corridor Under Pressure
A mid-sized money remittance company operates 1,150 agents across three states. Analytics show that 7% of agents originate 64% of all cash-in volume, and those agents cluster in two immigrant-heavy ZIP codes. The company's largest corridor sends funds to a country rated high risk for corruption, but that country is also the primary remittance destination for the local diaspora. Monitoring is rules-based: a single $3,000 alert threshold and no aggregation across agents or customers. Last quarter, 41 customers each made three to five cash deposits of $2,850 to $2,950 at different agents within 48 hours. The board wants to know whether the corridor should be exited. Compliance has four analysts and no agent-level risk scoring.
1. Identify the elevated risk factors in this portfolio and explain how they compound rather than merely add together.
Read the worked answer
Factors present
- Delivery channel / agent risk - 1,150 third-party agents are a distribution network the company does not directly control. Concentration (7% of agents producing 64% of volume) means control failures at a handful of locations dominate total exposure.
- Geography - the dominant corridor terminates in a high-corruption jurisdiction. Country risk is real but blunt: the same corridor carries most of the diaspora's legitimate remittances.
- Product - cash-in remittance is anonymous at the point of intake and settles cross-border almost immediately, so recovery and recall options are weak.
- Customer behaviour - the 41-customer pattern (multiple deposits just under the $3,000 threshold, split across agents, inside 48 hours) is consistent with structuring to evade both the company's threshold and any CTR-style reporting.
Why they compound
Each factor alone is manageable. Combined, they create a specific failure mode: the only control is a per-transaction threshold, while the risk sits in aggregation across agents and customers. An agent-level or customer-level view would surface the pattern instantly; a single-transaction rule structurally cannot. The high-risk corridor also means a typology match (structuring plus rapid cross-border movement) carries more consequence than the same pattern into a low-risk destination.
Conclusion for the board: the driver is not the country - it is the absence of aggregation and agent risk scoring. Exiting the corridor removes a legitimate customer base while leaving the control gap intact for every other corridor.
2. The board proposes exiting the entire corridor. Set out the arguments for and against, and recommend a defensible alternative with specific controls.
Read the worked answer
For exit
- Removes the highest-residual-risk exposure immediately and is easy to explain to a regulator.
- Compliance has four analysts; a corridor-wide exit requires no new capability.
Against exit
- Blanket de-risking is discouraged by FATF guidance and by most supervisors: it pushes customers into unregulated channels, which raises aggregate ML/TF risk rather than lowering it.
- The evidence points to a control gap, not to a corridor that is inherently illegitimate. Exiting does not fix the monitoring architecture and would look like avoidance in an examination.
- Commercial and reputational cost, and possible fair-access exposure, in a diaspora market.
Recommended alternative - segment, do not amputate
- Agent-level risk scoring (volume, corridor mix, ownership/beneficial ownership, turnover, on-site review results, complaint and fraud history). High-score agents get enhanced due diligence, periodic on-site visits, and lower thresholds.
- Aggregation rules keyed on customer, agent, beneficiary, device and 48-hour windows - this alone would have caught the 41-customer pattern.
- Corridor-specific thresholds and velocity limits rather than one global $3,000 rule.
- EDD trigger for any customer whose cumulative monthly cash-in exceeds a stated multiple of declared income or occupation profile; written source-of-funds request.
- 90-day metrics reported to the board: alert volume by segment, SAR conversion rate, agent attrition, exit decisions by segment.
Exit only specific agents or sub-segments where EDD cannot be completed or where an agent fails review. That is targeted, documented, and defensible.
3. What information would you require before finalising the risk assessment, and how would its absence change your conclusion?
Read the worked answer
Data to obtain
- Agent ownership and beneficial ownership, plus any common ownership among the highest-volume agents. Common control across seemingly separate agents is a classic layering structure and would move the assessment from control gap to suspected collusion.
- Customer-level profiles: occupation, declared income, expected monthly remittance, tenure. The teacher-with-$61k problem is a profile comparison, not an absolute number.
- Beneficiary data: repeat beneficiaries, beneficiaries shared across unrelated senders, corridor concentration per customer.
- Purpose/relationship codes on each transfer, and whether the same beneficiary receives from multiple senders.
- Agent cash handling records: whether deposits were consolidated before transmission, which would indicate agent-level structuring on behalf of customers.
- Peer benchmark: typical volume per agent nationally for the same product.
How missing data changes the conclusion
If agent beneficial-ownership data cannot be obtained, the concentration statistic can no longer be explained as ordinary commercial success, and the correct interim position is to cap or suspend the top-volume agents pending review - a narrow, reversible action rather than a corridor exit. If customer income and purpose codes are unavailable, the 41-customer pattern cannot be dispositioned as anomalous, and it should be treated as suspected structuring and escalated for investigation and possible SAR filing. Absence of data raises assessed risk; it never neutralises it.