Rogue business correspondents, payment aggregators join forces to launder money using bank payout APIs (2025)

Rogue business correspondents (BCs), payment aggregators who wink and nod, and an army of nondescript, hole-in-the-wall outfits are joining hands to launder money.

'Payout APIs' of banks, a ubiquitous technology tool to help businesses transfer funds to individuals or entities at the press of a button, are being shared with a string of operators and misused to move cash.

BCs are agents authorized by banks to provide banking services in remote areas and facilitate simple, local remittances, like migrant workers sending money to family members in distant villages. However, a number of them are breaking the rules by masquerading as ‘merchants’ and using APIs of payment aggregators to collect cash and act as laundering machines. A payment aggregator, licensed by RBI, is a third-party service provider that enables customers to make and businesses to accept payments online.

According to senior bankers ET spoke to, the BC industry has flagged this off to the Reserve Bank of India (RBI) and the Financial Intelligence Unit (FIU), the finance ministry arm which collects and shares information on suspicious transactions. “After this, we received calls from FIU to be careful in stopping API misuse,” said an official with a private sector bank.

Here’s how the money travels:

• · A string of agents of an unscrupulous BC pick up cash from faceless individuals who do not reveal their source of money;
• · The cash received is deposited by the BC in its bank account;
• · The BC then uses the API of the payment aggregator (PA) it has tied up with to send funds, often in various denominations, from its bank account to different beneficiary accounts.
• · The money first moves from the BC’s account to the PA’s account, and subsequently to the various beneficiary accounts.
• · The mechanism rests on the BC, posing as a merchant, and cutting a deal with the PA, and masking each money transfer as a payment from one merchant to another.

The deal between the BC and PA allows the former to share the API that the PA has received from its bank. In all likelihood, these beneficiary accounts are mule accounts --- with the money either being withdrawn or moved to multiple other accounts, making the fund flow tougher to trace. Money mules are persons who let their bank accounts be used by launderers and shysters to move proceeds of crime.

“Once the BC is accepted as a merchant by the payment aggregator, the latter shares the API that it has obtained from its bank. Some aggregators are probably in cahoots with such a BC. Now, if a BC ties up with more than one aggregator and each aggregator runs multiple bank accounts, laundering can be done at a larger scale using the APIs of different banks,” said another person.

Indeed, using a PA and accessing its API transforms the game. In legitimate direct money transfers (DMTs) by BCs, the sender of the fund has to undergo regular KYC and the remittance amount is capped at Rs 5000 for a single transaction and Rs 25,000 for a month. Though technically possible, such rules make ordinary DMTs a smaller and a far less effective laundering route. However, there are no remittance limits on fund transfers through a PA's bank account --- from one merchant (in this case, a corrupt BC) to other merchants (who are the beneficiaries and agents of persons sending the money by giving cash to the BC).

BC industry circles said that banks have acted against such errant BCs whenever they have been alerted about such operations. “But this can go on. One corporate BC would stop and another would open a shop unless the rules are tightened,” said an industry person. For instance, banks and PAs giving APIs to their enterprise customers should not further share the API with others, identities of API users should be disclosed to the bank, PANs of beneficiaries should be submitted in advance to check whether they are genuine merchants, and even restricting the number of merchants and payouts.

It is also observed that certain elements do not even sign up as BC and simply become merchants to a PA and carry out this activity. “Proper on-boarding and due diligence by PA of each such merchant is now the need of the hour, if one needs to curb such activities,” said an industry person.

BCs indulging such sharp practices are typically corporate BCs which include companies, NGOs, micro-lenders, and co-operative societies which have a larger reach than individual BCs like retired bank employees, service-men and kirana shops.

...moreless

...moreless