What the FATF’s 2026 report on scam compounds means for Africa, and for Zimbabwe’s new VASP regime

By Jabulani Chibaya and Tinotenda Bhunu   

IN BRIEF

The report. The Financial Action Task Force (FATF) now treats scam compounds as industrial, transnational organised crime, where online fraud meets human trafficking, corruption and money laundering.

The scale. Fraud costs an estimated US$500 billion a year. Compound losses alone run to tens of billions, and scam hubs have targeted people in more than 100 jurisdictions.

The weakness. Speed. In Thailand, stolen money can leave the financial system within three to five minutes. Victims take about 20 hours to realise.

Africa. No longer only a source of trafficked workers. Small scam cells, SIM boxes and laundering routes are surfacing from Nigeria to Zambia and Namibia.

Zimbabwe. S.I. 99 of 2026 opens the regulatory door. The contest will be decided in the payment window: mobile wallets, mule accounts and peer-to-peer stablecoin trades.

1. It starts with a message

Picture a composite case, built from patterns the report describes. A “recruiter” on WhatsApp offers a customer-support job in Thailand. Or a friendly stranger recommends a trading platform that always seems to pay out.

Weeks later, a victim in Harare sends several hundred dollars from a mobile wallet. Within minutes the money has hopped through three accounts and become USDT, a dollar stablecoin. By the time anyone suspects a thing, it is gone.

That, in miniature, is the story behind the FATF’s 2026 report, Combating End-to-End Illicit Financial Flows Linked to Scam Compounds. Its message fits on one line. Scam compounds are not a distant crime story. They are a payments problem, and payments are where Zimbabwe will win or lose.

2. Unpacking the report

The report first retires a mental image. A scam compound is not simply a fortified building in Southeast Asia. It is a node in an ecosystem where cyber-enabled fraud converges with human trafficking, corruption, cybercrime and money laundering.

There are two sets of victims. One is the people defrauded online. The other is the workers trafficked or coerced into running the scams, who may face debt bondage, confinement and violence.

The business model is both integrated and outsourced. Some networks run everything in-house. Others keep scam execution as their core and rent the rest: mule accounts, payment gateways, SIM cards, domains, laundering. Close one supplier and another appears.

Under enforcement pressure, operators are fragmenting from fortified compounds into rented rooms, flats, hotels and call-centre floors. The report is blunt: a decline in visible compounds should not, without further analysis, be read as a decline in illicit flows.

To follow the money, the FATF maps seven stages (Figure 1). Stages one to three are upstream: setting up premises, acquiring workers and victims, and running the scam. Stages five to seven are downstream: layering, cashing out and reinvesting profit. Between them sits stage four, collection and initial placement. The report calls it the payment window.

Figure 1. The seven stages of scam-compound money, and where Zimbabwe can act. Stage model after FATF (2026), Section 7, with names shortened; the design and the Zimbabwe intervention points are the authors’ own.

The plumbing will be familiar to anyone in compliance. Mule accounts opened with bought or stolen identities. Unlicensed money-transfer services and shell companies. Offshore exchanges and other virtual asset service providers (VASPs), plus peer-to-peer (P2P) and over-the-counter (OTC) desks. USDT on the TRON network. Telegram “guarantee” marketplaces, one of which, Xinbi, US authorities say processed more than US$24 billion since around 2022. And AI, which cuts the cost of translating and personalising scams.

Hayek would recognise the problem. It is a knowledge problem. The bank sees a payment, the telco a SIM card, the platform an advert, the police a complaint. Nobody sees the chain.

3. What the FATF wants done

The report sets six principles. Target the wider criminal ecosystem, not just the site. Disrupt flows end to end. Connect networks across sectors and borders. Act at speed. Put victims, both scammed and trafficked, at the centre. And adapt, measuring outcomes rather than activity.

The toolkit is practical: anti-scam centres and shared fraud-data platforms, rapid-response networks, mule-account analytics, preventive payment controls such as payee-name checks and cooling-off periods, blockchain tracing, and victim-linked recovery.

The yardstick is deliberate. Success is not alerts, arrests or account closures. It is whether victims are protected and the criminal business model is durably degraded.

4. How big is it?

Fraud costs an estimated US$500 billion a year, a Global Anti-Scam Alliance figure the FATF cites. Scam compounds alone cause losses in the tens of billions.

In 2026, INTERPOL’s Operation First Light brought together 97 countries and territories and produced 5,811 arrests, US$293 million in intercepted assets and more than 31,000 blocked bank accounts. US–UK action against the Prince Group, from October 2025, included the seizure of over US$15 billion in assets. The UN human rights office reported in 2023 that at least 120,000 people in Myanmar alone may have been forced to run online scams, and UNODC has found workers from at least 80 countries in Southeast Asian compounds.

Treat every figure as a floor. The Global Initiative Against Transnational Organized Crime (GI-TOC) estimates that around 70% of scam victims never report. Definitions differ, and many estimates cover cyber-enabled fraud generally. “None found” is not “none present”: the report cautions against reading non-identification as proof of absence.

The number that matters most is time (Figure 2). Thailand reports that stolen funds can reach an exit from the financial system in three to five minutes. Victims take around 20 hours to realise. The money moves 240 to 400 times faster than the victim. And once a report is made, the first 24 to 72 hours decide whether tracing and recovery are possible at all. Those arrangements must exist before the crime does.

Figure 2. Twenty hours in five-minute blocks. Each square is five minutes. Thailand reports that funds can reach an exit within 3–5 minutes (gold square), while victims take about 20 hours on average to realise they have been scammed (final square). Source: Thailand, as reported in FATF (2026). Illustration by the authors.

5. Africa is now in the frame

For years Africa featured in this story as a recruiting ground. GI-TOC finds that, going back to at least 2022, people from Kenya, Uganda, Nigeria, Ethiopia, South Africa and Zimbabwe have been targeted by job advertisements, and conservative estimates suggest 10,000 to 15,000 Africans from at least 33 countries have been lured into scam centres.

Now the operations themselves are arriving. GI-TOC identifies 14 African countries as particularly at risk, with underground banking used to launder proceeds in at least 10 of them. The cases the FATF cites are small, ordinary and instructive.

• Nigeria. A gated boiler-room compound in Abuja held 113 foreign nationals (November 2024). A 2025 case in Oyarifa, Ghana, involving 231 Nigerians, is read as networks relocating under pressure.
• South Africa. Cells of up to six people work from houses, hotel rooms and apartments.
• Zambia. The 2024 Golden Top case in Lusaka seized 135 computers, 11 SIM boxes and 37,000 SIM cards registered under stolen identities. Twenty-one foreign nationals were convicted.
• Namibia. A suspected operation with 150-plus workers had proceeds traced to Seychelles VASP accounts, and Namibia secured forfeiture of 112,334.50 USDT.
• Mozambique. An investment-fraud scheme ran from a rented house in Maputo behind a formally structured company. Mobile virtual-asset wallets are the main payment method in cases it links to compounds.

The African compound looks less like a fortress and more like a rented house with a SIM box. It will be found by its footprints: SIM purchases, power use, payroll, wallet activity.

6. Zimbabwe: the plumbing is already here

Zimbabwe does not appear anywhere in the report. Botswana, Eswatini, Mozambique, Namibia and Zambia answered the project’s questionnaire; Zimbabwe is not on the list. But absence from the record is not proof of absence.

Other evidence points to risk. GI-TOC lists Zimbabwe among its additional at-risk countries and notes that around ten new casinos have reportedly been developed by Chinese investors, several in Harare behind high perimeter walls. No public evidence links any Zimbabwean casino to scam activity, and the Chinese embassy has rejected the report and offered to deepen cooperation. Read it as a risk signal, not a verdict.

The downstream plumbing, at least, is not hypothetical. ITWeb Africa reported in April that mobile-money fraud losses exceed US$30 million a year, with phishing up more than 40%. The Reserve Bank of Zimbabwe (RBZ) Governor said some individuals were found holding up to 50 SIM cards each, every SIM a wallet, and that police tracing perpetrators hit dead ends because “the account belongs to a deceased person”. In February, police arrested an 11-person EcoCash “free data” phishing syndicate that allegedly took more than US$61,000, cracked by intelligence and transaction tracing.

These are domestic frauds, not compounds. But they run on the same rails: mule wallets, borrowed identities and a short hop to cash or USDT. And the hop exists. After the RBZ barred banks from servicing crypto in 2018, trading moved to peer-to-peer markets, and by 2019 Quartz described EcoCash as the dominant payment platform for Zimbabwe’s bitcoin traders. Those are the P2P and OTC channels the FATF flags.

Scrutiny is coming. The Financial Intelligence Unit’s (FIU) Director-General says Zimbabwe’s next evaluation, the first since 2015, begins this year, and assessors will test the effectiveness of implementation: prosecutions, convictions, asset recoveries. Paper compliance will not be enough.

7. What Zimbabwe should do now

The Finance Act 2025 brought virtual assets into law. S.I. 99 of 2026, gazetted on 10 June, requires anyone providing virtual-asset services “in or from Zimbabwe” to register with the FIU. It demands a local entity, at least two resident directors and a resident compliance officer, applies the Travel Rule, and requires wallet-ownership checks on transfers above US$1,000 to unhosted wallets. The Securities and Exchange Commission of Zimbabwe (SECZ) licenses in parallel, and the FIU stresses that registration alone is not authorisation to trade. The door is open. Seven priorities decide whether it works.

1. Police the bridge, not just the exchange. The FATF warns that rules reaching only physically established firms leave offshore platforms and P2P desks untouched. S.I. 99 covers business “in or from Zimbabwe” and tasks the FIU with identifying unregistered providers. Resource that duty: monitor P2P adverts and Telegram merchants, attribute wallets with blockchain analytics, and publish enforcement so the public register and QR code mean something.
2. Design for the payment window. Add payee-name checks, limits on new wallets and short holds on first-time transfers to VASP-linked accounts, with fast release when a flag is false. Share telecom signals, such as a live call during a payment or a fresh SIM swap, with banks, mobile-money operators and VASPs in real time. The UK’s Scam Signal service has been associated with 41% fewer people scammed, 44% lower fraud losses and 55% fewer false positives. Not compound-specific, but relevant.

Build the 72-hour response network. Name 24/7 contacts at banks, mobile-money operators, VASPs, the FIU and the Zimbabwe Republic Police. Ensure a clear legal basis for provisional holds before an investigation is complete. Agree a protocol for reaching stablecoin issuers: Brazil used one to freeze about 1.43 million USDT, though no restitution had followed. Then run drills that time every hand-off.

1. Finish the mule clean-up. The RBZ has ordered mobile operators to clean up customer databases with the Registrar General’s office, deactivating wallets not tied to valid identification. Make that permanent identity assurance, not a one-off audit, and add graph analytics across banks, operators and VASPs. Keep safeguards: separate deceived mules from knowing ones, allow correction, and avoid shutting honest low-income users out.
2. Give victims one door. Set up “no-wrong-door” reporting across the police, FIU, RBZ, the telecoms regulator POTRAZ, banks and NGOs, capturing wallet addresses, phone numbers and URLs and routing them to whoever can freeze or take down. Screen returning job-scam survivors as possible trafficking victims first, not as offenders.
3. Bring gambling into the same lens. The FATF ties compounds to casinos, junkets and virtual-asset exchange services, including junket operators accepting USDT for casino chips. Supervise Zimbabwe’s casinos and betting operators for virtual-asset arrangements, cash-outs and beneficial ownership, whoever the investor is.
4. Measure outcomes, not activity. Track time-to-intervention, value preserved and returned to victims, and displacement, not just alerts and arrests. Link the proposed AI Cyber Shield to shared fraud data, with legal gateways and data-protection safeguards.

The clock is running

Fight the network, not the building, and respect the clock. Zimbabwe has built the legal door. Speed, shared data and trust will decide whether anything useful walks through it. Kierkegaard said life is understood backwards but lived forwards. Will we wait for the first big raid to build this muscle, and only then understand it? The criminals are not waiting.

About this article

This article draws on FATF (2026), Combating End-to-End Illicit Financial Flows Linked to Scam Compounds: Applying the FATF Toolkit to the Fraud Epidemic, FATF, Paris, made available under a Creative Commons Attribution 4.0 International licence (CC BY 4.0). The analysis, illustrations and any errors are the authors’ own; the FATF has not endorsed this article. Other sources are named in the text and listed below, and were checked as at 6 November 2026.

Sources

1. FATF (2026), Combating End-to-End Illicit Financial Flows Linked to Scam Compounds
2. J. G. Tower, GI-TOC (19 May 2026), China-linked scam operations pivot to Africa, presenting new challenges for at-risk countries
3. MMM Law Firm, Zimbabwe regulates virtual asset service providers: key implications of S.I. 99 of 2026
4. LEX Africa (30 September 2026), Virtual assets, tokenised securities and crypto asset service providers: examining Zimbabwe’s emerging regulatory framework
5. The Herald, FIU moves to regulate virtual asset service
6. The Herald, New audit to test Zim’s financial crime fight
7. Bulawayo24 (21 June 2026), Zimbabwe faces crucial FATF test
8. Bulawayo24 (3 April 2026), RBZ clamps down on mobile money abuse
9. ITWeb Africa (13 April 2026), Zimbabwe declares war on rising AI-driven fraud
10. The Herald, 11 suspected EcoCash hackers in court for defrauding users of US$61,000
11. NewsDay, China-linked syndicates circle Zim’s digital economy
12. Africanews (14 May 2018), Zimbabwe bans banks from processing payments for cryptocurrencies
13. Quartz Africa (2019), Bitcoin and crypto soar in Zimbabwe again after US dollar ban

Jabulani Simplisio Chibaya is a Data and AI Consultant specializing in data science, artificial intelligence, blockchain, and cryptocurrency innovation. A seasoned conference speaker, he also writes on the intersection of technology, regulation, and economic development. Contact: Cell: +263 778 921 881 | Email: simplisiochibaya22@gmail.com | LinkedIn: https://www.linkedin.com/in/jabulani-simplisio-chibaya

Tinotenda Bhunu is an economist by profession. LinkedIn: https://www.linkedin.com/in/tinotenda-bhunu-114645208?utm_source=share&utm_campaign=share_via&utm_content=profile&utm_medium=android_app