When Your Bank Account Becomes a Crime Scene

• Three Nigerians, three very different journeys through the financial crime controls designed to protect the banking system

At 9.17am on a Monday morning, Abubakar Liman notices something wrong with his bank account. The balance is there. The money is his. But he cannot move it.

A transfer to a supplier fails. He tries again. The transaction is declined. Abubakar calls the bank. The explanation is brief: his account has been placed under restriction pending review. He is told to visit a branch.

What he is not told immediately is why an ordinary business transaction has suddenly turned into a financial crime compliance issue.

Abubakar has never been arrested. He has never knowingly handled criminal proceeds. He has never considered himself a person who would attract the attention of a bank’s financial crime team.

Yet, inside the bank’s risk system, something about his account has changed. Perhaps a payment received into his account has been connected to a suspicious transaction. Or the sender’s account is under investigation. Worse still, an unusual transaction has triggered an automated alert. Conceivably, the bank is simply doing what financial institutions are required to do when a transaction pattern demands closer scrutiny.

For Abubakar, however, the distinction between an alert and an investigation means little. His supplier wants payment, workers expect their wages and the business cannot wait indefinitely. This is where the story of financial crime compliance becomes personal.

The customer behind the transaction….

For years, conversations about anti-money laundering compliance have largely focused on criminals, banks, regulators and suspicious transactions.

The customer caught in the middle receives much less attention. Yet modern financial systems are increasingly designed to detect anomalies.

The Central Bank of Nigeria has strengthened its framework around customer identification, transaction monitoring and fraud prevention. The regulatory direction is towards faster detection, stronger identity controls and greater use of technology. The Apex bank’s current AML/CFT framework places financial institutions under obligations to identify, assess and manage money laundering and terrorist financing risks.

The logic is obvious because criminal proceeds can move rapidly, fraudsters can exploit legitimate accounts and monies can pass through several institutions within minutes. A bank that waits until a transaction has been completed before asking questions may already be too late.

But there is another side to the equation. The faster the financial system detects suspicious behaviour, the faster an innocent customer can potentially find themselves caught inside that system.

Abubakar: When a legitimate payment raises a red flag…

Abubakar runs a modest trading business. His customers pay electronically. He pays suppliers electronically. His employees receive their salaries electronically.

For years, the pattern has been predictable. Then one afternoon, a new customer makes a substantial payment. Nothing appears unusual to Abubakar. The customer has ordered goods. The invoice exists. The payment arrives and so the goods are prepared.

But somewhere else in the financial system, the transaction looks different. The account from which the money originated has become associated with suspicious activity. The payment eventually attracts attention, and so Abubakar’s account is now part of the transaction trail.

His bank’s compliance team does not necessarily know that Abubakar has a genuine invoice sitting in his office.

The system sees a transaction, but an investigation has to determine the story behind it. This is the essential distinction between transaction monitoring and criminal adjudication.

An alert does not mean that Abubakar is a criminal. It means that the institution has identified something that requires investigation. The difficulty begins when the investigation interferes with the customer’s ability to conduct ordinary life and business.

For a large corporation, a temporary banking restriction may be absorbed by treasury teams and multiple accounts. But for a small business like Abubakar’s, it can be devastating.

A delayed payment can mean a delayed delivery. A delayed delivery can mean a lost customer. A lost customer can mean unpaid wages.  Compliance decisions can therefore produce consequences far beyond the transaction that triggered them.

Fatai: When the account holder becomes the suspect

Fatai Arogundade’s story is different. He is a salaried employee. His bank account is mainly used for his salary, household expenses and occasional transfers to relatives. Then, without warning, his bank asks questions about a transaction he does not recognise. Fatai checks his account. The transaction appears to have come from his account. But he says he did not authorise it. This is where another compliance risk emerges.

Identity compromise…..

The financial system increasingly depends on identity infrastructure.

Banking Verification number (BVN), National Identity number (NIN), telephone numbers, passwords, mobile applications and biometrics.

Every additional layer of digital identity creates opportunities for criminals to steal, manipulate or exploit credentials.

The CBN has continued to strengthen identity verification and fraud controls around financial services, including measures designed to protect digital transactions. But technology does not eliminate identity theft. It changes the battlefield.

Fatai’s problem is therefore no longer simply, “Why has my account been restricted?” It becomes: How does an ordinary customer prove that a transaction bearing the customer’s identity was not actually authorised by the customer? That can be an exhausting experience.

A customer may have to provide explanations, documents, transaction histories and other evidence. The bank, meanwhile, has a legitimate responsibility to establish what happened.

Fatai wants access to the account, his bank wants certainty, investigator wants evidence whilst the fraudster has already moved on.

Chika: The money mule who did not know…

Chika Ogochukwu presents the most complicated case. She is young, digitally connected and comfortable using financial technology. One day, someone approaches her with what appears to be a simple proposition. Money will be paid into her account and she will transfer part of it to another account, whilst keeping a small amount for the service.

It sounds very easy. The money arrives and Chika transfers it. She does not know that the funds are connected to fraud. Several days later, her account is restricted. She is confused.

From her perspective, she performed a transaction for which she was paid. From the bank’s perspective, money connected to suspicious activity has moved through her account.

This is where the distinction between victim, negligent participant and deliberate facilitator becomes critical.

Chika may genuinely have had no knowledge of the criminal source of the funds. But ignorance does not absolve her of evident compliance consequences.

Financial institutions question how money moves through their systems, why an account is receiving money inconsistent with its normal activity and also examine the source and destination of funds.

And where suspicious activity is identified, they may have obligations to escalate the matter.

For Chika, the lesson arrives too late. An account is not merely a place where money sits. It is part of a financial identity. Allowing someone else to use it can create exposure that is difficult to reverse.

The stories of Abubakar Liman, Fatai Arogundade and Chika Ogochukwu illustrate three different ways an ordinary Nigerian can become entangled in the financial crime controls designed to protect the banking system.

Abubakar is the legitimate customer whose transaction becomes connected to suspicious funds. Fatai is the customer whose financial identity may have been compromised. Chika is the potential money mule who may not understand the risks of allowing her account to facilitate transactions for others.

The common thread is simple. The financial system is trying to determine whether a transaction is normal, and increasingly, technology is helping it make that determination.

The CBN is pushing financial institutions towards stronger automated fraud and anti-money laundering monitoring, because money now moves too quickly for purely manual checks. But an alert can identify an unusual pattern without understanding the human story behind it. It cannot, on its own, determine intent. That remains a human responsibility.

A sophisticated compliance system should therefore ask more than how many alerts it generates. It should ask how many are false positives, how quickly they are reviewed, how many customers are wrongly restricted and how quickly legitimate customers are restored. It should also examine how complaints are handled and what happens when an internal decision turns out to be wrong.

The 24-hour question…

Nigeria’s evolving BVN framework makes the issue particularly timely. The CBN introduced a temporary BVN watchlist mechanism for BVNs associated with suspected fraudulent transactions. The framework provides for a temporary watchlist period of up to 24 hours while the customer is contacted and given an opportunity to clarify the transaction.

It reflects a difficult balancing act. Financial institutions must act quickly when suspicious activity is detected, but customers must also have an opportunity to explain.

What happens when the explanation is not straightforward? What happens when the customer cannot immediately produce the requested evidence? What happens when several institutions are involved, or when the restricted account is the customer’s only source of income or business capital? These are questions that deserve closer attention from regulators, banks, consumer advocates and financial crime specialists. A red flag is not a verdict

There is a danger in the way financial crime is sometimes discussed. Once an account has been flagged, the account holder can quickly be treated as though guilt has already been established. That is not how a sound compliance system should work.

Financial crime controls operate on risk. Courts determine criminal guilt. Those are different functions.

A suspicious transaction may justify scrutiny, but it does not automatically establish criminal intent.

A person whose account receives suspicious money may be a criminal. They may also be an unwitting victim, negligent, deceived, or simply someone who conducted a legitimate transaction with a person who later became the subject of an investigation. The job of compliance is to establish which situation applies.

When the customer needs help. There is also a consumer protection dimension.

The CBN’s consumer protection framework recognises complaints involving account restrictions and wrong account liens. Financial institutions are expected to maintain complaint-handling processes, while unresolved complaints can be escalated through the CBN’s Consumer Protection Department. That matters because compliance should not become a black box.

Customers may not be entitled to every detail of an active suspicious transaction investigation because of confidentiality and law-enforcement considerations. But there should still be a meaningful route through which they can understand what is required, provide relevant evidence and challenge decisions where appropriate.

For Abubakar, that could mean producing invoices and evidence that a disputed payment came from a genuine business transaction. For Fatai, it could mean establishing that his credentials or account were compromised. For Chika, it could mean explaining exactly how she came to receive and transfer the money.

Each case requires evidence. Each requires judgement. And behind each account number is a human being whose circumstances may not be visible to an algorithm.

The compliance paradox………

This is the paradox at the centre of modern banking. Banks must become better at detecting suspicious money. But the better their detection systems become, the more important it is to manage false positives.

They must act quickly, but fairly. They must protect the financial system without unnecessarily punishing legitimate customers. They must investigate without allowing investigation to become an assumption of guilt. The strongest compliance regimes understand this tension.

Success should not be measured simply by the number of alerts generated or accounts restricted. It should also be measured by how effectively risk is identified, investigated, resolved and, where necessary, corrected.

Abubakar wants to run his business. Fatai wants access to his salary and personal funds. Chika wants to understand how an apparently simple transaction became a financial crime problem.

None of them needs the financial system to be weak. They need it to be accurate. That distinction matters.

A weak compliance system allows criminals to move money freely. An indiscriminate compliance system can make legitimate customers collateral damage. The objective should be neither.

The real test however, is whether the financial system can identify genuine risk while recognising that behind every BVN, account number and transaction, is a human being whose circumstances may not be visible to a machine.

A red flag should trigger an investigation. It should not become a verdict.

And when the system gets it wrong, the important question is not simply how the customer ended up on the wrong side of the compliance screen. It is whether the system knows how to bring an innocent customer back. Because when a bank account becomes a crime scene, the person standing behind the account may still be the victim.