The sector in brief
A card scheme operator runs the rules, technology and settlement arrangements that allow card payments to work between banks, merchants and cardholders. In the UAE, operators of such schemes fall within the Central Bank's supervision.
Most of the customer relationships sit with the members, such as issuing and acquiring banks and payment firms. The scheme therefore does not see every cardholder. Its AML role is different: it decides who may join, sets and enforces standards, and monitors activity across the network for patterns that individual members may miss.
This is a role with influence. A scheme that admits a weak member, or does not act on warning signs, lets illicit funds flow through a trusted brand. Supervisors expect scheme operators to take that responsibility seriously even though they are not on the front line.
Where the risk sits
Admitting weak members
A bank or payment firm with poor controls can introduce high-risk merchants or issue cards that are easily abused. Membership checks are the first line of defence.
High-risk merchants and merchant laundering
Fake merchants, or real merchants used to process transactions that are not genuine, can run illicit funds through the network as sales.
Cross-border cash-out
Cards used to withdraw cash abroad, or to buy goods that are easily resold, can move value across borders with little trace.
Gaps between members
Each member sees only its own part. Patterns that only appear across several members, such as one card used with many acquirers, may be visible only to the scheme.
Sanctions and restricted activity
The scheme must ensure that sanctioned parties and prohibited activities are kept out of the network and that members apply the right controls.
Who supervises you
Card scheme operators in the UAE are supervised by the Central Bank. If your operations also involve a financial free zone, check with the free-zone regulator whether any part of your activity is supervised there as well.
The supervisor decides the detailed rules for your licence category, so always read its current guidance alongside this page.
What supervisors expect
- A Compliance Officer or MLRO who understands both the scheme's rules and the supervisor's expectations, and who can escalate to the board.
- A risk assessment that looks at members, geographies, products and the types of merchants the network serves.
- Due diligence on prospective and existing members, including their ownership, licences, AML programmes and track record.
- Standards, audits and sanctions for members that do not meet the scheme's AML requirements.
- Network-level monitoring for unusual patterns across members, with a route to share concerns with members and authorities where appropriate.
- Screening of the scheme's own counterparties and a process to act on sanctions matches without delay.
- Reporting through goAML where suspicion arises, training, record keeping and independent testing.
Red flags to watch
- A prospective member that has been criticised by regulators or has weak AML governance.
- A sudden growth in volumes at one acquirer that does not match its merchant base.
- Clusters of transactions at merchants that appear to sell nothing real.
- Cards from one issuer used heavily for cash withdrawals in unrelated countries.
- A member that is slow or unwilling to answer the scheme's AML questions.
- Repeated rule breaches that are not corrected.
A worked example
One acquirer, an unusual merchant cluster
Scheme monitoring shows that an acquiring member has signed up dozens of small online merchants in a short period. Most have almost identical websites and receive payments from cards issued in many countries, with a high refund rate. No single transaction stands out. The scheme's AML team contacts the member, asks for the merchants' due diligence files, reviews them and, finding weak checks, requires remediation and enhanced monitoring. If the member does not cooperate, the scheme considers suspending processing and whether a report should be filed.
How Adventant helps
Questions answered
Does a card scheme have to identify cardholders?
Usually not directly, because cardholder relationships sit with issuing members. The scheme's duty is to make sure members meet proper standards and to monitor the network. The detail depends on how the scheme operates and on the Central Bank's rules.
What should membership due diligence cover?
Ownership and control, licences, financial strength, AML policies and track record, and the types of business the member will bring to the network. It should be repeated when something material changes.
How can a scheme enforce AML standards?
Through its rules and contracts, which can include audits, remediation plans, fines and, in serious cases, suspension. Enforcement is only credible if it is used consistently.
Can a scheme report suspicious activity itself?
Where the scheme itself forms a suspicion in the course of its activity, it has the same duty to report through goAML as other regulated firms. It should also have a route to alert members and authorities.
How does a scheme monitor activity it cannot fully see?
By using the data it has: patterns across members, merchants, countries and refund rates. The aim is not to see every payment in detail but to spot what no single member could see.