FinTelegram received a whistleblower allegation that Aku (aku.africa) may be issuing falsified “Visa penalty letters” to pressure clients into paying large “penalties.” We cannot currently verify or falsify this claim. What we can do now is document Aku’s public footprint: corporate representations, products, and Nigeria’s regulatory perimeter—then invite insiders to help close the gaps.
Go to the Aku Compliance Profile on RatEx42
Regulatory context: A CBN PSSP authorisation signals a payments-service licence category—not necessarily a “bank” licence in the deposit-taking sense. Where fintechs advertise “digital bank,” the compliance question is which regulated entity actually holds customer funds, who provides settlement accounts, and whether services like “wealth/credit” are delivered directly or via regulated partners.
Baseline obligations (Nigeria): A CBN-regulated payments provider is expected to run AML/CFT controls and comply with Nigeria’s AML laws and CBN AML/CFT/CPF rules; it must also treat customer data under Nigeria’s data protection regime and consumer protection expectations.
Whistleblower allegation (unverified): The tip alleges Aku “submits falsified Visa penalty letters” lacking a case ID; that Aku’s API requires clients to submit a “source URL”; and that Aku then allegedly references that URL in a ‘penalty letter’ and demands “50k–60k” (currency not specified). We have not seen the underlying documents yet. If genuine, merchants should verify any “scheme penalty” directly with their acquiring bank/card program partner—not via an intermediary letter alone.
In card payments, a “penalty letter” typically refers to a scheme- or acquirer-driven notice that a merchant (or its processing chain) has breached card-network rules—often tied to chargeback ratios, fraud levels, prohibited business models, excessive disputes, or compliance failures. In a legitimate setup, the “penalty” is not a random invoice from the processor: it is usually a pass-through of fees/fines assessed upstream (e.g., by the card scheme via the acquiring bank), backed by a case reference, program name, dates/metrics, and an identifiable acquirer/scheme contact trail—and it is settled via the acquiring relationship, not via ad-hoc pressure tactics.
The compliance problem described in the whistleblower tip is that if a processor (or any intermediary) fabricates such letters—especially without a verifiable case ID or upstream documentation—then the “penalty” becomes a pretext to extract money from merchants. That would plausibly amount to misrepresentation and fraud, and (as you note) unjust enrichment, because the funds would not be linked to a genuine scheme/acquirer assessment but instead to an invented enforcement event.
Do you have contracts, invoices, “penalty letters,” emails, screenshots of the “source URL” API field, settlement-account details, acquiring partners, or CAC filings connected to Aku / Akupay Services Limited / Aku Fintech Services Ltd? Please submit evidence—securely and, if needed, anonymously—via Whistle42.com. Insiders, affected merchants, and regulators: help us verify or debunk this allegation.

