Underground Banking and Hawala in 2026: What AML Leaders Need to Know About the New Professional Money Laundering Infrastructure

Based on the FATF September 2026 report, Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers

The latest FATF assessment makes one point unmistakably clear: underground banking and hawala are no longer simply “informal cash-remittance” problems. They are becoming sophisticated, cross-border financial infrastructures for professional money laundering (PML).

The FATF report, developed with contributions from 32 jurisdictions and three international observers, draws on responses from 46 jurisdictions to two questionnaires conducted in 2025 and 2026, alongside expert consultations, case studies and international research.

The findings should matter to every AML compliance leader because the threat is increasingly moving through the formal financial system rather than merely around it. Banks, payment service providers (PSPs), fintechs, virtual asset service providers (VASPs), vIBANs, prepaid cards, mobile-money platforms, trade businesses, real estate and professional intermediaries can all become components of the same laundering architecture.

The implication is significant:

The question for AML teams is no longer simply “Can we detect hawala?” It is “Can we detect the financial footprint of an informal value-transfer network when that footprint is distributed across multiple formal and informal channels?”

---

The FATF 2026 report in numbers

Before examining the typologies, several statistics establish the scale of the problem.

These percentages need to be interpreted carefully. They generally represent the percentage of jurisdictions responding to FATF’s survey that identified a particular feature, channel or risk—not the percentage of transactions or global illicit funds associated with it. The FATF explicitly cautions that the survey does not provide a robust quantitative measure of the prevalence or size of underground banking across regions.

---

1. Underground banking is almost everywhere—but largely invisible

One of the strongest findings appears early in the report: nearly 90% of jurisdictions responding to the survey reported the presence of underground banking systems and HOSSPs within their territories.

Yet this high prevalence does not translate into equally strong data.

The FATF says most jurisdictions cannot reliably quantify:

• the number of underground banking operators;
• transaction volumes;
• market share relative to formal MVTS;
• the proportion of PML passing through these networks;
• provider and customer demographics; or
• regional and cross-border flows.

Many jurisdictions reported having “no data”, “no statistics available” or being “not sure”, even when they recognised underground banking as a significant risk.

Why this matters

This creates an unusual AML problem: the risk is widely recognised, but its measurable footprint is weak.

For a compliance function, absence of evidence therefore cannot safely be treated as evidence of low exposure.

A bank may see:

• a series of ordinary payments;
• a legitimate-looking trading company;
• a remittance customer;
• several small cash deposits;
• a payment to a PSP;
• a transfer involving a vIBAN; or
• a VA conversion.

None may independently indicate underground banking.

The risk becomes visible only when these activities are connected as components of a network.

That is one of the central themes running through the FATF report.

---

2. What exactly is “underground banking” and how is it different from hawala?

The terminology matters because inconsistent definitions are themselves identified by FATF as a major obstacle.

The report defines professional money laundering as the laundering of criminal proceeds by individuals, organisations or networks that specialise in providing laundering services to criminals, generally for a fee, commission or other profit.

Underground banking is broader. FATF describes it as informal arrangements operating outside, alongside or through the regulated financial system to transfer, settle or store value through networks of intermediaries.

HOSSPs—hawala and other similar service providers—are a subset of money or value-transfer services. When appropriately licensed or registered, they can operate within the formal financial sector; when unlicensed or unregistered, they can form part of underground banking.

This distinction is critical.

Hawala is not inherently criminal

The FATF explicitly warns against treating every hawala or informal value-transfer arrangement as money laundering. These systems can serve legitimate remittance and financial-inclusion needs, particularly among migrant, refugee and diaspora communities and in areas where formal financial infrastructure is limited.

The compliance challenge is therefore not simply:

“Find people using hawala.”

It is:

“Distinguish legitimate informal value transfer from organised criminal exploitation of the same infrastructure.”

That requires contextual, behavioural and network-based analysis.

---

3. How the underground banking model actually works

The FATF’s operating model on page 14 illustrates a deceptively simple process.

1. Customer A gives local currency to HOSSP 1 in Jurisdiction A.
2. HOSSP 1 communicates transaction details to HOSSP 2 in Jurisdiction B.
3. HOSSP 2 pays equivalent value to Customer B, usually from a local cash pool or third-party business account.
4. HOSSP 1 and HOSSP 2 later settle their accumulated obligations.

Critically, the underlying money does not necessarily cross the border at the time of the customer transaction. The operators settle their obligations later through offsetting, trade, cash, formal banking channels, VAs or other forms of value.

The report’s diagram also identifies the core ecosystem:

• underground bankers/hawaladars;
• cash or liquidity pools;
• customers;
• remuneration/commission;
• clearing mechanisms.

Operators commonly work from apparently legitimate businesses such as travel agencies, currency exchange shops, import/export firms and wholesalers. FATF reports typical commissions of approximately 0.5% to 5%, with pricing influenced by risk, geography, urgency, transaction size and other operational factors.

The important AML insight

A traditional transaction-monitoring system is designed around money movement.

Hawala can instead involve:

Value movement → obligation creation → internal ledger → later settlement

That means the suspicious event may not be the original transfer. It may be the later settlement event that occurs through an apparently unrelated bank account, trade transaction, VA transfer or cash transaction.

---

4. What channels are PML networks actually using?

The FATF’s Infographic 3 on page 16 provides one of the report’s most useful quantitative views of the laundering ecosystem.

Main channels and techniques used for PML

What the graph tells us

The most important observation is not that underground banking itself ranks third.

It is that underground banking sits inside a much larger ecosystem of laundering mechanisms.

Shell companies and nominee structures appear in 67% of responding jurisdictions—twice the level at which underground banking/HOSSPs were identified in the chart.

TBML follows at 36%, while VAs are already at 31%, only two percentage points below underground banking/HOSSPs.

This suggests that an underground banking investigation should not stop at identifying the informal remittance mechanism. AML teams should immediately investigate its connections to:

corporate structures + trade + VAs + real estate + professional intermediaries.

That interpretation is consistent with FATF’s finding that approximately 80% of jurisdictions report underground banking/HOSSP-based PML being combined with other ML methods.

---

5. The predicate-crime landscape is much broader than drug trafficking

The second major quantitative graph—Infographic 4 on page 20—shows the predicate offences associated with underground banking and HOSSP-based PML.

The big shift: fraud has caught up with drugs

Drug trafficking and fraud both register at 40%, making them the leading predicate offences identified in the chart.

This is strategically important.

Historically, underground banking is often associated with:

• narcotics;
• bulk cash;
• smuggling; and
• traditional organised crime.

The FATF report shows that this framing is becoming incomplete.

Fraud, cybercrime, corruption, tax evasion and other criminal economies increasingly feed into the same infrastructure. FATF explicitly states that underground banking and HOSSPs now support a much wider spectrum of criminal activity, including fraud, cyber-enabled crime, corruption, tax evasion, terrorist financing, sanctions evasion, environmental crime, illegal gaming and gambling, intellectual-property crime and organised crime.

Compliance implication

A financial institution investigating underground banking should not restrict its typology library to cash + drugs + remittance.

A modern detection framework needs to account for:

fraud → mule accounts → informal settlement → trade/corporate structures → VA conversion

as well as:

tax evasion → false invoicing → HOSSP → cross-border settlement

and:

illegal gambling → digital wallets/UPI → cash → hawala → foreign investment narrative.

The FATF report provides an Indian case study illustrating precisely this latter pattern. An illegal online gambling platform used UPI, online banking, digital wallets, mule accounts and stolen identities; proceeds were partly converted to cash and moved abroad through hawala/underground banking before being reintroduced into India as purported foreign investment from the UAE.

---

6. The EUR 500 million warning: underground banking can operate at industrial scale

One of the clearest examples is Operation Klaver in the Netherlands.

Authorities identified an underground banking network that processed approximately EUR 500 million in criminal proceeds over eight months, largely for drug-trafficking organisations. Cash was collected by couriers, transported to warehouses, counted and recorded, and then redistributed to other criminal actors. The network maintained internal records, coded references and international broker relationships.

This is not an informal “person-to-person” remittance arrangement in the conventional sense.

It resembles a financial services operation for criminals:

• customer acquisition;
• cash collection;
• liquidity management;
• record keeping;
• pricing;
• settlement;
• international coordination; and
• distribution.

That is precisely why FATF describes professionalisation as a major risk multiplier.

---

7. Professional money laundering is becoming a service industry

The FATF identifies a clear shift toward professionalised, structured and commercially operated laundering networks.

These networks increasingly have:

• specialised roles;
• hierarchical or cell-based structures;
• digitised ledgers;
• technical specialists;
• logistical specialists;
• professional intermediaries;
• liquidity management;
• standardised processes; and
• cross-border operational capabilities.

Professional service providers—including lawyers, accountants, auditors, notaries, corporate formation agents, financial consultants and real estate agents—may also become involved.

This creates a fundamental change in the risk model.

From transaction laundering to infrastructure laundering

Instead of asking:

“Is this transaction suspicious?”

AML teams increasingly need to ask:

“What infrastructure is this customer connected to?”

That means examining relationships between:

• companies;
• directors;
• beneficial owners;
• bank accounts;
• payment accounts;
• PSPs;
• VASPs;
• mobile wallets;
• addresses;
• telephone numbers;
• counterparties;
• trade entities;
• cash-intensive businesses; and
• professional intermediaries.

---

8. “Digital hawala” is changing the detection window

Nearly 70% of responding jurisdictions reported emerging typologies, while nearly 70% identified the integration of new technologies into underground banking and HOSSP activity.

The FATF uses “digital hawala” to describe a spectrum of technology-enabled practices rather than one single model.

These include:

Digital coordination

Encrypted messaging applications, shared ledgers and online platforms can coordinate transactions while settlement continues through cash or trade.

Digital customer interfaces

Customers can initiate transactions through:

• bank transfers;
• mobile wallets;
• fintech applications; and
• instant payment systems.

The underlying operator-to-operator settlement may still happen through cash or trade.

VA-based settlement

Stablecoins such as USDT, USDC and DAI may be used to settle balances between operators.

Formal digital infrastructure

PSPs, fintech platforms, vIBANs and online banking can become the visible layer through which an otherwise informal settlement mechanism operates.

Automated tooling

The report even identifies cases involving automated transaction structuring, dynamic routing through mule accounts, rapid fiat-to-VA conversion and automated management of mule accounts.

The FATF identifies four particularly important consequences:

1. Higher speed
2. Greater opacity
3. More complex layering
4. Greater geographic reach and resilience

Why this matters for transaction monitoring

If criminal proceeds can be swept automatically once a threshold is reached, converted into VAs and moved overseas, the traditional monitoring model may have only a very narrow intervention window. A Japanese case cited by FATF describes automated transfer functions that moved funds from mule or compromised accounts once deposits reached specified amounts.

For AML leaders, detection latency becomes a risk metric.

A system that identifies a network only after funds have passed through five accounts, two PSPs and a VA exchange may be technically accurate—but operationally too late.

---

9. The formal financial system is not outside the problem—it is part of the architecture

Perhaps the most consequential finding for banks and fintechs is FATF’s observation that underground banking increasingly integrates with formal finance.

Networks use:

• bank accounts;
• fintech platforms;
• PSPs;
• digital wallets;
• vIBANs;
• prepaid cards;
• payment terminals;
• corporate structures; and
• VA services.

The formal system may provide the customer interface, placement layer or exit point, while the underground network performs the concealed settlement function.

This is why FATF describes formal-sector access as a structural component of many underground banking networks.

Example: vIBANs

The report describes Italian cases where vIBANs were used to disguise the true destination of funds or make cross-border transfers appear domestic. Multiple alias accounts could route incoming payments to a central master account, creating a nesting effect.

Example: prepaid cards

Prepaid cards can bridge cash-based underground systems and formal payment infrastructure, facilitating layering, short-term value storage and cross-border access.

Example: payment terminals

Fictitious or complicit businesses may use payment terminals to introduce illicit funds into the regulated system under the appearance of legitimate revenue.

The lesson

A transaction does not become low-risk merely because it occurs inside a regulated payment system.

The regulated channel may actually be the final visible layer of a much larger underground network.

---

10. Regional typologies are becoming more specialised

FATF identifies several important regional patterns.

Africa and Asia: hawala meets mobile money

Mobile wallets are increasingly being used as customer-facing channels for underground banking and HOSSPs.

The pattern can be:

Mobile wallet → HOSSP → cash/trade settlement

rather than:

Mobile wallet → mobile wallet

In East Africa, FATF highlights corridors associated with Somali diaspora remittances and the use of mobile-money rails such as Kenya’s M-Pesa alongside cash agents and informal exchangers. West African examples include nexus points in major cities where cash-based HOSSP activity intersects with mobile money and bank accounts.

Middle East: VAs + gold

FATF identifies an emerging hybrid settlement model involving virtual assets and gold/precious metals.

Gold can function as:

• a reserve asset;
• a store of value;
• a physical settlement mechanism; or
• an anchor for VA-based balances.

Latin America: BMPE and trade settlement

The Black Market Peso Exchange (BMPE) remains an important Latin American model, combining trade flows, FX arbitrage and informal value transfer.

Its underlying principle is similar to hawala: value crosses borders without necessarily moving the original funds across the border.

Europe and Asia: industrial-scale PML networks

FATF identifies increasingly sophisticated networks involving East Asian links, cash consolidation hubs, wholesale trading, trade settlement, luxury goods, casinos, mule networks, VAs and regulated payment infrastructure.

One-third of responding jurisdictions referenced underground banking/HOSSP structures involving such high-capacity networks.

---

11. One Spanish case shows how fragmented the network can become

Operation Karasu in Spain provides an important illustration.

Investigators identified a structured underground banking network with two branches performing different functions.

One branch provided and distributed cash in Spain in exchange for VAs. Another received funds in other jurisdictions and arranged equivalent cash payouts in Spain.

Investigators identified:

• 32 transactions
• totalling more than EUR 5.5 million
• over three months
• while one VA address processed more than USD 21 million
• over two years.

This is precisely the type of case that traditional single-account monitoring struggles to identify.

The suspicious activity was distributed across:

cash + couriers + VA wallets + different jurisdictions + separate network branches.

The same infrastructure could serve multiple transactions over time.

For AML teams, this strongly supports the move from account-centric monitoring to network-centric monitoring.

---

12. Why conventional “follow the money” approaches struggle

The FATF identifies a fundamental investigative problem:

Sometimes the money does not move.

Traditional investigations often rely on tracing a transaction from origin to destination. But in an underground banking model, HOSSP 1 can receive money in one country while HOSSP 2 pays an equivalent amount from its local pool.

The eventual settlement could happen through:

• trade;
• cash;
• gold;
• another HOSSP;
• third-party payments;
• bank accounts;
• VAs; or
• offsetting.

This means the visible payment may represent settlement rather than the original movement of criminal proceeds.

It changes the investigative question from:

“Where did this money go?”

to:

“What obligation is this payment settling?”

That is a much more powerful analytical question.

---

13. The biggest weakness may be knowledge, not technology

The FATF identifies several structural weaknesses:

Fragmented terminology

Different agencies and jurisdictions may use different definitions for the same phenomenon.

Weak data

Most jurisdictions lack reliable quantitative data on operators, transaction volumes and market size.

Limited training

Fewer than half of jurisdictions report structured capacity-building on underground banking/HOSSPs, and only about one-third specifically cover PML through these channels.

Weak NRA integration

Approximately one-third explicitly recognise PML within their NRAs, while others may cover underground banking only at a broad level.

Regulatory arbitrage

Differences in licensing, KYC, record-keeping and reporting requirements allow PML networks to shift activity between jurisdictions.

The result is a dangerous feedback loop:

limited visibility → weak risk assessment → weak typologies → weak detection → limited intelligence → limited visibility.

Breaking this cycle requires better data sharing and continuous typology development.

---

14. What should AML compliance leaders change?

The FATF’s recommendations can be translated into a practical AML operating model.

1. Monitor relationships, not just transactions

Transaction monitoring should feed into entity and network analysis.

Look for relationships between:

• common beneficial owners;
• common directors;
• shared addresses;
• common telephone numbers;
• common devices;
• common payment instruments;
• recurring counterparties;
• common PSPs/VASPs;
• shared cash-intensive businesses;
• repeated trade relationships; and
• common settlement corridors.

The objective is to identify network nodes and controllers, not just suspicious transactions.

---

2. Build underground-banking typologies into transaction monitoring

FATF specifically calls for formal feedback loops through which authorities share typologies, red flags and case outcomes with reporting entities.

For financial institutions, this means creating dedicated scenarios for combinations such as:

• many-to-one payments;
• repeated third-party transfers;
• cash deposits followed by rapid cross-border movement;
• unexplained payments to import/export firms;
• unusual payment references;
• circular trade flows;
• unrelated customers using the same accounts;
• rapid fiat-to-VA conversion;
• multiple accounts linked to a common beneficiary;
• activity inconsistent with customer profile;
• repeated transfers involving high-risk corridors.

No single indicator proves underground banking. The combination is what matters.

---

15. Add non-transactional intelligence to the AML stack

The FATF explicitly recommends detection beyond traditional supervisory and investigative tools.

These include:

• OSINT;
• social-media monitoring;
• mystery shopping;
• whistleblower channels;
• public registries;
• online advertising monitoring;
• digital forensics;
• cultural intelligence; and
• VA tracing.

The Oman case demonstrates the potential.

Authorities detected an apparent unlicensed remittance network through a combination of:

whistleblower intelligence + customer enquiries + WhatsApp monitoring + social-media analysis + payment data.

The investigation identified six suspected hawaladars and approximately USD 72,293 in transaction flows over one year.

The lesson is straightforward:

The internet can reveal the existence of the financial service before the transaction-monitoring system reveals the financial crime.

---

16. Treat cross-sector data as a detection requirement

FATF recommends integrated digital infrastructures connecting, where appropriate:

• supervisors;
• FIUs;
• law enforcement;
• customs;
• tax authorities;
• financial institutions;
• PSPs;
• VASPs; and
• relevant public/private registries.

For financial institutions, the same principle applies internally.

An AML investigation may need to connect:

KYC data + transaction data + corporate data + adverse media + trade data + payment data + VA exposure + device/behavioural signals.

The more fragmented the laundering scheme, the less effective a siloed dataset becomes.

---

17. Move from transaction-based enforcement to system-wide disruption

This is arguably the FATF report’s most important strategic recommendation.

The report proposes a “barrier model” that maps the entire laundering chain:

crime → cash generation → collection → recruitment → settlement → trade/financial layering → cash-out → reintegration

and identifies where preventive or enforcement interventions can be applied.

For an AML compliance leader, this translates into a useful internal question:

If we block this account today, what other account, entity, PSP, mule or settlement mechanism will replace it tomorrow?

If the answer is “several,” the institution has identified a network rather than an isolated customer.

---

18. Centralise case intelligence

FATF recommends centralised statistics and case registries containing information on:

• investigations;
• prosecutions;
• convictions;
• administrative actions;
• seizures;
• confiscations;
• STR/SAR data;
• typologies; and
• enforcement outcomes.

This is important because underground banking investigations can otherwise become disconnected case files.

A stronger model turns each investigation into reusable intelligence:

Case → typology → indicator → detection rule → network → new case → refined typology

This creates the intelligence feedback loop FATF advocates.

---

19. International cooperation is not optional

The FATF reports that 90% of detailed case examples submitted by jurisdictions contained a cross-border element.

This is consistent with the structure of the networks themselves.

A typical scheme may involve:

criminal proceeds in Europe → cash collection → underground settlement → PSP in another jurisdiction → VA conversion → gold/trade settlement → beneficiary elsewhere.

No single institution or jurisdiction necessarily sees the entire chain.

The FATF therefore recommends faster information exchange, greater legal alignment, joint investigations and practical use of international cooperation networks.

---

20. Financial inclusion is part of the AML solution

One of the report’s more nuanced findings is that enforcement alone can be counterproductive.

HOSSPs often serve legitimate customers because they provide:

• accessibility;
• speed;
• affordability;
• remittance access; and
• services in areas underserved by formal finance.

The FATF warns that indiscriminate enforcement or de-risking can push legitimate users further into informal channels, reducing transparency and increasing vulnerability.

Therefore, an effective AML strategy needs two parallel tracks:

Reduce criminal access to underground banking

while simultaneously:

Increase legitimate access to safe, affordable formal financial services.

This is particularly relevant to migrant and diaspora communities.

---

The AML leader’s checklist for 2026

Based on the FATF findings, compliance leaders should assess whether their programmes can answer the following questions:

Risk assessment

• Is underground banking/HOSSP risk explicitly covered in the institution’s financial-crime risk assessment?
• Are high-risk corridors identified?
• Are cash-intensive sectors assessed separately?
• Are mobile money, PSPs, VAs and vIBANs included?

KYC/CDD

• Can we identify beneficial ownership across connected entities?
• Can we identify nominee and front-company relationships?
• Are customer profiles connected to expected transaction behaviour?

Transaction monitoring

• Can we detect many-to-one and one-to-many patterns?
• Can we detect rapid movement through multiple intermediaries?
• Can we identify third-party payments?
• Can we identify circular transaction patterns?
• Can we connect cash, bank, PSP and VA activity?

Network analysis

• Can we identify common counterparties?
• Can we detect shared accounts, devices, addresses and identifiers?
• Can we identify potential controllers?
• Can we identify clusters rather than isolated alerts?

Digital intelligence

• Does the organisation use OSINT where legally appropriate?
• Can it monitor public online advertising for suspicious financial services?
• Can investigators analyse digital communication evidence?
• Can VA exposure be incorporated into investigations?

Intelligence

• Are case outcomes converted into new detection indicators?
• Are typologies updated regularly?
• Are false positives analysed?
• Is there a formal feedback loop between investigations and monitoring?

Cross-border risk

• Can investigators reconstruct transactions across jurisdictions?
• Can the institution identify high-risk settlement corridors?
• Are international information-sharing mechanisms being used effectively?

---

Conclusion: Hawala is evolving from a payment mechanism into an ecosystem

The FATF’s September 2026 report changes the way underground banking and hawala should be viewed.

The threat is no longer adequately represented by the traditional image of:

cash → hawaladar → cash.

The modern model can look more like:

criminal proceeds → shell company → bank/PSP → mule account → mobile wallet → HOSSP → trade settlement → VA → gold → foreign beneficiary.

The individual transactions within this chain may look legitimate.

The network is what makes them suspicious.

The data in the FATF report reinforces this shift. Nearly 90% of responding jurisdictions report underground banking/HOSSP presence. More than 80% identify these mechanisms among principal PML channels. Approximately 80% say they are combined with other laundering methods. Nearly 70% report emerging typologies and technological integration. And 90% of detailed case examples contain a cross-border component.

The strategic message for AML compliance leaders is therefore clear:

Do not build an AML programme that searches only for suspicious transactions. Build one capable of identifying suspicious ecosystems.

That means combining transaction monitoring with entity resolution, beneficial ownership intelligence, network analytics, cross-sector data, OSINT, digital intelligence, VA analytics, behavioural signals and continuously updated typologies.

The FATF report itself points in this direction: better data, stronger public-private cooperation, advanced analytics, integrated digital infrastructure, specialised investigation capabilities and a shift from transaction-by-transaction enforcement toward system-wide disruption of PML chains.

And perhaps the most important lesson is that the formal financial system is now part of the battlefield.

The institutions best positioned to detect underground banking will not necessarily be those that find the biggest transaction.

They will be those that can connect the small transactions, entities, behaviours, corridors and settlement mechanisms that collectively reveal the network.