From the journal

Hawala and Underground Banking in FATF’s 2026 Report

The Financial Action Task Force (FATF) published a September 2026 report on professional money laundering through underground banking, hawala and other similar service providers (HOSSPs). The questions are what its findings establish, how they relate to FATF standards, and what responses they support. No domestic jurisdiction, transaction or enforcement proceeding has been specified. The analysis addresses international standards and attributed country examples; it does not determine liability or operational duties under an unidentified national law.

Illia ProkopievCo-Founder and CEO16 min read

Summary

FATF presents the report as an awareness-raising publication with illustrative good practices. It creates no domestic offence, investigative power or reporting deadline. Authorities and regulated firms must identify the applicable domestic legal basis for action. (Report, paras. 18, 151–153.)

Legitimate remittance use, provider authorisation and criminal misuse require separate findings. Lawfully earned funds can pass through an unauthorised provider, while an authorised provider can process criminal proceeds. National treatment varies. (Report, paras. 30–36, 139–143.)

Customer payout and settlement between operators can use different channels. Banks, payment providers, trade businesses and virtual asset services can hold records relevant to informal settlement. The five settlement categories overlap. (Report, paras. 44, 67–78, 91–96.)

Digital hawala includes electronic coordination, customer interfaces and virtual asset settlement. Cash remains relevant. FATF reports some AI use, but Japan's automated-transfer example does not independently establish artificial intelligence. (Report, paras. 80–84; Box 6.)

FATF's reported prevalence percentages cannot establish the proportion of remittances that is illicit. Paragraph 50's figure of more than 80% conflicts with the 33% shown in Infographic 3. The published participation counts also require clarification. (Report, paras. 4, 42, 50–51; nn. 6, 8–9; Infographic 3.)

Investigators should examine controllers and settlement networks, while prosecutors must establish the applicable offence. Institutions must apply the separate suspicion-based reporting threshold; they should not await evidence sufficient for conviction. (Report, paras. 58, 145–150, 158–161; FATF Recommendations, Recommendation 20.)

FATF favours targeted enforcement alongside affordable authorised remittances and proportionate customer checks. Community ties, nationality and use of hawala cannot establish individual criminal responsibility without evidence of the relevant conduct. (Report, paras. 123–125, 200–208.)

Analysis by Issue

FATF published Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers on 3 September 2026. The Report addresses operating models, enforcement obstacles and good practices. FATF expressly describes its purpose as awareness-raising and its practices as illustrative rather than prescriptive. (FATF, official publication notice, 3 September 2026; Report, paras. 18, 39–41, 151.)

The Report creates no standalone domestic offence, search power, confiscation procedure or filing deadline. FATF standards require national implementation through measures adapted to each country's circumstances. A supervisor can use the Report to inform risk priorities, but any compulsory action requires an applicable legal power. Existing domestic obligations continue independently of this publication. (FATF Recommendations, June 2026, Introduction, pp. 7–8; Report, paras. 151–153.)

FATF names Recommendations 3, 5 and 14, alongside Immediate Outcomes 3 and 7, in paragraph 18. Under the June 2026 assessment methodology, Outcome 3 covers supervision and preventive compliance by financial institutions and virtual asset service providers. Outcome 7 concerns money laundering investigations, prosecutions and sanctions. These references identify assessment objectives without assigning new country ratings. (Report, para. 18; FATF Methodology, June 2026, Immediate Outcomes 3 and 7, pp. 129, 150.)

Lawful use, authorisation and criminal misuse

FATF distinguishes professional money laundering (PML) from the transfer arrangements that criminals exploit. PML concerns third-party laundering services supplied for profit by actors separate from the predicate offence. Underground banking encompasses informal arrangements for transferring, settling or storing value through intermediaries. HOSSPs are a subset of money or value transfer services (MVTS), commonly using compensation and delayed net settlement. These definitions do not establish any particular person's criminal responsibility. (Report, paras. 24–36; definitions, pp. 65–67.)

Under Recommendation 14, countries should license or register MVTS and monitor compliance. Countries should identify unauthorised providers and apply proportionate, dissuasive sanctions. An agent may instead appear on its provider's current list, accessible to competent authorities in the countries of operation. Providers should include agents in their anti-money laundering and counter-terrorist financing (AML/CFT) programmes and monitor compliance. A country need not require separate authorisation where an existing domestic financial-institution licence or registration permits MVTS and the institution is already subject to all applicable FATF obligations. (FATF Recommendations, Recommendation 14 and its Interpretive Note; FATF Methodology, criteria 14.1–14.5.)

A customer's lawful earnings do not establish the provider's authorisation, and an operator's registration does not establish every transaction's legality. FATF reports that unlicensed provision is generally criminal in most countries. Yet paragraph 139 records jurisdictions where comparable services operate lawfully without registration because they are neither expressly regulated nor prohibited. A national determination therefore requires the relevant offence, territorial connection and authorisation record. (Report, paras. 31, 34–36, 139–143.)

Customer payments and settlement between operators

The customer transfer and subsequent settlement need separate examination. One operator receives value locally and instructs a counterpart to pay the beneficiary from local resources. Operators record their obligations and later reconcile accumulated balances. Infographic 2, on printed page 14, depicts these stages. The model does not require a cross-border transfer for each customer payment; later settlement can involve cross-border cash, goods or financial transfers. (Report, para. 44; Infographic 2; paras. 65–78.)

FATF identifies five analytical categories. Bilateral offsetting balances reciprocal obligations between two operators. Triangular or network-based settlement involves additional participants, as depicted in Infographic 5 on printed page 22. Settlement through value uses cash, trade or commodities. Formal-channel settlement uses regulated financial services, while the digitally based category covers virtual assets and digital payment services. A scheme can combine several categories. (Report, paras. 67–78.)

The digital classification remains qualified within the Report. Paragraph 67 introduces a fifth category, but paragraph 78 describes digital mechanisms as tools that support other settlement methods. These passages permit overlapping classifications; they do not justify counting every digitally supported transfer as an additional, independent settlement. (Report, paras. 67, 77–78.)

Third-party payments require examination of the underlying obligation. FATF describes clearing through an entity other than the invoiced customer, alongside trade abuses involving misinvoicing, falsified shipping documents or phantom shipments. The identity of an unexpected payer alone does not establish trade-based money laundering. Investigators need commercial records and payment instructions to determine whether the arrangement explains a genuine debt or conceals criminal value. (Report, paras. 70–71.)

Digital activity and regulated financial services

Digital hawala describes several configurations rather than a uniform product. Operators can exchange instructions electronically while settling through cash or trade. Customers can use mobile wallets while counterpart operators reconcile elsewhere. Other arrangements use stablecoins, regulated payment accounts or combinations of digital services. FATF reports that nearly 70% of respondents identified the integration of new technologies. That is a respondent-based observation, not a measure of digital transactions worldwide. (Report, paras. 80–81.)

Authorities report shorter detection windows and records dispersed across services and jurisdictions. Cash remains important to collection and payout, with bulk transport continuing in some networks. Japan's Box 6 describes threshold-triggered automated transfers, which do not by themselves establish AI use. Paragraph 81(v) separately attributes reports of AI-based tools to some jurisdictions. (Report, paras. 81–84; Box 6.)

FATF describes PML businesses with specialised roles, internal records, liquidity arrangements and multiple clients. Controllers can coordinate collectors and settlement providers across countries. This division of work explains why an investigation can identify a courier without identifying the controller. That inference concerns network organisation; the courier's knowledge still requires evidence. (Report, paras. 58, 85–90, 147.)

Regulated payment products can connect these arrangements to records held by identifiable institutions. FATF describes bank accounts, payment service providers, virtual IBANs, prepaid instruments and virtual asset wallets as collection, settlement or payout channels. Italy's Box 7 includes alias accounts linked to master accounts. These examples support examining account relationships and economic purpose, without classifying the products themselves as criminal. (Report, paras. 91–96; Box 7.)

Bank settlement predates the 2026 publication. Although paragraph 35 presents formal-channel use as a development since 2013, FATF's earlier report expressly acknowledged bank settlement. The supported comparison concerns the digital configurations and combinations documented in 2026. (Report, paras. 35, 66–67, 80–96; FATF, The Role of Hawala and Other Similar Service Providers in ML/TF, 2013, pp. 9–10, 13–14.)

Separate payment-transparency amendments do not become duties created by this Report. FATF's Recommendation 16 announcement states that the changes will come into effect by the end of 2030. That international timetable neither postpones existing domestic duties nor establishes a uniform immediate deadline for every institution. Applicable national implementation must be checked separately. (FATF, FATF updates Standards on Recommendation 16 on Payment Transparency, 18 June 2025, updated 28 October 2025.)

Regional patterns and country examples

FATF reports mobile-money integration in Africa and Asia, often with customer-facing payments and settlement elsewhere. Middle Eastern examples combine virtual assets with gold or other high-value commodities. Latin American examples retain Black Market Peso Exchange arrangements and related trade settlement. FATF also records comparable or overlapping practices outside those regions, so geography does not provide an exclusive classification. (Report, paras. 103–122.)

Some reported high-capacity PML networks have East Asian operational links and participants from multiple jurisdictions. FATF distinguishes these criminal service businesses from community remittance channels. Shared language, migration ties or nationality cannot establish individual participation without evidence connecting the person to the relevant activity. The case-specific inquiry concerns conduct, counterparties and settlement arrangements. (Report, paras. 123–128, 201–202.)

The Netherlands' Operation Klaver reportedly identified a network that processed approximately EUR 500 million in criminal proceeds over eight months. Belgium describes criminal cash exchanged for bank-funded value through businesses seeking undeclared wage payments. Türkiye describes virtual asset and precious-metal settlement. These are FATF's accounts of contributed cases; where it reports no judgment or final outcome, the examples cannot establish one. (Report, Boxes 1, 2 and 10.)

FATF describes outgoing hubs where proceeds originate and incoming hubs where value is received or absorbed. Investigators can use that functional distinction to identify the jurisdictions holding relevant participants or records. The Report does not assign a country's measured share of global laundering, and these descriptions do not constitute jurisdiction-listing decisions. (Report, paras. 51, 129–130.)

Survey findings and numerical limits

The survey does not support a global estimate of illicit remittances. FATF reports 46 responding jurisdictions and questionnaires circulated in September 2025 and February 2026. The published lists also include an institutional contributor and do not fully reconcile the stated jurisdiction count. Paragraph 43 separately records the presence of underground banking and HOSSPs in nearly 90% of responding jurisdictions. None of these statements measures the proportion of customers or transfers involved in crime. (Report, paras. 4, 42–43, 48, 51; nn. 8–9.)

FATF's two prevalence figures conflict. Paragraph 50 states that more than 80% of jurisdictions identify these systems among principal PML channels or techniques. Infographic 3, on printed page 16, shows 33% for underground banking and HOSSPs under a respondent-percentage heading. FATF supplies no reconciliation in the available materials. Selecting one percentage as the corrected figure would require information absent from the publication. (Report, paras. 50–51; Infographic 3.)

Other percentages concern different reported observations. Approximately 80% of jurisdictions report combining these arrangements with other laundering methods. Separately, 90% of the detailed case examples submitted contained a cross-border element. Those denominators cannot be exchanged, added together or converted into population-wide prevalence rates. (Report, paras. 60, 192.)

FATF records missing operator counts, transaction volumes and estimates of the proportion of PML using these systems. Some authorities assign lower risk because they lack detected cases. Where detection capacity is uncertain, absence of identified cases cannot establish absence of activity. It also cannot justify presuming criminality in every unmeasured transaction. (Report, paras. 132–138.)

Detection and proof of offences

FATF identifies inconsistent definitions, missing data, differences in national treatment and operational constraints as obstacles to enforcement. Agencies within one country can disagree about terminology or legal status. Foreign assistance can be delayed by confidentiality restrictions, incompatible formats or differing procedural requirements. Those obstacles affect evidence gathering without changing the elements of the applicable offence. (Report, paras. 131–150.)

An incomplete bank trail does not exclude other evidence. FATF identifies ledgers, communications, tokens and records of collections or payouts as relevant sources. Prosecutors still need to distinguish an informal transfer arrangement from participation in laundering. A legitimate-remittance explanation must be tested against the person's conduct and the requirements of the charged offence. (Report, paras. 58, 147, 150, 191.)

FATF calls for rules allowing criminal knowledge and intent to be inferred from objective circumstances. A predicate-offence conviction should not be necessary when proving that property represents criminal proceeds. Domestic evidentiary rules determine how that proof can be made; the Report cannot establish an unnamed operator's mental state. (FATF Recommendations, Interpretive Note to Recommendation 3, paras. 4, 7(a); Report, paras. 147, 150.)

Terrorist financing can involve lawfully sourced assets. FATF's standard requires no actual use in, or link to, a specific terrorist act. The required intention or knowledge must still be established under the applicable offence. Türkiye's reported investigation involving digital receipts and front businesses illustrates the evidentiary inquiry without proving that unrelated remittances finance terrorism. (FATF Recommendations, Interpretive Note to Recommendation 5, paras. 2, 5–7; Report, paras. 97–102; Box 8.)

Supervision and network disruption

FATF encourages authorities to define authorised activities and the consequences of unauthorised provision. Public registers, warnings and published enforcement outcomes can help users identify authorised services. Supervisory attention should also cover the businesses through which laundering networks collect or settle value. Any inspection, sanction or disclosure remains dependent on the responsible authority's powers. (Report, paras. 152–157, 173–174.)

The Report's barrier model maps collection, transfer, settlement and reintegration, then assigns interventions to competent authorities. Belgium's example distributes measures across that chain. France reports early account restrictions and judicial seizure procedures involving short-lived companies suspected of laundering. FATF's account does not confer equivalent powers on another country's authorities. (Report, paras. 158–160; Box 15.)

Investigators must control scope. FATF warns that dismantling a small team can leave a replaceable service intact, while pursuing every connection can stall proceedings. Prioritising controllers and shared settlement arrangements is a case-derived recommendation where evidence connects them to criminal activity. It does not require every investigation to reconstruct every customer transaction worldwide. (Report, paras. 58, 145, 158–161.)

FATF recommends dedicated domestic coordination, joint training and central case registries. National risk assessments should address underground banking and HOSSPs separately and inform supervisory priorities. Authorities can consolidate investigation, prosecution, sanction and recovery records to identify recurring patterns. When consolidating records, authorities should preserve distinctions between suspicions, prosecutions and convictions. (Report, paras. 162–166, 180–190.)

Customer monitoring and reporting

Institutions can use the Report to examine payment activity inconsistent with a customer's business or stated purpose. FATF's examples include unexplained third-party payments, unclear beneficial ownership and transfers through related entities. These features warrant assessment against the customer's documented circumstances and genuine commercial explanations. An indicator derived from a case does not establish a universal rule of suspiciousness. (Report, paras. 89, 93, 168–169, 179; Boxes 7, 23 and 31.)

A reporting decision does not require evidence sufficient for conviction. FATF calls for prompt reporting to a financial intelligence unit where an institution suspects criminal proceeds or terrorist financing, or has reasonable grounds for that suspicion. The applicable domestic threshold governs; further enquiry should not postpone a report once that threshold is met. FinCEN's warning that no single red flag is determinative requires attention to surrounding circumstances, not proof of an offence before reporting. (FATF Recommendations, Recommendation 20; FATF Methodology, criterion 20.1; FinCEN, FIN-2025-A003, 28 August 2025, p. 8.)

FATF favours recurring feedback between authorities and reporting entities about indicators, false positives and monitoring difficulties. Oman describes further enquiries after a reporting entity noticed reduced use of a remittance corridor. That account supports investigating an unexplained change; a fall in formal remittances alone does not prove laundering. Customer contact and information exchange must also respect applicable confidentiality and tipping-off restrictions. (Report, paras. 168–172; Box 9; FATF Recommendations, Recommendation 21.)

Professional services and protected information

Professional-sector coverage depends on the activity and applicable law. FATF distinguishes designated non-financial businesses and professions (DNFBPs) from other businesses involved in settlement. Import/export firms and travel agencies do not become DNFBPs merely because a case involves them. FATF addresses virtual asset service providers under Recommendation 15; a connection to hawala does not displace that classification. (Report, paras. 155–157; FATF Recommendations, Recommendations 15, 22–23 and Glossary.)

For independent legal professionals, FATF's reporting standard excludes information obtained in circumstances covered by professional secrecy or legal professional privilege. This includes accountants acting as independent legal professionals. Countries determine the protected matters; the exclusion does not exempt every service supplied by a lawyer or accountant. The assessment must identify the professional's role, the relevant activity and the circumstances in which information was obtained. No particular communication has been supplied for that determination. (FATF Recommendations, Interpretive Note to Recommendation 23, paras. 1–2.)

FATF encourages digital forensics, blockchain analysis and shared analytical systems, while identifying privacy and resource constraints. A public-private partnership or database does not itself confer authority to disclose protected information. Authorities and firms must establish a lawful basis for each proposed information flow and address restrictions before sharing. (Report, paras. 171, 175–178, 196–199.)

International cooperation and asset recovery

Early contact with foreign counterparts can help identify settlement participants and preserve time-sensitive information. FATF recommends using intelligence exchanges alongside formal assistance where required. Different offence definitions and dual-criminality requirements can obstruct that work. A common description of hawala does not resolve differences in the conduct each jurisdiction criminalises. (Report, paras. 148–150, 192–195.)

Nigeria's Box 37 concerns a reported diversion of NGN 500,000,000, approximately USD 346,000, followed by gold-based settlement and overseas cash delivery. Authorities combined financial records, telecommunications data and supervisory intelligence to identify foreign actors. FATF describes engagement supporting potential mutual legal assistance. It does not report a completed foreign prosecution or final confiscation in that account. (Report, Box 37, p. 72.)

FATF recommends early restraint, freezing and recovery measures alongside criminal case development. Paragraph 191 conditions evidentiary mechanisms on defined circumstances and due process. A suspicious payment pattern cannot establish an unrestricted confiscation power. Authorities must identify the available procedure, its proof requirements and the rights of affected persons under the relevant national law. (Report, paras. 159, 191; Box 15.)

Financial inclusion and lawful remittances

FATF recognises legitimate demand among migrants, refugees, traders and communities with limited banking access. It warns that indiscriminate enforcement can increase exclusion and displace lawful transfers into less traceable channels. Those reported consequences support distinguishing organised criminal exploitation from customers seeking legitimate services. They do not establish immunity for an unauthorised operator. (Report, paras. 200–203.)

FATF proposes affordable authorised remittances, proportionate onboarding and community education. Its country examples include public information on authorised providers and cooperation with community organisations. FATF's separate MVTS guidance opposes wholesale termination merely to avoid an entire category of risk. A firm must still assess the individual relationship and comply with applicable restrictions or reporting duties. (Report, paras. 203–208; Box 27; FATF, Guidance for a Risk-Based Approach for Money or Value Transfer Services, 2016, para. 35.)

For a particular customer, the assessment should connect the source and purpose of value with the provider's status and settlement arrangements. Where explanations remain incomplete, institutions can seek clarification within the limits of applicable law. A lawful purpose does not dispense with required customer checks, and an investigation must not delay a reporting duty already triggered. (Report, paras. 168–179, 201–208; FATF Recommendations, Recommendations 10, 20–21.)

Illia Prokopiev

Written by

Illia Prokopiev

Co-Founder and CEO

Illia is the Managing Partner and founder of Licentium. With over 11 years of practice, he has guided innovators through cross-border M&A deals and the disputes that follow, combining transactional skill with courtroom resolve. Admitted to the bar in 2017, he pivoted early to Web3, serving as legal advisor to prominent crypto projects and carrying AML/MLRO duties that anchored complex token, DAO, and compliance questions on solid regulatory ground. Certified in money laundering prevention and an active crypto investor, Illia blends market intuition with a global network of specialists, enabling Licentium to untangle licensing knots for crypto and AI ventures anywhere in the world.

More from the journal

See all