FATF on Hawala and Underground Banking: AML Red Flags

On 3 September 2026 the Financial Action Task Force published Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers, and one case study, Operation Klaver in the Netherlands, records approximately EUR 500 million in criminal proceeds processed over eight months through a cash-based informal value-transfer system. The report names hawala and underground banking as key channels for professional money launderers, the specialists who move criminal proceeds for a fee, without committing the predicate crime themselves.

As a methods-and-trends publication it carries no article numbers, deadlines, or new obligations. FATF describes the report as an awareness-raising tool for public- and private-sector stakeholders and sets out typologies, red flags and good practices relevant to detection and reporting. FATF looks at how these informal value-transfer systems work, how professional launderers plug into them, and how competent authorities have responded. For those functions, the report provides an awareness-raising and typologies resource that can inform risk assessment, detection and reporting design; it does not itself set a new legal or supervisory threshold.

The temptation with a report like this is to treat it as background reading. That misreads its purpose. The report can inform national risk understanding and operational detection work, and FATF highlights feedback loops through which authorities can translate case experience into typologies, indicators and red flags for reporting entities; the report itself carries no binding legal force.

Related reading: FATF Recommendation 16 travel rule

What FATF actually published on 3 September 2026

The report is a typologies study, the FATF format that maps how a laundering method works in practice using investigated cases rather than legal drafting. It sits alongside two earlier FATF reports it builds on: the 2013 study on the role of hawala and other similar service providers in money laundering and terrorist financing, and the 2018 report on professional money laundering. The 2026 report joins those two strands, the vehicle and the operator, into one analysis.

FATF’s own summary sets the scope. Underground banking, hawala, and other similar service providers, which the report abbreviates to HOSSPs, are long-standing value-transfer and financial-service systems whose practices vary by region and by level of sophistication. They function as informal, decentralised networks that are distinct from the formal financial sector, though sometimes interconnected with it. They can serve legitimate remittance and value-transfer needs, and they can also be exploited by criminal actors, including professional money launderers, to facilitate illicit financial activity.

That dual character is the whole difficulty. A hawala network moving a construction worker’s wages to family abroad and a network settling a drug-trafficking debt can use the same operator, the same accounts, and the same settlement mechanics. The report examines the roles, methods, and typologies of these systems, and it also looks at the capabilities and responses of competent authorities, which is the half of the picture that usually gets less attention.

Reading the report against a live control framework clarifies its function. FATF Recommendation 14 calls on countries to ensure that MVTS providers are licensed or registered and effectively monitored. FATF’s wire-transfer transparency standard dates back to Special Recommendation VII, but the earlier standard required originator information; beneficiary-information requirements were incorporated later. Recommendation 16 was strengthened again in June 2025, with jurisdictions expected to be ready to implement those changes by the end of 2030. In the EU, Regulation (EU) 2023/1113 has applied since 30 December 2024, recasting the pre-existing funds-transfer regime and extending EU travel-rule requirements to in-scope crypto-asset transfers. Regulation (EU) 2024/1624 applies from 10 July 2027 and requires obliged entities to report suspicions regardless of the amount involved, including attempted suspicious transactions under Article 69. The report’s typology findings operate against that backdrop.

How hawala and underground banking move value

The mechanic that makes these systems hard to trace is the split between the value leg and the settlement leg. A customer hands cash or an instruction to an operator in one country. The operator contacts a counterpart in another country, who pays out the equivalent value to the beneficiary, often within hours. No money crosses a border at that moment. The two operators are now in a debtor-creditor relationship, and they settle later.

Settlement is where the 2013 FATF report drew the line between HOSSPs and ordinary money remitters. What distinguishes them is the use of non-bank settlement methods: they clear their mutual positions through trade, through cash, and through netting over a long period. A cluster of transfers in one direction can be offset against flows in the other, so the value that actually needs to be settled is a fraction of the gross amount moved. Trade provides cover for the rest, with an over- or under-invoiced shipment carrying value in the guise of a commercial payment.

This decoupling has a direct consequence for detection. There may be no cross-border wire transfer at the point the value moves, which means the travel-rule data an analyst reaches for first may not exist for that leg. What surfaces in the regulated system is the settlement, and it can look like trade finance, a string of cash deposits, or a domestic transfer between accounts that never obviously touch the original customer. The laundering is real; the wire trail that usually anchors an investigation is thin or absent.

Why professional launderers reach for these channels

The 2018 FATF report defined the professional money launderer as an individual, organisation, or network that provides laundering as a service, for a commission, to whoever pays. These actors operate as independent service providers, running collection accounts, controlling networks of intermediaries, and offering any paying client a menu that ranges from moving cash to placing it into the banking system to settling debts across borders.

Underground banking suits that business model. It offers reach into jurisdictions where formal correspondent relationships are thin, speed that beats bank settlement cycles, and a settlement layer that hides the link between payer and payee. A professional launderer can accept dirty cash in one city, instruct a hawala counterpart to pay clean value in another, and settle the position through trade months later, breaking the chain that an investigator would need to follow.

The 2026 report’s headline is the scale this can reach. The scale can be substantial: the report’s Operation Klaver case study describes approximately EUR 500 million in criminal proceeds processed over eight months through a cash-based informal value-transfer system. The report does not support the further characterisation of that figure as a single controller’s volume or compare it with a mid-sized payment institution.

Where the formal system meets the informal one

An obliged entity rarely sees a hawala transfer as such. It sees the point where the informal network touches the regulated one: the bank account an operator uses to pool customer cash, the payment institution that processes a settlement, the trade-finance instrument that clears a position, the correspondent relationship that lets value cross a border. That contact point is where a regulated entity may be able to observe the risk and apply its existing risk-based controls.

This is also why correspondent banking keeps recurring in AML follow-up work, a theme covered in our note on the MONEYVAL correspondent-banking findings for Bulgaria. A respondent bank that under-controls its own money-remittance customers can pass their risk up the chain to a correspondent that never saw the underlying transfers.

De-risking pulls in the opposite direction and can make the problem worse. FATF reports that some jurisdictions associate account closures, reduced correspondent access and de-risking pressures with greater use of unlicensed alternatives, and warns that indiscriminate measures can displace legitimate users towards less regulated channels. The CSSF states that higher ML/FT risk alone does not generally justify refusing or terminating relationships or excluding entire categories of clients, products or services. It also expressly states that firms may redefine their business lines and cease serving a category of clients as a strategic commercial decision. The regulated system loses sight of the flows instead of governing them.

The obligations that already apply, and how they translate

FATF Recommendation 14 is the international-standard registration hook. It calls on countries to ensure that natural or legal persons providing MVTS are licensed or registered and subject to effective compliance monitoring; FATF materials recognise informal systems described by terms including hawala and hundi within the relevant money-or-value-transfer concept. An operator running an unregistered hawala has not, by that fact alone, committed money laundering; the breach the recommendation targets is operating outside the licensing and supervision regime. FATF’s Interpretive Note to Recommendation 14 states that a country need not impose a separate MVTS licensing or registration system on a person already licensed or registered as a financial institution, permitted under that authorisation to perform MVTS, and subject to the full range of applicable FATF obligations; whether a separate local authorisation is required therefore depends on the jurisdiction’s law.

Recommendation 16 is the transparency hook. Under FATF Recommendation 16, the obligations differ by role and transfer type: ordering financial institutions must ensure that the required originator and beneficiary information accompanies covered payments or value transfers; intermediary and beneficiary financial institutions have their own requirements for retaining information, detecting missing information and applying appropriate procedures. Recommendation 16 does not itself specify whether or how transmitted information must be screened against sanctions lists. Regulation (EU) 2023/1113 has applied since 30 December 2024 and repealed Regulation (EU) 2015/847. It recasts the existing EU regime for transfers of funds and extends travel-rule requirements to in-scope transfers of crypto-assets. Its information requirements vary by transfer type and circumstances; for example, transfers of funds wholly within the Union benefit from simplified accompanying-information rules, and the Regulation contains specific EUR 1,000 provisions and scope exclusions. The travel-rule detail for Recommendation 16 matters here because HOSSP settlement can route through both bank rails and crypto-asset service providers, and the applicable information duties depend on whether the settlement leg is a transfer of funds or a crypto-asset transfer and on the provider’s role under Regulation (EU) 2023/1113.

The reporting obligation is the third hook. Under the EU AML Regulation, Regulation (EU) 2024/1624, obliged entities must report suspicious transactions to their national financial intelligence unit, and the standard is deliberately wide: all suspicious transactions, including attempted ones, regardless of the amount involved. AMLR entered into force on 9 July 2024 and applies from 10 July 2027, so today’s filings still run under transposed national law, though the direction is fixed. What the report changes is the risk and typology information available to teams assessing hawala-linked activity, not the legal duty to file. Reporting teams building toward that regime should read our summary of what AMLR changes in practice.

Outside the EU the instrument changes but the logic holds. In the United Kingdom, AML supervision and registration of money service businesses are governed by the Money Laundering Regulations 2017, with responsibility divided between HMRC and the FCA according to the business’s status; money transmitters also require the relevant FCA registration or authorisation under the Payment Services Regulations 2017. A UK team should therefore cite the applicable domestic UK rules rather than Regulation (EU) 2023/1113. The FATF standard is common; the legal citation is local, and mixing the two is a familiar way to get a source reference wrong.

Red flags a reporting team can put to work

The value of a typologies report is the indicators it hands to a monitoring function. Drawn from the way these networks operate, the patterns worth assessing include third parties settling a customer’s obligations with no clear relationship, flows that dwarf a customer’s stated profile or business, large amounts of criminal cash fragmented into multiple small deposits to avoid financial institutions’ AML monitoring thresholds, and trade documentation that does not match the goods, the route, or the price. The report documents formal-sector settlement through mechanisms including shell companies, mule accounts and corporate structures, using wire transfers, batch payments and layered transactions.

Each of these warrants further investigation, and the discipline the report reinforces is holding the indicator against the specific customer you know. A remittance corridor to a high-risk jurisdiction is expected for a customer whose family is there; the same corridor is a question for a customer whose profile gives no reason for it. Under AMLR, AMLA is mandated to issue guidance on indicators of suspicious activity, so the EU indicator set will become more concrete as that guidance lands.

The trap is the false negative that comes from treating hawala as exotic. They are long-standing value-transfer systems used in many regions, and FATF states that their use is not inherently criminal and may serve legitimate remittance and value-transfer needs as well as illicit activity. A monitoring rule tuned to flag every transfer to a hawala corridor risks generating noise that can blunt detection quality over time. The channel or corridor can itself be a risk indicator, while a mismatch with the customer profile can strengthen the signal; neither is proof on its own.

Turning a suspicion into a filing

Once suspicion crosses the threshold, the mechanics of reporting are the same as for any other typology, and the report does not alter them. The obliged entity files a suspicious transaction report to its national FIU. In Luxembourg that means the goAML platform operated by the Cellule de Renseignement Financier, and the workflow, format, and follow-up are set out in our goAML reporting workflow guide.

Two points bear on hawala cases specifically. First, an attempted transaction is reportable: if a customer tries to route value in a way that trips your suspicion and you decline it, the decision to decline does not discharge the duty to report. Second, the amount is not a gate. The AMLR standard captures suspicious transactions regardless of value, which matters for structured activity where each leg is small by design and only the pattern is large. A team that waits for a threshold before filing will miss exactly the smurfed flows this typology relies on.

The harder question is what to write. A settlement leg that surfaces as a trade payment or a domestic transfer needs the narrative to explain the informal-value-transfer hypothesis, because the raw transaction on its own will not carry it. The report is a useful reference to name the method precisely in that narrative.

Frequently Asked Questions

Is hawala illegal, and does using it trigger a report by itself?

Not necessarily. FATF states that the legal treatment of hawala and HOSSPs varies by jurisdiction and that their use is not inherently criminal. Recommendation 14 calls on countries to ensure that MVTS providers are licensed or registered and effectively monitored, while the 2026 report notes that unregistered HOSSP services are generally a criminal offence in most countries. Use of a HOSSP channel is not, by itself, indicative of money laundering or terrorist financing; the applicable local law and the facts giving rise to suspicion determine the reporting position.

Does the 3 September 2026 report create new reporting obligations?

No. It is a FATF methods-and-trends study with no binding force of its own. Your obligations continue to flow from the FATF Recommendations as implemented in national law, such as the EU Transfer of Funds Regulation and the AML Regulation, or the UK Money Laundering Regulations. The report provides additional typology and risk information that can inform existing detection and reporting frameworks; the rules you file under stay the same.

If there is no cross-border wire, how does the travel rule apply?

Recommendation 16 applies to covered domestic and cross-border payments or value transfers, subject to differentiated obligations and exceptions, while Regulation (EU) 2023/1113 applies to transfers of funds and crypto-assets within its defined EU scope and exclusions. A later HOSSP settlement leg may therefore fall within travel-rule requirements where the particular transfer and providers are in scope; it is not automatically covered merely because it uses a payment or crypto rail. The value leg between operators may carry no wire and no travel-rule data, which is precisely why the settlement leg and the accounts behind it deserve attention.

How do crypto-asset service providers fit into this?

Underground banking increasingly settles through crypto as well as trade and cash. Regulation (EU) 2023/1113 extends EU travel-rule requirements to in-scope crypto-asset transfers and imposes dedicated originator-and-beneficiary information duties on the crypto-asset service providers involved. Those duties are analogous to, but not identical with, the payer-and-payee rules applicable to payment service providers. Under Regulation (EU) 2023/1113, a HOSSP settlement through a CASP is in scope for that leg only where the Regulation’s territorial and transaction-scope conditions are met, including the required Union nexus, and no exclusion applies.

Should we de-risk money-remittance customers to avoid the exposure?

Indiscriminate AML/CFT-driven de-risking can undermine effective risk management and may displace legitimate users towards less transparent channels, but category-level exits are not categorically prohibited. The CSSF expects a nuanced, risk-based assessment and expressly distinguishes AML/CFT-driven de-risking from a strategic commercial decision to redefine a business line or cease serving a customer category.

When does the EU AML Regulation change what we file?

Regulation (EU) 2024/1624 applies from 10 July 2027, with a later application date of 10 July 2029 for football agents and professional football clubs covered by Article 3(3)(n) and (o). Until then, current national transpositions govern day-to-day filing. The report is worth mapping into your controls now so the typology is already embedded when the single rulebook and AMLA’s indicator guidance take effect.

Related Articles

• FATF Recommendation 16 Travel Rule Consultation: How the wire-transfer standard applies across payment and crypto rails in the EU.
• goAML Luxembourg CRF Reporting Workflow: The suspicious-transaction filing process, format, and follow-up with the Cellule de Renseignement Financier.
• AMLR: What Changes in Luxembourg: The single EU rulebook, its application date, and the reporting duties it hard-wires.
• MONEYVAL Bulgaria AML Follow-Up: Correspondent-banking weaknesses and how respondent-bank gaps travel up the chain.
• Wolfsberg Non-Bank PSP AML Guidance: Financial-crime controls expected of payment firms that sit between banks and end customers.

Key Takeaways

• FATF published its report on professional money laundering, underground banking, and hawala on 3 September 2026; it is a typologies study with no new obligation of its own, and one case study describes approximately EUR 500 million in criminal proceeds processed over eight months through a cash-based informal value-transfer system.
• The value-transfer and settlement stages can be decoupled, so observable risk may surface in trade, cash, domestic transfers or formal financial channels; FATF also reports that many networks use the regulated financial system to settle net balances, with wire transfers, batch payments and layered transactions as common features.
• FATF Recommendation 14 calls on countries to ensure that MVTS providers are licensed or registered and effectively monitored. The current Recommendation 16 sets differentiated payment-transparency requirements, while Regulation (EU) 2023/1113 has applied since 30 December 2024 to in-scope transfers of funds and crypto-assets under its own differentiated rules; a HOSSP settlement leg is subject to those requirements only where the particular transfer falls within the relevant scope.
• Report all suspicious transactions to the FIU, including attempted ones and regardless of amount; the AML Regulation applies this standard from 10 July 2027.
• Relevant detection signals include mismatches with the customer profile, third-party involvement and higher-risk corridors or settlement patterns; FATF also reports that de-risking pressures can divert legitimate remittance users and some formal MVTS providers into less visible informal channels.

Sources and References

• FATF, Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers (publication page, 3 September 2026).
• FATF, New FATF report finds underground banking and hawala are key channels for professional money launderers (news release, 3 September 2026).
• FATF, The Role of Hawala and Other Similar Service Providers in Money Laundering and Terrorist Financing (2013).
• FATF, Professional Money Laundering (2018).
• FATF, The FATF Recommendations (Recommendation 14 on money or value transfer services, Interpretive Note; Recommendation 16 on wire transfers, as strengthened June 2025).
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, EUR-Lex.
• Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation), EUR-Lex.
• EBA, Guidelines on information requirements in relation to transfers of funds and certain crypto-assets (travel rule).

Reading the report into your control framework

The practical move is small and specific. Take the settlement mechanics and the mismatch indicators the report describes, and check them against the scenarios your transaction-monitoring already runs and the narrative fields your STRs already ask for. Where a scenario assumes a traceable wire, add the settlement-leg case, so a trade payment or a cluster of domestic transfers can be recognised as the visible end of an informal transfer. Do that before AMLA’s suspicious-activity indicator guidance arrives under the AML Regulation, and the 10 July 2027 application date becomes a checkpoint you have already passed rather than a build you start late.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.