Hawala: How it impacts the financial services sector and what it means under the AMLR

In September 2026, the FATF published Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers — a report drawing on questionnaire responses from 46 jurisdictions and a dedicated Joint Experts Meeting, aimed at closing long-standing knowledge gaps around informal value-transfer systems. Its findings confirm that Hawala is not a marginal, exotic practice confined to informal cash economies: nearly 90% of surveyed jurisdictions report its presence within their territory, and more than 80% identify Hawala-type networks as among the principal channels for professional money laundering.

This matters directly to regulated financial institutions. As the report makes clear, Hawala no longer operates in a parallel world. It increasingly interacts with banks, payment institutions and fintechs through everyday regulated instruments such as virtual IBANs (vIBANs), prepaid cards and payment-agent arrangements. That means AML controls, transaction-monitoring logic and correspondent/agent due diligence at regulated institutions can be a direct line of defence - or a direct point of failure. This post explains (i) how Hawala has traditionally worked and how it operates today, (ii) the money-laundering and terrorist-financing risks it poses, (iii) how it interacts with the regulated financial sector and what that means in practice for compliance functions and (iv) what this means under the incoming EU AML Regulation (AMLR).

1. Hawala: Traditional Practice and Modern Evolution

Traditionally, Hawala is a trust-based, informal money-or-value transfer service operating on what Bafin describes as the "system of two pots": a customer hands cash (or another value) to a Hawaladar in one country, who instructs a counterpart Hawaladar in the destination country to pay the equivalent sum to the beneficiary - without any actual cross-border movement of funds. The two Hawaladars later settle their own mutual positions on a net basis, through cash, trade transactions or other compensation mechanisms. 

Today, Hawala has evolved considerably. The FATF reports that Hawala networks are becoming increasingly professionalised moving from individual, trust-based operators to hierarchical or cell-based structures with corporate-style record-keeping, technical specialists, and a broader pool of professional enablers (lawyers, accountants, notaries, real estate agents, and casino operators). At the same time, nearly 70% of surveyed jurisdictions report a shift towards "digital Hawala": a spectrum ranging from simple digital coordination tools layered onto traditional settlement, through to full virtual-asset settlement, dedicated Hawala apps and AI-based tools. This digitalisation increases transaction speed and network reach and resilience, but also opacity and the complexity of layering. The German regulator, Bafin, similarly notes that Hawala's global significance has grown in step with geopolitical conflict, as large sums are moved across borders through channels beyond the reach of ordinary state authorisation and supervision.

2. Money-Laundering and Terrorist-Financing Risks

The FATF's data leaves little doubt about Hawala's centrality to professional money laundering (PML). More than 80% of surveyed jurisdictions identify Hawala networks as among the principal PML channels, with particular prominence in Asia, Western Europe and West Africa. In the FATF's fourth round of mutual evaluations (2014–2024), half of FATF member jurisdictions and nearly 30% of the wider Global Network rated Hawala as high-risk for money laundering and terrorist financing. 

The FATF attributes Hawala's attractiveness for launderers to four intrinsic features:

• Anonymity and lack of transparency;
• Speed and convenience;
• Low cost; and
• Reliability/reputational trust embedded in Hawaladar networks. 

According to the FATF, the predicate-offence base has also broadened well beyond cash-intensive crime, now spanning drug trafficking, fraud, smuggling, tax evasion, cybercrime, corruption, human and migrant trafficking, and sanctions evasion. 

Bafin's own supervisory experience is consistent with these findings. Bafin has named inadequate AML/CFT prevention as one of six key risks to the German financial system in 2025, specifically citing Hawala's growing significance and committing to at least 75 special AML audits of banks and non-banks in 2025, with a focus on credit and payment institutions carrying elevated terrorist-financing risk. Most recently, Bafin's supervisory notices of 27 March 2025 and 29 September 2025 warned obliged entities of heightened ML/TF risk from sanctions-evasion transactions, specifically flagging informal Hawala networks operating across the Middle East as a means of circumventing EU sanctions against Iran (see our separate blogpost on sanctions circumvention).

3. Hawala and the regulated financial sector

The FATF's most operationally significant finding for regulated institutions is that Hawala is no longer confined to a self-contained informal system: professional launderers are actively fusing Hawala-style settlement with regulated payment infrastructure to gain speed and apparent legitimacy while lowering detection risk. In this model, underground banking functions as a hidden settlement layer, while the regulated sector (banks, PSPs, fintechs, digital wallets) is (mis)used for the surrounding stages of laundering. Access is often obtained via legitimate-looking corporate façades, nominee or shell-entity accounts, and vIBANs enabling fast cross-border transfers. The FATF even reports that in some cases, criminal networks have infiltrated or effectively controlled PSPs themselves, highlighting the importance of AML in the context of qualifying holding and licensing procedures.

The FATF report concludes with a description of best practices in combating the use of underground banking and Hawala networks, which are addressed primarily to financial intelligence units (FIUs), law enforcement and prosecution authorities, and supervisory bodies. 

Our key takeaways to be considered by financial sector entities are:

• AML controls must look beyond the classification as an informal or formal payment scheme. These classifications no longer work in a world where Hawala networks are integrated into the financial sector.
• vIBANs deserve elevated scrutiny. Bafin has once again highlighted that vIBANs can act as ‘trojan horses’ for money laundering and urged obliged entities to adapt their KYC measures. To the extent that vIBAN structures make it difficult to uniquely map payment flows to the actual end customers, risk-based, enhanced requirements must be imposed regarding information gathering, documentation, and ongoing monitoring of the business relationship.
• Nested account structures (alias accounts feeding a master account) and fragmented cross-border transfers are recurring red flags warranting tailored monitoring rules.
• Passporting/agent networks can be a supervisory blind spot. While the FATF does not find that passporting or the use of agents should be considered as AML risks per se, the FATF’s findings raise the question of whether the home/host cooperation and agent oversight in the EU needs to be improved.

4. How is this intertwined with the new EU AML Regulation (AMLR)?

The EU's new single AML rulebook, the AMLR (Regulation (EU) 2024/1624), enters into application on 10 July 2027, replacing the current national regimes with directly applicable, harmonised rules. Several of the points raised above already map onto specific, binding AMLR obligations that financial sector entities should start building into their compliance programmes:

• vIBANs: Article 22(3) AMLR directly targets the vIBAN structures described above. Where an obliged entity issues or relies on vIBANs, it must identify and verify the natural or legal person actually using each vIBAN (not only the master-account holder), record the vIBAN number assigned to that person, and capture the opening or, where applicable, closing dates of the underlying account. This turns Bafin’s supervisory expectation into a binding, EU-wide customer due diligence obligation.
• Sanctions-related exposure: the AMLR does not itself create a separate sanctions regime, which remains a matter of the EU's own restrictive-measures Regulations. However, it hard-wires sanctions-evasion risk into the AML compliance framework. Obliged entities must assess and mitigate the risk of non-implementation and evasion of targeted financial sanctions as part of their business-wide risk assessment and internal policies (Articles 9–11 AMLR) and must screen customers against EU/UN designated-persons lists. Separately, Article 29 AMLR requires mandatory enhanced due diligence for any business relationship or transaction connected to it, reinforcing, at EU regulation level, exactly the heightened scrutiny Bafin’s guidance on sanctions-evasion transactions notices already call for.
• Agent and passporting networks: Article 13 AMLR requires obliged entities to assess the skills, knowledge, good repute, honesty and integrity of agents and distributors before they start acting for the entity, and to repeat that assessment regularly – a direct answer to part of the supervisory blind-spot concern raised above. The accompanying AMLD6 (Directive (EU) 2024/1640) also extends the home/host central-contact-point framework to agent and distributor networks, which should narrow, though not eliminate, the cross-border oversight gap this post flags.

In light of the above, AMLR implementation now running in parallel with the FATF's and Bafin’s warnings, obliged entities have a widening, and increasingly binding, basis to treat Hawala-adjacent typologies as a core AML risk rather than a peripheral one – and a concrete set of rules against which to benchmark their existing controls well ahead of 10 July 2027.