Hawala: Definition and Use in Compliance

What is Hawala?

Hawala is money transfer without money movement. A worker in Dubai hands 10,000 dirhams to a shop owner; hours later, that worker's family in Lahore collects the equivalent in Pakistani rupees from another shop owner. No bank transfer happened. The two shop owners, both hawaladars, will settle their mutual debt later through a reverse transaction, trade invoicing, or another arrangement.

The mechanics are simple. What makes hawala significant from a compliance standpoint is the near-complete absence of formal transaction records. One hawaladar might keep a notebook. Another might use WhatsApp. No SWIFT message was generated. No CTR was filed. No correspondent bank processed the transaction. Regulators in neither country saw the movement.

The Financial Action Task Force classifies hawala as an Informal Value Transfer System (IVTS) and, under Recommendation 14, requires member countries to license or register operators and apply full AML/CFT obligations. In practice, compliance rates vary by corridor. Major commercial districts in Dubai, London, and New York have licensed operators working openly, while a large share of global volume flows through unregistered ones. The FinCEN guidance on money services businesses explicitly covers informal operators, but registration rates among active hawaladars remain low. That gap between legal requirement and operational practice is where the criminal opportunity lives.

The system's efficiency is real, which is why it persists. Hawala operators typically charge 1 to 3 percent, compared to 5 to 8 percent for formal bank wire transfers in high-volume corridors, and settlement takes hours rather than days. According to World Bank remittances data, global flows to low- and middle-income countries reached $669 billion in 2023, with informal channels handling a significant and unmeasured share in certain corridors including UAE-Pakistan and US-Somalia.

Hawala is related to but distinct from similar systems: the Chinese fei-ch'ien (flying money), the West African xitique, and the Latin American black market peso exchange. FATF groups these under its IVTS label. All share the same mechanism: value transferred through trust and offsetting claims, without physical movement of funds.

This typology sits squarely in the AML placement and layering category. The criminal separates funds from their origin not through bank accounts but through a parallel settlement network that operates outside regulatory visibility. No SWIFT messages. No correspondent bank records. No beneficiary information attached to the transfer. FATF documented cases across 17 countries in its 2013 typology report, noting hawala networks in narcotics trafficking, human trafficking, and sanctions evasion.

How does Hawala-Based Money Laundering work?

The mechanics are simple, and that's part of why the pattern persists across centuries and jurisdictions. A person in City A gives cash to a local broker (hawaladar). That broker contacts his counterpart in City B, who pays the intended recipient an equivalent amount in local currency, minus a small commission. No money physically crosses a border. No wire transfer is initiated. The two brokers record a debt to settle later, through their own private arrangement.

For money launderers, this is the central appeal: funds appear in the destination country with no wire transfer record, no SWIFT message, and no regulatory filing attached.

Settlement between the two hawaladars is where the typological complexity emerges. Legitimate hawaladars settle through reverse flows of clean funds or direct cash payments between trusted partners. Criminal networks use over- and under-invoiced trade transactions, physical gold shipments, real estate purchases, and cryptocurrency transfers. This is precisely where hawala intersects with trade-based money laundering, multiplying the detection challenge.

Illustrative scenario: A narcotics syndicate generates $3 million in US street-level cash sales. A recruited network of money mules makes structured deposits across 60 bank accounts, each just below $9,500, to avoid currency transaction reports. Those accounts wire funds to a hawaladar's business account coded as "consulting fees." The hawaladar instructs his Dubai counterpart to release equivalent funds to a UAE-registered shell company. The shell company invests in residential property. Eighteen months later, the criminal receives a wire transfer from an apparently legitimate property sale, and the layering cycle is complete.

The key compliance implication: no single bank sees the full picture. The deposit bank sees small cash deposits. The wire bank sees a legitimate-looking business payment. The UAE bank sees a real estate transaction. Only cross-institution data sharing or network-level analysis surfaces the full chain.

How is Hawala used in practice?

For compliance teams, hawala appears in three distinct modes: as a business type they bank, as a behavioral pattern in transaction monitoring, and as a mechanism identified in an active investigation.

Banks that provide accounts to licensed MSBs, including registered hawala operators, must build their onboarding around that risk profile. Know Your Customer (KYC) for a hawala operator means verifying their own AML program, their licensing status, their key personnel, and their transaction corridors. An operator with heavy exposure to Afghanistan, Somalia, or Myanmar warrants Enhanced Due Diligence (EDD): on-site review of customer records, documentation of the broker network, and ongoing transaction profiling.

In transaction monitoring, the textbook hawala pattern is a cluster of round-dollar cash deposits from multiple unrelated customers, followed by a single large outbound wire to a high-risk jurisdiction. A 2020 FATF typologies report identified exactly this pattern in UAE correspondent accounts, where individual MSB accounts aggregated funds from hundreds of customers before transferring to Pakistan and Afghanistan. Banks with graph-based analytics tools surface these high-centrality accounts faster than single-account rule sets.

Investigation teams building a hawala case face the challenge of reconstructing the network. That means identifying the hawaladars at both ends, mapping the settlement mechanism (is it trade invoicing, gold, or a reverse flow?), and determining whether the underlying funds are proceeds of a predicate offense. The trade-based money laundering (TBML) link is common: goods are over- or under-invoiced in trade transactions to settle the inter-broker debts.

Filing a Suspicious Activity Report (SAR) on suspected hawala activity requires a specific narrative. FinCEN expects investigators to document the suspected hawala mechanism, the direction of fund flow, and why the activity is inconsistent with the customer's stated business purpose. "Multiple cash deposits, high-risk jurisdiction" doesn't meet that standard.

Red flags and indicators

Most institutions detect hawala exposure through a combination of transaction monitoring alerts and account-level behavioral analysis. The indicators cluster into four categories.

Transaction-level signals

• Cash deposits repeatedly between $8,000 and $9,500 (structuring to avoid CTR thresholds)
• Frequent remittances to UAE, Pakistan, Somalia, or Afghanistan labeled "family support" or "gift" inconsistent with stated income
• Multiple inbound transfers from unrelated parties consolidated and sent to a single overseas account on the same day
• Cash-intensive deposit followed immediately by an international wire with no intervening domestic activity

Account-level signals

• Stated occupation (store clerk, driver) inconsistent with monthly transfer volumes exceeding $20,000
• Account opened recently with immediate high-frequency cross-border activity
• Customer claims to operate a money services business but holds no registered MSB license
• Inconsistent source-of-funds explanations across multiple transactions or relationship manager visits

Network-level signals

• Shared phone numbers, addresses, or device fingerprints across multiple remittance accounts at the same institution
• Tight account clusters all routing to the same small set of overseas beneficiaries with no apparent personal connection
• Counterpart accounts concentrated at correspondents in known hawala-active corridors
• Circular flows where funds exit an account and return to the same entity after three to five intermediary hops

Behavioral signals

• Customer avoids in-branch visits entirely, preferring mobile or agent channels for all transactions
• Becomes evasive when asked to describe the beneficiary relationship
• Different names, phone numbers, or addresses used across transactions at the same institution
• Associates open accounts at the same institution within days of the primary account, then route funds to the same destinations

Notable real-world cases

The most extensively documented enforcement action in this area is the prosecution of Altaf Khanani, described by US federal prosecutors as operating one of the world's largest money laundering networks. Khanani's hawala operation, centered in Pakistan and the UAE, moved an estimated $14 billion for Colombian and Mexican drug cartels, terrorist organizations, and sanctions evaders across roughly a decade. He pleaded guilty to money laundering conspiracy charges in a US federal court in 2015 and received a federal prison sentence in 2017. The case is documented in the DOJ press release.

FATF's 2013 typology report, "The Role of Hawala and Other Similar Service Providers in Money Laundering and Terrorist Financing," documented 48 cases across 17 countries and remains the canonical reference document for financial intelligence units worldwide. It is published as FATF's guidance on the Forty Recommendations.

FinCEN Advisory FIN-2010-A011 addressed IVTS-based money laundering risk in specific remittance corridors, noting that unregistered hawala operators were moving narcotics proceeds and terrorist financing through accounts at US financial institutions. The advisory remains live guidance for institutions with high-diaspora customer bases on the covered corridors.

The Egmont Group's 2017 report on professional money laundering included several hawala cases where correspondent bank compliance failures allowed settlement flows to pass undetected for years. Their findings are collected in the Egmont Group typology library.

How to detect Hawala-Based Money Laundering

Start with rule-based detection. Structuring alerts, velocity checks on outbound wire frequency, and threshold monitoring for cash deposits just below CTR limits catch the most obvious placement patterns. They're necessary. They're not sufficient.

Hawala operators split transactions across multiple accounts and institutions specifically to defeat single-account thresholds. Behavioral analytics close this gap. Build a normal-activity baseline for a given customer segment, then flag deviations: sudden volume spikes, new high-risk destination countries, or sharp changes in average transaction size relative to peers. An account in a low-income demographic sending $45,000 per month to Pakistan, when comparable accounts average $600 per month, warrants investigation even if no single transaction breaches a threshold.

Graph-based network analysis is where hawala detection gets its real traction. The broker-to-broker settlement relationship leaves structural footprints: shared identifiers, overlapping beneficiary accounts, and reciprocal flows between institutions that are invisible when you analyze accounts in isolation. A cluster of 30 accounts all routing through the same UAE correspondent with no apparent personal or business connection is a strong structural signal. That cluster won't appear in any single-account monitoring queue; it only emerges from graph analysis.

Manual review of KYC documentation should accompany every automated alert. Unlicensed MSB activity is a criminal offense under 18 U.S.C. § 1960, and onboarding inconsistencies often surface the network before transaction data does. Analysts should also check for overlap with cuckoo smurfing and smurfing and structuring patterns, which co-occur frequently with hawala placement in high-volume corridors.

We've seen banks identify entire hawala broker networks by starting with a single structuring alert and expanding outward through graph analysis. The broker is almost never acting alone.

Hawala in regulatory context

Hawala sits at the intersection of payment regulation, anti-money laundering law, and counter-financing of terrorism frameworks.

The CFT dimension draws the most acute regulatory attention. The 9/11 Commission Report documented Al-Qaeda's use of hawala to move operational funds into the United States before the 2001 attacks. Post-9/11, FATF strengthened Recommendation 14 to close that gap, requiring IVTS operators to be licensed or registered and to meet AML/CFT standards equivalent to those applied to banks. Recommendation 16, the Travel Rule, requires wire transfer originators to transmit complete beneficiary information, which hawala transactions routinely omit.

In the United States, the Bank Secrecy Act (31 U.S.C. § 5311 et seq.) requires every money transmitting business, hawala operators explicitly included, to register with FinCEN as an MSB, maintain records, and file Currency Transaction Reports above $10,000 alongside SARs when they identify suspicious activity. Two separate provisions carry the penalty: failure to register is an offense under 31 U.S.C. § 5330, and operating an unlicensed money transmitting business is a federal crime under 18 U.S.C. § 1960. FinCEN has made the coverage explicit in multiple advisories, yet in practice many unregistered operators serve entire neighborhoods without filing a single report.

In the European Union, the Fourth and Fifth Anti-Money Laundering Directives brought informal transfer operators within the AML regime, requiring registration, customer identification, and transaction recordkeeping; 5AMLD (Directive 2018/843/EU) also expanded due diligence for high-risk third-country transactions, which applies directly to corridors involving FATF-listed jurisdictions. The Sixth Directive extended criminal liability for money laundering to cover informal payment systems.

In the UK, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 require IVTS operators to register with HMRC and comply with full customer due diligence obligations. Operating without registration is a criminal offense, and HMRC has prosecuted unregistered hawala operators in multiple cases.

Some countries have tried prohibition outright. Pakistan criminalized unlicensed hawala in 2002 under FATF pressure, and the result was an immediate shift underground rather than a reduction in volume. Most regulators now accept that registration, monitoring, and international coordination work better than a ban.

The jurisdictional challenge is persistent. A single hawala chain might originate in the US, clear through the UK, route through the UAE, and settle in Pakistan, so no single regulator sees the full transaction. Financial Intelligence Units rely on intelligence-sharing frameworks including the Egmont Group to piece together cross-border flows, and even then the evidence is often inferential rather than documentary.

Compliance teams reviewing hawala exposure should also assess sanctions evasion via shell companies alongside this typology. The two patterns intersect frequently in high-risk corridor transactions where hawala settlement flows through UAE or Pakistani entities with sanctioned-entity links.

Common challenges and how to address them

The core compliance challenge with hawala is invisibility. There's no transaction record to query, no account to freeze, and no SWIFT message to intercept. By the time a compliance team identifies a hawala pattern, value has already moved.

The practical response is detection at the two points where hawala touches the formal financial system: when the sender deposits cash, and when the recipient withdraws it. Banks that catch these moments build detection around round-dollar cash deposits aggregated across multiple accounts, structuring patterns just below the $10,000 reporting threshold, same-day aggregation into a single outbound wire, and beneficiary accounts in jurisdictions with weak AML controls.

Network analysis tools are effective because hawala networks leave a specific footprint: one account receiving from dozens of otherwise unrelated customers. Rule-based systems that analyze individual accounts in isolation miss this entirely. Graph-based approaches that map fund flow relationships across an entire customer book identify the high-centrality nodes that indicate hawala aggregation. We've seen compliance teams using this approach cut their investigation time on MSB cases from weeks to days.

Investigation teams face a second challenge: proving criminal intent. Hawala isn't illegal if the operator is licensed and compliant. The money laundering question is whether the funds transferred are proceeds of a predicate offense. That requires tracing the upstream source, which is harder than documenting the transfer mechanism.

SAR quality is the third persistent issue. Too many hawala-related SARs describe the pattern without explaining the mechanism. A SAR narrative that names the suspected hawala operator, maps the fund flow direction, identifies the destination jurisdiction, and connects the activity to a plausible predicate offense is far more useful to law enforcement than a generic filing. Invest in analyst training that covers how hawala settlement works and how to reconstruct a broker network from banking records alone.

Automated systems help with alert volume. The judgment call on whether to exit a relationship, restrict an account, or file a SAR still requires experienced analysts who understand the typology.

Related terms and concepts

Hawala belongs to a broader family of informal and semi-formal value transfer mechanisms, each with distinct typologies and regulatory treatment.

The parent regulatory category is Informal Value Transfer System (IVTS), which FATF uses to group hawala alongside the Chinese fei-ch'ien, the South American black market peso exchange, and similar trust-based systems. All operate on offsetting claims and settlement outside the banking system. FATF Recommendation 14 applies to all of them.

Money or Value Transfer Services (MVTS) is the broader regulatory term covering both formal operators like Western Union and informal operators like hawala dealers. A licensed hawala operator is a compliant MVTS provider. An unregistered one is operating illegally in most FATF member jurisdictions and faces criminal prosecution.

Remittance is the legitimate use case that makes hawala a persistent compliance challenge. For certain corridors where formal banks have pulled back due to de-risking decisions, hawala is the primary transfer mechanism available. Cutting it off entirely creates financial exclusion without eliminating the underlying money flow.

Trade-based money laundering (TBML) is the most common hawala settlement mechanism investigators find. Brokers clear their mutual debts by over- or under-invoicing goods in trade transactions. A UK broker owes a Dubai broker £50,000; they settle it through a textile shipment invoiced at inflated value. No cash changes hands, and both sides of the ledger look like ordinary commerce.

Underground banking is sometimes used as a synonym for hawala, though it more precisely describes the full ecosystem of informal financial services, including unlicensed currency exchange and black-market lending. Hawala is one component of that ecosystem.

For analysts building typology libraries, FATF's 2013 report "The Role of Hawala and Other Similar Service Providers in Money Laundering and Terrorist Financing" is the definitive reference. It covers 12 jurisdictions, documents red flags, and includes case studies that translate directly into transaction monitoring rules.

How FluxForce detects Hawala-Based Money Laundering

Aiden Flux monitors transaction flows in real time across domestic and correspondent accounts, running velocity checks, peer-group comparisons, and network graph analysis simultaneously. Nova Sentinel maps structural patterns in account clusters, identifying shared identifiers and reciprocal settlement flows consistent with hawala broker networks. Both agents produce full decision explanations for every alert, so analysts review the evidence before any SAR is filed. Automated SAR drafting cuts the time from detection to submission from days to hours. To see how this works in a live compliance environment, request a demo.