FATF ¦ Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers

Professional money laundering enters the age of hybrid underground finance

Professional money laundering has become a specialised service industry. Individuals and networks that are separate from the underlying predicate offence collect, transfer, settle and integrate criminal proceeds for a fee, commission or other financial benefit. Their clients may include organised crime groups, fraudsters, cybercriminals, corrupt officials, tax evaders, sanctions evaders and terrorist financiers.

Underground banking and hawala and other similar service providers are central to this model. These arrangements can support legitimate remittances and cross-border trade, particularly where formal financial services are costly, inaccessible or unavailable. Their use is not inherently criminal. The risk arises when informal value-transfer mechanisms are used to conceal criminal proceeds, bypass regulatory controls or provide financial infrastructure to criminal organisations.

The distinction matters. A legitimate remittance transaction and a professional laundering operation may use similar channels, community networks or payment methods. The difference lies in the source and purpose of the value, the operator’s knowledge and intent, and the wider structure in which the transaction takes place.

Why informal value transfer remains attractive

Underground banking networks typically transfer value without physically moving funds across borders. A customer gives money to an operator in one jurisdiction. A counterpart operator pays the equivalent amount to a beneficiary elsewhere, usually from a local cash pool or business account. The operators later settle their accumulated obligations through offsetting, trade, cash, formal financial channels, virtual assets or other forms of value.

This structure offers professional money launderers several advantages. Transactions can be fast, inexpensive and available in locations with weak formal financial infrastructure. Internal records may be fragmented or coded, while communication takes place through private messaging services, encrypted applications or community intermediaries. The absence of a conventional cross-border payment trail makes it difficult to identify the origin, destination and purpose of the value.

Reputation is also important. Informal operators may rely on long-standing relationships, community visibility and social consequences for non-performance. This can create a level of trust that substitutes for formal documentation and supervision. For criminal clients, the same trust-based infrastructure can provide access to liquidity and rapid settlement without direct interaction with a bank.

The service is commercially organised. Operators may charge different fees according to the destination, urgency, transaction size, risk and complexity of the route. Criminal transactions can attract higher charges because the operator assumes greater legal and operational risk. Some professional money launderers may also earn from currency differentials, liquidity provision, settlement margins and fees charged to several parties in the same value cycle.

Bastian Schwind-Wagner _Follow

"Professional money laundering through underground banking and hawala networks is evolving into a sophisticated, commercially organised service. Criminal networks combine cash, trade, mobile money, formal payment channels, virtual assets and professional intermediaries to launder proceeds from drug trafficking, fraud, corruption, tax evasion and other predicate offences.

Effective enforcement must target the entire laundering infrastructure rather than isolated transactions. This requires stronger co-operation between public authorities and reporting entities, improved digital and financial intelligence, cross-border action, and proportionate access to legitimate remittance services."

Predicate offences are broadening

Drug trafficking remains one of the most frequently identified predicate offences. Large-scale drug markets generate substantial cash proceeds that must be collected, consolidated, transferred and converted into usable value. Underground banking networks can perform each of these functions while separating the money launderer from the drug-trafficking organisation.

The connection with drug trafficking should not obscure the wider threat. Underground banking and hawala-based structures are increasingly used to launder proceeds from fraud, cyber-enabled crime, corruption, tax evasion, smuggling, human trafficking, migrant smuggling, illegal gambling, undeclared work, intellectual property crime, environmental crime and the illegal extraction of natural resources.

The underlying crime may be committed in another jurisdiction, and proceeds from several offences may be mixed together. A network may collect drug proceeds in Europe, settle value through trade in the Middle East, use virtual assets for inter-operator compensation and reinvest the funds in real estate or luxury goods. This makes the laundering infrastructure relevant to several predicate offences at once.

Undeclared work illustrates how criminal and seemingly commercial interests can intersect. Criminal groups holding illicit cash may exchange it with businesses seeking unrecorded cash to pay workers or avoid payroll taxes and social security contributions. The businesses receive cash, while the criminal group obtains an equivalent bank transfer, often supported by false invoices or vague payment references. In this structure, proceeds from drug trafficking or illegal trade are absorbed into an economic system that is itself generating tax and labour law violations.

Illegal online gambling presents another variation. Gambling operators may use payment platforms, mule accounts, digital wallets and stolen identities to separate customer deposits from the organisers. A portion of the proceeds can then be converted into cash and transferred through hawala or underground banking channels before returning to the country as purported foreign investment.

Settlement no longer depends on cash alone

Traditional underground banking investigations often focused on cash couriers, cash pools and physical handovers. These remain important, particularly at the collection and payout stages. However, contemporary professional laundering networks use several settlement methods within the same operation.

Bilateral offsetting remains the simplest model. Two operators settle reciprocal obligations against one another, reducing or eliminating the need for a direct transfer. More complex networks use triangular or multi-party settlement. An obligation between operators in two countries may be discharged through a third operator with a surplus balance, a trade transaction or a payment arranged by an unrelated third party.

Trade-based settlement is particularly significant. Import/export companies, wholesalers and other commercial entities may be used to disguise value through over-invoicing, under-invoicing, false cargo descriptions, phantom shipments or circular trade. It is important to distinguish a third-party payment from trade-based money laundering (TBML). A third-party payment concerns who makes the payment, while trade-based money laundering involves manipulating the value, quantity or description of goods to disguise the movement of criminal value.

Commodities can also function as settlement instruments. Gold, precious stones, vehicles and luxury goods may be used as stores of value, exchanged across borders or bought with criminal cash and resold through related networks. In parts of Latin America, black market peso exchange models continue to combine drug proceeds, parallel foreign-exchange markets, trade and informal value transfer.

Formal financial channels remain deeply involved. Banks, payment service providers, fintech platforms, virtual international bank account numbers, prepaid cards and corporate accounts may serve as collection, layering or settlement points. Money mules can fragment large cash amounts into multiple deposits. In “cuckoo smurfing”, criminal cash is deposited into the account of a legitimate remitter, while the remitter’s genuine payment is used to settle an offshore obligation.

These arrangements demonstrate that underground banking should not be treated as a system operating entirely outside regulated finance. In many cases, the informal layer is concealed behind formal accounts and legitimate-looking businesses.

Digitalisation increases speed and opacity

Digitalisation is changing how underground banking networks recruit customers, communicate, record transactions and settle balances. The term “digital hawala” covers a wide range of practices, from the use of encrypted messaging to fully digital value-transfer models involving virtual assets and payment platforms.

In some schemes, operators use messaging applications and shared digital ledgers while continuing to settle through cash or trade. In others, customers initiate payments through mobile wallets, fintech applications or instant payment systems, while operators settle obligations through cash pools or third-party accounts. More advanced networks use stablecoins and other virtual assets to move value rapidly between jurisdictions.

Virtual assets can reduce the need for physical cash movement and provide additional layering opportunities. Criminal funds may be collected in fiat currency, converted into virtual assets, transferred between wallets and converted back into fiat or another store of value. Mule accounts, over-the-counter brokers, virtual asset service providers (VASPs), exchange offices and jewellery businesses may all form part of the same chain.

Automation adds another layer of complexity. Authorities have identified tools that automatically move funds from mule or compromised accounts once deposits reach a specified threshold. Automated sweeping reduces the time funds remain in any single account and limits direct intervention by network operators.

Digitalisation does not eliminate cash. Cash remains important for collection, payout and liquidity management. Instead, criminal networks are combining cash, formal payments, mobile money, virtual assets and trade to create hybrid systems that are faster and harder to reconstruct.

Professionalisation creates a resilient infrastructure

The professional money launderer is not necessarily a cash courier or a single broker. Larger networks can include controllers, collectors, couriers, transmitters, account providers, company nominees, technical specialists, professional advisers and complicit businesses.

Controllers, sometimes described as money brokers or super-facilitators, may manage correspondent brokers across several jurisdictions. They can determine pricing, credit limits, liquidity, settlement routes and risk controls. Identifying these controllers is often more valuable than focusing only on individual cash handlers, because removing a courier may have little effect on the wider network.

Professional laundering networks may maintain shell companies, front businesses and nominee structures for long periods. They may use trading companies, travel agencies, restaurants, currency exchangers, vehicle dealerships, precious metal traders, construction firms and professional service practices as operational fronts or access points to the formal financial system.

The service model is also becoming more diversified. A single network may offer cash collection, false documentation, company formation, beneficial ownership concealment, money mule recruitment, asset acquisition, financing, virtual-asset conversion and investment assistance. This makes professional money laundering a broader criminal service offering rather than a single transaction.

The investigative challenge: money may not move

The traditional instruction to “follow the money” has limited value where the principal transaction is a transfer of value rather than a cross-border movement of funds. Investigators may need to reconstruct obligations, ledgers, communications, cash collections, trade transactions and payouts instead.

Evidence can include coded records, banknote serial numbers used as tokens, messaging histories, device data, travel records, customs information, company records, cash deposits, virtual-asset transactions and relationships between apparently unrelated businesses. A token or ledger entry may help establish how the network authenticated a payment and recorded a handover.

The absence of conventional records does not mean the absence of evidence. It means that financial intelligence must be combined with communications evidence, digital forensics, customs and tax data, corporate information and information from foreign counterparts.

Prosecutors face a related difficulty. They must explain informal settlement mechanisms to courts and establish the operator’s knowledge and intent. An operator may claim to provide legitimate remittance services, while the prosecution must show that the activity involved criminal proceeds, concealment, unauthorised financial services or deliberate participation in a laundering arrangement.

The predicate offence remains important, but a successful money laundering case may not always require investigators to identify every underlying offence or trace every unit of currency. Depending on national law, evidence of unexplained wealth, opaque settlement, false commercial activity, criminal associations and deliberate concealment may help establish the illicit origin or laundering purpose. Any such approach must remain consistent with due process and the applicable evidentiary rules.

A system-wide response is required

Enforcement focused only on individual transactions is unlikely to dismantle resilient networks. Authorities need to map the full laundering chain, from the generation of criminal proceeds through collection, recruitment, settlement, conversion and integration.

This means examining predicate crime investigations for the laundering infrastructure behind them. A fraud investigation may reveal a network of mule accounts and payment agents. A drug trafficking investigation may expose cash-collection hubs and trade-based settlement. A tax investigation may identify businesses exchanging illicit cash for unrecorded wages. A customs case may reveal false invoicing used to balance underground banking obligations.

Financial intelligence units (FIUs), law enforcement, prosecutors, supervisors, tax authorities, customs agencies and immigration authorities each hold part of the picture. Dedicated task forces and permanent co-ordination mechanisms can help combine these sources, identify network controllers and assign intervention points.

Early disruption can be important. Account restraints, asset freezing, targeted inspections, licensing action and civil recovery may limit a network’s capacity while the criminal investigation develops. Publicising sanctions and convictions can increase deterrence, particularly where operators depend on reputation and customer trust.

Detection must extend beyond transaction monitoring

Banks and payment firms remain important detection points, but they should not be the only source of intelligence. Supervisors and investigators can use company register checks, tax data, customs records, social media monitoring, online advertising, public complaints and whistleblower channels to identify unauthorised operators and their fronts.

Relevant indicators may include unexplained third-party payments, many-to-one transfers, cash activity inconsistent with a business profile, payments involving newly formed companies, unclear beneficial ownership, unexplained links to high-risk corridors, repeated transfers involving unrelated customers and transfers that have no credible economic purpose.

Sector-specific analysis is essential. A small business in construction, catering, transport, retail or wholesale trade should not be assessed against the same operating profile as a large multinational. Customer portfolios can be analysed using sector benchmarks, cash ratios, staffing levels, turnover, trade volumes and payment patterns.

Public-private partnerships can improve both detection and reporting. Authorities can share typologies and case outcomes with banks, payment firms, virtual asset service providers and other reporting entities, while receiving structured feedback on false positives, data limitations and emerging methods. This creates a cycle in which better reporting produces stronger intelligence, which in turn supports more precise indicators.

Financial inclusion is part of the control framework

A prohibition-based response can produce unintended consequences. Migrant workers, refugees, diaspora communities and small traders may rely on informal value transfer arrangements because formal services are expensive, inaccessible or unavailable. Indiscriminate enforcement can push legitimate users further outside regulated channels and reduce visibility.

The appropriate response is targeted enforcement against criminal exploitation combined with accessible formal alternatives. Lower-cost remittance services, proportionate customer due diligence (CDD), simplified onboarding, reliable digital payments and clear public information can reduce demand for unlicensed operators.

Community engagement also matters. Authorities can work with diaspora leaders, employers, labour organisations and local businesses to explain the risks of unauthorised services and identify legitimate providers. Information should be available in relevant languages and reflect the practical needs of remittance-dependent communities.

The strategic priority

Professional money laundering through underground banking and hawala networks is not limited to cash couriers and informal remittance brokers. It increasingly involves controllers, shell companies, trade networks, mobile money, payment firms, virtual assets, precious metals, luxury goods and professional enablers.

The predicate offence may be drug trafficking, fraud, corruption, tax evasion, cybercrime, smuggling or another criminal economy. The laundering infrastructure can connect all of them, often across several jurisdictions and through a mixture of regulated and unregulated channels.

Effective action therefore requires more than identifying suspicious payments. Authorities and private-sector organisations must understand how value is collected, recorded, settled and integrated. They must identify the people who manage liquidity and relationships, the businesses that provide cover, the formal institutions that provide access and the predicate crimes that generate the proceeds.

The central task is to disrupt the service infrastructure itself while preserving legitimate access to remittances and financial services. That requires legal clarity, better data, cross-border co-operation, specialised investigation, technological capability and a precise understanding of the difference between informal finance and professional criminal laundering.

Dive deeper

• FATF ¦ Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers ¦ Link