FATF report on underground banking and hawala: red flags for Cyprus obliged entities

FATF (September 2026), Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers, published on 3 September 2026, examines the roles, methods and typologies of underground banking and HOSSPs in professional money laundering, and how competent authorities respond. It draws on evidence from more than 50 jurisdictions across the FATF Global Network and partners, and follows earlier FATF reports on hawala (2013) and on professional money laundering (2018).

The FATF describes underground banking and HOSSPs as long-standing value-transfer systems that work as informal, decentralised networks, distinct from, though sometimes connected to, the formal financial sector. They can meet legitimate remittance needs, but criminals, including professional money launderers, can exploit them. The FATF Standards recommend that countries require such providers to be licensed or registered, and in most countries providing underground banking or unregistered HOSSP services is generally a criminal offence.

Misuse is global: more than 80% of reporting jurisdictions identify these systems among the principal professional money laundering channels or techniques, and some cases involved more than EUR 500 million laundered within a few months. The networks have become highly professionalised and are increasingly associated with money laundering as a service, in which criminals outsource laundering to specialists who run it as a commercial business.

They are also increasingly integrated with the formal financial sector: the report describes professional money launderers using bank accounts, fintech platforms, payment service providers, virtual IBANs, prepaid cards and virtual asset wallets as entry and exit points in laundering cycles. Nearly 70% of respondents report the integration of new technologies, a growing shift towards so-called digital hawala: operators coordinate through encrypted messaging apps, customers start transfers by bank transfer, mobile wallet, fintech app or instant payment, and operators settle balances in virtual assets, including stablecoins.

The FATF also warns of the increasing involvement of lawyers, accountants, auditors, notaries, company formation agents, financial consultants, real estate agents, and casinos and junket operators in facilitating these schemes. Its findings stress combining targeted prevention and enforcement with proportionate financial inclusion efforts, supported by legal clarity, better detection capabilities, public–private feedback loops, domestic coordination and international cooperation.

The points below are our own selection from the FATF's findings, not a FATF list of risk indicators. They are relevant to investment firms, administrative service providers, payment and e-money institutions and CASPs in Cyprus.

Formal accounts as entry and exit points. Bank accounts, fintech platforms, payment service providers, virtual IBANs, prepaid cards and virtual asset wallets used to move funds into and out of laundering cycles, including customers whose activity looks like an unlicensed remittance or value-transfer business.

Digital hawala. Transfers started by bank transfer, mobile wallet, fintech app or instant payment, with balances between operators settled in virtual assets such as stablecoins and coordinated through encrypted messaging apps.

Business-like networks and gatekeepers. Cross-border networks offering lower commissions and rapid, large-volume transfers; lawyers, accountants, notaries, company formation agents and other professionals facilitating schemes; and funds from fraud, cyber-enabled crime, illegal gaming and gambling or terrorist financing, not only from cash-based crime such as drug trafficking or smuggling. For more examples, see our study note on suspicious transaction red flags.

Nothing new applies: the report creates no obligations and does not change Cyprus law. Obliged entities already have to follow a risk-based approach, carry out customer due diligence and ongoing monitoring, and report suspicions to MOKAS, the Cyprus financial intelligence unit, under Law 188(I)/2007 and the AML directives of CySEC and the Central Bank of Cyprus.

In practice, add underground banking, HOSSP and digital hawala typologies to the business-wide risk assessment; test whether monitoring picks up third-party funding, structured deposits, rapid pass-through of funds, payments routed through virtual IBANs and conversions between fiat money and virtual assets; look closely at customers whose activity resembles an unlicensed remittance or payment business; review the oversight of agents and introducers; use the report's case studies in staff training; and report suspicions to MOKAS promptly, without tipping off the customer. For the reporting duty, see our study note on reporting to MOKAS.