By Muhammad Shahid Farid, 26 October 2026
A September 2026 report on underground banking and hawala by the Financial Action Task Force (FATF) detailed how transferring value increasingly takes place via a complex series of steps, a complexity which is being exploited by criminals to transfer illicit funds. (Read more in Part 1)
To detect this, compliance practitioners must sharpen and improve their investigative skills. Today, effective detection of hawala and unlicensed money or value transfer service (MVTS) activity requires a combination of well-calibrated transaction monitoring system (TMS) scenarios and advanced anomaly detection techniques.
TMS scenarios should focus on behavioural indicators – for example multiple unrelated counterparties, high transaction velocity, rapid movement of funds, low balance retention, cash-to-peer-to-peer (P2P) activity and unusual collection and redistribution patterns.
These rules should be complemented by unsupervised machine learning and network analytics to identify customers whose transactional behaviour materially deviates from relevant peer groups or their own historical activity.
A hybrid approach combining rules-based scenarios, anomaly detection, network analysis and know-your-customer/customer-risk information can improve detection of previously unknown patterns while reducing reliance on static thresholds and improving the overall effectiveness of financial crime monitoring.
The following TMS scenarios offer a glimpse into what should be considered for an effective detection of unlicensed MVTS or hawaladars. It is intended as a baseline to help you establish a framework in which patterns indicative of underground banking can be more easily identified.
| # | TMS scenario | Scenario description / indicative detection logic | |
|---|---|---|---|
| 1 | Transactional behaviour | Multiple unrelated incoming P2P credits | Detect personal accounts receiving funds from an unusually high number of unique/unrelated individuals where the volume, value or frequency is inconsistent with the customer's occupation, salary, expected turnover, customer profile or historical activity. Key variables include unique credit senders, credit count/value and proportion of credits from unrelated parties. |
| 2 | Many-to-one-to-many / Collection & redistribution | Identify customers receiving funds from numerous unrelated individuals and subsequently transferring funds to numerous other beneficiaries. Focus on accounts operating as collection and redistribution nodes, rather than merely displaying high transaction volumes. | |
| 3 | Rapid pass-through / Low balance retention | Detect accounts where a significant proportion of incoming funds is transferred, withdrawn or otherwise dissipated within a short period (such as 24/48/72 hours) while maintaining relatively low average or end-of-day balances compared with account turnover. | |
| 4 | High-velocity P2P / Fawran activity | Detect unusually high frequencies of domestic instant-payment receipts and/or payments, particularly where transaction velocity resembles commercial money transmission rather than ordinary personal banking activity. Compare activity against relevant customer peer groups and historical behaviour. | |
| 5 | Cash-to-P2P / Cash-to-international transfer | Identify repeated cash or ATM deposits followed within a defined period by domestic P2P transfers, international transfers/remittances, cash withdrawals or transfers to exchange/remittance-related counterparties. | |
| 6 | P2P-to-cash conversion | Detect numerous incoming transfers from multiple unrelated customers followed by significant ATM or branch cash withdrawals, particularly where withdrawals occur shortly after receipt of funds or are inconsistent with historical customer behaviour. | |
| 7 | Structuring / Repetitive amount patterns | Detect repeated or rounded transaction amounts, transactions clustered around particular values, transactions immediately below relevant monitoring/reporting thresholds, or multiple similar-value transactions involving different counterparties. | |
| 8 | Personal account behaving like an MSB | Detect retail/personal accounts whose behaviour statistically resembles a money service business, exchange house, remittance provider or commercial collection account. Indicators include high counterparty diversity, transaction frequency, rapid turnover, repeated corridors and low balance retention. | |
| 9 | Dormant / low-activity account becoming a payment hub | Identify material changes in customer behaviour where a previously dormant or low-activity account suddenly begins receiving numerous P2P credits from unrelated parties and/or redistributing funds to multiple beneficiaries. | |
| 10 | Network behaviour | Network / shared counterparty activity | Identify apparently unrelated customers sharing an unusually high number of common counterparties or repeatedly transferring funds among themselves. Apply network analytics to identify potentially coordinated groups or interconnected accounts. |
| 11 | Hub-and-spoke transaction network | Detect customers occupying an unusually central position within a payment network, characterised by many inbound counterparties → central account → many outbound counterparties. Consider unique counterparties, network centrality, transaction velocity and flow-through ratios. | |
| 12 | Circular / reciprocal fund movement | Detect circular or reciprocal flows such as A → B → C → A, repeated A↔B transfers, or other network cycles where funds return directly or indirectly to originating customers without an apparent economic rationale. | |
| 13 | Cross-border / settlement behaviour | Geographic / remittance corridor concentration | Detect domestic aggregation of funds followed by concentrated international transfers to particular countries, regions, beneficiaries or remittance corridors where the activity lacks an apparent economic rationale or is inconsistent with the customer's expected profile. |
| 14 | Commercial / trade settlement indicator | Detect personal or unrelated business accounts receiving dispersed retail-type credits from numerous individuals and subsequently making concentrated payments to traders, wholesalers, import/export companies, exchange houses or other commercial counterparties, potentially indicating settlement activity. | |
| 15 | AI / ML anomaly detection | Multiple customers → Common beneficiary | Detect multiple apparently unrelated customers transferring funds to the same beneficiary or small group of beneficiaries, particularly where amounts, frequency, timing, transaction narratives or geographic patterns exhibit similarities. |
| 16 | Shared network attributes | Identify apparently unrelated customers sharing non-transactional attributes such as mobile numbers, addresses, devices, IP addresses, employers, introducers, beneficiaries, ATM locations or other linkage data. Combine these attributes with transaction relationships to identify potentially coordinated networks. |
Find Part 1 of this Insight exploring hawala and unlicensed money or value transfer services here.
About the author
Muhammad Shahid Farid is the MLRO Group Head of AML/CFT and Sanctions at Commercial Bank of Qatar, with more than 15 years of hands-on experience in Financial Crime Compliance.
His expertise spans AML/CFT, Sanctions Governance, Regulatory Compliance, Financial Crime Risk Assessment, and the deployment of tech-driven Financial Crime Compliance solutions.
Mr Farid holds a research-based MSc degree in Financial Crime and Compliance from the University of Manchester and several internationally recognised qualifications, including Advanced CAMS–Audit, CAMS, CFE, CSS, CGSS, CISI-Investment Operational Certificate, and the ICA Postgraduate Diploma in Financial Crime Compliance. He is a passionate compliance professional and committed to strengthening financial integrity through research, effective governance, innovation, and proactive engagement with regulators and industry stakeholders.