Financial crime teams face a growing challenge as traditional informal value-transfer networks adapt to digital payments, creating new complications for anti-money laundering (AML) monitoring and investigations, according to financial crime technology provider ZIGRAM.
A September 2026 assessment by the Financial Action Task Force (FATF), highlighted in ZIGRAM’s analysis, found that nearly 70% of respondents had observed new technologies being used in underground banking and hawala-related activity. The findings point to a shift in how established financial crime methods operate, with digital infrastructure giving informal networks new ways to communicate, transfer funds and coordinate settlements.
Hawala is built around trust-based relationships between intermediaries. Instead of moving money directly from sender to recipient through a corresponding bank transfer, operators arrange for value to be delivered at the destination and settle their obligations separately. These arrangements may rely on cash, trade or netting between participants. While the system can provide a legitimate remittance route for people who need to send money across borders, it can also be misused to conceal illicit financial flows.
The growing use of digital channels is changing the environment in which these networks operate. Messaging applications can connect intermediaries, while mobile wallets, banking services, FinTech platforms and instant payment systems give customers more ways to initiate transfers. Virtual assets, including stablecoins, may also be used to settle balances between operators. Faster communications and payment services can help networks coordinate activity across locations, potentially compressing settlement times.
For compliance teams, the difficulty is that a transaction visible to one institution may represent only a small part of a wider arrangement. A bank may record funds arriving in an account and being transferred elsewhere, but have no visibility into the separate settlement between intermediaries. Activity that appears to be a routine domestic payment may also be connected to a broader cross-border network.
The challenge is compounded when information is spread across multiple providers. Investigators may be able to access account histories, customer details and payment messages within their own organisation, but lack information held by other institutions. Where virtual asset services are involved, establishing the identity behind a wallet can present further difficulties. Connecting available records is therefore important, but investigators must distinguish confirmed relationships from assumptions based on incomplete data.
Certain transaction patterns may justify closer examination. These include funds being moved onward shortly after receipt, accounts receiving payments from numerous unrelated individuals, multiple senders repeatedly transferring money to the same beneficiaries, and activity that appears inconsistent with a customer’s known financial circumstances. Repeated transfers between fiat currency and virtual asset services, or identifiers shared by accounts already under scrutiny, may also provide leads for investigation.
None of these indicators independently establishes that money laundering is taking place. Similar patterns may arise from legitimate commercial activity or other explanations, including money mule arrangements. Compliance teams need to assess the wider customer relationship, transaction history and available supporting evidence before drawing conclusions.
An effective response requires monitoring systems that can identify patterns across time, rather than simply generating more alerts. Examining repeated counterparties, the order of transactions and changes from expected account behaviour can help investigators identify activity that merits further review. Graph analytics can also support the mapping of connections between accounts, businesses and beneficiaries, helping teams assess whether apparently separate transactions may be related.
Where there is evidence of virtual asset activity, blockchain analytics and information obtained from relevant service providers may add useful context. However, these capabilities do not guarantee that investigators can identify every wallet owner or uncover settlement arrangements that take place outside the blockchain. Their findings need to be considered alongside other evidence and the limitations of the available data.
The quality of the investigation also depends on how clearly the rationale for escalation is recorded. Guidance from the US Financial Crimes Enforcement Network (FinCEN) on informal value transfer systems calls on institutions to explain the basis for their suspicions in suspicious activity report narratives. Investigators should therefore separate observed transactions and verified relationships from customer explanations, analytical assessments and questions that remain unresolved.
ZIGRAM’s Complete FRAML System combines screening, transaction monitoring, entity intelligence and fraud monitoring within a connected financial crime environment. By bringing these capabilities and related investigative workflows together, the platform is designed to help institutions assess risk across different aspects of financial crime detection.
As outlined in ZIGRAM’s analysis, identifying digital hawala risks depends on looking beyond individual payments to examine the relationships and activity that may connect them. For compliance teams, the priority is to combine available intelligence, investigate plausible explanations and maintain a clear record of the evidence supporting any decision to escalate, while acknowledging where visibility remains limited.
Copyright © 2026 FinTech Global
Copyright © 2026 RegTech Analyst
