The Money Does Not Have to Move Through a Bank to Create a Banking Risk

A customer can appear to have a normal bank account, a legitimate business and ordinary transactions.

The risk may still be somewhere else.

The money could be collected in cash by one person, settled through another network, transferred through a third party, and only enter the formal financial system after the original transaction has already taken place.

This is one reason informal value-transfer systems can create a difficult AML problem.

The financial institution may only see the final movement of funds.

It may not see the network that made the movement possible.

The network behind the transaction

In September 2026, FATF published a new report examining professional money laundering, underground banking, hawala and other similar service providers.

The report highlights cases in which underground banking and hawala-based arrangements were used to move very large amounts of illicit funds, including cases involving more than EUR 500 million within a matter of months.

The important point is not that every hawala or informal value-transfer arrangement is illicit.

Many such systems serve legitimate customers and legitimate economic purposes.

The risk comes when criminals use the infrastructure, relationships and settlement mechanisms of these networks to move or disguise criminal proceeds.

That creates a problem for compliance teams:

The transaction they can see may only be one small part of the transaction that actually matters.

When the formal transaction is only the last step

Consider a customer who operates a legitimate trading business.

The customer receives several transfers from different individuals.

The amounts are not particularly large.

The senders are not obviously connected.

The payments are described as business-related.

On their own, the transactions may not immediately appear unusual.

But suppose the same customer is receiving funds that originated from an informal settlement network.

The bank may only see the final payment into the customer's account.

The underlying value transfer may have happened somewhere else.

This is where transaction monitoring needs context.

The question is not simply:

“Did this payment trigger an alert?”

It is:

“What economic activity is this payment actually representing?”

Professional money launderers change the problem

FATF has previously described professional money laundering networks as groups or individuals that provide laundering services to criminal clients.

They may specialise in different parts of the process.

One person may control cash.

Another may arrange accounts.

Another may establish companies.

Another may move value internationally.

Another may provide access to financial or commercial infrastructure.

This creates a very different risk from the traditional idea of a criminal simply depositing illicit money into a bank account.

The person whose account receives the money may not be the person who generated the criminal proceeds.

The company making the payment may not be the company that ultimately benefits.

And the person appearing on the transaction may not be the person controlling the wider arrangement.

The network is the risk.

Why customer-level reviews can miss it

AML controls often focus heavily on individual customers.

That is necessary.

But sophisticated laundering networks can exploit relationships between customers.

Consider several businesses that appear unrelated.

One receives money from Customer A.

Another sends money to Customer B.

A third company provides invoices.

A fourth entity receives the final proceeds.

Each customer may look relatively ordinary when reviewed separately.

Viewed together, however, the activity may reveal common ownership, shared addresses, common counterparties, repeated payment patterns or economic activity that does not make commercial sense.

This is why FATF's beneficial ownership standards place such importance on obtaining adequate, accurate and up-to-date information about the real people who own or control legal entities.

A corporate structure should not become a wall between the institution and the person actually controlling the activity.

The danger of relying on labels

One of the easiest ways to miss a suspicious transaction is to accept the description attached to it.

“Trade payment.”

“Family transfer.”

“Consultancy fee.”

“Loan.”

“Investment.”

“Settlement.”

The label does not establish the economic reality.

A transaction should make sense based on the customer's known business, financial position, counterparties and expected activity.

If a small company suddenly receives repeated payments from unrelated individuals and immediately transfers funds onward, the fact that the payments are labelled “business income” does not answer the compliance question.

The same applies to payments involving third parties.

The more complicated the payment chain becomes, the more important it becomes to understand why each party is involved.

What compliance teams should look for

This does not mean treating every unusual payment as suspicious.

It means identifying combinations of indicators that deserve investigation.

For example:

• Multiple apparently unrelated people sending funds to the same customer.
• Funds being rapidly transferred onward after receipt.
• Repeated third-party payments with no clear commercial explanation.
• Customers receiving funds that do not fit their stated business model.
• Several companies sharing owners, controllers, addresses or counterparties.
• Transactions involving businesses with little apparent economic activity.
• Payment descriptions that do not match the underlying transaction.
• Significant cash activity followed by transfers through the formal financial system.
• Customers acting as intermediaries without an obvious business reason.
• Repeated transactions that appear designed to break a larger movement of value into smaller amounts.

None of these indicators proves money laundering.

But together they can change the risk picture.

What DNFBPs should take from this

The same issue extends beyond banks.

A DNFBP may never see the original criminal proceeds.

It may instead see the asset purchased with those proceeds, the company used to hold the asset, the individual providing the funds, or the intermediary arranging the transaction.

For example, a real estate professional may see a property purchase funded by a company.

A precious metals dealer may see a third party paying for goods.

An accountant may be asked to establish several companies for customers who appear commercially connected.

A corporate service provider may be asked to create entities with complicated ownership structures but little obvious commercial purpose.

The individual transaction may look reasonable.

The wider relationship may not.

What should businesses do next?

For businesses exposed to these risks, the response does not have to begin with buying another technology platform.

It should begin with better questions.

1. Understand the customer's expected financial activity

What does the customer normally do?

Who are their expected counterparties?

What volume of transactions makes sense for their business?

2. Understand who controls the relationship

Do not rely only on the person signing the documents.

Identify the beneficial owners and relevant controlling persons.

Where information does not make sense, investigate the discrepancy.

3. Look beyond individual transactions

Review patterns.

A single payment may look normal.

Ten similar payments involving the same parties may tell a different story.

4. Understand third-party involvement

If someone other than the customer is paying, receiving or directing funds, ask why.

The answer should make commercial sense.

5. Connect information across customers

Where permitted and appropriate, look for relationships between customers, beneficial owners, counterparties and transactions.

A network can be invisible when every customer is reviewed in isolation.

6. Escalate unexplained activity

If the business cannot establish a reasonable explanation for the activity after appropriate due diligence, the issue should be escalated through the firm's AML procedures.

The objective is not to prove that a customer is a criminal.

The objective is to identify and respond to reasonable grounds for suspicion.

The lesson is bigger than hawala

The central AML challenge is not simply that criminals use alternative payment systems.

It is that criminals adapt to whatever part of the financial system gives them the least resistance.

If banks strengthen their controls, criminals may use businesses.

If companies strengthen customer due diligence, criminals may use nominees.

If transaction monitoring improves, criminals may change transaction patterns.

If beneficial ownership checks become stronger, criminals may use more complicated structures or intermediaries.

This is why FATF's recent work on professional money laundering is important.

The risk is increasingly about networks rather than isolated transactions.

A customer may be legitimate.

A company may be registered.

A payment may have a reasonable description.

An account may have passed KYC.

And yet the overall network connecting those pieces may be designed to move or disguise criminal value.

The strongest AML programs therefore do not only ask:

“Who is our customer?”

They also ask:

“Who is connected to the customer, what is the economic purpose of those relationships, and where could the value actually be coming from?”

Because sometimes the transaction you can see is not where the money-laundering risk begins.

It is simply where the risk finally becomes visible.