In a hawala transfer, no money crosses a border. A customer pays a broker in one country. A broker in another country pays the recipient. The two brokers now have an obligation between them, and they settle it later — by a transfer in the opposite direction, by a commercial payment, or by moving goods or gold.
The system is old, it is lawful and regulated in many jurisdictions, and it serves populations that banking does not reach. It is fast, cheap and reliable, and the overwhelming majority of its use is remittance by migrant workers.
How it works
The transfer and the settlement are separate events, and this separation is the whole mechanism.
The transfer leg leaves no cross-border record at all. Two domestic payments occur in two countries, and a message passes between the brokers. Nothing that any payment system can see connects them.
The settlement leg is where value actually moves, and it happens in aggregate, later, and often in a form that does not look like a payment. FATF’s 2013 study documents the settlement mechanisms directly. Providers that owe debt to corresponding providers settle accounts by fulfilling the commercial obligations of those providers — paying a debt or an invoice of the same value1 . Settlement occurs across multiple jurisdictions through value or cash outside the banking system2 , including through the use of cash couriers3 , and it commingles licit and illicit proceeds4 . Gold dealing appears among the businesses these operators run5 .
Where it meets trade misinvoicing
The most important link in this area is that a trade invoice can settle an unrelated obligation. If broker A owes broker B, a shipment of goods invoiced at the wrong price between their respective trading companies discharges the debt while appearing to be ordinary commerce.
The trade and the value transfer are then the same transaction viewed from different ends, and neither is comprehensible alone — which is why this site treats the two literatures as one body of material rather than as separate subjects.
The same structure, settled in stablecoins
The clearest contemporary description of a netting arrangement comes from the Multilateral Sanctions Monitoring Team, the body that took over DPRK sanctions monitoring after the Panel of Experts’ mandate lapsed. Describing how stolen cryptocurrency becomes usable cash, its 2025 report records that actors are highly reliant on Chinese underground banking and China-based facilitators7 , and sets out the mechanism: after converting stolen cryptocurrency to USDT, they transfer the tokens to an over-the-counter broker, usually in China, who takes a cut as payment in exchange for separately supplying an equivalent amount of fiat currency8 .
Read that against the definition at the top of this page. Nothing crosses a border. One party transfers value on a public ledger; the other supplies cash somewhere else; the two obligations cancel and the broker’s margin is the fee. It is hawala with the settlement asset changed, described by a monitoring body rather than inferred — and it corroborates the TGR Group designation, where Treasury found the same cash-for-USDT arrangement running for Russian clients.
Why it matters for sanctions specifically
Sanctions operate on the formal financial system: they block accounts, restrict correspondent relationships and screen payment messages. A value transfer that generates no cross-border payment message is not screened by anything, because there is nothing to screen.
The constraint is scale and settlement. Netting only works where flows run in both directions, and the settlement leg has to happen eventually. Where a restricted jurisdiction’s flows are heavily one-directional, settlement obligations accumulate, and discharging them requires moving real value by some means that is visible.
How it is caught
The settlement leg. Investigations focus on settlement rather than on transfers, because that is where value actually crosses. Trade flows between the brokers’ commercial entities, commodity movements and cash shipments are all observable.
Account profile. An operator’s own account frequently shows the pattern. FATF and the Egmont Group flag accounts with frequent cash deposits subsequently transferred to persons or entities in free trade zones or offshore jurisdictions with no business relationship to the account holder5 , and accounts that function as pay-through or transit accounts with rapid movement of high-volume transactions6 .
Record absence. Regulated operators are required to identify customers and record transfers. An operator accepting funds without recording sender, recipient or purpose has committed an identifiable regulatory offence, independent of anything the transfer was for.
Reconciliation of trade against obligation. Where two trading houses’ invoices consistently fail to correspond to any plausible commercial requirement, and the imbalances track remittance flows, the trade is functioning as settlement.