Terrorist Financing: Hawala, Crypto, and the Coordination Gap

Key Judgments

• [CONFIRMED] – A September 3, 2026 Financial Action Task Force report finds that underground banking and hawala-and-other-similar-service-providers (HOSSPs) are now identified as a principal professional money laundering channel by more than 80% of reporting jurisdictions globally, with individual documented cases moving over €500 million through such networks within a few months.
• [CONFIRMED] – These historically informal, cash-based networks have professionalized into what FATF terms “money laundering as a service” – commercially operated, scalable infrastructure integrating with formal financial channels through bank accounts, payment service providers, virtual IBANs, prepaid cards, and virtual asset wallets, creating what the report describes as multiple entry and exit points resistant to conventional detection.
• [CONFIRMED] – Cryptocurrency has become a documented, substantial terrorist financing channel: Hamas’s military wing shifted from Bitcoin to the more fungible USDT stablecoin after 2021, reportedly raising over $130 million by that method following October 7, 2023; a June 2023 Israeli seizure recovered roughly $1.7 million in cryptocurrency tied to a Hezbollah/Quds Force financial facilitator; and Chainalysis’s most recent tracking found overall extremist crypto donations declining globally even as financing specific to European white-supremacist and nationalist networks grew.
• [CONFIRMED] – As of June 2025, 12 African states remain on the FATF “grey list,” with Sub-Saharan Africa and the Sahel specifically identified by the UN Security Council’s Counter-Terrorism Committee as a priority region where weak oversight, limited law enforcement capacity, political instability, and exploitation of informal economies allow terrorist financing to flourish largely unaddressed.
• [ASSESSED] – CommandEleven Intelligence assesses the defining vulnerability in the current counter-terrorist-financing architecture is not any single channel – hawala, crypto, and formal-sector abuse are all independently well-documented – but the coordination gap between financial intelligence units, law enforcement, and regulatory bodies both domestically and across borders, a gap that the professionalization and AI-tool adoption documented in this white paper’s sourcing is actively widening rather than narrowing.

The Three-Channel Problem

Terrorist financing today moves through three broad, increasingly interconnected channels:

• traditional informal value transfer systems (hawala and similar networks)
• digital and cryptocurrency-based transfer
• formal-sector abuse (shell companies, nonprofit fronts, and trade-based laundering)

Treating these as three separate problems requiring three separate solutions increasingly misreads the threat: FATF’s own September 2026 findings describe these channels as actively converging, with hawala operators routing funds through the same bank accounts, payment processors, and virtual asset wallets used for entirely legitimate commerce, and with underground networks now adopting artificial intelligence tools and purpose-built applications to manage cross-border value transfer at a professionalized, commercial scale.

Traditional Channels: Hawala and the Digital Hawala Problem

Hawala and similar informal value transfer systems have served legitimate remittance functions for centuries, particularly for migrant workers and communities with limited access to formal banking – a fact FATF’s own reporting is careful to acknowledge even while documenting the systems’ exploitation. What has changed, per FATF’s September 2026 report, is scale and professionalization.

Case studies examined in that report include underground banking systems moving proceeds from large-scale cross-border drug trafficking alongside digital hawala networks specifically used to finance members of a terrorist organization – evidence that the same infrastructure now serves organized crime and terrorism financing interchangeably, often through the same operators. FATF President Giles Thomson characterized this development explicitly: the emergence of sophisticated, commercially operated cross-border money laundering networks functions as “a serious risk multiplier,” making it easier for illicit actors of every kind to obscure their activity.

The specific mechanism enabling this evolution is integration with formal finance. Traditional hawala relied on trust networks and physical cash settlement between operators in different jurisdictions. Digital hawala instead routes value through bank accounts, licensed payment service providers, virtual IBANs, prepaid cards, and cryptocurrency wallets – infrastructure that offers hawala’s speed and jurisdictional flexibility while adding a veneer of formal-sector legitimacy that complicates detection. Professionals increasingly implicated in facilitating these schemes, per FATF’s findings, include lawyers, accountants, auditors, notaries, corporate formation agents, and real estate agents – a expansion of the facilitator base well beyond the informal money-changer stereotype the term “hawala” often evokes.

The Cryptocurrency Channel

Terrorist and state-proxy use of cryptocurrency has moved from experimental to operationally significant. Hamas’s military wing’s shift from Bitcoin to USDT after 2021 reflects a deliberate technical choice: USDT’s price stability and broader liquidity make it more practically useful for real-world procurement than Bitcoin’s volatility allows, and reported fundraising exceeding $130 million by this method following October 7, 2023 demonstrates the channel’s real capacity. A separate June 2023 seizure by Israel’s National Bureau for Counter Terror Financing recovered approximately $1.7 million in cryptocurrency tied to a Hezbollah/Quds Force financial facilitator – evidence the channel serves Iran’s proxy network broadly, not Hamas alone.

• [DATA DEFICIT] – This white paper does not have a reliable comparative figure for total cryptocurrency-based terrorist financing across all actors globally; publicly available tracking (principally from Chainalysis) covers specific documented cases and broad trend directions rather than a comprehensive aggregate total, and this white paper does not present one.

Chainalysis’s most recent tracking offers an important nuance: overall cryptocurrency donations to extremist groups are declining globally even as financing specific to white-supremacist, nationalist, and antisemitic networks has grown within Europe specifically – evidence that the crypto financing threat is not uniform across ideological categories or geographies, and that blanket statements about “crypto terrorist financing” risk obscuring meaningfully different sub-patterns requiring different countermeasures.

Case Studies: The Closed-Loop Pattern

CommandEleven Intelligence’s own prior reporting offers two directly relevant case studies in how sanctions-evasion financing and terrorist-financing procurement now function as a single integrated system rather than separate problems. Treasury’s February 25, 2026 designation action against Iran’s shadow fleet and weapons-procurement networks explicitly described a “closed loop”: oil export revenue moving through sanctioned shadow-fleet vessels funds financial intermediaries that directly support Shahed-series drone engine production and missile propellant procurement.

Separately, CommandEleven Intelligence’s Muslim Brotherhood in America series documented CAIR – a US-based organization – publicly denying foreign financial support while public records show at least $7.7 million tied to Saudi-based Islamic Development Bank financing of its own headquarters project, illustrating that the credibility gap between public financial disclosure and documented funding reality is not confined to designated terrorist organizations abroad but extends to domestic advocacy organizations as well.

Both cases illustrate the same underlying pattern this white paper treats as its central analytical finding: modern illicit financing, whether serving a designated terrorist organization, a sanctioned state proxy network, or a domestic advocacy organization facing new scrutiny, increasingly relies on structurally similar techniques – revenue-generating fronts, layered intermediary entities, and a deliberate mismatch between public statements and actual financial architecture.

Sanctions Evasion as a Financing Technique

Sanctions evasion and terrorist financing are analytically distinct but operationally overlapping. CommandEleven Intelligence’s prior reporting on Iran’s “shadow supply chain” documented a Chinese “manufacturing plain” – a flat landscape of interchangeable micro-enterprises, individually insignificant and individually targetable, but collectively resistant to sanctions enforcement precisely because no single node justifies the investigative effort required to find and close it. This same structural logic – decentralization calibrated specifically to survive individual node loss – recurs across the hawala professionalization FATF documents in Section II, suggesting it is not an Iran-specific innovation but a general-purpose resilience strategy available to any illicit financial network with sufficient sophistication to implement it.

The Coordination Gap

FATF’s own recommendations in its September 2026 report center on a consistent theme: the problem is not primarily a detection-technology gap but a coordination gap – between domestic regulatory bodies, between financial intelligence units and law enforcement, and across international borders. The report specifically calls for enhanced domestic coordination, stronger public-private feedback loops between financial institutions and regulators, and improved international cooperation among financial intelligence units, police agencies, and regulatory bodies. That this recommendation recurs across multiple FATF reports over more than a decade – the 2013 report on hawala and similar service providers made substantially similar findings – suggests the coordination gap is a persistent structural problem rather than one closing over time.

The Sahel illustrates this gap in its most acute form. The UN Security Council’s Counter-Terrorism Committee Executive Directorate has identified Sub-Saharan Africa, and the Sahel specifically, as a priority region where some of the world’s most dangerous terrorist groups operate across porous borders, exploiting informal economies with minimal oversight. As of June 2025, 12 African states remain on FATF’s grey list – a formal designation indicating strategic deficiencies in anti-money-laundering and counter-terrorist-financing frameworks – reflecting both genuine capacity constraints and the low priority international attention has historically assigned to counter-terrorist-financing capacity building in the region relative to kinetic counterterrorism assistance.

Assessment

• [ASSESSED] – CommandEleven Intelligence assesses that the terrorist financing landscape in 2026 is defined less by any single dominant channel than by convergence and professionalization: hawala networks integrating with formal finance, cryptocurrency financing showing distinct ideology-specific growth patterns, and state-proxy networks (examined in this white paper’s Iran case study) building deliberately decentralized, sanctions-resistant procurement architecture. The common countermeasure gap across all three is not detection capability in isolation but the coordination – domestic, cross-agency, and international – that FATF’s own decade-plus of reporting has repeatedly identified as the binding constraint. This white paper assesses that gap, more than any specific channel’s technical characteristics, deserves primary attention from policymakers evaluating where additional counter-terrorist-financing investment would produce the greatest marginal return.

Sourcing Base (Confidence-Tiered, with Links)

CONFIRMED – Primary/Official Record:

• Financial Action Task Force, “New FATF report finds underground banking and hawala are key channels for professional money launderers,” Sept. 3, 2026
• UN Security Council Counter-Terrorism Committee, “Thematic summary assessment of gaps in implementing key countering the financing of terrorism provisions” (Sahel/African grey-list detail)
• US Department of State, “Sanctions to Disrupt Iran’s Weapons Procurement Networks and Shadow Fleet,” Feb. 25, 2026
• Chainalysis, “Cryptocurrency donations to extremist groups dip globally, but white supremacism, nationalism, and anti-Semitism grow across Europe“
• Chainalysis, “Assessing Terrorism Financing On-chain is Crucial and Complex” (Hezbollah/Quds Force $1.7M seizure)
• Congressional Research Service, “Terrorist Financing: Hamas and Cryptocurrency Fundraising“

ASSESSED – Credible Secondary Reporting:

• AML Network, “FATF Exposes Hawala Networks Fuelling Global Money Laundering Crisis“
• World Today Journal, “FATF Exposes Rise of ‘Digital Hawala’ and Professional Money Laundering Networks“
• Middle East Forum, “Revealed: CAIR’s $7.7 Million of Foreign Financing” (cross-referenced from CommandEleven Intelligence’s Muslim Brotherhood series)
• Jamestown Foundation, “PRC Supply Chain Ecosystem Behind Iran’s Drone Campaign” (cross-referenced from CommandEleven Intelligence’s Iran War Doctrine series)

Excluded from this white paper: Specific operational tradecraft for structuring hawala transactions or evading cryptocurrency transaction monitoring. This white paper treats such detail as more useful to those seeking to replicate evasion than to readers seeking to understand the strategic and policy picture.