Hawala and cybercriminality: from threshold-based detection to machine learning – and the structural limits of observing relationalsystems

Debt, compensation, coordination – why improving the observation of flows does not reveal relational structures

1. Detection through observable flows

An article by Bilal Moin, “Taming the untamable: Rethinking, regulating, and revamping hawala” (2024), proposes an analysis of hawala by situating it within its historical, economic and social context. The value of this contribution lies in the shift it introduces: hawala appears as a structured system, grounded in debt relations, compensation mechanisms and networks of trust.

This shift is achieved through particular attention to the actors within the system: the hawaladars. These are not merely executors of transactions. They organise the circulation of value across different economic spaces, most often without relying on physical transfers of funds.

In practice, a hawaladar receives a sum and mobilises another hawaladar to deliver an equivalent amount to a beneficiary in another geographical area, either domestically or internationally. This operation creates a debt relationship between the two actors. This debt is not settled immediately. It is embedded within an ongoing relationship in which positions are progressively balanced through the accumulation of transactions.

A logic of sustained cooperation thus emerges. The relationship between hawaladars is central. It relies on trust, reputation and converging economic interests.

Transactions between hawaladars mobilise a variety of instruments: bank transfers, online payments, crypto-assets, commercial transactions, and the circulation of goods, cash or precious metals. The settlement of debts does not necessarily follow the same path as the initial transaction. It may be deferred, fragmented and redistributed within the network.

This mode of operation gives hawala a distributed structure, without a formal coordinating centre, yet nonetheless organised. Hawaladars execute payments, absorb imbalances between regions, convert forms of value and stabilise relationships over time.

Within this framework, observable transactions provide access only to certain segments of the system. They are insufficient, on their own, to reconstruct its underlying logic. What organises flows are the relationships between hawaladars and the compensation mechanisms that connect them.

One of Moin’s key contributions is precisely to describe the full model: a set of structured relationships between actors, organised around forms of coordination that do not rely on formal institutions and that do not generate observable data.

2. From thresholds to machine learning

In a different register, AML/CFT detection systems – notably those based on graph analysis and scoring logics – seek to reconstruct hawala configurations from available traces. Alenova et al. (2024) propose a method aimed at identifying characteristic patterns – configurations of fund absorption, hidden links between accounts – in order to detect atypical structures.

Their approach builds on a critique of earlier detection methods based on thresholds. These fixed rules, applied to isolated transactions or non-compliant profiles, generate a high number of false positives. They are also easily circumvented through simple behavioural adjustments.

Alenova et al. shift the analytical focus: transactions are embedded within configurations reconstructed through machine learning. Using synthetic banking transaction data, the authors show that this approach reduces false positives from 90% to 46%. This improvement is substantial. However, its operational scope remains limited. The level of false positives remains high and, more importantly, the reconstruction of configurations is constrained by partial data, which only provide access to a fraction of the system.

The difficulty therefore does not lie in the methods employed, but in the nature of the available data. Detection approaches necessarily rely on observable traces. While machine learning models maximise their exploitation, in the case of hawala these traces remain structurally disconnected from mechanisms that do not generate transactional data – with cash and physical goods exchanges constituting only a partial exception.

3. Partial reconstruction and relational blind spots

A comparable structural constraint appears in the context of the ENSEMBLE project, which focuses on the detection of cybercriminality. In this setting, analytical models rely on observable data such as online transactional records, digital exchanges, messaging communications and other traceable interactions. These data allow for the reconstruction of interaction patterns and, to some extent, organisational configurations.

However, as in the case of hawala, these observable elements only capture a subset of the underlying relational structure. They reflect the visible manifestations of activities, but not the full structure of relationships, intentions and coordination mechanisms that sustain them. Critical dimensions – such as informal agreements, tacit understandings, strategic constraints or embedded organisational practices – remain outside the scope of available data.

The parallel with hawala is not merely illustrative; it reveals a common analytical limitation. In both cases, detection approaches are grounded in heterogeneous but partial data: banking transactions, online payments, crypto-assets, cash movements and physical goods in the case of hawala; digital transactions, platform-based interactions and communication traces in the case of cybercriminality1. While these data provide valuable entry points for analysis, they do not exhaust the system they seek to represent.

4. The structural limits of observable data

This highlights a shared structural constraint. Detection models do not fail primarily because of insufficient methodological sophistication, but because they operate on data that are structurally incomplete with respect to the phenomena they seek to represent. The challenge is therefore not only to improve the analytical performance of models, but to recognise the gap between observable traces and the relational structures that organise them.

Moin’s analysis precisely allows these mechanisms to be described. It highlights relationships, coordination forms and equilibria that are not translated into observable data. The challenge is therefore not only to detect, but to connect analytical registers that do not rely on the same forms of observation.

The constraint that limits threshold-based approaches thus also applies to the solutions proposed by Alenova et al. Unable to capture the structure of relationships, they grasp only transactional data, which reflect only a part of the hawala structure.

The more sophisticated the models become, the more they refine the reading of observable flows. Yet the systems they seek to apprehend cannot be reduced to those flows. It is within this gap that the current limitations of detection are structurally anchored.

Written by Paul Labic. Laboratory for theoretical and applied economics (BETA), CNRS UMR 7522. Associate researcher at the research lab of the French police academy (ENSP)f the French police academy (ENSP)


REFERENCES

Alenova, M., Utaliyeva, A., & Li, K. J. (2024). Detecting hawala network for money laundering by graph mining. Journal of Finance and Data Science, 10(100147), 17. https://doi.org/10.1016/j.jfds.2024.100147

Moin, B. (2024). Taming the untamable: Rethinking, regulating, and revamping hawala. Journal of Academics Stand Against Powerty, 5, 20–43. https://journalasap.org/index.php/asap/article/view/40


NOTES

  1. For the purposes of this discussion, hybrid criminal configurations – such as cyber scams culminating in the physical transfer of
    cash – are not examined in detail. The possibility of reconstructing a more complete model remains dependent on the proportion of observable elements relative to the underlying criminal structure. ↩︎

Similar Posts