From Hawala to Online Assets: The Evolving Architecture of Illicit Finance in India

Abstract: Hawala was India’s dominant architecture of illegal cash transfers for decades: informal, trust-based, with no paper-trail. That architecture has been recast today in code. Cryptocurrency exchanges, stablecoin rails, decentralised finance protocols and blockchain-based mixing services now offer the same core proposition that hawala always did: cross-border value transfer with minimal identifying documentation, but at exponentially greater speed, scale and geographic reach. This essay recounts the shift from conventional hawala to illegal finance based on digital assets. It also discusses India’s enforcement response through the PMLA framework and the Enforcement Directorate and highlights the structural holes that present law has not yet filled.

I. The Illicit Finance Core Architecture

All illicit finance is rooted in the same basic problem: how can the person holding criminally obtained value turn it into something that looks legitimate, can be spent, and has no connection to its unlawful origin? The Financial Action Task Force (FATF) with its three-stage model of money laundering (placement, layering and integration) captures the heart of this phenomenon. Placement is the injection of illegal funds into a financial system, layering is the concealment of their origin through a sequence of transactions and integration is their re-injection into the lawful economy in a form that is not readily traceable to the predicate violation.

Every illicit finance architecture is fundamentally a solution to this three-stage challenge tailored to the regulatory and technology context of its period. For decades, hawala was the dominant architecture for cross-border illicit finance in the South Asian context, as it provided placement without any formal financial institution, layering through the correspondent-broker relationship between hawaladars in different cities and integration through the settlement of debts in commodities, real estate or reverse cash flows that left no documentary connection to the original criminal proceeds.

The problem has not altered with the digital age. It has transformed the solutions that are accessible, and the new solutions are, in several crucial aspects, more powerful, more scalable and more difficult to trace than anything that existed in the hawala era.

II. The Traditional Hawala: Structure and Enforcement:

The hawala system is based on a network of brokers, hawaladars, who take value in one place and arrange for similar value to be supplied at another, with less commission, without any physical transfer of money across the border. The system is totally trust-based, with occasional countervailing trades, commodities, or the physical transfer of currency between brokers settling periodically between each other. From the law enforcement viewpoint its distinguishing trait is the almost complete absence of documentary proof.

Hawala transactions are banned in India by the Foreign Exchange Management Act, 1999 (FEMA) and a listed offence under the Prevention of Money Laundering Act, 2002 (PMLA). The FEMA framework makes illegal foreign exchange transactions a criminal offence, and the Enforcement Directorate (ED) has executed several high-profile searches and arrests under the PMLA for hawala-linked money laundering. The enforcement record against traditional hawala, however, has been mixed, and the trust-based, informal nature of the system, plus the lack of any evidentiary trail, make prosecutions hard to sustain to the conviction stage.

The Supreme Court has consistently observed in cases involving hawala operations that the evidentiary challenge is structural, where the entire transaction is oral, in cash, with brokers who share community ties and have every incentive to maintain omerta, the standard documentary evidentiary requirements of criminal prosecution are almost impossible to satisfy.

III. Third, Digital Assets : The New Architecture of Hawala

A. The Same Value Proposition as Cryptocurrency

The primary value proposition of cryptocurrency to the illegal finance user is the same as hawala - cross-border movement of value without documentary identification. But cryptocurrency offers three additional benefits that hawala cannot provide. First, speed: crypto transfers settle in seconds or minutes, versus the hours or days it takes to confirm hawala agreements. Second, scalability. One Bitcoin wallet can send and receive billions of dollars; a hawala network of comparable capacity would require hundreds of human brokers. Third, pseudonymity: In the sense that the transaction graph is accessible, blockchain transactions are public. However, the identities of the wallet addresses involved are not automatically known to any authority and require more forensic work to ascribe.

The merger of traditional hawala networks with cryptocurrency rails has been documented by India’s Enforcement Directorate . Investigative journalism has corroborated this . The Indian Express (November 2025) claimed that ED officers have seen a trend in the cyberfraud investigations. The money goes from anonymous wallets to blacklisted exchanges in Dubai, then to Cambodia and eventually into Chinese scam organisations. The same study showed hawala operators taking rupees from local customers and transferring the same amount in USDT, a dollar-pegged stable token, to foreign recipients on crypto exchanges, a digital version of the traditional hawala system.

This architecture is then illustrated in practice with the case of Manideep Mago, investigated by the ED under the PMLA (2024). A corporation located in Delhi traded cryptocurrencies worth over ₹1,858 crore on crypto exchanges and earned international payments of over ₹3,500 crore. They were members of an international hawala gang, routing money to Canada and Hong Kong through fake invoices, while at the same time invested in illegal crypto mining and arbitrage trading. The ED probe revealed that chartered accountants and bank personnel were involved in creating fake documents.

B. Layering Toolkit: Chain-Hopping, Mixers, and De-Fi

The layering step – where hawala traditionally relied on the broker network to hide the paper trail – has been greatly strengthened in the bitcoin setting by a range of technical tools. Chain-hopping is the transfer of funds from one blockchain to another via cross-chain bridges, which makes it hard for blockchain forensic investigators to track the trail across multiple distributed ledgers. Cryptocurrency mixers (sometimes called tumblers) take funds from several sources and combine them, then redistribute them, destroying the link between the source and destination of the transaction. Privacy coins like Monero use cryptographic techniques to make transactions inherently untraceable, whereas Bitcoin has a public transaction graph even if wallet identities are pseudonymous.

Decentralised finance (DeFi) protocols present a further complication: the middlemen AML frameworks normally depend on to enforce controls — banks, exchanges, payment processors — are substituted by autonomous software. A DeFi lending protocol does not have a compliance officer, no customer due diligence system, no means for reporting questionable transactions because there is no legal person running it.

The Directorate of Revenue Intelligence’s Smuggling in India Report 2024–25 (December 2025) pointed to this change explicitely: “The growing use of P2P crypto networks, offshore OTC platforms, decentralised finance and unhosted wallets creates additional difficulties for investigators.” In September 2026, Home Minister Amit Shah announced the setting up of a dedicated Darknet-Crypto Cell within India’s central investigative architecture, specifically to deal with the convergence of cryptocurrency and darknet markets in drug trafficking and financial crime investigations.

From Hawala to Online Assets: A Structural Overview

1. Hawala - How it works: The hawaladar receives cash. No banks involved. No KYC.
2. Crypto — Placement: Cash-to-crypto through P2P exchanges or unregistered OTC desks; no or fake identity verification.
3. Hawala - Layering: Network of brokers in several cities; offsetting transactions; commodity settlements.
4. Crypto - Chain-hopping across blockchains Mixing/Tumbling DeFi protocols Privacy currencies (Monero)
5. Hawala - Integration: Real estate, gold, commercial invoicing; value re-enters via legal business.
6. Crypto - Integration: INR conversion through crypto exchanges; real estate; fake consultation invoices; cross-border transactions using stablecoins.
7. Enforcement challenge (both) No paper trace (hawala) or pseudonymous trail (crypto) Cross-border jurisdiction Broker network omerta No human intermediary (DeFi)

IV. What is different in India’s enforcement framework 2023-2026:

A. PMLA and the Reporting Obligation under the VDA

Finance Act 2023 amended India’s Prevention of Money Laundering Act, 2002 to include Virtual Digital Asset Service Providers (VDA SPs) – cryptocurrency exchanges, custodians and other related service providers – within the definition of ‘reporting entities’ required to undertake customer due diligence, maintain transaction records and report Suspicious Transaction Reports (STRs) with the Financial Intelligence Unit – India (FIU-IND). As of December 2024, FIU-IND had 97 VDA platforms registered.

Enforcement Directorate has been actively using its attachment powers under PMLA in relation to cryptocurrency associated money laundering. The Gujarat bitcoin extortion case involving a former legislator and law enforcement personnel who were discovered to have been involved in cryptocurrency-mediated extortion and money laundering showed that the regulatory threat extends to insiders within the criminal justice system itself. The alleged comment from the Supreme Court in that instance that crypto is like hawala confirmed what financial crime investigators had found on the ground.

The Income Tax Act 2025 also enhances the reporting architecture by requiring prescribed crypto-asset reporting entities to provide transaction statements to the tax department under Section 509(1) and creating the domestic infrastructure for India’s planned implementation of the OECD Crypto-Asset Reporting Framework (CARF) by April 2027, which will facilitate cross border exchanges of VDA transaction data between tax authorities.

B. The Enforcement Gap: What PMLA Fails To Achieve

Despite this legislative evolution, three structural weaknesses persist in India’s anti-money laundering system for electronic assets. First, unregistered offshore exchanges: the PMLA reporting obligation applies to entities providing services to Indian users, but enforcement against exchanges with their headquarters outside India requires international cooperation through the Financial Intelligence Unit’s membership of the Egmont Group and bilateral mutual legal assistance channels – channels that are too slow to intercept rapidly moving cryptocurrency flows.

Second, decentralised protocols: DeFi systems that have no identifiable legal operator or corporate entity in any jurisdiction cannot be served PMLA notices, subjected to KYC obligations, or made to file STRs. The judicial system is just not equipped to handle an autonomous software system.

Third , privacy coins. Cryptographic privacy coins like Monero are supposed to be forensically opaque. Bitcoin allows blockchain analysis businesses to trace transaction graphs, although wallet identity attribution may require further inquiry. Monero’s cryptographic architecture is inherently resistant to tracing. In practice, this means that any laundering operation that transfers funds to Monero at any point in the layering process becomes significantly harder — and in some circumstances, nearly impossible — to track using standard blockchain forensic tools.

V. Where Should India Head?

“The bottom line of this survey is clear. India’s law enforcement and regulatory regimes have evolved to address cryptocurrency in illicit finance—the PMLA’s VDA reporting obligations, the ED’s crypto attachment powers, the income tax regime for VDA transactions—but they have evolved to address the Bitcoin-era version of the problem: a world where crypto transactions are pseudonymous, traceable, and identifiable exchanges serve as choke-points for compliance intervention.

The frontier of illicit digital banking — DeFi, privacy coins, cross-chain bridges, synthetic identities built by AI that pass KYC checks — is an area where none of those assumptions hold true. An acknowledgement of this frontier may be found in the ED’s September 2026 eighteen-month training and technology initiative, dedicated to building forensic capability for DeFi investigation, chain-hopping analysis and mixer-traced reconstruction. But forensic capacity alone cannot replace legal structures that allow investigators jurisdiction over essentially decentralised infrastructure.

What India needs – and what no jurisdiction has yet fully achieved – is a regulatory framework for the decentralised, intermediary-free frontier of digital finance. A legal basis for requiring DeFi protocol developers to implement compliance architecture from the design stage; international agreement on the treatment of cross-chain bridge operators as money transmission businesses; and investment in cryptographic forensic capabilities that can operate at the privacy-coin frontier. The criminal networks have transitioned fully from hawala to electronic assets. The legal structure is trying to catch up with it . It is a work in progress .

VI. Conclusion

The history of illegal finance is a history of a continual regulatory chase. Hawala has survived decades of FEMA enforcement because it is based on trust, word of mouth, and community networks that cannot be penetrated by paper production or bank record analysis. The same architecture, in digital form, depends on cryptography, coding, and pseudonymity — and is more difficult to trace and to govern than anything that came before it.

India’s enforcement authorities have made real strides. The PMLA’s VDA responsibilities, the ED’s crypto attachment powers, the FIU-IND’s exchange registration structure, and the nascent CARF implementation constitute a much more capable framework than existed even five years ago. But all of these technologies are at the centralised, mediated end of the digital financial continuum. Privacy coins and cross-chain bridges are functioning in a space where those tools have little reach, whereas criminal networks have already switched to DeFi.

Closing this gap requires the same realisation that addressed the hawala enforcement gap -- at least partially -- under FEMA: that the law must follow the architecture of the criminal, not wait for the architecture to adapt itself to the law. The evolving architecture of illicit finance requires an evolving architecture of financial crime law.

References:

1. Prevention of Money Laundering Act, 2002 (PMLA) – Section 2, 3, 12 (Reporting Entities); Finance Act 2023 modifications to incorporate VDA SPs under the term of Reporting Entity.
2. Financial Action Task Force (FATF), 'Virtual Assets and Virtual Asset Service Providers: Updated Guidance for a Risk-Based Approach' — Recommendation 15 and Travel Rule requirements.
3. Foreign Exchange Management Act, 1999 (FEMA) – Section 10 (contravention of approved foreign exchange); hawala as FEMA offence.
4. revenue Tax Act 2025 – Section 509(1) (crypto-asset transaction statement required); Section 115BBH (30% flat tax on VDA transfer revenue).
5. Directorate of Revenue Intelligence, Smuggling in India Report 2024-25 (December 2025) – Enforcement issues with P2P crypto networks, DeFi and unhosted wallets
6. Business Today / Indian Express, 'Crypto adds new layer of opacity to traditional hawala channels’ (Nov 2025) Available at: https://www.businesstoday.in/crypto/token/story/crypto-adds-new-layer-opacity-old-hawala-channels
7. Bitcoin News, 'Indian ED Seizes Large Scale Crypto and Hawala Operation – Manideep Mago Arrested' (June 2024). Available at: https://news.bitcoin.com/
8. CryptoTimes, ‘India Forms Darknet-Crypto Cell to Trace Drug Money Trail – Amit Shah’ (September 2026). https://www.cryptotimes.io/2026/09/07/india-sets-up-darknet-crypto-cell-to-trace-drug-money-trail-amit-shah/
9. CryptoTimes, ‘India’s ED Boosts Crypto Crime Tracking With New 18-Month Probe Plan’ (September 2026). Retrieved from: https://www.cryptotimes.io/2026/09/16/indias-ed-sharpens-crypto-crime-tracking-under-new-18-month-investigation-plan/
10. Zenodo / Beyond the Paper Trail : “Digital Hawala and the Enforcement Gaps in India ’s AML Regime . ” September 2026. Available from: https://zenodo.org/record/2280849
11. UNODC, ‘Casinos, Money Laundering, Underground Banking and Transnational Organised Crime in East and Southeast Asia’ (2024).
12. Chainalysis, 2025 Crypto Crime Trends Report – typologies and volumes of criminal cryptocurrency transactions.
13. OECD, Crypto-Asset Reporting Framework (CARF) (2022) – Target date for adoption April 2027; CARF transaction statement responsibilities under IT Act 2025 Section 509(1).