Terrorist Financing

Terrorist Financing After the terrorist attacks of September 11, 2001, the finance ministers of the Group of Seven (G-7) met on October 7, 2001, in Washington, D.C., and urged all nations to freeze the assets of known terrorists. Since then, many countries have committed to helping disrupt terrorist assets by alerting financial institutions about persons and organizations that authorities determine are linked to terrorism. The G-7 nations marshaled FATF to hold an “extraordinary plenary session” on October 29, 2001, in Washington to address terrorist financing. As a result, FATF issued the first eight of its Special Recommendations, which have since been incorporated into the current FATF Recommendations. (See the chapter "International AML/CFT Standards" for more detail.) Recommendation 5 encourages countries to criminalize terrorist financing and the financing of terrorist organizations and individual terrorists with or without a link to a specific terrorist act, as well as ensuring these crimes are designated as money laundering predicate offenses. This designation allows the application of money laundering statutes to terrorist financing and the potential for greater prosecution and deterrence. Cutting off financial support to terrorists and terrorist organizations is essential to disrupting their operations and preventing attacks. Differences and Similarities between Terrorist Financing and Money Laundering Money laundering and terrorist financing are often mentioned together, but there are critically important differences between the two crimes. Many of the controls that businesses implement are intended to serve the dual purposes of combating money laundering and preventing terrorist financing. The controls instituted to combat money laundering also strengthen the ability to identify, deter, and disrupt terrorist financing. Of note, over half of the individuals investigated by US law enforcement for ties to terrorist organizations and associated BSA records had engaged in suspected money laundering, including structuring. But money laundering and terrorist financing are separate crimes. Although there is no workable financial profile for operational terrorists, there are key distinctions that can help compliance officers understand the differences and distinguish suspicious terrorist financial activity from money laundering. The most basic difference between the two crimes involves the origin of the funds. Terrorist financing uses funds for an illegal political purpose, but the money is not necessarily derived from illicit proceeds. The purpose of laundering funds intended for terrorists is to support terrorist activities. The individuals responsible for raising the funds are not typically the beneficiaries of the laundered funds; rather, the money benefits terrorist activity. On the other hand, money laundering always involves the proceeds of illegal activity. The purpose of laundering is to enable the money to be used legally. The individuals responsible for the illegal activity are usually the ultimate beneficiaries of the laundered funds. From a technical perspective, the laundering methods used by terrorists and other criminals are similar. Although it would seem logical that funding from legitimate sources does not need to be laundered, terrorist groups do need to disguise the link between them and their legitimate funding sources, in part to ensure the continued and uncompromised future use of sources. In doing so, the terrorists use methods similar to those of criminal organizations, such as cash smuggling; structuring; purchase of monetary instruments; wire transfers; and use of debit, credit, and prepaid cards. The hawala system is an informal value-transfer system involving the international transfer of value outside the legitimate banking system. Based on a trusted network of individuals, this system has also played a role in moving terrorist-related funds. In addition, money raised for terrorist groups can be used for mundane expenses, such as food and rent; it is not always strictly used for the terrorist acts themselves. Detecting Terrorist Financing The National Commission on Terrorist Attacks Upon the United States determined that neither the September 11 hijackers nor their financial facilitators were experts in the use of the international financial system. The terrorists created a paper trail linking them to one another and their facilitators. Still, they were adept enough to blend into the vast international financial system without revealing themselves as criminals. The money laundering controls in place at the time were largely focused on drug trafficking and large-scale financial fraud; they were not sufficiently focused on the types of transactions made by the hijackers. Following 9/11, international efforts to detect and deter terrorist financing increased significantly. Conversely, in response to these efforts, terrorists and terrorist financiers have adapted, expanding and varying their methods of raising and moving funds, requiring increased innovation and vigilance by law enforcement and financial institutions. In an attempt to clarify terrorist financing and offer recommendations to the global financial community, FATF issued guidance to identify techniques and mechanisms used in financing terrorism and described the general characteristics of terrorist financing. Its objective is to help organizations determine when transactions merit additional scrutiny so they can better identify, report (when appropriate), and ultimately avoid transactions involving funds associated with terrorist activity. FATF suggests that organizations exercise “reasonable judgment” in evaluating potential suspicious activity. To avoid becoming conduits for terrorist financing, organizations must consider, among other things, the following factors: • Use of an account as a front for a person with suspected terrorist links • Appearance of an account holder’s name on a list of suspected terrorists • Frequent large cash deposits in accounts of nonprofit organizations • High volumes of transactions in accounts • Lack of a clear relationship between the banking activity and the nature of the account holder’s business FATF suggests that, with these scenarios in mind, organizations pay close attention to the classic indicators of money laundering, including dormant, low-sum accounts that suddenly receive wire transfer deposits followed by daily cash withdrawals that continue until the transferred sum is removed, as well as lack of cooperation by a customer in providing required information. Detecting terrorist financing (Case example: The Maute Group) The threat of terrorism financing involves the risk that funds and other assets intended for terrorists are being raised, moved, stored, or used in or through a jurisdiction. Systemic vulnerabilities can allow these activities to go undetected, which can have dire consequences. Understanding the threat environment and systemic vulnerabilities can facilitate the detection and disruption of terrorism financing. Experience shows that ongoing engagement with foreign counterparts is particularly important in both detecting and assessing cross-border terrorist financing risks. The 2018 Analyst Exchange Program (AEP) was a multinational project involving financial intelligence analysts from Australia, the Philippines, Malaysia, and Indonesia. The goal was to identify and understand the flow of funds, fighters, and material support to the radical Islamist Maute Group and associated groups in the Philippines prior to and during the Marawi Siege in 2017. The AEP initiative identified money-moving networks, probable fund sources, networks used, and previously unknown financiers and facilitators that were utilized to finance terrorist groups in the Southern Philippines. The Maute terrorists were trained by the Islamic State of Iraq and Syria (ISIS) and gained experience in Syria and Iraq, or they were trained locally by a wealthy Muslim family, the Maute family. They were funded by: • The Maute family • ISIS • The sale of shabu, a slang term for methamphetamine • Anonymous mobile payments During the AEP program, information was shared among the participants, including financial intelligence unit reports, transaction reports, and intelligence from domestic authorities and the private sector. This information has supported ongoing investigations. Key takeaways • Terrorists need to raise, move, store, and use funds in order to sustain their operations. • Countries must identify, assess, and understand terrorist financing risk as an essential part of dismantling and disrupting terrorist networks. • Engaging with foreign counterparts is important in detecting and assessing cross-border terrorist financing risks. • It’s important to establish procedures and mechanisms to handle the exchange of sensitive information at an early stage in collaboration. How Terrorists Raise, Move, and Store Funds Global sanctions efforts have reduced funding to organizations from traditional state sponsors of terror, leading those organizations to seek supplemental sources of income to conduct their activities. In a December 2015 United Nations Security Council meeting, Secretary-General Ban Kimoon told the Council: “Terrorists take advantage of weaknesses in financial and regulatory regimes to raise funds. They circumvent formal channels to avoid detection and exploit new technologies and tools to transfer resources. They have forged destructive and very profitable links with drug and criminal syndicates—among others. And they abuse charitable causes to trick individuals to contribute. Terrorists continue to adapt their tactics and diversify their funding sources,” which he noted include raising money through the oil trade, extortion, undetected cash couriers, kidnapping for ransom, trafficking of humans and arms, and racketeering. Use of Hawala and Other Informal Value Transfer Systems Alternative remittance systems, or informal value transfer systems (IVTSs), are often associated with ethnic groups from Africa, Asia, and the Middle East. These systems commonly involve the international transfer of value outside the legitimate banking system and are based on trust. The systems are referred to by different names depending upon the country: “hawala” (an Arabic word meaning change or transform), “hundi” (a Hindi word meaning collect), “chiti banking” (referring to the way the system operates), “chop shop banking” (China) and “poey kuan” (Thailand). Hawala was created centuries ago in India and China before Western financial systems were established to facilitate the secure and convenient movement of funds. Merchant traders wishing to send funds to their homelands would deposit them with a hawala broker, or hawaladar, who typically owned a trading business. For a small fee, the hawaladar would arrange for the funds to be made available for withdrawal from another hawaladar, typically also a trader, in another country. The two hawaladars would settle accounts through the normal process of trade. Today, the process works much the same way, with people in various parts of the world using their accounts to move money internationally for third parties. In this way, deposits and withdrawals are made through hawala bankers rather than traditional financial institutions. The third parties are typically immigrants or visiting workers who send small sums to their homelands to avoid bank fees for wire transfers. Reasons for legitimate use of hawala and other IVTS include less expensive and faster money transmission, lack of banking access in the remittance-receiving country, cultural preference, and lack of trust in the formal banking system. There is usually no physical movement of currency and typically a lack of formality regarding verification and recordkeeping. The money transfer takes place by coded information that is passed through chits, couriers, letters, faxes, emails, text messages, and online chat systems, followed by some form of telecommunications confirmation. Almost any document that carries an identifiable number can be used by the receiver to pick up the values in the other country. As AML/CFT measures have proliferated around the world, the use of hawala, which operates without governmental supervision, is believed to have become more appealing to money launderers and terrorists. FATF has said that regulation and supervision of hawalas and other similar service providers remains a key challenge to authorities. It also notes that, as in other sectors, money laundering and terrorist financing risk increases the less regulation and supervision the hawala and similar service providers are subjected to. These providers are attractive to launderers because they leave little to no paper trail; the details of the customers who will receive the funds are communicated to the receiving brokers via telephone, fax, and email. Authorities have observed the use of advanced internet technologies by hawala and other similar agents and suspect they are exclusively using protected online services to conduct their activities and maintain their accounts, leaving no manual accounts. Because hawala is a remittance system, it can be used at any phase of the money laundering cycle. It can provide an effective means of placement: When the hawaladar receives cash, he can deposit the cash in bank accounts. He will justify these deposits to bank officials as the proceeds of legitimate business. He may also use some of the cash received to pay for his business expenses, reducing his need to deposit the cash into a bank account. Hawaladars often operate within or in addition to a legitimate or front business to provide cover for the activity and commingle the funds in the business accounts. A component of many layering schemes is transferring money from one account to another, while avoiding leaving a paper trail. A basic hawala transfer leaves little if any paper trail. Hawala transfers can be layered to make following the money even more difficult. This can be done by using hawaladars in several countries and distributing the transfers over time. Hawala transaction example Hawala techniques can be used to convert money into almost any form, offering many possibilities for establishing an appearance of legitimacy in the integration phase of the money laundering cycle. The money can be reinvested in a legitimate (or legitimate-appearing) business. A hawaladar could, for example, very easily arrange for the transfer of money from the United States to Pakistan and then back to the United States, apparently as part of an investment in a business there. Hawalas are attractive to terrorist financiers because, unlike formal financial institutions, they are not consistently subject to formal government oversight and are not required to keep detailed records in a standard form. Although some hawaladars do keep ledgers, their records are often written in idiosyncratic shorthand and are maintained only briefly. Al-Qaeda moved much of its money by hawala before September 11, 2001, using approximately 12 trusted hawaladars who almost certainly knew of the source and purpose of the money. Al-Qaeda also used unwitting hawaladars who probably strongly suspected that they were dealing with al-Qaeda, but they were nevertheless willing to engage in the transactions. Detecting terrorist financing (Case example: Use of hawala and other informal value transfer systems) On August 18, 2011, Mohammad Younis pled guilty in Manhattan federal court to operating an unlicensed money transfer business between the United States and Pakistan. One of the money transfers was used to fund the May 1, 2010, attempted car bombing in New York City’s Times Square by Faisal Shahzad, who is serving a life sentence in federal prison. From January to May 2010, Younis provided money transmitting services to individuals in the New York City area by assisting in the operation of a hawala. On April 10, 2010, Younis engaged in two separate hawala transactions with customers who traveled from Connecticut and New Jersey to meet with him in Long Island. In each of the transactions, Younis provided thousands of dollars in cash to the individuals at the direction of a coconspirator in Pakistan, but without knowledge of how the customers were planning to use the funds. At no time did Younis have the license to operate a money transmitting business from either state or federal authorities. One of the individuals to whom Younis provided money was Shahzad, who on June 21, 2010, pled guilty to a 10-count indictment charging him with crimes relating to his attempt to detonate a car bomb in Times Square on May 1, 2010. During the course of his plea allocution, Shahzad acknowledged receiving a cash payment in April 2010 in the United States to fund his preparations for the bombing. According to Shahzad, the April cash payment was arranged in Pakistan by associates of the Tehrik-e-Taliban, the militant extremist group based in Pakistan that trained him to make and use explosive devices. On September 15, 2010, Younis was arrested by the FBI and other agents of the New York Joint Terrorism Task Force. Younis pled guilty to one count of conducting an unlicensed money transmitting business. Key takeaways • Unlicensed money transfer businesses, or hawalas, can be used to easily transfer sums of funds from high-risk jurisdictions at the direction of an unidentified third party. • Hawalas can be particularly useful for moving funds for illicit purposes, especially when a hawaladar is unlicensed and not subject to AML/CFT requirements. • The combination of the ease with which funds can be moved to and from high-risk jurisdictions and the limited level of scrutiny applied to transactions makes hawala especially attractive for terrorist financing. Use of Charities and Nonprofit Organizations (NPOs) After the September 11, 2001, attacks, the US government initiated the Terrorist Finance Tracking Program (TFTP) to identify, track, and pursue the funding sources of terrorist groups. Through the TFTP, the US government has uncovered and shut down over 40 designated charities that were used as potential fundraising front organizations. Knowingly or not, charitable organizations have served as vehicles for raising and laundering funds destined for terrorism. As a result, some charities, particularly those with Muslim connections, have experienced a large drop in donations or have become targets of what they claim are unfair investigations and accusations. FATF acknowledges the importance of the nonprofit organization (NPO) sector to the global community. However, FATF found that more than a decade after the abuse of NPOs by terrorists and terrorist organizations was formally recognized as a concern, the terrorism threat to the sector remains. The sector continues to be misused and exploited by terrorist organizations through a variety of means. Charities and NPOs have the following characteristics that are particularly vulnerable to misuse for terrorist financing: • Enjoying the public trust • Having access to considerable sources of funds • Being cash-intensive • Frequently having a global presence, often in or next to areas exposed to terrorist activity • Often being subject to little or no regulation and/or having few obstacles to their creation To help legitimate NPOs avoid ties to terrorist-related entities and regain public trust, FATF issued guidelines on best practices for charities in combating the abuse of NPOs. The guidance helps countries implement Recommendation 8 on NPOs in line with the risk-based approach, that is, to assist NPOs in mitigating terrorist-financing threats and assist financial organizations in the proper implementation of the risk-based approach when providing financial services to NPOs. The objective of Recommendation 8 is to ensure that NPOs are not abused by: • Terrorist organizations posing as legitimate entities • Exploiting legitimate entities as conduits for terrorist financing • Concealing or obscuring the clandestine diversion of funds intended for legitimate purposes to terrorist organizations The best practices address identification and mitigation of risk by countries and NPOs alike, self-regulation by NPOs, and access of NPOs to financial services. FATF recommends that NPOs maintain and be able to present full program budgets that account for all expenses, and conduct independent internal and external field audits, the latter to ensure funds are being used for intended purposes. FATF recommends that charities use formal bank accounts to store and transfer funds so that they are subject to the banks’ regulations and controls. In turn, the banks where the accounts are established should manage NPOs like other customers, apply their KYC rules, and report suspicious activities. The Charity Commission is an independent regulator of charities in England and Wales. Its role is to protect the public’s interest in charities and ensure that charities further their charitable purposes for the public benefit and remain independent from private, government, and political interests. Its counterterrorism strategy report dictates a four-strand approach to preventing abuse of charities by terrorist financiers, including: 1. Cooperation with government regulators and law enforcement nationally and internationally 2. Raising awareness in the sector of the risks charities face from terrorism 3. Oversight and supervision through proactive monitoring of the sector in areas identified as being at higher risk 4. Intervention when abuse, or the risk of abuse, related to terrorist activity is apparent Detecting terrorist financing (Case example: Using NPOs) Nonprofit organizations (NPOs) are an integral part of the global landscape. NPOs provide critically needed humanitarian aid around the world, especially to disadvantaged people in some of the most corrupt and under-governed territories, which often serve as “incubators” for terrorists. NPOs are at high risk for exploitation by terrorists. The most commonly observed method of exploitation of NPOs to support terrorism involves the diversion of funds. In this typology, funds raised by NPOs for humanitarian programs are diverted to support terrorism at some stage of the NPO’s business process; funds raised for charitable purposes are redirected to terrorists. Diversion occurs via internal actors, such as directing officials and staff, and via third-party associates. Other less common methods of exploiting NPOs include affiliation with a terrorist entity, abuse of programing, support for recruitment, false representation, and sham NPOs. The diversion of funds can be carried out by individuals who are internal to the organization. For example, a domestic NPO was raising funds for humanitarian relief in an area of conflict. The NPO used collection boxes outside religious institutions to solicit donations. The funds raised were held in a domestic bank account. The founder of the NPO was suspected of diverting the funds to facilitate terrorism rather than using them for the stated humanitarian activities. A law enforcement investigation resulted in the arrest of the founder of the NPO for terrorism facilitation offenses. In addition, US$60,000 in collected funds were seized. The diversion of funds can also be perpetrated by individuals who are external to the organization. For example, a domestic NPO was established to support charitable work in foreign areas of conflict. An investigation by the national financial intelligence unit was initiated following suspicious transaction reporting. It revealed that locally collected funds were being transmitted to foreign-based charitable organizations. The investigation also uncovered that, once the funds were received by the foreign-based NPOs, they were systematically passed on to persons or organizations that were part of, or affiliated with, a known terrorist organization. Although there were established connections between the foreign-based charitable organizations and the terrorist organization, direct links between the domestic NPO and the terrorist organization could not be substantiated. Key takeaways • NPOs are at high risk for exploitation by terrorists. • The diversion of funds occurs when funds raised for charitable purposes are redirected to support terrorist activity. • The diversion of funds can be perpetrated by individuals internal and external to the organization. • Diverted funds are used to support terrorist activities both domestically and abroad. Detecting terrorist financing (Case example: NPOs and Islamic Defenders Front of Indonesia) The nonprofit organization (NPO) sector has inherent vulnerabilities, which terrorist entities seek to exploit. A key risk that NPOs face is that they operate in the same vulnerable environments in which terrorists operate. One method of exploitation of NPOs to support terrorism is to form an operational affiliation between an NPO and a terrorist entity. These affiliations can range from informal personal connections involving NPO directors and terrorist entities to more formalized relationships. In a typical affiliation, the NPO’s internal actors, usually directing officials and staff, have established links to a terrorist entity. These internal actors are able to exercise influence over the operations of the NPO, which ultimately support terrorist entities. This can include the collection, transfer, retention, and expenditure of resources, and the delivery of programs. The affiliation involves every element of NPO operations. The Islamic Defenders Front (FPI) was a hardline Islamist organization founded in Indonesia in 1998 by Muhammad Rizieq Shihab. The FPI originally positioned itself as the Islamic moral police against vice, and it conducted mostly illegal and unauthorized vigilante operations. FPI gained support by appearing to be an NPO that provided voluntary-based welfare services in disaster-struck and poverty-ridden regions and neighborhoods. It provided schooling, food supplies, and other humanitarian aid. The Indonesian government alleged that Rizieq Shihab pledged FPI’s allegiance to the Islamic State of Iraq and Syria (ISIS). Former FPI members were allegedly involved in the bombing of a cathedral in Makassar, Indonesia, in early 2021. On December 30, 2020, the Indonesian government issued a joint ministerial decree banning FPI. The government claimed FPI had threatened Indonesia’s national ideology, committed illegal raids and atrocities including terrorism, and allowed its organizational permit to expire. The government claimed that 29 members of the group had been convicted of committing acts of terror and that 100 FPI members had been convicted of other crimes. On January 6, 2021, Indonesia’s financial intelligence unit, the Financial Transaction Reports and Analysis Centre (PPATK) froze FPI’s bank accounts to prevent the transfer of funds and use of funds from the accounts that were known or suspected to draw funds for illegal activity. Key takeaways • A key risk that NPOs face is that they operate in the same vulnerable environments in which terrorists operate. • Affiliations between NPOs and terrorists can range from informal personal connections to more formalized relationships. • In NPOs that are exploited by internal actors affiliated with terrorist entities, these individuals are able to exercise influence over the NPO’s operations to ultimately support terrorist activities. • Organizations must know their NPO customers, their staff members, and the individuals and entities with whom the NPO affiliates. Emerging Risks for Terrorist Financing FATF warns of several rising threats and vulnerabilities, including: • Self-funding by foreign terrorist fighters (FTFs) • Raising funds through social media • New payment products and services • Exploitation of natural resources Self-funding by FTFs Social media platforms, smartphone applications, and internet sharing sites provide terrorist organizations with global reach at little to no cost. FTFs and terrorist sympathizers can self-radicalize and communicate with terrorist organizations more efficiently than ever before. Often, the low cost associated with perpetrating a terrorist act on a soft target (i.e., a civilian, nonmilitary target that is relatively unprotected and thus vulnerable to terrorist attacks) makes it possible for such acts to be self-funded. Self-funding includes sources such as employment income, social assistance, family support, and bank loans, which makes detection nearly impossible without the association of other aggravating terrorist financing indicators. Former FBI Director James Comey stated, “Terrorists, in ungoverned spaces, disseminate poisonous propaganda and training materials to attract troubled souls around the world to their cause. They encourage these individuals to travel, but if they cannot travel, they motivate them to act at home. This is a significant change from a decade ago.” Raising funds through social media Social media platforms make it possible to build social and informationsharing networks like never before in human history. This technology presents a unique opportunity for terrorist organizations to communicate and raise money for their causes and the potential to reach into every home in every country in near real time. Terrorists have leveraged social media through methods such as crowdfunding and sharing of virtual and prepaid account information. These methods present unique difficulties for law enforcement, due to the increased dispersion of the activity and the need for cooperation from both financial institutions and social media platforms. New payment products and services (See the section "Risks Associated with New Payment Products and Services.") Exploitation of natural resources Terrorist organizations that hold or maintain control over territory or operate in a country with poor governmental control of the territory can take control of natural resources, such as gas, oil, timber, diamonds, gold and other precious metals, wildlife (e.g., ivory trading), and historical artifacts, or extort companies that extract those resources to both fund terrorist acts and support day-to-day activities. These resources themselves might be sold on the black market or to complicit companies, where they can then be integrated into the global trade sector. An awareness of geographies in which terrorist organizations operate and maintain control, knowledge of current commodity prices, and strong multijurisdictional partnerships are necessary to combat this method of terrorist funding, which has the potential to generate vast sums. Red flags include the association of a customer with PEPs, complex legal entities structures with multiple internal transactions, and the rapid shipment of resources to distant jurisdictions. Detecting terrorist financing (Case example: Islamic State and cryptocurrency) Criminal convictions for terrorist funding remain relatively rare. As criminals, terrorists adapt and utilize new technology in the current operating environment. However, law enforcement expertise and skills also are becoming increasingly sophisticated, revealing funding methods and technologies used by terrorists. Law enforcement can use the unique investigative pathways presented by blockchain and cryptocurrencies to identify, arrest, and prosecute individuals and organizations that fund terrorism against states and individuals. To combat the risks from terrorists using new technology, governments are enacting laws and guidance and working with exchanges and wider financial services to prevent misuse. Terrorist organizations are continually exploring new ways to raise, store, move, and use funds. The same is true for individual criminals, or “lone actors,” who fund terrorist activity, often far from conflict zones. Increasingly, new technological capabilities open channels for financing terrorism, and the use of cryptocurrency is one of these. In September 2021, at UK’s Birmingham Crown Court, Hisham Chaudhary, 28, was sentenced to 12 years’ imprisonment for one count of belonging to a proscribed terrorist group, two counts of entering terrorist fundraising arrangements, and four counts of disseminating terrorist publications. As part of his role, from his home, Chaudhary received money from supporters and transferred over £50,000 abroad using Bitcoin. These funds paid smugglers to help captured ISIS militants escape from Kurdish-controlled prison camps in northern Syria. The court heard that Chaudhary immersed himself online on encrypted chat and video platforms, from which he spread terrorist propaganda and solicited funds. He deliberately developed his understanding and use of cryptocurrency to facilitate these transfers and used encrypted chat to communicate. As is common, Chaudhary presented himself as a humanitarian and claimed his funding had charitable intent. Law enforcement, working with partners in cryptocurrency exchanges and financial services, rebutted this argument and proved his sustained support and funding of terrorists. Within regulated organizations, the first line of defense is responsible for identifying and reporting suspicious cryptocurrency activity. Working in partnership across all sectors is the most effective way of preventing financial crime. This applies to terrorist financing as well, which is notoriously difficult to identify by one agency alone. Key takeaways • Terrorists are adapting to technology and increasingly conducting transactions digitally, including through cryptocurrency. • Terrorists also use cyber-enabled tools to communicate. • Law enforcement employs tools and investigative techniques to identify terrorist funding through misuse of cryptocurrency. • Criminals often attempt to disguise terrorist funding as humanitarian activity. • The first line of defense (LOD) is responsible for identifying and reporting suspicious cryptocurrency activity. Detecting terrorist financing (Case example: Use of social media) The global terrorist threat has shifted from being organizational to more individual-centric, and the threat environment has gone from being more centralized to decentralized. There are differences between the financial requirements of terrorist groups and individual terrorists; however, they all require funding to sustain their operations. Social media can serve as a tool to facilitate and enable terrorist funding, recruitment, and propaganda. Terrorist groups, individual terrorists, and sympathizers are exploiting social media services to facilitate terrorist financing. Social media services are commonly used as communication channels by terrorists and their financiers to solicit funding. One advantage of using social media platforms is that the large volume of legitimate funding activity on these platforms can mask the comparatively small amount of illegitimate activity. According to the "Social Media & Terrorist Financing Report,” by the Asia/Pacific Group on Money Laundering (APG) and the Middle East & North Africa Financial Action Task Force (MENAFATF), multiple platforms have been exploited by organized networks to collect donations for extremist organizations. One case was detected through suspicious matter reports (SMRs) received by the Kuwait financial intelligence unit (FIU) from obliged reporting entities. Social media services, including Facebook, YouTube, Telegram, Twitter, and Instagram, were used to collect donations for extremist organizations. A privately owned website linked to a suspect was also used. Social media campaigns were created to solicit donations from the large number of followers on the sites. They provided bank account details and phone numbers for the people who collected the funds. Communication was undertaken via the various social media platforms and WhatsApp. Various methods of funding were used, including cash, ATM deposits, and various internal and external transfers through banks, exchange companies, bank websites, and standing orders of payment and checks. Although communication was facilitated by social media platforms, no online payment platforms such as PayPal were used. Some of the funds were used to purchase flights. The remaining funds were either transferred to other countries, where known terrorist organizations exist, or to countries adjacent to them. Monitoring and surveillance of social media platforms by law enforcement can greatly enhance the detection of social media abuse by terrorists. Encryption, the process of encoding information, is a challenge that hinders law enforcement’s ability to monitor and detect terrorist financing. Some examples of encrypted social media apps are WhatsApp, Telegram, Signal, and iMessage. Key takeaways • Social media can serve as a tool to facilitate and enable terrorist funding, recruitment, and propaganda. • Social media services are commonly used as communication channels by terrorists and their financiers to solicit funding. • Multiple social media platforms are exploited by organized networks. • Monitoring and surveillance of social media platforms by law enforcement can greatly enhance the detection of social media abuse by terrorists.