Chapter 5 · Terrorist Financing

Terrorist financing (TF) is providing or collecting funds, by any means, directly or indirectly, with the intention or knowledge that they will be used to carry out terrorist acts or by a terrorist organisation.

The critical framing:

• Focus is on the DESTINATION of funds (a terrorist person or act), not their origin
• The fund provider need not be a terrorist themselves
• Small amounts count — no de-minimis

The ML/TF asymmetry is why TF is harder to detect — traditional AML controls look for dirty money, but a $500 donation from a salary account looks perfectly clean until you know its destination.

The 9/11 attacks cost around $400-500,000 in total. The London 7/7 attacks cost under £8,000. The Paris 2015 attacks cost under €10,000.

Terrorist acts are cheap to execute. Small individual transfers, aggregated across a network, are the norm — which is why threshold-based monitoring alone fails. Behavioural monitoring + counterparty screening are essential.

The UK Terrorism Act 2000 (as amended) creates the core TF offences:

Max sentence for s.15-18 offences: 14 years imprisonment (parallel to POCA principal offences).

Signed 1999, in force 2002. Requires state parties to:

• Criminalise TF as a distinct offence
• Freeze funds used for terrorism
• Cooperate on investigation + extradition

Predates 9/11 — but became the template that FATF's post-9/11 Special Recommendations extended.

UNSC Resolution 1267 (1999) established a sanctions regime specifically targeting Al-Qaida / ISIL (Da'esh) and associated individuals + entities. Subsequently reinforced by 1373, 1988, 2253 and others.

Key features:

• Binding on all UN member states under Chapter VII
• Consolidated list of designated persons + entities
• Asset freezes, travel bans, arms embargoes
• Firms must screen against the list — inclusion triggers immediate freeze

Post-9/11 (October 2001), FATF issued 8 Special Recommendations on TF (SR I-VIII); a 9th was added in 2004 (cash couriers). These were consolidated into the current 40 Recommendations in 2012 — see [[Ch 1]].

Key historical Special Recs: criminalisation of TF, freezing of terrorist assets, reporting of suspicious transactions, NGO regulation, alternative remittance systems, wire transfer rules, cash couriers.

Terrorist organisations increasingly rely on legitimate funding — harder to detect and legally sourced:

• Donations — from sympathisers, front organisations, community networks
• Salaries + benefits — earned income diverted
• Charitable giving — some diverted to armed groups via NGOs
• Legitimate business income — enterprises owned by sympathisers
• State sponsorship — direct funding from state actors

NGOs and charities are FATF-designated high-risk for TF diversion. Key vulnerabilities:

• Operations in conflict zones
• Weak governance / financial controls
• Cash-based delivery of aid
• Difficulty verifying end-beneficiaries

UK Charity Commission monitors; FATF Recommendation 8 addresses NGO TF risk. Firms should apply EDD to NGO customers operating in FATF grey/black-list jurisdictions.

Hawala is a centuries-old remittance system rooted in South Asian, Middle Eastern and North African diaspora communities. Value moves between counterparties without funds physically crossing borders — settlements occur later via netting.

Regulatory status:

• Legal in most jurisdictions if registered as a Money Service Business (MSB)
• Illegal / unregistered operations widespread — the TF risk
• UK: registered with HMRC; UAE: licensed by Central Bank

Hawala has legitimate uses (cheap remittance to underserved regions) but is a documented TF channel because of its opacity.

• Small transfers, aggregated — under-radar amounts through multiple channels
• Prepaid cards — anonymous, cross-border, hard to trace
• Cryptocurrency — Bitcoin used by ISIS; privacy coins increasing (Monero); mixers/tumblers to obscure
• Crowdfunding — donations via legitimate platforms, sometimes with concealed end-recipient
• Trade-based TF (TBTF) — mispricing goods to shift value across borders
• Social media appeals — direct crypto wallet donations solicited online

What makes TF harder to detect than ML:

1. Small amounts (below typical monitoring thresholds)
2. Legitimate source (no dirty-money red flags)
3. Direct transfers (limited layering)
4. Legitimate-looking counterparties (charities, families)
5. Cross-border reach (multiple jurisdictions)

Behavioural analytics + counterparty sanctions screening + adverse-media checks are more effective than transaction-size thresholds.

Crypto TF documented since ~2015. High-profile cases:

• Ibn Ziyad Al-Tunisi (2015) — early ISIS Bitcoin fundraising
• Al-Sadaqa (2019) — Syria-based charity soliciting crypto donations for jihadist groups
• Hamas al-Qassam Brigades — solicited crypto post-October 2023; multiple wallets seized by US Treasury

FATF Rec 15 + Interpretive Note extends AML/CFT to Virtual Asset Service Providers (VASPs) — see [[Ch 7]] for Travel Rule etc.

Two overlapping but distinct enforcement tracks:

• TF criminalisation — TA 2000 offences, prosecuted in criminal courts
• Sanctions — OFAC / OFSI / EU designations; regulatory strict-liability for firms that transact with designated persons

A single transaction may trigger both — a wire to a designated person for terrorist purposes is both a TA 2000 offence AND a sanctions breach.

Certain states are designated state sponsors of terrorism — most restrictive by the US:

• Iran (since 1984)
• Cuba (re-listed 2021)
• North Korea (re-listed 2017)
• Syria (since 1979)

Sanctions consequences are severe — comprehensive US embargoes on Iran + Cuba + Syria + DPRK. Firms with any US touchpoint (USD clearing, US personnel, US goods) must screen against these regimes.

Same infrastructure as ML — SAR filed to UK NCA under TA 2000 s.19 (or POCA equivalent if unclear). But:

• TF SARs are prioritised — NCA has a dedicated counter-terrorism unit
• Threshold for reporting is "suspicion" — same as ML
• Failure to report has the same 5-year max sentence as POCA s.330
• Tipping-off equivalent (s.21D) applies to TF SARs