Recent reports suggest that the Taliban is able to raise $400 million each year to finance its governance and terrorism activities.
The Taliban raises funds in a variety of ways such as through the taxation of the opium trade, through taxation and extortion, as well as control of mines and mineral extraction. The group also receives significant funds from foreign state sponsors including Iran, Russia, and Pakistan. Private citizens from Saudi Arabia, the UAE, and Qatar are also believed to provide the group with funds.
Analysis: Like any terrorist organization that is able to hold territory, the Taliban likely derives the vast majority of its funds from taxation, extortion, and protection activities. The group likely taxes any economic activity within its area of control, including drug production.
Russia has established an “improvised banking system” in South Ossetia that it uses to circumvent sanctions and support breakaway states within the former republics of Ukraine, Georgia, and Moldova.
South Ossetia has become a focus of illicit financing as Russia uses the region to contravene sanctions imposed by the US and EU against doing business with these breakaway regions. The regions transfer funds to South Ossetia, and then funds are sent to Moscow where goods are purchased and shipped to Eastern Ukraine from Russia.
Analysis: South Ossetia and Russia essentially operate a separate banking system using the International Settlements Bank, which handles transactions with separatist territories. This scheme may go international soon, as South Ossetia plans to open a “representative office” in Damascus, Syria.
The US Department of the Treasury has sanctioned two Hizballah financiers, Shibl Mhusin ‘Ubayd Al-Zaydi, and Adnan Hussein Kawtharani.
Al-Zaydi served as a financial facilitator between IRGC-QF and armed groups in Iraq. He has facilitated investments in Iraq on behalf of the IRGC-QF Commander Qasem Soleimani, and has coordinated the smuggling of oil from Iran.
Al Zaydi’s role has also involved providing protection for companies in Iraq financed by Hizballah, and facilitating movement of Hizballah funds into Iraq for investments. He has also facilitated the movement of funds to Lebanon to finance Hizballah, including bulk cash from Iraq into Lebanon.
Kawtharani facilitated business transactions for Hizballah inside Iraq and has been involved in securing a significant source of funding for Hizballah. As of 2016, Kawtharani worked to obtain a weapons contract in order to raise funds for Hizballah fighters.
Analysis: These two designations demonstrate the extent to which established terrorist organizations like Hizballah rely on specialized financial facilitators for their more advanced financing requirements, including the management and maintenance of investments. While most terrorist organizations do not reach this level of sophistication, when groups do obtain significant amounts of funds, investments to maintain and expand those funds are often required, which in turn necessitates specialized facilitators.
15 suspected Hizballah members are on trial in France, charged with money laundering Colombian narcotics money.
The individuals are believed to have trafficked cocaine for a Colombian drug cartel and used their proceeds to purchase weapons for Hizballah. The cell is believed to have used some of the funds to purchase luxury goods like watches and jewelry worth €10 million. These items were then re-sold in Lebanon or West Africa.
As part of the investigation, €250 million was seized along with weapons and a luxury vehicle.
Analysis: Drug trafficking is increasingly being used by terrorist organizations to raise funds. While some analysts have argued that terrorist groups have an ideological opposition to the drugs trade, in practice, most terrorist groups will use this method (and many others) to raise funds. The movement of value through luxury goods such as jewellery and high-end vehicles is also an effective means of moving value without using the formal financial sector.
The Islamic State in Somalia is assessed to be cash poor, according to a recent report from the Hiraal Institute.
The group raises money through donations (some of which may be voluntary), as well as taxation and extortion. The group focuses on larger businesses within its area of operations, avoiding taxing smaller businesses.
While the group may not raise significant amounts of funds, it also has a low ‘burn rate’ due to low expenses. The group primarily spends money on weapons (most of which are old or outdated), and salaries (which are also very low). Historically, the group is reported to have received financial support from Yemen (in 2015 and 2016).
This report is in contrast to a report from August 2018 that suggested that the group is raising $72,000 per month, likely well above its subsistence level. These two reports demonstrate how little is known about terrorist financing by the Islamic State in Somalia, and how variable the estimates can be.
Analysis: The Islamic State in Somalia is likely to be able to raise funds quickly due to its existing taxation base. In Somalia, raising funds is largely about territorial control. Without control of a lucrative economic area or significant donors (such as other terrorist groups or state patrons), terrorist and insurgent groups generally maintain a subsistence level of financing.
The DPRK’s Lazarus hacking group used malware to infect servers controlling ATMs, allowing the group to withdraw cash.
While the group is believed to act on behalf of the state, some reports suggest that the group is now primarily motivated by profit.
The group is believed to have been behind the Bangladesh central bank heist using the SWIFT network, the breach at Sony Pictures in 2014, and a string of hacks against banks.
Analysis: While the group may be motivated by profit, it also likely continues to work at the behest of the North Korean government. DPRK may be increasingly targeting banks and financial entities in order to finance its activities both at home and abroad, including through withdrawal of cash that can fund operations and provide much-needed currency to its operators.
The Islamic State in Afghanistan has financed some of its terrorist attacks and activities in Pakistan through kidnappings for ransom.
Three men were arrested in Karachi for financing the Islamic State in Afghanistan through kidnappings for ransom. The men conducted 5-6 kidnappings and sent the money to the Islamic State in Afghanistan through hundi and hawala networks, as well as through bank accounts used to transfer funds to Afghanistan. The Islamic State earmarked the funds to conduct terrorist attacks in Pakistan.
Analysis: Kidnappings for ransom are a lucrative source of funds for terrorist groups. Increasingly, terrorist organizations are conducting low-profile kidnappings of individuals in their area of control or influence in order to raise money. The terrorist organizations seek to avoid media coverage of their activities as this can reduce the likelihood of a ransom being paid and complicate negotiations.
The Islamic State continues to raise money by conducting kidnappings for ransom. A recent hostage negotiation will likely net the group $27 million.
The Islamic State kidnapped 30 Druze in late July. In order to secure their release, the Syrian government has agreed to release 60 Islamic State members and pay a $27 million ransom.
Analysis: The Islamic State has raised significant amounts of money by kidnapping and ransoming people within its area of control or influence. The group has also kidnapped foreigners and raised money through their ransom, but has also used foreigners for propaganda value in executions. The kidnapping of people in areas proximate to ongoing Islamic State control or influence will likely continue, as this lucrative source of funds provides the group with a significant financial lifeline.
The US Department of the Treasury has imposed sanctions against Singapore-based companies and their director for evading sanctions targeting North Korea.
Tan Wee Beng, the director and shareholder of a Singapore-based commodities trading company Wee Tiong Holdings is accused of hiding the origin of payments and structuring transactions in order to help acquire goods for North Korea in contravention of sanctions. Two vessels tied to a company for which Tan is the managing director were also sanctioned for being involved in economic activity with North Korea (likely the shipment of goods into North Korea).
The sanctions evasion scheme is believed to have involved millions of dollars worth of financial transactions including the financing of shipments of goods to North Korea. It also involved the use of front companies in Singapore, Thailand and Hong Kong. Daedong Credit Bank was used to launder money and make payments in support of this activity.
Analysis: The use of a complicit financial institution makes sanctions evasion and money laundering easier to accomplish and reduces the risk of being caught. The use of front companies also helps obfuscate the origin and destination of funds. Both of these methods are well-known DPRK sanctions-evasion techniques.
Recent analytic work conducted by GIABA and FATF has revealed trends and typologies of how terrorists in West Africa finance their activities.
Terrorists finance their activities through trade, non-governmental and charitable organizations, taxation, through criminal activities such as the smuggling of weapons, and drug trafficking. They move their funds through cash couriers, as well as other formal and informal channels (likely hawala, MSBs and banks).
Analysis: Terrorist groups operating in West Africa make use the the economic activity (either licit or illicit) in the jurisdictions in which they are operating to make money. They participate in that activity, or they tax it to raise funds for their purposes. As with most other terrorist organizations, they use the means at their disposal to move funds, primarily through cash couriers and informal value transfer networks.
The US Department of the Treasury‘s Office of Foreign Assets Control sanctioned Afaq Dubai for the money services business’ involvement in moving funds for ISIL.
The Iraq-based MSB moved money for the Islamic State as recently as 2018. The MSB is believed to be part of ISIL’s financial facilitation network that includes other MSBs, hawalas, and financial facilitators.
Afaq Dubai was used by ISIL to provide funds to families of ISIL fighters and to “launder” funds for the terrorist organization, and was run by two ISIL financiers.
In May 2018, a Jordan-based financial facilitator deposited $3 million into three MSBs, including Afaq Dubai.
Analysis: The use of Iraq-based money services businesses is a well-established funds movement technique for ISIL. The group has also used MSBs to obscure their movement of funds by having MSB operators use false names or not record or report the transactions. The most valuable MSBs for any terrorist group are those that are controlled by individuals aligned with the group, as this allows them to move and obscure funds on behalf of the terrorist organization with little effort.
The Islamic State is far from bankrupt. The group may have lost the majority of its territory, but it likely anticipated this eventuality and prepared financially. The group is reported to have stashed millions across the region through investments in companies in Iraq, the purchase of gold in Turkey, and the transfer of millions to its affiliates. Iraqi experts estimate that the group managed to transfer around $400 million from Iraq/Syria. The funds were moved primarily through the hawala network, with the hawaladars using WhatsApp to communicate with each other.
Some of these funds ended up in Turkey, and are being ‘laundered’ (or rather, obscured) through investments, potentially in front companies.
When the group is able to control or influence territory, they are believed to raise money through criminal activities including kidnapping for ransom, extortion, robbery, theft, drug smuggling, and trafficking in antiquities, and may turn to extorting construction companies reconstructing Mosul and other devastated cities.
Analysis: It comes as no surprise that the Islamic State managed to prepare for its eventual downfall financially – the group demonstrated excellent financial management (for a terrorist group), and certainly had the ability to plan long-term. Sending funds to Turkey, however, is likely just the tip of the iceberg. From Turkey, funds could have been sent to a variety of other jurisdictions in preparation for longer-term investment, for attacks, to sustain networks and leadership, or to finance other nascent terrorist groups.
According to recent reports, Angola has developed a “reputation as a refuge for international terror financiers,” specifically Hizballah.
Hatem Barakat and Kassim Tajideen are accused of using Angola as a terrorism financing hub. The two individuals were recently arrested in South America and Morocco. However, their companies continue to operate in Angola. The companies were designated by the US in 2010, but reports suggest that they continue to receive shipments from US-based companies in contravention of sanctions. Tajideen is believed to be an important financial contributor to Hizballah.
Analysis: The companies may be fronts for Hizballah activity, but are more likely used to generate profits through legal activity; some of the profits may be diverted to the terrorist organization. Diversion of funds from legitimate businesses is one of the main ways that terrorist groups, including Hizballah, generate funds for their activities.
Cyber actors are reported to have committed financial crimes on behalf of North Korea, raising money for the country’s ballistic missile and nuclear programs.
DPRK is believed to have generated $1.1 billion from this activity, and $100 million in 2014 alone. In February 2016, the country’s cyber actors executed a cyber attack on the SWIFT network, fraudulently transferring $101 million out of Bangladesh’s central bank. Most of the funds have not been recovered.
The cyber actors used malware to insert fraudulent SWIFT transactions into the network, and alter transaction history. Funds were transferred via multiple transactions to accounts at banks in several other countries.
The theft of funds from banks (through cyber attacks) is just one way that the regime raises funds for its proliferation activities. Other methods have included cryptocurrency, overseas information technology workers, cigarette smuggling, etc.
Analysis: North Korea has diversified its fundraising methods over the years in response to sanctions pressures; the country is likely to continue to exploit new and emerging technologies, as well as cyber attacks, to raise money for its proliferation activities.
Israeli security services have disrupted a Hamas financing scheme that used trade to move value into West Bank and Gaza Strip.
In the scheme, a senior Hamas figure used his financial exchange business to contract Gaza businessmen, persuading them to work with him in exchange for financial benefits. Textile merchants appear to have been used as a cover to move product into the Gaza strip that could be sold to Gaza residents for a profit. The funds from the sales were earmarked for Hamas activity such as paying salaries of Hamas operatives and their families, arms purchases, and funding of hostile terrorist activity.
Analysis: Trade-based movement of goods and value by terrorist organizations is a well-established methodology for moving and raising funds. This method of moving funds takes advantage of international trade networks but also allows the terrorist organization to move funds (value) without interacting with the formal financial system, making interdiction of their funds much less likely.