Terrorist financing: small money, clean money.

Why this is not money laundering in reverse

The two crimes are routinely taught together and detected by the same systems, which is convenient and misleading. They are different problems, and controls designed for one are structurally weak against the other.

Money laundering starts with dirty money and seeks to make it usable. The money is the proceeds of a crime that has already happened. The origin is the problem; the laundering is the solution the criminal is attempting.

Terrorist financing starts with money that may be entirely clean and seeks to deliver it to a purpose. The crime it supports has not happened yet. The origin is frequently lawful — salary, savings, a business, a genuine donation. What makes it an offence is where it is going and what it is for.

Four consequences follow, and each one breaks a standard control.

• Intent, not origin. Your due diligence establishes where money came from. That question can be answered perfectly and tell you nothing. A salaried professional sending savings abroad has a documented, legitimate source of wealth whichever purpose the money serves.
• Amounts are small. The FATF's 2025 comprehensive update on terrorist financing risks observes that financing associated with foreign terrorist fighters typically involves small sums, sent abroad or used for travel, and that this money often comes from legal means including personal savings. Smaller networks tend to draw on ordinary income. Thresholds set to catch laundering simply do not see it.
• Cash stays convenient. Precisely because the amounts handled are relatively small, the same FATF work notes that cash remains a practical option — which keeps a meaningful share of the activity outside the financial system entirely.
• There is no characteristic pattern. Laundering has recognisable shapes: structuring, layering, round-tripping, value that does not match the business. A modest transfer from a salaried person to a relative abroad has no shape at all. It is indistinguishable from the millions of identical remittances sent every day for the reasons they appear to be sent for.

What that means for an institution, stated honestly. You will rarely detect terrorist financing from the transaction alone, because the transaction is usually unremarkable. What makes it visible is context from outside the payment — a name on a list, intelligence from authorities, the destination, the counterparty, a pattern across accounts that no single account shows, or information shared through a public-private partnership.

This is not a counsel of despair, but it should change what you expect of your systems. An institution that believes its transaction monitoring will find terrorist financing the way it finds laundering has misunderstood the problem, and will mistake the absence of alerts for the absence of risk.

What the framework requires

The obligations come from two directions that are easy to confuse: the United Nations, through binding Security Council resolutions, and the FATF, through its Recommendations.

The United Nations layer. Two resolutions matter most and they work differently:

• Resolution 1267 (1999) and its successors created a list maintained by the Security Council — a sanctions committee designates named individuals and entities, and member states must freeze their assets. The list is centrally decided and applies to everyone.
• Resolution 1373 (2001) requires every state to criminalise terrorist financing and to freeze the funds of terrorists, but it designates nobody. Each state builds its own list. The result is a patchwork: a person may be designated in one country and not in another, and an institution operating across borders must know which regimes bind it, not merely which list its vendor supplies.

The FATF layer.

• Recommendation 5 requires terrorist financing to be a criminal offence in its own right — including financing an individual terrorist or a terrorist organisation for any purpose, not only for a specific attack. The offence does not depend on the money being linked to a particular act.
• Recommendation 6 requires targeted financial sanctions for terrorism: freezing without delay and without prior notice the funds of designated persons. The speed matters. A freezing obligation executed next week is not compliance; the entire point is that the funds are still there.
• Recommendation 8 concerns non-profit organisations, and is covered in the last lesson, because it is the one most often implemented badly.

Terrorist financing is assessed separately from laundering. Countries are examined on distinct effectiveness outcomes for terrorist financing investigation and prosecution, and for the implementation of targeted financial sanctions. An institution reading its own country's mutual evaluation should look at those outcomes specifically — a country can perform respectably on laundering and poorly here.

Assessing the risk. The FATF's guidance on terrorist financing risk assessment treats risk as a function of threat, vulnerability and consequence — and the third term deserves attention, because it is where terrorist financing departs sharply from laundering. The sums are trivial by laundering standards; the consequence is not measured in money at all. That asymmetry is the argument for treating a small, odd transaction with more seriousness than its value would otherwise justify.

How terrorism is actually funded

Funding is opportunistic and local. There is no single model, and the mix differs between a territorial organisation controlling land and a handful of people planning something in a city.

Self-funding from lawful income. The most common and the hardest to see. Salary, savings, benefits, student loans, the sale of a car, a small business. Nothing about the money is unusual because nothing about it is criminal. The FATF's recent work emphasises that smaller networks typically draw on ordinary income.

Criminal proceeds. Fraud, drug trafficking, smuggling, kidnapping for ransom, counterfeit goods, theft. Here the two crimes converge, and conventional laundering controls do have purchase — this is the portion of terrorist financing your existing systems are genuinely suited to.

Abuse of charitable and humanitarian giving. Covered in the next lesson, because the modern form is crowdfunding.

Territorial control. An organisation holding territory raises money much as a state does — taxing populations and trade, extracting natural resources, seizing assets. This finance is largely internal to the controlled area and often barely touches the international financial system until someone tries to move the proceeds out.

Trade, remittance and informal transfer. Value moved through trade mispricing, cash couriers, and informal value transfer systems that operate on trust and settlement rather than wires. These systems serve enormous legitimate populations, which is exactly what makes a small abusive flow hard to pick out.

Virtual assets. Real, growing, and frequently overstated. The transparency of a public blockchain cuts both ways, and the sums documented in prosecutions are often modest — the FATF's crowdfunding report cites a United States case involving roughly thirty-five thousand dollars moved through cryptocurrency and other electronic means to wallets and accounts believed to be funding a terrorist organisation. Treat virtual assets as one channel among several rather than the defining one.

What the money is spent on, which is rarely discussed and should be. Operational costs for an attack are often very low — transport, accommodation, a vehicle, basic equipment. Most of what an organisation spends goes on existing: salaries and support for members and their families, propaganda and recruitment, travel, training, and the movement of people.

That has a practical consequence. Looking only for the financing of attacks means looking for the smallest and rarest transactions in the whole picture. The sustaining finance — regular, modest, ordinary-looking payments to people and their dependants — is larger, more persistent, and more likely to pass through a regulated institution.

Crowdfunding and the modern raise

Fundraising moved online, and terrorist financing moved with it. The FATF's October 2023 report Crowdfunding for Terrorism Financing is the clearest statement of the problem, and it begins from a premise worth repeating: crowdfunding is an entirely legitimate way of soliciting funds, and the report's stated aim includes ensuring that legitimate crowdfunding activity is not restricted.

The report identifies four main ways crowdfunding is abused, and notes that in practice terrorists and violent extremists rely on multiple methods and combine techniques. Its own example: establish a campaign on a dedicated platform, share it on social media, and request payment in virtual assets.

• Abuse of humanitarian, charitable or non-profit causes. Crowdfunding depends on the goodwill of supporters, and humanitarian and charitable causes make effective covers for solicitation. An appeal for victims of a conflict is credible, emotionally compelling, and genuinely indistinguishable from the real appeals running beside it.
• Use of dedicated crowdfunding platforms or websites. Purpose-built platforms, with varying controls over who may raise money and what checks are applied.
• Use of social media platforms and messaging apps. The report notes that social media has been a key driver behind the growth of crowdfunding itself. Appeals spread through networks that already share the sympathies being appealed to, and move into private or encrypted channels where nothing is visible.
• Interaction of crowdfunding with virtual assets. Requesting donations in virtual assets, which crosses borders without an intermediary that can be asked questions.

Why detection is so hard. The report is direct that it is difficult to ascertain whether a donor's source of funds is legitimate, and that funds for illegitimate purposes are easily disguised within legitimate donations. Consider what that means operationally. A platform receives a thousand small donations. Nine hundred and ninety are exactly what they appear to be. The institution banking that platform sees one settlement.

The chain has many links and each sees a fragment. The donor's bank sees a small payment to a recognised platform. The platform sees a campaign with plausible documentation. The payment processor sees ordinary card traffic. The receiving institution sees a settlement from a known business. No participant holds enough to form a view, which is why the report stresses public-private information sharing and continuous outreach as priorities — better detection, better mutual understanding, and keeping legitimate fundraising unobstructed.

Do not treat it as a sector of its own. The report advises countries to implement the standards relevant to virtual assets, non-profits and money or value transfer services, and to avoid treating crowdfunding as a siloed sector. It sits across all of them, and controls built for only one will miss it.

What you can see, and the harm of over-correcting

What an institution realistically has. Not much from the transaction. What it does have:

• Sanctions screening, which is the single most direct control and the reason Recommendation 6 demands freezing without delay or prior notice.
• Destination and counterparty context — where the money goes, to whom, through which corridor, and whether that fits what you know of the customer.
• Patterns across accounts that no single account reveals: several unconnected customers funding the same beneficiary, the same platform, the same corridor, in similar small amounts.
• Information from outside — law enforcement requests, intelligence shared through public-private partnerships, and the typologies and risk indicators published by the FATF and national authorities.
• Your own people. Front-line staff noticing something that does not fit are a more plausible source of a terrorist financing lead than a threshold rule, and most institutions have no practical route for that observation to travel.

The disclosure trap. The institution that does the most sanctions screening and the most reporting is also the one most likely to be told nothing in return. Feedback is scarce by nature here, and an institution that measures its counter-terrorist-financing performance by what comes back will conclude it is achieving nothing. That is a measurement problem, not a performance one.

Non-profit organisations, and Recommendation 8. This is where responses go wrong most often and most damagingly.

Recommendation 8 was revised in 2023 to correct widespread misapplication. Two points matter. First, the requirement is targeted: countries must identify which non-profits are at risk by virtue of their activities and characteristics, and apply focused, proportionate measures to those — not to the whole sector. Second, and stated plainly by the FATF, the standard does not require countries to treat all non-profits as high risk, and measures must not disrupt or discourage legitimate charitable activity.

The harm is concrete, not theoretical. Institutions that respond by exiting charities wholesale push humanitarian funding out of regulated channels and into cash and informal transfer — less visible, less traceable, worse for everyone including the counter-terrorism objective. The organisations most affected are those working in exactly the places where humanitarian need is greatest, which are the same places that look worst on a country risk rating. The FATF's crowdfunding work makes the parallel point, calling for a multi-stakeholder approach that includes civil society, with human rights due diligence, so that legitimate fundraising is not hindered.

The honest position. Terrorist financing is the hardest thing you are asked to detect, because the money is often clean, the amounts are small, and the signal lives outside the payment. The defensible response is to screen properly and fast, use the context you have, build a route for human observation to reach someone who can act, share where the law allows — and refuse the easy answer of cutting off whole categories of customer, which buys the appearance of safety at a real cost to people who have done nothing.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.