detecting terrorist financing · web viewdetecting terrorist financing (tf) activity is necessary...

DETECTING TERRORIST FINANCINGRELEVANT RISK INDICATORS

Detecting Terrorist Financing: Relevant Risks Indicators

The FATF developed the indicators in this report to help government agencies and selected private sector entities detect and disrupt the financial flows of terrorists and terrorist organisations. The FATF has decided not to distribute this report publicly, to preserve the usefulness of these indicators and other relevant information.

National competent authorities will be responsible for disseminating this report to relevant private sector entities in their country. Recipients of this report must maintain this information in confidence and not duplicate, share or otherwise further disseminate to third parties, without prior authorisation from their national competent authority.

FATFJune 2016

TABLE OF ACRONYMS.............................................................................................................................................................4

EXECUTIVE SUMMARY........................................................................................................................................................... 5

I. INTRODUCTION................................................................................................................................................................ 6

A. Purpose, scope and objectives.............................................................................................................................6

B. Methodology, participants and data utilised.................................................................................................6

C. Terminology................................................................................................................................................................ 7

D. Audience........................................................................................................................................................................7

E. Use of indicators........................................................................................................................................................8

II. RISK INDICATORS TO IDENTIFY TF ACTIVITY.........................................................................................10

A. Indicators relevant to customer behaviour................................................................................................10

Establishment of a business relationship....................................................................................................11

B. Indicators relevant to the economic profile of the customer..............................................................13

C. Indicators relevant to geographic risks........................................................................................................14

High-risk jurisdictions/regions........................................................................................................................14Cross-border factors.............................................................................................................................................15Kidnapping for Ransom.......................................................................................................................................17

D. Indicators relevant to spending activity......................................................................................................17

2016 – for restricted use only, not for publication 1


Travel-related spending activity......................................................................................................................18Non-travel related spending activity.............................................................................................................19Identifying Networks............................................................................................................................................19

E. Indicators relevant to products or services................................................................................................20

Money value transfer systems and remittance services.......................................................................20Hawala and other similar service providers..............................................................................................23Cash and automatic teller machines..............................................................................................................24Credit cards............................................................................................................................................................... 25Bank/personal loans.............................................................................................................................................26Currency exchange.................................................................................................................................................27New payment products and services.............................................................................................................28

F. Indicators relevant to non-profit organisations.......................................................................................31

Donations................................................................................................................................................................... 32Expenditures............................................................................................................................................................ 33Transactions............................................................................................................................................................. 33NPO executives and other staff........................................................................................................................34

G. Indicators relevant to trade and commercial entities............................................................................35

Illicit trade of antiquities/cultural heritage................................................................................................37Oil and gas industry...............................................................................................................................................38

III. SHARING CONTEXTUAL INFORMATION TO IMPROVE RISK INDICATORS.................................40

A. Feedback to reporting entities.........................................................................................................................40

B. Types of information shared.............................................................................................................................41

C. Mechanisms to engage with the private sector.........................................................................................44

IV. CONCLUSIONS..........................................................................................................................................................46

BIBLIOGRAPHY AND REFERENCES................................................................................................................................47

2 for restricted use only, not for publication - 2016


TABLE OF ACRONYMS

AML/CFT Anti-money laundering / countering the financing of terrorism

ATM Automated Teller Machine

CDD Customer due diligence

CIFG Counter ISIL Finance Group

FATF Financial Action Task Force

FIU Financial intelligence unit

FTF Foreign terrorist fighter

FTZ Free trade zones

HOSSPs Hawala and other similar service providers in money laundering and terrorist financing

ISIL Islamic State in Iraq and the Levant

KFR Kidnapping for ransom

ML Money laundering

MSB Money service business

MVTS Money value transfer systems

NPO Non-Profit Organisation

STR Suspicious transaction reports

TF Terrorist financing

TFS Targeted financial sanctions

TBML Trade-based money laundering



EXECUTIVE SUMMARY

Detecting terrorist financing (TF) activity is necessary in order to identify networks and suspects after an attack has occurred, but is also critical in preventing the tragic events from occurring at the outset. Since 2001, the FATF has been at the forefront in assisting the private sector to better identify and understand the nature and scope of TF activity. This work has justifiably increased over the past two years given the enhanced TF threats we are now facing globally. The two reports published in 2015 on the Financing of the Terrorist Organisation Islamic State in Iraq and the Levant (ISIL) and Emerging Terrorist Financing Risks have helped to enhance the global community’s understanding of TF risk. However, given the dynamic and constantly evolving nature of the risks and the challenges in detecting TF, it is important that FATF provide detailed information to aid in detecting this activity.

This report is the product of extensive input from both the public and private sectors and is designed to be a practical tool for both sectors to identify, and ultimately prevent, terrorist financing and terrorist activity from occurring. Section I recognizes the different roles and responsibilities of these sectors and Section III demonstrates the mutual benefits for both parties when strong partnerships are formed. Furthermore, this report serves as a tool for competent authorities (particularly law enforcement) to engage with the private sector institutions in their jurisdictions. Competent authorities are therefore asked to create an effective way of sharing this information with the private sector without adversely affecting ongoing investigations and intelligence efforts on which the indicators are based.

A risk indicator demonstrates or suggests the likelihood of the occurrence of suspicious activity. The report sets out how both the public and private sectors should use the indicators effectively as they are neither exhaustive nor applicable in every situation. The indicators are often just one of many elements contributing to a bigger overall picture of potential terrorist or TF risk and it is important that the indicators (or any single indicator) are not viewed in isolation. They need to be contextualised with information obtained from engaging with relevant authorities. Each country should therefore provide its private sector with the indicators and information most relevant for that country (and do so using existing tools and methods to share information securely). Competent authorities should also avoid using this document as a checklist when supervising private sector institutions as not all indicators are applicable to all countries or all institutions.

Terrorist financing, because of its nature, is extremely hard to detect. Not just because it often involves smaller sums of money than money laundering activity, but because it involves transactions that are often indistinguishable from legitimate day-to-day activities. It is therefore impossible to create a flawless list of indicators or ‘silver bullet’ to detect terrorist financing. Therefore, despite the detailed and specific information contained within this report, major knowledge gaps will continue to exist. These gaps can be overcome by enhancing information sharing as described in Section III, particularly sharing contextual information to improve the risk indicators.

The consultation process for this report has deepened our understanding of how private sector institutions use indicators and other mechanisms to identify terrorist-related activity. This report is intended to serve as a further catalyst for countries to improve their communication and interactions with the private sectors. This ongoing interaction will serve to improve the detection of TF and will also enrich FATF’s future efforts to combat terrorist financing.


http://www.fatf-gafi.org/publications/methodsandtrends/documents/emerging-terrorist-financing-risks.html

http://www.fatf-gafi.org/publications/methodsandtrends/documents/financing-of-terrorist-organisation-isil.html



I. INTRODUCTION

A. PURPOSE, SCOPE AND OBJECTIVES

The Emerging Terrorist Financing Risks report (FATF, 2015b) notes the importance of genuine private/public partnerships to enhance awareness of, and responses to, emerging terrorist financing (TF) risks. Providing accurate and forward-looking guidance to the private sector improves their monitoring and screening processes and reporting-time on sensitive transactions which may relate to TF. This close collaboration helps to identify and communicate TF risk among all relevant parties.

This report is an extension of the Emerging Terrorist Financing Risks report, and aims to develop risks indicators to assist private and public sectors identify and mitigate TF risks. The goal is to make this type of information available to the private sector though the relevant competent authority. The report includes a section on enhancing engagement with the private sector to support more regular and specific outreach and the dissemination of guidance on risk indicators.

B. METHODOLOGY, PARTICIPANTS AND DATA UTILISED

This report has been prepared under the co-lead of France and the United States and incorporates input from a wide variety of other delegations within FATF’s global network. Both country delegations and private sector entities have submitted over 30 sets of indicators on terrorist financing which have contributed to Section II of this report. Some of the information provided was based on strategic analysis of data available to Financial Intelligence Units. In most cases, the information was provided with the intent that it NOT be made publicly available, and as such, this report is confidential and not for further distribution . Many of the indicators received were specific to particular jurisdictions or geographic area. However, this report provides more general indicators which could be tailored to individual circumstances.

This report is also built on experience and knowledge provided by delegations’ participation in several typology workshops held within FATF’s global network and from discussion at the FATF meeting with the private sector on terrorist financing in February 2016. The aim of that meeting was to talk about good public-private partnership practices to identify risk indicators and share information to detect terrorists or TF. The feedback received during the private sector meeting has been incorporated into this paper. The FATF also held a joint session with the Counter ISIL Finance Group (CIFG) to further mutually reinforcing work to combat the financing of ISIL and to protect the international financial system from abuse by the terrorist organisation. Experts from the CIFG also contributed to this paper, specifically providing indicators related to ISIL Financing (e.g., Section II (G) on indicators related to the oil and gas industry).

In addition, FATF distributed a questionnaire globally on how competent authorities share information on TF risks with the private sector was distributed , and received over 40 responses. Three key issues emerged which related to (1) feedback to reporting entities, (2) types of information shared and (3) mechanisms to engage with the private sector. Section III of this report addresses these issues.





C. TERMINOLOGY

There is wide experience internationally of producing risk indicators or indices for money laundering or illicit financial flows. FATF has sought to develop “red-flag” indicators in a number of their reports to help both the financial and government sectors identify instances of money laundering (ML) or TF activity. However, identifying specific terrorist financing indicators presents a different (and more difficult) challenge, for several reasons. The concept of risk is both broad and complex. This report will not use the term “red-flag” and will limit itself to the use of one general term, risk indicator, which can be used to help identify instances of terrorist or TF activity. A risk indicator demonstrates or suggests the likelihood of the occurrence of suspicious activity. While a number of the factors identified may not appear to have any direct connection with terrorism or terrorist financing, they are nonetheless relevant when trying to identify this type of activity. One indicator, or a group of indicators, can provide a lead which requires more analysis. The indicators identified are just one aspect of a larger overall picture of potential terrorist or TF risk.

In 2002, the FATF published Guidance for Financial Institutions in Detecting Terrorist Financing. That guidance did not distinguish TF indicators from ML indicators. As referenced above, many relevant risk indicators cannot be directly connected to TF or ML activity. Recent efforts have better identified and understood more specific or unique TF methods and techniques. The recent FATF research has sought to explain particular transactions or behaviours exclusively or more probably associated with TF techniques or activity. Terrorist financing often involves smaller amounts of money, generated locally, when compared to the laundering of criminally-derived funds. These differences make funds intended for terrorism more difficult to detect than high-value money laundering activity.

D. AUDIENCE

The indicators in this report are equally relevant to both the public and private sectors. Not all the indicators will be seen by the private sector without additional contextual information from competent authorities (see Section III). Within the private sector, these indicators are intended to be used by personnel responsible for compliance, transaction monitoring, investigative analysis and other FIU-type operations within financial institutions and Money Services Businesses (MSBs). The indicators are most relevant to the banking industry but could apply to money remitters and exchange houses. Most of the indicators, particularly those related to behaviour, apply to retail banking but there are some indicators that are more relevant to corporate banking e.g., Section II.G. The indicators are meant to apply to a diverse range of customers, from individuals with modest means to high net-worth individuals, and broadly cover several aspects of a customer’s relationship. The indicators are also applicable to small and mid-size businesses and large conglomerates.

The indicators are also relevant to competent authorities, particularly financial intelligence units, law enforcement or security services, which are responsible for conducting operational and strategic analysis on TF trends. The indicators can also help authorities detect TF behaviour from their perspective. This report will be available to competent authorities with the intention that they share it it, or the information contained within, with private sector entities (See Section III on Sharing Contextual Information to Improve Risk Indicators). Competent authorities may also use the information in this report to craft their own advisories to relevant reporting entities. However, this


http://www.fatf-gafi.org/publications/fatfrecommendations/documents/guidanceforfinancialinstitutionsindetectingterroristfinancing.html


report is NOT intended to be used as a regulatory tool for compliance and examination purposes. Doing so could inadvertently lead to a rules-based approach in determining risk. The FATF will monitor the dissemination and use of this report to ensure its maximum utility.

E. USE OF INDICATORS

The indicators identified are comprehensive, including specific activities and situations, yet general enough to allow for an adapted application. The categories are generic and meant to raise attention so that further research and analysis can be carried out to ascertain whether there is sufficient suspicion for TF activities behind certain transactions, behaviours and activities. This report is not intended to be used as a basis to engage in wholesale or indiscriminate de-risking practices or any other activities that could result in significant unintended consequences outside the aim of preventing terrorist financing.

The indicators provided are derived from a sampling of the data received and is by no means a conclusive list. A single indicator may not alone warrant suspicion of terrorist financing or provide a clear indication of such activity. Furthermore the presence of a single indicator may not necessarily rise to the level of suspicion, but could prompt further monitoring and examination, as appropriate. Similarly, the existence of several indicators in relation to a customer or transaction could also warrant examination. The observation of one or more of the indicator(s) is dependent on the business lines, products or services that an institution offers and how it interacts with its customers, and on the institution’s human and technological resources.

A number of the indicators in this draft are overly broad and require further monitoring, examination or contextual information about the customer or transaction in order to draw any suspicions. Many of the indicators describe normal day-to-day activities. This report emphasises that the private sector will need contextual information from law enforcement authorities and financial intelligence units in order to make the best use of the indicators provided. Given that TF risks are always evolving, the indicators themselves are dynamic. In using these indicators, entities should take into consideration the totality of the customer profile, including information obtained from the customer due diligence (CDD) process as well as other relevant contextual risk factors. Reporting entities may not always be able to draw a link between suspicious customer activity and terrorism-related activities. However, any suspicious matter reported to financial intelligence units may provide a small but critical piece of a larger puzzle and can be crucial to the success of investigations into TF and associated terrorism activities conducted by competent authorities.

The indicators are meant to support suspicious activity monitoring and reporting systems and inform intelligence analyses using a risk-based approach. Monitoring systems typically include employee identification or referrals, transaction-based (manual) systems, surveillance (automated) systems or any combination of these. Some of the indicators in this report may be observable during general transactional screening while others may only present themselves when conducting in-depth analysis or case reviews.

For example, some banks have used proactive data mining to identify foreign terrorist fighters (FTFs) and associated networks by observing their customers’ payment activity and account usage (to include debit/credit card usage). This includes examining customer data of suspects such as address and payment data. This is often informed by alerts issued by FIUs outlining indicators. This



proactive approach often assists in developing focus for further investigation or enhanced monitoring. The private sector also provided an example of a chart indicating the stage of the customer monitoring process where these indicators might be seen. The example demonstrates that some indicators may be identified during the initial CDD or automated surveillance processes but many of them will require specialized tools, further investigations or information from law enforcement in order to be identified.

The greater number of indicators provided may result in difficulties in managing this information, particularly for smaller institutions. Some institutions may choose to integrate indicators into their automated systems (e.g., using filtering criteria or rules) which could reduce the discretion of personnel but may increase the capacity of detecting anomalies. System filtering criteria, including specific profiles and rules, should be based on what is reasonable and expected for each type of account. However, some indicators, such as those related with spending activities, cannot be automated which could make monitoring them more difficult. Those indicators which can be detected on an automated basis may require entities to enhance the capacity of their IT or management information systems (e.g., geolocation of internet connections and withdrawals on the border area, nature of spending activity).



II. RISK INDICATORS TO IDENTIFY TF ACTIVITY

The FATF Standards provide a framework to help both public and private sectors identify TF activities. The standards were revised in 2012 to strengthen the requirements for higher risk situations, and allow these sectors to take a more focused approach in areas where high risk remain, in particular in the context of terrorist financing. Accurately assessing TF risks requires a multifaceted analysis of customers, their activities, and the known risks associated with a product, country or transaction type.

Customer, product and geographic risks are three general categories considered when performing CDD, and may exhibit specific higher risk indicators which require enhanced measures. Given the unique nature of terrorist financing, this report has created specific TF risk categories based on:

A. customer behaviour

B. economic profile

C. geographic risk

D. spending activity

E. products/services,

F. Non-Profit Organisations (NPOs) and

G. trade and commercial entities.

This is a flexible categorisation and, in many cases, the indicators can exist in multiple categories.

A. INDICATORS RELEVANT TO CUSTOMER BEHAVIOUR

Knowledge of a customer plays a vital role in understanding the customer’s financial behaviour in relation to their non-financial activities and the overall customer relationship. In developing indicators, the private sector should consider information from a number of sources, including, but not limited to analysis of internal transaction data, review of Internet Protocol (IP) data, analysis of suspicious data specifically related to potential TF events, as well as information provided by law enforcement agencies. Institutions often conduct transaction monitoring, name screening and enhanced CDD for customers with financial or subjective connections to high-risk individuals/groups, entities (e.g., industries, NPOs) or jurisdictions.

FATF has always been explicit that terrorism and those who support terrorism can never be associated with any religion, nationality, civilisation or ethnic group. However, where terrorists, terrorist groups or those who support terrorism claim to be associated with particular backgrounds, such behaviour can be taken into account for purposes of risk-based due diligence. This behaviour includes adherence to radical, extremist or violent notions supposedly stemming from religion, nationalism or ethnicity. In this regard, efforts should be made to understand what may constitute radicalied or extremist behaviour that poses a potential terror risk compared with behaviour that is within the more typical range of practices and beliefs within the country or region.



Establishment of a business relationship

When establishing a business relationship with a customer, the potential customer’s name should be screened against designated individuals and entities listed on targeted financial sanctions (TFS) lists developed in accordance with applicable domestic or international law and procedures.1 Reporting entities and competent authorities should also check individuals or entities that have been designated by other countries. The United Nations has recently consolidated all of its sanctions lists (including TF sanctions) into one UN sanctions list for ease of compliance.2 The Consolidated Sanctions List includes all individuals and entities subject to sanctions measures imposed by the Security Council. While designated persons should clearly not be dealt with, individuals linked to designees should also be considered for enhanced due diligence, including representatives, beneficial owners, cohabitants, close relatives or other individuals known to be linked to a designated person. This includes monitoring transactions requested by an individual known to be close to a designated individual. Information to keep in mind when screening against TFS lists include the following:

Names, aliases, dates of birth and other personal identifiers of individuals involved in terrorism on domestic or international TFS lists can be linked with existing customers, beneficiaries and business entities on file.

When provided, addresses of individuals involved in terrorism on domestic or international TFS lists can often be linked with existing customers, beneficiaries and business entities on file.

Money or other property associated to individuals involved in terrorism on domestic or international TFS lists can be linked with other entities or customers.

Monitoring of open-source foreign and domestic media can assist the detection of new high-risk customers. External research tools also assist in developing a reasonable understanding of individuals associated with a transaction. Entities should take account of negative press or adverse media related to criminality associated with terrorist financing, illicit finance or other negative news about the high-risk customers, its principals, business operations, personal or industry relationships. Information held on social media sites frequented by terrorist organisations or radicalised individuals are likely to be beneficial when evaluating potential suspicious activity and identifying indicators of terrorist financing.

In most circumstances, it is difficult to identify TF-related activity without additional information from competent authorities. Information from competent authorities will often include typologies or case studies. Although competent authorities are often unable to exchange contextual information with financial institutions on those individuals associated with a TF investigation until after its conclusion, in some instances, authorities will share information to prevent terrorist activity (also see Section III). Issues to consider include:

Individuals previously charged with terrorism or terrorism-related crimes.

1 See International Best Practices on Targeted Financial Sanctions for Terrorist Financing (FATF, 2013a).2 Consolidated United Nations Security Council Sanctions List (UNSC, nd)


https://www.un.org/sc/suborg/en/sanctions/un-sc-consolidated-list

http://www.fatf-gafi.org/publications/fatfrecommendations/documents/bpp-finsanctions-tf-r6.html


Individuals known or suspected (e.g., under investigation) to be involved in terrorist activity or as foreign terrorist fighters.

Social media posts which support or promote radicalisation or violent extremism.

Known or suspected mobile number(s) utilised by terrorists or suspects.

Any details of underground supporters, sympathisers or facilitators.

Below is a sample of additional risk indicators relevant to customer behaviour at the establishment of a business relationship, that could be taken into consideration as relevant risk indicators for TF:

Resistance to cultural norms of the country where the customer is conducting the transaction such as conspicuous efforts made by the customer to avoid personal contact with any bank employee (e.g., refusal to interact with female employees).

Behaviour indicating adherence to radical or extremist notions or exhibiting violent tendencies (e.g., social media profiles which exhibit multiple posts of news articles related to or sympathizing with terrorist organisations).

Presentation of conspicuously counterfeit or new identity documents (e.g., counterfeit stamp or photo, photo stuck over the stamp, issue date does not match the condition of the document in respect of wear and tear).

New customers who ask excessive questions of bank employees in relation to disclosures, reporting requirements, thresholds or record-keeping requirements.

New customers who are reluctant to provide information.

Customers who may be conducting transactions or acting on behalf of another individual.

Account is opened on behalf of a legal person with the same address as another natural person who has not been associated with the account.

Account which is jointly held or used by a high number of individuals who are not related in either professional or personal terms or not relevant to the account owner.

Natural person opening several accounts (e.g., bank accounts, prepaid cards, e-wallets, etc.), for the purpose of receiving and/or sending small denomination transfers.

Natural person opening an account only for the purpose of receiving one or more transfers and withdrawing or transferring money to other individuals.

Establishing non-permanent residency and/or changing addresses frequently and/or not being apparently related to the declared occupancy.



Recurrent use of the same addresses, phone numbers and references (e.g., employment) in several seemingly unrelated accounts opened in different names.

Opening accounts in regions outside where the customer works or lives and without a reasonable purpose.

B. INDICATORS RELEVANT TO THE ECONOMIC PROFILE OF THE CUSTOMER

Customer due diligence starts prior to the establishment of a business relationship, and continues by monitoring any change in the customer behaviour and economic profile (including change in source of funds and expenses). Behavioural indicators of TF can also be verified in the course of the business relationship. Accordingly, indicators detected through ongoing monitoring should extend to those that may be verified after the establishment of the business relationship. Knowledge of a customer, including the customer’s established financial transaction history, can be important in forming a suspicion of terrorist financing. Indicators of transactions not being in line with the customer's usual activities can include:

Person performs several transactions in a single office or at multiple branches with the obvious intention to use different cashiers/tellers.

Customer uses marked-up financial instruments (e.g., cheques) with informal notes, initials or symbols, such as token number to act as a means of identification.

Unexplained termination of the business relationship or ontract (e.g., interest-bearing accounts).

Unexpected deposits, transfers or payments which relate to the sale of personal assets, retirement accounts and personal properties.

Customer’s account shows signs of unexplained increase in deposits and money flows.

Individual accounts receiving multiple large-value transfers from unrelated individuals or unknown sources (e.g., stated purpose is “sustenance”).

Several natural persons who are not relatives of the account holder are authorised individuals on the account.

Customers who are reluctant or refuse to present identification information or update their respective data.

Customers who submit different identification documents every time they are requested by the financial institution.

Customers who, in the course of their business, use aliases, nicknames or other alternative or simplified expressions instead of their own (full) name. This might include transposition of the order of the names.



Customers whose address or contact details (telephone, fax, e-mail address or other) change often, are incorrect or continuously non-operational, especially when the contact attempts by the financial institution occur shortly after the establishment of a business relationship.

Transfers ordered by different individuals or entities who share one or more personal details (e.g., surname, address, employer, telephone number, etc.) on the same day or close dates.

The frequency or volume of the transaction is inconsistent with the customer’s occupation, income, age, etc.

Large sudden withdrawal (often in cash) of benefit payments which are accrued over a period of months.

Case study: Changes in the economic profile of a customer

An individual requested the financial institution to terminate his interest-bearing accounts, without giving explanation. The full content of deposit accounts was withdrawn in cash.

The teller reported that this individual refused to interact with any female employee of the bank and seemed to have changed his clothing and physical appearance, which might indicate some adherence to radical notions. A long period of silence was then observed on this account.

Source: France

C. INDICATORS RELEVANT TO GEOGRAPHIC RISKS

Geographic risks associated with source, destination and transit countries should always be taken into consideration when assessing TF risks. This includes risks associated with the originator of a transaction and beneficiary of funds that may be linked to a high-risk jurisdiction or region. Geographic risk may also be applicable to an individual’s nationality, residence or place of business. This report does not seek to identify a list of jurisdictions as high-risk for terrorism financing. Competent authorities may determine their own list of high-risk countries and regions (including domestic areas within their own jurisdiction) based on these factors.

High-risk jurisdictions/regions

The terms “high-risk jurisdiction/region” are not easily defined or explained because they can apply to a number of situations and include risks associated with various types of crime (e.g., drug trafficking, money laundering, corruption), or other risks related to the political or economic situation. From a terrorist financing perspective, these terms can include those jurisdictions/regions in which terrorist activities occur (including, but not limited to attacks and planning attacks) or in which terrorist organisations reside, recruit or draw logistical support for the perpetration of terrorist acts. Below are some additional examples which could signify a high-risk jurisdiction/region.



A conflict zone. This is a synonymous term for those high-risk jurisdictions/regions that are unstable, at war, where armed hostility is present or where terrorist organisations are active.

Provinces/regions with known links to terrorist organisations or share border with territories controlled by terrorist organisations.

Countries where funds and other assets are generated (e.g., originator of the funds transfer) for terrorism acts or terrorist organisations irrespective of where those acts take place or organisations reside.

Jurisdictions/regions which are transit points or have had money flows to/from known foreign-terrorist fighters (FTFs) (see case study below).

Jurisdictions with strategic AML/CFT deficiencies, weak institutional frameworks, those that are non-compliant with the FATF Standards (including those publicly identified by the FATF) or are generally non-cooperative on CFT matters.

Case study: Use of Funds transfers near territories where ISIL operates

According to sensitive financial information, terrorist financing risks were discovered regarding the use of both Electronic Funds Transfers (EFTs) via banking channels and other transfers via Money Value Transfer Systems (MVTS) to areas located near territories where ISIL operates or designated individuals. The location of the receipt of these transfers were often located in areas known to be a funding, logistical and smuggling hub for foreign terrorist fighters and terrorist organisations. In some of these cases, social media have suggested that beneficiaries of funds transfers may have links to terrorist or radical groups. In other cases, excessive cash deposits were made in the US with subsequent wire transfers to beneficiaries in areas located near territories where ISIL operates. Risks identified also included lack of information of the purpose of the wires, the relationship of the receivers or the reason funds transfers were conducted in multiple transactions over short time periods.

Source: United States

Cross-border factors

Within this category are transactions and activities associated with travel, especially as it relates to FTFs. Much work has already been done in this area, in particular by the Egmont Group of Financial Intelligence Units, which has worked on specific FTF profiles. The Egmont Group has developed a non-public bulletin on FTFs which is available to relevant competent authorities to issue to their private sector. This report does not seek to duplicate Egmont’s extensive work. However, Section II.D of this report includes a number of factors relevant to FTFs.

In addition, geographic risk can include the use of money transfer services provided by a financial institution, in parallel with ordinary payments as well as family-owned businesses that provide wire transfer services through informal networks. This report seeks to explore some of the relevant risk indicators associated with money value transfers services (MVTS) (also see the report on The role of Hawala and other similar service providers in money laundering and terrorist financing (FATF,


http://www.fatf-gafi.org/publications/methodsandtrends/documents/role-hawalas-in-ml-tf.html



2013b).) Other indicators related to geographic risk are located in the categories associated with spending activity and products and services. Below is a sample of indicators relevant to geographic risk:

Multiple individuals sending funds to the same beneficiary in a high-risk jurisdiction.

Same customer sending funds to multiple beneficiaries in a high-risk jurisdiction.

Low value cross-border transfers sent/received with high frequency to/from unconnected or unrelated individuals.

Sending/receiving funds to/from the same counterparties by individuals who appear to act separately. (i.e., also referred to as a “consumer network” which represents a number of individuals connected by common counterparties.)

A payment from abroad, with the transaction description stated as donation, aid, loan, etc. and its immediate withdrawal in cash, or immediate transfer to a different account.

Excessive funds paid to a student account based in a foreign country by a family member or non-related organisation.

Customers with a residence in, or connection to, a high-risk jurisdiction.

Customers accessing their Internet (i.e., online) banking facilities from an IP address within a conflict zone or address not associated with CDD records.

Customer shows significant overseas spending in a recently opened account.

Longer stays abroad (more than 6 weeks) by unemployed individuals who continue to receive wage replacement benefits from the Government.

Indications that the customer has travelled (or regularly travels) to areas in or surrounding the conflict zone with cash on their person.



Case study: Example of European network with facilitators

Four individuals carried out 28 funds remittances through seven different entities located in Germany and France. These transactions had 17 different beneficiaries who withdrew the funds in 16 distinct business entities, located in Egypt, Germany, Greece, Morocco, Portugal and Tunisia.

According to the analysis, the transactions linked to this group occurred between 2006 and 2013, the majority of which were in 2008. The beneficiary in Portugal withdrew the funds in January 2009, in three different entities located in Oporto. He did not have any income or property in Portugal. According to the intelligence collected through international cooperation, in 2014, the beneficiary in Portugal allegedly travelled to Syria, via Turkey, and is suspected of joining ISIL. He was later arrested when returning to Europe.

Source: Portugal

Kidnapping for Ransom

Kidnapping for ransom (KFR) is a source of revenue for terrorist groups, including ISIL.3 Terrorist organisations use networks of facilitators to move the proceeds of KFR through the global financial system, including alternative remittance systems, banks exchange houses and other financial institutions.4 Cash often plays a significant role in KFR. Banks are unlikely to be able to determine if a payment was derived from a ransom payment absent specific information. Some indicators recently identified include:

Relatives (on behalf of the victim) acquiring money through the sale of assets and loans.

Setting up a trust (or other legal arrangement) to collect/store donations of ransom payments.

Setting up a crowdfunding site to accept donations on behalf of a victim.

Large bulk cash shipments sent through MVTS (including remitters and hawalas) to third party jurisdictions different from the one where kidnapping happened.

International funds transfers on behalf of religious groups or entities. Individuals (e.g., treasurers) who control bank accounts in the name of religious organisations have, when questioned by the bank, indicated the true purpose of transactions were in fact for ransom payments.

Withdrawal of bulk cash from account disguised for use as aid payments.

Funds received from an insurer dealing in Kidnap & Ransom (K&R) Insurance products.

Cooperation with firms or insurance companies dealing in hostage negotiations.

3 Financing of the Terrorist Organisation Islamic State in Iraq and the Levant (ISIL) (FATF, 2015a).4 Organised Maritime Piracy and Related Kidnapping for Ransom (FATF, 2011).


http://www.fatf-gafi.org/publications/methodsandtrends/documents/organisedmaritimepiracyandrelatedkidnappingforransom.html



D. INDICATORS RELEVANT TO SPENDING ACTIVITY

Spending activity could be detected in many different ways, taking into account the information provided by the customer, the purpose of the credit transfers and the business sector of the counterparties. As noted in the section on geographic risk, a number of spending indicators relate specifically to FTFs. These individuals will make a number of financial and logistical arrangements prior to their travel and while en route to the conflict zone. One indicator involves the purchase of an “e-visa” outside of the traveler’s resident country or an inconsistency with the first declared destination of the traveller. In order to avoid detection, FTFs often stagger their journeys to conflict regions by traveling via intermediate destinations. In order to legitimise these intermediate journeys, FTFs will obtain visas for their intermediate destinations. Examining the source of funds and the age of the traveller (e.g., teenager) can also help determine if purchases would be considered abnormal in relation to most holiday type planning expenditures.

Applying these indicators may present a number of challenges for the private sector. For example, institutions may receive insufficient information about the product, service or even type of business which processed a credit/debit transaction. Furthermore many of the indicators in this section are benign in nature and not immediately indicative of terrorist financing. The indicators may be particularly relevant in identifying a change in the usual transactional activity of an individual preparing to travel to a conflict zone to become a foreign fighter (see case study below), showing a disproportion between income and expenses. This section will address travel-related scenarios, individual/groups spending for non-travel purposes and identifying networks.

Travel-related spending activity

Payments to outdoor stores (where they may purchase boots, sleeping bags, clothes, thermal underwear, tents and equipment).

Payments indicating appointments at medical clinics before travel.

Purchase of an airline ticket, bus ticket, car hire, carpooling booking.

Booking one-way flights abroad by credit card (often for parties with no identifiable direct connection).

Purchase of numerous airline or bus tickets, after receiving several cash or wire transfers.

Payment for visas, in particular Internet banking payments for e-visas to conflict regions.

Travelers who ask questions regarding confirmation that nominated beneficiaries of life insurance policies will receive payment in the event of circumstances that suggest involvement in terrorism, rather than being a victim of terrorism. (These cases involve potential FTFs who do not declare their travel to conflict zones prior to departing.)

Young individuals purchasing funeral or life insurance policies or cashing out a policy to fund airline tickets.



Buying cars for the purpose of exporting them to countries bordering the conflict zones.

Purchasing pre-paid phones or SIM cards.

Case study: Transactional activities of a FTF preparing to travel to a conflict zone

An individual, with no regular income, records numerous payments of small amounts for trips (by train, public transportation) taken within France. This activity tends to indicate the existence of radicalized individuals which could be potential FTFs.

The bank accounts held by the individuals described above are also marked by an increase in telephone expenses in the months prior to their departure. At least one purchase (for a few hundred euros) of “sporting goods” is registered on the individual account. The purchase of “sporting goods” is done online or at sporting goods stores, or at stores specialising in the sale of goods for extreme climates. Such purchases can contribute to collecting basic military gear (e.g., sleeping bag, hiking boots, parkas, etc.).

Finally, the accounts noted online purchases connected to travel expenses (e.g., payments to travel agencies, airlines, and ferry companies) outside the domestic territory.

Source: France

Case study: Facilitator for a network of potential foreign terrorist fighters

An individual holding several bank accounts received numerous wire transfers from a large number of people. The funds received are then transferred to another individual’s bank account, who buys plane tickets and insurance on a regular basis. However, the use of his credit card doesn’t show any travel abroad.

Source: Turkey

Non-travel related spending activity

Purchasing expensive or sophisticated communication devices and information technology (for example, satellite phones).

Purchasing shooter games or engaging in combat training-type activities.

Purchasing weapons or dual-use products usable for terrorist attacks or in a war context (e.g. ammunition, explosive materials, military supplies, optical or electronical equipment) through electronic payment accounts.

Payments to media or bookstores associated with propagating radicalism, extremism or violence.

Donating to NPOs or religious websites associated with propagating radicalism, extremism or violence.

Purchasing multiple prepaid cards (e.g., telephone, general purpose).



Identifying Networks

Proactive mining will often identify relationships that may show wider networks around suspected FTFs. Networks can often be identified by examining the main suspect’s relationships through customer data, such as address and payment data. These factors could be used to establish networks.

Shared addressees.

Shared use of computers and IP addresses.

Deposits from same sources.

Individual within a network dispersing funds to other parties.

Money flows from overseas to fund activity domestically.

E. INDICATORS RELEVANT TO PRODUCTS OR SERVICES

Like other categories of risk indicators, this area is wide-ranging, diverse and not easily organised. One issue to consider is how products and services offered by the financial sector are used to move funds. A useful reference point is Section III (B) of the 2015 Emerging Terrorist Financing Risks report (see pages 20-23). That section provides an overview of the traditional TF methods and techniques which are still currently utilised to move funds. The sample indicators which have been provided generally cover those products identified in the above referenced report. Alternatively, Section IV (B and C) of the Emerging Terrorist Financing Risks report looked at vulnerabilities relevant to social media and a number of new products and services.

Money value transfer systems and remittance services

MVTS are defined by FATF as financial services that involve the acceptance of cash, checks, other monetary instruments or other stores of value and the payment of a corresponding sum in cash or other form to a beneficiary by means of a communication, message, transfer, or through a clearing network to which the MVTS provider belongs. Transactions performed by such services can involve one or more intermediaries and a final payment to a third party, and may include any new payment methods. A number of the indicators identified under the geographic risk section relates to MVTS.

Money exchangers and transfer companies remain one of the biggest means by which ISIL moves financial resources. These types of companies are prominent in Iraq and Syria where only a minority of the population has bank accounts. Businesses in the region depend on these companies to send payments to and receive payments from foreign counterparts, yet they are particularly vulnerable to exploitation by ISIL. For example Iraq has more than 1900 registered money exchangers and 34 registered money transmitters. In January 2016, the Central Bank of Iraq (CBI) publicly identified nearly 150 money exchangers and transmitters known to be conducting transactions on behalf of ISIL or that are physically located in ISIL-controlled territory 5. The CBI issued a directive prohibiting their participation in Iraq's foreign exchange currency window.

5 The Central Bank of Iraq’s list of prohibited money exchangers and transmitters can be accessed at: http://www.cbi.iq/documents/public%20Blacklist%2016%20March%202016%205th%20april.xlsx





Geographic risks

Transactions with/in/from high-risk regions to/from seemingly unrelated individuals with no apparent family connection.

Money transfers to high-risk jurisdictions/regions which are not consistent with the customer’s usual foreign business dealings.

Sender and beneficiary have no relation to country where he/she sends/receives the money and cannot sufficiently explain why money is sent there/received from there (especially when receivers are foreign citizens).

Sender specifically asks for the money to be given in an international currency rather than a local one.

Multi-country transaction routing, through high-risk corridors or regions.

Customers using web-based systems identified with significant distance between city of residence and IP address location.

Beneficiary constantly providing an address of a hotel in a touristic area as his personal address.

Identification issues

Multiple identification documents containing inconsistent information provided by the same individual or multiple individuals using the same identification documents.

Customers submitting inconsistent biographical data (e.g., an increasing amount of foreign terrorist fighters from Western countries are Muslim converts who have changed their names to an Arabic moniker. Transactions may be conducted in their Anglo name).When establishing a business relationship, customers should be screened against targeted financial sanctions (TFS) lists (see section above on Establishment of a business relationship).

Real phone numbers replaced with randomly generated phone numbers or logical sequence of numbers that could look like a domestic phone number (e.g., 0123456789).

Volume and frequency of transactions

High volume of transactions by a single individual, performed in different locations.

Sudden increase of transactions volume by multiple individuals at a single agent location, during a short period of time.

Increase of transaction volume not related to a locally known usual pattern (e.g., salary remittance or cultural celebration).



Transactions to/from cities identified as receiving an increased number of funds transfers and/or funds between the pre-crisis and ongoing-conflict periods.

Many-to-one and one-to-many consumer networks

Individual conducting a large volume of transactions with multiple countries.

Same customer sending funds to multiple beneficiaries in a high-risk jurisdiction.

Small value cross-border transfers sent/received with high frequency to/from unconnected individuals.

Multiple senders transferring funds to a single individual, acting as a “third party” receiver.

Same individual receiving money from different money remittance companies or MVTS agent locations.

Other elements

The customer seems to learn what amount is being transferred only after the MVTS employee has counted the cash.

The customer shows no interest in the transfer costs.

The sent transaction was never received by the beneficiary, who is supposedly deceased.

Case study: Network of collectors using MVTS

Several members A, B and C of a family received a large number of cash transfers through MVTS, each of them from different individuals seemingly unrelated (different names, and various locations across the country). Those individuals A, B, and C always provided a phone number which consisted of a sequence of numbers. They regularly sent cash transfers to individuals D, E and F, located in a country neighbouring a conflict zone. Receivers of those transfers always provided a hotel in touristic area as their personal address. Receivers D, E and F never received money at the same time, and seemed to operate successively. Individuals A, B and C were sending their money to the only active people, presumably aware of the change of name of the collector from D to E and then from E to F. An individual holding several bank accounts received numerous wire transfers from a large number of people. The funds received are then transferred to another individual’s bank account, who buys plane tickets and insurance on a regular basis. However, the use of his credit card doesn’t show any travel abroad.

Source: France



Hawala and other similar service providers

Hawalas are considered a subset of MVTS and are defined as money transmitters6, particularly with ties to specific geographic regions or ethnic communities, which arrange for transfer and receipt of funds or equivalent value and settle through trade, cash, and net settlement over a period of time. While they often use banking channels to settle between receiving and pay-out agents, what makes them distinct from other money transmitters is their use of non-bank settlement methods, including settlement via trade and cash, as well as prolonged settlement time. This description is based on the services they provided and not their legal status. These are NOT global money transfer networks (including agents) operated by large multinational money transmitters and money transfers.

The 2013 FATF report on The role of Hawala and other similar service providers in money laundering and terrorist financing (HOSSPs) identifies TF vulnerabilities and provides guidance on transactions patterns that are often associated with illegal/unregulated money transfer providers, including HOSSPs. Some of these risk indicators to identify suspicious providers are briefly referenced below (also see Indicators relevant to geographic risks).

Extensive use of collection accounts (in which small sums are deposited or aggregated and then wired abroad at regular intervals).

Wire transfers frequently sent by traders to foreign countries which do not seem to have any business connection to the destination countries.

Business accounts used to receive or disburse large sums of money but show virtually no normal business related activities such as payment of payrolls, invoices etc.

Frequent deposits of third party checks and money orders into business or personal accounts.

The The role of Hawala and other similar service providers in money laundering and terrorist financing (HOSSPs) report also highlights the use of criminal hawala networks and the role of different individuals such as controllers. The controller (also called a money broker in some jurisdictions) offers specialised global money laundering services and provides criminals with a central point of contact and coordination for their requirements. The criminal customer tells the controller who will hand over the money, and where the value is to be paid. The report identified a number of methods which could be considered relevant risk indicators, such as:

Using local complicit MVTS to bank and transmit the money to third parties or into accounts run by the controller.

Paying the cash into bank accounts on behalf of the controller to complete separate onward remittances.

The physical movement of the cash (cash smuggling) by courier, freight or cargo.

6 The role of Hawala and other similar service providers in money laundering and terrorist financing (FATF,

2013b)








Cash and automatic teller machines

While the use of cash is covered in the spending activity category, cash is also a type of product used by those that finance terrorism. This is another area in which work has been done developing indicators related to FTFs. Given the relatively low amounts involved in terrorist financing it lends itself to cash smuggling. The use of large denomination notes (e.g., EUR 500 notes) sometimes facilitates this . The smuggling is carried out by the fighters themselves traveling to the region, as well as friends and relatives who travel to the region once the fighters are in place.

There have also been examples where bank accounts are established to collect donations of multiple small cash deposits which are then withdrawn in varying amounts at self-service Automated Teller Machines (ATMs) shortly afterwards. For example, money may be rapidly withdrawn after deposit from accounts from one ATM, or several in close proximity (in consecutive days or several withdrawals some days apart). However, one delegation has reported that using ATM and card transactions has not been a conclusive indicator, because of the large numbers of their nationals who holiday in areas bordering conflict zones, the large numbers of domestic subjects who have family roots in those same border areas and the large contingent of legitimate aid workers, journalists and diplomats who travel to the area. In addition, some banks may have insufficient information about the precise location (e.g., country or ATM identification code) of an ATM used. Some general indicators involving cash and ATMs that have been reported include the following:

Sudden cash withdrawal, approximately corresponding to the current account balance, justified as need for foreign travel.

Customer requests a cash withdrawal of funds earlier transferred to his/her personal account within short period of time after the initial transaction.

Customer requests payment in cash of the unused balance of his/her account.

Structuring of cash deposits into smaller transactions to avoid reporting requirements triggered by a particular threshold.

Structuring of cash withdrawals with several withdrawals from a single ATM in consecutive days or from multiple ATMs in a nearby location.

Cash withdrawals using debit cards, on the same day or contiguous days, in different countries along a discernible route to a conflict area.

Small cash amounts deposited frequently at self-service terminals into a private account (the account being used for collecting donations) and withdrawal of the collected funds at self-service terminals shortly afterwards.

Large cash deposits followed by low-value international transfers below the reporting threshold.

Structured deposits into an account from third parties, followed by immediate overseas ATM withdrawals in transit areas or high-risk jurisdictions.



Individual accounts suddenly changing typical activity such as numerous, large deposits made via ATMs and then repeated balance inquires via phone and then withdrawing large amounts via ATMs.

Case study: Continued access to bank accounts by FTFs

According to sensitive financial information, terrorist financing risks were discovered regarding foreign cash withdrawals via ATMs that were made by unknown individuals in areas located near territories where ISIL operates. These withdrawals were taken from US-based bank accounts using a check card. Another terrorist financing risk identified was the existence of large deposits into bank accounts followed by immediate foreign cash withdrawals in areas located near to territories where ISIL operates. This information reveals the terrorism financing risks posed by the continued ability of the individuals who are believed to have travelled to areas occupied by ISIL to reach their bank accounts in their home countries.

Source: United States (FATF Report on ISIL Financing, 2015)

Credit cards

Similar to bank customers, many credit card customers are assessed and categorized within a tiered risk structure based on a multifactor analysis. An applicant or credit card accountholder may be subject to different levels of due diligence depending on the tier to which it is assigned. Furthermore, certain types of products or services may be subject to enhanced controls or requirements, or made unavailable in a certain country or customer tier. Geographic location of the applicant or the customer is the initial factor for the risk assessment process, but specific adjustments can be made based on the assessment of other individual risk factors. Many of the behaviour indicators identified in Section II (A) also apply to these products. Some of the specific indicators identified include:

Repeated cash advances made in countries bordering conflict areas or countries lying along the routes normally followed to/from conflict areas.

Payments by credit card in several countries while transiting (for example, petrol station, road tolls or at a location close to an airport).

Customer shows large value cash advances on a recently issued credit card.

Cash advances on credit card often with no immediate repayment.

Given the customer’s creditworthiness, unfounded or unjustified request for a maximum increase of the credit limit.

Reaching credit limits prior to departing for travel.

Apparent absence of change in the use of a credit card after a departure by plane to conflict areas (e.g., card used in domestic country by a third person) (see case study below).



Sudden use of credit cards in high-risk territories (e.g., increased cash advances) when that use has been proceeded/followed by a few months inactivity.

Use of credit cards only for receiving and making transactions between individuals while payments for goods or services are missing (e.g., individuals acting as storefronts).

Use of credit cards registered in the name of third parties.

Case study: Silent period of credit card use

The use of debit bank cards abroad followed by silent periods regarding the use of those cards has been identified. In this case, after travel expenses have been registered on the account, the account is left dormant for a period of time, thus giving the impression that the account holder does not need any funding for his trip abroad. When the account is active again, usually, it is to make a purchase at a store close to an airport.

Other examples of risk include the use of someone’s credit card in a domestic country, whereas this individual has reportedly left for a conflict area, to pretend that the FTF has never left his country of origin.

Source: France

Bank/personal loans

One emerging trend identified in FATF’s Emerging Terrorist Financing Risks report includes suspected FTFs applying for small, short-terms loans from many providers simultaneously with no intention to repay the loans. Below is a sample of indicators identified:

Customers who take bank loans in cash and tend to default.

Customers’ use of funds from bank loans inconsistent with purposes declared.

Customer applies for a large personal loan and shortly thereafter withdraws significant portion as cash.

Taking out small loans with several lending/credit companies where no repayment is made.

Loans granted (e.g. on the basis of forged income statements) when there are indications that the individual may abscond abroad.

Taking frequent loans by using high value items as collateral.

Loan applications which appear unjustified against the applicant’s economic and financial background.

Unrelated third parties acting as loan guarantors for the applicant.




Fraudulent loan applications for the purchase of goods which do not appear to have been used by the applicants (e.g. purchase of a vehicle or home appliances).

Case study: Application for numerous short-term loans

Numerous cases investigated dealt with consumer credits of low amounts (less than EUR 2 000) which were all withdrawn in cash from the holder's account within 24 to 48 hours. It is therefore more than likely that the amount of the credit has been diverted from its original intent in order to set up a “savings account” to fund a trip or logistical goods.

Source: France

Case study: Non-repayment of a personal loan

An individual received two personal loans totalling JOD 7 500. After he stopped making repayments, the bank tried to call the individual, and his employer, who mentioned that the individual had been away from work for a long period of time.

After requesting information from its counterpart, the FIU was told that this individual travelled to country (H) and then on to a country bordering the conflict zone. The FIU of country (H) referred the case to the competent general prosecutor for a suspicion of conducting terrorist financing. The competent general prosecutor seized his and his family’s moveable and immovable assets.

Source: Jordan

Currency exchange

The FATF has not widely studied the TF risks relevant to currency/money exchange. That said, some of the indicators identified to date that may be relevant to this service include the following:

Lack of information regarding the individual’s purpose and the source of funds.

Bank customer exchanging a large amount of foreign currency to domestic currency and using it to open a new bank account in a border area next to a conflict zone.

Exchange of a significant amount of currency into large denomination notes (e.g., EUR 500 notes).

Money exchange transactions followed by international money transfers to high-risk jurisdictions in a short period of time.

International network of currency exchangers – international trade between various exchangers residing in high-risk jurisdictions.

International network comprising currency exchangers and trade entities residing in high-risk jurisdictions: informal clearing and settlement system between cash and commodities, with no cross-border movements.



Overseas money exchangers suspected to tender counterfeit currency.

Unregistered exchange houses using counterbalancing settling mechanisms with registered complicit exchange houses who maintain bank accounts.

Exchange house taking part in dollar auctions, held by the central bank, more often than necessary given the size of its activities.

New payment products and services

The Guidance for a risk-based approach for prepaid cards, mobile payments and Internet-based payment services (FATF, 2013c) identifies a range of risk factors that help to identify the ML/TF risks associated with new payment products and services. Value can be stored digitally in a variety of new payment products (e.g., e-wallets, prepaid cards, mobile payments) and be interconnected to operate transactions. These products can be used for purchase and trade transactions but also used to enable international fund transfers between individuals. Indicators identified in this report related to spending activities and geographic risks could be relevant to these products.

These new products and services are operated by a variety of different payment service providers. When non-financial institutions manage these products, CDD requirements may not be as robust and therefore may represent a greater TF vulnerability.

Internet-based payments

Internet-based payment services provide mechanisms for customers to access, via the Internet, including via smartphones, pre-funded accounts which can be used to transfer the electronic money or value held in those accounts to other individuals or businesses which also hold accounts with the same provider.

One individual using many financial profiles (e.g., e-wallets) to register with multiple payment systems.

E-wallet registration from a high-risk jurisdiction/region.

Account replenishment from a high-risk jurisdiction/region.

Remote transfer of money from e-wallet to third persons’ accounts opened in a different jurisdiction (person to person).

Placement of financial details on websites and social networks with extremist and radical context.

Payments indicating that the account may be used for charity fund-raising.

Large and diverse source of funds (e.g. bank transfers, credit card and cash funding from different locations) used to fund the same e-money wallet.

Multiple bank accounts from banks located in various cities used to fund the same account.

Online accounts linked to individuals related to terrorism charges by name, credit cards, addresses, e-mail activity and computer cookies. (e.g., these


http://www.fatf-gafi.org/publications/fatfrecommendations/documents/rba-npps-2013.html



accounts were used to purchase electronic parts and prepaid cellular cards on-line).

Case study: Many-to-one e-wallet payments

During an FIU initiative to monitor open sources on a social network (i.e., Vkontakte), a post drew attention. This post was calling for donations for financial assistance to families of terrorists, for Jihad and for funding terrorists’ training. Several e-wallets numbers were mentioned in this post. An individual owning those e-wallets, received transfers from multiple individuals, located in different countries. Money on those electronic accounts was then sent to a mobile bank account linked to a phone number located in a conflict area.

Source: Russian Federation

Prepaid cards

Prepaid cards are cards loaded with a fixed amount of electronic currency or value. General purpose reloadable prepaid cards which are linked to a bank account are often subject to CDD compliance. Like similar bank products such as debit cards, they can be used for TF purposes to withdraw money at ATMs in a high-risk jurisdiction (see section above on Cash and automatic teller machines). In addition, below are some specific indicators which could also be relevant to account-based prepaid cards:

Foreign prepaid cards issued in high-risk jurisdictions.

Registering of multiple prepaid cards for family members, in a context of departing to a high risk jurisdiction/region.

Use of card-to-card transfers to/from a high-risk jurisdiction/region.

Online transaction checking from an IP address in a high-risk corridor.

Transaction attempt above the prepaid basis, by someone who doesn’t seem aware of the amount of funds loaded, thus who might not be the original holder of the card.

Regarding non-bank account based prepaid cards, sold by retailers, identification is often required above a threshold of maximum amount or reload time limit. Those cards can be loaded domestically via cash electronic methods and carried offshore inconspicuously. On arrival in a high-risk country or transit country for terrorism financing, the funds are then converted back to cash through multiple offshore ATM withdrawals.

Use of prepaid cards registered under a false identity or someone else’s name for purchasing on the Internet.

Cards loaded online through an anonymous means of payment (e.g., vouchers paid in cash, amounts of cash through ATM, e-wallet).

Open loop prepaid network-branded cards sold by retailers with a small reloadable limit that do not require identification. This is the type of prepaid card that is of most concern.



Multiple purchases of prepaid cards that do not require identification, despite higher fees than a prepaid card with higher threshold but with ID requirement.

Purchasing multiple prepaid cards in exchange houses while changing currency.

Numerous cash deposits to a reloadable prepaid debit card by subject identified with terrorism-related charges.

Case study: Use of prepaid card ahead of attacks

A prepaid reloadable open loop card, managed by a financial institution, was used in several European countries for cash withdrawals and small travel-related spending: buying airline tickets, booking hotel rooms, renting cars, paying for petrol, paying for purchases at motorway service areas. The prepaid cards were also used as a guarantee when renting a car or booking a hotel room. Attempted transactions exceeding the available loaded amount on the card could not be seen by the issuer bank, but were noticed by the company managing the expenditure of the card. This company, established in country D informed the FIU of country D, which in turn informed the Belgian FIU. It was then possible to retrace the terrorists’ route by analysing the payments made with the prepaid card. The rejected transactions were also important to locate and understand the terrorists’ routes. The investigation showed that the payments made with the prepaid card enabled the provision of logistical support to the terrorists.

Source: Belgium

Mobile payments

There is a wide-range of mobile payment services offered by financial institutions and mobile network operators who have partnered to create agent networks. Mobile network operator retail outlets and other storefront retailers offer similar services to those of limited purpose bank branches (e.g., deposit taking and paying out cash to settle mobile payment transactions).

Cross border cash transfer to high-risk jurisdiction/region.

Mobile phone bought only to be used for mobile payments and not communication purposes.

Registration of a disposable mobile phone with the mobile payment service provider.

Use of stored value phone card paid by cash (particularly where no customer identification is required).

Receiver can ask the transfer to his stored value card and withdraw the funds from any ATM.



Crowdfunding platforms

Crowdfunding platforms can be misused for TF purposes by pooling funds on Internet, offering multiple payment methods to send money internationally. Ideally, each individual registering to raise funds on a crowdfunding platform could be screened against TFS lists and open-source media as noted in Section II.A of this report.

Large sums collected from a few participants.

Small project collecting money from individuals related in real life (e.g., members from a small local NPO, a neighbourhood), despite high fees taken by the crowdfunding platform.

Payments received from high risk jurisdiction/region.

Possible misuse of a humanitarian fund raising campaign.

Project managers using bank accounts with no geographic link with the advertised project.

Crowdfunding platforms that have projects/purposes related to violent extremism or radicalism.

Case study: Misuse of humanitarian fundraising through a crowdfunding platform

A recently set up non-profit organisation, linked to one religious place of worship in a small neighbourhood, set up a fundraising campaign for humanitarian purposes related to schools abroad on a crowdfunding platform. Most of the donations were given by few people living in the neighbourhood, presumably in relation with the audience of the place of worship. The 5.5 % fee charged by the crowdfunding platform, costly for a small NPO, should have deterred the use of such a technique to raise money among an already established audience. One individual from the NPO management was suspected to have close links with FTFs.

Source: France

F. INDICATORS RELEVANT TO NON-PROFIT ORGANISATIONS

While not all non–profit organisations (NPOs) are high risk and some may represent little or no risk at all7, the ongoing international campaign against TF has identified cases in which terrorist entities target some NPOs to access materials and funds from these NPOs and to exploit their networks, thus intentionally abusing the NPO. This issue was addressed in the FATF’s Emerging Terrorist Financing Risks Report but was comprehensively addressed in the June 2014 FATF Report on the Risk of terrorist abuse in non-profit organisations. Chapter six of the 2014 report provides a comprehensive set of general indicators and more focused terrorist financing indicators. Extensive material on risk indicators was also submitted specifically for this project. The sample indicators recently received can be put into four general categories associated with Donations, Expenditures, Transactions and NPO Executives.

7 See Best Practices on Combating the Abuse of Non-Profit Organisations (FATF, 2015c).


http://www.fatf-gafi.org/publications/methodsandtrends/documents/risk-terrorist-abuse-non-profits.html




http://www.fatf-gafi.org/publications/fatfrecommendations/documents/bpp-combating-abuse-npo.html


As indicated in the first paragraph under I. E Use of Indicators, this report is not intended to be used as a basis to engage in wholesale or indiscriminate de-risking practices. As such, the indicators below should not be interpreted as an indication that established or reputable charitable organisations, working in geographic areas with a presence of a terrorist group, now represent a higher risk for institutions. Again, a single indicator may not alone warrant suspicion of terrorist financing or provide a clear indication of such activity. The FATF has recently updated its standard regarding NPOs in order to ensure that it is line with a risk-based approach and does not disrupt or discourage legitimate charitable activities.

Donations

Large donations from a foreign entity or corporation to the account of an NPO, especially absent a clear relationship.

The number of small denomination transfers deposited to an NPO account has increased without any obvious reason.

Cumulatively large and not adequately justified amounts, especially if made primarily in cash.

Multiple cash deposits into a personal account (or a condition stating that cash mush be transferred to an individual in a high-risk country) described as ‘donations’ or ‘contributions to humanitarian aid’ or similar terms.

High percentage of the donations/assets to an NPO are coming from or going to foreign states which do not correspond to the financial location of the donor.

High amounts of donations from a fictitious individual to an NPO.

An individual receives donations in a bank account intended for charitable donations and transfers money to organizations that have been linked to terrorist financing through electronic media.

Donation to an NPO has been intended only for very few beneficiaries.

Deposits using a combination of monetary instruments atypical to a legitimate business activity.

NPOs operating in conflict areas receiving donations from corporate entities (having business interests in these areas) in their accounts directly or through a series of layered transactions. Such funds could be related to terror organisations extorting corporate entities via NPOs.



Case study: Diversion of Funds by Actors Internal to NPOs

An individual (Mr. A) established a charitable foundation under the pretext of collecting donations for Syrian refugees, people in need of medical and financial aid, and construction of mosques, schools and kindergartens. However, Mr. A was the leader of an organised scheme in which donations were sent to a group of individuals related to Mr. A (Group A) instead of the foundation’s account. In most cases, the first stage involved money being sent through money remitters and then transported in cash. The money was then transferred either to credit card accounts or to e-wallets. The members of Group A placed the relevant information (that funds are being collected for the declared purposes) on the Internet, but, in fact, the funds were sent as aid for terrorists and their families and meant to be used as financial support for terrorist activities.

This information was discovered through investigations conducted by the FIU based on regular monitoring of entities on their domestic l ist of designated terrorist entities and related persons or on information provided by law enforcement. Analysis of the collected information allowed the FIU to identify the relation between different cases: common payers and recipients and similar modus operandi in collection and distribution of funds. Further cooperation with law enforcement authorities allowed the FIU to establish the direct link between Mr. A and ISIL’s activity. This resulted in several criminal investigations related to Mr. A. In addition, Mr. A was listed on the domestic list of designated terrorist entities, with the relevant freezing procedures performed. Under the court decisions, assets of the Group A members were frozen.

Source: Russian Federation (FATF Report on Financing of the Terrorist Organisation Islamic State in Iraq and the Levant, 2015a)

Expenditures

Organizations not intended to provide humanitarian charity, sending money to high-risk jurisdictions.

Unclear use of the funds for expenditures which are not connected with the activity of an NPO.

Transactions stating the purpose to build a facility for an NPO, especially if the beneficiary is an individual that seems unrelated to the project and cannot be linked with a construction business.

Use of charity organisations to sell goods.

Payment for goods is made by a third party and not the importer.

NPO’s “on paper” expenditures not proportionate to expectations (i.e., the risk of funds being skimmed, repurposed, or taxed for TF purposes).

Transactions

Transactions conducted on the account of an NPO which are inconsistent with the pattern and size of the organisation’s purpose or business.



Transactions carried out by NPOs that do not correspond with the activity declared by the beneficiary/supporter.

Transactions characterized by large flows in a short period of time and involving several NPOs that show unjustified links, such as sharing the same address, representatives or staff or multiple accounts with the same names recurring.

Transfer of the majority of the raised funds to geographical areas habitually marked by activities and initiatives related to terrorist financing.

Transactions requested with counterparties which have been designated in lists or which are entities associated with terrorist financing activities.

An individual deposits funds into several accounts (which he/she holds) and requests a transfer of funds to themselves abroad for the purpose of donations.

A repeated cash contribution paid by natural persons into a NPO account and subsequently the cash is transferred to accounts of natural or legal persons.

Only crediting and cashing operations are made in the NPO’s account.

NPO executives and other staff

Several individuals with signatory power on an account held by an individual, or an NPO with no family or business relations; frequent changes of individuals with signatory power over an NPO’s account.

Accounts that received funds from newly founded NPOs and fundraisers (entities may have changed/updated their identity recently).

Large payment orders are made to the accounts of NPO founders (or other individuals connected to the NPO, such as executives or treasurers), cashing operations in NPO founder accounts are conducted on an ongoing basis.

Financial funds of NPO are situated in the accounts of natural persons.

Incomplete details about an originator of transactions in favor of an NPO or in favor of individuals related to the organisation.

Principals (or employees) of NPO misappropriating funds, such as where funds are withdrawn prior to departing to a conflict zone.

Bank accounts of executive or contactors, who are operating in conflict areas, could be paying extortion/ransom to the terror organisations for pursuing their business interest or collecting extortion on behalf of terror organisations.



G. INDICATORS RELEVANT TO TRADE AND COMMERCIAL ENTITIES

The rapid growth in the global economy has made financial transactions associated with goods and services an increasingly attractive avenue for the international movement of illicit funds. The FATF has addressed illicit finance vulnerabilities associated with trade and commercial entities in a number of reports to include Trade Based Money Laundering (TBML) in 2006 and 2012,8 Proliferation Finance in 20089 and Free Trade Zones (FTZs) in 201010. Some of these reports have identified specific risk (“red flag”) indicators. While not all are associated with terrorist financing, some are relevant for this report and have been included.

As larger corporate banks typically offer the types of financial products and services involved in domestic and international trade and commercial activity, they are most likely to be exposed to trade-based TF activity. Types of products and services that may be involved range from payment transfers from the importer to the exporter to more sophisticated financial products, such as letters of credit, documentary collections and guarantees. The financial sector also provides export finance to bridge the time between the need of funds for production, transportation etc. and the payment for such products by the importer. Banks and other export credit agencies provide loans and credit to traders to enable them to purchase and resell goods or equipment. All financial institutions involved in trade finance, no matter what their business line, have both commercial incentives and legal obligations to conduct CDD and potentially account monitoring. But the nature and depth of CDD undertaken, and how it is organised, can vary significantly between financial institutions, from transaction to transaction and based on the regulations in the local jurisdiction. Risk indicators related to trade can include:

Natural persons engaged in the trade and production of goods and technology is subject to designation or TFS domestically or globally.

Business relationship has been established by legal or natural persons that could be connected with terrorist organisation.

Shortly after a designation, a related company is registered and a new account is opened.

Large number of people authorised to conduct business in the name of the legal person or organisation.

Money transfers to high-risk jurisdictions immediately after the creation of a legal entity when a business relationship has not been established.

Cash-intensive business using MVTS for transactions rather than wire-transfers.

Transactional activity between individuals or entities with newly established companies with no apparent business relationships or companies seemingly not operative (e.g. generic import-export activity, no website etc.).

8 Trade-based money laundering (APG, 2012) 9 Typologies report on Proliferation Financing (FATF, 2008) 10 Money laundering vulnerabilities of Free Trade Zones (FATF, 2010)


http://www.fatf-gafi.org/publications/methodsandtrends/documents/moneylaunderingvulnerabilitiesoffreetradezones.html

http://www.fatf-gafi.org/publications/methodsandtrends/documents/typologiesreportonproliferationfinancing.html

http://www.fatf-gafi.org/publications/methodsandtrends/documents/trade-basedmoneylaunderingtypologies.html


Numerous incoming personal cheques deposited into business accounts with no apparent legitimate purposes.

Travel agencies facilitating religious pilgrimages to destinations in high-risk jurisdictions, and with an average cost offered significantly lower than the price of other travel agencies.

Payment for delivery of goods incompatible with the level of service, or geographic structure of the country to which goods are delivered.

The buyer (natural person) of goods resides in a location, which is in a different country than the final recipient of the ordered goods.

The legal person’s registered line of business is not in accordance with its real business, or real beneficiary of ordered goods does not appear as the final beneficiary.

Numerous incoming money transfers into business accounts with no apparent legitimate purposes.

Sudden increase of transactions on an MVTS professional bank account.

Commercial entities with businesses in high-risk areas dealing with merchandise that could be considered dual-use or that could be used in terrorist activities.

Commercial entities conducting businesses in high-risk areas that may be vulnerable to abuse or coercion (i.e., payments in exchange for access to ports and commercial areas controlled by terrorist groups).

Investment in transportation companies, which allow the intensive use of cash, operating in routes and zones linked to illicit activities.

Investment of funds in the creation/operation of companies that sell/purchase vehicles in high-risk conflict zones.

Unusual commercial volume in cash-intensive sectors located in areas bordering conflict zones.

Case study: Trade-based financing of terrorism

Following the designation of company A as an unauthorised association in Israel, the company was not able to import goods through Israeli ports. Despite these restrictions, company B, a local company that imports and markets basic food products, cooperated with company A to circumvent these limitations. Company B first imported goods into Israel and then an accomplice, company C, released the goods from the port and stored them. Later, company B transferred the goods to company A in a high-risk territory for TF. As part of the settling of accounts, company A transferred funds from its accounts to company B. The value of the goods and transfers was estimated at several million in Israeli new shekel (NIS).

Source: Israel (Emerging Terrorist Financing Risks (FATF, 2015))




Case study: Trade of goods smuggled for terrorist financing purposes

Some inconsistencies on a commercial invoice were noticed which included the fact that the buyer had a different name compared to the wire transfer beneficiary, which was a shipping company, and might not be the ultimate recipient of those goods. In addition, while the stated purpose of that wire was for some food goods, the invoice mentioned a medical equipment company, with no delivery address stated. Information from law enforcement revealed a nexus between the medical equipment company and a terrorist organisation.

Source: France

Illicit trade of antiquities/cultural heritage

United Nations Security Resolution (UNSCR) 2199 imposes a world wide moratorium on trading in cultural objects from Syria (since 15 March 2011) and in Iraq (since 6 August 1990). As mentioned in the Report of the Secretary-General on the threat posed by ISIL (Da’esh) to international peace and security and the range of United Nations efforts in support of Member States in countering the threat , in view of the scale of the looting and its significant economic value, it is likely that many items are being stored by criminal networks. Once the attention diminishes, individuals and groups involved in transnational criminal networks will begin to introduce additional laundered items into the market.

ISIL appears to be mainly benefiting from this illicit trade at the preliminary stages mainly by selling excavation permits to local citizens and contracters, as well as taxing the sale of coins, small sculptures, pottery and mosaics that local citizens and contractors excavate and collecting a tax on antiquities smuggled out of its territory. The UN notes that while profit margins for looted antiquities at the first point of sale are potentially small, the trading of significant volumes of antiquities is required if significant funds are to be generated11. Outreach is being done to law enforcement, art dealers, auction houses, museums and the antiquities market to encourage greater vigilance in tracking and stopping the sale of cultural artefacts looted and sold but it is not clear how any related transactions have touched the formal financial sector. Any financial transactions which relate to cultural goods that could have originated from Syria, Iraq or Libya should be subjected to detailed scrutiny and precautionary measures. Jurisdictions are also under an obligation to report the interdiction of antiquities in their territory that are being transferred to or from ISIL (see paragraph 15 of UNSCR 2253 (2015) and paragraph 12 of UNSCR 2199 (2015)).

Financial transactions in relation to cultural goods similar to those mentioned in the UNSCR 2199 and by the International Council of Museums (ICOM) in Emergency Red List of Iraqi Antiquities at Risk (2003), Emergency Red List of Syrian Cultural Objects at Risk (2013) and Emergency Red List of Libyan Cultural Objects at Risk (2015).

Financial transactions related to antiquities from Iraq and Syria (including small pieces, such as coins and statuettes) put up for sale on Internet and social media.

11 Challenges business entities face in implementing Security Council resolution 2199 (2015).(UN SC, 2016).


http://www.un.org/en/ga/search/view_doc.asp?symbol=S/2016/213


Financial transactions related to shipments of underground monitoring/scanning equipment such as metal detectors used by looters to excavate ancient artefacts and cultural objects.

False import decalartions which claim that artefacts originate from countries neighbouring Syria and Iraq.

Oil and gas industry

Input from stakeholders and the private sector requestedx indicators specifically related to ISIL. While many of the indicators throughout this paper are relevant to the specific threats associated with ISIL, this section specifically focuses on those indicators associated with the oil production and refining operations, including the purchase, shipment or trade of oil drilling and refinery equipment.

UNSCR 2199 requires all states to prevent any direct or indirect trade with ISIL of any oil and oil products, modular refinery equipment and related material. UNSCR 2199 also emphasises that all states must freeze all assets of ISIL-related groups, as well as those of associated individuals, groups, undertakings, and entities, including their oil, oil products, modular refineries, and related material. Institutions should therefore be aware of the general types of hydrocarbon industry drilling and refinery equipment and spare parts that ISIL may be interested in acquiring. Some indicators that may be relevant include:

Financial connections to oil companies, brokers and parts suppliers located in high-risk areas.

Individuals or entities suddenly procuring and/or shipping oil equipment to Syria, Iraq or bordering states, where the activity is not consistent with the customer’s line of business.

Front companies used to disguise the trade and sale of oil products and oil-related parts.

Transaction involves possible shell companies (e.g. companies do not have a high level of capitalisation or displays other shell company indicators).

A freight forwarding firm is listed as the product’s final destination.

Wire instructions or payment from or due to parties not identified on the original letter of credit or other documentation.

New customer requests letter of credit transaction awaiting approval of new account.

The transaction involves the use of repeatedly amended or frequently extended letters of credit.

To limit ISIL’s ability to benefit financially from oil produced within its territories; the CFIG have collaborated with the international oil industry to create an illustrative list of oil drilling and refinery equipment12, which ISIL will likely require to continue its oil production and refining

12 Illustrative List of Oil Drilling and Refinery Equipment (US DOS, 2016)


http://www.state.gov/e/enr/c71196.htm


operations. This list can be used to identify equipment to prevent the shipment or transhipment of drilling and refining equipment and related material into ISIL-controlled territory. This list can be shared with oil industry representatives, logistics companies, border control authorities, and oil drilling and refining equipment manufacturers. This list may be equally beneficial to large corporate banks and the financial sector dealing in trade finance.



III. SHARING CONTEXTUAL INFORMATION TO IMPROVE RISK INDICATORS

While risk indicators are a useful tool, they are no substitute for close relationships between the private and public sector to exchange information on TF risks. The FATF Standards require countries to develop strong legal and operational frameworks to inform the private sector of ML/TF risks and to ensure that the private sector takes ML/TF risk into account in the course of its business. The FATF Emerging Terrorist Financing Risks report highlighted the need to combine data from reporting entities with contextual and sanitized information from authorities. Given the urgency and time-sensitive nature of these issues, the ability to quickly and securely share terrorist financing-related information is essential. This section focuses only on domestic mechanisms to enhance information sharing between the public and private sectors in order to improve risk indicators.

In response to current TF risks, the FATF is undertaking extensive work on information sharing within, and between, the public and private sector. Consultation on this report revealed a number of useful steps to enhance public-private collaboration and joint efforts to identify and communicate risks, and develop risk indicators. This section provides a preliminary assessment of these tools.

Respondents also noted a number of factors that prevent or restrict effective information sharing in the context of TF both at the domestic and multilateral levels. Terrorism and TF information, by its nature, is highly sensitive and needs protection even among competent authorities. A lack of trust between competent authorities and the private sector may inhibit sharing sensitive data. The public sector has the difficult task of balancing the confidentiality of sensitive operational information and creating awareness of TF risks with stakeholders. Relationships should be developed to harness skills from both sides by building a community of experts which can leverage those capabilities. The engagement must be an ongoing process as the private sector needs to have the most accurate understanding of the constantly changing risk environment.

A. FEEDBACK TO REPORTING ENTITIES

Risk indicators assist the private sector (and FIUs) in identifying certain suspicious behaviour which may be related to TF. However, the private sector is always looking for more robust and timely guidance and feedback from the public sector with respect to the quality and utility of their Suspicious transactions reports (STRs) in order to improve their identification and analysis methods. Guidance, feedback or outreach has a very tactical element to it in that it provides reporting entities with meaningful or “targeted” information with the explicit purpose of helping the private sector provide better suspicious activity reporting. This cycle (or “feedback loop”) ultimately leads to even better outreach by the competent authorities to the reporting institutions that further enhance reporting.

The private sector also finds it helpful to, where possible, review and provide feedback to public authorities on drafts of risk profiles and indicators with the private sector before they are issued in order to have the most effective product.




Case study: The Netherlands

The Netherlands provided an example of how their authorities test indicators with the private sector to assess their feasibility and usefulness. Draft risk profiles are refined based on the preliminary results provided by reporting entities. Once finalized, risk profiles are disseminated by the competent authority to the reporting entities in the form of guidance. In this case, the continuing guidance and feedback enhances the effectiveness of the development of TF indicators.

Case study: Australia

Australia provided an example of how it provides guidance and feedback on STRs to a number of key stakeholders on a periodic basis. Each quarter the FIU and law enforcement will meet with the four largest banks to discuss compliance issues and feedback STRs. These meetings have resulted in a 300% increase in suspicious transaction reports.

B. TYPES OF INFORMATION SHARED

When providing preliminary feedback on this report, the private sector emphasised that risk indicators are useful but they need to be supplemented by detailed contextual information. While it is difficult to share this information in this report, participants identified a number of ways in which authorities can provide the private sector with the information they need, through general and targeted outreach, without compromising the confidentiality of the information.

Authorities must properly understand what types of information and intelligence are of value to the private sector in identifying terrorist activity. The responses indicate that most competent authorities can provide reporting entities with sanitized case studies and typologies on TF and no legal barriers exist regarding this type of data. This type information is often produced by the FIU in the form of an annual report, newsletter or e-bulletin. Often times, more detailed versions of case studies can be shared to specific entities though appropriate channels.

National Risk Assessments are another useful mechanism to disseminate case studies and typologies. These assessments are useful in engaging with the private sector at an early stage and in increasing the awareness of specific risks. One challenge identified involves those countries which do not have case studies or typologies related to TF in their own jurisdiction, and can provide only case studies relating to another jurisdiction.

The private sector is often looking for assistance and more detailed contextual information from the public sector, which may be sensitive, to help interpret the data they have. Some private sector entities have stressed the importance of receiving a list of relevant individuals (i.e. people under monitoring, surveillance or investigation) from competent authorities. Such list-based approaches may help in identifying specific transactions and to detect the network of subjects related to those listed. However, sharing lists of subjects is a sensitive issue as preserving the confidentiality of on-going investigations and operations is a priority for law enforcement authorities. Some private sector participants, particularly those with larger data sets, have emphasised that even if it is not



possible to divulge the particular facts of a case, a general indication of the type of activity occurring can assist them to provide additional financial intelligence.

The private sector may maintain data about a customer for CDD purposes such as Internet Protocol (IP) addresses, mobile phone numbers and geolocation data. In combination with information from competent authorities, such CDD information can become useful for identifying potential TF activity. Competent authorities have highlighted particular countries which may pose a greater risk of terrorist financing or have identified certain business that may pose a heightened security risk. For example, law enforcement has shared information about certain cities or neighbourhoods where known intermediaries and facilitators for FTFs are living. In some cases, authorities will provide detailed data analysis on geographical areas concerning borders, logistical or transit areas. In other cases, law enforcement has shared financial information they gain from large seizures (e.g., bills of lading, receipts, etc.) to banks, which use it to check against records in their system to identify any relevant suspicious transactions.

Information regarding real time incidents should be more detailed and more specific to enable the private sector to take immediate action. However, as noted above, concrete information relating to specific individuals and events are often subject to restrictions. These practical challenges exist with respect to ongoing or active terrorism or terrorist financing investigations. In these cases, it is often difficult to share information, even through a sanitized case study. Authorities and entities are therefore not able to act in good faith because of legal restrictions, privacy protection or liability issues. Establishing exceptions or protocols could allow authorities to share information with the private sector, as needed on an urgent basis, when there is a real-life incident unfolding where there is, or could be, loss of life.



Case study: United States

The United States Financial Crimes Enforcement Network (FinCEN) regulations under Section 314(a) of the USA PATRIOT Act enable FinCEN to reach out to more than 43 000 points of contact at more than 22 000 financial institutions to locate accounts and transactions of persons that may be involved in terrorism or money laundering. FinCEN makes these requests for its own analytical and investigative purposes and on behalf of federal, state, local, and certain foreign (e.g., European Union) law enforcement agencies. Section 314(a) provides lead information only (financial intelligence) and is not a substitute for a subpoena or other legal process, which is typically used following the identification of relevant information to obtain the information for further investigative or evidentiary purposes.

Through an expedited communication system, FinCEN’s 314(a) process enables an investigator to provide sensitive investigative lead information directly to reporting entities. FinCEN provides a secure e-mail system to disseminate this sensitive information. Based upon the initial information that the financial institutions provide, the investigative focus quickly zeros in on relevant locations and activities. In addition FinCEN will organise and host information sharing discussions with appropriate financial institutions to issue requests for information pursuant to Section 314(a). This cooperative partnership between the financial community and law enforcement allows disparate bits of information to be identified, centralized and rapidly evaluated.

Specific and targeted guidance, advisories and notifications are considered the most useful type of information by the private sector. These advisories are sometimes sent via secure channels depending on the sensitivity of the data. They provide robust contextual information on the targeted TF activity, focus the private sector on the areas of risk, and explain not only the potential indicators of the activity but also how the private sector may encounter them within its operations. In some cases, this guidance will include a list of high risk individuals or legal persons associated with the activity. For that information to be most useful to the private sector, however, public sector authorities should include specific information, personal data (name, date of birth) of these high-risk individuals/entities. Domestic and international targeted financial sanctions against individuals and entities should be sent proactively to financial institutions, slightly in advance of the official publication to ensure a better screening and disrupting of any attempt of funds movement ahead of the freezing process.



Case study: Russian Federation

The Russian FIU (Rosfinmonitoring) has developed a CFT multi-layer set of indicators system for Russian financial institutions. These indicators are divided into three groups:

1) A regional feature (linking the transaction to a specific area);

2) Initiating criteria;

3) Supportive (auxiliary) criteria.To assist in the identification a specific territory as the zone of increased terrorist threat, one should use officially available information, published by international (intergovernmental) organisations, including the associations of FIU. Transactions covered by the indicators of Group 1 are defined as initiating, i.e. transactions subject to examination along with considering supportive (auxiliary) transactions, which are covered by the Group 2 indicators.

Some indicators are then developed as thematic topics such as:

FTF Indicators are further divided into two categories:

indicators of external category that reflect the behaviour model and the specific characteristics of transactions with funds performed by FTFs in the areas of high risk; and

indicators of internal category that reflect the behavioural model and the specifics of transactions with funds committed by FTFs within their home area.

Indicators regarding "Radical centers" and "Business structures" consist of the "initiating" and "supportive" (auxiliary) indicators categories. As a result, it should be noted that using the multi-layer set of indicators enables both credit institutions and FIUs to avoid needless "interferences" (irrelevant data) in the reported operations, and focus on specific groups of transactions suspected of being linked to terrorist financing.



C. MECHANISMS TO ENGAGE WITH THE PRIVATE SECTOR

Participants in this project highlighted the importance of a two-way relationship between the private and public sector. Authorities have developed a variety of mechanisms to facilitate this. These mechanisms can include formal meetings and informal briefings, both at the one-on-one level and with multiple entities. Most countries indicated they hold at least a yearly forum or seminar with the private sector to discuss TF risk and trends. The emphasis of these meetings differs depending on the competent authority involved (e.g., law enforcement, FIU or supervisor). Regardless of the hosting authority, operational entities such as law enforcement or security agencies are often included to provide practical case examples or specific information on risk. In other cases, seminars on TF risk take place as part of the conferences, seminars, and training for reporting entities. Additionally, this outreach may occur at the initiative of the private sector rather than the government to enable more expansive discussion of the potential TF activity.

Regular and timely “one-on-one” meetings with selected and security-cleared stakeholders are a useful mechanism to discuss specific feedback. Competent authorities (especially the FIU or law enforcement) can often provide feedback on whether the suspicion reported was grounded or not by providing examples of how this information was ultimately used by law enforcement and judicial authorities. Respondents also noted that when providing specific feedback, law enforcement or other authorities should try to directly meet with compliance officers and employees who are responsible for identifying suspicious activity related to terrorist financing. Authorities are often able to discuss the content of an STR with a reporting entity. This enables reporting entities to better understand their risk monitoring systems and determine if adjustments are needed. As noted above, feedback may be inhibited due to sensitive information regarding terrorist related investigations.

Outreach may occur under the auspices of established legal protections, protected fora, or signed confidentiality agreements. Jurisdictions indicated that one effective mechanism to support the effective sharing of sensitive or national security data is to have key private sector employees be cleared, authorised and approved to receive such information. In these cases, law enforcement, security or intelligence agencies will hold one-on-one meetings with selected companies in the financial sector where key employees have been approved for the purpose of the meeting. Sensitive or classified information related to TF, including active cases is then shared. Another is to have a legally protected forum for discussions where all relevant public sector competent authorities and the private sector are able to address TF trends, cases, and issues in a confidential but not classified manner.

In some cases, specific TF working groups or task forces have been established between the public and private sector. Examples include the United Kingdom’s Joint Money Laundering Intelligence Taskforce (JMLIT)13, Australia’s Major Reporters Forum and the United States’ Domestic Security Alliance Council (DSAC)14. These types of task forces provide a forum for operational collaboration which is instrumental in improving the analysis and investigation functions of all parties involved. Switzerland also provided a useful example of such interaction which involves additional

13 Joint Money Laundering Intelligence Taskforce (NCA, nd) 14 www.dsac.gov


http://www.dsac.gov/

http://www.nationalcrimeagency.gov.uk/about-us/what-we-do/economic-crime/joint-money-laundering-intelligence-taskforce-jmlit


stakeholders from other sectors that are not reporting entities to foster better discussion and understanding of risks.

Case study: Egypt

The Federation of Egyptian Banks (FEB) was established as a non-profit independent entity. FEB connects all Egyptian banks and foreign banks working in Egypt. The objectives of the FEB are to discuss and share common issues between the members of the federation; this is in addition to giving opinions of draft laws and suggesting amendments of current legislation related to the banking sector.

In 2003 a Compliance Officer Association was created as an initiative of the FEB. All compliance officers of the banks operating in Egypt are members in this association. Regular meetings are held to discuss any suggestions or problems with regard to combating TF and ML. The Central Bank of Egypt and the Egyptian FIU (EMLCU) are usually invited to attend these meetings to provide feedback and technical assistance on the issues raised by the compliance officers.

There is also a need for a mechanism or process within a jurisdiction for the private sector to report potential TF transactions or at least those that appear to indicate that a terrorist act may be imminent to law enforcement/security services in near real time. This presupposes that the competent authority has the channel to receive this type of information and can act accordingly. Examples include dedicated telephone “hotlines.”



IV. CONCLUSIONS

This report represents a significant advancement in how the FATF develops risk indicators to help detect terrorist and terrorist financing activity. The report recognises that detecting terrorist financing activity is a multi-faceted process and cannot rely on solitary, stand-alone indicators which can be fed into automated systems. The FATF engaged with a number of private sector entities to ensure that this report was both relevant and useful to them in their day-to-day work, and could be operationalised and aligned with methods of banks and other financial institutions. This type of collaboration serves as a model for FATF’s future efforts on identifying money laundering or terrorist financing risks.

Risk indicators for terrorist financing should take into account several monitoring activities, such as:

name screening,

transaction monitoring,

payments screening, and

behavioural due diligence in the training environment,

These indicators should also feed specialised data mining and mapping tools, as well as trigger internal further investigations.

While the indicators identified are wide-ranging and constantly evolving, they are best used when applying other contextual information from domestic law enforcement and public sources. A rules-based approach cannot determine terrorist financing risks, but a risk-based approach can be implemented with a dynamic two-way dialogue between financial institutions and public authorities.

Enhancing information sharing is a complex topic at both the national and multilateral levels. This report aims to establish practical domestic mechanisms to enhance information sharing about terrorist and terrorist financing risk as they relate to indicators identified. Section III of this report is only one small piece of work the FATF plans on doing on information sharing. Hopefully, this report can feed into other work streams at the international level.

This report is not intended as a compliance monitoring tool by supervisory authority. Domestically, competent authorities should take this opportunity to use the report itself as a catalyst to:

engage with the private sector,

implement specific feedback on terrorist financing- related suspicious activity reports and help financial institutions fine-tune their monitoring process

share contextual information on terrorism and terrorist financing that could trigger preventive detection of potential terrorists.

To evaluate the effectiveness of this report, FATF will monitor how authorities are disseminating the indicators and measures taken to enhance partnerships with the private sector based on the use of the risk indicators.



BIBLIOGRAPHY AND REFERENCES

FATF (2015a) Financing of the Terrorist Organisation Islamic State in Iraq and the Levant (ISIL), FATF, Paris, www.fatf-gafi.org/publications/methodsandtrends/documents/financing-of-terrorist-organisation-isil.html

FATF (2015b) Emerging Terrorist Financing Risks, FATF, Paris, www.fatf-gafi.org/publications/methodsandtrends/documents/emerging-terrorist-financing-risks.html

FATF (2015c), Best Practices on Combating the Abuse of Non-Profit Organisations, FATF, Paris, www.fatf-gafi.org/publications/fatfrecommendations/documents/bpp-combating-abuse-npo.html

FATF (2014), Risk of terrorist abuse in non-profit organisations, FATF, Paris, www.fatf-gafi.org/publications/methodsandtrends/documents/risk-terrorist-abuse-non-profits.html

FATF (2013a), International Best Practices on Targeted Financial Sanctions for Terrorist Financing, FATF, Paris, www.fatf-gafi.org/publications/fatfrecommendations/documents/bpp-finsanctions-tf-r6.html

FATF (2013b) The role of Hawala and other similar service providers in money laundering and terrorist financing, FATF, Paris, www.fatf-gafi.org/publications/methodsandtrends/documents/role-hawalas-in-ml-tf.html

FATF (2013c) Guidance for a Risk-Based Approach to Prepaid Cards, Mobile Payments and Internet-Based Payment Services, FATF, Paris, www.fatf-gafi.org/publications/fatfrecommendations/documents/rba-npps-2013.html

FATF (2011) Organised Maritime Piracy and Related Kidnapping for Ransom, FATF, Paris, www.fatf-gafi.org/publications/methodsandtrends/documents/organisedmaritimepiracyandrelatedkidnappingforransom.html

FATF (2010) Money laundering vulnerabilities of Free Trade Zones, FATF, Paris, www.fatf-gafi.org/publications/methodsandtrends/documents/moneylaunderingvulnerabilitiesoffreetradezones.html

FATF (2008) Typologies report on Proliferation Financing, FATF, Paris, www.fatf-gafi.org/publications/methodsandtrends/documents/typologiesreportonproliferationfinancing.html

FATF (2002) Guidance for Financial Institutions in Detecting Terrorist Financing, FATF, Paris, www.fatf-gafi.org/publications/fatfrecommendations/documents/guidanceforfinancialinstitutionsindetectingterroristfinancing.html

APG (2012) Trade-based money laundering, APG, Sydney, www.fatf-gafi.org/publications/methodsandtrends/documents/trade-basedmoneylaunderingtypologies.html

NCA (nd) Joint Money Laundering Intelligence Taskforce, National Crime Agency, London www.nationalcrimeagency.gov.uk/about-us/what-we-do/economic-crime/joint-money-laundering-intelligence-taskforce-jmlit, accessed May 2016.




http://www.fatf-gafi.org/publications/methodsandtrends/documents/trade-basedmoneylaunderingtypologies.html


















http://www.fatf-gafi.org/publications/fatfrecommendations/documents/bpp-combating-abuse-npo.html






UNSC (2016) Challenges business entities face in implementing Security Council resolution 2199 (2015), United Nations Security Council, New York,https://www.un.org/sc/suborg/en/sanctions/1267/monitoring-team/reports. See Document S/2016/213.(UN SC, 2016)

UNSC (nd) Consolidated United Nations Security Council Sanctions List, United Nations Security Council, New York https://www.un.org/sc/suborg/en/sanctions/un-sc-consolidated-list

US DOS (2016) Illustrative List of Oil Drilling and Refinery Equipment, US Department of State, Washington, www.state.gov/e/enr/c71196.htm


http://www.state.gov/e/enr/c71196.htm

https://www.un.org/sc/suborg/en/sanctions/un-sc-consolidated-list

https://www.un.org/sc/suborg/en/sanctions/1267/monitoring-team/reports

detecting terrorist financing · web viewdetecting terrorist financing (tf) activity is necessary...

Documents