COMMENTARY: Terrorist financing: What is it and how is it identified?  



Martin Woods, Thomson Reuters

The actions of a group of organised individuals in Paris on November 13 amounted to perhaps the most deadly and significant terrorist incident since 9/11. This is not to suggest that the attacks in Madrid in 2004 and London in 2005 were in any way less significant. It is the presence of other factors, and in particular the rise of Islamic State (IS), the war in Syria and the refugee crisis, which contribute to the notoriety of November 13, 2015.

The attacks took place the day before a meeting of the G20 to discuss and hopefully resolve the conflict in Syria, and followed what has now been confirmed as a terrorist attack on a Russian passenger airliner in Egypt on October 31. More people died in the bombing of this plane, but such attacks are not necessarily measured in the number of deaths. 

The attacks in Paris have heralded calls for more measures to be taken to counter the militants and prevent more attacks. Central to this is finance: how terrorism is financed; how militants acquire weapons; how they pay for travel costs; and ultimately how banks and other businesses, both regulated and unregulated, may be able to provide vital intelligence which may prevent further attacks. 

The Financial Action Task Force (FATF) has highlighted a need for more counter-terrorist finance (CTF) training. The G7 nations have expressed anxiety about IS using crypto-currencies such as bitcoin to fund terrorist activity, and are reportedly keen to apply tighter regulations to crypto-currencies. All these reactions help to illustrate to important role which the financial services industry can place in CTF. 

What is terrorist financing?

This may not be as straightforward a question to answer as might initially be thought; there are varying definitions, but it is universally accepted that terrorist financing extends beyond payments for the final logistics of an attack. Terrorist financing incorporates lifestyle payments, including rent, food, utility bills, travel costs for reconnaissance, training and planning meetings with fellow militants. What patterns of financial activity tend to generate red flags which, either individually or, as is more likely, collectively, may indicate terrorist activity?

It is difficult to identify any single transaction as a suspicious indicator of terrorist financing. Anyone who determines to misrepresent the facts, fail to tell the truth, or to use false or forged documents may of course be a terrorist financier; equally, he/she could be a fraudster or a money launderer. As a result, the importance of due diligence, of "know your customer" and of scrutiny at the initiation of a new relationship, or the provision of a new service/product, and in particular a loan, has never been greater. Simply put, it is easier to detect, deter and frustrate terrorist financiers, money launderers and fraudsters at the beginning of a relationship than it is when such a relationship has started. 

Red flags

Practitioners can identify red flags by analysing the financial activity of militants, and specifically the kinds of financial activity that often precede an attack. In the case of the Paris attackers, a number of transactions might potentially have generated red flags:

  • They were heavily armed with automatic weapons and explosives, which are likely to have been purchased from a black market/criminal supplier for cash.


  • They had booked three hotel rooms in Paris; once again, these were almost certainly paid for in cash.


  • It has been reported they were using a safe house. How this was paid for is not yet known.


  • In respect of the suicide bombers at the Stade de France, it has been reported that at least one of the attackers had a ticket for the game.


  • They used at least three hire cars, which would not ordinarily be paid for in cash, as substantial deposits are generally required.

Other than the purchase of the weapons and explosives, none of the transactions listed above, assessed in isolation, would be suspicious. Taken collectively, however, the costs begin to mount up. Media reports have suggested one of the militants had recently obtained a loan of €6,000 from a regulated financial firm/bank. The acquisition of finance has been and continues to be a perpetual challenge for militants. It is unknown whether the entire €6,000 was drawn down in cash, but it is probable the majority of this sum, perhaps more, would have been required to purchase the weapons and explosives alone. 

Historic lessons

Analysis of previous terrorist attacks and conspiracies has revealed other financial transactions which, when considered as a pattern, may represent the financial footprint of a militant. Historically, many militants and/or would-be jihadi fighters have sought to secure low-value (i.e., below €10,000) loans or credit facilities (credit/debit cards) before travelling abroad. Some have needed to purchase visas or even passports. Additionally, preparations for attending a terrorist training camp can include the purchase of camping equipment, outdoor clothing and living products as well as survival books.

Further back still in the process, the online activity of suspects has commonly revealed the purchase of books from unusual sources — often radical religious or political books. Suspects have purchased new mobile telephones, airline tickets or other forms of cross-border transport. Then, and perhaps most significantly, all their financial activity has suddenly stopped. Accounts, and credit or debit cards, are suddenly no longer used: it is as though the customer has disappeared. Where has he/she gone; what has happened to them? In some cases, investigations have revealed that the cessation of banking activity could be explained by the customer having travelled to a training camp. 

The need for funding 

There was a time when would-be jihadists had to pay a fee of £4,000 to attend a training camp in Pakistan, hence the need for a loan. One terrorist suspect was found to have unsuccessfully applied for multiple loans and credit facilities. In his desperation to secure the requisite funds to attend a training camp he set fire to his own car and sought to claim a payout from his insurance company. 

Funding is vital to the militant and it is commonly obtained through low-value frauds committed against regulated financial service businesses. There is never any intention of repaying the money, as to do so would be wasting funds which could instead be spent on terrorist activity. 

Historic investigations have also revealed that, before an attack, militants commonly carry out reconnaissance of intended targets, incurring travel costs and leaving financial and digital footprints at the scene. Militants are aware such activities can provide financial intelligence, as they too conduct retrospective investigations to identify why an attack/planned attack failed and how others succeeded. Nevertheless, their options are limited, and financial activity remains an Achilles heel: it is a necessity, but it simultaneously poses a risk of discovery, capture and, ultimately, conviction. 

Red flags

The financial services industry can therefore play a critical role in the fight against terrorism. Practitioners need to look for aggregated data of:

  • Unusual online purchases (none of which can be accomplished with cash).


  • The purchase of a passport.


  • The purchase of a visa.


  • Geographically unusual transactions, such as the purchase of petrol or food in a remote holiday/camping place, where they may have been attending a preparatory domestic militant training camp.


  • The purchase of outdoor/camping equipment, which may be reflected in financial transactions with known retailers.


  • The purchase of airline tickets.


  • The hiring of a car(s).


  • The purchase of petrol in a remote area, some distance away from a customer's home.


  • Loan applications.


  • The withdrawal of a large sum of cash or a series of substantial withdrawals.

Such activities may then be followed by a complete lack of activity from the customer for some time. One of the most significant suspicious transactions will then be the recommencement of account activity. This may indicate he/she is back, he/she has returned home, perhaps with to the intention of carrying out a domestic attack. At this point, the risk factors have substantially increased, and this is when a suspicious activity report might potentially have optimum impact. 

Cooperation between financial crime professionals and law enforcement agencies

This shows how valuable it can be for financial crime practitioners to have, and to use, such knowledge, and to monitor accounts for some of the activities outlined above. It is not easy: quite where does a bank begin with this process, and how does a bank identify one account/customer or group of customers as the relevant group to monitor? 

Nevertheless, there have been some instances of outstanding cooperation and investigation between the financial services industry and law enforcement agencies, some of which have prevented, and continue to prevent attacks.

The investigation into the July 2005 attacks in London revealed that at least one of the attackers was known to the security services and had featured in previous, unconnected, surveillance but had not become the subject of surveillance in his own right. The security services and the police have limited resources, and cannot be everywhere, all of the time, monitoring all suspects or potential suspects; they need help from the financial services industry.

Law enforcement agencies and governments perhaps need to rethink the way they work with financial services professionals, to ensure that they make the best use of monitoring activities and to coordinate counter-terrorist efforts across the world. The police and security services have a wide range of powers to monitor suspects' accounts and other financial activities. It has been reported that failed attempts to use liquid bombs on transatlantic airlines in 2006 were the subject of continuous real-time financial monitoring. One dedicated financial crime professional was said to have taken his sleeping bag and flask (yes, outdoor camping equipment) to the office, such was his and his bank's commitment supporting to the police investigation. 

During the London riots of 2011, all police leave was cancelled and the assistance of former and retired police officers was requested. The authorities may wish to consider engaging the many former and retired police officers working in the financial services industry to assist with the monitoring of named suspects. This already takes place on a limited basis, and some financial crime professionals have been cleared by the security services to receive and use sensitive information, which they can then monitor and report upon. Perhaps this scheme could be extended.

Real-time information can be invaluable

If the Paris attacks are played back, the real-time provision of information about a terrorist suspect (to have been identified so quickly some, perhaps all, of these suspects must have been known to the authorities) then the hiring of a car in Belgium could potentially have alerted the authorities and even have prevented this attack. Border authorities could have circulated the details of the car and it could have been intercepted. Paris has reminded us that we remain at risk, and that our monitoring, our collaboration and our acquisition and use of real-time financial data all need to improve significantly.