Three dates frame the rules a compliance team works under today.
- 9 December 1999. The UN's International Convention for the Suppression of the Financing of Terrorism is concluded in New York. Its Article 2 defines the offense.
- 28 September 2001. UN Security Council resolution 1373 decides that every state shall criminalize terrorist financing and freeze terrorist funds without delay.
- 23 June 2026. FATF updates Recommendation 6 so that asset freezes respect the humanitarian exemption in Security Council resolutions 2664 and 2761.
The core offense has not moved since 1999. Money from any source, given for a terrorist purpose, is a crime, and designated funds are frozen. The detail keeps moving: which channels regulators name, which resolutions a freeze covers, where humanitarian aid is exempt.
Terrorist financing runs through the same banks, remittance firms and wallets as the money laundering methods and typologies your team already monitors. It asks a different question of the data.
What is terrorist financing?
Terrorist financing is the provision or collection of funds, by any means, directly or indirectly, with the intention or the knowledge that they will be used to carry out a terrorist act. That is the offense in Article 2(1) of the 1999 Convention. Article 2(3) closes the obvious gap: "it shall not be necessary that the funds were actually used to carry out an offence".
FATF Recommendation 5 widens the scope to the financing of terrorist organizations and individual terrorists, "even in the absence of a link to a specific terrorist act or acts" (FATF Recommendations, updated June 2026). Security Council resolution 2462 of 28 March 2019 says the same at paragraph 5, and adds that the funding can be for any purpose, "including but not limited to recruitment, training, or travel".
So the source of the money does not matter. FATF's interpretive note extends the offense to funds "whether from a legitimate or illegitimate source". A salary qualifies. So does a donation.
Picture a salaried customer who sends 200 dollars a month to an online appeal, knowing the organizer passes the money to a designated group. The figures are illustrative. Her income is clean and every payment is small. No attack follows, and it is still terrorist financing.
Counter terrorist financing (CFT) is the response: the laws, standards and controls that prevent, detect and report terrorist financing. In a regulated firm it covers customer due diligence, screening against terrorist designations, transaction monitoring, freezing designated funds and reporting suspicion to the financial intelligence unit. It usually sits beside AML in one AML/CFT policy, the pairing the FATF standards carry in their own title. The detection logic is its own.
How is terrorist financing different from money laundering?
Money laundering hides where money came from. Terrorist financing hides where money is going.
Origin against destination. Laundered money is criminal proceeds, so you ask whether the funds fit the customer. Terrorist financing often starts as clean money moving toward a criminal purpose, so you ask where the funds end up.
Amount. The 9/11 Commission's monograph on terrorist financing calls the 400,000 to 500,000 dollars spent on the September 11 attacks "a relatively small amount of money". FATF's 2025 update describes lone actors who rely on microfinancing drawn from licit sources and petty crime.
Direction of the investigation. A laundering case traces money back to a crime. A terrorist financing case traces money forward to a person or a purpose, often before anything has happened.
The two overlap. A group that raises money through extortion has proceeds to launder, which is why one AML/CFT program covers both.
How do terrorists raise, move, store and use money?
Table 1. Terrorist financing by stage. Channels: FATF, update on terrorist financing risks (8 July 2025), and FinCEN, advisory on the financing of ISIS (1 April 2025). The last two columns are the reading of Complead, formerly Sanction Scanner, for a compliance team.
| Stage | Channels regulators name | What a bank or fintech sees | Control that usually catches it |
|---|---|---|---|
| Raise | Donations and crowdfunding, abuse of nonprofits, legitimate income, extortion, kidnapping for ransom | Many small transfers from unrelated senders; fundraisers on social media | Aggregation and velocity rules; nonprofit due diligence; adverse media screening |
| Move | Cash couriers, hawala, money services businesses, banks, online payments, virtual assets | Remittances to unrelated people in high risk jurisdictions; a sudden switch to P2P, prepaid cards or crypto | Screening the sender and receiver of each payment; corridor rules |
| Store | Bank accounts, shell companies, trusts, wallets, cash | Funds parked in entities with unclear owners; a dormant account that wakes up | Beneficial ownership checks; screening of owners; ongoing monitoring |
| Use | Travel, accommodation, cash withdrawals, everyday purchases | One card booking travel for several unrelated people; cash advances; ATM use where the customer has never been | Card and ATM monitoring; escalation to a suspicious activity report |
FATF's July 2025 update names four verbs: raise, move, store and use. Store covers value parked in accounts, companies, trusts and wallets between the raise and the use. That row is where client screening and ownership checks do their work.
Most of the money still moves through ordinary financial services. The US Treasury's 2024 National Terrorist Financing Risk Assessment found that terrorists "still prefer traditional financial products and services". Money services businesses filed nearly 72 percent of US suspicious activity reports related to terrorist financing between 2020 and 2022, with a reporting threshold of 2,000 dollars against 5,000 dollars for other institutions (page 16).
FinCEN's 2025 advisory says ISIS still frequently uses cash couriers, and also banks and money services businesses, especially hawalas, unregistered money transmitters and digital asset exchanges. The hawala entry explains how brokers settle and what a program can still see.
What are the red flags of terrorist financing?
Both regulators quoted here open with the same warning. FinCEN: "no single red flag is determinative of illicit or suspicious activity". AUSTRAC: "On their own, one of these indicators may not suggest suspicious activity". Treat a red flag as a reason to look at the customer's history. It is not a verdict.
The list below takes items 1 to 5 from FinCEN's ISIS advisory and items 6 to 9 from AUSTRAC's indicators for nonprofit customers (last updated 25 March 2026), with one line on why each matters.
- One card or account books travel or accommodation for several unrelated people at once in an area of known ISIS activity. Why: ordinary spending rarely pays for strangers' travel.
- Small sums collected through P2P transfers, social media or virtual currency, then sent on as one lump sum to a region where ISIS is prevalent. Why: the raise and the move happen in one account within days.
- Remittances with no known legitimate purpose to several unrelated people in jurisdictions known for ISIS facilitation. Why: the sender has no visible tie to the recipients.
- A sudden hunt for credit, with new cards used almost only for cash advances and virtual currency, then left unpaid. Why: the customer does not expect to repay.
- Local deposits withdrawn abroad, or one account accessed in several countries at once or within a very short time, where ISIS is prevalent. Why: someone else, somewhere else, is using the account.
- A nonprofit operating in jurisdictions with known terrorist activity, or headquartered where terrorist entities have a substantial presence. Why: the work there may be legitimate, so the test is whether the money matches the declared programs.
- A nonprofit paying third parties unrelated to its declared programs, or using a shell organization as a funding conduit. Why: the gap between stated purpose and actual payees is the signal.
- A nonprofit procuring dual use goods, or matched against a sanctions list. Why: both point to a legal prohibition, not only to unusual behavior.
- Open source information linking the customer to known terrorist organizations. Why: adverse media screening finds this, and the transactions rarely show it.
FinCEN asks filers to weigh the customer's history and whether several flags appear together before deciding that activity is suspicious.
What do crypto red flags look like?
FATF's virtual assets red flag indicators of 14 September 2020 are its crypto list, built from more than 100 case studies. The 2024 US assessment says certain groups, Hamas among them, are experimenting with virtual assets, and that terrorists still prefer traditional products. FinCEN adds one pattern: crypto placed in a wallet from an IP address in one location, then cashed out by users elsewhere where ISIS is prevalent. If a customer hands you a wallet address, you can check it first with the free crypto wallet risk check. How each market licenses the providers that hold those wallets is compared in cryptocurrency regulations by country.
What do FATF Recommendations 5 to 8 require?
FATF's introduction names Recommendations 5, 6 and 8 as the ones "unique to terrorist financing". Recommendation 7 covers proliferation. The rest of the terrorist financing standard is spread through the general Recommendations on due diligence, record keeping and reporting. All 40 Recommendations, and how countries are rated against them, are explained in the FATF Recommendations guide.
Recommendation 5 requires countries to criminalize terrorist financing on the basis of the 1999 Convention, including the financing of organizations and individual terrorists with no link to a specific act.
Recommendation 6 requires targeted financial sanctions. Countries freeze, without delay, the funds of persons designated by the Security Council, including under resolution 1267 and its successors, and of persons a country designates under resolution 1373.
On 23 June 2026 FATF amended Recommendation 6 to require compliance with the humanitarian exemption in resolutions 2664 and 2761, as well as 2615. The interpretive note leaves the method to each country and names exemptions, general licenses and legislative carve outs among the options. The duty to freeze without delay stays.
Recommendation 8 covers nonprofit organizations. Its October 2023 revision asks for focused, targeted and risk based measures that do not unduly disrupt or discourage legitimate nonprofits. Resolution 2462 calls on states to assess nonprofit risk periodically (paragraph 23) and urges them to weigh the effect of their measures on exclusively humanitarian activities (paragraph 24).
What does freeze without delay mean?
For UN designations, FATF's glossary defines "without delay" as "ideally, within a matter of hours of a designation".
Picture a payment firm that loads list updates once a night. A person designated in the morning can move funds all day, and the firm freezes an empty account. The example is illustrative.
What is proliferation financing, and where does Recommendation 7 fit?
Proliferation financing is the financing of weapons of mass destruction and their spread. Recommendation 7 applies targeted financial sanctions to it, with the same freeze without delay. Its interpretive note, as issued in October 2025 after the UN measures on Iran were reapplied, lists resolution 1718 and its successors for North Korea and resolutions 1737, 1747, 1803 and 1929 for Iran. Since an October 2020 revision, Recommendation 1 also asks countries and firms to assess the risk that those sanctions are breached, not implemented or evaded.
The standards are clearer than the results. FATF's July 2025 update found that 69 percent of jurisdictions assessed by FATF and its Global Network had major or structural deficiencies in investigating, prosecuting and convicting terrorist financing. Mutual evaluation results feed the high risk countries and FATF lists that geography rules draw on.
Which laws apply in the US, UK, EU and Türkiye?
Table 2. The terrorist financing offense, freeze and reporting duty by jurisdiction. Sources linked in each row, read 14 October 2026.
| Jurisdiction | Offense | Freezing and lists | Reporting duty |
|---|---|---|---|
| United Nations | Convention Art. 2; resolution 2462, para. 5: funding organizations and individual terrorists for any purpose | Resolution 1373: freeze without delay; the 1267 regime (UN sanctions list) | Set by national law under the FATF standards |
| United States | 18 U.S.C. 2339A, material support for listed offenses (up to 15 years); 2339B, knowing material support to a designated foreign terrorist organization (up to 20 years); 2339C, the Convention offense | OFAC blocks the property of Specially Designated Global Terrorists under Executive Order 13224 and 31 CFR Part 594 (SDN list); 2339B(a)(2): a financial institution retains and reports funds of a designated organization | Suspicious activity report, SAR field 33(a); immediate telephone notice to law enforcement for suspected terrorist activity (31 CFR 1020.320(b)(3)) |
| United Kingdom | Terrorism Act 2000, ss. 15 to 18: fund raising (s. 15), use and possession (s. 16), funding arrangements (s. 17), laundering terrorist property (s. 18) | Asset freezes on the HM Treasury sanctions list | s. 21A: failure to disclose in the regulated sector, up to five years |
| European Union | AMLR (Regulation (EU) 2024/1624) Art. 2(1)(2): the conduct in Art. 11 of Directive (EU) 2017/541 | Asset freezes under Council decisions and regulations (Art. 29 TEU, Art. 215 TFEU), as the AMLR defines targeted financial sanctions | Art. 69: report suspicion "regardless of the amount involved"; applies from 10 July 2027 |
| Türkiye | Law No. 6415 (Official Gazette, 16 February 2013), Art. 4(1): funds for a terrorist or terrorist organization, even without a link to a specific act; 5 to 10 years | Law No. 6415, Art. 1: the freezing procedure for Security Council designations | Suspicious transaction reports to MASAK, the financial intelligence unit, under Law No. 5549, Art. 4 |
The rows differ most on the mental element. Section 2339B requires that the person knew the organization was designated or engaged in terrorism. The UK offense in section 15 is met when a person "has reasonable cause to suspect" the money may be used for terrorism, a lower bar. The EU text lets knowledge or intent be inferred from objective factual circumstances.
The reporting duty is where your team feels the law. A US bank facing suspected terrorist activity that needs immediate attention telephones law enforcement as well as filing a suspicious activity report. In the UK, failing to disclose a suspicion in the regulated sector is itself an offense. In the EU, from 10 July 2027, suspicion is reported regardless of amount, which matters for a crime that runs on small sums. Türkiye's Law No. 6415 puts the offense and the freezing procedure in one statute. The rest of the Turkish regime is in the AML in Türkiye whitepaper.
How do screening and monitoring detect terrorist financing?
Picture a remittance customer with a steady salary. Over three weeks, 14 people he has never dealt with send him between 20 and 80 dollars each through a P2P app. He then sends 900 dollars to a person abroad. The figures are illustrative.
Screening checks the names: the customer, the 14 senders and the recipient. None is designated, so screening is clear. Monitoring checks the behavior: many new senders, one lump sum out, a new corridor. That is red flag 2 above, and an aggregation rule written for it fires. A network search then looks at the recipient. If the recipient shares an address or a phone number with a designated person, the case moves from unusual to reportable. The analyst makes that call, and the case file records it.
Screening answers a list question: is this person, owner or counterparty designated? It runs at onboarding, on every list update and on each payment. Complead screens against 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Sanction Scanner, the screening product, is part of Complead: its sanctions screening runs the list check, and its transaction screening checks both parties to a payment, sender and receiver, through the API while the transfer is still being processed. To see what a list check returns, try the free sanctions check.
Monitoring answers a behavior question: does this activity look like money raised or moved for a purpose? Rules built on large amounts miss terrorist financing, so the useful rules count new counterparties, add up small inflows and watch corridors. The guide to AML transaction monitoring covers the program. The transaction monitoring rules library has aggregation and geography rules to start from. The tools of an AML program carry over to CFT; the rules and the lists do not.
The two meet at the customer. In Complead, onboarding, screening, monitoring, fraud and investigation share one engine, and each customer has one risk score rather than one per tool. The connections graph looks up to six hops out from a customer, by default, for a path to a sanctioned person, a PEP or an adverse media entity, and keeps every hop with its source as case evidence.
Volume decides whether any of this is workable. Moldcell, a Complead customer with 1.5 million users, ran about 100,000 transactions through screening, and about 10,000 of them went to an analyst (the Moldcell case, published July 2026).
From a terrorist financing alert to a report
Detection ends where reporting begins. Once an alert looks like terrorist financing, the questions change: what goes into the report, which field marks it as terrorist financing, and how fast law enforcement hears about it. In the US the answer can include a telephone call as well as a suspicious activity report. In the EU, from 10 July 2027, the amount stops mattering. The SAR and STR filing guide answers those three questions.
