The Charity Commission's sector risk assessment of 18 August 2026 counts what its terrorism, extremism and state threat team did in 2025 to 26: 656 disclosures to police and other agencies, 7 disqualification orders and 29 official warnings. Anti money laundering (AML) law reaches a charity from two sides, its own rulebook and its bank's.
Why are charities used to launder money and finance terrorism?
Charities move money on trust to places banks rarely see. FATF Recommendation 8 names three ways terrorists abuse that trust: posing as legitimate organizations, using real ones as conduits, including to escape asset freezes, and hiding the diversion of funds raised for legitimate purposes (FATF Recommendations, R.8, revised October 2023 and unchanged in the June 2026 edition). Its interpretive note adds that "the majority may represent low risk" (para 6).
The UK's 2025 national risk assessment rates the money laundering risk in nonprofits low, though "risen within the 'low' banding", a change put down to better data (para 5.177). Terrorist financing risk is low too. Charities in or near conflict zones face significantly greater exposure (para 5.181). The US 2024 National Terrorist Financing Risk Assessment finds that "the vast majority of U.S. charitable NPOs have little exposure to TF" and that typologies have "shifted from abuse of legitimate charities to sham charities and fraudulent charitable appeals".
Non profit money laundering often starts as plain charity fraud. In January 2025 Rajbinder Kaur received a sentence of two years and eight months for money laundering and six counts of theft, totaling £50,000 in donations to Sikh Youth UK (NRA 2025, Box 5.H). Terrorist financing runs the other way: clean donations reach a group through a sham charity or a partner abroad.
Do AML rules apply to charities and NGOs?
| Rulebook (in force, November 2026) | The NGO's own rules | Is the NGO an AML obliged entity? | The bank's rules for NGO customers |
|---|---|---|---|
| FATF | R.8 and its interpretive note (revised October 2023) bind countries, not NGOs | No: "NPOs are not reporting entities" (INR.8 para 5(e)) | R.10 customer due diligence; FATF Best Practices on NPOs (November 2023) paras 122 to 128 |
| EU | National charity and association law; EU sanctions regulations; beneficial owner information under Directive (EU) 2015/849 art. 30(1), and AMLR art. 63 from 10 July 2027 | No: not in the AMLR art. 3 list | Directive (EU) 2015/849 art. 13 until 9 July 2027, then the AMLR; EBA/GL/2023/03 NPO annex; AMLR recital 53 |
| UK | Charities Act 2011 (England and Wales): inquiries (s. 46), official warnings (s. 75A), suspension of trustees and interim managers once an inquiry is open (s. 76), disqualification, including counter terrorism designated persons (s. 178, Case J); Terrorism Act 2000 s. 19 duty to disclose | No: not in the MLRs reg. 8(2) list | MLRs regs 27, 28 and 33 |
| US | OFAC regulations: a full record of each transaction kept at least 10 years (31 CFR 501.601) | No: the Joint Fact Sheet (19 November 2020) treats charities as bank customers | 31 CFR 1020.210; 1010.230(e)(3)(ii), control prong only for a nonprofit corporation or similar entity that filed its organizational documents with the state; SARs under 1020.320 |
| Türkiye | Law 5253 on associations, as amended by Law 7262 (Official Gazette, 31 December 2020): annual declaration by the end of April, audits each year by risk and at most three years apart (art. 19); notice before aid from or to abroad, cash aid from abroad through banks (art. 21); income and payments above a line set at 7,000 TL and revalued each year through banks, other financial institutions or PTT, or a fine on the managers of up to 10% per transaction (art. 32(u)); Law 6415 asset freezes | No | Law 5549; Measures Regulation art. 8, identification of associations and foundations |
| UAE | Federal Decree by Law No. 10 of 2025 art. 16 (supervisors assess and inspect nonprofits) and art. 17 (warning, fines of AED 10,000 to 5,000,000 per violation, suspension of directors, without prejudice to a more severe sanction in other law); Cabinet Resolution No. 134 of 2025 art. 34 (risk based measures approved by the supervisor, accountability policies, regulated channels whenever possible; also binds persons acting for a nonprofit) | Not a reporting entity (Decree by Law art. 18 covers financial institutions, DNFBPs and VASPs), but supervised, with duties of its own | The Decree by Law and CR 134 due diligence articles |
Five of the six rulebooks answer no: a charity is a customer of the AML system, not part of it. The UAE is the exception. There a nonprofit's supervisor can fine it AED 10,000 to 5,000,000 per violation (Decree by Law art. 17(1)(b)).
The duty to report terrorist financing suspicion is wider. In the UK it binds anyone outside the regulated sector who forms the suspicion from information met at work (Terrorism Act 2000 s. 19). US agencies add that there is "no regulatory requirement in the CDD rule, nor is there a supervisory expectation, for banks to have unique, additional due diligence steps for charities" (Joint Fact Sheet).
What AML and KYC checks must a charity run, and what does its bank check?
| Check (in force, November 2026) | What the charity does | What its bank does | Source |
|---|---|---|---|
| Partners and grantees | Due diligence and end use monitoring, more effort where risk is higher | Understands governance, funding, objectives, beneficiaries, expected transactions and countries | Charity Commission chapter 2 s. 3.1; EBA annex para 1(a) to (f) |
| Owners and controllers | Holds its trustee and beneficial owner information | Identifies trustees and controllers; KYB and UBO verification follows owners up the chain until natural persons are reached | Directive (EU) 2015/849 art. 30(1); EBA annex para 1(a); 31 CFR 1010.230; Measures Regulation art. 8 (Türkiye) |
| Sanctions | Checks the relevant countries' lists of proscribed organizations and designated persons, as good practice | Screens the charity, its trustees and its payees | Chapter 2 s. 10.3; OFAC regulations |
| Records | Accounting records at least 6 years (charities in England and Wales that are not companies); OFAC transaction records at least 10 years (US) | Customer and transaction records under its own AML law | Charities Act 2011 ss. 131, 135; 31 CFR 501.601 |
| Suspicion | Reports crime to the police; reports unverified or suspicious donations of £25,000 or more to the Commission, as a guide | Files a suspicious transaction or activity report | Terrorism Act 2000 s. 19; chapter 2 s. 5.5 |
| Humanitarian exemption | Keeps evidence that work in a sanctioned country fits the exemption | Obtains evidence giving reasonable assurance that the exemption or a derogation applies | UNSCR 2664; Regulation (EU) 2023/331; EBA annex para 4 |
The two columns ask for the same evidence from different seats. The charity collects it on its partners and donors; the bank collects it on the charity. One file per partner, with the check, the date and the result, answers both the trustees and the bank's questionnaire.
Chapter 2 of the Commission's compliance toolkit sets the UK rule of thumb: "the greater the risks, the more charity trustees have to do" (s. 3.1). A conflict zone grantee's file runs thicker than a local supplier's.
Must a charity screen partners and donors against sanctions lists?
No UK statute orders a list check, but asset freeze rules forbid making funds available to a designated person. The Commission calls it good practice, "as a minimum", for trustees of charities working overseas to check the relevant country's lists of proscribed organizations and designated persons, with more lists, checked more often, as risk rises (chapter 2 s. 10.3).
Picture a charity funding a clinic through a local partner. It screens the partner, its directors and the main suppliers before the first transfer and again when lists change. Know your donor checks do the same for income.
What does a bank ask a charity for at onboarding?
EU banks follow the EBA's NPO annex of 31 March 2023. Para 1 asks a bank to understand who controls the charity, how it is funded, what its operations aim to do, who benefits, which transactions it will request, and where it operates, down to the countries where staff are paid. A charity and NGO KYC form collects the core of that: registration, trustees, main funders and where programs run.
US banks ask less on ownership. A nonprofit corporation or similar entity that filed its organizational documents with the state gives the control person only (31 CFR 1010.230(e)(3)(ii)).
Which red flags point to a charity being misused?
One flag is a reason to ask, not proof. Each comes from a regulator or standard setter.
- No visible charitable work. Donations solicited with no charitable services in sight (FinCEN alert of 20 October 2023, in NTFRA 2024).
- A partner later designated. A fundraising partner or channel is later sanctioned (Charity Commission, 19 April 2024).
- A designated founder, funder or trustee. A counter terrorism designation disqualifies a trustee (Charities Act 2011 s. 178, Case J).
- Vouchers and money service businesses. Payments through voucher schemes or money service businesses, flagged for weak transparency (CSRA 2026).
- Cash loans repaid by transfer. Interest free cash loans from members, repaid by bank transfer (UK NRA 2025 para 5.178).
- Connected businesses. Close connections between the charity and connected businesses and companies (para 5.178).
- Cash, crypto or crowdfunding. Funding that relies entirely or largely on these (EBA annex para 2(h)).
- High risk donors. Donors in higher risk jurisdictions or EU high risk third countries (para 2(i)).
- Intermediaries it cannot oversee. Conflict zone work through third parties the charity cannot monitor (para 2(j), (k)).
- Informal transfers. Hawala or similar channels where banks are absent (NRA para 5.183).
- New or linked to extremism. Set up in the last 12 months, or linked to extremism by reliable sources (EBA para 2(d), (e)).
- Loose grants. No written grant agreement, one large payment, no disclosure of how funds are used (OFAC risk matrix, high risk column).
Which charities were sanctioned or investigated since 2024?
The Kantor inquiries show how a designation reaches a charity. In April 2022 the UK designated Dr Kantor under its Russia regime; he was the two foundations' sole donor. That month the Commission opened inquiries and froze the charities' bank accounts. It found him responsible for "misconduct and/or mismanagement" for not resigning after the designation and for not cooperating. Interim managers granted £1,388,000 to other charitable causes (Charity Commission, 22 April 2026).
The US record is designations. OFAC calls the targets below sham charities, fronts or fraudulent organizations. Its civil penalty lists for 2023 to 2025 name no charity.
| Date | Authority | Target | Action |
|---|---|---|---|
| 19 April 2024 | Charity Commission | Funds raised by and for Aozma Sultana, a UK designated person | Statutory inquiry under s. 46, opened 28 March 2024; she is automatically disqualified as a trustee (release) |
| 15 October 2024 | OFAC, jointly with Canada | Samidoun | Designated as a sham charity raising funds for the PFLP (release) |
| 10 June 2025 | OFAC | Five charities abroad: Filistin Vakfi (Türkiye), Israa Charitable Foundation (Netherlands), La Cupola d'Oro (Italy), El Baraka (Algeria), Al Weam (Gaza); and Addameer (West Bank) | Designated for funding Hamas's military wing; Addameer for links to the PFLP (release) |
| 21 January 2026 | OFAC | Six organizations in Gaza that claim to provide medical care | Designated for supporting Hamas's military wing (release) |
| 12 March 2026 | OFAC | Four nonprofits: three based in Türkiye, among them Hayat Yolu, and KNRP (Indonesia) | Designated as sham charities funding Hamas's military wing (release) |
| 22 April 2026 | Charity Commission | Kantor Foundation and Kantor Charitable Foundation | Inquiry outcome published: misconduct and/or mismanagement by the designated funder; both charities wound up; £1,388,000 granted to other causes |
| 23 July 2026 | OFAC | Madad Palestine Charitable Society (Gaza), Tujah Bulah Global (Indonesia) | Designated as fronts created by Hamas to raise funds for its military wing (release) |
| 2 October 2026 | OFAC | Association Baraka and Ensemble C Mieux (France) | Designated as charity fronts that raised public donations for Hamas (release) |
What does FATF Recommendation 8 say about de-risking charities?
Picture a charity that pays a water project's contractors in a conflict area. Its bank holds two transfers for weeks, then gives notice to close the account. The charity's fallback is cash carried by staff or an informal transfer. That is de-risking, and the rules try to prevent it: the UK assessment notes it can push nonprofits toward cash and less regulated money service businesses (NRA 2025 para 5.183).
Recommendation 8, revised in October 2023, asks countries for focused, proportionate measures "without unduly disrupting or discouraging legitimate NPO activities". The FATF's Best Practices paper of November 2023 speaks to banks directly: "Financial institutions should not view all NPOs as high risk" (para 123). Ending relationships with whole classes of customers without regard to their actual risk is "not consistent with the FATF Standards" (para 114).
On 10 July 2025 the FATF added a procedure for cases where countries misapply its NPO standards. The US Treasury's de-risking strategy of April 2023 cites a 2017 survey in which two thirds of nonprofits with international operations had trouble getting financial services, 15 percent regularly, and a 2020 survey in which about 62.5 percent reported difficulties.
Can a bank close a charity's account because it works in a high risk country?
Not for the country alone. The EU AML Regulation, which applies from 10 July 2027, says the operation of civil society organizations in such jurisdictions "should not, alone, result in the refusal to provide financial services or termination of such services" (recital 53). Until then, the EBA annex asks banks serving nonprofits in sanctioned regions for evidence that a humanitarian exemption or a derogation covers the work (para 4).
That exemption comes from UN Security Council Resolution 2664 of 9 December 2022, which the EU carried into its UN based regimes (Regulation (EU) 2023/331) and OFAC into general licenses issued or amended on 20 December 2022 (FAQ 1105). A bank may still exit, case by case, where the terrorist financing risk cannot be mitigated (FATF Best Practices para 116), after weighing safeguards such as consent regimes or approved payment routes (para 126).
Which rule changes since 2024 matter to charities, and what is due in 2027?
- 18 January 2024. Türkiye's Constitutional Court (E. 2021/28, K. 2024/11) annuls Law 5253 art. 30/A (removal of officials, suspension of activity) and parts of art. 19, with effect from 3 April 2024 and 1 March 2025 (art. 30/A and a sentence of art. 19's second paragraph from the later date).
- 10 July 2025. The FATF adopts its procedure on unintended consequences for nonprofits.
- 17 July 2025. The UK keeps nonprofit risk low, money laundering risen within the band.
- 14 December 2025. Nonprofit duties in art. 34 of the UAE's Cabinet Resolution No. 134 of 2025 apply as the resolution takes effect (art. 71).
- 22 April 2026. The Commission publishes the Kantor inquiry outcome.
- 18 August 2026. The Commission flags vouchers and money service businesses.
Next: from 10 July 2027 the AMLR applies; art. 63 makes every legal entity created in the EU hold beneficial owner information and report it to the central register.
What goes in a charity's AML and sanctions file in 2026?
The last column marks where complead, formerly Sanction Scanner, fits; "outside the platform" is governance work that stays with the charity or the bank.
| Line (in force, November 2026) | Source | Where complead fits |
|---|---|---|
| Risk based measures against terrorist financing, by country and program, approved by the supervisor where the law asks (UAE) | CR 134 art. 34(1)(a); Charity Commission chapter 2 s. 3.1 | Outside the platform |
| Trustee eligibility and disqualification checks | Charities Act 2011 s. 178; Law 5253 art. 3 | Trustees screened like any other party |
| Partner due diligence and end use monitoring scaled to risk | Charity Commission chapter 2 | Partners and their directors screened; site visits and reports outside the platform |
| Sanctions screening of partners, suppliers, donors and trustees, repeated when lists change | Chapter 2 s. 10.3; OFAC regulations; Law 6415 (Türkiye) | 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes |
| Written grant agreements with safeguards and suspension clauses | OFAC risk matrix | Outside the platform |
| Regulated payment channels, cash by exception | CR 134 art. 34(1)(d); Law 5253 art. 32(u), added by Law 7262 | Outside the platform |
| Notice to the local governor's office before aid goes abroad (Türkiye) | Law 5253 art. 21 | Outside the platform |
| Humanitarian exemption evidence on file | Regulation (EU) 2023/331; OFAC FAQ 1105 | Outside the platform |
| A route for suspicious donations to the police and the regulator | Chapter 2 s. 5.5; Terrorism Act 2000 s. 19 | Reporting support within case management |
| Records: 6 years (charities in England and Wales that are not companies), 10 years for OFAC regulated transactions | Charities Act 2011 s. 131; 31 CFR 501.601 | Every screening search recorded with who searched, what, when and the result, including searches with no match |
| Beneficial owner information held and filed | Directive (EU) 2015/849 art. 30; AMLR art. 63 | Outside the platform |
| Bank pack ready: governance, funding, objectives, beneficiaries, transactions, countries | EBA annex para 1 | Outside the platform |
| Bank side: a documented risk assessment per NPO customer; exits case by case where the risk cannot be mitigated | FATF Best Practices paras 116, 124; AMLR recital 53 | Every alert shows which rule fired and which signals matched; the record shows who decided |
Which of these checks can complead run for a charity or its bank?
complead runs the screening rows of that file for a charity or its bank.
An API call starts monitoring on a new grantee and another stops it when the grant ends. The search log keeps who ran each check, on which name, when and with what result, no match results included. Client screening and ongoing monitoring checks those names, and the lists behind each check are 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
The EBA annex's reputation questions are what adverse media screening and monitoring answers. On the bank side, payment screening checks both parties to a transfer, sender and receiver, while the payment is processed. Agents close routine cases themselves. Each carries its evidence, a narrative and a work log; an analyst takes the rest, and the case record names who decided.
This week: list every partner paid in 2026 with the date it was last screened; name who reports a suspicious donation, and to whom; and ask your bank which items of the EBA annex it still needs.
The 2026 PDF edition. Every rule, flag and case is on this page. The PDF from the form beside it holds five templates to fill in: a charity side checklist by jurisdiction, the onboarding pack a bank asks a charity for, a partner screening log with rescreen dates, a humanitarian exemption evidence sheet and an exit decision record for banks. Each legal line was checked on 4 November 2026 against the text then in force on legislation.gov.uk, the eCFR, EUR-Lex, mevzuat.gov.tr, the UAE's official English texts and the FATF's own papers.
