Language selection

Search

Operational alert: Terrorist activity financing

Reference number: FINTRAC-2022-OA001
December 2022

Purpose

The purpose of this Operational Alert is to support reporting entities in recognizing financial transactions suspected of being related to terrorist activity financing. Through financial transaction reports, FINTRAC is able to facilitate the detection, prevention and deterrence of all stages of money laundering (placement, layering and integration) and the financing of terrorist activities by providing actionable financial intelligence disclosures to law enforcement and national security agencies. This Operational Alert provides terrorist activity financing indicators as a result of the analysis of FINTRAC disclosures related to terrorist activity financing.

Background

Terrorist financing provides funds for terrorist activity. Terrorists use techniques like those of money launderers (e.g., structuring, use of nominees) to evade authorities' detection and to protect the identity of their sponsors and of the ultimate beneficiaries of the funds. Like money laundering, funds for terrorist activity financing can be sourced from criminal sources (e.g., drug trade, smuggling of weapons and other goods, fraud, kidnapping and extortion). However, unlike money laundering, funds can be raised from legitimate sources too (e.g., personal donations and profits from businesses and charitable organizations), making the detection and tracking of these funds more difficult. Funds for terrorist activity financing also tend to be in smaller amounts compared to funds in money laundering.

The Government of Canada groups terrorist threats faced by Canada into three broad types of violent extremism: religiously motivated violent extremism (RMVE), politically motivated violent extremism (PMVE) and ideologically motivated violent extremism (IMVE).

Currently, 77 terrorist entities are listed under the Criminal Code and can be found on the Public Safety Canada website. These listings of terrorist entities help safeguard Canada’s financial system from furthering terrorist activity by providing the means to seize/ restrain and/or obtain the forfeiture of property belonging to a listed entity. The newest listed terrorist entities since 2019 have included IMVE-related groups – the first time such groups have been listed in Canada.

The Government of Canada states RMVE, PMVE and IMVE all represent a threat to the security of Canada, and IMVE has grown in presence within Canada in recent years. Since 2014, the Government of Canada notes that Canadians motivated in whole or in part by extremist ideological views have killed and wounded more people on Canadian soil than RMVE or PMVE.

The Government of Canada explains types of violent extremism as:

  • RMVE encourages the use of violence as part of a spiritual struggle against a perceived immoral system. Followers believe that salvation can only be achieved through violence.
  • PMVE encourages the use of violence to establish new political systems, or new structures and norms within existing systems.
  • IMVE is often driven by a range of grievances and ideas from across the traditional ideological spectrum. The resulting worldview consists of a personalized narrative which centres on an extremist's willingness to incite, enable and or mobilize to violence. Extremists draw inspiration from a variety of sources including books, images, lectures, music, online discussions, videos and conversations. These individuals and cells often act without a clear affiliation to a specific organized group or external guidance, but are nevertheless shaped by hateful voices and messages online that normalize and advocate violence.

Source: CSIS Public Report 2020

Overview of FINTRAC’s analysis of disclosures related to terrorist activity financing

FINTRAC analyzed a sample of disclosures from January 2019 to October 2022 related to terrorist activity financing. Based on FINTRAC’s analysis, the transactions disclosed fell into three main themes: domestic terrorism, financing international terrorist groups, and Canadian extremist travellers (CETs). All three types of violent extremism, as identified by the Government of Canada, were observed in FINTRAC’s sampled disclosures, with IMVE and RMVE being the most common.

FINTRAC analyzed its disclosures from the past two years associated to terrorism threats specifically occurring in Canada—that is, the target of terrorism was in Canada (regardless if a terrorism event actually occurred) and is in-line with what Public Safety Canada refers to as domestic terrorism incidents and threats in the Federal Terrorism Response Plan. Among these FINTRAC disclosures, most were related to IMVE. Based on FINTRAC’s analysis, IMVE actors in Canada fell into three sub-categories: lone actors, cross-border networks and organized groups. Lone actors tended to be self-funded, often by payroll, government assistance deposits, and/or cash deposits. Cross-border networks mainly used large money services businesses (MSBs) to transfer funds, along with electronic money transfers (EMTs). These funds were mainly sent to third parties, often in locations of concern for IMVE activityFootnote 1. Organized groups raised funds through a variety of methods, including EMTs, sales of merchandise, and frequent cash deposits. The reference section of EMTs often included particular words, phrases and/or numbers (e.g., years of particular significance to their ideology or numbers that correspond to the group’s name) that linked the transaction to a particular IMVE group. FINTRAC’s analysis revealed that IMVE financing activity involved actors located and operating in Canada. While there were funds being sent overseas to suspected IMVE actors, based on financial transactions analyzed, there were IMVE operations/activities being organized within Canada as well.

FINTRAC found that transactions relating to the financing of international terrorist groups consisted primarily of outgoing funds transfers to another country – particularly to jurisdictions of concern for terrorist activity financingFootnote 2. The jurisdictions of concern most frequently seen in the sampled FINTRAC disclosures included: Iraq, Lebanon, Pakistan, Syria, Turkey, United Arab Emirates, and Yemen. These outgoing international fund transfers, often funded by cash deposits, were conducted by individuals in Canada and primarily involved the use of MSBs.

Within the analyzed disclosures, the most frequently identified international terrorist entity was Daesh, followed by Hizballah. A large portion of the funds suspected of supporting Daesh were sent to Turkey, often to regions or towns close to the Turkey-Syria border, a particular high risk region for terrorist activity financing.

A large portion of funds suspected of funding Hizballah were sent to Lebanon. Funds suspected of funding Hizballah were frequently sent or received by individual/entities referencing sale of cars or listed in the automotive industry.

FINTRAC continues to receive suspicious financial transactions related to the threat of Canadian extremist travellers (CETs). The five phases of CETs identified in FINTRAC’s 2018 Terrorist Financing Assessment remain relevant and were observed in the financial transactions analyzed. The five phases are: Pre-departure, En Route, In Theatre, Returning, and Interrupted travel. FINTRAC observed that CETs in the Pre-departure phase often depleted their accounts prior to travel by way of cash withdrawals. A significant shift from historic account activity was also observed in the accounts of CETs prior to departure from Canada. Individuals in the En Route phase often demonstrated financial activity that included the use of debit or credit cards along known travel corridors to a conflict zone or location of concern. Often, accounts were dormant while the CET is in the In-theatre phase. Use of these accounts would then resume upon the CET’s return to Canada. Additionally, CETs returning to Canada frequently sent and/or received international transfers and received cash deposits from third parties with no clear purpose. The travel of aspiring CETs was sometimes interrupted before they were able to leave Canada. According to publicly available information, this was due to intervention by law enforcement. Among the sampled FINTRAC disclosures, travel-related refunds, such as airline tickets, often occurred in accounts of these disrupted travellers.

Reasonable grounds to suspect and how to use indicators

How reporting entities determine if they submit a suspicious transaction report to FINTRAC (for either a completed or attempted financial transaction) requires more than a "gut feel" or "hunch," although proof of terrorist activity financing is not required. Reporting entities are to consider the facts, the context and terrorist activity financing indicators of a transaction. When these elements are viewed together, they create a picture that is essential to differentiate between what may be suspicious and what may be reasonable in a given scenario. Reporting entities must reach reasonable grounds to suspect that a transaction, or attempted transaction, is related to terrorist activity financing before they can submit a suspicious transaction report to FINTRAC.

Indicators of terrorist activity financing can be thought of as red flags indicating that something may very well be wrong. Red flags typically stem from one or more characteristics, behaviours, patterns and other contextual factors related to financial transactions that make them appear inconsistent with what is expected or considered normal. On its own, an indicator may not initially appear suspicious. However, it could lead reporting entities to question the legitimacy of a transaction, which may prompt them to assess the transaction to determine whether there are further facts, contextual elements or additional money laundering (ML) or terrorist financing (TF) indicators that would increase their suspicion to the point where submitting an STR to FINTRAC would be required (see FINTRAC Guidance on Suspicious Transaction Reports).

Reporting Terrorist Property to FINTRAC

Reporting entities must submit a terrorist property report (TPR) to FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and associated regulations when they are required to make a disclosure under section 83.1 of the Criminal Code or under section 8 of the Regulations Implementing the United Nations Resolutions on the Suppression of Terrorism. A disclosure is required in the following situations: (a) when reporting entities know of the existence of property in their possession or under their control is owned or controlled by or on behalf of a terrorist or a terrorist group; and (b) when reporting entities have information about a transaction or proposed transaction in respect of property owned or controlled by or on behalf of a terrorist or a terrorist group.

For the purposes of the disclosure described above, property is anything owned or controlled by a person or entity, whether tangible or intangible. It includes real and personal property of every description, as well as deeds and instruments that give a title or right to property, or a right to recover or receive money or goods. It also includes any property that has been converted or exchanged, or that has been acquired from any conversion or exchange. Examples of property include cash, monetary instruments, casino products and tokens, virtual currency, bank accounts, prepaid payment products and prepaid payment product accounts, securities, jewellery, precious metals or precious stones, real estate, and insurance policies. Therefore, when such property is owned or controlled by or on behalf of a terrorist or a terrorist group, and is in the possession or under the control of a reporting entity, or a reporting entity has information about a transaction or proposed transaction in respect to such property, the reporting entity must make a disclosure to the RCMP or CSIS and submit a TPR to FINTRAC.

TPRs differ from other reports submitted to FINTRAC because a transaction or attempted transaction does not need to occur for reporting entities to submit a TPR. Instead, the mere existence of property owned or controlled by or on behalf of a terrorist group or information about a transaction or proposed transaction in respect to such property, prompts reporting entities’ obligation to disclose to the RCMP or CSIS, and submit a TPR to FINTRAC. If a transaction was attempted or completed involving the property that reporting entities know is owned or controlled by or on behalf of a terrorist or a terrorist group, then reporting entities should also submit an STR to FINTRAC. For clarity, if reporting entities are not sure but suspect that the property in their possession or control is owned or controlled by or on behalf of a terrorist or a terrorist group, then reporting entities must submit an STR to FINTRAC if there was an attempted or completed transaction associated with this property.

Reporting entities must submit a TPR to FINTRAC immediately once they are required to make a disclosure under the Criminal Code or the Regulations Implementing the United Nations Resolutions on the Suppression of Terrorism. For more information on submitting a TPR, please see Guidance on Reporting Terrorist Property to FINTRAC.

Terrorist Activity Financing Indicators

Below are indicators related to terrorist activity financing derived from FINTRAC’s analysis and reflect the types and patterns of transactions, along with contextual factors, which emphasize the importance of knowing your client. Indicators from FINTRAC’s money laundering and terrorist financing indicators – financial entities and FINTRAC’s Terrorist Financing Assessment 2018 are included below as they remain relevant and should be considered all together.

These indicators should not be treated in isolation; on their own, these indicators may not be indicative of terrorist activity financing or other suspicious activity. They should be assessed by reporting entities in combination with what they know about their client and other factors surrounding the transactions to determine if there are reasonable grounds to suspect that a transaction or attempted transaction is related to the commission or attempted commission of a terrorist activity financing offence. Several indicators may reveal otherwise unknown links that, taken together, could lead to reasonable grounds to suspect that the transaction or attempted transaction is related to the financing of activity related to the commission or attempted commission of a terrorist activity financing offence. It is a constellation of factors that strengthen the determination of suspicion. These indicators aim to help reporting entities in their analysis and assessment of suspicious financial transactions.

Indicators of terrorist activity financing in relation to domestic terrorism

The following indicators are applicable to various types of violent extremism (e.g., IMVE, RMVE, PMVE). Some that are specific to IMVE are in-line with the characteristics identified in FINTRAC’s Special Bulletin on Ideologically Motivated Violent Extremism.

Indicators of terrorist activity financing in relation to support of international terrorist groups

Some of the following indicators were also included in FINTRAC’s Guidance on money laundering and terrorist financing indicators – financial entities. They continue to be commonly reported indicators observed by FINTRAC in suspicious terrorist activity financing transactions.

Indicators of terrorist activity financing in relation to Canadian Extremist Travellers (CETs)

Some of the following indicators were included in FINTRAC’s 2018 Terrorist Financing Assessment. They continue to be commonly reported indicators observed by FINTRAC in suspicious terrorist activity financing transactions.

Pre-Departure

En-Route

In Theatre

Returning

Disrupted travel

Contact FINTRAC

© His Majesty the King in Right of Canada, 2022.
Cat. No. FD4-27/2022E-PDF
ISBN 978-0-660-41873-5

Resources

For more information on terrorist activity financing, violent extremism as well as associated financial intelligence, please consult the following resources:

Canada

International

Date Modified: