The UN’s latest report on ISIL, al-Qaeda and associated groups provides a useful snapshot of how jihadist organizations are financing themselves, and how those financial systems are changing. In advance of the report’s release, I had the pleasure of speaking with Colin Smith, the Coordinator for the Monitoring Team, and Sue Eckert, an expert with the Monitoring Team, who shared their insights with me. Five developments stand out from my read of this report and our conversation, and across all the UNMT reports that Insight Monitor has analyzed over time:1

Read more

In the lead-up to the 25^th anniversary of the September 11, 2001, terrorist attacks, much is being written about the state of Al Qaeda. While there is some variation in assessments of the threat the group poses, many analysts describe it as a much-degraded network of affiliates. Across all assessments, it remains unclear to what extent Al Qaeda is coordinating these days, who is truly calling the shots, and how much they cooperate, all of which speaks to operational capability and external operations ambitions.

In that light, the latest UN Monitoring Team report reveals something very interesting and important about these relationships.

Last year, JNIM received a ransom payment of $50 million from the UAE for a hostage taken by the group. (There is some suggestion that the group was actually paid €50 million, a material difference of about $7 million.)

In paragraph 50 of the latest report, the Monitoring Team notes that “AQIM likely channelled a share of the approximately $50 million ransom obtained by JNIM to the Al-Qaida core and AQAP.”

This revenue-sharing provides a rare and powerful signal that the al-Qaeda network remains (at least somewhat) financially integrated, with resources flowing between affiliates to sustain the broader organization.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

JNIM’s decision to share proceeds from its massive KFR operation provides unusually concrete evidence of financial integration within the al-Qaeda network and interest in sustaining the broader network. JNIM could have used these funds to consolidate its territorial control, expand its operations, or strengthen its position as arguably the most territorially powerful of AQ’s affiliates. Instead, at least some of the proceeds appear to have flowed beyond JNIM itself. That suggests the group values sustaining the broader network, even when doing so means foregoing resources that could be used for its own expansion. More importantly, it gives us a more concrete signal of network integration than we have typically had.

Revenue-sharing is an important mechanism for sustaining geographically dispersed terrorist networks. We have seen a similar dynamic within the Islamic State, where funds from wealthier provinces or groups have flowed to other parts of the organization to sustain struggling affiliates, provide start-up funding, or finance specific attacks. In both cases, money is doing more than financing individual groups: it is helping sustain the network as a whole.

The most important implication might be what this tells us about direct financial connections between affiliates. Over the last twenty-five years, counterterrorist-financing efforts have degraded these connections, making them increasingly difficult to observe and leaving uncertainty about how much money actually moves between different parts of these networks. We may not know precisely how the JNIM transfer occurred, how much was moved, or which intermediaries were involved. But the apparent sharing of proceeds from a major JNIM revenue stream with the broader AQ network is itself a significant signal.

Understanding how these funds moved will be the next critical task for the monitoring team. As Colin Smith, coordinator for the monitoring team, told me, “Tracking how that money moves, and where it goes, gives us insight into the nature and priorities of the global Al-Qaida movement.”

Share

More to follow.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

In this month’s terrorism financing report, we cover terrorism financing news from North America to Southeast Asia, featuring the arrest of finance chiefs in terrorist organizations, sanctioned ISIL-KP cryptocurrency addresses, and cartel money laundering networks. We also cover criminal organizations’ weapons-smuggling operations and Iranian insurance schemes! Don’t miss our long-read recommendations on hybrid terrorism financing networks and Boko Haram’s financing evolution.

Dive in, share with a colleague, and explore our long-read picks.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

North America

James “Fergie” Chambers, a pro-Palestinian activist and philanthropist, was arrested in Spain after the United States sought his extradition on allegations of money laundering intended to finance terrorism. Chambers and his organization, Babochki, have donated about US$800,000 to the Middle East Children’s Alliance (MECA). US authorities claim that MECA has provided funds to organizations they classify as affiliates of the Popular Front for the Liberation of Palestine.

The US Treasury sanctioned 134 Islamic State Khorasan Province (ISIL-KP) cryptocurrency addresses within the group’s network. ISIL-KP allegedly used its media wing to solicit crypto contributions through Tron, Monero, and Bitcoin. The Tron wallets have processed more than US $1.4 million since 2023, with more than US $880,000 transferred out.

Mahmoud al‑Abyari, a UK‑based senior Egyptian Muslim Brotherhood official, was designated by the US Treasury for providing material support to Hamas, including fundraising for the previously sanctioned Turkish charities Filistin Vakfi and Hayat Yolu. Al‑Abyari worked with two Hamas‑created front charities, Indonesia‑based Tujah Bulah Global and Gaza‑based Madad Palestine Charitable Society, to raise funds for the group’s military wing. Türkiye‑based El‑Kahira for General Trading was also sanctioned for transferring hundreds of thousands of dollars to Hamas.

Read more

This month, we explored the changing nature of terrorism and illicit finance—from overlooked domestic threats to hybrid financial networks and the growing role of digital assets in sanctions evasion and global security.

Before we dive in, check out this Toronto Star news article on Canada's participation in the Trump administration's summit on left-wing extremism, where Jessica shares her insights on the implications for Canadian counter-terrorism policy and the terrorist-listing process.

This month, as always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We kicked off the month by joining the Canadaland podcast to discuss state links to criminal shooter-for-hire networks and introduce a new framework for understanding why states rely on criminal proxies. Next, we examined a newly recognized terrorist attack in Canada and what it reveals about the country's evolving threat landscape. We then shared research on hybrid threat finance networks and the convergence of traditional and digital financial systems, before wrapping up the month with the announcement of a SSHRC-funded research project led by Michael Nesbitt and Jessica Davis exploring cryptocurrency, sanctions evasion, and the fragmentation of global finance.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for July! We’ll be back soon with more news and analysis. Subscribe to stay up to date.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

📖 Bridging the Divide: Cryptocurrency, Sanctions Evasion, and the Fragmentation of Global Finance

As sanctioned states increasingly turn to digital assets to evade economic restrictions, the intersection of cryptocurrency, sanctions, and global finance has become one of the most important areas of illicit finance research.

Over the next year, this project will examine how digital assets are reshaping sanctions evasion, the implications for the international financial system, and the policy responses needed to address these emerging risks.

A major goal of this grant is to build a multidisciplinary network of researchers and practitioners working on sanctions evasion and digital assets. Through workshops, collaborative research, and knowledge sharing, I hope to connect people working across disciplines and sectors on these issues.

If you’re working on cryptocurrency and sanctions, I’d love to hear from you. Please feel free to reach out if you’d like to be involved in the network or stay informed about upcoming workshops and opportunities to collaborate. Many updates will be posted through this newsletter as well, so all Insight Monitor readers can stay up-to-date on this research.

I’m incredibly grateful to SSHRC for supporting this work!

To be in touch about the research, you can email me at jessica[dot]davis1[@]ucalgary.ca

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Terrorist Use of Hybrid Threat Finance Networks

For years, discussions of terrorist financing have often treated traditional financial systems and digital assets as separate worlds; increasingly, these are not separate systems for illicit financing. Today, threat actors combine these systems deliberately to obfuscate the flow of funds, complicate investigations, and try to ensure operational success.

In a new paper published with the Royal United Services Institute’s Centre for Finance and Security (RUSI CFS), Terrorist Use of Hybrid Threat Finance Networks, I argue that terrorist financing has entered a new phase—one in which financial networks increasingly blend conventional financial services with digital assets, decentralized finance (DeFi), online payment platforms, and other financial tools. Rather than choosing between traditional and digital methods, terrorist actors are using both.

Read it here

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

The paper introduces the concept of hybrid threat finance networks to describe this evolution. These networks combine the resilience, accessibility, and anonymity offered by different financial ecosystems, allowing terrorist groups and their supporters to move seamlessly between traditional banking, money service businesses, cash, cryptocurrencies and stable coins, DeFi platforms, and other emerging financial technologies. (I talk about “TradFi and DeFi” as shortform in the paper. I think it’s useful!)

The research examines this shift through three case studies focused on ISIL. These include a Canadian ISIL financing network, an examination of ISIL’s organizational financing, and the financing of the Crocus City Hall terrorist attack, all with an emphasis on digital assets and hybrid networks. While the case studies focus on ISIL(a deliberate choice driven by the project’s scope and NATO sponsorship), the broader findings extend well beyond a single organization. The same trends are increasingly evident across terrorist and violent extremist movements, regardless of ideology. I make some reference to neo-Nazis and accelerationist groups, but it applies equally to Hamas, the Houthis, other Iran-sponsored groups, and more.

One of the paper’s key contributions is new empirical evidence drawn from my original dataset of terrorist financing cases. The data demonstrate how financial behaviour has evolved over time, showing that digital assets are becoming integrated into broader financing networks rather than replacing traditional methods. Many contemporary terrorists and extremists are digital natives (and increasingly crypto natives) who view digital financial services as simply another component of their financial toolkit.

This has important implications for governments, financial institutions, regulators, blockchain analytics firms, and technology companies. Countering terrorist financing cannot focus exclusively on either traditional financial institutions or virtual asset ecosystems. Instead, practitioners need to understand how funds move across both environments and where vulnerabilities emerge as actors exploit the interfaces between them. Increasingly, every threat finance investigation has a digital asset component.

The paper identifies several key policy challenges, including:

• Uneven regulation and supervision of digital assets across jurisdictions.

• The growing complexity of monitoring transactions between the TradFi and DeFi ecosystems.

• The need for stronger public-private partnerships capable of addressing hybrid financial threats rather than isolated financial sectors.

As terrorist financing continues to evolve, our analytical frameworks must keep pace. Hybrid threat finance networks as a concept better captures the operational reality facing investigators and policymakers today than approaches that artificially separate “traditional” and “digital” finance.

I hope the paper provides a useful framework for researchers, practitioners, and policymakers working to understand how terrorist financing is adapting to an increasingly digital financial ecosystem.

If you’re working on terrorist financing, digital assets, sanctions evasion, financial intelligence, or countering violent extremism, I’d be interested in hearing your thoughts and discussing future collaboration!

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

In the afternoon of 10 June 2025, someone wearing a long black trench coat, a hat and a mask with a long beak and wielding a sword stalked the halls of Neelin High School in Brandon, Manitoba. At first, students thought it was a joke, but it quickly became clear that the masked figure was out for blood. He attacked 15-year-old student Chinonso Onuke, nearly severing seven of his fingers, and badly injuring him with stab wounds to his chest, forearms, hands and thighs.

Keep reading to learn more about the attack, and how it came to be categorized as a terrorist event in Canada

Read more

This month’s report covers new terrorism financing issues and cases, ranging from the Islamic State (ISIL), the identification of crypto-enabled networks in North America and Europe, and Iranian financial and procurement operations. We also report on Hamas’ ongoing financing schemes, ISWAP’s taxation practices in West Africa, and the increasing involvement of organized crime in terrorism financing across South America.

Explore the latest on global terrorism financing—and don’t miss our in-depth long-reads section!

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

North America

North Carolina resident Alexander White was sentenced to eight years in prison for providing material support to ISIL. White circulated propaganda and fundraised for well-known ISIL affiliates, while also attempting multiple financial transactions to support terrorist camps and funnel money to ISIL members and supporters.

The US Treasury sanctioned three individuals and six entities in West Africa, Europe, and the Middle East for facilitating ISIL financial transfers. In Syria, Abdelhakim Boukich and his company were sanctioned for converting cryptocurrency donations into cash for ISIL. Mukhtar Adamu Muhammad and three of his businesses in West Africa were also designated by the Treasury for supporting ISIL financing and fund transfers. The last sanctioned individual, France-based Miloud Abderrahmane, facilitated transactions with ISIL affiliates in Syria and provided guides and manufacturing instructions.

The US Treasury Department sanctioned nine individuals and entities tied to weapons procurement networks supporting Iran’s Islamic Revolutionary Guard Corps (IRGC) and Ministry of Defence and Armed Forces Logistics (MODAFL), including China- and Hong Kong-based facilitators and a Hong Kong company involved in clandestine banking.

Read more

June brought a fast-moving mix of live conversations, research coverage, policy developments, enforcement actions, and real-world security events across the illicit finance and counter-terrorism space.

Before we begin, let’s remember the terrorist attack of July 7th, 2005, in London, UK. Last year, we wrote a retrospective analysis on the financing of the attack. You can read that analyis here:

This month, as always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We kicked off the month with a live conversation between Jessica and Steven Reimer to discuss the No Money for Terror conference, her forthcoming book, and Steven’s fieldwork in Ghana. We then dug into a new Research Read on the effects of ransom payments on terrorist activity in West Africa. Next, we broke down FATF’s latest plenary, where counter-terrorist financing remained front and centre alongside concerns about the use of mainstream digital platforms for illicit activity. We also looked at the Europol-led disruption of the AUDI A6 cryptocurrency laundering service and what it reveals about illicit crypto infrastructure, including a Canadian connection. Finally, we closed with an emergency Secure Line podcast on the Montréal incel attack, unpacking the attacker’s manifesto and the debate over how it has been interpreted in the aftermath.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for June! We’ll be back soon with more news and analysis. Subscribe to stay up to date.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

The best part (IMO) was that I got to introduce my strategic actor selection model: a model I developed that helps explain when and why states use criminal actors to conduct covert action like state-sponsored assassinations, sabotage, and more. You can read more about it at the link below, and a full paper developing the ideas more thoroughly (with case studies!) will be out sometime soonish through SOC-ACE.

In the meantime, happy listening, and be sure to let me know what you think in the comments! And if you find this insightful, please share with a friend and help grow this community.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Prior to the attack, the perpetrator released a 104-page manifesto. This has been the subject of intense media scrutiny.

My Secure Line co-hosts and I decided to record an emergency podcast reflecting on the attack’s significance, but more importantly, how people understood the manifesto. We were all dismayed by how quickly the incel-misogynistic motivation was downplayed for other themes.

To be clear, any manifesto is usually a grab bag of grievances, ideas, and issues. These ideas might converge or diverge, but it’s all intended to shape narratives around an attack, and this case is no different.

I invite you to listen to the podcast in its entirety, because this is a critical issue for understanding terrorism today.

I want to be very clear here, however, about how I see this attack and the manifesto:

Share

I also want to add that it’s dismaying that no public official has come out and called this what it is: an act of terrorism. There will obviously be no terrorism charges laid in this case (the perpetrator is dead); however, it would be useful for political leaders to actually lead in this space and name this for what it is.1

Finally, I want to add that this is the first terrorist attack in Canada in over two years. The last one was in Edmonton in 2024.2 However, there have been a number of terrorism disruptions (arrests, peace bonds, etc). We had a very good run of preventing terrorism in this country — in fact, this two-year period was the longest we have gone without a terrorist attack in Canada since 2011. This is something our law enforcement and security services should be proud of, even as they review the Montréal shooting to identify areas where it might have been disrupted.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

In 2025, ransomware gangs stole roughly US$ 820 million from cryptocurrency exchanges, and, unbelievably, this was actually a decrease from the year before. These funds were stolen by criminal gangs for profit, state-enabled gangs (like many that operate freely in Russia), and also by state actors like North Korea. These funds go to further other criminal activity, and in the case of North Korea, to help fund its intelligence services and ballistic missile and WMD program.

To make full use of these funds, ransomware actors have to launder the money they steal, essentially hiding the fact that it was the proceeds from a hack, exploit, or other cyberattack, and making it appear as though it came from legitimate sources.

These laundering services are significant illicit finance enablers. While some argue that there is a legitimate use case (and legitimate activity) happening on these services, the vast majority of laundered funds are from illicit sources like ransomware attacks.

One of these services is AUDIA6.

AUDIA6 is a cryptocurrency laundering service that processed more than €336 million for ransomware gangs, and has been linked to more than 15 international cybercrime investigations. In June 2026, EUROPOL announced that an international law enforcement operation dismantled this crypto laundering service. Two individuals were arrested, 25 domains were taken down, 30 servers were seized, and €692,000 in crypto was frozen and over €86,000 in crypto was seized.

AUDIA6 also operated Dark2Web, a cybercrime forum where users paid to commission crimes against specific targets.

AUDIA6 operated as a “mixer as a service”. As part of this operation, the service used over 6,000 KYC (“know your customer”)-verified accounts. These accounts were essentially money mules (individuals or accounts that knowingly or unknowingly move money on behalf of someone else), and were used to rapidly launder stolen digital assets through centralized cryptocurrency exchanges. These accounts were either stolen or purchased identities.

AUDIA6 charged a 3-10% commission on its services, and maintained connections to a variety of high-risk exchanges such as Bitzlato and Garantex.

The investigation and disruption of AUDIA6 was led by the US Secret Service, the IRS, and the Polish Police, with help from other EU member states and international partners, including the RCMP. The involvement of the RCMP raised some questions for me, so I asked them about it. Keep reading to find out what they had to say about their involvement in this operation:

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Read more

Mutual Evaluations Adopted

FATF adopted the mutual evaluation reports of Canada and Türkiye during the plenary. While the reports have not yet been released publicly, publication is expected in September–October. While Canada will not be on the grey list, according to the Globe and Mail, Canada could face enhanced follow-up to address deficiencies/areas for improvement, where we will have to demonstrate effectiveness and outcomes relating to all our deficiencies (one of which is likely to be a lack of terrorist financing prosecutions).

Changes to the Grey List

Algeria and Namibia Removed

FATF removed both Algeria and Namibia from its list of jurisdictions under increased monitoring (the “grey list”). Algeria’s removal is the country’s third exit from the list. Algeria had most recently been grey-listed in October 2024. While FATF standards evolve, which can lead to states being grey-listed over and over again, Algeria’s repeated grey-listing raises questions about the effectiveness of FATF recommendations for encouraging AML/CFT measures, and whether the current timeframe for mutual evaluations is sufficient.

Namibia, meanwhile, had been under increased monitoring since February 2024.

The removals indicate that both jurisdictions have addressed the strategic deficiencies identified by FATF and completed the action plans agreed upon with the organization.

Iraq Added to the Grey List

Iraq was added to the grey list for the second time, having previously been listed in 2008.

Several of Iraq’s outstanding deficiencies relate directly to terrorist financing. FATF identified the need for Iraq to demonstrate more effective terrorist financing investigations and prosecutions, strengthen technical compliance related to its terrorist financing offence, and develop a more robust understanding of terrorist financing risks within the non-profit organization (NPO) sector.

Bosnia and Herzegovina Added to the Grey List

Bosnia and Herzegovina was also added to the grey list, marking its second appearance after previously being listed between 2016 and 2018.

Among other measures, FATF has called on Bosnia and Herzegovina to demonstrate a more proactive approach to terrorist financing investigations, clarify the interpretation and application of its terrorist financing offence, and strengthen the implementation of targeted financial sanctions related to terrorism and terrorist financing.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Looking Ahead: FATF Focus on Terrorist Financing in Digital Ecosystems

FATF also signalled continued attention to evolving terrorist financing methods online. The organization announced an upcoming publication examining terrorist financing activity conducted through social media platforms, instant messaging applications, and streaming services.

The project reflects growing concern that terrorist actors are increasingly leveraging mainstream digital platforms to solicit donations, facilitate financial transfers, advertise fundraising campaigns, and connect supporters with financial facilitators. While cryptocurrencies often receive significant attention in public discussions of terrorist financing, FATF’s focus underscores the continued importance of conventional online platforms in facilitating financial support networks.

Key Takeaway

The latest plenary reinforces a broader trend in FATF’s approach to counter-terrorist financing: effectiveness matters. The grey-listing of Iraq and Bosnia and Herzegovina reflects continued scrutiny of countries’ ability to investigate, prosecute, and disrupt terrorist financing in practice, while FATF’s forthcoming work on social media and messaging platforms highlights increasing concern with the digital environments where terrorist financing activity now occurs. In terms of terrorist financing, this focus on effectiveness and outcomes will be translated to national regulators, which in turn will require greater identification of terrorist financing activity in regulated sectors. Fintechs, banks, money service businesses, and more, will all be under increased pressure to better detect and report suspected terrorist financing activity.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Kidnapping for ransom has increased dramatically in the Sahel in recent months. This has affected both foreigners and locals. It is one of the ways that terrorists raise money as part of their financing strategies. As such, it is critically important to understand if, and how, ransom payments contribute to terrorism. This might seem obvious, but I think it’s a lot more complicated than a straight causal relationship. Have a read of my summary of this research to understand more:

Article: Tim Lohse and Andreas Nyga, “How Much Bang for the Buck? Exploring the Effects of Ransom Payments on Terrorist Activity in West Africa,” Terrorism and Political Violence 0, no. 0 (2025): 1–22, https://doi.org/10.1080/09546553.2025.2565449.

How ransoms fuel terrorism

Ransom payments are believed to finance terrorism and advance the ideological objectives of terrorist groups. This is an oft-repeated claim that I have also interrogated, and there is ample evidence of research asserting this claim. What is less well studied, however, is the claim itself: do ransom payments actually lead to more terrorism? There is, it might surprise you to learn, very little evidence to support the claim.

The authors posit that ransom payments might influence short-term (90 days) operational behaviour, essentially financing operational activity. They find that, in two instances following ransom payments to JNIM, there was a short-term increase in the number or intensity of attacks. As they are right to note, their findings have limited generalizability due to the limited number of cases and the time period. The authors also note that it is difficult to control for alternative financing methods or unobservable shocks that can influence terrorist activity (confounding and intervening variables).

Methods

The article uses a difference-in-differences method to assess the short-term effects of ransom payments on terrorist attacks. The method compares changes over time between a group that is exposed to the intervention and a group that is not. The study uses event data (from ACLED) between 2017 and 2023, and compares attacks by ISGS and JNIM. This builds on the basic descriptive statistics that I employed with my co-author Alex Wilner in our study on kidnapping for ransom and terrorist attacks.

Why you should care

Anyone involved in kidnapping-for-ransom negotiations, policy responses, or counterterrorist financing will find this article interesting. Many states have policies that explicitly prohibit the payment of ransoms for individuals kidnapped by terrorist groups, under the assumption that these payments will lead to more terrorism. However, this is not a proven fact. Further, there are many states that pay ransoms, as well as private actors, which undermines the effectiveness of the policy. We need to know if the policy is evidence-based in order to determine how strictly it should be enforced/advocated for.

It is important to note that while the authors find some support for kidnapping for ransom payments leading to more terrorism, this is far from the last word. There is much more work to be done to actually establish this relationship and tease out nuances in the relationship that might suggest different policy approaches depending on circumstances. (I.e. there might be some instances where a ransom payment won’t lead to more terrorism. It would be helpful to know this as ransoms are being negotiated, and other hostage release options are being considered!)

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

The future of KFR research

There is much work to be done on this topic. In particular, similar methods could be employed across a greater number of cases (many terrorist groups use kidnapping for ransom to raise funds). Longer time periods should also be studied; both of these would improve the external validity of these findings. Additional methods should also be considered to control for other variables, such as exogenous fund infusions, territorial control changes (and corresponding taxation base increases or decreases), and likely many other variables. It would also be really useful to know if the payment size affects levels of terrorism.

Read along with:

Jessica Davis and Alex Wilner, “Paying Terrorist Ransoms: Frayed Consensus, Uneven Outcomes & Undue Harm,” International Journal, September 26, 2022, 00207020221130308, https://doi.org/10.1177/00207020221130308.

Anja Shortland, Kidnap: Inside the Ransom Business (Oxford University Press, 2019).

Did you find this article useful? Be sure to like, subscribe, and share!

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Thank you , , and many others for tuning into my live video with !

If you want to see more of this, let us know in the comments, with likes, email or social media.

Get more from Jessica Davis, PhD in the Substack app

Available for iOS and Android

Get the app

This past month brought continued developments across illicit finance and counter-terror finance policy, with a focus on attribution challenges and evolving policy frameworks.

In case you missed it…

Jessica Davis published an article for The Line on Canada’s proposed Financial Crimes Agency under Bill C-29 and its implications for financial crime enforcement.

The Secure Line podcast, released three new episodes, covering Canada’s proposed lawful access legislation and the debate over privacy, security, and constitutional rights, the federal government’s planned Financial Crimes Agency and it’s implications for financial crime enforcement, and national security-themed summer read recommendations. Catch up on the latest episodes here.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We started the month by examining alleged activity linked to Harakat Ashab al-Yamin al-Islamiya (HAYI) and Kata’ib Hizballah (KH) activity, comparing attack patterns across Europe and Canada to evaluate claims of a Canadian connection, and exploring the financing and strategic drivers beyond these networks. We also published a commentary on the No Money for Terror (NMFT) conference, examining how its increasingly maximalist global objectives may set unrealistic expectations for counter-terror finance efforts.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for May! See you next month with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

This month, we highlight a surge in global terrorism-financing enforcement and disruption: US sanctions on Iran-linked networks; crypto-based cases in Türkiye and India; Hamas-linked fundraising and transfer activity across Europe and North America; and cartel-connected money laundering through crypto and shell networks. We also feature long reads on Islamic State financing in Central Africa and data-driven approaches to strengthening transaction monitoring for AML/CFT.

Dive in, share with a colleague, and explore our long-read picks for deeper analysis.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Read more

But first: next week, my friend and colleague will go live on Substack to share our latest insights, research, and, of course, gripes, on terrorist and counterterrorism financing. It promises to be a lively discussion, as Stephen and I have much to catch up on. You can sign up here:

CTF LIVE!

The “No Money for Terror” conference (NMFT) was the brainchild of French President Emanuel Macron, and first took place in 2018. Since that time, there have been meetings in Australia in 2019, New Delhi in 2022, and Munich in 2025. After every conference, communiques and press releases are issued with varying degrees of lucidity. Inevitably, they call on states to implement the FATF recommendations fully, and sometimes call on the FATF to take specific actions.

This is not unusual, as this conference stems from the G7 process. These meetings tend to result in negotiated statements. That’s not to say that these processes are toothless. They set high-level policy objectives that get translated into FATF action, state legislation, and much more, over long periods of time.

That’s not my problem. My problem is the maximalist objectives the conference and related press releases invite.

The very title of the conference invites criticism: “no money for terror". Further, following this year’s conference, the FATF President said: "We need to work decisively, and collectively, to cut off the financial blood supply to terrorists."

These are impossible tasks and statements like this set up the entire CTF regime for failure.

Now, you might think that I’m nitpicking here, and perhaps I am. But these are the statements against which success is measured. If the policy outcome is “no money for terror” or “cut off the blood supply to terrorists”, this implies that anything less than total elimination of terrorist financing is a failure.

The larger problem, of course, is that the goals of counter terrorist financing have always been either really grandiose or ill-defined. This is something that my next book deals with in detail. Part of the problem starts with how we define counterterrorist financing. I address this at length in my Terrorism and Political Violence article, available here. I broadly define CTF as a combination of policies and tools that can be broadly grouped together according to these categories:

Taken together, these are all the tools and policies that constitute “CTF”. None of these, on their own, constitutes a CTF strategy. To have a good CTF strategy, these tools need to be selected and adapted according to specific threats, and more importantly, coordinated with international partners. (Terrorist financing is an international problem, not a domestic one, and it necessitates international cooperation.)

Critically, none of these tools will ever end terrorist financing. They will add friction. They will reduce the amount of money available for terrorism. But stop terrorist financing? I wish.

If we want to evaluate CTF outcomes, we have to evaluate each and every one of these tools and policies, determine whether, when, and how they ‘work’ (defining “work” is also important), and how they can be improved. But we should not measure them against an impossible yardstick.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Back to the Conference….

Anyway, back to the NMFT statement. The statement identifies three priority areas for counterterrorist financing efforts:

1. Misuse of financial innovations for terrorist financing: terrorists are using virtual assets and digital payments, and investigations involving these assets are difficult. Terrorist financing also uses crowdfunding and social media and messaging apps. The NMFT communique calls on states to enforce FATF standards, to address gaps in regulating stablecoins and unhosted wallets, and to enforce the travel rule.1

2. Territorial control: including the capture of state funds by terrorists, ransom payments, and transnational nodes and facilitation networks. This is increasingly a problem in Africa, and specifically in Mali, with the expansion of JNIM’s activities.

3. Terrorism and organized crime: noting how terrorists use crime to raise money, and that some organized crime groups meet the legal threshold for listing as terrorist entities, and that some terrorists are providing crime-as-a-service (a likely reference to the Com network).

I don’t have a problem with any of these priorities; they are, in fact, huge problems in the world of terrorist financing. This covers pretty much all the highlights and is a focused list to engage the FATF and international partners.

It’s all well and good until someone suggests that we stop the flow of funds to terrorists or give no money for terror.

Maybe we can just agree on “less money for terror”? And less terrorism in general? What do you think? Join our live to have your say next week.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Last week, the FBI released a criminal complaint1 against an alleged commander for Kata’ib Hizballah (KH), an Iranian proxy group financed and directed by Iran’s Islamic Revolutionary Guards Corps (IRGC). The complaint argues that Mohammad Baqer Saad Dawood Al-Saadi is a KH commander and, as part of his work for the group, directed Harakat Ashab al-Yamin al-Islamiya (HAYI).

HAYI has claimed responsibility for nearly twenty attacks in Europe since the start of the Iran-US-Israel conflict. The group first emerged in March 2026 and sought to portray itself as a Europe-based group, independent from KH; however, imagery and social media posts strongly suggested that it was in fact an IRGC-linked entity. That is not to say that the group is a proxy; in fact, I think it’s critical to make a distinction here. Iranian proxies (Hamas, Hizballah, KH, and the Houthis) are financed and directed by Iran and the IRGC. This does not mean that these groups only follow Iranian direction — in fact, they operate with varying levels of autonomy and financial control. But they are well-established groups with hierarchies, membership, and financial structures.

On the other hand, HAYI currently appears to be more of a recruitment network. The network identifies individuals who will commit acts of violence, vandalism, and terror for pay. This pattern of activity is very similar to how Iran contracts state-sponsored assassinations. In some cases, Iran uses criminal organizations to carry out attacks in areas where it has limited operational reach and capabilities. HAYI’s breadth of activity, but low-level tactics against soft targets, suggests activity more commensurate with a criminal surrogate than a full-fledged terrorist proxy group.

To understand how Iran chooses the type of threat actor to deploy, and its implications for Canada (and the broader HAYI network), keep reading:

Read more

This month, we highlight a surge in global terrorism-financing actions: U.S. sanctions on Iran-linked networks, crypto cases in Indonesia and Iran, Hamas-linked fundraising in Europe and North America, and cartel-linked money laundering through casinos and hawala. We also feature long reads on Hizballah’s finances and the human rights impacts of asset-freezing regimes.

Dive in, share with a colleague, and explore our long-read picks for deeper analysis.

Read more