In part 1 of this series, we explained the Iran sanctions context and how Iran began widespread use of cryptocurrency in 2018, largely as a response to those sanctions. We highlighted Iran’s role in mining Bitcoin, which creates liquidity for the regime while also leveraging its oil surplus.

In part 2 of the series, we explored how Iran uses cryptocurrency to finance the Houthis (Ansarallah). We illuminated the various companies, exchanges, and individuals involved in Iran-Yemen crypto threat finance, highlighting the many jurisdictions this network spans.

«in part 3 of the series…»

Today, we’re looking at the role of Iran’s illicit crypto finance network in financing Hamas. Hamas is part of Iran’s Axis of Resistance and has been funded by the regime to the tune of $100 million per year. While much of this is provided to Hamas through cash couriers, hawala transfers, and trade-based financing mechanisms, some of it is provided through cryptocurrency transactions.

Hamas’s relationship with cryptocurrency is an interesting one. The group was an early adopter of cryptocurrency, soliciting donations on its public website almost a decade ago. Hamas has used cryptocurrencies such as Bitcoin and stablecoins to store and transfer funds, and has raised hundreds of thousands (if not millions) by soliciting cryptocurrency donations from its members and supporters worldwide. To conceal the origin and final destination of cryptocurrency transactions, the Qassam Brigades’ website offered instructions in multiple languages on creating Bitcoin wallets and making untraceable donations to Hamas. To further enhance anonymity, Hamas also generated unique transaction links for individual Bitcoin wallets on its website, avoiding cryptocurrency exchanges that are more susceptible to tracking by authorities.

Hamas has not had complete freedom to operate in the cryptocurrency market. In June 2021, Israel’s National Bureau for Counter-Terrorist Financing (NBCTF) seized multiple cryptocurrency wallets linked to a Hamas fundraising campaign, some associated with the Qassam Brigade. One of these wallets belonged to Buy Cash Money and Money Transfer Company, a Gaza-based business providing money transfer and virtual currency exchange services. Buy Cash facilitated fund transfers for not only Hamas but also affiliates of other terrorist groups, such as Al Qaeda and ISIS. However, this was not the end of Hamas’s use of cryptocurrency. While Iran has a number of different means to move money to Hamas, the IRGC has also used cryptocurrency to fund the group.

In April 2023, Israel’s NBCTF seized 189 cryptocurrency accounts that were associated with three Palestinian currency exchanges, including Gaza and Türkiye-based exchange Al-Markaziya Li-Siarafa, which Israel designated for its support for Hamas. This exchange, previously known by a different name (Al-Mutahadun for Exchange), is alleged to be directly involved in facilitating tens of millions of dollars from the IRGC-QF to Hamas and Palestinian Islamic Jihad (PIJ). Al-Markaziya is owned by Zuhair Shamlakh, a Gaza-based money changer. He is alleged to have used a network of exchanges that sent digital tokens to operators abroad to settle hawala balances, as well as to wallets controlled by Hamas-affiliated money exchanges. Around 2020, this method of transfer became a central part of Hamas’s operational financial activity.

Another known Hamas financing network is the Herzallah network. This network is centered on the Gaza-based Herzallah Exchange and General Trading Company LLC, which has worked with Hamas to facilitate transactions through cryptocurrencies and has laundered funds for Hamas and PIJ. The exchange is owned by Muhammad Fallah Kamil Hirzallah, Na’im Kamil Raghib Hirzallah, and Salah Kamil Raghib Hirzallah. While there are no publicly identified transactions from Iran moving through this exchange, this remains a possible avenue for Iranian crypto funding of Hamas.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

The attribution of wallets and the transactions moving through them is complicated. In some cases, wallets are wholly attributed to the IRGC even when they are used by multiple entities. In one case, the NBCTF designated two hot wallets used by the IRGC. Even though other (non-IRGC) funds likely moved through those wallets, the entire set of wallets was designated by Israeli authorities. When this type of action is reported by the media, it can lead to exaggerated estimates of terrorist financing, as the nuances of wallet control and use are sometimes lost, and all funds that have flowed through those wallets are incorrectly “attributed” to the IRGC. In reality, these wallets often represent informal exchanges, over-the-counter brokers, or hawalas, meaning that they serve a diverse set of clients, not just Hamas or other terrorist groups. As such, describing all the transactions flowing through the wallets as “terror finance” is misleading.

While there is evidence of direct cryptocurrency transactions between Iran-linked wallets, facilitators, and Hamas, transactions appear to have largely passed through informal exchanges or hawaladars providing cash-out services, making the scale of this activity difficult to quantify. Historically, Iran’s support to Hamas has primarily moved through cash couriers into Gaza, as well as other types of transactions to deposit funds into the group’s wider financial networks abroad.

However, with recent disruptions to traditional supply routes, Iran could increasingly turn to cryptocurrency to facilitate transfers. The change in regime brought about by the Iran-US-Israel war has removed significant layers of older regime members; the newer, younger leaders are likely to more fully embrace cryptocurrency as a means of transferring funds to its proxies, including Hamas. At the same time, Israel’s focused targeting of financial facilitators in Gaza has likely constrained the effectiveness of any such efforts, leaving the future role of cryptocurrency in Hamas’s financing both fluid and uncertain.

Share

This research is part of my post-doctoral work funded by the University of Calgary’s Faculty of Law.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Part 1:

The first installment of this eight-part series outlined how one of the world’s most heavily sanctioned states has evolved its financial infrastructure — integrating traditional networks with crypto rails — to sustain its economy and underwrite proxy activities across the Middle East. Against a backdrop of geopolitical conflict and tightening sanctions, Iran’s adoption of cryptocurrency is not just about evading sanctions but about embedding itself in an emerging “axis of illicit finance” that links it with other sanctioned states and actors, making crypto increasingly central to its ability to fund and project influence through its affiliates. In recent years, Iran’s proxy networks have conducted on-chain activity of over $2 billion; this activity is based on confirmed wallets identified in sanctions designations, and likely represents a low estimate of Iran’s true use of cryptocurrency for terrorist financing.

Yemen, the Houthis, and the Axis of Resistance

Over the last two years, the Houthis have become even more important to Iran amid geopolitical losses. At the same time, cryptocurrency has become increasingly important for Iran, with the IRGC’s share of Iran’s cryptocurrency ecosystem rising to 50% in the last quarter of 2025. For instance, several reports indicate that Iran accepts crypto payments for military equipment purchases, even if those payments are not necessarily processed directly through websites. Ultimately, sanctions targeting both Iran and the Houthis, and Iran’s development of crypto rails for payments to its proxies (among other uses), likely complement other, more traditional payment methods like hawala, cash couriers, and even bank transfers.

Like the other axis members, Iran funds the Yemen branch of its axis of resistance (Ansarallah / The Houthis) in various ways, primarily by diverting profits from illicit oil sales through cryptocurrency transactions. The crypto component of Iran’s hybrid threat-financing network that funds the Houthis is illustrated below. Some of the basic details are as follows:

• According to the US OFAC, the IRGC-QF cooperates with Iran-based Ansarallah financial official Sa’id al-Jamal; OFAC has identified five cryptocurrency wallets associated with him. Al-Jamal also operates exchange companies in Sana’a, Yemen, specifically Janat al Anhar General Trading LLC (formerly Abu Sumbol General Trading LLC). These businesses facilitate payment for Iranian oil.

• Funds transfers are also facilitated for him through a variety of money exchanges located in the United Arab Emirates (UAE), including Adoon General Trading FZE. Al-Jamal reportedly generates revenue through the illicit sale of Iranian petroleum to customers in East Asia using a network of shipping firms in Malaysia. (Malaysia acts as an intermediary for some Iranian oil, with Iranian oil re-labelled as originating from Malaysia and sold to other countries, including China).

• These oil transactions often appear in Iran’s shadow banking network and refer to “Malaysian blend” oil. Some of these transactions have been small-denomination inflows through informal exchanges.

These transactions are not limited to the Middle East and are linked to the broader illicit finance network through Russia, specifically the Russian cryptocurrency exchange Garantex, which is reportedly still active despite sanctions and domain seizure. In April 2025, the US further identified eight wallets associated with Sa’id Al-Jamal and indicated that, in addition to facilitating illicit petroleum sales, he is also involved in weapons procurement from Russia and facilitating the sale of stolen Ukrainian grain. These addresses included six private wallets and two deposit addresses at mainstream services. According to Chainalysis, these addresses have moved nearly $1 billion in illicit funds. As part of this activity, the Houthis used deposit addresses at Garantex. In early 2026, allegations surfaced about the role of Binance in Iran’s illicit finance network, including for sending money to the Houthis. These allegations suggest that Binance has facilitated over $1.7 billion for Iran / IRGC / Axis of Resistance.2

Share

Financial Intelligence Sources

Do you want to identify and exploit new sources of financial intelligence? Our evergreen course is your guide to finding, analyzing, and contextualizing open source financial intelligence. This step-by-step guide to FININT sources will greatly expand your intelligence knowledge and skills. This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

An International Network

Anyone versed in counter-terrorist financing will also not find it surprising that this terrorist financing network has connections in Türkiye. According to OFAC, Türkiye-based Hassan Jafari has also worked with Sa’id al-Jamal to launder money on behalf of al-Jamal’s network and has arranged payments worth millions of dollars in support of shipments for the Houthis. Jafari has also worked with brothers Hushang and Sohrab Gahirat on the Houthis’ commercial initiatives in Russia, including arms procurement and grain shipments.

Part of this network also extends into Syria. For instance, Alireza Derakshan and Arash Estaki Alivand coordinated more than $100 million in oil sales for the Iranian government through cryptocurrency and used a network of front companies across multiple jurisdictions. Alivand worked as a financial facilitator and oil broker for Syria-based Al Qatirji Company, while Derakhshan used UAE-based Minato Commercial Brokers as a front company to make a payment to Al Qatirji Company.

In Yemen, a network of money service businesses connects and facilitates cryptocurrency payments, as well as traditional financial transfers and likely cash-out services:

• Houthi finance official, Abdullah al-Jamal, has used a network of money service businesses, trade facilitators, and cryptocurrency addresses to move funds.

• He has used the Sana’a-based money service business Mohammed Ali Al Thawr Exchange, and he also controls the Davos Exchange and Remittances company.

• Other exchanges, specifically Khaled Al Hazmi and Brother Company General Partnership, have also transferred funds to Davos Exchange as part of this illicit activity.

This cryptocurrency network does not operate in isolation. Instead, it plugs directly into a wider ecosystem of exchange houses, front companies, and long-standing smuggling routes tied to the Houthis’ weapons-procurement apparatus. Together, these crypto nodes form a parallel financial architecture—one that functions as a secondary payment system —designed to move value, settle transactions, and sustain illicit activity while insulating the network from sanctions and traditional financial controls. While parts of this network are visible through on-chain analysis, additional off-chain activity (including cash and hawala transactions) likely further obfuscates the network's full extent.

Iran and the Houthis’ hybrid threat finance system is likely growing in complexity and sophistication, and is facilitated by access to greater pools of illicit cryptocurrency funds provided by Chinese money laundering networks. Furthermore, Ansarallah has used privacy-enhancing tools such as mixers and cross-chain protocols, demonstrating financial tradecraft capabilities.

Ansarallah’s use of cryptocurrency for financing, facilitated by a small number of identified individuals, reflects a broader and potentially more complex network linked to Iran. These facilitators operate through companies, hawalas, and exchanges in Türkiye, Russia, Yemen, Syria, Lebanon, and the UAE, thereby enabling the group to access financial infrastructure beyond Yemen’s borders. While current evidence highlights these specific connections, it remains unclear whether this network represents the entirety of Ansarallah’s crypto-financing apparatus or merely the visible edge of a much larger system. The opacity of these networks, combined with Iran’s established role in supporting proxy groups through both traditional and emerging financial channels, suggests that the full scale and sophistication of Ansarallah’s digital financing strategy might still be underappreciated.

Following Iran’s significant military setbacks in the first half of 2025, Iran needs Ansarallah more than ever, and faces significant sunk costs in terms of existing investment in the group. As a result, Iran is likely to continue, and could increase, support for the group, and some of the tens or hundreds of millions of dollars a year that Iran provides to the group might increasingly move through cryptocurrency.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Share

Last week, news reports surfaced indicating that JNIM received a $50 million ransom from the UAE for several hostages the group had kidnapped. This is not new: JNIM has conducted widespread kidnapping campaigns targeting foreign nationals to finance its operations. However, according to BBC Monitoring, the exchange also involved an additional $20 million of arms and ammunition for the militants,1 and the release of 20 JNIM prisoners from a Bamako jail. (Alternatively, some sources report that JNIM will receive an additional $20 million instead of the arms and ammunition.) As part of the deal, JNIM militants began allowing fuel tankers and trucks to reach the capital. (Other sources, including the excellent Wassim Nasr, report that the blockade remains in place and that this was not part of the negotiation.)

Prior to 2020, groups within the JNIM umbrella were primarily conducting local kidnappings for ransom. These “snatch and grab” kidnappings tend to be shorter in duration and raise smaller sums of money, while international kidnappings for ransom tend to generate far greater ransoms. (I analyze this distinction in my book Illicit Money: Financing Terrorism in the 21st Century). In 2020, JNIM secured around $40 million in ransom for one French and two Italian hostages, so these sums of money are not unprecedented for the group.

Here at Insight Monitor, we ~very~ roughly estimate that JNIM generates about $100 million per year in revenues. (Estimating terrorist revenues is extremely difficult, particularly as it tends to rely on estimates of informal economic activity, taxation, extortion, territory controlled, and a host of other sources of funds. You can read our full analysis below.)

They use this money to pay for fighters, food, sustenance, and sometimes weapons (although many of their weapons have been stolen from the various militaries they confront), as well as to provide governance, security, and justice in their areas of territorial control. This money also helps to accelerate their operational reach and sophistication by allowing them to purchase and use improvised explosive devices and drones to conduct assaults.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

This ransom is not pure profit for JNIM: there will be fees to be paid to those involved in hostage care, negotiations, security, etc., but this will still be a lot of money for the group. It’s important to note that ransom payments do not always lead directly to more terrorist attacks. However, in this case, research suggests that there will be at least a short-term increase in the number or intensity of attacks. Further, given the state of the militant advance on the capital, this influx of funds could provide a significant cash reserve for the group as they combat Malian forces. Regardless, kidnapping for ransom has been, and will remain, a core part of the group’s business model. Targeting mining operations and foreign nationals will be a focus for the group, because these types of international kidnappings for ransom generate the most profits, particularly with governments (and corporations) that have the financial (and moral) capacity to pay.

While JNIM’s strategic goals regarding the capital (and Mali in general) are contested, this money could well support a full-scale siege of Bamako. And if not a siege, the money will certainly allow JNIM more operational freedom of movement in the coming months, and likely incentivize them to gain more territory and solidify control and influence in the region. This influx of funds is certainly not going to help the security situation in Mali in the short to medium term and will likely enable more operations (and more technologically sophisticated attacks) in the coming months.

If you’ve been thinking about subscribing to Insight Monitor, the time to lock in is now! Our prices will increase (modestly) in 2026.

Subscribe now

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Share

Subscribe now

Origins and Operations

LFM started in the Mexican state of Michoacán in 2006. The group originally split from the Gulf Cartel and its armed wing, Los Zetas, and established itself by mixing violence with religious rhetoric. Under its leader Nazario Moreno González, LFM promoted a quasi-religious doctrine of family values, discipline, and moral order, even as it trafficked drugs and killed rivals. It became famous for a 2006 attack in Uruapan, when members threw five severed heads onto a nightclub floor. The group’s activities initially centred on the production and distribution of methamphetamine, marijuana, and other illicit drugs and precursor chemicals, but over time diversified into extortion, racketeering, and kidnapping.

While the original LFM fragmented after Moreno’s reported death in 2010, its successors remain powerful. Today, there are two major factions: La Nueva Familia Michoacana (LNFM) and the United Cartels (Cárteles Unidos, CU). These factions operate under the broader LFM umbrella but retain independent financial and operational structures. LNFM focuses its operations in Guerrero and Michoacán (including the Port of Lázaro Cárdenas, one of Mexico’s largest seaports), whereas CU exerts influence in southern Michoacán and has extended operations into neighbouring states (with territory overlapping that of LNFM). LNFM is the most powerful faction and alone is responsible for the annual transportation, importation, and distribution of approximately 12 tons of methamphetamine, 13 tons of opioids, including heroin and fentanyl, and 18 tons of cocaine in the United States.

Read more

We have previously examined JNIM subgroups, with articles on Al Mourabitoun and Ansar al-Dine available on Substack and Katibat Macina included in our terrorism financing case study library. This post provides a standalone overview of JNIM, focusing on developments in its financial profile since 2023. The group’s strength is not only related to its operational tempo, but also to its ability to raise, manage, and obscure funds.

Subscribe now

Origins and Operations

JNIM was created in March 2017 through the merger of several jihadist groups operating in Mali and the wider Sahel: Ansar Dine, Katibat Macina, Al-Mourabitoun, Ansar al-Islam, and the Sahara branch of al-Qaeda in the Islamic Maghreb (AQIM). The coalition consolidated these different jihadist entities into a unified front, enabling greater coordination, shared resources, and a collective identity under the al-Qaeda banner. Iyad Ag Ghali, a Tuareg former diplomat and rebel, is the leader of JNIM, while Amadou Koufa, a Fulani cleric, is deputy.

As of 2025, JNIM has around 6,000 fighters, making it the largest militant force in the region. Its strongholds stretch from Mali and Burkina Faso into Niger and the Gulf of Guinea states, with Burkina Faso alone recording over 280 JNIM attacks in the first half of 2025. Militarily, the group deploys guerrilla warfare tactics, ambushes, and suicide bombings, often targeting state forces, international missions, and rival jihadist groups such as the Islamic State Sahel Province. Politically, JNIM seeks to build legitimacy in communities by positioning itself as a security provider and enforcer of “justice.”

Raising Funds

JNIM is predominantly financed through local revenue streams as part of the Sahel’s war economy.

Gold Mining

Artisanal gold mining is JNIM’s most profitable sector. The group controls or influences mining sites, regulates access, and taxes production and transport. Within JNIM-controlled areas, artisanal sites can produce up to 725 kilograms of gold annually, worth approximately US$34 million, with primary export destinations in the United Arab Emirates, Turkey, and Switzerland. Revenue from gold mining is not only financial but also strategic: mines serve as recruitment grounds, storage sites for weapons, and logistical hubs, allowing JNIM to secure both resources and social influence.

Kidnapping for Ransom

Kidnapping for ransom has declined slightly as a source of revenue but remains a central element of JNIM’s financing strategy. Between 2017 and 2023, the group carried out 845 of 1,100 recorded kidnappings across Mali, Burkina Faso, and Niger. Ransom amounts vary widely: local businessmen can be released for sums as low as $3,000–$5,000, while foreigners can get multimillion-dollar payouts. In 2020, JNIM reportedly secured a ~$40.5 million ransom for the release of one French and two Italian hostages. More recently, reflecting the group’s continued focus on resource extraction, JNIM abducted four foreign nationals in July 2025 from a major cement and lime production site in Karaga.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. As part of the course, you receive access to a Case Study Library that contains more group profiles like this one. Sign up today!

Livestock Theft (often reported as ‘Cattle Rustling’)

JNIM has increasingly relied on livestock as a source of revenue, using both theft and coercion. They sometimes raid communities and steal cattle outright, while in other cases they seize animals under the pretense of collecting the Islamic tax (zakat). Unlike traditional zakat, which is intended to help the impoverished, JNIM diverts these resources to sustain its fighters, weapons, and operations. In 2021, the group reportedly generated $739,200 from cattle theft in Mali’s Youwarou district alone, while its subgroup Ansarul Islam earned between US$42,000 and US$50,000 per month through similar raids in other regions. Militants have confiscated entire herds from villages in Burkina Faso, and in central Mali, livestock owners are compelled to give one-year-old bull calves for every 30 cattle and one-year-old heifers for every 40 cattle in exchange for “protection.” Stolen livestock are transported across borders and sold in markets in Mali, Mauritania, or Senegal.

Taxation, Fundraising, and Extortion

JNIM collects zakat and imposes various taxes as part of its broader strategy to generate revenue and assert control over territory. The importance of zakat varies by region: in Kidal, Mali, the group relies more on fundraising than zakat, and contributions are more voluntary in some communities but mandatory for those perceived as “pro-Islamic State”. In central Mali, zakat reportedly constitutes only a minor portion of JNIM’s resources, with roughly two-thirds redistributed to the needy. Regional practices differ widely; in southwestern Tillaberi, Niger, zakat collection is described as “messy and extortionist”, whereas in northern Tahoua, locals perceive it as largely non-violent and limited to traditional contributions.

Beyond zakat, JNIM taxes goods, including fuel, food, and medicines, along major roads and transit corridors in Mali and Burkina Faso, forcibly imposing “protection fees” on merchants, truck drivers, and migrants passing through its territory. Noncompliance often results in the confiscation of goods or vehicles, as evident by one trader whose truck full of tea was seized, taking a year to recover.

Illicit Smuggling

JNIM has embedded itself within broader illicit economies, collaborating with criminal networks involved in drug trafficking, arms smuggling, and human trafficking. While the group often benefits indirectly by taxing or charging fees to traffickers, it also engages directly in illicit activity. For example, it has exploited security gaps in Libya by levying fees on human smugglers forced to use routes through JNIM-controlled territory. In another case, AQIM landed a Boeing 727 full of cocaine (the origin and ownership unknown) near Gao, Mali, burned the plane after unloading, and transported the cargo via trade routes to Libya and Morocco for European markets. It has also leveraged its territorial control to offer protection services to actors involved in illicit smuggling. By 2021, JNIM had expanded its influence across mines, trade and smuggling routes, and large wildlife parks, functioning as a de facto security provider to smugglers, miners, and hunters in exchange for a share of their revenue.

Looting

JNIM diversifies its resources through the looting of military stockpiles, trucks, and the diversion of humanitarian aid convoys. The group frequently targets fuel trucks, sometimes intercepting deliveries suspected to be prearranged by traffickers. Large quantities of fuel are consumed by JNIM fighters, and in some cases, this has reportedly driven up prices, creating more profitable local markets. Surplus fuel is sometimes resold or distributed at below-market prices to sympathetic sellers or communities.

JNIM has also systematically hijacked transport trucks and vehicles carrying a variety of goods along major roadways, including NGO vehicles and ambulances from district health centers. On multiple occasions, aid trucks have been diverted, with food and medicine redistributed to select communities under JNIM control. For example, in April 2022, a convoy of eight new United Nations vehicles bound for Niger was reportedly stolen by JNIM combatants.

Using Funds

Weapons and Equipment

One of JNIM’s main expenses is equipment for its military operations, such as weapons, ammunition, fuel, vehicles, and motorbikes. Motorbikes are particularly valuable in the Sahel’s terrain. JNIM often pre-pays for bulk purchases of new motorbikes from traders who divert them from regional supply chains, frequently through ports such as Lagos, Lomé, and Cotonou. Local dealers describe JNIM as reliable customers who pay upfront and place regular, large orders, ensuring a constant supply. Alongside this investment in mobility, JNIM has also allocated funds toward acquiring and deploying drones, which, when combined with improvised explosive devices and motorbike-mounted bombs, have enabled increasingly complex attacks on well-defended targets.

Consolidation of Territorial Control and Attacks

JNIM carries out systematic attacks to consolidate its territorial control and undermine state authority. The group frequently targets symbols of foreign influence, including French and UN forces, and more recently has threatened Russian mercenaries fighting alongside Malian troops.

To exert control over local populations, JNIM sets up irregular checkpoints where fighters gather intelligence, conduct identity checks for military personnel, state militiamen, and perceived collaborators, and seize vehicles, motorcycles, and other goods to sustain their operations. The group also imposes embargoes and blockades on towns, villages, and entire administrative subdivisions, including the Bandiagara region in Mali and parts of Kompienga, further reinforcing its authority over local communities.

JNIM additionally targets schools and critical infrastructure to weaken state presence and expand influence. Attacks on schools disrupt formal education, replacing secular instruction with religious teachings aligned with the group’s ideology. Roads, bridges, and convoys are also frequently attacked, undermining state capacity while simultaneously creating opportunities for taxation.

Governance and Service Provision

JNIM also channels resources into governance, providing limited but strategic services to strengthen its legitimacy. Despite having relatively low bureaucratic capacity, the group offers basic justice and security functions, including dispute resolution and the management of goods and services from nongovernmental organizations. In some areas, it redistributes zakat revenues to vulnerable populations. JNIM arbitrates disputes, resolves theft cases, and sometimes returns stolen goods, including livestock and items such as telecommunications antenna batteries, to local communities. It has also undertaken initiatives aimed at generating support, such as targeting individuals involved in robberies, gang activity, or other crimes, positioning itself as a more effective authority than weak state structures.

Communications

JNIM allocates resources to enhance both propaganda and operational communications. The group has reportedly acquired satellite internet systems, such as Starlink, to improve battlefield coordination. These systems provide high-speed internet in areas where regular mobile networks are unavailable or unreliable, allowing JNIM to synchronize operations across dispersed units, coordinate attacks, and respond rapidly to shifting security conditions. In parallel, enhanced connectivity supports the group’s propaganda efforts, enabling the dissemination of messages, videos, and ideological content.

Storing and Moving Funds

JNIM primarily relies on cash and in-kind resources, including looted goods, gold, and stolen cattle. Cash reserves are decentralized, with local commanders holding funds to ensure liquidity for ransom payments, supply purchases, and other immediate needs. Mining sites and rural bases also serve as storage hubs for both money and weapons. Funds are moved along routes under the group’s control or, in some cases, through hawala networks. In addition, JNIM invests in small businesses and shops, lends money to merchants, and occasionally uses formal banking systems, embedding itself in local commerce in ways that both generate revenue and strengthen its local legitimacy. Unlike some Islamic State affiliates in the region, there is little evidence that JNIM has adopted cryptocurrency. While ISWAP has reportedly experimented with virtual assets such as Tether, no such activity has been confirmed in JNIM’s case.

Managing Funds

JNIM manages its finances through a hybrid system that combines centralized oversight with local autonomy. The group’s leadership hierarchy is structured around three tiers: central leadership, regional commanders, and local area commanders, anchored by its Majlis al-Shura (leadership council), which sets strategic priorities. High-value operations, such as major kidnappings or international negotiations, typically require approval from senior leaders. Senior commanders are also deployed across regions to maintain cohesion and ensure that local financial practices align with broader strategy, preventing fragmentation. For example, Sidan ag Hitta, sanctioned by the US in 2021, coordinated all JNIM negotiations concerning Western hostages, while Jafar Dicko, sanctioned in 2024, oversaw kidnappings in Burkina Faso through the JNIM-affiliated group Ansarul Islam.

At the local level, JNIM operates on what experts describe as a “franchise model,” adapting its financial governance to regional conditions. This includes tailoring taxation and zakat collection practices to local customs and grievances. In parts of Mali, zakat collection is coercive and deeply resented, while in Burkina Faso and Niger, JNIM has sought to frame contributions as voluntary, redistributing some revenues to local communities to bolster legitimacy. The group also relies on external operatives to sustain its financial and logistical networks. For instance, in July 2024, authorities dismantled a Libyan-led JNIM cell that supplied satellite communication systems and wireless devices to support operations.

Obscuring Funds

Because JNIM controls territory in many areas, it does not always need to conceal its financial activity locally. Operating in a predominantly cash-based economy, JNIM is able to collect zakat in livestock or cash and then pay for goods and services without relying on banks, allowing the group to circumvent the regulated financial system almost entirely.

Concealment becomes more important when funds leave the region or enter the formal economy. To achieve this, the group often relies on intermediaries such as local traders or criminal networks who manage ransom payments, gold sales, or procurement on its behalf. Revenues from gold mining are also laundered through illicit dealers operating in international hubs like Dubai and Turkey.

At the local level, JNIM uses different techniques to disguise or legitimize revenue collection. Payments for access to mining sites or protection fees are frequently framed as zakat, which reduces resistance from communities.

A Shifting Identity?

JNIM is likely to maintain strong financial resilience unless its key revenue streams, including illicit gold exports, livestock markets, and ransom networks, are actively disrupted, all of which would require a significant improvement in governance across the region. At the same time, the group appears to be reshaping its identity. Its congratulatory statement on HTS victory in Syria and the leader’s omission of al-Qaeda in a recent interview suggest a deliberate attempt at rebranding and distancing itself from the global Al-Qaeda network, which it already does not rely on for funding. Looking forward, we will see whether this shift will hold or change the group’s trajectory.

Ultimately, financing in the region remains cash-based and relies on territorial control. Significant improvements in state authority are unlikely in the short to medium term, leaving JNIM well positioned to maintain and expand its operations. The group could also incorporate other groups by offering financial and organizational incentives, further strengthening its power. The security outlook for the region thus remains bleak.

Did you find this post insightful? Share it with a colleague!

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Among the groups listed, the Gulf Cartel stands out as one of the oldest and largest criminal organizations in Mexico. By the late 1990s, the cartel was reportedly generating billions of dollars annually, and it continues to operate as a major player in the global drug trade. While it is primarily known for drug trafficking, the US government cited its use of extreme violence, including targeted assassinations of civilians and officials, as a means to intimidate the public and assert territorial control, as actions that meet the threshold for terrorism.

Keep reading to learn more about the Gulf Cartel’s financial profile and don’t forget to subscribe to stay informed of our coverage on drug cartel financing.

Subscribe now

Origins and Operations

The Gulf Cartel, based in northeastern Mexico, has long maintained control over key segments of the US-Mexico border, particularly near the Gulf of Mexico. Its origins trace back to the Prohibition era, when it was involved in smuggling alcohol and heroin. The organization rose to prominence in 1984 under Juan García Abrego, who secured a trafficking agreement with the Colombian Cali Cartel. This alliance redirected drug routes into the US through Mexico after American authorities cracked down on Caribbean smuggling corridors. At its peak, the cartel dominated drug trafficking into Texas’s Rio Grande Valley, moving fentanyl, methamphetamine, cocaine, and heroin through its strongholds in cities like Matamoros and Reynosa in the state of Tamaulipas.

In recent years, however, the Gulf Cartel has experienced a decline, losing both territory and cohesion as it broke into rival factions. Much of the cartel’s destabilization can be traced to its own creation of Los Zetas, a militia originally formed as the cartel’s violent enforcement arm.1 By 2010, Los Zetas had grown into a powerful paramilitary force of over ten thousand, known for their extreme brutality, extortion, and kidnappings, eventually breaking away and operating independently.2 Their violence and growing ambition significantly contributed to the Gulf Cartel’s internal collapse. Today, much of the academic and investigative focus has shifted toward Los Zetas, and as a result, current data on the Gulf Cartel is often outdated or complicated by its ongoing fragmentation.

Read more

Since the Houthis continue to pose an economic and security threat, the Trump administration has focused new disruption efforts on the financial networks that sustain their operations. Previous rounds of sanctions and other financial measures have had limited impact due to humanitarian concerns and the Yemeni government's limited capacity to freeze Houthi-controlled assets.

As an addendum to our January 2024 coverage, this article provides additional information on how and why the Houthis have such robust financial capabilities.

Subscribe now

Raising Funds

Taxation, Customs, and Extortion Fees

The UN Panel of Experts on Yemen highlight that the Houthis generate significant revenue, approximately YR 3.392 trillion in 2023 (US 13.6 billion) per year. The group has recently increased taxation, customs duties, and imposed new levies. These include customs fees on goods entering Red Sea ports under their control, which remain critical gateways for goods entering Yemen. The Houthis have also been extorting shipping agencies, allegedly demanding payments in exchange for not targeting vessels. This maritime extortion could generate up to $180 million per month.

On land, the Houthis impose taxes on goods transported from areas controlled by the Government of Yemen into Houthi-held territories. In 2023 alone, revenues from these land-based collection points were estimated at YR 300 billion ($1.2 million).

Read more

Subscribe now

Al-Shabaab generates significant revenue annually—estimated by the UN in 2025 to be between $100 and $200 million, primarily through taxation, control of trade routes, and smuggling activities.

While the group’s income has increased over time, its expenditures on salaries, military operations, and other activities have remained relatively stable.

Unlike many other groups, Al-Shabaab has not adopted cryptocurrency; instead, it relies on a combination of formal and informal financial systems to move funds as well as cash and other financial technologies like mobile money.

The group operates under a top-down leadership structure with formal institutions such as taxation and finance offices that help maintain consistent funding and limit risks from external pressures or internal corruption. Local fundraising is delegated to regional operatives, while senior leaders oversee broader financial planning.

Our latest article focuses on the methods Al-Shabaab uses to obscure its financial activities, including trade-based money laundering, using legitimate businesses and charities as fronts, and exploiting gender bises to further hide its transactions.

Thanks again for reading, subscribing, and sharing. We’ll keep bringing you in-depth coverage as we have on Al-Shabaab, Hamas, and white power extremist groups in Canada. Stay tuned for more. And if you want to learn how to do this type of analysis from top experts, check out our online course!

Share

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

This article examines the last piece of Al-Shabaab’s financial blueprint: the obfuscation tactics employed to conceal the origins, flow, and use of their funds. The group uses a variety of tactics, including trade-based money laundering and organizational structures involving charities, legitimate businesses, and front companies. They also exploit gender biases to further obscure their financial activities. These practices are key to understanding how Al-Shabaab protects its network from disruption and sustains its operations over time.

In this final installment of our series on Al-Shabaab, we highlight actors and key examples that demonstrate the diverse obfuscation tactics that the group uses.

Subscribe now

Trade-Based Money Laundering

Charcoal Trade

Al-Shabaab has significantly relied on trade-based money laundering tactics, especially in involvement in Somalia’s charcoal trade, to finance operations and obscure the origins of its funds. Despite a United Nations Security Council ban on charcoal exports from Somalia imposed in 2012, the group continued to profit from the trade in subsequent years. Estimates from 2018 and 2019 suggest that Al-Shabaab earned between US$7.5 million and US$50 million annually. Although the trade appeared to slow between 2020 and 2021, US sanctions and investigations revealed that the illicit activity had resumed.

To bypass the UN ban, Al-Shabaab and its facilitators employ a variety of smuggling and financial obfuscation techniques. Shipments are often mislabeled to conceal their Somali origin, with forged documentation indicating that the charcoal originates from countries such as Iran, Comoros, Ghana, or Ivory Coast.1 A common smuggling route involves vessels arriving in Somalia carrying sugar and departing with charcoal, thereby creating a two-way illicit trade corridor. The financial proceeds from these exports are typically deposited in Gulf State banks and rerouted back to Al-Shabaab through import-export businesses and front companies.2

Read more

Subscribe now

Origins and Operations

The Base is a neo-Nazi, white supremacist paramilitary organization founded in 2018. While the group was initially primarily active in the US, the Base has also maintained a presence in Canada, Australia, South Africa, and parts of Europe. At its peak, the group had around 60 members, although its numbers reduced significantly to roughly a dozen individuals across the US following arrests by law enforcement. Despite these disruptions, the Base has recently intensified its recruitment efforts, and exact estimates of its current global membership remain unknown.

As of mid-2021, the Base had been involved in two acts of vandalism and three foiled violent plots in the US. Most of these targeted minority groups, including the Jewish community. The group's activities have also extended to Europe, where one of the eco-fascist cells was implicated in burning a mink farm, and other cells were sharing manuals for 3D-printed weapons.

Read more

This article is part 4 in our series about Al-Shabaab financing:

Keep reading to learn more about Al-Shabaab’s financial management structure.

Subscribe now

Broader Organizational Structure

Formal decision-making within Al-Shabaab is structured around two primary councils: the Shura Council (advisory) and the Tanfid Council (executive).2 While the Shura Council proposes policies and offers guidance, actual authority and final decisions lie with the Tanfid Council, which is composed of influential militia commanders, clan leaders, and religious figures.3 These councils, together with Al-Shabaab’s emir and his deputies, operate under internal organizational guidelines that define the powers of key officials as well as the procedures for appointment and dismissal.4

Operational implementation of the decisions are carried out by ‘maktabs’, or departments, which act as the functional arms of the organization. These have varied in number from seven to eleven over time. Core departments include:5

• Da’wa (Preaching and Ideology) – Al-Shabaab’s ideological department, responsible for religious outreach and control of the group’s education system.

• Zakat (Religious Taxation and In-Kind Taxes) – Oversees the collection of Islamic taxes, including in-kind goods such as livestock and agricultural produce.

• Finance – Collects monetary taxes and oversees financial inflows.

• Wilayat (Regional Administration) – Manages civil governance through appointed governors in each Somali region.

• Amniyat (Security and Intelligence) – Handles internal security, assassinations, and counter-intelligence.

• Jabhat (Military/Army) – Directs combat operations and armed units.

• Garsoor (Justice) – Administers Sharia-based legal rulings.

• Hisbah – Morality police.

Each maktab is led by a chief who reports directly to the emir. Territorial control is divided among regional governors, who are responsible for civil services, including welfare, local infrastructure, and overseeing regional branches of the maktabs.6 These governors do not often command military units but report to the governor of governors, who serves as the main liaison with the emir.7 Within these departments and regional branches, Al-Shabaab has a wider, less defined network of operatives and facilitators involved in financial activities. Some of the key figures hold multiple positions, such as serving as regional finance emir, in addition to being the head of a local intelligence unit or court.

Read more

Read more

Although some have previously suggested that ISIL-KP is “starved financially”, the group has reportedly improved its financial and logistical capabilities. ISIL-KP continues to conduct attacks in Afghanistan, challenging the Taliban’s consolidation of control. It also claimed responsibility for January 2024 Kerman Bombings and the March 2024 Moscow Crocus City Hall Attack.

This article provides an update and overview of the group’s financing activities. This analysis was originally written for my book, Illicit Money: Financing Terrorism in the 21st Century, but has been updated and is current to April 2025.

Purchase: Illicit Money

Last updated 15 April 2025

Raising Funds

In Afghanistan, ISIL-KP clashes with the Taliban in terms of funding and resources. ISIL generated the majority of its funds from taxing and extorting the local population in its area of control and influence, from donations from ISIL core and wealthy donors, and from identity-based support networks, as well as kidnapping for ransom. Tax rates vary, ranging between 10% and 15% depending on whether the economic activity is legitimate or illegal. This control / influence can be fleeting, and does not depend on ongoing territorial control (although that is certainly desirable from the group’s perspective). This taxation / extortion activity includes control of mining sites, including talc, chromite, precious and semi-precious stones as well as agriculture. Prior to being taken over by ISIL-KP, the mining sites had been held by the Taliban who profited from them, but did not mine them directly. The group is also reported to raise funds from timber smuggling

Kidnapping for ransom has further served as a revenue source for the group. In 2018, three men were arrested in Karachi for conducting 5-6 kidnappings and sending the money to ISIL-KP through hundi and hawala networks, as well as through bank accounts used to transfer funds to Afghanistan. The Islamic State earmarked the funds to conduct terrorist attacks in Pakistan. Estimates from 2015 and 2016 suggest that the group is able to generate between $300 and $350 million in revenues from this activity, but this is largely dependent on the territory they are able to control / extort, and is therefore highly variable.1 The group is believed to have suffered unspecified financial losses in 2020 likely related to counter-terrorism operations and reduction in territory (specifically in southern Nangarhar).

Subscribe now

Read more

What else does the group spend its money on? Find out below.

Organizational Expenses

Salaries

Al-Shabaab allocates a significant portion of its financial resources for paying salaries to soldiers, administrators, and other officials. Foot soldiers, who make up the bulk of the group’s members, are paid relatively modest wages. In 2022, new recruits earned about $30 per month, and trained cadets and drivers earned $70 per month. In addition to salaries, food costs for these fighters totalled about $3.6 million per year in 2018, based on $2 per fighter per day.

Among Al-Shabaab’s personnel, the Amniyaat (the group’s security force) receive the highest base salaries, starting at $200 per month. Their financial packages also include ‘additional benefits’ to support their activities, particularly when operating in enemy territory – but there are limited details on these other incentives. Commanders and administrative officials also earn competitive salaries, with starting pay of $200 per month, which can rise to $400 depending on rank. The Somali Government outlines that very high-ranking officials, such as the group’s Emir, are among the highest-paid members, earning up to $25,000 per month.

Read more

Keep reading to find out more about how Aryan Strikeforce raised and obfuscated their illicit funds.

Subscribe now

Origins and Operations

Aryan Strikeforce was created in the United Kingdom between 2006 and 2010. In 2013, Joshua Steever, a former member of Combat 18 and founder of Aryan Terror Brigade, established a new version of the Aryan Strikeforce after being expelled from his previous group. Over time, the group claimed to establish chapters in the UK and the US, with connections in Eastern Europe, South America, South Africa, and Canada.

The group promoted a decentralized structure and advocated for violent action to overthrow governments and incite racial conflict. In 2016, the group was reportedly involved in planning a suicide bombing targeting counter-protesters during a white supremacist rally in Pennsylvania. Other than the plot, Aryan Strikeforce members primarily engaged in various criminal activities, including the production of chemical weapons, the transfer of bomb-making instructions, and trafficking firearms.

Group members also collaborated with National Socialist Movement leader Jeff Schoep to form the Aryan National Alliance (ANA). This coalition brought together over 20 white supremacist groups across the US and Canada. This effort aimed to consolidate and coordinate the activities of various extremist organizations, including Aryan Nations and the National Socialist Movement.

Read more

Al-Shabaab funds its operations through imposing taxes, controlling trade routes, and smuggling goods, among other methods. In February 2025, the UN reported that the group’s annual revenue ranges between $100-$200 million.

Keep reading to learn about the many ways that Al-Shabaab raises funds.

🎉 We’re Celebrating 7 Years of Insight Threat Intelligence! 🎉

We’ve been at the forefront of research, investigation, education, and expert analysis in illicit finance, security, and intelligence for seven years. We couldn’t have done it without our incredible community!

To celebrate, we’re offering 20% off all courses for a limited time! Whether you’re starting your journey in financial intelligence or looking to deepen your expertise, now is the time.

Use code ITI20 at checkout! 🎓✨

Insight Academy

📅 Offer valid until March 31!

Subscribe now

Origins and Operations

Al-Shabaab, meaning "The Youth" in Arabic, emerged in Somalia around 2004 as the youth wing of the Islamic Courts Union (ICU). Following Ethiopia's 2006 invasion and dismantling of the ICU, Al-Shabaab became an insurgency, gaining control of southern and central Somalia. By 2009, the group pledged allegiance to al-Qaeda and became an official affiliate in 2012.

Al-Shabaab conducted its first attack outside Somalia in 2010, killing 74 civilians in Uganda. It intensified operations against Kenya following the country’s 2011 military intervention, with the 2013 Westgate Mall attack in Nairobi killing 67 people. The 2019 DusitD2 complex attack also gained global attention after Al-Shabaab claimed responsibility for killing 22 individuals and injuring an additional 30.

The group operates in Somalia, Ethiopia, Kenya, Djibouti, Tanzania, and Uganda. Al-Shabaab has an estimated 5,000 to 10,000 fighters, and was responsible for over 2,500 violent events and 6,000 fatalities in 2022/2023.

Read more

Is it too early to call the group a counter-terrorism success story? Keep reading to learn about ISIL Sinai’s financial profile.

Subscribe now

Origins and Operations

ABM first appeared in 2011 and primarily carried out attacks against the Egyptian and Israeli governments. In October 2014, leaders from both ABM and the Islamic State supposedly met to negotiate potential funding opportunities. ABM’s pledge of allegiance to ISIL could have thus been a financial decision.

After becoming an affiliate, ISIL Sinai conducted operations against foreign and religious targets, including bombing a Russian passenger aircraft, executing a Croatian citizen, and attacking Egyptian Coptic Christians. The group primarily operated in the northern Sinai region of Egypt. In 2021, the UN assessed ISIL Sinai had around 1,000 fighters. However, the group is now estimated to have a few hundred remaining members.

Read more

The PKK

The Kurdistan Workers’ Party, or PKK, was formally established in 1978 in Türkiye by Abdullah Öcalan and is a Marxist-Lenist group whose mission is to ignite a communist revolution through guerilla warfare and create a separate Kurdish state.1 The group formally began operations in Türkiye in 1983, but these activities have not been contained to the country.2 The PKK has been responsible for 29% of all terrorism-related deaths in OECD countries between 2009 and 2014, and the group has launched thousands of terrorist attacks.3

The PKK was initially sponsored by states such as Syria and received support from the Soviet Union, Cyprus, Greece, Armenia, Libya, Iran, Iraq, Bulgaria and Cuba. Following the collapse of the Soviet Union, the PKK needed to find new sources of funds, so they expanded into criminal activities, relying heavily on the drug trade but also on support campaigns, publication sales, grants, and subscriptions, as well as funds from legitimate businesses diverted to the group.4

Today, the PKK has an elaborate network of fundraising activities, ranging from extortion and taxation to robbery, drug trafficking and arms smuggling. They also engage in money laundering, kidnapping for ransom, and counterfeiting, among other activities.5

Despite being a proscribed terrorist group in the UK, EU, and Canada, the PKK has managed to maintain its organizational financing activities. Part of the reason for this is the lack of interest in the issue from proscribing states: it becomes a simple matter for states to ignore the activity so long as the PKK establishes a plausible front or avoids using known PKK operatives as the point people on charitable or commercial activities.

Lack of international cooperation to counter the PKK, combined with lukewarm efforts domestically, means that the group operates and finances itself with relative domestic and international impunity. One of the countries it exploits to do so is Canada; while not as important as the European drugs market, the group's support from international donor networks is likely an important part of its financing operations.

The PKK in Canada

Read more

Keep reading to learn about HTS’s financial network and how it will help the group sustain power in the region.

Subscribe now

Origins and Operations

Based in Syria’s northern Idlib province, HTS is a rebel group that opposed the Bashar al-Assad regime. The group was originally founded in 2011 as Jabhat al-Nusra, an al-Qaeda affiliate. Jabhat al-Nusra was dissolved when one of the leaders, Abu Mohammed al-Jolani, broke ranks with al-Qaeda and merged 5 Islamist militias and opposition factions in 2017 to create HTS. HTS is estimated to have between 12,000-20,000 members and mainly targets Assad forces, rival militias, and Russian operations.

Read more

Thanks for caring about illicit finance and global security,

~Jess

Origins and Operations

The Blue and Black Movement was formed from young members of the far-right Finns Party, some of whom were disillusioned with the Party’s lack of open support of white nationalism.3 The party took its name from the youth wing of the fascist federal party Isänmaallinen kansanliike (Patriotic People's Movement), which operated in the 1930s.

The Blue and Black Movement’s first two applications to become a registered federal political party were rejected by Finland’s Ministry of Justice over concerns that the group’s programme did not respect constitutional law and universal human rights. This rejection led them them to tone down their official programme.

In April 2021, Finland’s national chapter of Extinction Rebellion published an English-language essay warning environmentalists about the Blue and Black Movement, calling the group “explicitly ecofascist” and saying that:

“it would be too easy to fool ourselves believing that their (Blue and Black’s) ecology is sincere and not merely a fig leaf or vehicle for more sinister aims.”

After adjusting their platform, the Blue and Black Movement was accepted as a political party in 2022 and ran in Finland’s 2023 parliamentary election, garnering approximately 0.1% of votes. They were subsequently de-registered in 2023 after it was determined they reverted back to their original party programme after registration, and remain de-registered due a lack of sufficient support. Chairperson Tuukka Kuru was convicted of incitement of hatred and fined €1,280 ($1,400) over antisemitic social media comments in June of 2023. The party has attempted to register again as a federal party and remains active under Kuru’s leadership.

Raising Funds

The Blue and Black Movement requires membership fees for all official members, which must be submitted along with membership applications. The initial cost to join is €30 ($32.26), but the group’s membership application form does not specify how frequently members must pay after their initial application.

The Blue and Black Movement sells official merchandise on their website, with items ranging in price from €5.90 ($6.34) to €29.90 ($31.18). Their only merchandise store uses Woocommerce, an open-source Ecommerce plugin for the Wordpress platform. Woocommerce is commonly used by far-right groups to sell merchandise.

The Blue and Black Movement reported €5 497,24 ($6,006.42) in official party donations during the 2023 parliamentary election cycle. As a minor political party, the Blue and Black Movement was not subjected to strict public financial disclosures during their time as a registered political party.4

Terrorist Financing Analysis

Our Terrorist Financing Analysis course now includes a new download! Students of this course get access to our Hamas financing report for free to further their learning and ensure that their knowledge is completely up to date. Be sure to sign up today for the terrorist financing analysis course to lock in 2024 pricing!

Using Funds

According to the National Audit Office of Finland, the Blue and Black Movement spent €964,919 ($1,037,669) in the 2023 parliamentary election. Since the party has been deregistered as an official political party, their recent spending activities are not the subject of public reporting.

Read more