Jessica Davis is the president of Insight Threat Intelligence and the author of Illicit Money: Financing Terrorism in the Twenty-First Century. She was consulted by the government of Canada on the development of a new financial crimes agency.

In Budget 2025, the Carney government promised to create a Canadian Financial Crimes Agency, introducing legislation by the spring of 2026, to address a growing range of financial threats facing Canadians.

This is not the first time Canadians have heard this promise: a financial crimes agency was promised in the Liberal election platform of 2021 and has been in various stages of policy development since that time. Yet Canadians have heard very little about the promised agency, except for Finance Minister François-Philippe Champagne’s promise in the fall of 2025 that it would tackle sophisticated financial crimes.

As Canadians face unprecedented levels of sophisticated fraud, ransomware attacks, and geopolitical uncertainty, it’s time for the government to set an ambitious and clear mandate to protect Canadians and our financial sector.

Canada is slowly coming to terms with the fact that its once most-valued partner is increasingly unreliable. This is true in the world of trade as much as it is true in the world of security and intelligence.

The United States has long been an important law-enforcement partner, conducting joint investigations with Canadian police and often taking the lead on terrorist financing or money-laundering investigations. Today, and for the foreseeable future, Canada must prepare to go it alone on critical issues, as the U.S. has recently proven that it can only be relied upon to serve its own immediate and mercurial interests.

In this context of geopolitical uncertainty, Canada must protect the financial sector and Canadians against a smorgasbord of threats. Top of mind for most Canadians is fraud: many know someone who has been directly targeted by sophisticated fraud. These frauds are often perpetrated from abroad, sometimes by people who themselves are victims of human trafficking networks. Money from these schemes is moved swiftly offshore, and often through cryptocurrency. Another threat, ransomware, targets critical infrastructure and services, holding mission-critical data hostage until a ransom is paid. When payments are made to restore services, those payments embolden and strengthen criminals.

While fraud and ransomware are well-known threats to Canadians, the threat from those seeking to avoid sanctions is quietly stalking our financial system. Historically, enforcement of Canadian sanctions has been spotty at best. In the cryptocurrency era, sanctions evasion through Canada has been supercharged. According to one report, the Canadian cryptocurrency sector ranks in the top 10 worldwide in terms of exposure to sanctioned entities. This places Canada on the same list as countries such as North Korea, Russia, and Iran. Canada needs to take immediate action, or we risk becoming a haven for sanctions evasion.

Finally, Canada also needs to address the growing issue of professional money laundering networks. These networks of professionals (accountants, lawyers, and business owners) exist to launder the proceeds of a variety of crimes, including drug trafficking and fentanyl production. These professionals create separation between the main crime and the ultimate beneficiary of the money, making it harder to hold criminals accountable. Addressing this issue requires specialized, skilled, and dedicated financial crime professionals.

The financial sector is a bright beacon in Canada’s economy. Canada must get smart, innovative, and efficient at combating financial crimes targeting and exploiting the sector.

Share

The future Canadian Financial Crimes Agency will face tremendous challenges from the threat environment and from structural issues in this country. In addition to the threats outlined above, the agency will have to spend considerable resources to avoid conflict with other departments, the RCMP, and other police forces. It will also need to engage in horizontal co-ordination across the 13 federal departments and agencies responsible for Canada’s anti-money laundering regime, as well as with provinces and territories.

While avoiding conflict and ensuring co-ordination will be important, the future agency will also need serious teeth. It will need considerable powers to collect intelligence and evidence, analyze that information, investigate crimes, and, ideally, to compel, prohibit, sanction, and disclose information as required. The agency will also require a clear reporting and review structure, with actionable objectives and performance metrics.

A new agency will be expensive, but it will also be a tremendous opportunity for Canada to develop its considerable existing financial investigative capabilities into a world-class agency to fight serious and transnational financial crimes and protect our important financial sector and Canadians.

A future Financial Crimes Agency needs a focused mandate to address the most pressing threats and robust authorities to carry out this mission.

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

This year’s report has me asking some serious questions: Canada’s anti-money laundering, counter-terrorist financing, and sanctions-evasion framework gives FINTRAC extraordinary visibility into the financial lives of ordinary Canadians. This is an intrusion into privacy that is justified only if it delivers meaningful security outcomes. Collecting vast amounts of personal financial data may be proportionate to the threats we face, but proportionality depends on the system’s effectiveness, not just its intent. FINTRAC cannot achieve impact on its own; the rest of the regime must convert intelligence into action, enforcement, and results. With the promised Canadian Financial Crimes Agency still on the horizon, we should be asking: is our current AML/CTF and sanctions regime truly effective enough to warrant the level of privacy intrusion it demands?

If there’s one chart I would use to illustrate FINTRAC’s activities over the years, it’s the one above. It outlines all the reports that the Centre has received from reporting entities. However: I’d prefer to contextualize this with the action (or inaction) taken by others in the regime to combat terrorist financing, money laundering, and sanctions evasion. Maybe I’ll do that in the future. But for now, here’s what FINTRAC had to say. This year, there were a few notable shifts — some encouraging, others concerning.

Get caught up on our previous analysis here:

Read more

So, what does the terrorist financing landscape in Sri Lanka look like, and does ISIL actually operate there? Keep reading to find out.

Subscribe now

Terrorism Financing Context

Sri Lanka’s counterterrorism efforts have historically focused on the Liberation Tigers of Tamil Eelam (LTTE), a separatist group active in the civil war until 2009. The LTTE maintained extensive global financing networks through foreign support, wealthy donors, the Tamil diaspora, and charitable organizations while diverting funds to insurgent activities. Its fundraising operations extended to more than fifty countries, at times raising millions per month.

Since the LTTE’s defeat in 2009, publicly documented cases of terrorism financing in Sri Lanka are limited, with most reporting emphasizing regulatory and legal frameworks rather than operational financial networks. On June 3, 2024, however, the Sri Lankan government announced the freezing of all funds, financial assets, and economic resources belonging to 15 groups and 210 individuals allegedly involved in terrorist activities (many of which were from Tamil groups).

Read more

Last week, the National Security Intelligence Review Agency (NSIRA), released its review of the Canada Revenue Agency’s (CRA) Review and Analysis Division. The purpose of the review was to try and determine whether the division treats registered Canadian charities fairly and without discrimination on the basis of religion.

Share

This review was sparked, at least in part, by the report “Under Layered Suspicion: A Review of CRA Audits of Muslim-Led Charities”.1 The report looked at a selection of case studies and concluded that the possibility of bias in CRA “informs the structure, design, and/or bureaucratic application” of government policies, including the anti-terrorism financing regime. This report was widely cited as demonstrating bias in CRA’s approach to charities. That report, however, never actually went that far, nor would its methodology support findings like that. (Nerd out with me here for a minute: for a study to find bias based on religion, a broader sample of audits of charities would have to be analyzed across a diverse set of charitable causes, and then intervening variables such as quality of governance and management structure controlled for in order to identify bias in an outcome like deregistration.)

Enter NSIRA.

NSIRA also didn’t find that CRA’s Review and Analysis Division (RAD) had breached its non-discrimination obligations under Canadian Law. But there’s a very troubling reason why not, and I’m going to spend some time unpacking that.

What is RAD?

CRA’s Review and Analysis Division was established in the post 9/11 counter terrorism framework as part of Canada’s obligations under the Financial Action Task Force’s (FATF) Recommendation 8. This recommendation requires that all countries protect non-profit organizations from terrorist financing abuse through a risk-based approach that targets only those most vulnerable to misuse. Basically, charities and non-profit organizations were identified as a significant source of terrorist financing after the terrorist attacks of September 11, 2001, and this was the global response to that. To learn more about how terrorists exploit charities and the broader charitable sector:

RAD is responsible for conducting audits of charities to identify potential terrorist financing abuse (although the Charities Directorate, writ large, can also audit for broader issues). NSIRA’s review focused on the trigger for these audits, or essentially, what led RAD to conduct an audit of the charitable organization.

These triggers include things like derogatory media, intelligence from security and intelligence partners, public tips, or referrals from other areas of the CRA. In cases of serious non-compliance, CRA can order the revocation of the charitable status of the organization. (Note: this does not mean that the organization has to stop functioning, and there are no criminal penalties associated with this. In fact, some charities that have had their status revoked have continued to operate as non-profit entities in Canada, enjoying tax-free status. Have a read of the case below to find out what happens when a charity loses its tax-free status. It’s not particularly good news.)

The Findings

The report is well worth reading, particularly in the context of Canada’s upcoming FATF mutual evaluation (starting later this year, and expected to conclude, with results published, in 2026). This report will certainly be on the FATF assessor’s reading list. Let me highlight some of the findings from the report and explain why I think these are so important.

RAD’s indicators of terrorist abuse

NSIRA found that RAD does not have an evidence-based method for validating risk indicators that it relies on to justify scrutinizing a charity for terrorism-related concerns. They have a list of indicators, but they don’t record which indicators are triggered that lead to an audit. This is what the youth today might call vibes analysis.

While this is quite bad from a transparency and accountability perspective, let’s take a quick look at the positive outcome of this. In their response to the review, CRA said:

This is extremely good news, and highlights the best outcome of NSIRA’s reviews: a strengthening of internal processes, and ultimately, a strengthening of rule of law in Canada. At a time when we see this deteriorating around the world, and particularly in our southern neighbours, I think we should take a moment to enjoy this.

CRA relies on risk indicators as part of its process for selecting charities for audits. These indicators reflect “internationally recognized indicators” as developed by the FATF. (Sidebar: Anyone involved in risk indicator development knows how slippery this process is. I wouldn’t describe it as evidence-based, or methdologically sound. Probably something we should all work on, right?)

NSIRA found that the CRA’s indicators are also not formally assessed for effectiveness, and they recommended that RAD develop an evidence-based method for validating indicators. This is a great suggestion for countries all around the world who are using similar methods to assess risks of charitable abuse. But here’s the bottom line of NSIRA’s review: they aren’t recording their use of indicators, and those indicators themselves aren’t validated or based on real evidence. More vibes.

Here’s the real kicker though. The lack of rigour in RAD’s processes introduced the risk of bias and discrimination. NSIRA could not go further, however, because of how poor RAD’s internal governance is/was (it’s important to note here that steps have already been taken to start fixing this). There was “no consistency in the documentation for capturing and assessing risks”, and the lack of standardization means that the selection of charities for audit is “highly subjective and could be susceptible to bias.” Basically: the work was so poorly documented and standards were so uneven (when they existed at all) that NSIRA couldn’t even test for bias in their review.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Going forward

I want to take a second to highlight that responses to this review haven’t been entirely fact-based. For instance, the International Civil Liberties Monitoring Group stated that NSIRA “confirmed” their findings that audits of Muslim charities are “flawed, biased & discriminatory”. Having read this review, NSIRA has definitely found the audits to be flawed. But biased and discriminatory? Nope. (This whole topic has big “vibes-over-evidence” energy.)

You can read CRA’s response to the NSIRA review here. My sincere hope is that even more steps are taken to tighten up how the CRA conducts audits of charities for terrorist abuse, and that the CRA really takes a close look at its indicators in the current geopolitical context of terrorism, state-sponsored terrorism, and extremism. Because terrorists find charities (and charitable causes) useful for financing and facilitation activities, it is unlikely to stop anytime soon.2

To use these types of indicators, it’ll be important for them to remain contextually relevant. For instance, I would argue that if RAD wants to continue using the indicator “conducting activities in or close to a foreign high-risk jurisdiction”, they’re going to have to include the United States as one of those high-risk jurisdictions. I’m not being facetious. A handful of terrorist entities on our terrorist list (Three Percenters, James Mason, Proud Boys, and the Base) originate in the United States. If we’re going to call Syria a high-risk jurisdiction because it’s been home to several terrorist groups, then we have to do the same for the United States.

Oh, also, someone should do something about the non-profit organizations. They are almost entirely unregulated and unaudited, and they are just as likely to be abused for terrorist financing purposes as registered charities. Vibes-based legislation and regulation.

Share

Did you find this post insightful? Share it with a colleague, and help us grow our community of people who care about illicit finance!

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Share

The 36th Analytical Support and Sanctions Monitoring Team report, submitted in July 2025, offers a wealth of new insight into the financing of ISIL, Al-Qaida and their affiliates. Beyond the expected operational updates, the report contains some of the most interesting recent developments in terrorist financing, showing how groups are adapting both traditional methods and emerging technologies to sustain their activities.

ISIL continues to rely on familiar methods of moving money through hawala networks and cash transfers, but these are now augmented by more sophisticated tactics. Female couriers are increasingly employed to transport funds in order to avoid detection. As we’ve long talked about, using female financial facilitators is a form of financial tradecraft intended to take advantage of counterterrorism forces’ bias against seeing women as terrorist actors.

Cloud hawala systems, where transaction records are stored online rather than in physical ledgers, are becoming more common, complicating monitoring efforts. (On the other hand, these online ledgers are likely vulnerable to cyber intrusions, so they present a unique opportunity for intelligence collection. Traditionally, collecting intelligence on hawala operations has involved significant HUMINT capabilities.) Safe-drop boxes have also emerged as a technique, allowing operatives to deposit funds at exchange offices that can be retrieved using only a password or code, adding another layer of operational security.

In Somalia, the Al-Karrar office has been cut off from central ISIL funding, prompting the search for alternative income streams. One adaptation has been to rely on small-scale kidnap-for-ransom schemes, with demands as low as US $50 to $100 sent via mobile money applications to secure quick releases. This is reminiscent of the same tactic used by various criminal entities in Nigeria, where “express kidnappings” are common. (In my book, Illicit Money, I make the distinction between these types of local kidnappings for ransom, which usually generate small proceeds, and large international kidnappings for ransom that can generate ransoms in the tens of millions of dollars.)

The group has also begun keeping physical cash caches in hidden locations, while also concealing funds in the bank accounts of sympathetic businessmen and investing in local enterprises—both to mask resources and to generate ongoing returns. Similar investments were made in Mozambique, which we wrote about for Insight Monitor back in 2023.

Building on what has previously been reported, the Monitoring Team noted that ISIL-KP in Afghanistan has embraced cryptocurrencies as a key component of its financial toolkit, using platforms such as Monero, KuCoin, MEXC, Huobi and Totalcoin. While Monero’s popularity appears to be waning due to de-platforming from national exchanges and the difficulty of converting it, other tools are filling the gap. Chief among them is “Cash Now,” a cryptocurrency exchange app that facilitates rapid swaps between different crypto assets, giving ISIL operatives ready access to liquid funds without relying on the formal banking sector.1 Telegram’s @wallet funding app has also gained traction because it requires no know-your-customer checks, and unhosted wallets are increasingly used for single-use transfers that leave few traces. The report also notes that ISIL operatives are experimenting with AI-generated fake documents to circumvent know-your-customer procedures..

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Libya’s intelligence service has recently dismantled three ISIL facilitation networks. The first specialized in recruiting operatives from North Africa and moving them to Somalia and the Sahel, providing forged passports and safe houses along the way. The second laundered money through front companies to help fighters and their families escape the al-Hawl camp in Syria and relocate to Libya, where they were housed in ISIL-funded safe houses. This network also pursued investments in regional countries. The third focused on transferring funds to ISIL using cryptocurrencies. This is interesting, as much of ISIL’s network in Libya has reportedly been destroyed in recent years.

Taken together, these developments point to a clear trend: the increasing sophistication of financial tradecraft across ISIL’s network and in the broader terrorist financing arena. Investments in legitimate-seeming companies suggest an interest in long-term sustainability, while the growing adoption of cryptocurrencies reflects both opportunism and a growing liquidity in the cryptocurrency market that makes them useful for terrorist (both organizational and operational) financing. The report underscores that even when traditional funding lines are disrupted, these groups find ways to diversify income streams, conceal assets and adapt quickly to enforcement pressures

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

We covered a lot of ground, including:

• how input to the FATF report is solicited;

• what struck us as most interesting in the report;

• how the report can be used by governments, financial institutions, and researchers;

• that OnlyFans reference 🫠;

• new technologies (crypto, of course!) and terrorist financing;

• crime and terrorism;

• the uses and abuses of FATF standards;

• the cryptocurrency and hawala mashup;

• and much more!

We were joined by many of you (thanks!), and look forward to doing another one of these soon (maybe). If you think this is a good format, let us know in the comments or by messaging us. We’re eager to hear your thoughts and develop content that suits a broad range of readers. You can reach me here, of course, and you can reach Stephen on LinkedIn.

Get more from Jessica Davis in the Substack app

Available for iOS and Android

Get the app

New Articles

I also wanted to flag a couple of new publications. This week, I published an article with on how counterterrorist financing tools can be used (and abused) to counter organized criminal groups. Have a read of it here: Lessons from the Ledger.

I also wrote an article for GNet on the recent terrorism case in Canada of the group of military (former, current, and proximate) members seeking to create a “new society” in Canada and their anti-government ideology. You can read it here: “‘A New Society’: Behind Canadian Armed Forces Members’ Plot to Form a Militia and Seize Land.

Have a great rest of the week, and we’ll be back to our regularly scheduled articles next week.

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

However, if you want to support the ITI research team and other analysis from this newsletter, you’re still welcome to become a paying subscribe! This helps us produce more news and analysis you won’t find anywhere else. And there’s no shortage of topics….

The Nobitex Hack

Last week, in the midst of the Israel-Iran conflict, the largest cryptocurrency exchange in Iran was attacked by a “hacktivist” group, Gonjeshke Darande (Predatory Sparrow). Predatory Sparrow is believed to have “links” to Israel’s military or intelligence agencies, with some analysts suspecting that Israel sponsors the group. The hackers stole $90 million (in Bitcoin, EVM, Ethereum, Ripple, Dogecoin, Solana, and other cryptocurrencies) from the exchange, but effectively “burned”the money by transferring the funds to wallets for which they did not have the keys (the security mechanism needed to access the funds). The hackers also reportedly released the complete source code of the exchange, exposing assets still hosted on the exchange to possible theft. On Thursday, Nobitex responded, saying that no additional losses had occurred.

The Israel-affiliated hackers had previously attacked Iran’s Bank Sepah, and claimed to have destroyed all the bank’s data in retaliation for its association with the Islamic Revolutionary Guards Corp (IRGC).

Iran’s Crypto Lifeline

Nobitex is Iran’s largest cryptocurrency exchange. Since the mid-2010s, cryptocurrency has become increasingly important for Iran’s economy, facilitating payments outside of the formal banking sector (and to evade sanctions and sanctions-related restrictions on financial transactions). Nobitex has provided the majority of cryptocurrency services to Iranians since 2017, and between 2018 and 2022, it is believed to have processed $8 billion in transactions (often with the help of Binance). Nobitex processes transactions across multiple blockchains, including the ones that were attacked in the hack, as well as Tron. In addition to Nobitex, Iran also has four other large exchanges: Wallex.ir, Excoino, Aban Tether, and Bit24.cash.

Since 2018, Iran has used cryptocurrency to bypass US and international sanctions. The IRGC (and the IRGC QF in particular) uses cryptocurrency to move funds to support its various functions, including intelligence operations and its network of proxy groups (aka the Axis of Resistance). Indeed, Nobitex was reportedly targeted for its role in facilitating sanctions evasion activity and for terrorist financing, specifically between the IRGC QF and proxies such as Hizballah, Hamas, and the Houthis.

According to a statement from Nobitex’s CEO AmirHossein Rad (via a video posted on the social media platform X), the exchange had a delayed response to the hack due to limitations placed on Internet access in Iran and a lack of access to the company’s data centers. The Iranian government is believed to have significantly reduced (and in some cases stopped) all internet access for periods during the conflict. Rad further stated that the exchange will fully compensate clients for all funds stolen from hot wallets (wallets hosted online on the exchange) and reiterated that the exchange remains liquid, as the majority of its assets are held in cold wallets (offline storage devices). He indicated that the exchange will come back online gradually over the next four to five days.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Disrupting Iranian Illicit Finance

The future of Nobitex and the impact of this hack on Iran’s financial sector is uncertain. If the exchange is able to return to operations and enhance security after the alleged leaking of its source code, the cryptocurrency ecosystem in Iran will remain largely intact. However, if Nobitex is unable to resume services, this will seriously reduce the ability of regular Iranians (and the Iranian regime) to move money into and out of Iran. With Bank Sepah also offline, this poses a significant hindrance to the IRGC’s financial operations.

While Iran’s proxy groups are unlikely to feel the pinch in the short term (1-2 weeks), if these financial service providers remain offline, Iranian proxies will likely start to experience financial limitations and possibly face financial disruption, hindering their ability to procure weapons and goods, as well as pay for services. While other Iranian cryptocurrency exchanges remain functional, they are unlikely to replace Nobitex's processing volume easily, and if or when they attempt to do so, they might also become targets for Predatory Sparrow. Reducing Iran’s ability to provide financial support to its proxies was likely the intended goal of the hack; while this has been achieved in the short term, it remains to be seen whether this will be successful in the long term.

Did you find this Insightful? Share it with a friend!

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Outcomes of the FATF Meeting

Last week, the Financial Action Task Force (FATF), the global standard-setter for anti-money laundering and counterterrorist financing, released its updated list of jurisdictions under increased monitoring, commonly known as the grey list, and those identified as high-risk and subject to a call for action, more commonly referred to as the blacklist. These designations aren’t just bureaucratic labels; they have real implications for countries’ financial sectors, global investment flows, and geopolitical reputations.

To learn more about those impacts, have a read of this book chapter I wrote a few years ago.

Tanzania and Croatia were removed from the grey list after 2.5 years, while Mali was removed after 3.5 years. The UK Virgin Islands were placed on the list for the first time, and Bolivia was grey listed for the second time (the first was in 2011). Over the course of the list’s existence, 87 countries have been listed, some of them multiple times.

A continent-by-continent analysis reveals that Africa dominates the list with 12 countries, followed by 4 from the Middle East, 5 from Asia, and 4 from the Americas. Only three countries on the entire list — Bulgaria, Monaco, and the British Virgin Islands— are part of the Global North.

This geographic breakdown matters. FATF listing disproportionately affects countries in the Global South, highlighting a persistent tension in global financial governance. While the FATF emphasizes technical compliance and effectiveness in anti-money laundering and counterterrorist financing frameworks, the designations carry significant political and economic weight. Being grey- or black-listed can reduce access to international banking systems, raise the cost of capital, and trigger de-risking by international financial institutions.

As more countries from the Global South find themselves under FATF scrutiny, questions arise about equity in the global financial system and the capacity of lower-income countries to implement complex regulatory frameworks. At the same time, the listings serve as a reminder that illicit finance is a global challenge that transcends regions and political systems. Compliance isn’t just about checking boxes, but about building resilient and transparent financial institutions.

So does it work?

As part of my work for my PhD,1 I conducted a series of large data analyses looking at levels of terrorism in countries around the world (“levels of terrorism” was defined as the number of terrorist attacks each year, as well as the number of people killed and injured). To assess the impact of FATF grey and blacklisting on terrorism, I used a negative binomial regression (a statistical method designed to model count data, like the number of terrorist incidents in a country). This type of regression is ideal when the data shows high variability, meaning some countries experience very few attacks while others experience many. Negative binomial regression accounts for this uneven distribution, making it a good fit for analyzing patterns in terrorism.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

In the model,2 I included FATF listing status as a variable (amongst a half dozen others),3 lagged by three years.4 This lag accounts for the time it typically takes for technical assistance and other remedial measures triggered by FATF listing to take effect. The results show that even three years after being placed on a FATF list, countries continue to experience increasing levels of terrorism. This raises important questions about the effectiveness of FATF-driven reforms at enhancing global security. There are a number of possible explanations (I will explore these when I publish my book based on my dissertation), and this by no means suggests that we should abandon the FATF process. Instead, while these findings are preliminary, they provide a valuable starting point for evaluating whether FATF listings result in meaningful security improvements.

These findings underscore the importance of seeking empirical evidence about the real-world impacts of global anti-money laundering and counter-terrorist financing (AML/CTF) policies. While FATF listings are designed to pressure countries into compliance, we still know surprisingly little about whether those efforts actually reduce threats like terrorism and money laundering. This analysis isn’t the final word—it’s a starting point. By grounding future discussions in data and measurable outcomes, we can move beyond assumptions and begin to ask harder questions: What works, what doesn’t, and why? As the global community continues to refine its AML/CTF strategies, it’s critical that we base those efforts on evidence, not just expectations.

Share

Did you find this post insightful? Share it with a friend or colleague and help us grow our community!

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

On 3 June 2025, the Government of Canada tabled Bill C-2 in the House of Commons. The Bill, formally known as “An Act respecting certain measures relating to the security of the border between Canada and the United States and respecting other related security measures” (aka the Border Bill) “will strengthen our laws and keep Canadians safe by ensuring law enforcement has the right tools to keep our borders secure, combat transnational organized crime, stop the flow of illegal fentanyl, and crack down on money laundering”.

Share

The government claims that the Bill will “disrupt illicit financing”:

Do the measures proposed in this bill sound familiar? That’s because most of these were already advertised in the Trudeau government’s fall economic statement last year. I wrote about that here:

Illicit Finance Headlines

Bigger Fines, More Compliance?

There are two main headlines for me. The first is the enhancement of FINTRAC’s administrative monetary penalty regime. FINTRAC, Canada’s financial intelligence unit, is also the regulator for financial entities. These entities (banks, money service businesses like Western Union, and many others) are required to report suspicious and threshold transactions. This includes cash deposits and international wire transfers of $10,000 or more, among other things. When financial entities fail to meet these obligations, FINTRAC has the ability to administer monetary penalties. You will likely remember the recent fines against RBC, CIBC and TD Bank, all of which were over $1 million.

FINTRAC’s penalty regime has been under scrutiny for years because of the small value of its fines. It was hard to argue that compliance fines were a significant incentive to comply with reporting obligations when they topped out at a few million dollars. This might seem like a lot for an individual, but for many financial institutions, it was hardly more than a rounding error, if that.

Under the new proposal, the maximum penalties would be $4 million for individuals and $20 million for entities (an increase from $100,000 for individuals and $500,000 for entities). These violations can be stacked. For instance, TD Bank was fined $9.3 million for five violations (of which there were many instances). I can’t explain exactly how the math works out, but basically, FINTRAC has the ability to issue penalties for each violation and instance of violations.

There are limits to the penalties. For individuals, this is the greater of $4 million and 3% of the person’s gross global income. For entities, this is the greater of $20 million and 3% of the entity’s gross global revenue. So, keeping with our example of TD Bank, it is conceivable that they could have faced far greater fines, limited only by 3% of their 2023 revenues. For reference, 3% of $2.9 billion is $87 million. This is still a far cry from the penalty they faced in the United States, which was $3.1 billion, but is also proportional to their Canadian revenues.

Also interesting is the addition of compliance order violations, which are (as far as I can see) new, and have even bigger penalties than original compliance violations, of $5 million and $30 million for individuals and entities, respectively. This makes sense. Once financial entities are under compliance orders, failure to abide by those orders is serious. The Trudeau government promised us increased criminal liability for serious non-compliance, and this is what I think we get instead of that.

Personally, I’d have preferred more serious criminal liability in these cases. Still, frankly, we have a limited ability to investigate and prosecute criminal non-compliance as it is, so I think this is actually the most feasible way to improve compliance.

Cash Limits, Big Implications

The second impactful amendment, in my view, is the one on cash transactions. While professions and businesses have long been required to report cash transactions of $10k or more, this new legislation will outlaw those transactions in their entirety. Casinos, in particular, will no longer be allowed to accept cash buy-ins of $10,000 or more, which will have the effect of driving cash deposits to financial institutions and entities. The idea here is that these institutions are better able to manage the risk (and reporting) associated with cash transactions of this nature. While this isn’t the part of the Bill that will garner headlines, I believe it is likely to be the most consequential amendment for disrupting illicit financing throughout the entire bill.

Yes, criminals will still have cash, and they will still launder it. But the number of places they are able to do so (particularly through the first stage of money laundering, placement into the financial system) will be limited. This will increase friction for criminals, which is the whole point. If a regime creates enough friction, it reduces profit for criminals.

Housekeeping

There are also a few other amendments that, in my view, are more like housekeeping for our illicit finance regime. These include making sure that information sharing for public-private partnerships is on firmer footing. (Specifically, the Integrated Money Laundering Intelligence Partnership between banks and law enforcement, but the new legislation is drafted to include terrorist financing and sanctions evasion, thus covering all of FINTRAC’s mandate.) FINTRAC will also be able to share disclosures with the Commissioner of Elections Canada, which will help on the foreign interference issue, and was a recommendation I made at the foreign interference commission. There are also other smaller amendments that I think are less impactful but will likely help FINTRAC do its business, such as universal enrolment for reporting entities and having FINTRAC’s Director a member of an OSFI (bank supervisor) committee.

More Amendments, Little Illicit Finance Impact

If you’re reading this and wondering how this will help “combat transnational organized crime, stop the flow of illegal fentanyl, and crack down on money laundering”, you’re not alone. Most of these amendments do very little to move the yardstick on these issues.

And of course, this Bill still has to pass through committees in both the House and the Senate, and survive a vote in the House of Commons. In a minority parliament, that is a challenging task. The opposition could drag out the committee process, and the government will have to find a few members of the House to support the bill. Alternatively, some members of the opposition might be absent from the House that day, thus creating an easy path for the Bill to pass.

Regardless of what happens with the Bill, the big issues preventing meaningful action on organized crime and money laundering remain: an RCMP desperately in need of reform to effectively investigate these crimes, a lack of analytic and investigative capability (mostly in terms of numbers although upskilling is a huge challenge when resources are stretched), and a lack of government prioritization (and resources). Those of you with eagle eyes will see that there’s nothing here on establishing a Canadian Financial Crimes Agency, or fixing the RCMP’s mandate so that they are better able to investigate these issues.

So here we are, with yet another Canadian government paying lip service to combating illicit finance, yet doing very little about it in practice.

Share

Did you find this article insightful? Please share it with a friend and help us grow our community of individuals working to make the world a safer and fairer place for everyone.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Following the Liberal election victory, Stephanie Carvin laid out her national security priorities for the Carney government on her Substack. We’ve agreed (along with our co-host, Leah West) to do our final episode of Secure Line on this topic.

This promises to be a heady mix of issues for Canada, both domestic and international. Before this episode, I thought I’d lay out some of my logic and rationale for what I believe the Carney government’s top four national security priorities should be. A quick disclaimer: I chose four to align with Stephanie’s list. However, I also think that nothing is a priority if a government has anything more than a handful of priorities. So here are what I think the Carney government’s top four national security priorities should be:

1. RCMP Reform

Readers of this newsletter will not find this surprising. I’ve long been critical of the RCMP’s underperformance in matters of national security. Much of this is driven by structural issues and the overly broad mandate of the RCMP, which focuses on both federal and local policing. The RCMP also has many other responsibilities and activities that contribute to policing across Canada. This broad mandate has made it difficult for the RCMP to protect resources for long and complex investigations like financial crimes, as community policing resourcing often takes priority. Former Prime Minister Trudeau discussed this in his white paper, which he released on his last day in office. There’s a strong case to be made for separating federal policing responsibilities from contract policing, either under a functionally separate structure or a new enforcement agency. This is an issue whose time has come. I’ll likely have more to say about this shortly.

Along with RCMP reform, we need to do something about financial crimes enforcement. One option that the Trudeau government pursued, but did not execute, was the creation of a financial crimes agency. From my perspective, I see two different models. Creating a standalone financial crimes agency would be beneficial without RCMP reform. However, financial crimes are intricately linked to all federal crimes, like espionage, foreign interference, serious organized crime, professional money laundering, sanctions evasion, terrorism, and political corruption. Because of this, the best solution for Canada is a reformed RCMP with a more explicit mandate, protected resources for federal policing (or even a standalone federal policing RCMP), which includes financial crimes. But if that doesn’t happen, a standalone financial crimes agency is the next best option.

One thing I don’t think we need to prioritize now is terrorism and violent extremism. That’s not to say that I don’t think it’s an issue – it certainly is!

What I think, however, is that our systems are working pretty well in that regard. We’re seeing preventative arrests and peace bonds, and a generally low level of terrorism (compared internationally, despite it being a high threat level compared to Canadian history). In fact, I’d argue that this type of policing is the thing the RCMP does best. Does that mean it’s perfect? Of course not: I’d love to see more after-actions and lessons learned shaping policy and operations to fine-tune this process. But does the RCMP succeed in threat-to-life investigations? Broadly speaking, yes. So this isn’t the place where I think we need to place our priorities (for now). We need to maintain and fine-tune our approach.

2. Enhanced and expanded intelligence relationships beyond the US

The United States is Canada’s main intelligence partner. There is no doubt in my mind that this continues to be true. However, given what’s happening in the United States with some senior appointments and their concerning views on one of our main adversaries (Russia), the gutting of the FBI, staff reductions at intelligence agencies, and the overall antagonistic relationship with Canada that Trump seems intent on pursuing, this cannot continue. Canada needs to diversify its intelligence relationships beyond the US, eventually looking to replace the importance of that relationship with a network of new and expanded intelligence sharing agreements.

Of course, Canada has existing intelligence relationships beyond the US. We have the other members of the Five Eyes, and intelligence sharing with them can often be very robust, sometimes even surpassing intelligence sharing with the US on specific issues and operations. Beyond the Five Eyes, we also have intelligence sharing agreements with other European countries and countries around the world. All of these existing agreements need to be nurtured. We need to spend far more time strategically cultivating these relationships on areas of mutual interest to create redundancies in our intelligence relationships and networks, and diversify away from the United States. Shared interests should dictate intelligence relationships: We increasingly have fewer and fewer shared interests with the United States, and our intelligence apparatus should respond accordingly.

3. Enhanced collection and use of intelligence for economic security and trade

What are Canadian interests when it comes to intelligence collection and sharing? Certainly, security issues like terrorism, foreign interference and espionage are critical. However, I would go beyond this and argue that Canadian interests that should be supported by robust intelligence collection relate primarily to economic security and trade. That’s not to say that this capability doesn’t exist: it does. Canada already has a strong program on economic security, and some support for trade from intelligence. But if our current capabilities sit at a 5/10, we should be turning that up to a 9/10 or a 10/10. This would provide Canada (and our allies) with crucial intelligence, and support the development of trade relationships worldwide, helping us diversify away from the United States.

This is also a place where Canada could develop a very niche area of expertise. We already have a head start and expertise with the Investment Canada Act and supporting intelligence activities. Canada could use this expertise to support our allies, security and trade partners, and shore up those critical networks.

One additional capability that would be useful on this front would be the creation of a foreign human intelligence agency. Canada already collects some foreign intelligence through a variety of capabilities, but a human foreign intelligence agency would provide a unique set of capabilities, support economic security and trade development, give Canada unique intelligence to share with our enhanced network of intelligence partnerships. It’s critical to remember that intelligence relationships are often based on the principle of “Give To Get”, so we have to have something worth giving to get useful intelligence in return. I don’t see this as a short-term solution, but certainly, the policy work to develop this could be started, perhaps through a secretariat at Public Safety. There are years of policy and implementation work ahead of this happening, so it would be a good idea to get started now, to support broader intelligence and security priorities.

4. Sanctions regime for criminal and cyber actors

Finally, Canada should prioritize creating a sanctions regime for criminal and cyber actors. Our partners in the US and the UK already have this capability: to list criminal actors and cyber gangs, and subject them to financial and administrative restrictions. In Canada, we cannot list, for instance, ransomware gangs, under any of our existing sanctions regimes. (There might be some instances where we could squint and make the case under the terrorism listings regime, or SEMA, but these would be a stretch and an inelegant, and possibly unlawful, use of these regimes.) Instead, Canada should create a dedicated regime to target these actors.

This is a pressing issue because Canada is one of the most targeted countries for ransomware actors. Having a sanctions regime would allow Canada to restrict the movement of funds to these criminal actors, which could have a deterrent effect on their activities targeting Canadians. It would also enhance the tools that we could bring to bear on these actors, and align us with our partners in the UK and the US to target criminal entities. Enhanced intelligence activities on economic security would also facilitate this sanctions regime. Ransomware actors target Canadian critical infrastructure, including hospitals, as well as universities, so establishing a sanctions regime against criminal actors could be beneficial. It could also be used against international criminal organizations, and if done correctly, might unlock new investigative tools to facilitate complex investigations.

We’re going to talk this through next week for Secure Line, so you’ll get more details and debate on these proposed priorities. You’ll want to tune in to find out what Leah and Stephanie think, so keep an eye on your podcast feeds later next week. In the meantime, you can get caught up on the first season of Secure Line here, on YouTube, or wherever you get your podcasts.

Share

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

What is Terrorgram?

As outlined in Insight Monitor’s coverage of Ecofascism, Terrorgram functions as a writing collective composed of anonymous but influential Nazi accelerationist figures and social media personalities. It has become a major producer of accelerationist propaganda, and draws inspiration from an evolving strain of neo-Nazism originating from Iron March. The network deifies figures such as Brenton Tarrant, Anders Breivik, and Ted Kaczynski, along with other mass murderers they refer to as “saints.”

Insight Monitor

Greenwashing Hate: Ecofascism and Finance

Hello Insight Monitor subscribers! Today, we’re looking at ecofascism and some of the financial connections that underpin this movement. This article provides an ideological and historical overview of the movement and its intersections with other elements of the far and extreme right. Let us know what you think of this article in the comments, and thanks, as always, for caring about illicit finance and global security…

Read more

a year ago · 1 like · Dan Collen

A defining behavior of the network is its reliance on Telegram as a hub for announcing new extremist groups, recruiting members, and disseminating propaganda. While Telegram serves as its core platform, Terrorgram-affiliated groups also expanded to mainstream social media to reinforce their messaging and amplify allied organizations – however, the presence on these other platforms often does not last as long due to content moderation. Tech Against Terrorism identified 21 entities operating as part of Terrorgram between June 2021 and February 2022, noting that these groups were distinct but appeared to be strategically allied.

Over the past year, the collective has faced significant setbacks as antifascist activists identified individuals in Canada and the United States as part of the network. This has led to the arrest of multiple members on terrorism charges, disrupting Terrorgram’s ability to operate freely.

Read more

First, a request. As most of you know, our Global Terrorist Financing Report comes out twice a month, and covers all the terrorist financing news from around the world. We’re going to expand that to include covering the newly minted terrorist organizations that are actually criminal organizations (Mexican Drug Trafficking Organizations, primarily). While I don’t agree with the listing / designation, the reality is is that because both the US and Canada think these are terrorist groups, we’re going to analyze them as such. Don’t worry, we’ll keep this in a separate section of our newsletter so you can skip it if it doesn’t apply to you.

But, relatedly, this is going to increase our team’s workload. Already, this portion of the newsletter costs us thousands of dollars every year to produce. We think it’s a valuable resource, and from what some of you have told me, you agree. So: in order to keep this news roundup happening, we are going to need to

• a) increase our paid subscriber base, and

• b) put the news roundup behind a paywall right from the start.

I know this will disappoint some of you,— this has been a free resource for years. But it hasn’t been free for us to create.

So here’s the ask: by the end of March, we need 30 more paid subscribers or we will have to stop producing the Global Terrorist Financing Report. It takes a lot of time and effort to find and curate all the articles, so we need to cover those costs. Subscribe and share so we can meet this goal and continue to produce this valuable resource! 

Subscribe now

Podcast Updates

We’ve released two new episodes of Secure Line recently. The first features Global News reporter Stewart Bell talking about the terrorism threat in Canada. You won’t want to miss this, particularly in light of US retrenchment and its implications for counterterrorism. You can check it out here:

Our episode “Implausible Deniability” was released today, and you can find it on all major platforms as well. We talk with Matthew Redhead about state threats, their intersection with organized crime, and his recent report “Old Wine in New Bottles”. It’s a must-listen for anyone interested in foreign interference and espionage.

Paywall Removed: Terror on the Rise

By popular demand, we’ve removed the paywall on one of our recent analyses looking at the terrorism threat in Canada. Have a read, and let us know what you think!

And in case you missed it, here’s another article without the paywall, part of our research reads series (aka the Insight Monitor bookclub). Be sure to check it out and update your knowledge on terrorist and illicit financing!

That’s it for updates today. Remember, we’re doing a big subscription drive for the next five weeks, and we really need your support to keep doing what we love. If you can, please upgrade to paid, and if that’s not possible, sharing is caring! The more we grow our audience, the better!

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

• $1.3 billion border plan (this had previously been announced)

• Appointing a fentanyl czar

• Listing cartels as terrorist organizations

• Watching the border 24/7

• Launching a joint Canada-U.S. strike force to target organized crime, fentanyl and money laundering

• Signing a new intelligence directive on organized crime and fentanyl backed by $200 million

If some of this sounds like stuff Canada is already doing, that’s because it is. However, the last two points are likely new, and listing the cartels as terrorist organizations certainly is. While details are murky about what the joint Canada-U.S. “strike force” entails or the new intelligence directive, any efforts to combat money laundering and organized crime in Canada are welcome.

What exactly we’re going to do on the intelligence front is particularly unclear because, in Canada, we don’t really have “intelligence directives.” We have intelligence priorities, and combatting organized crime and illicit financing are already two priorities. It might be a Ministerial Directive to law enforcement and intelligence services to do more on this issue. It’ll be interesting to see what, if any, details emerge because much of this is already happening.

Leaving that aside, let’s talk about two issues that Trudeau’s negotiations raise: the scope and scale of money laundering in Canada and listing cartels as terrorist entities.

Money Laundering in Canada

Like terrorist financing, there are several different ways to measure money laundering. In Canada, we frankly have no idea what the scope and scale of money laundering is. Our biggest issue is the lack of coherent and collated information on money laundering investigations, charges, prosecutions, and other forms of disruption.

However, we know plenty of suspected money laundering activity is happening in Canada. According to FINTRAC’s annual reports, the Centre shares thousands of disclosures with law enforcement about suspected money laundering in Canada yearly. Each disclosure could contain a single suspicious transaction or thousands of individual transactions. Still, in each case, disclosures must be shared based on reasonable grounds to suspect that the information would be relevant to a money laundering investigation. That’s a lot of possible money laundering.

There are also other measures of illicit activity in the Canadian economy: Canadian exposure to illicit crypto transactions. My friends at TRM Labs were kind enough to share their 2024 Crypto Adoption and Illicit Exposure Report with me, and there is some disturbing info in it. Their illicit crypto exposure index shows countries with the highest proportion of illicit crypto exposure. Canada is in the top ten this year for the first time, with the illustrious company of countries like Iran, North Korea, Nigeria, and Russia. This is not a good list to be on. The primary category of illicit activity in Canada? Sanctions evasion activity.

There are also the non-compliance disclosures that FINTRAC shares with law enforcement. These disclosures share information that rises above the usual regulatory failures and wades into potential criminal liability for not complying with the Proceeds of Crime, Money Laundering, and Terrorist Financing Act.

This often involves things like professional money launderers and informal value transfer systems.

Further, profit-motivated crime, particularly cybercrime, is rising in Canada. This often involves money laundering and organized crime. Police-reported organized crime is also increasing in Canada (all data available from Statistics Canada). Recent reporting from FINTRAC also indicates that Canada is home to professional money laundering networks.

Finally, gravity models3 of money laundering in Canada suggest that this was a $46.7 billion problem in 2018,4 and would undoubtedly be a more substantial problem in 2025.

All of these measures point to a reasonably serious money laundering and crime problem in Canada. In the last election, the Liberals promised to tackle this issue, in part by establishing a financial crimes agency. That has not happened, and from what I understand, resources continue to be pulled from federal financial crime policing efforts despite a recent high-profile success. So there’s a non-zero chance (as much as it pains me to say it) that the threat of tariffs might motivate the government to finally get serious about money laundering and illicit finance in Canada. That’s the hope, anyway.

Listing Cartels as Terrorist Organizations

Part of Trudeau’s negotiations with Trump resulted in the agreement that Canada would list cartels as terrorist organizations. I’ve gotten a lot of questions about whether this would be lawful, and my answer is unfortunately, probably. And even if it isn’t, it likely doesn’t matter. Here’s why.

First, many cartels engage in targeted killings and general violence for the purpose of intimidating the population or a segment of the population, such as politicians. The criteria for listing involves carrying out terrorist activity (violence for a political purpose) is easily met by this activity. So the designation of cartels is likely lawful.

Second, even if the designation were not lawful (i.e. the criteria had not been met), it wouldn’t matter, and Canada would designate them anyway. Take, for instance, the listing of the IRGC. The Islamic Revolutionary Guards Corps is listed in its entirety as a terrorist entity, even though there’s a specific carve-out for state armies in the listing criteria. Canada has shown that it is not interested in adhering to its own listing criteria in this process, and instead increasingly uses it as a political tool and for political theatre, as the votes for listings have illustrated.

There’s little threat of repercussions for Canada for not following its listing process and criteria: to challenge the listing, the designated entity would have to engage legal counsel, something that is difficult to do when you are prohibited from engaging in financial transactions. Further, most listed entities can’t be bothered to challenge the listing, as it has little material impact on their activities, particularly if they employ a modicum of financial tradecraft.

In other words, the sophisticated analysis I shared on Bluesky yesterday stands: It’s icky but lawful.

I’m sure there’ll be more to discuss on this issue over the coming days and months, and you can be sure that I’ll be writing about it here. But you can also listen to my analysis on my new podcast, Secure Line, which I’m cohosting with Leah West and Stephanie Carvin. Subscribe wherever you get your podcasts.

Share

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Read more

~Jess

In 2023, the Government of Canada established the Public Inquiry into Foreign Interference. The focus of the inquiry is foreign interference in federal electoral processes and democratic institutions. The current phase of the inquiry is reaching more broadly to understand the capacity of the government to detect, deter, and counter foreign interference.

I was asked to participate in the roundtable on political financing, and I focused on comments on foreign interference financing, drawing on international examples (and some Canadian) of concrete FI activity and its financial mechanisms. If you’re interested in this topic, you can check out all the roundtables here. I recommend you watch the roundtables from Wednesday, 23 October, on Canada’s national security apparatus and enforcing, deterring, and prosecuting foreign interference activities. Those two panels featured some faces that are likely to be familiar to readers of this newsletter (I have worked with several of these folks, both academically and professionally), and there were some very interesting and innovative ideas for combatting foreign interference.

The main takeaway from both of those panels, plus my own, is that, by and large, we do not need new offences for dealing with foreign interference. My own recommendations focus on structural changes and some tinkering with the Proceeds of Crime, Money Laundering and Terrorist Financing Act and associated regulations, but more on that next week when I submit my final report to the Commissioner.

For today, here’s a summary of my comments on what foreign interference financing looks like and a link to my presentation and questions and answers. I was very heartened by the Commissioner’s interest in financial intelligence, the role of FINTRAC in all of this, and getting to the facts. This was my second time participating in a Commission of Inquiry, and this was an excellent use of my time.

Want to learn how to identify and exploit financial intelligence sources? In ten days, we are launching our latest offering in our series on financial intelligence. Don’t miss out: we‘ve got lots of great content and a new community to help you learn and expand your knowledge of financial intelligence!

Foreign Interference Financing

Foreign interference requires resources and money. It takes money to build disinformation networks, pay influencers, and spread messages. It also takes money to engage in transnational repression activities, whether that’s through official salaries, bonuses, or stipends. It also takes money to buy votes, fund candidates and parties, and ensure that voters who support a particular message make it to the polls.

Financing has been a neglected element of foreign interference investigations and research. As such, I focus on international examples of foreign interference financing (some of which will also reflect what the commission has heard here in Canada) and will aim to give concrete examples of how money enables foreign interference.

These cases inform a discussion of Canada’s strengths and vulnerabilities (in terms of legislation, regulation, and capability). While there are some areas of improvement for Canada in terms of legislation, the vast majority of the work Canada needs to do to exploit financial intelligence for foreign interference financing disruption is in investigations: resources, skills, and political will.

Canada needs to invest in its capabilities to detect and disrupt foreign interference. This applies to its financial intelligence unit, FINTRAC, and its law enforcement and security services responsible for conducting these investigations. They must understand and exploit financial intelligence in the foreign interference space.

Financing Foreign Interference Activities

States use various methods to interfere in the politics of other countries:

• Financing Political Parties and Candidates: Foreign actors have financially supported political parties and candidates aligned with their interests. These funds can be direct donations, loans, or other financially advantageous transactions.

• Funding Political Campaigns: Foreign governments have also funnelled money to support specific political campaigns. This funding can provide a significant advantage to the recipient, potentially distorting the electoral process and undermining fair competition.

• Incentivizing Voters: Foreign actors also directly target the electorate to influence voting behavior, such as discounted flights, shopping vouchers to encourage return to vote.

• Vote Buying: Vote buying is another potential method of foreign interference. While not as common as other tactics, it involves offering money or incentives directly in exchange for votes.

• Exploiting Diaspora Communities: Foreign actors also attempt to leverage their diasporas to influence elections in their host countries. This can involve mobilizing support for favoured candidates, providing financial contributions, or even engaging in voter intimidation.

• Misinformation / Disinformation: State actors will also spread mis- and dis-information in elections (and outside of election periods) to shape the information battlespace. In some cases, state actors pay troll farms to amplify particular messages.  In other cases, states pay for advertisements, sponsor investigative journalism, and pay for interviews to promote their interests.

Financial Transactions in Foreign Interference

The activities involved in foreign interference financing are essential to understand, as are the transactions that support these activities. These usually involve cash payments, cryptocurrency transfers, loans, and bank transfers, as well as the use of third-party intermediaries, foundations, think tanks, organized crime groups, political consultancies, shell companies, state-owned enterprises, and sometimes embassy accounts and resources. Gifts and luxury goods are also used to compensate threat actors for their role in foreign interference. In-kind donations (payment of legal fees, buying media space to promote a selected candidate or party) and even transportation subsidies to ensure voters get to the polls are all examples of financial transactions involved in foreign interference.

Obfuscation: State actors often use intermediaries (including friends, family members, and trusted business associates) to send and receive funds on behalf of or in support of the political candidate or party and to obfuscate their role in the interference activity. In some cases, financial institutions might be co-opted to enable the transfer of funds with less scrutiny. Finally, states also pressure donors to give money to specific candidates.

These activities and transactions outline how Canada’s adversaries finance foreign interference activities. Much more research needs to be done to establish more robust patterns of activity that can be used to support detection and disruption. For now, however, this high-level description can inform discussions on legislation, regulations, policy, and enforcement.

You can watch my full presentation (and question & answers) here (starting around the 24-minute mark):

More to follow after my final report (including sources and recommendations) are shared with the Commission.

Share

Subscribe now

On Friday, the Globe and Mail published an op-ed by the editorial board calling for the Prime Minister to release the names of “those who collude against us”. This is a reference to the 11 political candidates and 13 political staff members that Justice Hogue, Commissioner of Canada’s Public Inquiry into Foreign Interference in Federal Electoral Processes and Democratic Institutions (PIFI), said either had a direct connection to (witting or unwitting) or were affected by the activities of PRC threat actors in the 2019 election.

For background to Canada’s foreign interference inquiry and the issue in general:

While there's robust public interest in knowing the names of people named in classified intelligence for colluding with foreign governments, Hogue has said she will not release the names; the Globe editorial calls instead on the Prime Minister to do so. The editorial board argues that the precedent has been set by the Prime Minister sharing classified intelligence in the House of Commons relating to the targeted assassination of Hardeep Singh Nijjar in BC. However, this comparison creates a false equivalency: naming and shaming a state is very different from naming Canadian citizens or residents as complicit in foreign interference.

Further, it is not clear who, exactly, the editorial board wants named. The language that the Commissioner uses is critical here: there is a combination of witting and unwitting individuals implicated in this activity. The editorial board wants to name the members of parliament implicated (a subset of the 24 individuals referenced in the Hogue report), but it’s not clear that the MPs were all wittingly complicit in the threat activity. There might be a case to be made for naming the witting individuals, but naming the unwitting ones and those who were impacted by these activities would paint everyone with the same brush. I have a few concerns with this, but Justice Hogue says it best in the report:

“Canada is a state governed by the rule of law, which recognizes and protects the fundamental rights of every individual, including the right to fully defend oneself against charges and accusations,” Hogue said.

There is no meaningful way this can happen. Let me explain.

Intelligence is not evidence. The accusations against these individuals (and the MPs that the Globe and Mail want to have named) are derived from intelligence. But this is not evidence. In intelligence, there are often motivated sources, circular reporting issues, intelligence from foreign agencies or highly sensitive sources that can't be disclosed, etc. Intelligence is about probability, not certainty. Given the classification and likely source of this information, full disclosure of where it came from (required for people to be able to accurately defend themselves against these accusations) cannot happen. We already know that there are issues with some of the information that has been reported.

As a result of the complexities of intelligence collection, analysis, and dissemination, the named individuals would not be able to fully defend themselves. The intelligence would not be revealed in its entirety, which means the individuals named would have no ability to refute specific instances or allegations. Without being able to refute the intelligence piece by piece, their defence would be hollow and unconvincing. They would be convicted in the court of public opinion.

Further, naming them would overtake the story but not provide any solutions. The media cycle would focus on the individuals, not the systemic problems facing Canada in dealing with FI. Focusing on the individuals would create the illusion of solving a problem, not actually fixing it. Yes, the government passed the FI bill, but as the recent case of Tenet media illustrates, there are still gaps in that Act and clear issues that still need resolving, to say nothing of enforcement. The 24 individuals referenced in the Commission’s report is not the sum total of the foreign interference problem in Canada.

The real solutions lie in prosecuting the individuals involved (for any law they might have broken, although there might not be any…) and having party leaders with classified clearances (and knowledge of the named individuals) withhold party nominations. (Relatedly, Elizabeth May said no sitting MPs were listed in NSICOP’s unredacted report.)

When I posted a version of this article in a thread on X (the platform formally known as Twitter), it caused quite the uproar. I’m going to take a few minutes and address a few of the more coherent and useful comments.

My former colleague Andrew Kirsch asked why we were holding this to an evidentiary standard when the MPs haven’t been charged with a crime. I think that’s exactly the point. Do we want a world in which the Prime Minister (or NSICOP, or another parliamentary committee) releases a list of names of people they believe have collaborated with foreign powers? What recourse would these individuals have? Slander/libel laws would likely not apply because of parliamentary privilege, so they would have no recourse or ability to correct the record. (And we all know intelligence gets things wrong sometimes.) Andrew also raises the prospect of a different level of disclosure depending on the severity of the allegations, which is something I’ll get to in a moment.

Another commenter noted that some of our allies have decided to name and shame, including the UK. In one case, MI5 named Christine Lee as an “agent of influence” for her work for the United Front Works Department and her efforts to “seed” the UK political system with candidates friendly to China. I don’t know the ins and outs of the case, but it seems as though there were no charges that could be brought in this case. I suspect this might have been a form of threat disruption from MI5.

Here’s one challenge in terms of prosecution: investigations seeded from intelligence, which (if underway) these almost certainly are, require parallel reconstruction to capture evidence that does not rely on the original intelligence, especially if that intelligence cannot be disclosed in a court of law, like highly classified or allied reporting. Depending on how much time has elapsed between the collection of the intelligence and the start of a law enforcement investigation, this reconstruction might be extremely difficult, if not impossible. Imagine a scenario in which CSIS acquires a recording of a phone conversation that happened four years ago. Two years later, CSIS acquires additional intelligence suggesting that the phone call, in addition to the new intelligence, might rise to the level of criminal activity. It’s now been two years since the phone call occurred, and even if the RCMP were able to get a warrant to tap the phone based on a disclosure or advisory letter from CSIS, the subjects of the investigation might not communicate again or engage in any illicit activity. This is a simplified hypothetical scenario, but it’s meant to illustrate that you can’t just push a “parallel reconstruct” button and have all the intelligence automatically become evidence.

This raises an interesting prospect (related to Andrew’s comment above). In the most egregious cases of foreign interference, there might not have been any laws broken. The Foreign Interference bill that passed earlier this year goes some way to solving this problem, but gaps remain.

That does not mean that there is nothing to be done. CSIS does have the power to engage in threat reduction measures. Some of these require a warrant, and others do not. There is a world in which CSIS, in consultation with relevant partners (and likely the political level as well), decides that naming an MP as a “foreign collaborator” or “agent of foreign influence” is a proportional and appropriate threat reduction measure. However, I would have to think that this a) might require a warrant and b) require that CSIS has tried other measures to reduce the threat before doing so, as this could be seen as democratic interference. I also think that this is not something my former colleagues at CSIS would be keen to do if they had any other option. Accusations of politicization of intelligence would almost certainly be forthcoming.

We also don’t know that CSIS ~hasn’t~ engaged in threat reduction activity relating to foreign interference. There’s a host of things that they can do, many of which would not require a warrant, to try to reduce the threat of foreign interference.

Anyway, the TL;DR here is that naming the "foreign collaborators" will not solve our FI problem. Instead, it will just distract us from the real issues facing Canada. These are hard policy problems that won’t be solved with a simple list.

Share

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today!

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Listen on Spotify

In the podcast, I talk about a number of resources (including Insight Monitor, which I assume you’re familiar with since you’re reading this post). The others are here:

🔗Our analysis of Hamas financing (full report): https://insightthreatintelligence.thinkific.com/courses/hamasfinancingreport

🔗My article in Terrorism and Political Violence outlining the policies and practices involved in counter-terrorist financing: https://doi.org/10.1080/09546553.2022.2083507

If you want to learn more about terrorist and threat financing, sign up for our terrorist financing analysis course today!

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Share

Subscribe now

***

For the first time, a Canadian has been sentenced to life in prison for a white nationalist terrorist attack. Last week, Nathaniel Veltman was sentenced to five life sentences after having been found guilty in November on four counts of first-degree murder and one count of attempted murder. Veltman killed four members of a Muslim family, and injured another, in what we now know was a terrorist attack motivated by white nationalism.

White nationalism is part of the ideologically-motivated violent extremist landscape. White nationalists want to create a white ethno-state. The majority are white supremacists, and want strict controls on non-white immigration, and sometimes go so far as to support ethnic cleansing or genocide. In this case, the killer took action on these ideas, trying to rid Canada of minorities, and in this case, specifically Muslims.

Ideologically-motivated violent extremism, a category of extremism that includes incel-motivated violence, white supremacist and white nationalist violence, as well as anti-authority violence, is a growing concern for many Western countries, Canada included. In fact, this form of extremist violence has killed more people in Canada than another other type of political, ideological, or religiously-motivated violence, with the exception of the Air India terrorist attack in 1985.

The growth of this form of violent extremism is often attributed to the availability of extremist content online, ranging from extremist manifestos to the live-streaming of terrorist attacks. And while the availability of this content is concerning, this attribution misplaces cause and effect. The ideas are not driving the hate: instead, the hate and fear felt by these extremists is finding an outlet in these ideas. Just as Islamic State propaganda landed with young, socially-isolated and vulnerable Muslims and recent converts to Islam in the 2010s, so does white nationalist propaganda land with young, socially-isolated and vulnerable men and women in the 2020s.

In both cases, the first reaction of terrorism prevention professionals has been to advocate for content restrictions. While there is certainly content that should be restricted (terrorist manifestos and the live-streams of terrorist incidents are two clear-cut cases), restricting other types of extremist content quickly becomes difficult. The internet is decentralized and distributed, and so are the laws that govern content restrictions. Recent experience has demonstrated that this is not a practical solution.

Nor does restricting the content remove the underlying conditions for radicalization and mobilization (how people act on their extremist ideas). Even more confounding, millions of people consume extremist content online, and tens of thousands (and probably many more) are white nationalists. But only a very small fraction of these individuals will go on to commit acts of violence. The challenge lies in figuring out who will move from ideas to action.

One solution is to significantly expand law enforcement and security service surveillance of individuals consuming white nationalist (and other IMVE) content and try to proactively identify people mobilizing to violence. While possible, this would require a significant increase in national security budgets in Canada and would greatly enhance the number of people under surveillance, infringing on their civil liberties. It also would not solve the problem of signal to noise: there is still no good way to predict who will act on their extremist ideas.

This is why the finding of the attack being motivated by white nationalist extremism is so important for Canadians. We need to understand that this type of ideology can lead to murder and terrorism. People do not tend to radicalize and mobilize in isolation: they usually do that by consuming extremist content (often online, although it can also happen in-person), and will often try to find “fellow travellers” with whom they can share their extremist ideas. Even so-called lone actors (like Veltman, people who commit acts of terrorism on their own) share information about their intention and plans with people around them, although not always intentionally.

While the finding of terrorism in this case is important from a signaling perspective (helping Canadians understand that terrorism can look like a white man deliberately hitting a Muslim family with his vehicle), it does little to make Canada safer. To do that, law enforcement and security services need to get better at preventing this type of attack, which they can only do with better research into the mobilization process. They also need to be more transparent about why they are not able to detect attackers before they act: the reasons might point to legislative or policy changes that need to be made to make all Canadians safer. Fundamentally, law enforcement and security services need to develop better tools to detect and disrupt ideologically-motivated violent extremism before it takes another life in this country. The body count is already too high.

Share

If you want to learn more about how the January 6th insurrection on the US Capitol was financed, and what can be done to stop the next incident, have a read of our report:

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Listen: CBC

Subscribe now

If you’d like to read a bit of background on the case, you can read our analysis here:

From CBC’s The Current:

JESSICA DAVIS: Good morning, Matt.

MG: When you read or perhaps listen to that judge's decision yesterday, what went through your mind?

JESSICA DAVIS: My initial reaction was one of extreme relief. It's one of those, when we look at this case, it is a textbook case of terrorism. And I think many of us, you know, terrorism experts looked at this and said, well, we really hope that the judge finds this because to find otherwise would really question or raise a lot of questions about our terrorism legislation, our judicial system, etc. So, the relief was palpable, I think, from people who are watching this kind of thing.

MG: What does that mean? A textbook case of terrorism? Because to Dr. Sukhera's point, in past, that has not been a luxury afforded to Muslim communities. They saw it as a textbook case, a slam dunk, but weren't sure that that would be seen within a court of law, for example, because of past cases.

JESSICA DAVIS: Yeah. And I think that concerns about bias in our judicial system, in our police force are justified. There's a lot of cases in the past that could have constituted a terrorism offence, particularly, I think about the Quebec Mosque shooting that were not charged as a terrorism offence. That we didn't see any conversation around terrorism other than some public statements at the time. So, in this case, if you take an unbiased look at the Criminal Code definition of terrorism, this case is textbook. It was driven by a desire to create fear in a particular community. It was driven by a very clear, if sometimes muddled ideology, but a very clearly ideological position. And those are two key components of terrorism offences in this country. So, looking at this from an unbiased perspective, this absolutely had to meet the definition of terrorism.

MG: Is your sense that that definition is being applied more broadly now? Last fall, a young man was successfully prosecuted for terrorism in a misogynist attack in a spa. We've also seen terror charges laid recently against people accused of being involved in neo-Nazi groups. So, are prosecutors and police taking those ideologies more seriously than in past and more seriously in the context of terrorism than in past?

JESSICA DAVIS: I think we're definitely seeing a change in how terrorism is perceived amongst law enforcement, security services and prosecutors in this country, and it's a welcome change. I mentioned a minute ago the Quebec Mosque shooting. You know, that is the kind of thing that should have been charged as terrorism.

MG: Why wasn't it as you understand it?

JESSICA DAVIS: There's a lot of complexities around, you know, what charges get brought. So, it's difficult to say specifically, but I think at the time that that occurred, police and our security services in general were reluctant to see what we now call ideologically motivated violent extremism as a form of terrorism. There was a bit of a denial that this kind of activity could rise to the level of terrorism. That is changed really significantly in the last, I'd say, four or five years with the charges that you mentioned. And I think part of that is that in our law enforcement security services, there have always been people who saw this kind of violence as terrorism and were arguing that this definitely fit the definition of terrorism and should be treated as such. But there was also some bias. I think if we can be really honest about it in that community that was reluctant to see, frankly, white people perpetrating terrorism.

MG: A member of the Afzaal family said after this ruling that he believed this decision would offer, and perhaps this speaks to what you were just saying, would offer safety in future to other communities, not just Muslim communities, but Black and Jewish communities as well. What do you think?

JESSICA DAVIS: I think this case is so important. And the incel case that you mentioned a minute ago is so important because it demonstrates that police have now successful investigative strategies for dealing with this kind of terrorism, and that those strategies can lead to successful prosecutions. Without successful strategies like that, police can become, you know, rightly reluctant to pursue these kinds of charges. So, this sets a very important precedence investigativelly and legally.

MG: It was interesting in reading the judge's ruling yesterday, something leapt out at me. I just want to read it to you. "It is too simplistic to draw a straight line of causation between the offender's actions and what he read on the internet, but the offender drew much of his rage from internet sources, which he repeatedly accessed in the days and moments leading up to this attack. The tentacles of hate can reach a broad audience when they are merely a click away." What do we do about that?

JESSICA DAVIS: Well, I disagree with one piece in that statement, which is that the ideas are driving the hate. I think instead, it's better to think about it as the hate was finding an outlet in the ideas. And this puts the problem in a different perspective. A lot of our ideologically motivated violent extremists are driven by hate, anger, fear, social isolation. They're finding outlet in extremist content. There's a couple of options that we have for this. One of them is to try to take down all extremist content, but I probably don't need to explain how difficult that would be and how implausible that is as an actual strategy. We can try to limit it. We can try to restrict access to things like terrorist manifestos, which I think is a good idea. But seeing this as the solution is not, is not a solution to the terrorism and extremism problem. We can also significantly expand surveillance to try to proactively identify people who might go on to commit violence. But the number of people who are consuming this kind of content is in the hundreds of thousands, if not millions, and only a very, very small number of them will go on to commit an act of terrorism. So again, that's not a great solution either. We can also accept a particular level of terrorism, but that's not a satisfying solution for anybody who's lost a loved family member or a community member in a terrorist attack, and not one that I would advocate for either. Which leaves us with the much harder and longer-term solution, which is to build a society and a system that addresses or begins to address some of these underlying causes of hate and fear. And that is a very long-term prospect.

MG: It speaks back to what Tabinda Bukharii said, that this hate didn't exist in a vacuum. It thrived in the whispers and the prejudices and the normalized fear of the other. I mean, that can be online, but that can be, as they say, in real life as well.

JESSICA DAVIS: Yes. And I think that that was a really important and salient point when we think about people who are radicalizing and potentially mobilizing violence. We're all, most of us know people who have some form of extremist ideas, often driven by fear or concern. Fear of loss, you know, the sense that their position in society is being threatened. And we all need to accept that that's something that we need to be aware of and try to work to reduce the social isolation of those people and try to bring them back into the fold. Because it's the whispers that really drive the extremism.

MG: In the meantime, your belief, just finally, is that--I said that this is a test case. That this case, having passed that test will change how law enforcement deals with incidents like this in future.

JESSICA DAVIS: I think the changes already occurred. I think what we saw was proof of their new approach to this kind of thing. I think the real test, though, will come with cases that are less clear cut. Where there's less overwhelming evidence of the terrorist motivation, and when they're actually in the pre-emption stage. When they've stopped someone ahead of time. And there's no clear event that we can point to at the end.

MG: Jessica, we'll leave it there. Thank you very much.

JESSICA DAVIS: Thanks, Matt.

MG: Jessica Davis is president of Insight Threat Intelligence and a former CSIS analyst.

Share

Share

The Puzzle

Last week, two US-based researchers published an article “Trading on Terror?”. The authors argue that in the days leading up to the October 7th Hamas attack, there was anomalous short selling on the Israeli stock exchange.

(Short selling is taking a position in the securities market, betting that the price of a security will lose value at some time in the future.)

The authors try to determine who took these short positions, and why.

They put forward two propositions:

1. That abnormal short selling occurred

2. That informed traders knew about Hamas’s planned activities and sought to profit from them

(Informed traders are people with more information than the general market participant, and who try to use this information to make a profit.)

Proposition 1: Anomalous short selling

The basis of the research is that a sharp and unusual increase in the shorting of Israeli companies occurred just before the terrorist attacks of October 7th. The authors spend the bulk of their paper demonstrating this anomalous activity. In response to the article, the head of Israel Securities Authorities stated that there were no significant trading abnormalities in the lead-up to the attack.

The authors contend that the unusual short selling is consistent with substantial block trades, and that a small number of actors appear to be behind this options trading.

(Block trades are privately negotiated futures or options that are permitted to be executed apart from the public market)

Israeli authorities further determined that the short position in Bank Leumi (one of the illustrative cases) was actually taken by an unidentified Israeli bank known to the Tel Aviv Stock Exchange (TASE). Finally, whoever carried out these short sells would be transparent to the local regulator because they would have to sign a lending agreement with a TASE member, so the identity of the short sellers is not a mystery.

In brief: according to Israeli authorities, there was nothing anonymous, or puzzling, about this activity.

I find these explanations from Israeli authorities particularly compelling because our political climate is not currently one in which we minimize Hamas’s capabilities.

Proposition 2: That informed traders knew about Hamas’s planned activities and sought to profit from them

Setting aside Proposition 1 for a moment, let’s evaluate Proposition 2 on its own merits.

The authors argue that the most plausible explanation for the anomalous activity is that whoever made the trades was familiar with Hamas’s secrets. They look at pre-incident anomalies and conclude that in October, these anomalies were related to the Hamas attack.

To strengthen this assertion, the authors look at another date (5 April 2023) and find similar anomalies. According to The Times of Israel, this date was the original date of the Hamas attack. This assertion is based on source reporting from unnamed soldiers in the Israel Defence Force’s 8200 signals intelligence unit. The authors conclude that “taken together, this evidence strengthens the interpretation that the trading observed in October and April was related to the Hamas attack rather than random noise.”

I disagree.

General Problems with the Study

There were several general problems with the study that affected its internal and external reliability. Data problems (not understanding that TASE prices are quoted in Agorot, not Shekels) seriously undermine the internal reliability of this paper.

The study was also poorly theorized / conceptualized. There have been few (if any) studies linking short selling with terrorist activity, and certainly very few (if any) studies that suggest that terrorists raise funds in this way.1 The lack of familiarity with terrorist financing literature affects the external reliability of the paper, as well as the general theorizing about what happened, and why.

There were also few, if any, alternative explanations considered and tested. For instance, some critiques have suggested that the anomalies could reflect the closing positions of investors on the first day of a quarter, or that they might have been a market-maker’s response to a trader buying up shares in the fund.

Finally, the type of statistical modelling that the authors use is not particularly compelling for determining correlation. For that, we would need a more robust model controlling for a series of variables as well as seasonality in stock prices and short-selling volumes to determine actual anomalous activity and potentially link it to prior knowledge of a terrorist attack.

The authors essentially identify anomalous activity (proposition 1), and explore one explanation (proposition 2) to explain it. But neither proposition stands on its own, and certainly not taken together.

Finally, the authors do not discuss how the informed traders would come to know about the attack. This would likely occur if the traders were in the inner sanctum of Hamas’s operational planning. Given the closed circle involved in planning this attack, the idea that Hamas would share details of the attack is extremely unlikely, as is the idea that Hamas would encourage informed traders to short these stocks, particularly if it raised the risk of detection.

It’s worthwhile noting that Hamas has the financial sophistication to short sells stocks and exchange traded funds in advance of an attack. But they have enough money from other financing activities that doing anything so is not worth the effort, particularly if it raises the risk of detection. And even if they did seek to profit from their attack in this way, they would likely take small positions so as to avoid detection (and avoid creating anomalous data).

The Policy Response

Despite these serious limitations, the authors go on to discuss policy responses. They state that informed traders profited by anticipating the events of October 7th. They suggest that there should be incentives for informed traders to report knowledge of impending terrorist attacks, and that these incentives need to be strong enough to overcome the profit motivation of the informed traders.

They do not, however, discuss how the informed traders might have become aware of a highly secretive terrorist operation, nor do they discuss the viability of encouraging people who might be in the inner circles of terrorist groups to disclose this information to law enforcement and security services. (They put this forward as a potential policy response to this alleged problem, but do not consider whether this is realistic or feasible.)

Ultimately, the authors conclude by saying that “we have provided suggestive evidence that trading on terror occurs through informed trading in securities markets.” I think they’ve failed to both demonstrate that there was anomalous activity, and certainly have failed to demonstrate that its only causal mechanism was prior knowledge of a terrorist attack, or even that this is a viable scenario.

Despite these serious flaws, we all know that this is going to come up for the next decade as “evidence” of terrorist use of securities / options trading. The only value this article has, in my view, is to demonstrate how poorly conceived research evolves into stigmatized knowledge and can become part of conspiracy theories.

Our terrorist financing analysis course is open for the next two months. In February, we’re going to close it to new registrations while we do an update, and re-open sometime in mid-2024. So sign up today if this is on your to-do list for 2023 or 2024! All current students maintain access to course content, forever.

© 2023 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.