Insight Monitor: News

Global Jihadist Financing

Jessica Davis, PhD — Tue, 18 Aug 2026 13:03:01 GMT

Hello, Insight Monitor subscribers! Welcome to another edition of our newsletter. Today, we’re continuing our exploration of UN reporting, with some reflections on the state of global jihadist financing. If you missed it, last week I talked about what I thought was the key highlight from the report: the likely revenue sharing by JNIM from their kidnapping-for-ransom operations. Today, I’m taking a broader look at the jihadist landscape. Have a read, and be sure to share with friends, colleagues, and your network!

The UN’s latest report on ISIL, al-Qaeda and associated groups provides a useful snapshot of how jihadist organizations are financing themselves, and how those financial systems are changing. In advance of the report’s release, I had the pleasure of speaking with Colin Smith, the Coordinator for the Monitoring Team, and Sue Eckert, an expert with the Monitoring Team, who shared their insights with me. Five developments stand out from my read of this report and our conversation, and across all the UNMT reports that Insight Monitor has analyzed over time:1

Global Terrorism Financing Report

Emelia Connolly — Thu, 06 Aug 2026 13:03:12 GMT

Welcome back, Insight Monitor subscribers!

In this month’s terrorism financing report, we cover terrorism financing news from North America to Southeast Asia, featuring the arrest of finance chiefs in terrorist organizations, sanctioned ISIL-KP cryptocurrency addresses, and cartel money laundering networks. We also cover criminal organizations’ weapons-smuggling operations and Iranian insurance schemes! Don’t miss our long-read recommendations on hybrid terrorism financing networks and Boko Haram’s financing evolution.

Dive in, share with a colleague, and explore our long-read picks.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

North America

James “Fergie” Chambers, a pro-Palestinian activist and philanthropist, was arrested in Spain after the United States sought his extradition on allegations of money laundering intended to finance terrorism. Chambers and his organization, Babochki, have donated about US$800,000 to the Middle East Children’s Alliance (MECA). US authorities claim that MECA has provided funds to organizations they classify as affiliates of the Popular Front for the Liberation of Palestine.

The US Treasury sanctioned 134 Islamic State Khorasan Province (ISIL-KP) cryptocurrency addresses within the group’s network. ISIL-KP allegedly used its media wing to solicit crypto contributions through Tron, Monero, and Bitcoin. The Tron wallets have processed more than US $1.4 million since 2023, with more than US $880,000 transferred out.

Mahmoud al‑Abyari, a UK‑based senior Egyptian Muslim Brotherhood official, was designated by the US Treasury for providing material support to Hamas, including fundraising for the previously sanctioned Turkish charities Filistin Vakfi and Hayat Yolu. Al‑Abyari worked with two Hamas‑created front charities, Indonesia‑based Tujah Bulah Global and Gaza‑based Madad Palestine Charitable Society, to raise funds for the group’s military wing. Türkiye‑based El‑Kahira for General Trading was also sanctioned for transferring hundreds of thousands of dollars to Hamas.

Following the Money

Lisa Niemzyk — Tue, 04 Aug 2026 13:02:42 GMT

Hello, Insight Monitor subscribers!

This month, we explored the changing nature of terrorism and illicit finance—from overlooked domestic threats to hybrid financial networks and the growing role of digital assets in sanctions evasion and global security.

Before we dive in, check out this Toronto Star news article on Canada's participation in the Trump administration's summit on left-wing extremism, where Jessica shares her insights on the implications for Canadian counter-terrorism policy and the terrorist-listing process.

Photo by Maxim Ilyahov on Unsplash

This month, as always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We kicked off the month by joining the Canadaland podcast to discuss state links to criminal shooter-for-hire networks and introduce a new framework for understanding why states rely on criminal proxies. Next, we examined a newly recognized terrorist attack in Canada and what it reveals about the country's evolving threat landscape. We then shared research on hybrid threat finance networks and the convergence of traditional and digital financial systems, before wrapping up the month with the announcement of a SSHRC-funded research project led by Michael Nesbitt and Jessica Davis exploring cryptocurrency, sanctions evasion, and the fragmentation of global finance.

Stay informed with our latest analyses — explore our newest articles below:

That’s a wrap for July! We’ll be back soon with more news and analysis. Subscribe to stay up to date.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

New Project Announcement: Bridging the Divide: Cryptocurrency, Sanctions Evasion, and the Fragmentation of Global Finance

Jessica Davis, PhD — Tue, 28 Jul 2026 13:02:57 GMT

I’m delighted to share that Michael Nesbitt and I have been awarded a SSHRC Insight Development Grant for our new research project:

Photo by MJ Duford on Unsplash

📖 Bridging the Divide: Cryptocurrency, Sanctions Evasion, and the Fragmentation of Global Finance

As sanctioned states increasingly turn to digital assets to evade economic restrictions, the intersection of cryptocurrency, sanctions, and global finance has become one of the most important areas of illicit finance research.

Over the next year, this project will examine how digital assets are reshaping sanctions evasion, the implications for the international financial system, and the policy responses needed to address these emerging risks.

A major goal of this grant is to build a multidisciplinary network of researchers and practitioners working on sanctions evasion and digital assets. Through workshops, collaborative research, and knowledge sharing, I hope to connect people working across disciplines and sectors on these issues.

If you’re working on cryptocurrency and sanctions, I’d love to hear from you. Please feel free to reach out if you’d like to be involved in the network or stay informed about upcoming workshops and opportunities to collaborate. Many updates will be posted through this newsletter as well, so all Insight Monitor readers can stay up-to-date on this research.

I’m incredibly grateful to SSHRC for supporting this work!

To be in touch about the research, you can email me at jessica[dot]davis1[@]ucalgary.ca

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Following the Money

Tue, 07 Jul 2026 13:01:15 GMT

Hello, Insight Monitor subscribers!

June brought a fast-moving mix of live conversations, research coverage, policy developments, enforcement actions, and real-world security events across the illicit finance and counter-terrorism space.

Before we begin, let’s remember the terrorist attack of July 7th, 2005, in London, UK. Last year, we wrote a retrospective analysis on the financing of the attack. You can read that analyis here:

This month, as always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We kicked off the month with a live conversation between Jessica and Steven Reimer to discuss the No Money for Terror conference, her forthcoming book, and Steven’s fieldwork in Ghana. We then dug into a new Research Read on the effects of ransom payments on terrorist activity in West Africa. Next, we broke down FATF’s latest plenary, where counter-terrorist financing remained front and centre alongside concerns about the use of mainstream digital platforms for illicit activity. We also looked at the Europol-led disruption of the AUDI A6 cryptocurrency laundering service and what it reveals about illicit crypto infrastructure, including a Canadian connection. Finally, we closed with an emergency Secure Line podcast on the Montréal incel attack, unpacking the attacker’s manifesto and the debate over how it has been interpreted in the aftermath.

Stay informed with our latest analyses — explore our newest articles below:

That’s a wrap for June! We’ll be back soon with more news and analysis. Subscribe to stay up to date.

Subscribe now

Montréal Attack

Jessica Davis, PhD — Tue, 30 Jun 2026 13:01:13 GMT

Last week, a terrorist attack took place in Montréal, Canada. In the attack, an individual targeted an adult entertainment/technology company (AYLO) and its employees. Two people were killed in the attack, as well as the attacker.

Prior to the attack, the perpetrator released a 104-page manifesto. This has been the subject of intense media scrutiny.

My Secure Line co-hosts and I decided to record an emergency podcast reflecting on the attack’s significance, but more importantly, how people understood the manifesto. We were all dismayed by how quickly the incel-misogynistic motivation was downplayed for other themes.

To be clear, any manifesto is usually a grab bag of grievances, ideas, and issues. These ideas might converge or diverge, but it’s all intended to shape narratives around an attack, and this case is no different.

I invite you to listen to the podcast in its entirety, because this is a critical issue for understanding terrorism today.

I want to be very clear here, however, about how I see this attack and the manifesto:

A common feature of terrorism and extremism today is mixed or unstable ideologies. We see this in manifestos like the Montréal shooter’s, where many different ideas and grievances converge. However, underlying his ideology (and many ideologies today) is a strong misogyny. This is the common feature tying many different types of terrorism together. This also leads to “picking and choosing” what themes are important by readers, particularly those who aren’t trained in reading extremist texts. In the case of the Montréal shooter, the main worldview tying his various ideas together is misogyny. Females, girls, and women are referenced hundreds of times (370+). Anti-capitalism appears frequently as well (about 100x). Other ideas and grievances, like anti-zionism, Marxism, and pornography, are mentioned dozens of times, illustrating that the shooter’s main focus (and driving force) was grievances against women, with other grievances and ideas scaffolded on top.

The courts, as well as our intelligence and security services (CSIS and the RCMP), have also been very clear that Incel-motivated violence meets the definition of terrorism. Refusing to acknowledge Incel ideology and misogynistic violence as terrorist in nature is, in and of itself, misogynistic.

Misogyny is a political system designed to repress and subordinate women. Denying Incel as terrorism is just one more legal exclusion of women.

I also want to add that it’s dismaying that no public official has come out and called this what it is: an act of terrorism. There will obviously be no terrorism charges laid in this case (the perpetrator is dead); however, it would be useful for political leaders to actually lead in this space and name this for what it is.1

Finally, I want to add that this is the first terrorist attack in Canada in over two years. The last one was in Edmonton in 2024.2 However, there have been a number of terrorism disruptions (arrests, peace bonds, etc). We had a very good run of preventing terrorism in this country — in fact, this two-year period was the longest we have gone without a terrorist attack in Canada since 2011. This is something our law enforcement and security services should be proud of, even as they review the Montréal shooting to identify areas where it might have been disrupted.

Subscribe now

I think it’s entirely possible (and probable) that in future reports, CSIS, ITAC, and the RCMP will list this attack in their terrorism statistics/analysis of terrorism in Canada. I’ll be keeping my eyes open for that.

This count excludes the Tumbler Ridge school shooting. There are compelling arguments for including it as a terrorist attack; for the time being, I’m excluding school shootings from my data as I’m not certain that school shootings would meet the legal criteria for being ideologically, politically, or religiously motivated in Canada, and that they are designed to create societal fear or change.

Terrorist Financing Developments You Shouldn't Miss from FATF

Jessica Davis, PhD — Tue, 23 Jun 2026 13:00:32 GMT

Last week, FATF held its June plenary, where counter-terrorist financing remained a prominent topic. The plenary also pointed towards areas of concern, particularly the exploitation of mainstream digital platforms for terrorist financing purposes. For practitioners, these developments provide an indication of both FATF’s current priorities and the direction of future policy and regulatory attention. Keep reading to learn how this will translate into greater terrorist-financing detection requirements for regulated entities:

Mutual Evaluations Adopted

FATF adopted the mutual evaluation reports of Canada and Türkiye during the plenary. While the reports have not yet been released publicly, publication is expected in September–October. While Canada will not be on the grey list, according to the Globe and Mail, Canada could face enhanced follow-up to address deficiencies/areas for improvement, where we will have to demonstrate effectiveness and outcomes relating to all our deficiencies (one of which is likely to be a lack of terrorist financing prosecutions).

Changes to the Grey List

Algeria and Namibia Removed

FATF removed both Algeria and Namibia from its list of jurisdictions under increased monitoring (the “grey list”). Algeria’s removal is the country’s third exit from the list. Algeria had most recently been grey-listed in October 2024. While FATF standards evolve, which can lead to states being grey-listed over and over again, Algeria’s repeated grey-listing raises questions about the effectiveness of FATF recommendations for encouraging AML/CFT measures, and whether the current timeframe for mutual evaluations is sufficient.

Namibia, meanwhile, had been under increased monitoring since February 2024.

The removals indicate that both jurisdictions have addressed the strategic deficiencies identified by FATF and completed the action plans agreed upon with the organization.

Iraq Added to the Grey List

Iraq was added to the grey list for the second time, having previously been listed in 2008.

Several of Iraq’s outstanding deficiencies relate directly to terrorist financing. FATF identified the need for Iraq to demonstrate more effective terrorist financing investigations and prosecutions, strengthen technical compliance related to its terrorist financing offence, and develop a more robust understanding of terrorist financing risks within the non-profit organization (NPO) sector.

Bosnia and Herzegovina Added to the Grey List

Bosnia and Herzegovina was also added to the grey list, marking its second appearance after previously being listed between 2016 and 2018.

Among other measures, FATF has called on Bosnia and Herzegovina to demonstrate a more proactive approach to terrorist financing investigations, clarify the interpretation and application of its terrorist financing offence, and strengthen the implementation of targeted financial sanctions related to terrorism and terrorist financing.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Looking Ahead: FATF Focus on Terrorist Financing in Digital Ecosystems

FATF also signalled continued attention to evolving terrorist financing methods online. The organization announced an upcoming publication examining terrorist financing activity conducted through social media platforms, instant messaging applications, and streaming services.

The project reflects growing concern that terrorist actors are increasingly leveraging mainstream digital platforms to solicit donations, facilitate financial transfers, advertise fundraising campaigns, and connect supporters with financial facilitators. While cryptocurrencies often receive significant attention in public discussions of terrorist financing, FATF’s focus underscores the continued importance of conventional online platforms in facilitating financial support networks.

Key Takeaway

The latest plenary reinforces a broader trend in FATF’s approach to counter-terrorist financing: effectiveness matters. The grey-listing of Iraq and Bosnia and Herzegovina reflects continued scrutiny of countries’ ability to investigate, prosecute, and disrupt terrorist financing in practice, while FATF’s forthcoming work on social media and messaging platforms highlights increasing concern with the digital environments where terrorist financing activity now occurs. In terms of terrorist financing, this focus on effectiveness and outcomes will be translated to national regulators, which in turn will require greater identification of terrorist financing activity in regulated sectors. Fintechs, banks, money service businesses, and more, will all be under increased pressure to better detect and report suspected terrorist financing activity.

Following the Money

Mon, 08 Jun 2026 13:02:40 GMT

Hello, Insight Monitor subscribers!

This past month brought continued developments across illicit finance and counter-terror finance policy, with a focus on attribution challenges and evolving policy frameworks.

Terrorist Financing Analysis

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

We started the month by examining alleged activity linked to Harakat Ashab al-Yamin al-Islamiya (HAYI) and Kata’ib Hizballah (KH) activity, comparing attack patterns across Europe and Canada to evaluate claims of a Canadian connection, and exploring the financing and strategic drivers beyond these networks. We also published a commentary on the No Money for Terror (NMFT) conference, examining how its increasingly maximalist global objectives may set unrealistic expectations for counter-terror finance efforts.

Stay informed with our latest analyses — explore our newest articles below:

That’s a wrap for May! See you next month with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

Global Terrorism Financing Report

Emelia Connolly — Thu, 04 Jun 2026 13:02:38 GMT

Welcome back, Insight Monitor subscribers!

This month, we highlight a surge in global terrorism-financing enforcement and disruption: US sanctions on Iran-linked networks; crypto-based cases in Türkiye and India; Hamas-linked fundraising and transfer activity across Europe and North America; and cartel-connected money laundering through crypto and shell networks. We also feature long reads on Islamic State financing in Central Africa and data-driven approaches to strengthening transaction monitoring for AML/CFT.

Dive in, share with a colleague, and explore our long-read picks for deeper analysis.

Financial Intelligence Fundamentals

Global Terrorism Financing Report

Emelia Connolly — Thu, 09 Apr 2026 13:01:10 GMT

Welcome back, Insight Monitor subscribers!

In this month’s report, we explore compelling stories from Canada, Europe, and the Middle East in the complex world of terrorism financing. Our coverage includes unregistered digital finance companies, the funding and growth of ISIL cells, and Hizballah’s evolving stockpiles and revenue streams.

Dive in, share your thoughts with a colleague, and be sure to check out our long-read recommendations for deeper insights!

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

Following the Money

Lisa Niemzyk — Tue, 07 Apr 2026 13:03:24 GMT

Hello, Insight Monitor subscribers!

While the world of terrorist financing and emerging threats kept moving fast this month, we had a bit of a quieter month here taking some time to wrap up some fiscal year-end projects. We will be back in full force next month. Be sure to subscribe so you don’t miss out!

Before we dive in…

CASIS recently announced its 2026 essay contest. You can get all the details here.

The Secure Line podcast, was back this month with two new episodes. Highlights include discussion on recent policy and intelligence developments, and why protecting research and innovation has become a core national security priority. Catch up on the latest episodes here.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

This month we did a deep dive into terrorist financial tradecraft, highlighting new data on how attacks are funded and the methods groups use to move and obscure money. We also released a commentary on Canadian terrorism trends, examining riding changes, shifting motivations, and the growing involvement of youth.

Stay informed with our latest analyses — explore our newest articles below:

That’s a wrap for March! See you next month with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

Five Years of Following the Money 💸

Jessica Davis, PhD — Wed, 01 Apr 2026 13:03:33 GMT

Hello, Insight Monitor subscribers! This month marks the five-year anniversary of my newsletter here on Substack. Join me for a little reflection, and stay until the end for a nice surprise….

Photo by Nicolas Picard on Unsplash

It’s been quite the journey. What started with a few hardcore illicit finance nerds has grown to a community of over 8,000, with new subscribers every day. I’m always excited when someone else agrees to receive the newsletter or follows me on this platform, because I think we’re collectively one step closer to illicit finance being taken more seriously. And as regular readers of this newsletter know, countering the illicit finance threat is something I take very seriously.

This newsletter started as something I wanted to do to capture my thinking on illicit finance and security, share insights through something more enduring than the odd thread on Twitter (I refuse to use the new name because I think it’s dumb), and promote the courses and other activities that I do as part of Insight Threat Intelligence. It’s grown well beyond that and has actually become a revenue line for the business; it’s also become a source of some expenses, because I usually have at least one researcher working on the Global Terrorist Financing Report (our monthly roundup of terrorist financing news), as well as research for other newsletters.

When I first started out, I migrated old content from a blog I was running to help populate the back catalogue – a lot of that is still available on the site if you go way, way back. As with most Substackers, I started publishing free articles, but quickly added a paywall because, frankly, those news roundups are an annoying amount of work. Artificial intelligence has helped a bit, but we still need to check every story, verify details, and make sure it’s accurately represented, and I have yet to find an AI tool that does that to my satisfaction. All that to say: this newsletter remains labour-intensive, and I’m happy about that. The writing is the work.

Somewhere along the way, I started trying to write twice per week. That turned out to be too much — for both my readers and me. So now we focus on one article per week, and sometimes add a second if things are particularly newsy. I’m increasingly trying to take things slowly: reading, writing, and publishing with intention. In our information ecosystem, I think we can all use a bit of a break, and a focus on more signal, less noise.

Growth on this platform hasn’t been exponential for me. I feel like I’ve earned every one of my followers or subscribers; while Substack touts a network effect, I have yet to really experience it, and I haven’t had any posts go truly viral as I have elsewhere. But there’s something more organic and sustainable about this – I feel like every person is here because they want to be, not because they feel like they should be, or because the algorithm told them to be.

I think one of the things that I like the most about writing a regular newsletter is that it keeps the writing muscles sharp, even during long periods where I’m mostly researching, travelling, or giving talks, like right now, when over the period of three months I’m scheduled to be in three different countries and eight cities, some twice. It forces me to write, for better or for worse. Yes, this is pressure, but I also give myself grace, and if I really need to miss some weeks, that’s okay.

In recent years, I’ve experimented with publishing series. I’m not sure that these really work, but I like them because they give me a way to break up longer pieces of analysis and share them with readers, without overwhelming people with details, links, or forty-page documents. Feel free to let me know what you think about these series in the comments, by email, or however we communicate.

This platform itself isn’t without flaws. There are way too many Nazis on the platform, although I’d argue this is true of most social platforms these days. Substack also takes a pretty big cut of my profits, particularly compared to other platforms. Finally, Substack has started a Polymarket integration, which I think is criminal. (Note: it is not technically criminal now, but I’m willing to bet (haha) that it will become criminal within ten years when we see the full effects of the gaming and gambling epidemic. Maybe sooner, although policy change takes time.) This is all driven, of course, by Substack’s need to become profitable. It has no alternative viable path to profitability. Which, in my view, raises questions about the platform’s long-term viability.

To that end, I’ve migrated my content to a blog hosted on my website, which you can access at www.insightthreatintel.com. It has both a free and a paid section, and one of my wonderful team members maintains it, keeping it up to date with the latest news and analysis, pretty much at the same time as we release articles on Substack. This also gives some readers the chance to subscribe without supporting the Substack platform, which is an absolutely valid choice.

That’s not to say I’ll be disappearing from here anytime soon, but it is to say that I’m making plans (and maintaining newsletter lists!) so that if Substack disappears, I can still keep doing this work. Because that’s what matters, not the way it lands in your inbox.

That’s enough reflection for one day. On to the good stuff. To celebrate my five years on this platform, I’m offering a huge discount for new subscribers: 50% off an annual membership. This is a rare sale (we almost never have them), and this is by far the largest discount I’ve ever given. It’ll be available for the full month of April, so if you want to take advantage, be sure to lock it in before the end of the month. And you know the drill: like, share, and subscribe to help us grow our community!

50% OFF!

Illicit Money is out in Paperback!

Jessica Davis, PhD — Mon, 30 Mar 2026 07:03:54 GMT

Hello, Insight Monitor subscribers! I wanted to flag that my second book, Illicit Money: Financing Terrorism in the 21st Century, is now out in paperback format. You can purchase it through the publisher here.

We’ll be back with regular newsletters in April — we’re on a short hiatus as I wrap up some significant fiscal year-end projects, deliver some technical assistance, and generally just try to get caught up on life.

If you want something a little bit more hands-on, we also have a course based on the book, which you can access here:

Announcing the 2026 CASIS Essay Contest

Mon, 23 Mar 2026 13:03:30 GMT

Call for Papers: 2026 CASIS Essay Contest

CASIS is pleased to announce the 2026 essay contest. Essays must address some dimension of intelligence, security, or law enforcement issues in any time period and in any country. Submissions can be from any Humanities or Social Sciences discipline, inter-disciplinary programmes, or law school.

For a full description of eligibility and requirements, see the official call for papers here.

The winners of the essay contest will receive cash prizes ($2500 for the graduate winner and $1000 for the undergraduate winner), and will also be invited to present their papers at the annual CASIS Symposium in Ottawa.

Please share with friends and colleagues!

Global Terrorism Financing Report

Emelia Connolly — Tue, 10 Mar 2026 13:01:53 GMT

Hello, Insight Monitor subscribers, welcome back to another global terrorist financing roundup.

In February 2026, news of terrorism financing struck almost every region of the world. From North America and Western Europe to the Middle East and Africa! We cover illicit financing through NGOs, terrorist organizations’ gold reserves, and money-filled briefcases headed to Hizballah. So, have a read, share with a colleague, and don’t miss out on our long-read recommendations!

Financial Intelligence Fundamentals

Following the Money

Lisa Niemzyk — Thu, 05 Mar 2026 14:01:17 GMT

Hello, Insight Monitor subscribers!

It has been another packed month, full of research and analysis on terrorist financing and emerging threats. Be sure to subscribe so you don’t miss out!

Illicit Finance Investigations

The Illicit Finance investigations bundle includes access to both Financial Intelligence Fundamentals and Financial Intelligence Sources and is your one-stop shop to learn how to conduct an illicit finance investigation.

Whether your goal is to work as a financial intelligence analyst, an investigator, or in a related field, this bundle ensures you’re equipped with the skills needed to succeed.

Enroll now and take your expertise to the next level!

Articles

February was packed with insight. We started the month with our analysis of the 2025 Bondi Beach terrorist attack, breaking down how it was financed and what it reveals about disrupting future attacks. Next, we shared a commentary outlining Jessica’s recommended priorities for Canada’s future financial crimes agency to tackle emerging threats and protect Canadians. We also unpacked the 37th UN Monitoring Team Report, showing how ISIL, Al-Qaeda, and associated groups continue to sustain themselves through both traditional and innovative financing methods. Finally, in the second article of our Axis of Illicit Finance Series, we examined how Iran moves funds to the Houthis using cryptocurrency, spotlighting the networks that underpin this capability.

Stay informed with our latest analyses — explore our newest articles below:

That’s a wrap for February! See you in March with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

Innovation at the Margins, but Continuity at the Core: How ISIL and AQ Are Adapting—and Enduring

Jessica Davis, PhD — Tue, 17 Feb 2026 14:02:47 GMT

Last week, the United Nations Monitoring Team released its 37th report on ISIL, Al-Qaeda, and associated groups.1 As I often do, I have reviewed it with a particular focus on terrorist financing and what it reveals about how these groups are sustaining themselves. What follows is a brief synopsis of the key financial dynamics that stood out in the report. Some of our prior analysis is linked below:

Photo by Nils Huenerfuerst on Unsplash

One of the most notable developments in AQ/ISIL terrorist financing concerns the Allied Democratic Forces (ADF), which is reportedly using satellite internet to facilitate cryptocurrency conversions into state-issued currency, including through mobile money applications. This demonstrates not only the increasing accessibility of crypto for terrorist actors but also a significant operational adaptation to access crypto even in remote areas. The technical and logistical barriers are being overcome, and groups are increasingly integrating digital assets into local financial ecosystems.

At the same time, while cryptocurrency adaptation is increasing, it does not displace more traditional revenue streams. Across theatres, local taxation and extortion networks remain central to sustaining operations, alongside criminal activity such as smuggling and illicit trade. The report reinforces a familiar pattern: innovation at the margins, but continuity at the core. For most groups, territorial control, coercive taxation, and embedded criminal economies continue to underpin their financing strategies.

JNIM

According to the UN, JNIM profited from a single large ransom payment and used that to increase its capabilities. Here at Insight Monitor, we wrote about that large ransom payment, noting that “the money will certainly allow JNIM more operational freedom of movement in the coming months, and likely incentivize them to gain more territory and solidify control and influence in the region.” JNIM engages in both low-level (and low-cost) local kidnappings, as well as higher cost (and higher reward) international kidnapping for ransom.

JNIM is assessed by the UN to be the wealthiest Al-Qaeda affiliate after Al-Shabaab, having significantly expanded its revenue base through territorial control. The group raises funds by taxing and regulating gold mining and other commercial activities, imposing road tolls and transportation fees, and engaging in smuggling and livestock rustling. It also collects zakat (charitable donations), with rates varying by location; in areas where local communities resist or are perceived as uncooperative, zakat can be increased to extortionate levels. This diversified and locally calibrated approach to revenue generation has strengthened JNIM’s financial resilience.

Lakurawa

The UN also mentioned (I believe for the first time) Lakurawa, a group within the Islamic State Greater Sahel,2 and described their financing as primarily illegal tax collection and cattle rustling. You can read more about Lakurawa in this Soufan Center intel brief.

Terrorist Financing Analysis

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals, helping them learn about terrorist financing and analyze suspicious patterns to disrupt terrorist activities more effectively. Sign up today to grow your counter-terrorism expertise.

ADF

The Monitoring team also reported an increase in ADF's use of cryptocurrency for financing. They also noted that the ADF now has greater satellite connectivity, enabling the group to convert cryptocurrency into usable funds via mobile money applications and wallets. This capability allows them, even when deep in the bush and in areas outside of conventional cell coverage, to access and covert cryptocurrency to state-issued currency. To read more about ADF financing:

ISIL

The UN monitoring team assesses that the revenue collection capability of ISIL in Somalia has been significantly degraded. While the group continues to generate revenue through its business interests, it can no longer collect revenue in key locations such as Bosasso, Qandala, and Ba’ad, where security conditions have tightened. The securitization of these areas has disrupted their taxation and extortion activities, constraining their ability to operate as they once did. That said, ISIL-Somalia has been able to draw on residual funds, which have helped sustain the group despite these setbacks.

ISIL-K has sought to exploit geopolitical flashpoints, including the war in Gaza, to drive fundraising and mobilize support. By framing distant conflicts as part of a broader narrative of global grievance, the group attempts to tap into issues that resonate with potential donors and sympathizers. This reflects a broader adaptation strategy: rather than relying solely on local revenue generation, ISIL-K leverages international events to expand its financial reach and reinforce its relevance within the global jihadist movement.

At the same time, counterterrorism efforts have disrupted elements of ISIL’s broader financial architecture. In Iraq, authorities dismantled a finance network with connections stretching to Côte d’Ivoire, Madagascar, and Togo. The geographic spread of this network underscores the transnational character of ISIL’s facilitation structures and its reliance on dispersed nodes to move and store funds. Disruptions in one theatre, therefore, have ripple effects across regions, illustrating both the network's scope and its potential vulnerability to coordinated action.

ISIL-K has also faced setbacks in the digital financial space. The group reportedly lost access to approximately $100,000 in Monero after several individuals were arrested, preventing it from retrieving funds held in associated wallets. In response, it altered its Monero quick response code distributed through its propaganda arm Voice of Khorasan and introduced a new Bitcoin address. This episode highlights both the risks and adaptability associated with cryptocurrency use: while digital assets offer speed and global reach, they also expose groups to technical and operational vulnerabilities when key facilitators are detained.

Al Shabaab

The report also notes developments concerning Al-Shabaab and its relationship with Al-Qaeda in the Arabian Peninsula (AQAP). While financial support from Al-Shabaab to AQAP may have declined, cooperation between the two groups continues. This suggests that even when financial flows fluctuate, operational or strategic ties endure, including those associated with weapons trafficking networks. In the Somali context, this underscores a broader pattern in which terrorist groups adapt to financial pressure but maintain networks that allow them to remain resilient.

To read more about Al Shabaab financing:

Libya

In Libya, security services have dismantled at least four cells involved in terrorist financing, migrant and fighter smuggling, and media operations, with links extending to Europe, Iraq, Syria, the Sahel, and East Africa. One of these cells played a logistical role, facilitating operations through smuggling networks and money laundering. The use of smuggling routes and financial crime as enabling mechanisms reflects a pragmatic blending of ideological objectives with criminal enterprise; when one node is disrupted, others can absorb the shock.

AQAP & the Houthis

At the same time, the threat from Al-Qaeda in the Arabian Peninsula (AQAP) is reportedly growing, driven in part by improved funding streams. AQAP, for instance, has profited from Al Shabaab piracy by receiving a share of payments made by vessels in exchange for transiting through high-risk waters. The group also uses Telegram to solicit funds and connect supporters to financial intermediaries. (This is a form of informal crowdfunding that allows them to access international support networks.) Increased access to resources appears to have strengthened the group’s operational tempo and capacity, underscoring the persistent relationship between financing and capability. Where funding improves, groups can move beyond subsistence-level activity and reconstitute networks, invest in recruitment, and plan more ambitious operations. This pattern reflects a familiar dynamic: financial resilience often precedes operational resurgence.

Further complicating the picture, the Houthis reportedly provided AQAP with financial support for a successful attack. This illustrates the fluidity of relationships in conflict environments, where tactical or transactional arrangements can override ideological divides.

Conclusions

The through line in this report is not dramatic innovation; it is consistency and slow adaptation to counter-terrorist financing measures. Groups are experimenting at the edges, whether through cryptocurrency, satellite internet access, or opportunistic alliances, but their core revenue models remain intact. Taxation, extortion, smuggling, and embedded criminal economies continue to sustain most organizations. Disrupting a wallet address or arresting a facilitator matters, but it rarely dismantles the underlying system. These networks are adaptive by design; when pressure is applied in one area, activity shifts to another.

Countering this ecosystem is becoming increasingly difficult amid geopolitical fragmentation and strategic distraction. Cooperation on sanctions enforcement, financial intelligence sharing, and capacity-building is more difficult to sustain when alliances are divided and disrupted and multilateral institutions are strained. Terrorist groups, by contrast, exploit these seams: weak governance, contested territories, and inconsistent enforcement all make terrorist groups stronger. As states turn inward or prioritize great-power competition, the space for illicit finance expands. The difficulty of coordinated disruption, combined with enduring funding streams, leaves all of us less safe than we might otherwise be.

United Nations Security Council, Thirty-Seventh Report of the Analytical Support and Sanctions Monitoring Team Submitted Pursuant to Resolution 2734 (2024) Concerning ISIL (Da’esh), Al-Qaida and Associated Individuals and Entities.

Our profile of ISGS’s financing is available through our case studies library: https://insightthreatintelligence.thinkific.com/courses/take/terrorist-financing-case-studies-library/texts/47282318-how-to-access-the-case-studies

Following the Money

Lisa Niemzyk — Tue, 03 Feb 2026 14:03:18 GMT

Hello, Insight Monitor subscribers! It has been a busy month here at ITI. We kicked off the year with the introduction of a new dataset on terrorist financing, setting the foundation for deeper analysis of how illicit finance is evolving. Later this week, we will have our analysis of how the 2025 Bondi Beach terrorist attack was financed, and what that means for detecting and disrupting terrorist activity. Be sure to subscribe so you don’t miss out!

But before we dive in… Jessica has been busy in the background this month:

She shared her insights in this Global News article involving a Toronto auto exporter who has been accused of laundering money for Hezbollah.
She provided expert commentary in a Money Laundering Bulletin article on how Hawala networks and crypto-enabled transfers are exploited by terrorist groups.
She was the guest speaker in the Terrorist Financing Detection: Tools, Tactics and Real-World Solutions webinar hosted by Nasdaq Verafin.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Financial Intelligence Sources

Ready to go beyond the basics of financial intelligence? Our Financial Intelligence Sources course dives deeper, exploring open and closed sources, leaked data, and more. Perfect for researchers, compliance and intelligence professionals, and anyone in a FININT or OSINT role.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

This month, we kicked off an 8-part series exploring how Iran uses cryptocurrency to evade sanctions and operate within a broader illicit financial network. We also introduced our Trends in Terrorist Financing 2020-2025 dataset, built from six years of research, which highlights key patterns in how terrorist financing operates. Finally, we examined how digital assets are increasingly used alongside traditional financial systems, the rise of crypto-hawala networks, and the regulatory and intelligence challenges this creates.

Stay informed with our latest analyses — explore our newest articles below:

That’s a wrap for January! See you in February with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

Global Terrorism Financing Report

Emelia Connolly — Thu, 15 Jan 2026 14:01:07 GMT

Happy New Year, Insight Monitor Subscribers! This month, we cover key developments in terrorism financing with stories from Canada, the US, the UK, South America, Africa, India, Pakistan, and more! In December 2025, there was a surge in law enforcement crackdowns across North America and Europe, alongside new sanctions and emerging digital financing methods. Explore how global efforts are evolving to disrupt the financial networks behind terrorism below:

Financial Intelligence Sources

Do you want to identify and exploit new sources of financial intelligence? Our evergreen course is your guide to finding, analyzing, and contextualizing open source financial intelligence. This step-by-step guide to FININT sources will greatly expand your intelligence knowledge and skills. This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

North America

Following the Money

Lisa Niemzyk — Tue, 13 Jan 2026 14:00:53 GMT

Hello, Insight Monitor subscribers! We hope everyone had a relaxing holiday. December was a bit of quieter month for us here at ITI as we took some time to recharge. In this week’s Follow the Money, you’ll find:

A not-to-miss webinar on terrorist financing
An update on recent media interviews
Exciting news about the paperback edition of Illicit Money: Financing Terrorism in the 21st Century
A link to the latest Global Terrorist Financing Report
News about our terrorist financing analysis course
Two new Secure Line podcast episodes!

Read for more:

Terrorist Financing Webinar

In partnership with Nasdaq Verafin, Jessica will be sharing her knowledge and expertise on terrorist financing trends and issues on a panel. You can register for “Terrorist Financing Detection: Tools, Tactics, and Real-World Solutions” here. The webinar is on 21 January at 12:30 pm EST. Don’t miss out!

In the Media

Jessica gave a media interview for the Financial Times on Binance’s compliance woes. You can read her comments here. Her thoughts on the issue of noncompliance on crypto exchanges can be summarized succinctly with this quote: “…part of the problem with the fines is that we’re just talking about so much money being made on these platforms that even a billion-dollar fine becomes fairly meaningless.”

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Illicit Money Update

Good news! Jessica’s publisher for Illicit Money also recently announced that the book is going to be published in paperback format. We know some of you have been put off by the price (especially outside of North America), so hopefully this version will be a bit more affordable. We’ll be sure to share details when it’s released.

Terrorist Financing Analysis

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Secure Line Podcast

Secure Line podcast also released two new episodes in December. The first was with the Economist’s Defence Editor Shashank Joshi where Jessica, Leah and Stephanie talk about the year that was (2025) and the year ahead (2026). The second was the Festivus episode, where the Secure Line hosts share their grievances from the year and what they’re looking forward to for 2026. This is a rare video episode, complete with Christmas sweaters!

There’s lots more to come from Insight Monitor, Secure Line, and Insight Threat Intelligence for 2026, so be sure to subscribe and stay up to date!

Subscribe now