The $50 Million Signal: What Revenue-Sharing Reveals About the al-Qaeda Network's Resilience
UN Monitoring Team’s 38th report on ISIL and Al Qaeda
Hello, Insight Monitor subscribers! Today, we have a newsletter focused on the long-awaited UN Monitoring Team’s 38th report on ISIL and Al Qaeda. Something very important stood out for me in this report: the revenue-sharing of JNIM’s $50 million ransom payment. I’m still working through the rest of the report, and will share more observations in another newsletter, but I wanted to flag this early, as it’s critical for our understanding of the AQ network. Read my analysis below and share with a friend or colleague to help grow our network of people who care about illicit financing!
In the lead-up to the 25th anniversary of the September 11, 2001, terrorist attacks, much is being written about the state of Al Qaeda. While there is some variation in assessments of the threat the group poses, many analysts describe it as a much-degraded network of affiliates. Across all assessments, it remains unclear to what extent Al Qaeda is coordinating these days, who is truly calling the shots, and how much they cooperate, all of which speaks to operational capability and external operations ambitions.
In that light, the latest UN Monitoring Team report reveals something very interesting and important about these relationships.
Last year, JNIM received a ransom payment of $50 million from the UAE for a hostage taken by the group. (There is some suggestion that the group was actually paid €50 million, a material difference of about $7 million.)
In paragraph 50 of the latest report, the Monitoring Team notes that “AQIM likely channelled a share of the approximately $50 million ransom obtained by JNIM to the Al-Qaida core and AQAP.”
This revenue-sharing provides a rare and powerful signal that the al-Qaeda network remains (at least somewhat) financially integrated, with resources flowing between affiliates to sustain the broader organization.
Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!
JNIM’s decision to share proceeds from its massive KFR operation provides unusually concrete evidence of financial integration within the al-Qaeda network and interest in sustaining the broader network. JNIM could have used these funds to consolidate its territorial control, expand its operations, or strengthen its position as arguably the most territorially powerful of AQ’s affiliates. Instead, at least some of the proceeds appear to have flowed beyond JNIM itself. That suggests the group values sustaining the broader network, even when doing so means foregoing resources that could be used for its own expansion. More importantly, it gives us a more concrete signal of network integration than we have typically had.
Revenue-sharing is an important mechanism for sustaining geographically dispersed terrorist networks. We have seen a similar dynamic within the Islamic State, where funds from wealthier provinces or groups have flowed to other parts of the organization to sustain struggling affiliates, provide start-up funding, or finance specific attacks. In both cases, money is doing more than financing individual groups: it is helping sustain the network as a whole.
The most important implication might be what this tells us about direct financial connections between affiliates. Over the last twenty-five years, counterterrorist-financing efforts have degraded these connections, making them increasingly difficult to observe and leaving uncertainty about how much money actually moves between different parts of these networks. We may not know precisely how the JNIM transfer occurred, how much was moved, or which intermediaries were involved. But the apparent sharing of proceeds from a major JNIM revenue stream with the broader AQ network is itself a significant signal.
Understanding how these funds moved will be the next critical task for the monitoring team. As Colin Smith, coordinator for the monitoring team, told me, “Tracking how that money moves, and where it goes, gives us insight into the nature and priorities of the global Al-Qaida movement.”
More to follow.
© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.
This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.