SERIES ONETerror Finance 2020Evolution of Religious Terrorism

October 21, 2020, 1:00PM – 3:00PM EST2 - ACFCS CPE HoursT

HR

EA

T F

INA

NC

E A

CA

DE

MY

A D

IVIS

ION

OF

SE

CT

ION

2

WORKCAST WEBINAR INTERFACETe

rror

ism

Fin

ance

DISCLAIMERS***RESTRICTIONS***

INTR

ODUC

TION

TO

HYBR

ID

THRE

AT F

INAN

CE

▪ TFA Instructors represent the positions only of Section 2 Financial Intelligence Solutions, and do not necessarily represent the official or unofficial views of any other public or private sector entity.

▪ Keynote speakers represent their own individual views, that don’t necessarily represent the official or unofficial positions of any public or private sector entity.

▪ Instructors and keynote speakers are strictly prohibited from discussing any content, that individually or in aggregate, would constitute classified, Law Enforcement Sensitive (LES), BSA Sensitive, or For Official Use Only (FOUO) information.

▪ Audience members from the public sector are asked to refrain from any sensitive questions in this open-source format.

OUR INSTRUCTORSS2’s Threat F inance Academy offers some of the wor ld ’s top f inancia l cr ime instructors from the f inancia l services , academia , law en forcement , and in te l l igence industr ies .

Deb GeisterCEO, Section 2

BSA Officer, Sr. Compliance Exec: LexisNexis, Matrix-IFS,

MetaBank, U.S. Bank

Sue LynchS2 TFA Manager

Economic Crime Professor, Bank Fraud Officer:

MasterCard, Goldman Sachs

Rob BaconS2 TFA Manager

U.S. Army 1st Sergeant (Ret.), Police Spec. Ops Commander

NY-NJ HIDTA/DEA-FIT/NYPD NIU

Joshua FruthCSO, Section 2

U.S. Army Captain, Law Enforcement Officer, AML

Director at Matrix-IFS

Terr

oris

m F

inan

ce

KEYNOTE SPEAKERIN

TROD

UCTI

ON T

O HY

BRID

TH

REAT

FIN

ANCE

Colonel Josh Potter, USA (Ret.)Former Director, Transnational Threats Division,

USSOCOM, U.S. Army Special Forces

Terror Finance 2020October 21, 2020

AGENDA▪ Hybrid Threat Finance (HTF)▪ Islamic History & Sectarianism▪ Current Threat Landscape▪ Mechanisms▪ Global Threat Landscape▪ Typologies by Threat Organization▪ Keynote Address▪ Q&A▪ Upcoming Sessions▪ Workshop/Quiz Overview

Terr

oris

m F

inan

ce

LEARNING OBJECTIVES

▪ Understand the History of Islamic Terrorism and Sectarian Division and the current landscape

▪ Understand the primary terrorist organization networks and:o Their locations o Revenue generation o Money laundering typologies

▪ Understand terrorist finance mechanisms such as: o Hawala/Sarafio Charitable Misappropriationo Zakato Currency-cleansing

TERR

OR F

INAN

CE 2

020

THE “HYBRID THREAT”

Hybrid Threat – Network intersection between:

a. 1 or more State (government) or Non -State (non-gov) threat organizations

b. Operating in multiple threat classif ications

Threat Classifications

TERR

OR F

INAN

CE 2

020

HYBRID THREAT FINANCE

Hybrid Threat Finance – The ill icit f inance network intersection

between 1 or more hostile State and/or Non-State threat organizations.

TERR

OR F

INAN

CE 2

020

COMPARING RISK VS THREATGLOBAL THREAT

LANDSCAPE (GTL)INHERENT RISK

ENVIRONMENT (IRE)

VS

Weapons Humans Drugs TerrorProducts Geography Customers Counterparties

▪ Threat-focused, static, threat

“Actor-centric” view of the world

▪ Defines and contrasts Threat

Classifications, Organizations, and

Typologies against Mechanisms,

Products, and Geography.

▪ Institutionally-specific risks to

exploitation by threat networks

▪ Explores products/services,

geographic nexus of

product/service offerings,

customers and their counterpartiesTERR

OR F

INAN

CE 2

020

INHERENT RISK ENVIRONMENT (IRE)Risk to Financial Institutions

Geographic Nexus

Products/Services

Customer Population Group Segmentation

“Core-4” Risk Model

Counterparty Population Group Segmentation

WHAT products & services do you offer?

WHERE do you offer them?

WHO are your customer groups (good & bad)?

WHO are their counterparties (good & bad)?

TERR

OR F

INAN

CE 2

020

GLOBAL THREAT LANDSCAPEGlobal Threat Landscape

Ge

ogr

aph

y

Pro

du

cts

Me

chan

ism

s

Threat Classifications

Sub-Classifications

Threat Organizations

Schemes & Typologies

Hawala

Prostitution

TERR

OR F

INAN

CE 2

020

SECTION 1

TERR

OR F

INAN

CE 2

020

ISLAMIC HISTORY & SECTARIANISM

ISLAMIC HISTORY & SECTARIANISMTE

RROR

FIN

ANCE

202

0

▪ Sunni: Most competent leader

o Salafist Movement: Orthodox (traditional) literalist, strict, puritanical adherence to written Qur'an

▪ Shi’a: (aka Shiite) Bloodline leadership -“followers of Ali”

▪ Caliph: “The Rightly Guided;” ruler of the Caliphate

▪ Caliphate: Office of supreme religious and political leader of the Umma, the Islamic State, and political successor to Mohammad.

▪ Islamic State: Religious kingdom under the leadership of the Caliph; adherence to Sharia

▪ Sharia: Strict adherence to orthodox Islamic Law; derived from the Qur’an and the Sunnah. Significantly different views on freedom of speech, religious freedom, and women’s rights.

ISLAMIC HISTORY & SECTRARIANISMSectarian Division

TERR

OR F

INAN

CE 2

020

ISLAMIC SECTARIANISM

Sunnis Shiites

Caliphate Model Most competent leader Bloodline succession

Population Majority (85-90%) Minority (10-15%)

LeadershipDecentralized under various

countries/groups/places; many

seek Islamic Caliphate

Centralized leadership under Iranian leader -

philosophy of vilayat-e faqih (rule of the Islamic jurist, or single leader)

GeographyDiverse and spread out

throughout Middle East, Africa,

SE Asia.

Concentrated population centers - Iran, Iraq,

Syria, Yemen, Lebanon, Bahrain, Azerbaijan,

South America, & West Africa

ISLAMIC HISTORY & SECTRARIANISMIran – Fall of the Shah: The 1979 Revolution

TERR

OR F

INAN

CE 2

020

“From Mubarak, Through Morsi: Military, Muslim Brotherhood, and U.S. Policy in Egypt.” Fruth, Joshua T. University of Military Intelligence, Fort Huachuca, Sierra Vista, AZ. 2013. The United States Army.

▪ Deposed the Monarchy (Shah) and instilled the radical Shiite state (1979-1981).▪ Iran has dual religious and political power structures. Both maintain militaries and intelligence services. ▪ The religious side has significantly more power, funding, and control.▪ Iran’s religious wing provides oversight to numerous Shiite Militia Groups (SMG) around the world,

such as Lebanese Hezbollah and the Yemeni Houthi.

Ayatollah Ali KhameneiIranian Spiritual Leader

President Hassan RouhaniIranian Political Leader

TERR

OR F

INAN

CE 2

020

▪ 4 years after the end of the last Caliphate (Turkish Ottoman Empire), Egyptian schoolteacher Hassan al-Bannafounded the Muslim Brotherhood (MB) in 1928.

▪ MB is the root of all modern Sunni terrorist groups, including al-Qaeda, HAMAS, Egyptian Islamic Jihad (EIJ), Palestinian Islamic Jihad, and ISIS. HAMAS refers to itself as a “wing of the Muslim Brotherhood.”

▪ AQ founder Osama bin Laden and current leader Ayman al-Zawahiri were both members.▪ Laser focus on implementing Sharia and creating an Islamic Caliphate▪ Millions of members in overt & covert branches in over 70 countries, including legitimate political parties in

many countries.

“From Mubarak, Through Morsi: Military, Muslim Brotherhood, and U.S. Policy in Egypt.” Fruth, Joshua T. University of Military Intelligence, Fort Huachuca, Sierra Vista, AZ. 2013. The United States Army.

Jihad is defined as: “Violent warfare against non-Muslims to establish Islam as dominant across the entire world.” – Hasan al-Banna, Muslim Brotherhood

“God is our goal, the Qur’an is our Constitution, the Prophet is our leader,

jihad is our way, and death in the service of God is the loftiest of our

wishes. God is great. God is great.” -The Muslim Brotherhood Motto

ISLAMIC HISTORY & SECTRARIANISMIran – Fall of the Shah: The 1979 Revolution

SECTION 2

TERR

OR F

INAN

CE 2

020

Current Threat Landscape

GLOBAL TERROR 2020Major Events & Updates (Part 1 of 3)Crypto-cleansing

TERR

OR F

INAN

CE 2

020

▪ October 2020 – US DOJ “Cryptocurrency Enforcement Framework” – Indicates heavy crypto usage by terrorist groups & DOJ’s plan to disrupt terror crypto-cleansing Link Here

▪ August 2020 – DOJ Crypto Seizure – DOJ announced operation resulting in seizure of $2 million USD in asset forfeiture across approx. 300 crypto currency wallets belonging to al Qaeda, Hamas, and ISIS terrorists See Here

o “Scheme involved openly asking for donations to fund terrorist activities (WITTING), duping people into donating to fake charities (UNWITTING), and exploiting the coronavirus pandemic by purporting to sell personal protective equipment (PPE).”

- Don Fort, Chief, IRS-CI.

GLOBAL TERROR 2020Major Events & Updates (Part 2 of 3)Hezbollah Bill

TERR

OR F

INAN

CE 2

020

▪ October 2020 – New Hezbollah Money Laundering Bill in Congress –Bill targets areas under Hezbollah's control that should be classified "primary money laundering concerns" under section 311 of the USA PATRIOT Act.

o Targets south Lebanon

o Targets Tri-Border Area (TBA) in South America, specifically 3 cities in 3 countries: Puerto Iguazu in Argentina, Ciudad del Este in Paraguay and Foz do Iguaçu in Brazil, which is responsible for $6 billion USD in money laundering per year for narco-terrorists and other threat networks See Here

GLOBAL TERROR 2020Major Events & Updates (Part 3 of 3)Al Qaeda Gemstone TBML

TERR

OR F

INAN

CE 2

020

▪ October 2020 – US Department of Treasury Sanctions Australian-based al Qaeda Money Launderer –

o Ahmed Luqman Talib traded in precious stones, allowing him to “move funds internationally” for Al Qaeda.

o Mr. Talib’s business is based in Melbourne, but he works around the world, including in Brazil, Colombia, Sri Lanka, Tanzania, Turkey and the Persian Gulf region.

GLOBAL TERROR 2020Conflict Zones – Afghanistan/Pakistan

TERR

OR F

INAN

CE 2

020

▪ Groups: Taliban, ISIS-K, Taliban, Haqqani Network, Lashkar-e-Taiba (LeT), & Tehrik-i-Taliban, al Qaeda in the Indian Subcontinent (AQIS), IRGC Quds Force (IRGC-QF).

▪ Funding: Extortion tax (Zakat), opium/morphine/heroin hub of the world, hashish, methamphetamine, gemstones, minerals.

▪ Money Laundering Systems: Cash smuggling, Hawala, Sarafi Exchange Money Service Businesses (MSB), currency auctions & wires through conventional banking

▪ Financial Facilitation Hubs: Afghanistan (Kandahar, Kabul, Herat, Nangarhar), Pakistan, Dubai (UAE); cash smuggling through Helmand, Kandahar, Nangarhar, and Herat provinces with Iran and Pakistan.

TERR

OR F

INAN

CE 2

020

▪ Groups: o Syria: ISIS, al Qaeda of Syria (AQS), AQ-aligned Hurras al Din (HaD)1, al-Hay’at Tahrir al-Sham (HTS)2,

Russia, Turkey, IRGC-QF, Shiite Militia Groups (SMG)o Iraq: ISIS, Shiite Militia Groups (SMG); esp. Kata’ib Hezbollah, Iran’s IRGC-QF.

▪ Funding: Charitable donations & external funding, oil, artifacts, smuggling, zakat taxation, checkpoint taxation, kidnapping for random (KFR)3,4.

▪ Money Laundering Systems: Turkey and Lebanon as financial hubs, followed by bulk cash smuggling; currency auctions & wires through Iraqi banks, Hawala, Sarafi Exchange Money Service Businesses (MSB).

▪ Financial Facilitation Hubs: Turkey and Lebanon; cities in Syria/Iraq change depending on fighting locations.

GLOBAL TERROR 2020Conflict Zones – Iraq/Syria

TERR

OR F

INAN

CE 2

020

▪ Groups: o Palestine: HAMAS, Palestinian Islamic Jihad (PIJ)o Lebanon: Hezbollah

▪ Funding: Internal as powerful political parties in Palestine and Lebanon; foreign funding from Iran & Muslim Brotherhood.

▪ Money Laundering Systems: Turkey and Lebanon as financial hubs, followed by bulk cash smuggling; currency auctions & wires through Iraqi banks, Hawala, Sarafi Exchange Money Service Businesses (MSB).

▪ Financial Facilitation Hubs: Beirut (Lebanon), Turkey, Cyprus. Cash smuggling into Syria through Lebanon and Iraq through Turkey.

GLOBAL TERROR 2020Conflict Zones – Israel/Palestinian Territories

TERR

OR F

INAN

CE 2

020

GLOBAL TERROR 2020Conflict Zones – Gulf of Aden

▪ Groups: o Somalia: al-Shabaab (AQ-aligned), ISIS-EAo Yemen: Houthi (Iran-proxy), al Qaeda in the Arabian Peninsula (AQAP), ISIS-Y, IRGC-QF,

Saudi Arabian military, UAE military.▪ Funding:

o Somalia: Internal through various revenue streams, including zakat taxation (held territory), smuggling, kidnapping for ransom (KFR).

o Yemen: External from ISIS Core, UAE/Saudi Arabia, and Iran. ▪ Money Laundering Systems: Mobile Money platforms associated with telecommunication

giants, back-ended by remittance services like Western Union and MoneyGram.▪ Financial Facilitation Hubs: Kenya, Libya, Turkey, UAE, Nigeria. Bulk cash smuggling.

TERR

OR F

INAN

CE 2

020

GLOBAL TERROR 2020Conflict Zones – West Africa▪ Groups:

o Libya: UN-backed Government of National Accord (GNA) - backed by Turkey and Qataro Libyan National Army (LNA) - backed by Russia, UAE and Egypt. o West Africa: ISIS-Greater Sahara, AQIM, Jama'at Nasr al-Islam wal Muslimin (JNIM), Hezbollah

▪ Funding/Money Laundering Systems:o Libya/West Africa: External states, zakat, smuggling, Kidnapping for Ransom (KFR). Cash smuggling;

mobile money, remittance programs, banks in Kenya, Egypt, Morocco, Nigeria.▪ Financial Facilitation Hubs:

o Nigeriao Shiite population centers in West Africa remitting/

wiring funds to Lebanon to support Hezbollah

TERR

OR F

INAN

CE 2

020

GLOBAL TERROR 2020Conflict Zones – South America

▪ Groups: o Colombia: Remnants of FARC and National Liberation Army (ELN)

narco-terrorists, Sinaloa Federation (Mexico), CJNG (Mexico)o Venezuela: Maduro regime, Drug Cartels, Hezbollah, IRGC-QF, Russia.

▪ Funding/Money Laundering Systems:o Venezuela: Narcotics; Trade-based Money Laundering (TBML),

crypto currency. ▪ Financial Facilitation Hubs:

o Venezuela, Cuidad del Este (Paraguay), Panama, Caribbean Islands, Puerto Iguazu (Argentina), Foz do Iguaçu (Brazil)

THREAT CLASSIFICATIONTERROR FINANCE

Sunni VEO Shiite VEO OtherSu

b-C

lass

ific

atio

ns

Hezbollah (Transnational)

Financial Facilitators(Interorganizational)

Homegrown(Lone Wolf)

Attack Cell (External Operations)

IRGC(Transnational)

Al Qaeda (Transnational)

Taliban (Afghanistan/Pakistan)

ISIS(Transnational)

TERR

OR F

INAN

CE 2

020

VEO - Violent Extremist Organizations

Houthi (Yemen)

Hamas (Transregional)

Al Shabaab(Regional)

Muslim Brotherhood(Transnational)

Political/Racial

Narco-terrorists“Santa Muerte”

Eco-Terrorist

- Today’s Case Studies

SECTION 3

TERR

OR F

INAN

CE 2

020

Mechanisms

MECHANISMS - BEYOND MONEY LAUNDERINGTe

rror

ism

Fin

ance

Salaries, Precursor Chemicals

Protection, Smugglers

Bribing officials

Fighter salaries/Martyrdom Payments*

Small arms procurement

Ballistic & Nuclear Weapons Programs

Currency Cleansing - Sanctions Evasion

Narcotics

Weapons proliferation

Corruption (Misappropriation)

Illicit Mineral/Gemstone Mining

Human Trafficking

Cyber Fraud

State Funds

Use of Funds

Revenue Generation

IntegrationPlacement Layering

MECHANISMS - MONEY LAUNDERING Te

rror

irsm

Fina

nce

▪ Bulk Cash Smuggling

▪ Hawala

▪ ATM

▪ Bitcoin ATM

▪ Prepaid Cards

▪ Cash Deposits

▪ Charitable contributions

▪ Sarafi Exchanges*

▪ Remittances

▪ Mobile Money

▪ Wire Transfers

▪ Free Trade Zones (FTZ)

▪ TBML – False Invoicing

▪ Crypto Exchanges

▪ Front companies

▪ Shell/Shelf Companies

▪ Cash “bust-out”

▪ Bulk cash smuggling

▪ Purchase of Assets

▪ Stored Value

IntegrationPlacement Layering

MECHANISMS – HAWALA SYSTEMTe

rror

ism

Fin

ance

▪ Hawala: An ancient informal value transfer system (IVTS) of debts transcribed on ledgers. Debts settled by bulk cash smuggling, Sarafi Exchange Money Service Businesses (MSB), movement of stored value or goods, or traditional banking.

▪ Hawalader: Honorific for cash-intensive hawala dealer-broker.

Communicates Transaction Order(now owes Debt)

Originator Beneficiary

Hawalader BHawalader A

Debt transcribed on ledger, subject to settlement

MECHANISMS – HAWALA SYSTEMSarafi Debt Settlement

Terr

oris

m F

inan

ce

▪ Sarafi Exchange: Money Service Business (MSB) and currency exchanger, often in under-banked Islamic countries. Settle debts on behalf of hawaladers. Sarafis use remittance programs like Western Union or MoneyGram, and conduct wire transfers through bank accounts.

▪ Sarafs: Honorific for Sarafi Exchange remitter.

Transaction Order (Debt)

Real Transactions (Debt Settlement)

Hawalader A Hawalader B

Saraf A Saraf B

Correspondent Banks

MECHANISMS – HAWALA SYSTEM Currency Auctions

Terr

oris

m F

inan

ce

▪ Hawala Auction: Typically a government-run auction of various currencies. Hawaladers use hawala currency auctions to conduct exchanges between various currencies.

▪ Where do they take place? – Iraq, Afghanistan, Iran, Pakistan, UAE, and other countries with significant use of the hawala system.

▪ Why does it matter? – Hawala auctions serve as a primary mechanism of organized currency cleansing to avoid sanctions, most often by Iran, who is actively exchanging out of the Iranian Rial (IRR) currency for Afghan Afghani, Turkish Lira, UAE Dirham, Pakistani Rupee, Euro, and most significantly, the U.S. Dollar.

Currency Cleansing

MECHANISMS – HAWALA SYSTEM TBML Debt Settlement

Terr

oris

m F

inan

ce

Hawala Trade-based Money Laundering (TBML): Stored value exchange to settle debts between hawaladars on hawala ledgers

▪ Precious Metals, such as Gold and Silver▪ Gemstones, such as diamonds, rubies, and emeralds▪ Minerals, such as Talc, Chromite, and Marble

H-A owes $$$ to H-BSettles debt with Gemstones

Hawalader A (H-A) Hawalader B (H-B)

MECHANISMS – HAWALA SYSTEM Crypto Debt Settlement

Terr

oris

m F

inan

ce

Crypto Currency Debt Settlement: Hawaladers utilize Sarafs with bank accounts, who wire funds to crypto currency exchanges of the counterparty.

▪ Sarafs in multiple locations could share the same crypto currency wallet address for purposes of depositing in one location and withdrawing in another location without a transaction on the blockchain ledger

Transaction Order (Debt)

Real Transactions (Debt Settlement)

Hawalader A Hawalader B

Saraf A Saraf B

MECHANISMS – ZAKATTe

rror

ism

Fin

ance

▪ Zakat: One of the five pillars of Islam, Zakat is a mandatory religious tax, misused by terrorist groups for extortion from civilian populations.

o Sunni Terrorism Zakat: I.e. Taliban or ISIS, implement Zakat as an extortion tax within their territorial control.

o Shiite Terrorism Zakat: i.e. IRGC or Hezbollah, centralized under the leadership of the Iranian Ayatollah, receive Zakat from Shiite population centers, even outside of their territorial control (e.g. South America or Africa)

▪ Types of Zakat:o General taxation, protection extortion, checkpoints, utilities o Charitable Contributions*

▪ Types of Payments:o Cash payments, remittances, wire transferso Portion of farming/agricultural produceo Safe-haven and material support

MECHANISMS – ZAKATCharities & NGOs

Terr

oris

m F

inan

ce

▪ Charities:

o Type 1 – Witting terrorist financing

o Type 2 – Unwitting misappropriation of charitable contributions

• Payments companies, Money Service Businesses (MSB), Crypto Currency

▪ NGOs:

o NGOs focused on refugees, children, or other emotional connections in specific conflict zones where terror groups are most prominent

o Islamic/academia NGOs

Scheme: Misappropriation (NGO or Business) to Bust-Out

Phases 1 2 3

Currency BTC or Fiat BTC Fiat

ActionsFiat and/or BTC received into entity, forwarded to crypto exchange.

BTC layered through Tumbler to second exchange.

Fiat ACH transfer from crypto exchange to bank, followed by cash-intensive “bust-out.”

1 2

KEY

▪ NGOs operating in active combat zones in Middle East or North Africa▪ Businesses with no apparent crypto need or business purpose

Charities & NGOs – Misappropriation Scheme

3

SECTION 4

TERR

OR F

INAN

CE 2

020

Threat Organizations

IRGC-Quds Force

Typologies: Threat Group Analysis

Islamic Revolutionary Guard Corps – Quds Force (IRGC-QF)

Leader Esmail Qaani (replaced Qasem Soleimani)

Sub-ClassificationShiite terror group, military, and intelligence service of Iran with oversight of Shiite terror groups around the world.

AffiliationsHezbollah, Hamas, Taliban, Houthi, al Qaeda, Palestinian Islamic Jihad, Los Zetas, Russia, Venezuela, Syria, Turkey, Chinese criminal organizations

LocationsIran, Afghanistan, Iraq, Syria, Lebanon, Yemen, Azerbaijan, Bahrain, Qatar, Turkey, Venezuela, United Arab Emirates, Palestinian Authority, China

Money Laundering

▪ Revenue Generation: State government funds/Oil; Khatam al-Anbiya, (IRGC’s construction arm)▪ Mechanisms/Typologies: Hawala auction currency cleansing, weapons procurement.▪ Financial Hubs: Turkey, UAE, Iraq, Afghanistan, Lebanon, China.

ORGANIZATIONAL PROFILES

Scheme: Iranian Sanctions Evasion – Hawala Auctions and Turkish $50,000 USD Structuring

Phases 1 2 3 4

Currency Iranian Rial to other Fiat Fiat Fiat & BTC USD fiat

ActionsIranian proxies exchange Iranian Rial for other fiat currencies at Iraqi or Afghan hawala currency auctions

Fiat SWIFT to Turkish banks

Turkish Engineers structure wires under $50,000 USD to crypto exchanges

USD sent to bank. Bust out cash smuggled to Iran

1 2 4

Iran

Iraq

Afghanistan

?

3

Iran

KE

Y

▪ Turkish CTR threshold is above $50,000 USD▪ Look for groups of engineers from same companies▪ Transactions between Turkish banks and crypto exchanges gradually build over time to >$50,000

Case Study – Iranian IRGC

Terr

oris

m F

inan

ceHezbollah

Typologies: Threat Group Analysis

Lebanese Hezbollah (LH)Leader Hassan Nasrallah

Sub-Classification Shiite terrorist, Iranian proxy; Lebanese political party & military; Transnational Criminal Organization.

Affiliations IRGC, Shiite groups in Iraq/Syria, Houthi (Yemen), HAMAS (Palestine), South American drug cartels

Locations Middle East, West Africa, South America, United States, Mexico, Canada

Money Laundering ▪ Revenue Generation: Iranian funding, cocaine, counterfeit goods, tobacco, gold/precious metals▪ Mechanisms/Typologies: TBML cocaine, retail goods, gold, & counterfeit goods, remittances/wires

from Shiite population centers in South America and West Africa to Lebanon▪ Financial Hubs: Tri-border Area (TBA) countries of Paraguay (Ciudad del Este), Argentina (Puerto

Iguazo), and Brazil (Foz do Iguaçu). Lebanon (Beirut), Venezuela, Colombia, Panama, Mexico

ORGANIZATIONAL PROFILES

Hezbollah Finance

https://www.washingtoninstitute.org/hezbollahinteractivemap/

Who:▪ Businesses: Electronics, import/ export, construction, auto

dealer, gas stations/convenience stores

▪ Individuals: Military-aged males, Shiite Islamic naming conventions

What: Trade-based money laundering (TBML) - cocaine and counterfeit goodsWhere: Tri-border Area (TBA) banks to Hezbollah headquarters in Lebanon.

When: Year-round.Why: Sending proceeds to Lebanon headquarters and paying off counterfeit goods suppliers in mainland China via Hong Kong

Product Classification Typology Organization EchelonInternational – SWIFT Narcoterrorism Tri-Border Area (TBA) Cocaine Hezbollah Operational

Originator O-Bank B-Bank Beneficiary Wires Time RangePARAGUAY BRAZIL HONG KONG HONG KONG 7 30 days $20,000-50,000

VENEZUELA PARAGUAY IRAQ LEBANON 6 30 days $20,000-50,000ARGENTINA ARGENTINA LEBANON LEBANON 12 30 days $20,000-50,000

Case Study – Hezbollah

Taliban Finance

Typologies: Threat Group Analysis

TalibanLeader Hibatullah Akhundzada

Sub-Classification Sunni Terrorist Group, Drug Trafficking Organization

Affiliations Al Qaeda (AQIS), Haqqani Network, Tehrik-i-Taliban, IRGC-QF (1, 2, 3, 4), Pakistani ISI (5, 6, 7, 8)

Locations Afghanistan, Pakistan, Iran (1, 2, 3, 4), Dubai (UAE) (9, 10), Qatar

Money Laundering ▪ Revenue Generation: Heroin production, distribution, taxation; other narcotics; Zakat” taxation, control of electrical dam, gemstone trafficking, mineral trafficking (talc, chromite, marble).

▪ Mechanisms/Typologies: Bulk cash smuggling; Hawala/Sarafi system, payments to fighters, martyrdom payments to families, real estate purchases in Dubai and Pakistan.

▪ Financial Hubs: Pakistan, Dubai (UAE), Qatar, Iran, Turkey.

ORGANIZATIONAL PROFILES

Terr

oris

m F

inan

ce

Scheme: Sarafi Exchange – Hawala Debt Settlement

Phases 1 2 3

ActionsT-A gives cash to H-A intended for T-B. H-A now owes debt to H-B.

S-A wires funds to S-B to settle H-A’s debt to H-B. The transaction is cleared by Correspondent Bank.

T-B picks up cash from H-B

AFGHANISTAN PAKISTAN DUBAI, UAE

Terrorist-A(T-A)

Hawaladar-A (H-A)

Hawaladar-B (H-B)

Terrorist-B(T-B)

Saraf-A (S-A)

Saraf-B (S-B)

DUBAI, UAE1 2 3

Debt Debt

KE

Y

▪ Mainly Sunni groups like Taliban or ISIS▪ Scheme applied to significant revenue generation event (i.e. drug trafficking)▪ Shiite groups like Hezbollah prefer TBML

Bank-A (B-A)

Correspondent

Case Study – Taliban

ISIS Finance

Typologies: Threat Group Analysis

ISISLeader Mohammad Abdul Rahman al-Mawli al-Salbi (replaced Abu Bakr al-Baghdadi)

Sub-Classification Sunni terrorist group born from al-Qaeda of Iraq (AQI).

Affiliations Internal between ISIS Headquarters (Syria/Iraq) and ISIS provinces (wilayats)

Locations Syria/Iraq, Afghanistan, Northwest/East/Central Africa, East Asia, Gulf Nations

Money Laundering ▪ Revenue Generation: Former Caliphate (banks, oil, antiquities), Zakat taxation, Charities (misappropriation), Mineral Mining & Gemstones (Afghanistan), criminal activities.

▪ Mechanisms/Typologies: Caliphate Retreat - funding remote provinces from HQ through Turkey hub via Hawala/Sarafi. Funding external attacks. Crypto currency, exploitation of refugee camps.

▪ Financial Hubs: Turkey, Syria, Iraq, Indonesia, Nigeria, Germany, Saudi Arabia, Egypt, Malaysia

ORGANIZATIONAL PROFILES

Product Classification Typology Organization Echelon

International - SWIFT Terrorism External Operations ISIS Strategic

Case Study - ISIS

SECTION 5

TERR

OR F

INAN

CE 2

020

Investigatory Techniques - ISIS

Terr

oris

m F

inan

ce Working at the practitioner level

▪ The Case of Ali Roble o Detection

o Case Investigation

o SAR submittal

ISIS CASE STUDY - ROBLE

COMPARING RISK VS THREATTe

rror

ism

Fin

ance

GLOBAL THREAT

LANDSCAPE (GTL)INHERENT RISK

ENVIRONMENT (IRE)

VS

Weapons Humans Drugs TerrorProducts Geography Customers Counterparties

▪ Threat-focused, static, threat

“Actor-centric” view of the world

▪ Defines and contrasts Threat

Classifications, Organizations, and

Typologies against Mechanisms,

Products, and Geography.

▪ Institutionally-specific risks to

exploitation by threat networks

▪ Explores products/services,

geographic nexus of

product/service offerings,

customers and their counterparties

Terr

oris

m F

inan

ceISIS CASE STUDY - ROBLE

Alert Investigation

Case Investigation

SAR

IRE “Core-4” Case Escalation

Terr

oris

m F

inan

ce ▪ Provide material support for ISIS

▪ Specifically personnel and resources

▪ 11 conspirators charged in Minnesota

▪ Federal authorities are charging 20-year-old Mohamed AminAli Roble, a Minneapolis man, with joining the Islamic Stateafter they say he used settlement money from a bridgecollapsing suit to travel to Syria.

ISIS CASE STUDY - ROBLE

ISIS CASE STUDY - ROBLETe

rror

ism

Fin

ance

AML RISK – FINANCIAL INSTITUTIONS“Core-4” RiskTe

rror

ism

Fin

ance GEOGRAPHIC NEXUS

Recognizing the multidimensional nature of

jurisdictional risk in fund flows

▪ Corruption

▪ Sanctions Evasion

▪ Organized Criminal Trafficking

▪ Terror Finance

AML RISK – FINANCIAL INSTITUTIONS“Core-4” RiskTe

rror

ism

Fin

ance PRODUCT/SERVICES NEXUS

Recognizing the spending and items purchased

▪ Organized Criminal Trafficking

▪ Terror Finance

▪ Corruption

▪ Terrorist logistics support

AML RISK – FINANCIAL INSTITUTIONS“Core-4” RiskTe

rror

ism

Fin

ance

Group Segmentation

Recognizing the spending and items purchased

▪ Social affiliation

▪ Expected culture and ways

▪ Expected alliances

AML RISK – FINANCIAL INSTITUTIONSTe

rror

ism

Fin

ance

AML RISK – FINANCIAL INSTITUTIONSTe

rror

ism

Fin

ance COUNTRY TF RISK DETAILS

TURKEY VERY HIGH

ISIS, Hurras al-Din (HAD), Hay'at Tahrir al-Sham(HTS), Kata'ib Hezbollah, al Qaeda, Kurdish Groups (YPG/PKK), Syria, Iran & Venezuela funding ties. Money Laundering financial facilitation hub for terrorist organizations.

$81,000Total amount 7 months

Terr

oris

m F

inan

ce

HIGH RISK

MCC /POS data/ATM

ISIS CASE STUDY - ROBLE

Terr

oris

m F

inan

ce

CORE-4

VERY HIGH RISK

GAZIANTEP

ALEPPO

$81,000Total amount 7 months

MCC/POS data/ATM

ISIS CASE STUDY - ROBLE

Terr

oris

m F

inan

ceISIS CASE STUDY - ROBLE

12 Transactions$47 k

Terr

oris

m F

inan

ce

CORE-4

VERY HIGH RISK

MCC/POS data/ATM

Terr

oris

m F

inan

ceHTF METHODOLOGY

TERROR FINANCE QUESTIONSTe

rror

ism

Fin

ance

1. What is the source of funding or wealth?

2. Where and how illicit funds or value are placed?

3. Where and how do they store funds or value?

4. How do they move or transfer funds or value?

5. What goods and services are purchased and how are they payed?

6. Is there any financial activity that suggests imminent threat or terrorism financing?

7. Is there activity that suggests the existence of a terrorist network? (target central transactional analysis)

Terr

oris

m F

inan

ce

▪ Should we escalate the alert to CASE?

▪ What do we do?

ISIS CASE STUDY - ROBLE

Mohamed Amin Ali Roble

Terr

oris

m F

inan

ce ▪ Integrated Controls — Operations

o Risk Assessment/Threat Assessment

o Typology Identification (specific detection scenarios)

o Transaction Monitoring that includes the “who and the how”

SUMMARYImplementing HTF Methodology

KEYNOTE SPEAKERIN

TROD

UCTI

ON T

O HY

BRID

TH

REAT

FIN

ANCE

Colonel Josh Potter, USA (Ret.)Former Director, Transnational Threats Division,

USSOCOM, U.S. Army Special Forces

Terror Finance 2020October 21, 2020

DARK FINANCIAL INTELLIGENCETASK: MAKE US MORE SECURE & PROFITABLE

WHAT MAKES ORGANIZATIONS SUCCESSFUL?

▪ Capitalize on Strengths

▪ Mitigate or Reduce Weaknesses

▪ Security, Security, Security

FINANCIAL SERVICES FOR THE SYNDICATE

GENERATE

▪ Extortion of local area, closed diaspora or controlled territory

▪ Private donations

▪ Misuse of Non-profits and charities

▪ Proceeds from illicit activities

▪ Kidnap for ransom

▪ Legitimate commercial enterprise

▪ State sponsorship

STORE

▪ Physical cash; fiat currency

▪ Formal cash deposits

▪ Virtual currency

▪ Investment vehicles

▪ Non-traditional financial vehicles

MOVE

▪ Formal financial mechanisms

▪ Informal financial mechanisms

▪ Physical cash transportation

▪ Virtual currency transactions

▪ Illicit value transfer

USE

▪ Operations

▪ Propaganda, information and recruitment

▪ Salaries and member compensation

▪ Training

▪ Social services

OBFUSCATE, CONFUSE AND PROTECT▪ The source of illicit money

▪ The identities of the syndicate

▪ The true locations of activity and assetsOBFUSCATE

▪ The investigators

▪ Our competition

▪ Mix legitimate and illicit; witting and unwittingCONFUSE

▪ The syndicate organization

▪ Communications

▪ Asset transfersPROTECT

GENERATE: COMMON SOURCES OF ILLICIT INCOME

▪ Drugs

▪ Human trafficking

▪ Insurance fraud

▪ Theft of high value items

▪ Cybercrime

▪ Art forgery

▪ Ponzi schemes

▪ Weapons trafficking

▪ Intellectual property theft

▪ Extortion

▪ Counterfeit currency

▪ Document forgery (identification,

bills of lading, inventory, etc)

▪ Counterfeit DVDs

▪ Piracy

▪ Precious metals

▪ Trade violations and black market

▪ Kidnap for ransom

USE: COMMON USES OF PROCEEDS

Payroll

Facilities (safe houses, cache, storage units,

supply network, auto garage)

Material, equipment, tools

Vehicles (including vehicle modifications or

chop-shop)

Commercial travel

Communications (couriers, cell phones,

devices, people)

IED making material (circuit boards,

blasting cap, UAS, etc)

Weapons (arms and ammunition)

Training

Recruitment

Bribes to officials and to influence

Payments to martyrs’ families

Social programs

STORE & MOVE: COMMON MISTAKES OF ILLICIT TRANSFERS

Bulk Cash Smuggling:

▪ Courier appears nervous

▪ Courier loose fitting clothes

▪ Courier walks with an odd gait

▪ Courier unusual concern about carry-on

▪ Unusual routing in shipping container

▪ Evidence of tampering or altering construction of vehicle compartment

Charities and NGO Thurways:

▪ Small, obscure charity with minimal staff (or check signing authority)

▪ Money given to families of suicide bombers (martyr payments)

▪ Lack documentation to show charity is fundraising with general public

▪ Closed list of donors

▪ No fundraising events

▪ Charitable objectives do not match expenditures

▪ Overlapping corporate officers and bank signatories

▪ Complex structure or Organization chart

STORE & MOVE: COMMON MISTAKES OF ILLICIT TRANSFERS

Front & Shell Companies

▪ Deposits greatly exceed receipts generated

▪ Business has few customers and/or appears not to be profitable

▪ # of employees exceeds what business warrants (ghosts)

▪ Stock on shelves untouched or old

▪ Lack of progressive accounting measures

▪ Avoids marketing or commercial coverage

▪ Little indication of business expenses

▪ Multiple business sharing address

▪ Multiple businesses incorp on same day

▪ Board members from same family / friends

▪ Address is a mail service company

Trade Based Money Laundering (TBML)

▪ Items shipped (manifest) are inconsistent with customer business

▪ Customers conduct business in or transit through high-risk areas

▪ Customers involved with potentially high-risk activities (subject to import/export restrictions)

▪ Over- or Under-pricing of goods and services

▪ Transaction structure appears unnecessarily complex

▪ Customer requests payment of proceeds to unrelated party

▪ Shipment locations or description of goods not consistent with letter of credit

STORE & MOVE: COMMON MISTAKES OF ILLICIT TRANSFERS

Wire Remittance

▪ Multiple TX on same or consecutive days below reporting threshold

▪ Repeat TX sent to border locations

▪ ID information missing, illegible or inconsistent (phone number, etc)

▪ TX sent to “grey zone” areas

Traditional Banks

▪ Financial activity inconsistent with purpose of business or stated occupation

▪ Use of multiple accounts at single bank without explanation

▪ Importation of high dollar currency not commensurate with occupation

▪ Multiple safe deposit boxes

▪ Uneconomic or unjustified fund transfers

▪ Concealing assets (found through other searches)

▪ Payments to fictitious companies

▪ Using false billing or invoices

▪ Frequency of check cashing

▪ Use of stolen or false identification

PRIMARY SOURCE OF MONEY: DRUG TRADE (OLD SCHOOL)

Grower Refinement Distributor

Dealer

Product exchanged for cash with Customer

Local organization affiliate

PRIMARY SOURCE OF MONEY: FRAUD (REAL ESTATE)

Fraudster Agent Purchase property

Renovations & Upgrades

Client-owned businesses do not perform work charged or over

billing

Sell property

DESIGN MECHANISM TO OBFUSCATE, CONFUSE & PROTECTUse various means, controlled by the syndicate. If

you need it, we can acquire it. Listed to the right are

some previous examples. Incorporate multiple layers:

▪ TBML

▪ Cryptocurrency

▪ Legitimate businesses

▪ Real estate

▪ Shell companies

* Take into consideration insurance and mitigation

measures

Pool & landscaping

services

Hotels

Transportation &

shipping Cryptocurrency

exchange

Casinos

Engineering and

architectural design

Meat packaging &

delivery

Construction

Waste

management

Florist delivery

Communication

application design

Dry cleaning

Air fright cargoUsed cars Art dealership

appraisal

Mining operation

Professional

consultant services

DARK FINANCIAL INTELLIGENCE

▪ What is your solution?

QUESTIONS?PLEASE USE YOUR CHAT BOX TO SUBMIT YOUR QUESTIONS FOR COL. POTTER

PRACTICAL EXAM IN

TROD

UCTI

ON T

O HY

BRID

TH

REAT

FIN

ANCE

▪ Quiz will be available after the session. There will be a link in your follow-up email. It will also be available at https://s2fis.com/session2

▪ Recording available after the session▪ https://s2fis.com/quizzes/terrorism-finance-2020/▪ Passing score is 80%▪ Certificate will be immediately available for printing/download upon passing the

quiz. Certificate for each portion. If you pass all 6, you will receive a series certificate (12 CPE)

▪ 2 CPE credits from ACFCS or University of New Haven

INTR

ODUC

TION

TO

HYBR

ID

THRE

AT F

INAN

CE

KEYNOTE SPEAKER

UPCOMING SESSIONSIllicit Finance in Drug TraffickingOctober 28, 2020, 1-3PM EST

Javier Peña & Steve MurphyDEA Special Agents (Ret.),

Inspiration for Netflix series “Narcos,”Authors of “Man Hunters”

▪ What are the differences in money laundering

schemes/typologies by drug product (i.e. cocaine,

heroin, methamphetamine)

▪ How have drug cartels evolved their money

laundering practices since Pablo Escobar and the

Medellin Cartel?

▪ How can I target narco-laundering from street level

to international level?

▪ Who are the major drug trafficking orgs to watch

for internationally and in the U.S. in 2020? What

should I look for?

INTR

ODUC

TION

TO

HYBR

ID

THRE

AT F

INAN

CE

KEYNOTE SPEAKER

UPCOMING SESSIONSCounterfeiting & Wildlife TraffickingNovember 04, 2020, 1-3PM EST

David LunaDirector for National Security &

Diplomacy, U.S. Dept. of State (Ret)

▪ At what points to counterfeiting and money

laundering intersect? What does it look like?

▪ What are the primary animals, bank products,

fund flows, and places I should be looking at?

▪ What threat organizations are earning

revenue from Counterfeiting & Wildlife

Trafficking?

▪ How do these subjects tie into Trade-based

Money Laundering (TBML)?

INTR

ODUC

TION

TO

HYBR

ID

THRE

AT F

INAN

CE

KEYNOTE SPEAKER

UPCOMING SESSIONSTrade-based Money Laundering (TBML)November 11, 2020, 1-3PM EST

Jimmy ArroyoAssistant Special Agent in Charge, DEA NY Division

▪ How can I identify shell companies using only

open source websites and mapping tools?

▪ How do I analyze letters of credit, bills of

laden, and other relevant documents to

determine over or under invoicing?

▪ How do threat organizations use maritime

and air cargo containership for TBML?

▪ Who are the organizations that use TBML,

what are their geographic fund flows, entity

types by group, and what financial products to

they use?

INTR

ODUC

TION

TO

HYBR

ID

THRE

AT F

INAN

CE

KEYNOTE SPEAKER

UPCOMING SESSIONSCorruption & Sanctions Evasion – VenezuelaNovember 18, 2020, 1-3PM EST

Dr. Vanessa NeumannVenezuelan-American Diplomat;

Founder, Asymmetrica; Author, “Blood Profits”

▪ Why is Venezuela one of the world’s most

strategically important countries for money

laundering? How does it tie into National Security?

▪ How does the Nicholas Maduro regime

misappropriate proceeds, generate illicit revenue

streams, launder proceeds, and evade sanctions

and how do I identify these patterns?

▪ What hostile state and non-state threat

organizations have a transactional relationship with

the Maduro regime?

Thank you for your participation!

• Please fill out the feedback form following the session.

• Thank you once again to our partners who made this possible.

#NatSecGirlSquad

DEA NARCOS.com

https://s2fis.com/tfa-webinarhttps://s2fis.com

1-833-723-4700 Toll Free

Thank you for your participation ! See you next week! Don’t miss the NARCOS Agents—Steve Murphy and Javier Pena

Thank you to our partners!