Upload
others
View
9
Download
0
Embed Size (px)
Citation preview
SERIES ONETerror Finance 2020Evolution of Religious Terrorism
October 21, 2020, 1:00PM – 3:00PM EST2 - ACFCS CPE HoursT
HR
EA
T F
INA
NC
E A
CA
DE
MY
A D
IVIS
ION
OF
SE
CT
ION
2
WORKCAST WEBINAR INTERFACETe
rror
ism
Fin
ance
DISCLAIMERS***RESTRICTIONS***
INTR
ODUC
TION
TO
HYBR
ID
THRE
AT F
INAN
CE
▪ TFA Instructors represent the positions only of Section 2 Financial Intelligence Solutions, and do not necessarily represent the official or unofficial views of any other public or private sector entity.
▪ Keynote speakers represent their own individual views, that don’t necessarily represent the official or unofficial positions of any public or private sector entity.
▪ Instructors and keynote speakers are strictly prohibited from discussing any content, that individually or in aggregate, would constitute classified, Law Enforcement Sensitive (LES), BSA Sensitive, or For Official Use Only (FOUO) information.
▪ Audience members from the public sector are asked to refrain from any sensitive questions in this open-source format.
OUR INSTRUCTORSS2’s Threat F inance Academy offers some of the wor ld ’s top f inancia l cr ime instructors from the f inancia l services , academia , law en forcement , and in te l l igence industr ies .
Deb GeisterCEO, Section 2
BSA Officer, Sr. Compliance Exec: LexisNexis, Matrix-IFS,
MetaBank, U.S. Bank
Sue LynchS2 TFA Manager
Economic Crime Professor, Bank Fraud Officer:
MasterCard, Goldman Sachs
Rob BaconS2 TFA Manager
U.S. Army 1st Sergeant (Ret.), Police Spec. Ops Commander
NY-NJ HIDTA/DEA-FIT/NYPD NIU
Joshua FruthCSO, Section 2
U.S. Army Captain, Law Enforcement Officer, AML
Director at Matrix-IFS
Terr
oris
m F
inan
ce
KEYNOTE SPEAKERIN
TROD
UCTI
ON T
O HY
BRID
TH
REAT
FIN
ANCE
Colonel Josh Potter, USA (Ret.)Former Director, Transnational Threats Division,
USSOCOM, U.S. Army Special Forces
Terror Finance 2020October 21, 2020
AGENDA▪ Hybrid Threat Finance (HTF)▪ Islamic History & Sectarianism▪ Current Threat Landscape▪ Mechanisms▪ Global Threat Landscape▪ Typologies by Threat Organization▪ Keynote Address▪ Q&A▪ Upcoming Sessions▪ Workshop/Quiz Overview
Terr
oris
m F
inan
ce
LEARNING OBJECTIVES
▪ Understand the History of Islamic Terrorism and Sectarian Division and the current landscape
▪ Understand the primary terrorist organization networks and:o Their locations o Revenue generation o Money laundering typologies
▪ Understand terrorist finance mechanisms such as: o Hawala/Sarafio Charitable Misappropriationo Zakato Currency-cleansing
TERR
OR F
INAN
CE 2
020
THE “HYBRID THREAT”
Hybrid Threat – Network intersection between:
a. 1 or more State (government) or Non -State (non-gov) threat organizations
b. Operating in multiple threat classif ications
Threat Classifications
TERR
OR F
INAN
CE 2
020
HYBRID THREAT FINANCE
Hybrid Threat Finance – The ill icit f inance network intersection
between 1 or more hostile State and/or Non-State threat organizations.
TERR
OR F
INAN
CE 2
020
COMPARING RISK VS THREATGLOBAL THREAT
LANDSCAPE (GTL)INHERENT RISK
ENVIRONMENT (IRE)
VS
Weapons Humans Drugs TerrorProducts Geography Customers Counterparties
▪ Threat-focused, static, threat
“Actor-centric” view of the world
▪ Defines and contrasts Threat
Classifications, Organizations, and
Typologies against Mechanisms,
Products, and Geography.
▪ Institutionally-specific risks to
exploitation by threat networks
▪ Explores products/services,
geographic nexus of
product/service offerings,
customers and their counterpartiesTERR
OR F
INAN
CE 2
020
INHERENT RISK ENVIRONMENT (IRE)Risk to Financial Institutions
Geographic Nexus
Products/Services
Customer Population Group Segmentation
“Core-4” Risk Model
Counterparty Population Group Segmentation
WHAT products & services do you offer?
WHERE do you offer them?
WHO are your customer groups (good & bad)?
WHO are their counterparties (good & bad)?
TERR
OR F
INAN
CE 2
020
GLOBAL THREAT LANDSCAPEGlobal Threat Landscape
Ge
ogr
aph
y
Pro
du
cts
Me
chan
ism
s
Threat Classifications
Sub-Classifications
Threat Organizations
Schemes & Typologies
Hawala
Prostitution
TERR
OR F
INAN
CE 2
020
SECTION 1
TERR
OR F
INAN
CE 2
020
ISLAMIC HISTORY & SECTARIANISM
ISLAMIC HISTORY & SECTARIANISMTE
RROR
FIN
ANCE
202
0
▪ Sunni: Most competent leader
o Salafist Movement: Orthodox (traditional) literalist, strict, puritanical adherence to written Qur'an
▪ Shi’a: (aka Shiite) Bloodline leadership -“followers of Ali”
▪ Caliph: “The Rightly Guided;” ruler of the Caliphate
▪ Caliphate: Office of supreme religious and political leader of the Umma, the Islamic State, and political successor to Mohammad.
▪ Islamic State: Religious kingdom under the leadership of the Caliph; adherence to Sharia
▪ Sharia: Strict adherence to orthodox Islamic Law; derived from the Qur’an and the Sunnah. Significantly different views on freedom of speech, religious freedom, and women’s rights.
ISLAMIC HISTORY & SECTRARIANISMSectarian Division
TERR
OR F
INAN
CE 2
020
ISLAMIC SECTARIANISM
Sunnis Shiites
Caliphate Model Most competent leader Bloodline succession
Population Majority (85-90%) Minority (10-15%)
LeadershipDecentralized under various
countries/groups/places; many
seek Islamic Caliphate
Centralized leadership under Iranian leader -
philosophy of vilayat-e faqih (rule of the Islamic jurist, or single leader)
GeographyDiverse and spread out
throughout Middle East, Africa,
SE Asia.
Concentrated population centers - Iran, Iraq,
Syria, Yemen, Lebanon, Bahrain, Azerbaijan,
South America, & West Africa
ISLAMIC HISTORY & SECTRARIANISMIran – Fall of the Shah: The 1979 Revolution
TERR
OR F
INAN
CE 2
020
“From Mubarak, Through Morsi: Military, Muslim Brotherhood, and U.S. Policy in Egypt.” Fruth, Joshua T. University of Military Intelligence, Fort Huachuca, Sierra Vista, AZ. 2013. The United States Army.
▪ Deposed the Monarchy (Shah) and instilled the radical Shiite state (1979-1981).▪ Iran has dual religious and political power structures. Both maintain militaries and intelligence services. ▪ The religious side has significantly more power, funding, and control.▪ Iran’s religious wing provides oversight to numerous Shiite Militia Groups (SMG) around the world,
such as Lebanese Hezbollah and the Yemeni Houthi.
Ayatollah Ali KhameneiIranian Spiritual Leader
President Hassan RouhaniIranian Political Leader
TERR
OR F
INAN
CE 2
020
▪ 4 years after the end of the last Caliphate (Turkish Ottoman Empire), Egyptian schoolteacher Hassan al-Bannafounded the Muslim Brotherhood (MB) in 1928.
▪ MB is the root of all modern Sunni terrorist groups, including al-Qaeda, HAMAS, Egyptian Islamic Jihad (EIJ), Palestinian Islamic Jihad, and ISIS. HAMAS refers to itself as a “wing of the Muslim Brotherhood.”
▪ AQ founder Osama bin Laden and current leader Ayman al-Zawahiri were both members.▪ Laser focus on implementing Sharia and creating an Islamic Caliphate▪ Millions of members in overt & covert branches in over 70 countries, including legitimate political parties in
many countries.
“From Mubarak, Through Morsi: Military, Muslim Brotherhood, and U.S. Policy in Egypt.” Fruth, Joshua T. University of Military Intelligence, Fort Huachuca, Sierra Vista, AZ. 2013. The United States Army.
Jihad is defined as: “Violent warfare against non-Muslims to establish Islam as dominant across the entire world.” – Hasan al-Banna, Muslim Brotherhood
“God is our goal, the Qur’an is our Constitution, the Prophet is our leader,
jihad is our way, and death in the service of God is the loftiest of our
wishes. God is great. God is great.” -The Muslim Brotherhood Motto
ISLAMIC HISTORY & SECTRARIANISMIran – Fall of the Shah: The 1979 Revolution
SECTION 2
TERR
OR F
INAN
CE 2
020
Current Threat Landscape
GLOBAL TERROR 2020Major Events & Updates (Part 1 of 3)Crypto-cleansing
TERR
OR F
INAN
CE 2
020
▪ October 2020 – US DOJ “Cryptocurrency Enforcement Framework” – Indicates heavy crypto usage by terrorist groups & DOJ’s plan to disrupt terror crypto-cleansing Link Here
▪ August 2020 – DOJ Crypto Seizure – DOJ announced operation resulting in seizure of $2 million USD in asset forfeiture across approx. 300 crypto currency wallets belonging to al Qaeda, Hamas, and ISIS terrorists See Here
o “Scheme involved openly asking for donations to fund terrorist activities (WITTING), duping people into donating to fake charities (UNWITTING), and exploiting the coronavirus pandemic by purporting to sell personal protective equipment (PPE).”
- Don Fort, Chief, IRS-CI.
GLOBAL TERROR 2020Major Events & Updates (Part 2 of 3)Hezbollah Bill
TERR
OR F
INAN
CE 2
020
▪ October 2020 – New Hezbollah Money Laundering Bill in Congress –Bill targets areas under Hezbollah's control that should be classified "primary money laundering concerns" under section 311 of the USA PATRIOT Act.
o Targets south Lebanon
o Targets Tri-Border Area (TBA) in South America, specifically 3 cities in 3 countries: Puerto Iguazu in Argentina, Ciudad del Este in Paraguay and Foz do Iguaçu in Brazil, which is responsible for $6 billion USD in money laundering per year for narco-terrorists and other threat networks See Here
GLOBAL TERROR 2020Major Events & Updates (Part 3 of 3)Al Qaeda Gemstone TBML
TERR
OR F
INAN
CE 2
020
▪ October 2020 – US Department of Treasury Sanctions Australian-based al Qaeda Money Launderer –
o Ahmed Luqman Talib traded in precious stones, allowing him to “move funds internationally” for Al Qaeda.
o Mr. Talib’s business is based in Melbourne, but he works around the world, including in Brazil, Colombia, Sri Lanka, Tanzania, Turkey and the Persian Gulf region.
GLOBAL TERROR 2020Conflict Zones – Afghanistan/Pakistan
TERR
OR F
INAN
CE 2
020
▪ Groups: Taliban, ISIS-K, Taliban, Haqqani Network, Lashkar-e-Taiba (LeT), & Tehrik-i-Taliban, al Qaeda in the Indian Subcontinent (AQIS), IRGC Quds Force (IRGC-QF).
▪ Funding: Extortion tax (Zakat), opium/morphine/heroin hub of the world, hashish, methamphetamine, gemstones, minerals.
▪ Money Laundering Systems: Cash smuggling, Hawala, Sarafi Exchange Money Service Businesses (MSB), currency auctions & wires through conventional banking
▪ Financial Facilitation Hubs: Afghanistan (Kandahar, Kabul, Herat, Nangarhar), Pakistan, Dubai (UAE); cash smuggling through Helmand, Kandahar, Nangarhar, and Herat provinces with Iran and Pakistan.
TERR
OR F
INAN
CE 2
020
▪ Groups: o Syria: ISIS, al Qaeda of Syria (AQS), AQ-aligned Hurras al Din (HaD)1, al-Hay’at Tahrir al-Sham (HTS)2,
Russia, Turkey, IRGC-QF, Shiite Militia Groups (SMG)o Iraq: ISIS, Shiite Militia Groups (SMG); esp. Kata’ib Hezbollah, Iran’s IRGC-QF.
▪ Funding: Charitable donations & external funding, oil, artifacts, smuggling, zakat taxation, checkpoint taxation, kidnapping for random (KFR)3,4.
▪ Money Laundering Systems: Turkey and Lebanon as financial hubs, followed by bulk cash smuggling; currency auctions & wires through Iraqi banks, Hawala, Sarafi Exchange Money Service Businesses (MSB).
▪ Financial Facilitation Hubs: Turkey and Lebanon; cities in Syria/Iraq change depending on fighting locations.
GLOBAL TERROR 2020Conflict Zones – Iraq/Syria
TERR
OR F
INAN
CE 2
020
▪ Groups: o Palestine: HAMAS, Palestinian Islamic Jihad (PIJ)o Lebanon: Hezbollah
▪ Funding: Internal as powerful political parties in Palestine and Lebanon; foreign funding from Iran & Muslim Brotherhood.
▪ Money Laundering Systems: Turkey and Lebanon as financial hubs, followed by bulk cash smuggling; currency auctions & wires through Iraqi banks, Hawala, Sarafi Exchange Money Service Businesses (MSB).
▪ Financial Facilitation Hubs: Beirut (Lebanon), Turkey, Cyprus. Cash smuggling into Syria through Lebanon and Iraq through Turkey.
GLOBAL TERROR 2020Conflict Zones – Israel/Palestinian Territories
TERR
OR F
INAN
CE 2
020
GLOBAL TERROR 2020Conflict Zones – Gulf of Aden
▪ Groups: o Somalia: al-Shabaab (AQ-aligned), ISIS-EAo Yemen: Houthi (Iran-proxy), al Qaeda in the Arabian Peninsula (AQAP), ISIS-Y, IRGC-QF,
Saudi Arabian military, UAE military.▪ Funding:
o Somalia: Internal through various revenue streams, including zakat taxation (held territory), smuggling, kidnapping for ransom (KFR).
o Yemen: External from ISIS Core, UAE/Saudi Arabia, and Iran. ▪ Money Laundering Systems: Mobile Money platforms associated with telecommunication
giants, back-ended by remittance services like Western Union and MoneyGram.▪ Financial Facilitation Hubs: Kenya, Libya, Turkey, UAE, Nigeria. Bulk cash smuggling.
TERR
OR F
INAN
CE 2
020
GLOBAL TERROR 2020Conflict Zones – West Africa▪ Groups:
o Libya: UN-backed Government of National Accord (GNA) - backed by Turkey and Qataro Libyan National Army (LNA) - backed by Russia, UAE and Egypt. o West Africa: ISIS-Greater Sahara, AQIM, Jama'at Nasr al-Islam wal Muslimin (JNIM), Hezbollah
▪ Funding/Money Laundering Systems:o Libya/West Africa: External states, zakat, smuggling, Kidnapping for Ransom (KFR). Cash smuggling;
mobile money, remittance programs, banks in Kenya, Egypt, Morocco, Nigeria.▪ Financial Facilitation Hubs:
o Nigeriao Shiite population centers in West Africa remitting/
wiring funds to Lebanon to support Hezbollah
TERR
OR F
INAN
CE 2
020
GLOBAL TERROR 2020Conflict Zones – South America
▪ Groups: o Colombia: Remnants of FARC and National Liberation Army (ELN)
narco-terrorists, Sinaloa Federation (Mexico), CJNG (Mexico)o Venezuela: Maduro regime, Drug Cartels, Hezbollah, IRGC-QF, Russia.
▪ Funding/Money Laundering Systems:o Venezuela: Narcotics; Trade-based Money Laundering (TBML),
crypto currency. ▪ Financial Facilitation Hubs:
o Venezuela, Cuidad del Este (Paraguay), Panama, Caribbean Islands, Puerto Iguazu (Argentina), Foz do Iguaçu (Brazil)
THREAT CLASSIFICATIONTERROR FINANCE
Sunni VEO Shiite VEO OtherSu
b-C
lass
ific
atio
ns
Hezbollah (Transnational)
Financial Facilitators(Interorganizational)
Homegrown(Lone Wolf)
Attack Cell (External Operations)
IRGC(Transnational)
Al Qaeda (Transnational)
Taliban (Afghanistan/Pakistan)
ISIS(Transnational)
TERR
OR F
INAN
CE 2
020
VEO - Violent Extremist Organizations
Houthi (Yemen)
Hamas (Transregional)
Al Shabaab(Regional)
Muslim Brotherhood(Transnational)
Political/Racial
Narco-terrorists“Santa Muerte”
Eco-Terrorist
- Today’s Case Studies
SECTION 3
TERR
OR F
INAN
CE 2
020
Mechanisms
MECHANISMS - BEYOND MONEY LAUNDERINGTe
rror
ism
Fin
ance
Salaries, Precursor Chemicals
Protection, Smugglers
Bribing officials
Fighter salaries/Martyrdom Payments*
Small arms procurement
Ballistic & Nuclear Weapons Programs
Currency Cleansing - Sanctions Evasion
Narcotics
Weapons proliferation
Corruption (Misappropriation)
Illicit Mineral/Gemstone Mining
Human Trafficking
Cyber Fraud
State Funds
Use of Funds
Revenue Generation
IntegrationPlacement Layering
MECHANISMS - MONEY LAUNDERING Te
rror
irsm
Fina
nce
▪ Bulk Cash Smuggling
▪ Hawala
▪ ATM
▪ Bitcoin ATM
▪ Prepaid Cards
▪ Cash Deposits
▪ Charitable contributions
▪ Sarafi Exchanges*
▪ Remittances
▪ Mobile Money
▪ Wire Transfers
▪ Free Trade Zones (FTZ)
▪ TBML – False Invoicing
▪ Crypto Exchanges
▪ Front companies
▪ Shell/Shelf Companies
▪ Cash “bust-out”
▪ Bulk cash smuggling
▪ Purchase of Assets
▪ Stored Value
IntegrationPlacement Layering
MECHANISMS – HAWALA SYSTEMTe
rror
ism
Fin
ance
▪ Hawala: An ancient informal value transfer system (IVTS) of debts transcribed on ledgers. Debts settled by bulk cash smuggling, Sarafi Exchange Money Service Businesses (MSB), movement of stored value or goods, or traditional banking.
▪ Hawalader: Honorific for cash-intensive hawala dealer-broker.
Communicates Transaction Order(now owes Debt)
Originator Beneficiary
Hawalader BHawalader A
Debt transcribed on ledger, subject to settlement
MECHANISMS – HAWALA SYSTEMSarafi Debt Settlement
Terr
oris
m F
inan
ce
▪ Sarafi Exchange: Money Service Business (MSB) and currency exchanger, often in under-banked Islamic countries. Settle debts on behalf of hawaladers. Sarafis use remittance programs like Western Union or MoneyGram, and conduct wire transfers through bank accounts.
▪ Sarafs: Honorific for Sarafi Exchange remitter.
Transaction Order (Debt)
Real Transactions (Debt Settlement)
Hawalader A Hawalader B
Saraf A Saraf B
Correspondent Banks
MECHANISMS – HAWALA SYSTEM Currency Auctions
Terr
oris
m F
inan
ce
▪ Hawala Auction: Typically a government-run auction of various currencies. Hawaladers use hawala currency auctions to conduct exchanges between various currencies.
▪ Where do they take place? – Iraq, Afghanistan, Iran, Pakistan, UAE, and other countries with significant use of the hawala system.
▪ Why does it matter? – Hawala auctions serve as a primary mechanism of organized currency cleansing to avoid sanctions, most often by Iran, who is actively exchanging out of the Iranian Rial (IRR) currency for Afghan Afghani, Turkish Lira, UAE Dirham, Pakistani Rupee, Euro, and most significantly, the U.S. Dollar.
Currency Cleansing
MECHANISMS – HAWALA SYSTEM TBML Debt Settlement
Terr
oris
m F
inan
ce
Hawala Trade-based Money Laundering (TBML): Stored value exchange to settle debts between hawaladars on hawala ledgers
▪ Precious Metals, such as Gold and Silver▪ Gemstones, such as diamonds, rubies, and emeralds▪ Minerals, such as Talc, Chromite, and Marble
H-A owes $$$ to H-BSettles debt with Gemstones
Hawalader A (H-A) Hawalader B (H-B)
MECHANISMS – HAWALA SYSTEM Crypto Debt Settlement
Terr
oris
m F
inan
ce
Crypto Currency Debt Settlement: Hawaladers utilize Sarafs with bank accounts, who wire funds to crypto currency exchanges of the counterparty.
▪ Sarafs in multiple locations could share the same crypto currency wallet address for purposes of depositing in one location and withdrawing in another location without a transaction on the blockchain ledger
Transaction Order (Debt)
Real Transactions (Debt Settlement)
Hawalader A Hawalader B
Saraf A Saraf B
MECHANISMS – ZAKATTe
rror
ism
Fin
ance
▪ Zakat: One of the five pillars of Islam, Zakat is a mandatory religious tax, misused by terrorist groups for extortion from civilian populations.
o Sunni Terrorism Zakat: I.e. Taliban or ISIS, implement Zakat as an extortion tax within their territorial control.
o Shiite Terrorism Zakat: i.e. IRGC or Hezbollah, centralized under the leadership of the Iranian Ayatollah, receive Zakat from Shiite population centers, even outside of their territorial control (e.g. South America or Africa)
▪ Types of Zakat:o General taxation, protection extortion, checkpoints, utilities o Charitable Contributions*
▪ Types of Payments:o Cash payments, remittances, wire transferso Portion of farming/agricultural produceo Safe-haven and material support
MECHANISMS – ZAKATCharities & NGOs
Terr
oris
m F
inan
ce
▪ Charities:
o Type 1 – Witting terrorist financing
o Type 2 – Unwitting misappropriation of charitable contributions
• Payments companies, Money Service Businesses (MSB), Crypto Currency
▪ NGOs:
o NGOs focused on refugees, children, or other emotional connections in specific conflict zones where terror groups are most prominent
o Islamic/academia NGOs
Scheme: Misappropriation (NGO or Business) to Bust-Out
Phases 1 2 3
Currency BTC or Fiat BTC Fiat
ActionsFiat and/or BTC received into entity, forwarded to crypto exchange.
BTC layered through Tumbler to second exchange.
Fiat ACH transfer from crypto exchange to bank, followed by cash-intensive “bust-out.”
1 2
KEY
▪ NGOs operating in active combat zones in Middle East or North Africa▪ Businesses with no apparent crypto need or business purpose
Charities & NGOs – Misappropriation Scheme
3
SECTION 4
TERR
OR F
INAN
CE 2
020
Threat Organizations
IRGC-Quds Force
Typologies: Threat Group Analysis
Islamic Revolutionary Guard Corps – Quds Force (IRGC-QF)
Leader Esmail Qaani (replaced Qasem Soleimani)
Sub-ClassificationShiite terror group, military, and intelligence service of Iran with oversight of Shiite terror groups around the world.
AffiliationsHezbollah, Hamas, Taliban, Houthi, al Qaeda, Palestinian Islamic Jihad, Los Zetas, Russia, Venezuela, Syria, Turkey, Chinese criminal organizations
LocationsIran, Afghanistan, Iraq, Syria, Lebanon, Yemen, Azerbaijan, Bahrain, Qatar, Turkey, Venezuela, United Arab Emirates, Palestinian Authority, China
Money Laundering
▪ Revenue Generation: State government funds/Oil; Khatam al-Anbiya, (IRGC’s construction arm)▪ Mechanisms/Typologies: Hawala auction currency cleansing, weapons procurement.▪ Financial Hubs: Turkey, UAE, Iraq, Afghanistan, Lebanon, China.
ORGANIZATIONAL PROFILES
Scheme: Iranian Sanctions Evasion – Hawala Auctions and Turkish $50,000 USD Structuring
Phases 1 2 3 4
Currency Iranian Rial to other Fiat Fiat Fiat & BTC USD fiat
ActionsIranian proxies exchange Iranian Rial for other fiat currencies at Iraqi or Afghan hawala currency auctions
Fiat SWIFT to Turkish banks
Turkish Engineers structure wires under $50,000 USD to crypto exchanges
USD sent to bank. Bust out cash smuggled to Iran
1 2 4
Iran
Iraq
Afghanistan
?
3
Iran
KE
Y
▪ Turkish CTR threshold is above $50,000 USD▪ Look for groups of engineers from same companies▪ Transactions between Turkish banks and crypto exchanges gradually build over time to >$50,000
Case Study – Iranian IRGC
Terr
oris
m F
inan
ceHezbollah
Typologies: Threat Group Analysis
Lebanese Hezbollah (LH)Leader Hassan Nasrallah
Sub-Classification Shiite terrorist, Iranian proxy; Lebanese political party & military; Transnational Criminal Organization.
Affiliations IRGC, Shiite groups in Iraq/Syria, Houthi (Yemen), HAMAS (Palestine), South American drug cartels
Locations Middle East, West Africa, South America, United States, Mexico, Canada
Money Laundering ▪ Revenue Generation: Iranian funding, cocaine, counterfeit goods, tobacco, gold/precious metals▪ Mechanisms/Typologies: TBML cocaine, retail goods, gold, & counterfeit goods, remittances/wires
from Shiite population centers in South America and West Africa to Lebanon▪ Financial Hubs: Tri-border Area (TBA) countries of Paraguay (Ciudad del Este), Argentina (Puerto
Iguazo), and Brazil (Foz do Iguaçu). Lebanon (Beirut), Venezuela, Colombia, Panama, Mexico
ORGANIZATIONAL PROFILES
Hezbollah Finance
https://www.washingtoninstitute.org/hezbollahinteractivemap/
Who:▪ Businesses: Electronics, import/ export, construction, auto
dealer, gas stations/convenience stores
▪ Individuals: Military-aged males, Shiite Islamic naming conventions
What: Trade-based money laundering (TBML) - cocaine and counterfeit goodsWhere: Tri-border Area (TBA) banks to Hezbollah headquarters in Lebanon.
When: Year-round.Why: Sending proceeds to Lebanon headquarters and paying off counterfeit goods suppliers in mainland China via Hong Kong
Product Classification Typology Organization EchelonInternational – SWIFT Narcoterrorism Tri-Border Area (TBA) Cocaine Hezbollah Operational
Originator O-Bank B-Bank Beneficiary Wires Time RangePARAGUAY BRAZIL HONG KONG HONG KONG 7 30 days $20,000-50,000
VENEZUELA PARAGUAY IRAQ LEBANON 6 30 days $20,000-50,000ARGENTINA ARGENTINA LEBANON LEBANON 12 30 days $20,000-50,000
Case Study – Hezbollah
Taliban Finance
Typologies: Threat Group Analysis
TalibanLeader Hibatullah Akhundzada
Sub-Classification Sunni Terrorist Group, Drug Trafficking Organization
Affiliations Al Qaeda (AQIS), Haqqani Network, Tehrik-i-Taliban, IRGC-QF (1, 2, 3, 4), Pakistani ISI (5, 6, 7, 8)
Locations Afghanistan, Pakistan, Iran (1, 2, 3, 4), Dubai (UAE) (9, 10), Qatar
Money Laundering ▪ Revenue Generation: Heroin production, distribution, taxation; other narcotics; Zakat” taxation, control of electrical dam, gemstone trafficking, mineral trafficking (talc, chromite, marble).
▪ Mechanisms/Typologies: Bulk cash smuggling; Hawala/Sarafi system, payments to fighters, martyrdom payments to families, real estate purchases in Dubai and Pakistan.
▪ Financial Hubs: Pakistan, Dubai (UAE), Qatar, Iran, Turkey.
ORGANIZATIONAL PROFILES
Terr
oris
m F
inan
ce
Scheme: Sarafi Exchange – Hawala Debt Settlement
Phases 1 2 3
ActionsT-A gives cash to H-A intended for T-B. H-A now owes debt to H-B.
S-A wires funds to S-B to settle H-A’s debt to H-B. The transaction is cleared by Correspondent Bank.
T-B picks up cash from H-B
AFGHANISTAN PAKISTAN DUBAI, UAE
Terrorist-A(T-A)
Hawaladar-A (H-A)
Hawaladar-B (H-B)
Terrorist-B(T-B)
Saraf-A (S-A)
Saraf-B (S-B)
DUBAI, UAE1 2 3
Debt Debt
KE
Y
▪ Mainly Sunni groups like Taliban or ISIS▪ Scheme applied to significant revenue generation event (i.e. drug trafficking)▪ Shiite groups like Hezbollah prefer TBML
Bank-A (B-A)
Correspondent
Case Study – Taliban
ISIS Finance
Typologies: Threat Group Analysis
ISISLeader Mohammad Abdul Rahman al-Mawli al-Salbi (replaced Abu Bakr al-Baghdadi)
Sub-Classification Sunni terrorist group born from al-Qaeda of Iraq (AQI).
Affiliations Internal between ISIS Headquarters (Syria/Iraq) and ISIS provinces (wilayats)
Locations Syria/Iraq, Afghanistan, Northwest/East/Central Africa, East Asia, Gulf Nations
Money Laundering ▪ Revenue Generation: Former Caliphate (banks, oil, antiquities), Zakat taxation, Charities (misappropriation), Mineral Mining & Gemstones (Afghanistan), criminal activities.
▪ Mechanisms/Typologies: Caliphate Retreat - funding remote provinces from HQ through Turkey hub via Hawala/Sarafi. Funding external attacks. Crypto currency, exploitation of refugee camps.
▪ Financial Hubs: Turkey, Syria, Iraq, Indonesia, Nigeria, Germany, Saudi Arabia, Egypt, Malaysia
ORGANIZATIONAL PROFILES
Product Classification Typology Organization Echelon
International - SWIFT Terrorism External Operations ISIS Strategic
Case Study - ISIS
SECTION 5
TERR
OR F
INAN
CE 2
020
Investigatory Techniques - ISIS
Terr
oris
m F
inan
ce Working at the practitioner level
▪ The Case of Ali Roble o Detection
o Case Investigation
o SAR submittal
ISIS CASE STUDY - ROBLE
COMPARING RISK VS THREATTe
rror
ism
Fin
ance
GLOBAL THREAT
LANDSCAPE (GTL)INHERENT RISK
ENVIRONMENT (IRE)
VS
Weapons Humans Drugs TerrorProducts Geography Customers Counterparties
▪ Threat-focused, static, threat
“Actor-centric” view of the world
▪ Defines and contrasts Threat
Classifications, Organizations, and
Typologies against Mechanisms,
Products, and Geography.
▪ Institutionally-specific risks to
exploitation by threat networks
▪ Explores products/services,
geographic nexus of
product/service offerings,
customers and their counterparties
Terr
oris
m F
inan
ceISIS CASE STUDY - ROBLE
Alert Investigation
Case Investigation
SAR
IRE “Core-4” Case Escalation
Terr
oris
m F
inan
ce ▪ Provide material support for ISIS
▪ Specifically personnel and resources
▪ 11 conspirators charged in Minnesota
▪ Federal authorities are charging 20-year-old Mohamed AminAli Roble, a Minneapolis man, with joining the Islamic Stateafter they say he used settlement money from a bridgecollapsing suit to travel to Syria.
ISIS CASE STUDY - ROBLE
ISIS CASE STUDY - ROBLETe
rror
ism
Fin
ance
AML RISK – FINANCIAL INSTITUTIONS“Core-4” RiskTe
rror
ism
Fin
ance GEOGRAPHIC NEXUS
Recognizing the multidimensional nature of
jurisdictional risk in fund flows
▪ Corruption
▪ Sanctions Evasion
▪ Organized Criminal Trafficking
▪ Terror Finance
AML RISK – FINANCIAL INSTITUTIONS“Core-4” RiskTe
rror
ism
Fin
ance PRODUCT/SERVICES NEXUS
Recognizing the spending and items purchased
▪ Organized Criminal Trafficking
▪ Terror Finance
▪ Corruption
▪ Terrorist logistics support
AML RISK – FINANCIAL INSTITUTIONS“Core-4” RiskTe
rror
ism
Fin
ance
Group Segmentation
Recognizing the spending and items purchased
▪ Social affiliation
▪ Expected culture and ways
▪ Expected alliances
AML RISK – FINANCIAL INSTITUTIONSTe
rror
ism
Fin
ance
AML RISK – FINANCIAL INSTITUTIONSTe
rror
ism
Fin
ance COUNTRY TF RISK DETAILS
TURKEY VERY HIGH
ISIS, Hurras al-Din (HAD), Hay'at Tahrir al-Sham(HTS), Kata'ib Hezbollah, al Qaeda, Kurdish Groups (YPG/PKK), Syria, Iran & Venezuela funding ties. Money Laundering financial facilitation hub for terrorist organizations.
$81,000Total amount 7 months
Terr
oris
m F
inan
ce
HIGH RISK
MCC /POS data/ATM
ISIS CASE STUDY - ROBLE
Terr
oris
m F
inan
ce
CORE-4
VERY HIGH RISK
GAZIANTEP
ALEPPO
$81,000Total amount 7 months
MCC/POS data/ATM
ISIS CASE STUDY - ROBLE
Terr
oris
m F
inan
ceISIS CASE STUDY - ROBLE
12 Transactions$47 k
Terr
oris
m F
inan
ce
CORE-4
VERY HIGH RISK
MCC/POS data/ATM
Terr
oris
m F
inan
ceHTF METHODOLOGY
TERROR FINANCE QUESTIONSTe
rror
ism
Fin
ance
1. What is the source of funding or wealth?
2. Where and how illicit funds or value are placed?
3. Where and how do they store funds or value?
4. How do they move or transfer funds or value?
5. What goods and services are purchased and how are they payed?
6. Is there any financial activity that suggests imminent threat or terrorism financing?
7. Is there activity that suggests the existence of a terrorist network? (target central transactional analysis)
Terr
oris
m F
inan
ce
▪ Should we escalate the alert to CASE?
▪ What do we do?
ISIS CASE STUDY - ROBLE
Mohamed Amin Ali Roble
Terr
oris
m F
inan
ce ▪ Integrated Controls — Operations
o Risk Assessment/Threat Assessment
o Typology Identification (specific detection scenarios)
o Transaction Monitoring that includes the “who and the how”
SUMMARYImplementing HTF Methodology
KEYNOTE SPEAKERIN
TROD
UCTI
ON T
O HY
BRID
TH
REAT
FIN
ANCE
Colonel Josh Potter, USA (Ret.)Former Director, Transnational Threats Division,
USSOCOM, U.S. Army Special Forces
Terror Finance 2020October 21, 2020
DARK FINANCIAL INTELLIGENCETASK: MAKE US MORE SECURE & PROFITABLE
WHAT MAKES ORGANIZATIONS SUCCESSFUL?
▪ Capitalize on Strengths
▪ Mitigate or Reduce Weaknesses
▪ Security, Security, Security
FINANCIAL SERVICES FOR THE SYNDICATE
GENERATE
▪ Extortion of local area, closed diaspora or controlled territory
▪ Private donations
▪ Misuse of Non-profits and charities
▪ Proceeds from illicit activities
▪ Kidnap for ransom
▪ Legitimate commercial enterprise
▪ State sponsorship
STORE
▪ Physical cash; fiat currency
▪ Formal cash deposits
▪ Virtual currency
▪ Investment vehicles
▪ Non-traditional financial vehicles
MOVE
▪ Formal financial mechanisms
▪ Informal financial mechanisms
▪ Physical cash transportation
▪ Virtual currency transactions
▪ Illicit value transfer
USE
▪ Operations
▪ Propaganda, information and recruitment
▪ Salaries and member compensation
▪ Training
▪ Social services
OBFUSCATE, CONFUSE AND PROTECT▪ The source of illicit money
▪ The identities of the syndicate
▪ The true locations of activity and assetsOBFUSCATE
▪ The investigators
▪ Our competition
▪ Mix legitimate and illicit; witting and unwittingCONFUSE
▪ The syndicate organization
▪ Communications
▪ Asset transfersPROTECT
GENERATE: COMMON SOURCES OF ILLICIT INCOME
▪ Drugs
▪ Human trafficking
▪ Insurance fraud
▪ Theft of high value items
▪ Cybercrime
▪ Art forgery
▪ Ponzi schemes
▪ Weapons trafficking
▪ Intellectual property theft
▪ Extortion
▪ Counterfeit currency
▪ Document forgery (identification,
bills of lading, inventory, etc)
▪ Counterfeit DVDs
▪ Piracy
▪ Precious metals
▪ Trade violations and black market
▪ Kidnap for ransom
USE: COMMON USES OF PROCEEDS
Payroll
Facilities (safe houses, cache, storage units,
supply network, auto garage)
Material, equipment, tools
Vehicles (including vehicle modifications or
chop-shop)
Commercial travel
Communications (couriers, cell phones,
devices, people)
IED making material (circuit boards,
blasting cap, UAS, etc)
Weapons (arms and ammunition)
Training
Recruitment
Bribes to officials and to influence
Payments to martyrs’ families
Social programs
STORE & MOVE: COMMON MISTAKES OF ILLICIT TRANSFERS
Bulk Cash Smuggling:
▪ Courier appears nervous
▪ Courier loose fitting clothes
▪ Courier walks with an odd gait
▪ Courier unusual concern about carry-on
▪ Unusual routing in shipping container
▪ Evidence of tampering or altering construction of vehicle compartment
Charities and NGO Thurways:
▪ Small, obscure charity with minimal staff (or check signing authority)
▪ Money given to families of suicide bombers (martyr payments)
▪ Lack documentation to show charity is fundraising with general public
▪ Closed list of donors
▪ No fundraising events
▪ Charitable objectives do not match expenditures
▪ Overlapping corporate officers and bank signatories
▪ Complex structure or Organization chart
STORE & MOVE: COMMON MISTAKES OF ILLICIT TRANSFERS
Front & Shell Companies
▪ Deposits greatly exceed receipts generated
▪ Business has few customers and/or appears not to be profitable
▪ # of employees exceeds what business warrants (ghosts)
▪ Stock on shelves untouched or old
▪ Lack of progressive accounting measures
▪ Avoids marketing or commercial coverage
▪ Little indication of business expenses
▪ Multiple business sharing address
▪ Multiple businesses incorp on same day
▪ Board members from same family / friends
▪ Address is a mail service company
Trade Based Money Laundering (TBML)
▪ Items shipped (manifest) are inconsistent with customer business
▪ Customers conduct business in or transit through high-risk areas
▪ Customers involved with potentially high-risk activities (subject to import/export restrictions)
▪ Over- or Under-pricing of goods and services
▪ Transaction structure appears unnecessarily complex
▪ Customer requests payment of proceeds to unrelated party
▪ Shipment locations or description of goods not consistent with letter of credit
STORE & MOVE: COMMON MISTAKES OF ILLICIT TRANSFERS
Wire Remittance
▪ Multiple TX on same or consecutive days below reporting threshold
▪ Repeat TX sent to border locations
▪ ID information missing, illegible or inconsistent (phone number, etc)
▪ TX sent to “grey zone” areas
Traditional Banks
▪ Financial activity inconsistent with purpose of business or stated occupation
▪ Use of multiple accounts at single bank without explanation
▪ Importation of high dollar currency not commensurate with occupation
▪ Multiple safe deposit boxes
▪ Uneconomic or unjustified fund transfers
▪ Concealing assets (found through other searches)
▪ Payments to fictitious companies
▪ Using false billing or invoices
▪ Frequency of check cashing
▪ Use of stolen or false identification
PRIMARY SOURCE OF MONEY: DRUG TRADE (OLD SCHOOL)
Grower Refinement Distributor
Dealer
Product exchanged for cash with Customer
Local organization affiliate
PRIMARY SOURCE OF MONEY: FRAUD (REAL ESTATE)
Fraudster Agent Purchase property
Renovations & Upgrades
Client-owned businesses do not perform work charged or over
billing
Sell property
DESIGN MECHANISM TO OBFUSCATE, CONFUSE & PROTECTUse various means, controlled by the syndicate. If
you need it, we can acquire it. Listed to the right are
some previous examples. Incorporate multiple layers:
▪ TBML
▪ Cryptocurrency
▪ Legitimate businesses
▪ Real estate
▪ Shell companies
* Take into consideration insurance and mitigation
measures
Pool & landscaping
services
Hotels
Transportation &
shipping Cryptocurrency
exchange
Casinos
Engineering and
architectural design
Meat packaging &
delivery
Construction
Waste
management
Florist delivery
Communication
application design
Dry cleaning
Air fright cargoUsed cars Art dealership
appraisal
Mining operation
Professional
consultant services
DARK FINANCIAL INTELLIGENCE
▪ What is your solution?
QUESTIONS?PLEASE USE YOUR CHAT BOX TO SUBMIT YOUR QUESTIONS FOR COL. POTTER
PRACTICAL EXAM IN
TROD
UCTI
ON T
O HY
BRID
TH
REAT
FIN
ANCE
▪ Quiz will be available after the session. There will be a link in your follow-up email. It will also be available at https://s2fis.com/session2
▪ Recording available after the session▪ https://s2fis.com/quizzes/terrorism-finance-2020/▪ Passing score is 80%▪ Certificate will be immediately available for printing/download upon passing the
quiz. Certificate for each portion. If you pass all 6, you will receive a series certificate (12 CPE)
▪ 2 CPE credits from ACFCS or University of New Haven
INTR
ODUC
TION
TO
HYBR
ID
THRE
AT F
INAN
CE
KEYNOTE SPEAKER
UPCOMING SESSIONSIllicit Finance in Drug TraffickingOctober 28, 2020, 1-3PM EST
Javier Peña & Steve MurphyDEA Special Agents (Ret.),
Inspiration for Netflix series “Narcos,”Authors of “Man Hunters”
▪ What are the differences in money laundering
schemes/typologies by drug product (i.e. cocaine,
heroin, methamphetamine)
▪ How have drug cartels evolved their money
laundering practices since Pablo Escobar and the
Medellin Cartel?
▪ How can I target narco-laundering from street level
to international level?
▪ Who are the major drug trafficking orgs to watch
for internationally and in the U.S. in 2020? What
should I look for?
INTR
ODUC
TION
TO
HYBR
ID
THRE
AT F
INAN
CE
KEYNOTE SPEAKER
UPCOMING SESSIONSCounterfeiting & Wildlife TraffickingNovember 04, 2020, 1-3PM EST
David LunaDirector for National Security &
Diplomacy, U.S. Dept. of State (Ret)
▪ At what points to counterfeiting and money
laundering intersect? What does it look like?
▪ What are the primary animals, bank products,
fund flows, and places I should be looking at?
▪ What threat organizations are earning
revenue from Counterfeiting & Wildlife
Trafficking?
▪ How do these subjects tie into Trade-based
Money Laundering (TBML)?
INTR
ODUC
TION
TO
HYBR
ID
THRE
AT F
INAN
CE
KEYNOTE SPEAKER
UPCOMING SESSIONSTrade-based Money Laundering (TBML)November 11, 2020, 1-3PM EST
Jimmy ArroyoAssistant Special Agent in Charge, DEA NY Division
▪ How can I identify shell companies using only
open source websites and mapping tools?
▪ How do I analyze letters of credit, bills of
laden, and other relevant documents to
determine over or under invoicing?
▪ How do threat organizations use maritime
and air cargo containership for TBML?
▪ Who are the organizations that use TBML,
what are their geographic fund flows, entity
types by group, and what financial products to
they use?
INTR
ODUC
TION
TO
HYBR
ID
THRE
AT F
INAN
CE
KEYNOTE SPEAKER
UPCOMING SESSIONSCorruption & Sanctions Evasion – VenezuelaNovember 18, 2020, 1-3PM EST
Dr. Vanessa NeumannVenezuelan-American Diplomat;
Founder, Asymmetrica; Author, “Blood Profits”
▪ Why is Venezuela one of the world’s most
strategically important countries for money
laundering? How does it tie into National Security?
▪ How does the Nicholas Maduro regime
misappropriate proceeds, generate illicit revenue
streams, launder proceeds, and evade sanctions
and how do I identify these patterns?
▪ What hostile state and non-state threat
organizations have a transactional relationship with
the Maduro regime?
Thank you for your participation!
• Please fill out the feedback form following the session.
• Thank you once again to our partners who made this possible.
#NatSecGirlSquad
DEA NARCOS.com
https://s2fis.com/tfa-webinarhttps://s2fis.com
1-833-723-4700 Toll Free
Thank you for your participation ! See you next week! Don’t miss the NARCOS Agents—Steve Murphy and Javier Pena
Thank you to our partners!