CHARITIES AND TERRORISM FINANCING COMPLIANCE APPROACHES AND CHALLENGES IN 2014 By Paul Cochrane Statement of intent This paper examines charities and Countering the Financing of Terrorism (CFT) regimes, looking into the perceived threats of non-profit organizations (NPOs) being used as front companies and conduits for terrorist or threat financing. The paper provides a global overview of regulations and enforcement related to NPOs and CFT, the current challenges and the approaches being taken to reduce sectoral risk. The views and opinions expressed in this paper are those of the author and do not necessarily reflect the official policy or position of Thomson Reuters.
ABOUT THE AUTHOR Paul Cochrane is a freelance journalist based in Beirut, where he has lived since 2002. He covers the Middle East and Central Asia for specialized publications, business magazines and newspapers. Mr Cochrane s work has been featured in over 70 publications, including Money Laundering Bulletin, Accountancy Futures, Fraud Intelligence, and Commercial Crime International. Educated in Britain, Mr Cochrane earned a Master s degree in Middle Eastern Studies at the American University of Beirut. 2 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
EXECUTIVE SUMMARY Regulatory oversight is key to protecting the charitable sector and the financial institutions that deal with them from abuse by terrorist organizations. While compliance with anti-money laundering (AML) and countering the financing of terrorism (CFT) rules has increased globally, particularly by financial institutions wary of falling foul of regulators, the non-profit sector has been given less attention and compliance at the global level is weak. Only now, over a decade after CTF and AML regimes were established, are the regulations being re-assessed and are nonprofit organizations (NPOs) being brought into reviews of typologies. The sector is also under greater scrutiny due to a rise in terrorism in the Middle East, especially due to the conflict in Syria. At such a juncture, lessons can be learned from more regulated jurisdictions, such as the UK, which have been struggling to get the balance right between over-regulating the NPO sector, addressing the risks, and ensuring that donations reach their intended target. This paper also discusses ways to improve compliance and enforcement, such as implementing FATF s risk-based approach that brings together NPOs, regulators and the financial sector at the local, regional and global level. 3 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
INTRODUCTION There are an estimated 10 million nongovernment organizations (NGOs) worldwide. 2 In the US alone there are an estimated 1 million charities, while in India there are some 3.3 million NPOs. 3 It is a burgeoning sector, with NPOs annual expenditures estimated at $2.2 trillion a year and employing some 56 million people worldwide. 4 Despite such funds, the number of people involved, and a footprint that includes the riskiest jurisdictions on the planet, oversight of the sector has been in general haphazard, varying greatly across the globe. In the years following the September 11, 2001 (9/11) terrorist attacks on the United States, counter terrorist financing (CTF) was propelled into the spotlight, and became a prominent tool of what has been termed financial warfare in the US-led War on Terror. 5 There were several high profile cases of Islamic charities that were used and abused as avenues for funding by terrorist organizations, such as Al Haramain Foundation, the Muwafaq Foundation, the Revival of the Islamic Heritage Society, and the Holy Land Foundation for Relief and Development (HLF). There were designations, prosecutions and testimonies that exposed how the sector was vulnerable. But over the last decade, charities and CFT were not given the same attention by regulators, not being considered an apparent priority of anti-money laundering (AML) and CFT regimes. Only now are the regulations being re-assessed and the NPO sector being brought into reviews of typologies. Further driving the need for improved compliance of the NPO sector is the number of highly publicized fines on financial institutions for flouting or having deficient AML and compliance regimes, particularly by the US authorities. However, largely behind the scenes there has been heated debate in the more advanced jurisdictions about how best to oversee the sector, whether through a rules or risk-based approach. NPOs have complained that governments have lacked insight into the sector to effectively implement a risk based approach, which has led to excessive regulations that eats into NPOs funds and time, while in certain cases has impacted on NPOs ability to operate, such as being prevented from opening bank accounts and transferring donations to sanctioned and risky jurisdictions like Sudan and Somalia. Getting the approach right is still very much a work in progress, in the more developed jurisdictions as well as everywhere else on the spectrum of compliance. A stumbling block has been compliance with the OECD s Financial Action Task Force (FATF) 40 Recommendations plus 9 Special Recommendations, which were implemented in 2001 to counter terrorist financing. Special Recommendation 8 specifically concerns the NPO sector, but it has been criticized for being too open to misinterpretation by regulators and NPOs, which is reflected in low implementation globally. In part to alleviate such misinterpretation, the recommendation was 2 According to the Public Interest Registry and Global Journal. 3 NPOs, charities and NGOs are often used interchangeably. This paper will primarily refer to charities as NPOs. 4 See https://www.un.org/en/sc/ctc/briefings/2013/npo/docs/working-document-4-5feb.pdf 5 See Juan C. Zarate, Treasury s War: The Unleashing of a New Era of Financial Warfare (New York: PublicAffairs, 2013) 4 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
amended in 2013, and a FATF body is currently performing assessments to address the scale of the risks NPOs face. The problem has been implementation on the ground by various governments. It has been 13 years (since the FATF Recommendations) so not a short period of time, but a lot of jurisdictions have not gotten regulatory capacity and tools up-to-speed, said Ian Lye, Head of Terrorism and Insurgency Research at Thomson Reuters. Charities potential for being abused by terrorist organizations has come to the fore again because of the uprisings in the Middle East the Arab Spring while strategic changes in Central Asia, particularly in Afghanistan, also poses risks. Renewed concerns have focused in particular on NPO funds and services ending up in the hands of Islamic extremists. The biggest threat today is the conflict in Syria, said Dr. Matthew Levitt, Director of the Stein Program on Counterterrorism and Intelligence at the Washington Institute for Near East Policy. It is not only about the ability to move funds but goods and personnel, as there are all kinds of things that make the charitable sector vulnerable to abuse. This needs a significant amount of attention, and the best way to do this is through regulations and oversight, which has to be done in such a way as doesn t create fear (within the NPO sector). THE RISKS While few cases are reported across the world, especially of charities being used as fronts by terrorist organizations to raise funds, risks still abound. In the late 1990s, a CIA report found that 40 percent of Islamic charities had been infiltrated. Today it is much less because of rules and regulations, but still there, said Rohan Gunaratna, Director of the International Center for Political Violence and Terrorism Research in Singapore. Gunaratna considers charities as the fourth line of financing for terrorist groups after individual contributions, legitimate businesses, and criminal activities, be it narcotics, arms or human trafficking. It is a very effective method of financing as charities don t have to pay tax, can earn a lot of money, and many governments provide grants to ethnic religious and social welfare organizations which terrorist groups can use as a front and to create sympathetic groups with charitable status, he said. Last year, a charity based in Canada had its tax-exempt status revoked for providing nearly $300,000 to an Islamic terrorist organization in Kashmir. In Germany in April, 2014, the charity Waisenkinderprojekt Libanon (Orphaned Children Project Lebanon) was banned for violating the German constitution by allegedly sending Euro 3.3 million between 2007 and 2013 to a charity connected to Lebanese political party Hizbullah which is designated as a terrorist organization in many Western countries. Yet while Western jurisdictions have, in general, paid more attention to Muslim charities and groups, other terrorist organizations have also abused the sector. The Tamil Tigers (LTTE), the Kurdistan Workers Party (PKK), ETA in Spain, Aum in Japan, the New People s Army in the Philippines and FARC in Colombia have all used charities, as well as having prominent people sit on boards, said Gunaratna. 6 Moneyval is the Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism, a monitoring body of the Council of Europe. 5 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
Heightened AML and CTF regulation has meant the sector is less exposed but as the metaphor goes, financial crime is like an elongated balloon, as when pressure is put on one area to reduce crime, the balloon expands in another. Indeed, terrorist organizations are aware of the legislation in place, which jurisdictions are strong or weak, and how to try and circumvent regulations. It is like the telephone, terrorists know it is being monitored but keep using it, said Gunaratna. They are also smart, recruiting accountants, bankers and those that understand money. We must not underestimate them, and these groups know about suspicious activity reports (SARs). Syria is a case in point, which has become an international concern in the years since the conflict started in March, 2011, with intelligence reports indicating there are now 100,000 rebel fighters of which an estimated 7,000 to 10,000 are foreigners fragmented among 1,000 groups, which includes radical Islamic groups such as Jabhat Al Nusra and the Islamic State of Iraq and the Levant (ISIL). A seizure of data in Iraq in June, indicated ISIL has a staggering US$875 million at its disposal, and when including other assets such as stolen antiquities, heavy armor and the like, assets of up to US$2 billion. While funds have been raised through bank robberies, oil sales and extortion, funding has also come through charitable donations. Certain Gulf countries like Kuwait define terrorism in a different way, so they have turned a blind eye to charities and private donations to Syria. Because it is so difficult to transfer funds through legitimate means, supporters in the Gulf openly solicit for funds via Twitter that list bank accounts, and the cash is smuggled in bulk to groups like Al Nusra and ISIL. It is an example of how strict regulations have not had the desired effect, by instead sending the money underground, said Lye. It is on the ground that charities have higher exposure to risk, as they could be unwittingly involved with a terrorist organization in distributing aid and other services. Indeed, FATF s Recommendation 8 Interpretative Note goes beyond how money is raised and moved by also covering how funds are used, noting that NPOs have been exploited through providing logistical support. This is reflected in a report on the NPO sector being drawn up by FATF, yet to be published, with initial findings suggesting that the NPOs most at risk appear to be those engaged in service activities and who operate in close proximity to an active terrorist threat. Indicative of the risks Syria poses, the Charity Commission of England and Wales, a regulatory body, issued specific guidelines to charities responding to the humanitarian crisis, with a particular focus on aid convoys. But it is not just abroad that charities are at risk. In April, 2014, the Commission s Chairman William Shawcross went further, warning that the problem of Islamist extremism and charities...is not the most widespread problem we face in terms of abuse of charities, but is potentially the most deadly. However, at a global level, gaging the extent to which charities could have been abused or infiltrated by terrorist groups, Islamic or any other, is hampered by a dearth of data and compliance in many jurisdictions. The more proactive jurisdictions are few and far between, and this is a major issue that needs to be addressed. 6 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
One of the main issues is to understand the size of the NPO sector and determine what parts are vulnerable to TF. Many countries don t even know what kind of NPO sector they have, so it is hard to identify the charities that could be vulnerable to this phenomena, said a member of the Moneyval secretariat. 6 I think the situation will become clearer when countries do national risk assessments, as then they will realize whether there s a problem or not. RECOMMENDATION 8 AND THE ENFORCE- MENT TRACK RECORD The Interpretative Note to FATF s Recommendation 8 requires domestic reviews of the NPO sector. It suggests a four pronged approach to identifying, preventing and combating terrorist misuse of NPOs: (a) outreach to the sector, (b) supervision or monitoring, (c) effective investigation and information gathering and (d) effective mechanisms for international cooperation. Adoption of the recommendations has been lackluster around much of the world, especially in covering all four of the suggested approaches. Member countries of Moneyval are indicative of this. 7 From the Moneyval point of view, compliance with Recommendation 8 has been very low, said a member of the secretariat. Moneyval has never conducted any studies on NPOs specifically in relation to AML/ CFT compliance, but in its third round of assessments of overall compliance in 2009, 27 out of 33 countries were in the lower range. 8 The vast numberwere non-compliant or partially compliant. That means there is no real understanding at a policy level of this issue, and it is not being tackled as a matter of priority, maybe because it is not considered a priority. Jurisdictions may often think they don t have a TF problem as there are no Islamic fundamentalist groups, unlike in Britain, he said. In the latest, fourth round of evaluations of Moneyval countries, yet to be published, ratings are still very poor and there are deficiencies: no reviews of NPOs, no outreach. The shortcomings are very common, added the Moneyval member. Other jurisdictions are even further behind the curve, with some countries still grappling with AML regimes. Uganda for example only put into effect AML and CFT legislation last year, while Afghanistan is on FATF s watch list, as are several other jurisdictions, which included Turkey until early 2014. Such shortcomings and the need for greater clarity about the risks NPOs face is expected to be addressed by FATF. The UK and Canada are currently co-chairing a FATF study group which will produce a Typology Report on the Risk of Terrorist Abuse in the NPO Sector. Once completed, FATF members are expected to decide whether and how to update the Best Practices paper on NPOs, and if Recommendation 8 itself needs updating. This is unlikely to be clear until early next year, noted the Charity Commission. REPORTING AND KYC The UK is useful as an example of one of the more proactive jurisdictions when it comes to CFT and the charitable sector. Like in the US, there has been a vibrant debate about effectively regulating the sector, in part due to public pressure as well as awareness of the negative impact that terrorism financing can have on the charitable sector at large. 7 Moneyval members include certain European states, Central Asian states, Russia, the Holy See and Israel. 8 For a list of countries currently under evaluation see: http://www.coe.int/t/dghl/monitoring/moneyval/evaluations/evaluation_ reports_en.asp 7 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
The damage that can be done by the exceptionally few cases of charity funds being abused for terrorist or extremist ends can be massive, said Caron Bradshaw, Chief Executive of the Charity Finance Group (CFG), which promotes best practice in finance management in the voluntary sector in Britain. However I think it unwise to single out Islamic extremism or think of it as the most deadly threat to charities. We should be careful not to paint a false picture of a sector which is a hotbed of terrorist activity. Cases of such abuse are extremely few. Reflective of the low incidence, charities accounted for 23 out of 316,527 suspicious activity reports (SARs) in the UK s National Crime Agency s SAR 2013 Report, while just one was disseminated to the National Terrorist Financial Investigation Unit (NTFIU) and Counter Terrorism Units (CTUs), equivalent to 0.12% of all terrorist finance SARs. However, the UK is a relative exception when it comes to SARs, or Suspicious Transaction Reports (STRs), related to NPOs. A cursory review of other jurisdictions finds that mentions of charities is a relative rarity, and that while in some jurisdictions STRs are reported, there are typically few prosecutions. But this is also related to a broader problem: the low levels of compliance with the FATF recommendations on terrorist financing. Many Financial Intelligence Units (FIUs) say they have hardly received any STRS related to TF, and not just charities, said the member of the Moneyval secretariat. Complicating compliance further is that Know Your Customer (KYC) and STR covered entities varies by jurisdiction. In the UK for instance charities are not deemed regulated businesses for AML purposes, putting the onus on financial institutions to carry out due diligence and file STRs. Seemingly less common is for jurisdictions to require charities themselves to file reports. 11 Some countries in recent years have made NPOs reporting entities, which means they have to do customer due diligence, especially if donations are made in cash. It is a little bit odd as one risk is that an NPO is just a front, so by imposing requirements on the charity itself (rather than through an external agency), it could still carry on with whatever it was set up to do, said the Moneyval secretariat member. That said, STR reporting should not be viewed as a panacea, in that a jurisdiction is carrying out effective oversight. If a regulator is measured by the number of investigations it opens then I think that will create a perverse incentive and remove flexibility in the system that ought to exist. There will be lots of cases where charities are outside the confines of permitted behavior because they are ignorant not because they are intentionally flouting the law. In such cases it might be appropriate to aid charities into compliance and not simply resort to hitting them with a big stick, said Bradshaw. This is a key point, as NPOs are often not fully aware of legislation due to insufficient outreach by regulators. It is a fact recognized by the Charity Commission, that despite having a counter-terrorism strategy in place that addresses the risks to NPOs and an out-reach 9 See http://www.nationalcrimeagency.gov.uk/publications/94-sars-annual-report-2013/file 10 Exceptionally few FIUs mention NPOs in annual reports. The UK is one of the few countries that actually lists STRs related to charities; the US Treasury does not. 11 Out of the 65 jurisdictions of primary concern in the US State Department s International Narcotics Strategy Report: Money Laundering and Financial Crimes Volume 2, March 2014, only five countries - Argentina, the British Virgin Islands, Guinea Bissau, India and Iran - have requirements for charities to carry out KYC and file STRs. 8 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
program targeting faith-based charities, more work needs to be done with the sector and partner agencies to raise awareness of the need to report instances of or suspicions of abuse. It is the Commission s assessment that charity trustees, employees and volunteers are not fully aware of reporting requirements and that they commit a criminal offense if they fail to report certain matters, said a spokesperson. For example, an offense is committed by virtue of section 19 of the Terrorism Act 2000 if an individual with a belief or suspicion that a terrorist financing offense has been committed fails to report it to the police (this includes reporting to the NCA) even if these occurred outside of the UK. This highlights another problem with NPOs being reporting entities, as NPOs may lack the resources and capabilities to effectively report, particularly small and medium sized charities. Self-regulation by charities has also not worked as effectively as it could have. While an estimated 360 NPOs around the world do self-regulate, it is primarily aimed at increasing accountability and transparency rather than CFT. It is only recently that NPOs are recognizing that they are vulnerable to terrorist abuse, said the Commission spokesperson. Conversely, as noted, governments have lacked sufficient knowledge of the NPO sector to effectively implement a risk-based approach, as stipulated by FATF. This means that they often take a blanket approach, putting into place policies and legislation which can make it difficult for NPOs to function properly, said the Commission spokesperson. A clear solution in how best to address the issues the sector faces is for more cooperation between regulators and NPOs to minimize risk, although this too needs time and effort to be effectively implemented at the national and international level. Unfortunately, government/sector relations in many countries are not good, and developing a dialogue between the two sides on this subject can be challenging. In addition to this, in many countries the NPO infrastructure is very weak, making it difficult to pass on ideas, information and to organize much needed training, added the spokesperson. In addition to this the NPO sector has only recently begun to engage with FATF. MOVING FORWARD The onus on financial institutions to carry out due diligence and KYC on NPOs is seen as a more effective approach as banks are registered, have better resources and it is easier for governments to monitor banks. A key relationship is that between charities and their banks to take a joined up approach to monitoring and mitigating risk. Charities need to be aware of the pressures that banks are under to protect against risk and banks need to be informed of what due diligence mechanisms the charity already has in place, said the Charity Finance Group s Bradshaw. However, there is minimal economic incentive for banks to do such investigations versus the fees gained from servicing NPOs. As a result, charities can be viewed as a regulatory burden by the financial sector. This is where governments and FIUs could take on a greater role to lessen the burden on banks, in line with the four pronged approach suggested by FATF. Banks need to play a bigger role, but how to convince them to do it? Governments need to step up, as well as make counterparts more accountable, said Lye. 9 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
A further possible solution is a collective action initiative among major banks to improve oversight of the NPO sector. Collective action is not unheard of, like the Wolfsberg Group, although the challenge is to get private organizations that are essentially competitors to work together, said Dr Radha Ivory, a Lecturer at the TC Beirne School of Law at the University of Queensland, Australia, and Senior Consultant to the Basel Institute on Governance. The movement towards collective action for an industry with common interests and risk exposure is something of increased interest to international policymakers. NPOs are themselves attempting to improve selfregulation, especially if operating in multiple jurisdictions. Overall, there is significant work ahead to address CFT in the NPO sector, at the regulatory level, among charities themselves, and internationally to improve overall compliance and oversight of AML and CTF regimes. Less developed jurisdictions have the opportunity at this juncture to learn from the more advanced jurisdictions about how they are dealing with NPOs, as well as the best way to implement a risk-based approach. FATF s current reevaluation of the NPO sector will go a long way in addressing how significant such risks are, but ultimately, a multi-pronged approach is needed to curb the threat terrorist financing poses to NPOs, financial institutions and countries. We need the security services to work very closely with financial institutions and FIUs, as if there is no collaboration terrorist financing will continue. I think the world has made a lot of progress but much more needs to be done, said Gunaratna. 10 Charities and Terrorism Financing Compliance Approaches and Challenges in 2014 AUGUST 2014
THOMSON REUTERS ACCELUS The Thomson Reuters Governance, Risk & Compliance (GRC) business delivers a comprehensive set of solutions designed to empower audit, risk and compliance professionals, business leaders, and the Boards they serve to reliably achieve business objectives, address uncertainty, and act with integrity. Thomson Reuters Accelus connects business transactions, strategy and operations to the everchanging regulatory environment, enabling firms to manage business risk. A comprehensive platform supported by a range of applications and trusted regulatory and risk intelligence data, Accelus brings together market-leading solutions for governance, risk and compliance management, global regulatory intelligence, financial crime, anti-bribery and corruption, enhanced due diligence, training and e-learning, and board of director and disclosure services. Thomson Reuters has been named as a category leader in the Chartis RiskTech Quadrant For Operational Risk Management Systems, category leader in the Chartis RiskTech Quadrant for Enterprise Governance, Risk and Compliance Systems and has been positioned by Gartner, Inc. in its Leaders Quadrant of the Enterprise Governance, Risk and Compliance Platforms Magic Quadrant. Thomson Reuters was also named as Operational Risk Software Provider of the Year Award in the Operational Risk and Regulation Awards 2013 and 2014. For more information, visit accelus.thomsonreuters.com 2014 Thomson Reuters GRC01499/8-14