Category: Terrorist and Proliferation Financing
ISIL Financing
Also known as: ISIS Financing, Financing of ISIL, Financing of ISIS, Islamic State Financing
Simply put
ISIL financing refers to the ways the terrorist group known as ISIL (also called ISIS or Islamic State) raises, moves, and uses money to support its operations. This has historically included revenue from activities such as controlling oil fields, looting, other criminal activity, and donations from sympathizers internationally. It is a specific form of terrorist financing focused on one designated terrorist organization and its affiliates.
Formal definition
ISIL financing denotes the funding streams, financial support networks, and value-transfer methods used by the terrorist organization Islamic State in Iraq and the Levant (ISIL/ISIS) and its global affiliates to sustain terrorist activities, infrastructure, and governance requirements. As a subset of terrorist financing rather than money laundering, it concerns the sourcing and movement of funds, whether from licit or illicit origins, toward a specified terrorist entity, and is distinct from the broader offence of terrorist financing in that it targets a particular group and its affiliates. Identified financing sources have historically included revenues from control of oil fields, looting, and proceeds of criminal activity, as well as support from sympathizers internationally; the relative significance of these streams has shifted over time, for example following coalition efforts beginning in 2015 to target ISIL's financial infrastructure and the resulting revenue losses. Relevant designations and countermeasures derive from instruments such as United Nations Security Council Resolution 2170 (2014), FATF public statements and typologies work on the financing of ISIL, and jurisdiction-specific guidance such as FinCEN advisories in the United States. Practitioners should note that these typologies are illustrative of observed methods rather than exhaustive or legally determinative, and that specific obligations and designations should be confirmed against the applicable regulatory and sanctions regime.
Why it matters
ISIL financing is significant because it addresses how a specific designated terrorist organization, Islamic State in Iraq and the Levant (also known as ISIS or Islamic State) and its global affiliates, raises, moves, and uses funds to sustain terrorist activities, infrastructure, and governance requirements. Unlike money laundering, which concerns disguising the illicit origin of funds, terrorist financing (including ISIL financing) can involve funds of both licit and illicit origin directed toward a proscribed group. Understanding this distinction matters for obliged entities that must detect and report suspicious activity potentially linked to terrorist financing, and for authorities implementing designations and countermeasures.
Who it's relevant to
Financial intelligence analysts
Analysts reviewing transactions and networks for potential terrorist financing links benefit from understanding ISIL's evolving funding streams, such as those historically associated with oil fields, looting, criminal proceeds, and international sympathizer support, while treating published typologies as illustrative rather than conclusive. An alert or apparent match does not by itself establish wrongdoing.
Compliance officers at obliged entities
Compliance professionals responsible for monitoring, screening, and suspicious activity reporting should align their controls with the correct source instruments, including relevant FATF outputs and jurisdiction-specific guidance such as FinCEN advisories in the United States. Specific obligations and designations vary by regime and should be confirmed against the applicable sanctions and regulatory framework.
Sanctions and designations teams
Teams implementing designations and countermeasures should note that relevant measures derive from instruments such as UNSCR 2170 (2014) and jurisdiction-specific implementations. Because ISIL financing targets a particular designated group and its affiliates, screening against current, applicable designation lists is essential and should be verified against the governing regime.
Investigators and law enforcement liaisons
Investigators tracing the sourcing and movement of funds toward a proscribed group can use FATF and other typologies to inform lines of inquiry, while distinguishing the compliance meaning of ISIL financing indicators from the criminal-law standard for establishing an offence. Observed methods are context-dependent and have shifted over time.
Risk and policy professionals
Those setting institutional risk appetite and terrorist financing risk assessments should account for the fact that ISIL's financing profile changes, for example following coalition efforts beginning in 2015, so risk methodologies should be periodically reviewed rather than treated as static, and framed as measures to detect, deter, and mitigate risk rather than eliminate it.
Inside ISIL Financing
Terrorist Financing Context
ISIL financing refers to the raising, moving, storing, and using of funds and other assets by or for the Islamic State of Iraq and the Levant. It falls under the broader concept of terrorist financing, which is analytically distinct from money laundering: money laundering seeks to disguise the illicit origin of proceeds, whereas terrorist financing concerns the destination and use of funds and may involve funds from lawful sources.
Revenue Sources
Historically, ISIL revenue has been associated with sources such as control of territory and natural resources, extortion and taxation of populations under its control, kidnapping for ransom, looting and antiquities trafficking, and external donations. The specific mix of sources has varied over time and should be assessed against current threat assessments rather than treated as fixed.
Fund Movement Methods
Movement of funds may involve cash couriers, informal value transfer systems (such as hawala), the formal banking sector, money or value transfer services, and, in some reporting, virtual assets. The relevance of any given channel depends on the operating environment and evolves over time.
Applicable Sanctions Frameworks
ISIL is subject to targeted financial sanctions, notably under the UN Security Council sanctions regime associated with Resolution 1267 and its successor resolutions covering ISIL (Da'esh) and Al-Qaida. These give rise to asset-freezing and prohibition obligations that are typically implemented through national and regional measures, such as EU regulations and US OFAC designations, and enforced differently across jurisdictions.
FATF Standards Relevance
The FATF Recommendations addressing terrorist financing and targeted financial sanctions (including Recommendations 5, 6, and 8) are relevant to how jurisdictions are expected to criminalize terrorist financing and implement targeted financial sanctions. These are international standards rather than binding law; their obligations take legal effect through domestic implementation.
Obliged Entity Obligations
For obliged entities, ISIL financing intersects with sanctions screening, customer due diligence, ongoing monitoring, and suspicious activity or transaction reporting. Screening for sanctioned entities is distinct from PEP screening, and a screening match is an indicator requiring review, not proof of wrongdoing.
Common questions
Answers to the questions practitioners most commonly ask about ISIL Financing.
Is ISIL financing the same as money laundering?
No. These are distinct concepts that should not be treated as interchangeable. Terrorist financing, including the financing of ISIL, concerns the provision or collection of funds intended to support a terrorist organization or acts, and the source of those funds may be entirely legitimate. Money laundering concerns disguising the illicit origin of proceeds of crime. While the two can overlap operationally and share some detection techniques, they differ in focus: money laundering typically starts with illicit proceeds and seeks to legitimize them, whereas terrorist financing is concerned primarily with the destination and intended use of funds regardless of their source. Applicable obligations and offences differ by jurisdiction and should be confirmed against the relevant regime.
Does a screening alert or a match against an ISIL-related designation mean a customer is financing terrorism?
No. A screening alert, potential name match, or transaction flag does not establish wrongdoing. Such outputs indicate that further review is warranted, not that a customer has committed an offence. Matches must be assessed for accuracy, including the possibility of false positives arising from common names or incomplete identifiers. Any conclusion about criminal conduct is a matter for competent authorities and, ultimately, the courts under the applicable criminal law. A compliance filing or alert is an operational risk measure, not a determination of guilt.
How should obliged entities screen for ISIL-related designations in practice?
Screening is generally performed against applicable sanctions and terrorist-designation lists relevant to the jurisdictions in which an entity operates, which may include lists maintained under United Nations frameworks and by national or regional authorities. Firms typically screen customers, beneficial owners, and relevant counterparties at onboarding and on an ongoing basis, and may screen transactions where required. The exact lists that apply, the frequency of screening, and record-keeping expectations vary by regime and by the type of obliged entity, and should be confirmed against the applicable regulation. Screening is a measure to help detect and manage risk, not a guarantee of prevention.
What steps generally follow when a potential ISIL-related match is identified?
In many jurisdictions, a firm would first assess whether the alert is a true or false positive by comparing available identifiers. Where a potential true match involving a designated person or entity is identified, applicable sanctions or asset-freezing obligations may require the firm to take specified action, which can include freezing relevant funds and refraining from dealing, and reporting to the competent authority. Suspicion of terrorist financing may also trigger a reporting obligation to the relevant financial intelligence unit, which in some jurisdictions is termed a SAR and in others an STR. The precise obligations, timeframes, and prohibitions on tipping-off vary by regime and should be confirmed against the applicable rules.
What red flags might inform a risk-based assessment of possible ISIL financing?
Indicators discussed in typologies literature may include transactions or relationships connected to higher-risk geographies, patterns inconsistent with a customer's known profile, use of channels associated with obscuring fund flows, and links to designated persons or entities. These indicators are not exhaustive and are not proof of criminality; the presence of a red flag warrants further review rather than a conclusion. Firms typically incorporate such indicators into a risk-based approach to detect, deter, and mitigate risk, calibrated to their customer base, products, and jurisdictions.
How can firms address the challenge of small-value or self-funded terrorist financing?
Terrorist financing, including support to groups such as ISIL, can involve small amounts and funds derived from legitimate sources, which can make detection based solely on transaction value or unusual source patterns difficult. Firms generally address this through a risk-based approach that combines screening, transaction monitoring calibrated to relevant indicators, staff awareness, and use of typologies and guidance issued by authorities. No single control eliminates financial crime risk; these measures collectively aim to detect, deter, and manage it. The specific expectations placed on an obliged entity depend on its jurisdiction and sector and should be confirmed against the applicable regulation.
Common misconceptions
ISIL financing always involves large sums moved through the banking system.
Terrorist financing, including that associated with ISIL, can involve relatively small amounts and may move outside the formal banking sector through cash couriers or informal value transfer systems. The scale and channel vary, so monitoring should not focus solely on large formal-sector transactions.
Because it is terrorist financing, the funds must originate from criminal activity.
Unlike money laundering, terrorist financing can draw on funds from legitimate as well as illicit sources. The defining feature is the intended use or destination of the funds, not necessarily their origin, which makes detection based on illicit-origin indicators alone insufficient.
A sanctions screening match against an ISIL-linked designation establishes that a customer is financing terrorism.
A screening alert or potential match is an operational indicator that requires investigation and, where appropriate, escalation and reporting. It does not by itself establish criminal wrongdoing, which is a matter for the relevant authorities and legal processes.
Best practices
Treat terrorist financing risk, including ISIL-related risk, as distinct from money laundering risk in your risk assessment, recognizing that funds may derive from legitimate sources and that the focus is on use and destination.
Maintain sanctions screening against current UN, and applicable EU and OFAC or other national lists covering ISIL (Da'esh) and associated designations, and confirm the exact scope and legal basis against the frameworks applicable in your jurisdiction.
Do not rely solely on formal banking-sector monitoring; account for channels such as cash couriers, informal value transfer systems, and, where relevant, virtual assets, calibrated to your operating environment.
Keep typologies and red flags current using up-to-date national and FATF threat assessments, and treat them as non-exhaustive indicators rather than proof of criminality or a fixed checklist.
Ensure screening matches and suspicious indicators are investigated, escalated, and reported through the correct suspicious activity or transaction reporting channel, without treating an alert or match as a determination of guilt.
Verify how the FATF standards on terrorist financing and targeted financial sanctions have been implemented in domestic law for each jurisdiction in which you operate, since obligations and thresholds differ and take effect only through national measures.