Introduction
Terrorist financing and money laundering are almost always discussed together. In most institutions they share a regulatory framework and a set of reporting obligations, and usually one team, one set of policies and one monitoring system as well. Both terms appear in the title of the Money Laundering Regulations, and most job descriptions in this field treat them as a single discipline. In my view, keeping them so closely paired comes at a cost, because controls built to detect money laundering are designed around a particular pattern of behaviour that terrorist financing very often does not follow.
I came back to this question recently while completing the Basel Institute on Governance course on combating terrorist financing, which brought into focus a point that is easy to lose sight of in day-to-day work. Money laundering is about disguising where money came from. Terrorist financing is usually about where the money is going and what it will be used for. A control framework that looks mainly at the first question can be well run and still have very little to say about the second.
This article looks at the ways terrorist financing differs from money laundering that matter for detection, why those differences mean it is often missed, and what institutions can do to give it the separate attention it needs.
Regulatory context
In the UK, the main terrorist financing offences are found in the Terrorism Act 2000 and not in the Proceeds of Crime Act 2002. Sections 15 to 18 cover fund-raising, use and possession, involvement in funding arrangements and money laundering in relation to terrorist property. For most of these offences it is enough that a person intends, or has reasonable cause to suspect, that the money or property will or may be used for the purposes of terrorism. Section 21A adds a separate offence for people in the regulated sector who fail to disclose knowledge or suspicion of these offences. This has real consequences in practice. The Proceeds of Crime Act asks whether property is criminal in origin, whereas under the Terrorism Act funds can be entirely legitimate in origin and still fall within the offence because of what they are intended for.
The Money Laundering Regulations 2017 require firms to assess both money laundering and terrorist financing risk under regulation 18 and to maintain proportionate policies, controls and procedures under regulation 19. Firms must also comply with counter-terrorist asset freezing obligations, which the Office of Financial Sanctions Implementation administers.
The most recent assessments describe the threat clearly. The UK’s National Risk Assessment of Money Laundering and Terrorist Financing, published in July 2025, states that where money for terrorism is raised in the UK, it is typically raised through legitimate means, and that UK-based terrorists generally fund their lifestyles through legitimate methods such as a salary, a loan or state benefits. It notes that the threat includes low-sophistication attacks by lone actors or small groups. It assesses retail banking and money service businesses as high risk for terrorist financing, and electronic money and payment institutions have moved up from medium to high (HM Treasury and Home Office, 2025).
In the same month, the Financial Action Task Force (FATF) published a comprehensive update on terrorist financing risks. It found a growing threat from lone actors and small self-financed cells, often funded through what it called microfinancing from legitimate sources and petty crime, and it pointed to how small in scale and how hard to see the financial activity behind attack preparation tends to be. It also found that 69 per cent of the jurisdictions assessed by the FATF and its Global Network had major or structural weaknesses in investigating, prosecuting and convicting terrorist financing cases (FATF, 2025).
Where the two risks differ
The money is often clean
Most money laundering controls start with the source of funds. Customer due diligence asks where the customer’s wealth comes from, monitoring looks for income that does not fit the customer’s profile, and investigations try to trace money back to a predicate offence. In terrorist financing, the source is frequently unremarkable. As early as 2015, the FATF reported that individuals travelling to join terrorist groups often relied on employment income, savings, family support, bank loans and social assistance. It also noted an emerging pattern of people taking out small short-term loans from several providers at once with no intention of paying them back (FATF, 2015). The 2025 National Risk Assessment describes the same reliance on legitimate income in the UK (HM Treasury and Home Office, 2025). A salary credit or a personal loan from a regulated lender gives a money laundering analyst every reason to feel reassured, yet in a terrorist financing case it may tell them nothing at all.
The amounts are small
Money laundering monitoring is built largely around value. Thresholds, aggregation rules and velocity scenarios are tuned to pick up large or fast-growing flows, because that is what the movement of criminal proceeds usually looks like. A lone actor or a small cell may need very little money. The National Risk Assessment notes that terrorist funds moving through retail banking may be small amounts of money over a period of time, used for living costs such as rent and food (HM Treasury and Home Office, 2025), and many of the payments involved will look like ordinary consumer spending. From what I have observed, a monitoring scenario designed to catch laundering will rarely alert on a few hundred pounds sent to a payment service, a modest cash withdrawal or a purchase from an outdoor equipment retailer, and it would be unreasonable to expect it to.
The timeline is short
Laundering schemes often run for months or years, so their patterns become visible over time, and monitoring and periodic review are designed with that in mind. Terrorist financing connected to attack preparation or travel can start and finish within a few weeks. By the time a monthly aggregation rule has gathered enough activity to fire, or the next periodic review comes around, the account may already be dormant.
The purpose is what matters
Since the source and the size of the funds may both look normal, the more useful signals in terrorist financing tend to relate to purpose and context. They include payments to or from people or organisations linked to designated groups, and donations to fundraising pages or charities whose stated activities do not match where the money ends up. Other examples are a sudden liquidation of savings or drawdown of credit, travel bookings to areas close to conflict zones, and transfers through money service businesses or virtual asset platforms that break the visible trail. None of these is conclusive on its own, and most have perfectly legitimate explanations. They start to mean something in combination, and only when someone is looking at them with terrorist financing in mind.
An illustrative case
Consider a hypothetical retail customer of a UK bank, a young salaried employee who has held a current account there for several years. The account has always been quiet, with a monthly salary credit, regular household bills and modest card spending, and the customer is rated low risk.
Over five weeks, the customer takes out a personal loan of £8,000 from another lender and moves the full amount into the account. In the days that follow, the customer sends several transfers of between £150 and £400 to individuals they have never paid before, makes three payments to an online fundraising page, buys a one-way flight to a country bordering an area of active conflict and spends a few hundred pounds on outdoor clothing and equipment. Two cash withdrawals of £500 follow on consecutive days, along with a final transfer of £1,200 through a money service business. After that, the account goes quiet.
The bank’s monitoring raises one alert, for the rapid movement of funds after the large inbound credit. The analyst checks the source, finds that it is a personal loan from a regulated UK lender, and notes that the outgoing payments are each small and consistent with personal spending. The alert is closed with a comment that the source of funds is legitimate and the activity does not indicate laundering.
Judged as a money laundering alert, that conclusion was reasonable. The money was clean, the amounts were small and nothing suggested that criminal proceeds were being disguised. Nobody asked what the money was being used for. Taken together, the loan, the transfers to new payees, the fundraising payments, the one-way travel, the equipment and the money service transfer made up exactly the kind of pattern that terrorist financing indicators are designed to recognise. The analyst was not careless, since the alert was reviewed against the risk the system had been built to detect and the review followed that design.
Why terrorist financing is often missed
The first reason is structural. In most institutions, terrorist financing is folded into the AML framework and is not treated as a risk in its own right. The business-wide risk assessment may give it a paragraph, but the monitoring scenarios, the alert review guidance and the quality assurance testing are usually designed and measured with laundering in mind. From what I have observed, where terrorist financing scenarios do exist, they often focus on transactions involving high-risk jurisdictions, which covers only a small part of the risk described in the National Risk Assessment.
The second reason concerns training and judgment. Analysts are trained to ask whether activity fits the customer’s known profile and whether the source of funds is legitimate, and those are the right questions for money laundering. In a terrorist financing case the customer profile may be entirely ordinary and the source may be legitimate, so an analyst who is not prompted to think about purpose and context will reasonably close the alert.
The third reason is that any single institution sees very few terrorist financing cases. A bank may go years without identifying one, which makes it hard to calibrate scenarios, build experience among staff or justify investment. In my view, the rarity of these cases does not show that the risk is low. It may simply mean that the controls in place are not designed to find them.
Finally, institutions have a tension to manage here. Terrorist financing indicators must be based on behaviour and context, and they must never rest on a customer’s nationality, religion or community. Controls that lean on crude proxies are unfair and they do not work, and the FATF has repeatedly warned about the unintended consequences of poorly targeted measures, including de-risking, financial exclusion and the undue targeting of non-profit organisations (FATF, 2021; FATF, 2023). Striking this balance takes thought, and it is one reason some institutions prefer to leave terrorist financing inside a generic framework instead of addressing it directly.
Practical measures
Institutions can give terrorist financing the attention it needs within their existing compliance function, provided the controls are deliberately designed for it. In practical terms, they should consider the following measures:
- Assess terrorist financing as a risk of its own. The business-wide risk assessment should look at terrorist financing exposure by product, channel and customer type, drawing on the National Risk Assessment and FATF typologies, and should not treat it as a subsection of money laundering risk.
- Build monitoring scenarios around purpose and combinations of indicators. Terrorist financing monitoring should look for combinations of lower-value signals, such as new payees, fundraising payments, sudden drawdown of credit, travel purchases and transfers through money service businesses, and should not rely on value thresholds alone.
- Shorten the look-back period where the risk calls for it. Some terrorist financing indicators lose their value when aggregated over a month or a quarter, so scenarios should use a time window that matches how quickly this activity can start and finish.
- Change the questions analysts have to answer. Alert review guidance should prompt analysts to consider what the funds appear to be used for as well as where they came from, and quality assurance should test whether that question was considered.
- Train staff on terrorist financing cases specifically. Training that presents terrorist financing as a variant of money laundering will reinforce the wrong instincts, while case-based training using public typologies helps staff recognise patterns they are unlikely to see often in their own work.
- Make sure everyone understands the reporting route. Staff and the nominated officer should know that disclosures relating to terrorist property are made under the Terrorism Act 2000, and that suspicion can arise even where the source of funds is legitimate.
- Keep indicators based on behaviour. Scenarios and guidance should be reviewed regularly to confirm that they rely on activity and context and do not use identity-based proxies, which produce unfair outcomes and poor detection.
Conclusion
Money laundering controls ask, quite reasonably, whether money is what it appears to be. In terrorist financing the money is often exactly what it appears to be, moving in amounts too small to stand out over a period too short for most monitoring cycles to notice. A framework that treats the two risks as one will tend to perform well against money laundering and poorly against terrorist financing, while appearing to cover both.
This does not mean institutions need to build an entirely new control environment, since most of the components already exist. What is often missing is a decision to design, test and review some of those components with terrorist financing specifically in mind. In my experience, the controls that work best are built on a clear understanding of the behaviour they are meant to detect, and terrorist financing deserves controls built on that same understanding of how it actually behaves.
References
Financial Action Task Force (FATF) (2015) Emerging Terrorist Financing Risks. October. Paris: FATF.
Financial Action Task Force (FATF) (2021) High-Level Synopsis of the Stocktake of the Unintended Consequences of the FATF Standards. Published 27 October. Paris: FATF.
Financial Action Task Force (FATF) (2023) Best Practices on Combating the Abuse of Non-Profit Organisations (Recommendation 8). Updated 16 November. Paris: FATF.
Financial Action Task Force (FATF) (2025) Comprehensive Update on Terrorist Financing Risks. Published 8 July. Paris: FATF.
HM Treasury and Home Office (2025) National Risk Assessment of Money Laundering and Terrorist Financing 2025. July. London: HM Treasury.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692). London: The Stationery Office.
Terrorism Act 2000 (c. 11). London: The Stationery Office.
Leave a Reply