Terrorist Financing Red Flags
Terrorism financing is a global, evolving, and critical threat, with illicit funds originating from both legal sources (donations, charities) and criminal activities (trafficking, kidnapping) to support terrorist acts.
Efforts to combat this involve strengthening international cooperation, freezing assets, and regulating new technologies to stay ahead of the increasingly adaptive methods used by terrorist organizations.
Effective policies on combating the financing of terrorism (CFT) policies and measures are key to the integrity and stability of the international financial system and member countries’ economies.
Check this section regularly for timely information on Terrorist Financing developments.
FIU Curaçao launches Terrorist Financing Awareness Series
The Financial Intelligence Unit of Curaçao (FIU Curaçao) is pleased to announce the launch of its Terrorist Financing (TF) Awareness Series, a structured outreach initiative aimed at strengthening national prevention and detection efforts.
Beginning this week, FIU Curaçao will publish 26 weekly Terrorist Financing Red Flags designed to support reporting entities in identifying potentially suspicious activity linked to terrorist financing.
This initiative forms part of FIU Curaçao’s ongoing commitment to:
- Enhancing risk awareness within the financial and non-financial sectors
- Promoting a risk-based approach to monitoring and reporting
- Strengthening public-private cooperation
- Supporting national and international AML/CFT obligations
Each weekly publication will highlight a specific risk indicator, explain its relevance, and remind reporting entities of their reporting obligations under applicable legislation.
Terrorist financing often involves relatively modest amounts and subtle behavioral patterns. Early detection depends on vigilance, professional judgment, and timely reporting.
FIU Curaçao encourages all reporting entities to follow this series and incorporate relevant indicators into their risk assessment and monitoring frameworks.
Together, we strengthen Curaçao’s resilience against terrorist financing
FIU CURAÇAO TERRORIST FINANCING AWARENESS SERIES
TF RED FLAGS 1–5 OF 26
Strengthening Prevention Through Risk Awareness
TF Red Flag #1 – Multiple Small Transfers to High-Risk Jurisdictions
Indicator
Multiple small-value transfers are sent over a short period, each structured below reporting thresholds, to one or more High-Risk Jurisdictions (HRJs). A current list of HRJs can be found on the FIU Curaçao website.
Why It Matters
Terrorist financing often uses small transfers to evade detection while moving funds internationally. Structuring transactions in this way may indicate attempts to circumvent reporting systems.
Reporting Reminder
If transfers appear repetitive, lack a clear economic purpose, or involve HRJs, submit an Unusual Transaction Report promptly.
TF Red Flag #2 – Funds Sent To or Received From High-Risk / Conflict Zones
Indicator
Transactions involve sending or receiving funds from regions with heightened TF risk, including parts of the Middle East, Africa, or sanctioned areas.
Why It Matters
Funds moving to or from conflict zones or sanctioned jurisdictions can be linked to terrorist networks or high-risk entities.
Reporting Reminder
Monitor such transactions carefully and report any that appear suspicious or inconsistent with the customer’s profile.
TF Red Flag #3 – Use of Third-Party Accounts for High-Risk Transfers
Indicator
Accounts belonging to family members, friends, or unrelated businesses are used to send or receive funds, particularly to or from HRJs.
Why It Matters
Use of third-party accounts can obscure the true beneficiary or originator of funds, a pattern commonly observed in terrorist financing cases.
Reporting Reminder
Where the relationship between account holders and the customer is unclear or suspicious, consider enhanced review and reporting.
TF Red Flag #4 – Rapid In-and-Out Movement of Funds With No Economic Rationale
Indicator
Funds are rapidly deposited and withdrawn from an account without an apparent economic or business purpose.
Why It Matters
Such “layering” behavior may be indicative of attempts to disguise the origin or destination of funds, which can be linked to terrorist financing.
Reporting Reminder
Transactions that show unusual velocity or circular patterns should be carefully assessed and reported if suspicious.
TF Red Flag #5 – Accounts Used Inconsistent With Customer Profile
Indicator
Account activity is inconsistent with the customer’s profile, such as a student or unemployed individual sending frequent or high-value remittances, particularly to HRJs.
Why It Matters
Behavior outside normal expectations for the customer’s occupation or financial situation can signal misuse for TF purposes.
Reporting Reminder
If the activity does not match the customer’s known profile, enhanced due diligence and timely reporting are required.
Disclaimer:
These indicators are not exhaustive and do not automatically imply terrorist financing. Reporting entities must apply a risk-based approach and professional judgment.
FIU CURAÇAO TERRORIST FINANCING AWARENESS SERIES
TF RED FLAGS 6–10 OF 26
Strengthening Prevention Through Risk Awareness
TF Red Flag #6 – Donations to Suspicious NPOs / Charities
Indicator
Funds are donated to non-profit organizations or charities that have minimal local footprint, unclear purpose, or limited transparency. Additionally, NPOs transferring money to High-Risk Jurisdictions (HRJs), conflict zones, or adjunct jurisdictions.
Why It Matters
Terrorist financiers may exploit NPOs as a conduit to move funds while appearing legitimate. Minimal activity or unclear objectives can signal misuse.
Reporting Reminder
When donations or transfers appear unusual or inconsistent with the NPO’s stated purpose, enhanced due diligence and timely reporting are required.
TF Red Flag #7 – Purchase of Easily Movable Value Items
Indicator
Transactions involve the acquisition of assets that are easily transferable, such as gift cards, cryptocurrency, gold, or prepaid top-ups.
Why It Matters
Such assets can be quickly liquidated or transferred internationally, making them attractive for TF purposes.
Reporting Reminder
Unusual purchases, particularly in combination with other risk indicators, should be reported as potentially suspicious.
TF Red Flag #8 – Use of Informal / Unlicensed Value Transfer Systems
Indicator
Transactions are conducted through informal or unlicensed value transfer methods (hawala, hundi, or similar systems) rather than regulated financial channels.
Why It Matters
Informal systems can be exploited to move funds across borders with limited traceability, presenting higher TF risk.
Reporting Reminder
Monitor unusual or high-volume use of informal channels and report any activity that raises suspicion.
TF Red Flag #9 – Use of Multiple Accounts, Aliases, or Online IDs
Indicator
The customer uses multiple bank accounts, online identifiers, or aliases to move small-value flows.
Why It Matters
Layering funds across accounts and identities is a known TF tactic to obscure the origin, destination, or ultimate beneficiary.
Reporting Reminder
Suspicious patterns involving multiple accounts or online identities should trigger enhanced review and reporting.
TF Red Flag #10 – Customer Reluctant to Provide Information
Indicator
The customer is evasive or reluctant to provide information about the source of funds, purpose of transfers, or intended recipient.
Why It Matters
Refusal or inconsistency in providing key information may indicate an attempt to conceal involvement in terrorist financing.
Reporting Reminder
Where information cannot be verified or seems inconsistent, enhanced due diligence and immediate reporting are required.
Disclaimer:
These indicators are illustrative and not exhaustive. Reporting entities must apply professional judgment and report suspicious activity in accordance with NORUT. For the current list of High-Risk Jurisdictions (HRJs), visit the FIU Curaçao website.
FIU CURAÇAO TERRORIST FINANCING AWARENESS SERIES
TF RED FLAGS 11–15 OF 26
Strengthening Prevention Through Risk Awareness
TF Red Flag #11 – Transfers to Areas with Known Terrorist Activity
Indicator
Fund transfers occur without a legitimate or reasonable explanation to or from areas where terrorist groups are active, nearby regions, or areas where such groups are known to have support networks.
Why It Matters
Unexplained transactions involving high-risk regions may facilitate terrorist operations or support networks.
Reporting Reminder
Reporting entities should submit an Unusual Transaction Report where transfers to these areas lack an economic or lawful rationale.
TF Red Flag #12 – Payments for Unusual Substances or Materials
Indicator
Payments are made for substances or materials unrelated to the individual’s normal activities, in unusual quantities, or which could be used to manufacture explosives (e.g., aluminium pipes, shooting equipment, fertiliser, scrap iron).
Why It Matters
Terrorist financing may be used to procure materials for constructing explosive devices or other attacks.
Reporting Reminder
Transactions with unusual patterns or items should be assessed carefully and reported if suspicious.
TF Red Flag #13 – Payments Related to Travel or Communication Services in High-Risk Areas
Indicator
Payments are made for travel arrangements or communication services to/from areas with terrorist activity, nearby regions, or areas known to support terrorist groups.
Why It Matters
Travel or communication services linked to high-risk regions may facilitate operational movement or coordination of terrorist activity.
Reporting Reminder
Transactions of this nature that appear inconsistent with legitimate personal or business purposes should be reported.
TF Red Flag #14 – Transaction Activity Inconsistent with Customer Profile
Indicator
The customer’s transactions do not align with their known profile, for example:
Salary accounts used to purchase airline tickets to higher-risk jurisdictions or nearby regions
Subsequent dormancy or inactivity of the account
Why It Matters
Discrepancies between account usage and customer profile may indicate concealment of terrorist financing activity.
Reporting Reminder
Transactions inconsistent with the customer’s usual profile should trigger enhanced due diligence and reporting.
TF Red Flag #15 – Dormant Accounts Reactivated for Intensive Use
Indicator
An account remains dormant for several months and then becomes highly active, especially if the activation coincides with flight purchases or travel arrangements.
Why It Matters
Dormancy followed by sudden intensive activity can be used to move or layer funds for terrorist purposes.
Reporting Reminder
Monitor and report accounts with unusual dormancy patterns combined with activity linked to high-risk jurisdictions or suspicious travel arrangements.
Disclaimer:
These indicators are illustrative and not exhaustive. Reporting entities must apply professional judgment and report suspicious activity in accordance with NORUT. For the current list of High-Risk Jurisdictions (HRJs), visit the FIU Curaçao website.
FIU CURAÇAO TERRORIST FINANCING AWARENESS SERIES
TF RED FLAGS 16–20 OF 26
Strengthening Prevention Through Risk Awareness
TF Red Flag #16 – Remote Account Activity from High-Risk Areas
Indicator
Bank account activity is conducted remotely (online banking, ATMs, debit/credit cards) from areas where terrorist groups are active, nearby regions, or areas known to support terrorist groups. Particular attention should be paid when this coincides with receipt or transfer of significant funds or follows prolonged account inactivity.
Why It Matters
Remote access from high-risk regions may indicate an attempt to move or layer funds while avoiding local scrutiny.
Reporting Reminder
Transactions or access patterns inconsistent with normal behavior should trigger enhanced due diligence and prompt reporting.
TF Red Flag #17 – Suspicious Terms or References in Transaction Instructions
Indicator
Transaction instructions contain terms or references (e.g., in SWIFT messages) associated with extremist beliefs, terrorist ideologies, or short suspicious messages such as mujahid, mujahideen, ghanimah, fai, or fay.
Why It Matters
Certain terms can indicate that the funds are intended to support terrorist activities or individuals, especially if combined with other risk factors.
Reporting Reminder
Transactions containing unusual or ideologically-linked terms should be carefully reviewed and reported where appropriate.
TF Red Flag #18 – Religious Terminology in Transfers with Other Risk Factors
Indicator
References to Zakat/Zakah, Jizyah, Ghanimah, Khums, or Saleb appear in transfers. While these terms are legitimate in many contexts, their presence alongside high-risk factors—such as remittance to high-risk jurisdictions—may indicate TF.
Why It Matters
Contextual risk assessment is key: when combined with HRJ remittances, these references may signal misuse for terrorist financing.
Reporting Reminder
Assess transfers for context and supporting risk factors; report if suspicious.
TF Red Flag #19 – Wire Stripping or Removal of Payment Information
Indicator
Transfers involve changes or removal of payment instructions, obscuring sender or beneficiary details (wire stripping), making identification of transactions to/from sanctioned entities or high-risk jurisdictions difficult.
Why It Matters
Wire stripping is a common method to bypass sanctions or hide the ultimate beneficiary in TF schemes.
Reporting Reminder
Transactions exhibiting this behavior should trigger immediate scrutiny and reporting.
TF Red Flag #20 – Lack of Documentation or Vague Justifications
Indicator
Customers provide minimal documentation or vague explanations for transfers to high-risk jurisdictions or entities when questioned.
Why It Matters
Insufficient or unclear justification may indicate an attempt to conceal TF activity or other illicit purposes.
Reporting Reminder
Enhanced due diligence should be applied, and suspicious activity reported promptly.
Disclaimer:
These indicators are illustrative and not exhaustive. Reporting entities must apply professional judgment and report suspicious activity in accordance with NORUT. For the current list of High-Risk Jurisdictions (HRJs), visit the FIU Curaçao website.
FIU CURAÇAO TERRORIST FINANCING AWARENESS SERIES
TF RED FLAGS 21–26 OF 26
Strengthening Prevention Through Risk Awareness
TF Red Flag #21 – Unusually Large Cash Withdrawals
Indicator
The customer makes unusually large cash withdrawals, particularly following a refusal by the financial institution to process an overseas fund transfer, potentially signaling cross-border cash smuggling.
Why It Matters
Large withdrawals after blocked transfers may indicate an attempt to move funds physically to support terrorist financing activities.
Reporting Reminder
Such transactions should be monitored closely, and any suspicion should be reported immediately.
TF Red Flag #22 – Transfers Involving Sanctioned Entities
Indicator
Fund transfers involve entities that are subject to international or EU sanctions.
Why It Matters
Engagement with sanctioned entities carries a high risk of facilitating terrorist financing or breaching sanctions obligations.
Reporting Reminder
Transactions to or from sanctioned entities must be reported and blocked in accordance with applicable legislation.
TF Red Flag #23 – Transfers Involving Entities with Known Terror Links
Indicator
Fund transfers involve entities that, while not formally sanctioned, are known to be sympathetic to or linked with terrorist groups.
Why It Matters
Even unsanctioned entities can serve as conduits for terrorist financing or logistical support.
Reporting Reminder
Enhanced due diligence and timely reporting are required when such connections are suspected.
TF Red Flag #24 – Transfers via Informal Financial Channels
Indicator
Fund transfers are conducted to or from individuals or entities operating in the informal financial sector, such as Hawala systems.
Why It Matters
Informal channels often operate outside regulatory oversight, making detection of TF activity more difficult.
Reporting Reminder
Transactions involving informal systems should be carefully reviewed, and suspicious activity reported without delay.
TF Red Flag #25 – Use of Money Remitters Without Apparent Links
Indicator
The customer uses money remitters to send or receive funds to high-risk jurisdictions, where the sums are significant, or the customer has no apparent established link or provides no reasonable explanation.
Why It Matters
Such activity may indicate an attempt to move funds internationally without an obvious legitimate purpose, increasing TF risk.
Reporting Reminder
Enhanced review and reporting are required whenever the purpose or origin of funds is unclear.
TF Red Flag #26 – Use of Cash, Drafts, or Prepaid Cards Before Travel to High-Risk Areas
Indicator
The customer cashes bank drafts in foreign currencies, or uses travellers’ cheques or prepaid/open-loop cards, in areas where terrorist groups are active, nearby regions, or areas known to support terrorists. Vigilance is advised for withdrawals via open-loop cards from ATMs in these jurisdictions.
Why It Matters
Such activity may indicate preparation for travel-related terrorist financing or cash-based operations in high-risk areas.
Reporting Reminder
Monitor and report unusual patterns in cash, drafts, or prepaid card usage linked to high-risk travel.
Disclaimer:
These indicators are illustrative and not exhaustive. Reporting entities must apply professional judgment and report suspicious activity in accordance with NORUT. For the current list of High-Risk Jurisdictions (HRJs), visit the FIU Curaçao website.
FATF/CFATF
SANCTIONS
FIU Curaçao monitors and supports compliance with sanctions to uphold national security, financial integrity, and international obligations, including UN, EU, and other relevant measures.
NOTIFICATIONS
Stay informed with the latest updates, alerts, and important announcements. Check this section regularly for timely information on regulatory changes, sanctions and financial crime developments.