Governments, through their intelligence and law enforcement agencies, assess and prepare for terrorist activity based on the level of the risk or physical threat that terrorism presents. To address the risk or the threat, you have to understand the risk or the threat. Understanding the threat of terrorism can lead to detection, intervention, disruption and prevention. Truly understanding requires accurate and continuous risk assessment. No one is more cognizant of the risk assessment process than financial institutions. The cornerstone of every anti-money laundering (AML) compliance program is the risk assessment.

An AML risk assessment is designed to identify inherent risks. Once inherent risks are identified, you develop controls or control environments that will mitigate risk. The next step in the process is to identify the inevitable residual risk. Once residual risks are identified, you again determine the level of controls necessary to continue to mitigate the risk. In assessing the threat of terrorism from an AML perspective, you must first assess the overall threat of terrorism and then drill down and assess the terrorist financing risk. Terrorist financing should be considered a component of terrorism, and therefore, should be assessed in conjunction with the broader terrorism risk and mitigation strategies.

Specific inherent and residual terrorist risk factors are not financial institution risk factors. As a component of terrorism, terrorist financing risk factors should be considered after assessing the specific terrorist risk factors by drilling below the broader terrorist risk factors to identify the financial threats. However, it should be noted that inherent and residual mitigation measures will include specific financial disruption mechanisms.

The greatest immediate threat to the U.S. and our allies comes from jihadist terrorism or Islamist extremism. Islamism is a radical political ideology. It is extremely important to note that Islamism is separate from Islam as a religion. Islam is not the problem. Jihadist extremists who twist Islam and misinterpret it to fit their radical ideology present the problem. Core groups, most notably the Islamic State and al-Qaeda, their affiliate groups and grassroots jihadists who are influenced by these groups pose the threat. Groups like the Islamic State and al-Qaeda have been extremely adept at exploiting the internet for propaganda, fundraising, and most notably, recruitment. Disenfranchised and easily radicalized individuals, who become foreign terrorist fighters and homegrown violent extremists, have evolved into the most acute threat to the U.S. and its allies.

On April 18, 2017, in a speech at George Washington University, Center for Cyber and Homeland Security, Department of Homeland Security Secretary, John Kelly, discussed the threat of terrorism. Secretary Kelly made the following comments: “The threat to our nation and our American way of life has not been diminished. In fact, the threat has metastasized and decentralized, and the risk is as threatening today as it was that September morning almost 16 years ago. As I speak these words the FBI has open investigations in all 50 states…But the dangers don’t just come from overseas. Over the past few years, we’ve seen an unprecedented spike in homegrown terrorism. In the past 12 months alone, there have been 36 homegrown terrorist cases in 18 states. These are the cases we know about—homegrown terrorism is notoriously difficult to predict and control. And what’s feeding this homegrown violence? Most experts agree a major contributor is the internet.”¹

Secretary Kelly’s remarks underscore the fact that over the past several years, the terrorist threat environment facing the U.S. and its allies has evolved into something more dangerous and complicated than ever before. It points to the threat evolution of homegrown violent extremists. In order to disrupt, diminish and ultimately prevent the threat of homegrown violent extremism, we must fight the threat of terrorism through sustainable tactical and strategic strategies. Sustainable tactical and strategic strategies require establishment of meaningful public-public and public-private partnerships.

We must establish and maintain tactical measures to thwart terrorist attacks. Tactical measures include:

• Public sector intergovernmental offensive and defensive activities to include military action, diplomatic engagement, intelligence operations, law enforcement investigations and sanctioning actions
• Public and private sector capacity building initiatives to assist at-risk countries build good governance systems and to fight corruption
• Public and private sector financial disruption activity through disrupting the funding flows to and from terrorist organizations. This is where financial institutions, and more broadly the financial services industry, play a significant role

We must establish and maintain strategic measures to counter the extremist radicalization that fuels its hatred and violence and undergirds its strategy and global appeal. Strategic measures include:

• Public and private sector community outreach and vigilance to identify and interdict individuals at risk for radicalization
• Public and private sector propaganda strategies using social media and internet communications to dispel and counter the appeal of radicalization
• Public and private sector strategies to prevent radicalization, promote intervention and reintegration

The foundation for developing meaningful and sustainable tactical and strategic strategies is to understand the risk factors. You understand risk factors through risk assessment and analysis. From an AML perspective, you identify the inherent risk factors, risk mitigation of the inherent risk factors, residual risk factors and risk mitigation of the residual risk factors. For Islamic terrorism the inherent risk factors include: sectarianism, ideology, lack of governance, corruption and convergence. The residual risk factors include adaptability, capacity and reach.

Inherent and residual risk factors for Islamic terrorism do not contain direct financial threats. The financial threats are indirect. This is one of the reasons why terrorist financing is a component of terrorism. From an AML perspective, this is also one of the primary considerations as to why terrorist financing is so difficult to identify. Developing tactical and strategic Islamic counterterrorism strategies begins with assessing and understanding terrorist risk factors starting with inherent risk factors. Tactical strategies will be more tangible, while strategic strategies will be more intangible.

There are a variety of inherent risk factors that merit consideration. Five fundamental inherent risk factors include:

1. Sectarianism: Sectarianism goes back thousands of years. It goes back to the death of the Prophet Muhammad in the year 632. It is rooted in the divide between Sunni Muslims and Shiite Muslims about who was the rightful successor to Muhammad. Through the years, the sectarian divide between Sunnis and Shiites has grown and has led to significant fighting, chaos and instability in the Arab world.
2. Ideology: Islamist ideology is an extreme radical interpretation of Islam that has been adopted by Islamic terrorist groups to justify their violent tactics and political quest to establish a caliphate.
3. Lack of governance: The lack of governance in many countries is caused by factors to include the Sunni and Shia divide and corruption. The lack of governance creates crisis and chaos, which serve as an incubator for the growth of terrorist groups and transnational criminal organizations.
4. Corruption: Corruption contributes to a lack of governance and a loss of trust. When the public does not trust the government there is a lack of governance, which fosters sectarianism and enables the growth of terrorism and transnational criminal activity.
5. Convergence: The convergence of terrorist groups and transnational criminal organizations has proven to be extremely profitable for both. By forming hybrid terrorist and criminal organizations, these groups have been empowered and have developed lucrative funding streams, especially in countries with poor governance.

Each of the five inherent risk factors build on each other to enhance the risk of Islamic terrorism. The tactical mitigation strategies to address the inherent risk factors should first be focused to operationally contain the physical threat of terrorism. It should then lead to disruption, and ultimately, to prevention, in tandem with strategic strategies.

There should be two prongs to the tactical mitigation strategy. The first requires public sector interagency collaboration to continue to contain and disrupt the threat of terrorism through military, diplomatic, intelligence, law enforcement and sanctions operational counterterrorism measures. The second prong requires public and private sector collaboration to disrupt and prevent the flow of funds to and from terrorist organizations, operations and operatives. This is where financial institutions play a pivotal role.

Strategic mitigation strategies should also be two pronged. Both prongs require public and private sector partnerships. The first prong should involve public and private sector collaboration to counter the propaganda used by terrorists on social media and through internet communications for recruitment. The second prong should involve diverse community outreach to identify at-risk individuals and to interdict those who fall prey to jihadist recruitment. This requires vigilance, intervention and ultimately the reintegration of at-risk individuals back into the community.

There are two primary Islamic terrorist residual risk factors, which are:

1. Adaptability: All terrorists, including Islamic terrorists, have demonstrated the ability to be adaptive. As the public and private sector assess risk, terrorists assess counterterrorism tactics and adapt their operations to avoid detection and disruption. They also seek to continuously identify systemic vulnerabilities they can exploit in order to sustain the threat they pose.
2. Capacity and reach: Islamic terrorist groups evolve or devolve as their capacity and reach change. For example, the Islamic State evolved into an organization with a supposed caliphate, which provided barbaric governance. As the caliphate collapses, the Islamic State will devolve from a structured organization to an insurgency. Their capacity to govern will cease but their ability to wreak havoc will continue to some extent. Through homegrown violent extremists and other mechanisms, they will strive to establish greater reach by causing attacks in the U.S. and allied nations.

To address the residual risk, both the tactical and strategic mitigation strategies should continue to follow their two-pronged approaches. Terrorists will be more adaptive to tactical counterterrorism initiatives. Therefore, from a tactical counterterrorism perspective the response should be more vigilant and flexible to adjust to the adaptations of the terrorists. As Islamic terrorist groups, most notably the Islamic State, see their physical presence in Iraq and Syria diminish, they are more likely to push outward on the internet to intensify recruitment of homegrown violent extremists. Between foreign fighters returning to their homelands—from Iraq and Syria—and the ongoing recruitment of homegrown violent extremists, the Islamic State will encourage them to commit terrorist acts in their home countries. Thus, it is critically important that strategic counterterrorism initiatives intensify to identify, interdict and disrupt the radicalization process.

The ultimate goal of counterterrorism initiatives is to eliminate the threat of terrorism. Unfortunately, that will never happen. With respect to Islamic terrorism, especially with the serious sectarian divide between Sunnis and Shiites, it is extremely unlikely that we can eliminate the inherent and residual risk factors. However, we can work toward detection, intervention, disruption and prevention. To accomplish this, we must understand the enemy, their perspective and the risks they pose. As part of this process, we must identify and understand the flow of funds to and from terrorist organizations. This should emphasize the importance of financial intelligence and the risk assessment process.

Understanding the terrorist threat should lead to the development and implementation of effective tactical and strategic containment and disruption strategies. These initial strategies are mostly reactive strategies that can be built upon. This is the juncture where public-public and public-private partnerships play a meaningful role. This is where collaboration leads to the development of more proactive strategies that leverage the capabilities and capacity of public and private partners. This will allow us to evolve from reactive containment and disruptive strategies to reactive and proactive disruptive and preventive strategies. We may never be able to eliminate the threat of terrorism, but we can disrupt and prevent terrorist attacks from occurring. It is a daunting task that begins with understanding risk. 

Dennis M. Lormel, CAMS, internationally recognized CTF expert, president & CEO, DML Associates LLC, Lansdowne, VA, USA, dlormel@dmlassocllc.com

For more information on how to identify and mitigate terrorist financing, please visit http://www.acams.org/counter-terrorist-financing-training/.

1. “Home and Away: DHS and the Threats to America, Remarks Delivered by Secretary Kelly at George Washington University Center for Cyber and Homeland Security,” U.S. Department of Homeland Security, April 18, 2017, https://www.dhs.gov/news/2017/04/18/home-and-away-dhs-and-threats-america