The Financial Crimes Enforcement Network (FinCEN) is issuing this advisory to provide financial institutions with information on identifying and reporting transactions possibly associated with Foreign Terrorist Fighters (FTFs) who support the Islamic State of Iraq and the Levant (ISIL), al-Qa’ida, and their affiliates in Iraq and the Lev ant region. Financial institutions may use this information to enhance their Anti-Money Laundering (AML) risk-based strategies and monitoring systems. This advisory is not intended to call into question financial institutions’ maintenance of normal relationships with other financial institutions, or to be used as basis for engaging in wholesale or indiscriminate de-risking practices.
…
Activity Possibly Associated With FTFs
Once recruited, FTFs seek to travel to areas where ISIL, al-Qa’ida, and their affiliates operate, such as Iraq and the Levant region. Accordingly, financial activity of FTFs may reflect transactions related to their travel preparations and arrangements, departure, in-transit period, and arrival and presence in the conflict zone.
FTFs may use diverse methods to disguise their finances or intentions. When determining whether transactions may be related to the financing of an FTF, financial institutions should consider multiple factors in addition to the red flags identified in the next section below, including:
• Deviation from a customer’s normal activity;
• Source of funds;
• Available information on the purpose of transactions;
• Publicly available information; and
• Whether a customer exhibits several of the red flags mentioned in this advisory and/or in FinCEN’s May 2015 non-public advisory on ISIL financing.
With respect to publicly available information, for instance, ISIL and other terrorist organizations are known to be active on social media sites. Financial institutions may find available social media information helpful in evaluating potential suspicious activity and in identifying risks connected to the red flags provided in this and other advisories. Similarly, the location from which a customer logs into a financial institution’s online services platform may also be considered when determining whether a transaction is suspicious (see next section).
…
In applying the red flags below, financial institutions are advised that no single transactional red flag is a clear indicator of terrorist activity. Financial institutions should consider additional factors, such as a customer’s overall financial activity and whether he or she exhibits multiple red flags, before determining a possible association to terrorist financing and FTFs. Financial institutions should also refer to the red flags and other information provided in this an d the May 2015 non-public advisory to formulate a more comprehensive assessment of potential suspicious activity.
Depending on their products and services offered, financial institutions may be able to observe one or more of the following red flags. Some of these red flags may be observed during general transactional screening, while others may be more readily identified during in-depth case reviews.
Activities Prior to Departure: Prospective FTFs make typical financial and logistical preparations prior to traveling. Transactions associated with FTFs may include:
Purchasing goods at camping or survival stores;
Purchasing first-person shooter games or engaging in combat training-type activities;
Purchase of airfare and payment of travel related fees (e.g., visa fees) involving countries in Europe or countries near or adjacent to ISIL-controlled areas—including Cyprus, Egypt, Greece, Jordan, Lebanon, and Turkey;
Establishing lines of credit and taking out personal loans where no loan repayments are made;
Liquidating personal assets, including retirement accounts/plans, and obtaining life insurance policies;
Receiving funds from or sending funds to seemingly unrelated individuals who are located near cities with a reported ISIL/al-Qa’ida-presence, where the transactions do not appear to have a lawful business purpose. These seemingly unrelated individuals may share common or similar addresses, telephone numbers, or other identifying information; and
Customers with minimal activity before ISIL’s expanded operations (early 2014) now showing inflows from unknown origins followed by fund transfers to beneficiaries (or ATM withdrawals) in Iraq, northeastern Lebanon, Libya, southern Turkey, or Syria.
