Unpacking Treasury’s 2024 National Terrorist Financing Risk Assessment

The NTFRA is the first step in implementing the risk-based approach (RBA) required by the Financial Action Task Force (FATF), which sets international standards for laws aimed at countering the financing of terrorism (CFT). FATF’s Recommendation 8 (R.8) on NPOs requires outreach to NPOs in the risk assessment process and an assessment of how existing laws and measures mitigate risks. The FATF standard states that the measures adopted by governments as a result of the risk assessment process should be proportionate to actual risk and not disrupt the activities of legitimate NPOs. The standard requires countries to conduct outreach to NPOs as part of the risk assessment process. R.8 and its Interpretive Note (INR) and the accompanying Best Practices Paper on Combatting the Terrorist Financing Abuse of Non-profit Organisations (BPP) was most recently revised in Nov. 2023. These revisions made a number of significant changes, including

• An update to R.8’s objective and scope; 
• Ensuring that risk assessments are truly evidence-based to understand real rather than perceived risks, including consultation with and evidence from the NPO sector to understand the risks;
• Highlighting the need for States to take NPO’s self-regulatory measures into account; 
• Integrating “bad practices” into the BPP on what States should not do in implementing the standard, which is seen as a significant milestone and has already been recommended to replicate across other processes;
• Emphasizing that countries’ measures to mitigate anti-money laundering (AML)/CFT risks must be truly proportionate, risk-based, and focused.

Of significance, in Jul. 2024, FATF held a public consultation to solicit input on their National Risk

Assessment (NRA) guidance. The Global NPO Coalition on FATF, co-led by the Charity & Security Network (C&SN), contributed to this submission. 

Treasury held one outreach meeting with NPOs to solicit input ahead of publication of the 2024 NTFRA. From a historical perspective, Treasury held discussions with NPOs prior to publication of the 2022 and 2018 NTFRA but not the 2015 NTFRA. The NPO community inquired about further opportunities for input, and we were only invited to submit this in writing. 

C&SN Recommendations to Treasury Ahead of Publication of the 2024 NTFRA

In Dec. 2023, C&SN submitted comments and suggestions to Treasury laying out recommendations for the 2024 NTFRA. The letter highlighted key issues stemming from CFT measures that continue to confront NPOs as they work to implement humanitarian programs, as well as peacebuilding and human rights work. The recommendations C&SN proposed to address these issues include the following:

• The emphasis that the issuance of UNSCR 2664 and the U.S. Treasury’s new and amended baseline general licenses do not equate to a greater risk of diversion.
• Our sector is susceptible to disinformation attacks. Treasury and the financial sector should be aware of this dynamic, and Treasury should encourage financial institutions to conduct proper due diligence to avoid reliance on disinformation.
• Address financial access barriers for NPOs by making enforcement standards consistent with the risk-based approach.
• Include nuanced language around threats to the NPO sector, including specific language that the vast majority of the NPO sector is not at risk of terrorist financing.

C&SN appreciates the Treasury Department’s continued engagement with NPOs ahead of publication of their biennial NTFRAs.

Participants & Methodology

The 2024 NTFRA incorporated input from the following U.S. government (USG) agencies, in addition to the Department of the Treasury, whose Office of Terrorist Financing and Financial Crimes (TFFC) authored the report:

• Department of State (DOS);
• Department of Justice (DOJ);
• Department of Homeland Security (DHS);
• The Office of the Director of National Intelligence’s (ODNI) National Counterterrorism Center (NCTC). For reference, the ODNI alongside the Central Intelligence Agency (CIA), are independent agencies within the 18 organizations comprising the S. Intelligence Community;
• Federal Functional Regulators staff.

The concepts used to approach the 2024 NTFRA include: Threats, Vulnerabilities, Consequences, and Risks.

Additionally, Treasury notes they incorporated analysis from a number of relevant sources, including NPOs and the FATF. A deeper look into the 145 citations used, however, reveals that the overwhelming majority of sources come from the USG, followed by fewer sources coming from FATF and the United Nations (UN). Fewer still come from think tanks, legal documents/case law, blockchain datasets, and news outlets. There is only one NPO citation, and this comes from the Anti-Defamation League (ADL), which is concerning as the ADL has been widely criticized for promoting Zionist, anti-Palestinian sentiments; conflating support for Palestine with anti-semitism; and deemed “an unreliable source” by Wikipedia’s editorial team. C&SN is disappointed in Treasury’s use of such an unreliable source and calls on Treasury to utilize the wealth of reliable NPO resources publicly available. As a resource center, C&SN houses many such publications. 

Threats

The 2024 NTFRA “identifies the TF threats, vulnerabilities, and risks the United States faces.” It highlights that while “terrorism” remains the largest threat to the U.S., “the primary terrorism threat to the homeland comes from individuals in the United States who are inspired by [al-Qa’ida] AQ, the [Islamic State of Iraq and Syria] ISIS, or domestic violent extremist (DVE) ideologies and who seek to carry out deadly attacks without direction from a terrorist group”. DVE groups and movements, especially “racially and ethnically motivated violent extremists (RMVE)” who are “driven by a belief in the superiority of the white race”, have grown “to become one of the most serious terrorism threats facing the United States” over the past ten years. These echo findings from the 2022 NTFRA. Internationally, the greatest terrorism threat “comes from ISIS-inspired affiliates that seek to attack the United States, its citizens, and its interests”.

RMVE has gained particular traction in the last few years and there are valid concerns about its potential misuse outside of a U.S. context. Caution must be taken to avoid applying, as Nicholas Miller, senior legal advisor at the International Center for Not-for-Profit (ICNL) law, states, “a US-centric lens that promotes integrating RMVE in international standard-setting without considering or accounting for the way it will be applied or the effects it will have in different country contexts.”

Vulnerabilities

This section discusses person-to-person (P2P) payments, banks, cash, virtual assets, unregistered money transmission, registered money services businesses (MSBs), and NPOs, and the vulnerabilities and risks they face due to TF. 

NPOs & Charities

Similar to the last NTFRA, this latest iteration makes a number of key points that highlight its commitment to taking an RBA and incorporating proportionality into its assessment of NPOs’ terrorist risk vulnerabilities. For example, as noted above, the 2024 NTFRA builds on findings from the 2022 NTFRA wherein “the U.S. government acknowledges the continued practice of many charitable NPOs to apply internal risk-mitigation measures, including due diligence, governance transparency, accountability, and other compliance measures, including when responding to crises.” Further, the 2024 NTFRA highlights that of all U.S.-based NPOs, “only a small subset of charitable NPOs with an international presence are vulnerable to TF.” It also notes that NPOs who operate in areas deemed “high-risk” as partners to the United States Agency for International Development (USAID) undergo “additional vetting measures by USAID”.

C&SN welcomes the 2024 NTFRA’s inclusion of the challenges that NPOs continue to face in regards to de-risking and financial access, even with Treasury Department’s Dec. 2022 new and amended baseline General Licenses (GL)s, which aimed to “standardize humanitarian-related authorizations across U.S. sanctions programs”. This underscores that when NPOs lose access to financial relationships and services, they are forced to operate in payment channels that are less-regulated; the irony is when NPOs are forced to operate in this way, their risk for TF may increase.

While operating outside of regulated financial channels is a means of last resort for most NPOs, FATF’s updated Nov. 2023 BPP notes that there a number of conditions, including de-risking, in which “NPOs may have no other choice than to use unregulated financial or payment channels”. Similarly, the 2024 NTFRA finds that one of the key ways to reduce NPO’s TF risks is through “protecting and maintaining access to the banking system”. Finally, the RA lays out how misinformation campaigns weaponizing aid diversion narratives on authorized humanitarian activities have adverse impacts on NPO financial inclusion and access. While this inclusion is much appreciated, the 2024 NTFRA could have gone a step further in specifying which “certain NPOs” experience this targeting most acutely – such as Muslim NPOs and charities and Palestinian civil society organizations (CSOs).

NTFRAs from Inception to Present: A Brief Overview on NPO Language

This section aims to give a brief and non-exhaustive overview of the evolution of language on NPOs from NTFRA inception in 2015, to present.

2015 – 2024

From 2015 – 2024, the NTFRAs (2015, 2018, 2022, and 2024) have all made similar assessments and conclusions regarding the U.S. NPO sector: that the majority of NPOs pose little to no TF risk. Likewise, all four NTFRAs acknowledge that NPOs enact self-regulatory, due diligence, and risk mitigation measures to reduce their risk of TF and to ensure aid flows are safe, transparent, and accountable.

2022

It is not until the 2022 NTFRA that Treasury notes NPOs experience “financial access challenges”; it is worth noting this is five full years after C&SN published its 2017 landmark Financial Access for U.S. Nonprofits report, highlighting many of these issues. Financial access challenges faced by NPOs are also echoed in the 2024 NTFRA. The 2022 NTFRA is also the first time Treasury included language acknowledging that USAID partners working in areas deemed “high risk” undertake additional measures to uphold U.S. sanctions compliance, including both requirements surrounding risk mitigation and due diligence, and supplemental vetting measures. This was also echoed in the 2024 NTFRA.

2024

Notably, 2024 is the first time the risk assessment acknowledged de-risking and misinformation campaigns, and how these negatively impact NPO operations and access to financial services. De-risking is the phenomenon where banks restrict or exit banking relationships, thereby choosing to avoid, rather than manage, risk. Despite NPOs highlighting the de-risking challenges they face for many years, including to Treasury, the inclusion of de-risking is likely due to, instead, Treasury’s Apr. 2023 publication of their inaugural De-risking Strategy. Misinformation campaigns consist of information that has inaccuracies and falsities. C&SN is grateful to Treasury for the inclusion of misinformation campaigns against NPOs, and, as included in our comments to Treasury, hopes that disinformation campaigns can also be included moving forward, as the latter includes the “deliberate efforts to spread false information” that NPOs face.

Encouragingly, the 2024 NTFRA also made fundamental shifts in how it addresses “sham charities” vs. “legitimate charitable organizations” by including welcome language that clearly distinguishes between the two: “TF risk presented by NPOs primarily arises in the context of sham charities, as distinct from legitimate charitable organizations” [emphasis added]. This is the first NTFRA that makes this important distinction. This is vital for accurate classification and for financial service actors to understand and integrate within their approach to servicing the NPO sector. C&SN is appreciative to Treasury for this important shift.

Recommendations for Future NTFRAs

Treasury, despite its progress in distinguishing between “sham charities” and “legitimate charitable organizations”, should harmonize this distinction with how it measures the NPO sector’s overall TF risk. For instance, Treasury emphasizes their role in “identifying and designating sham charitable organizations, which reduced the overall TF risk of the NPO sector”. However, if “sham charities” are truly “distinct from charitable organizations” [emphasis added] as stated by Treasury, then the former should have no bearing on the outcome the NPO sector’s TF risk level, as these should be treated as two separate typologies. Further, the report lays out how “the most common form of charitable abuse by terrorist groups” are “[F]raudulent charitable appeals, without the involvement of a registered NPO”. Given these appeals are being implemented “without the involvement of a registered NPO”, then this should also carry no bearing on the overall TF risk level of the NPO sector.

Neither “sham charities” nor “fraudulent charitable appeals” should fall under “NPO sector” categorization, as neither are legitimate and, like Treasury, the NPO sector rejects both. Including these within the NPO sector conflates the two entities and categories, and thus, the rightful TF risks associated with “sham charities” and “fraudulent charitable appeals” are being wrongfully misplaced on legitimate “charitable organizations”, thus driving up the overall NPO sector’s TF risk. This does a disservice to NPOs, who have sophisticated means to prevent TF; have established and trusted relationships in the communities they serve; and are experienced in navigating high compliance standards in complex sanctions and AML/CFT regulations. 

Conclusion

The 2024 NTFRA showed Treasury’s commitment to upholding the RBA throughout, reiterated that most U.S.-based charitable organizations are at little to no risk of TF abuse, made important shifts on “sham charities” vs. “legitimate charitable organizations”, and included important concerns surrounding financial access, de-risking, and misinformation campaigns. These findings should encourage Treasury to continue enhancing the proportionality of CFT measures. C&SN is appreciative of Treasury’s continued engagement with NPOs and encourages Treasury to continue this progress in a meaningful and impactful way.