another try by Flo

Partnership against Crime and Terrorism Project in the Western Balkan (WB PaCT)

Guideline on "Good Practices in Countering Terrorism Financing in the Western Balkans" Author Shaun McLeary With the support of Dr Lajos Korona

DISCLAIMER

This document has been produced with the financial assistance of the European Union however it reflects the views of the authors and the participants within the initiative. The views expressed herein do not reflect the official opinion of the European Union or the Western Balkans project beneficiaries.The present document reflects the views expressed in the context of four workshops held in Sarajevo, (12 - 13 October 2022) and Budapest (31 May - 02 June, 19- 20 September and 15- 16 November 2023) among law enforcement officials of the Western Balkans beneficiaries. The views expressed herein are those of the participants.This document is intended for internal use within CEPOL and the beneficiaries for the development of the training materials and shall be only reproduced or disseminated with the expressed consent of all.This guideline can help law enforcement officers to develop their skills and knowledge on how to detect, investigate, and prosecute terrorist financing.CEPOL’s support is aligned with the Joint Action Plan on Counter-Terrorism for the Western Balkans, specifically Objective 4, which focuses on enhancing capabilities to combat money laundering and terrorism financing. In this context, CEPOL is bolstering the capacity of partners in the Western Balkans to undertake actions in this critical area. This involves providing the necessary training, resources, and support to enable the partners to effectively address the challenges posed by money laundering and terrorism financing. This commitment underscores CEPOL’s pivotal role in the capacity building in regional counter-terrorism efforts and its dedication to fostering a safer and more secure Western Balkans region.

DISCLAIMER

CONTENT1. Acronyms..................................................................................................................................................52. Introduction..............................................................................................................................................63. Methodology.............................................................................................................................................74. General Good Practices Identified…….………….………………………………………………………..95. Thematic areas.............................................................................................................………...…….…115.1 Cooperation with the Financial Intelligence Unit…………..………………………………….............115.2 Cooperation with the private sector…….………………………………………………………………125.3 Abuse and Exploitation of non-profit organisations….………………………………………….........145.4 Risks emerging from new technologies......….……………………………………………………...….155.5 Use of informal banking systems …………….…………………………………………………………206. Training and development of a curriculum…………………………………………………….……......226.1 Developing and delivering a CTF course in phases………………………………………………........226.2Learning outcomes………………………………………………………………………………………..226.3 Curriculum of the CTF Course……………………………………………………………………….…..267. Conclusions….……………………………………………………………………………………………..30

ACRONYMS

INTRODUCTION

There is no terrorism without finance therefore a financial investigation strategy should be incorporated into every counter terrorism (CT) investigation strategy. Financial investigators should be involved in all CT investigations using financial intelligence to assist the wider CT investigations. The strength of Financial Intelligence is illustrated by this sentence contained within the 9/11 Commission Report “Expect less from trying to dry up terrorist money and more from following the money for intelligence: as a tool to hunt terrorists, understand their networks, and disrupt their operations.”Financial information is one of the most powerful investigative and intelligence tools available. However, financial information alone is not enough to effectively combat terrorism. However, when combined with counter-terrorist intelligence, surveillance, intercept, sources etc. financial information is a very powerful tool and can enhance capacity to identify and intercept terrorist activity. Financial investigation may provide material of use in all types of investigations, including those with no obvious link to money or assets. This is possible because most people have some kind of property, money, or assets, and use service providers. Many also use electronic means of payment and banking instead of cash. This development has created sources of information that can reveal details about a person’s life, activities, interests, associates, plans, and desires, all of which can be used to detect and combat terrorism and crime.

METHODOLOGY

The Counter Terrorism Support Network (CTSN) established by the CEPOL Western Balkans Partnership against Crime and Terrorism project (WB PaCT) is providing a connection between operational and training personnel in the area of counter terrorism in the Western Balkans. Due to the needs in the region, the CTSN is looking into the area of countering terrorism financing (CTF). The network members decided to identify the good practices through discussing CTF case studies as an effective way to promote learning, critical thinking, and knowledge sharing among law enforcement professionals.The CTSN members discussed and identified the following areas to examine to establish good practices:1. Cooperation with financial intelligence units (FIU)2. Cooperation with the private sector3. Abuse and exploitation of Non-profit organisations (NPO)4. Risks emerging from New Technologies5. Use of informal banking systems6. Financing of right-wing terrorismThe representatives from all WB beneficiaries delivered a presentation detailing a case study that implemented the format agreed at the earlier CTSN workshop. The format being:

METHODOLOGY

Introduce the case study and provide background information about the organization/s involved in the case. Briefly describe the context of the investigation and the significance of the issue. If possible try and identify cases (CTF or FTF) that have a connection with the six areas discussed by the CTSN.

Introduction

Describe the approach taken to investigate the terrorism financing activity, including any relevant regulations, laws, or international agreements. Explain the sources of information used and the investigative techniques employed. Evaluate evidences and discuss the strengths and weaknesses of different investigative approaches.

Approach

Present the results of the investigation and the impact of the solution. Provide any relevant data or metrics that demonstrate the effectiveness of the solution.

Results

Discuss any lessons learned from the case study, including what worked well and what could have been done differently. Analyse the effectiveness of the approach and solution, and identify any areas for improvement in future investigations.

Good practices

Summarize the main challenges

Challenges

METHODOLOGY

At the conclusion of the workshop, all parties agreed that there was no need to include a separate section dealing with the financing of right-wing terrorism. The rationale behind it was that the same financial skill set, legislation, investigatory powers, special investigative techniques, and good practices should be deployed against suspects involved in right-wing terrorism as would be deployed during all other TF investigations regardless of the motivations of groups or organisations that the suspect(s) are aligned to.The CTSN members identified that international cooperation and digital skills such as the use of OSINT research featured in all their case studies and was treated horizontally across all the thematic areas. A key factor in all the case studies was the value of building relationships at the international level and sharing information with partners, but there was also the recognition that international cooperation and obtaining evidence from overseas can prove challenging.With regards to the use of OSINT, this is the digital age, and every case study involved the terrorists using mobile phones and other digital media. It was accepted that evidence of a financial transaction on its own is seldom sufficient to prove a terrorist finance offence. However, coupled with the suspect(s) use of social media and a forensic examination of the mobile phone and other digital media may provide sufficient supporting evidence to enable a successful investigation and prosecution.The methodology transformed the identified good practices in CTF investigations into meaningful and measurable learning outcomes. This approach ensures that learners acquire the necessary knowledge, skills, and competencies to excel in the field of CTF investigations.Learning outcomes increasingly influence the definition and design of curriculum and the understanding and definition of the term curriculum itself. Therefore the subsequent learning outcomes were developed in a curriculum on the topic that will build the capacities of the WB in combating Terrorism Financing. The guideline was consulted internally within CEPOL and with relevant units within DG NEAR, DG HOME, EEAS and Europol.

GENERAL GOOD PRACTICES IDENTIFIED

All the representatives identified similar good practices in their respective WB beneficiaries during the workshop, and these included:

When commencing a terrorism finance investigation there should be clear aims and objectives which should be constantly reviewed as the intelligence and priorities change.

Early consultation with the prosecutor is vital so that clear guidance can be provided regarding the offences under investigation, the points to prove and evidential leads to be pursued.

To enhance intelligence sharing and coordination the establishment of a multi-agency team /working group should be considered at the outset. This should comprise representatives of the FIU, Police Investigators from the Counter Terrorism Bureau, National Intelligence Agencies, other relevant Law Enforcement Agencies, appropriate Government Departments and Prosecutors.

Building strong partnerships with financial institutions and the private sector is essential. Effective briefing and feedback will yield dividends for the current investigation and future investigations.

To corroborate and support information regarding suspicious financial transactions, consideration should be given to efficiently using the wide range of the special investigation techniques available to law enforcement.

GENERAL GOOD PRACTICES IDENTIFIED

These investigations can be time consuming and labour intensive so be patient and never underestimate the length of time the investigation will take. Teamwork is critically important so share duties and have the appropriate number of trained staff working on the investigation.

There should be no value threshold placed on investigating a specific transaction. Every transaction in a TF investigation should be investigated to understand the story that transaction tells you. Does that transaction enable the investigator:

1. to locate or identify suspects or witnesses; 2. to identify associations and links to people and places; 3. to identify criminality; 4. to identify the use of other services such as phones, etc.; 5. to identify evidential opportunities; 6. to provide disruption opportunities; 7. to identify threats.

THEMATIC AREAS

1. Cooperation with the Financial Intelligence Unit FIUs were established for the purpose of collecting and analysing reports filed by the regulated sector of suspicious transactions and other information relevant to preventing and detecting the financing of terrorism, money laundering and associated predicate offences. FIUs study the information received in the notification, such as account opening documents (authorized account signatories, postal addresses, power of attorney, ownership of the company, members of its board of directors, type of business activity), account statements (transactions and their nature), transaction records (the beneficiary, the sender, how the process was carried out as well as where it was done and who did it). FIUs obtain additional information related to the suspicious activity and the suspect mentioned in the notification directly through accessing databases available to it under the memoranda of understanding concluded between the FIUs and the various authorities, in addition to the official correspondence. The FIUs also contact counterpart FIUs in other jurisdictions as well as with other WB beneficiaries, if needed, to obtain information regarding the suspicious case under review. After the completion of the information collection, evaluation and analysation process, a decision is made whether the notification will be referred to the competent authority or not.

THEMATIC AREAS

Suspicious Transaction Reports (STRs) provide information and intelligence to law enforcement which is predominantly used in relation to terrorist finance, money laundering and financial crime, but can also be helpful in relation to other criminal activity. They provide information that assists in ongoing operations such as telephone numbers, addresses, alias identities, companies, investment activity, bank accounts and other assets. STRs can help identify typologies enabling detection and prevention activity including the issue of alerts to businesses at risk from such activity. Multiple STRs on the same subject or company can identify new targets for operational activity. STRs provide intelligence about criminal methods. At a strategic level STRs data can inform policy and direct resources, particularly amongst LEAs. STRs can help establish a geographical picture or pattern of the vulnerability of a particular sector or product and can also be used in the analysis of suspicious activity before and after a specific event e.g., a terrorist incident. FIUs have an important role to play in the countering of terrorist finance:

engagement between public and private sectors;

detecting the indicators of terrorist financial activity;

analysing the methodologies used for terrorist finance;

identifying the vulnerabilities in financial products and systems;

producing and distributing terrorist finance typologies.

THEMATIC AREAS

STRs have a number of potential uses, not least a key intelligence role:

initiate investigations;

augment existing intelligence and provide context;

not always apply solely to financial cases;

employed in broader terrorist investigations;

initially, STRs may be not linked to terrorist financing.

Cooperation with the FIU – good practices identified:

In all CT investigations it is recommended that investigators should make full use of the FIU access to the various domestic databases at their disposal and internationally through Egmont channels where appropriate.

In consultation with the prosecutor, the investigators should at an early stage seek to convert the information provided by the FIU into evidence.

2. Cooperation with the private sectorPartnership and information sharing are key in tackling terrorism. Although financial institutions lack information that can enable them to identify terrorists, they have information that can be vital in finding terrorists. States cannot expect the private sector to have a better idea of what terrorist financing looks like than the states themselves.

THEMATIC AREAS

You don’t know what you don’t know nor where the investigation will take you so working within the parameters of your domestic legislation cast your net wide and do not operate with tunnel vision. Providing the private sector with risk profiles, emerging trends, and typologies, both domestic and international, is essential. Money Service Businesses (MSBs)The larger MSBs (such as Western Union, MoneyGram, Ria) have liaison officers who act as a point of contact for law enforcement inquiries. MSB records are maintained for a specified time period and the Law Enforcement Liaison officer(s) have access to all records globally. Whereas, if you make an enquiry of the local agent where the transaction occurred that agent only has the information for the sender from that agent location. The local agent does not see the receiver’s details and is not able to see transaction data from any other agent. Any original documents, images and video are retained by the local agent(s) and the retention and release policies vary.Searches can be undertaken on one or a combination of the different selectors such as: name, date of birth, address, email address, money transfer control number, telephone/mobile number, ID number or IP address.

THEMATIC AREAS

Searches can be targeted to a specific date(s), agent location or jurisdiction (city/country). Generally, the Law Enforcement liaison officer(s) can share the following information without a judicial order:

confirm/deny the existence of records;

regulatory reports (depending on jurisdiction);

when/where/how money was sent and received;

fraud reports (when victim has consented their release);

exigent - threat to life or high-risk event: information will be shared but must be followed by a judicial order within 48 hrs and requires management approval.

Data available on both the sender and payee following receipt of a judicial order and can be used in evidential proceedings. Money Service Businesses – good practices identified Whenever investigating a transaction involving an MSB, investigators and prosecutors should make an enquiry with the company’s law enforcement liaison officer to obtain all sent and received global transactions linked to the suspect rather than the single transaction that can be provided by the local agent.

THEMATIC AREAS

3. Abuse and Exploitation of non-profit organisations FATF defines an NPO as: “A legal person or arrangement or organisation that primarily engages in raising or disbursing funds for purposes such as charitable, religious, cultural, educational, social or fraternal purposes, or for the carrying out of other types of “good works”. NPOs are vulnerable to exploitation and abuse by terrorists and terrorist groups for the following reasons:

high levels of public trust in the sector due to its voluntary and altruistic nature;
have a global presence and framework often in conflict areas –move money, goods and people in and out;
operate in conflict zones with little or no infrastructure;
have complex global financial operations – multiple donors and currencies – may use cash, various payment platforms and alternative remittance systems;
pass funds to other organisations rather than deliver services directly;
subject to lower and inconsistent levels of regulation internationally.

Some of the challenges when conducting an investigation relating to the use of NPOs include:

cash intensive, operating in conflict zones or areas with little infrastructure;
international assistance is required to evidence foreign transactions;

THEMATIC AREAS

difficulties in identifying end use of funds to an evidential standard;

circular payments between individuals and organisations complicating the direct flow of funds.

The financial abuse of NPOs by terrorists may take different potential forms:

Raising funds in public collections in the name of NPOs generally, or for a named NPO for charitable causes such as a humanitarian relief campaign or following a natural disaster. These funds are then diverted away from the NPO and used for criminal and terrorism purposes. This may happen without the knowledge of the NPO.

Establishing a charity for the purpose of providing cover for channelling funds for the purposes of terrorism, directly or indirectly.

Where an NPO’s funds are being moved from one place to another, or in different forms, for example, through international currencies or through cash transfers, internationally, that may be diverted before reaching the intended recipients.

An NPO may be used to launder money.

Cash may be transported in a way that looks legitimate under the name of an NPO and charitable causes so its transportation may be less likely to be questioned or challenged.

Recipients of charity funds, whether partners or individuals, may misuse the money they have been given for terrorism purposes.

THEMATIC AREAS

Use of non-profit organisations - good practices identifiedWhen carrying out an investigation that involves the use of NPOs, investigators should seek to obtain the following:

Annual Returns – the annual report compiled by the legally responsible person, bank account information, financial accounts and what the NPO declare they have done in the last year.

Details of the legally responsible person –including contact information.

The Statute detailing charitable objects and area of operation.

Investigators should consider working with the supervisor of the NPOs as they may have additional information and may be able to assist with the following:

Adverse case history -Details of our dealings with the charity in relation to compliance issues.

Advice & Guidance - rules for registration, annual accounts & returns etc.

4. Risks emerging from new technologies. CryptocurrencyBitcoin uses public key cryptography. Public key cryptography uses a pair of keys - a public key, which can be publicly shared and a private key, which is only known by its owner.

THEMATIC AREAS

A public key when referenced to cryptocurrency operates like an email address.A private key when referenced to cryptocurrency operates like a password. If you want to send cryptocurrency to someone else, you ask them for their address. A cryptocurrency address is simply a cryptographic hash of the public key associated with that address. The cryptocurrency value is stored in wallets and these wallets come in a variety of formats. It should be noted that no physical coin is stored within the wallet, but the value is stored within the private key.Paper, these contain a physical print of the public key and the associated private key.

Physical devices such as a Ledger or Trezor. The users’ private keys are stored on a physical device that’s protected against attacks and viruses. With the help of proprietary apps or browser add-ons, the private key never leaves the device.

App/software that is stored on a persons’ mobile phone, laptop, or other media device. The above three formats are typically known as self-custodial.

Custodial wallet. The fourth type of wallet is with an online service such as an exchange like Coinbase or Binance. These services differ to the previous type as the exchange holds both the public and private keys and are known as custodial wallets. Exchanges may also hold additional data which can assist an investigation.

THEMATIC AREAS

Most cryptocurrencies like Bitcoin use a blockchain to store their transaction records. At its most basic a blockchain is a growing list of records called blocks that are securely linked together using cryptography. What makes the blockchains of many cryptocurrencies unique from Traditional Bank ledgers is that the updates to these records are not handled by a single centralised authority. The additions of new records are handled by a decentralised network of independent computers called nodes. Unlike the records in a Traditional Bank ledger, the blockchains of most cryptocurrencies are technically immutable. Once a transaction is accepted by the nodes and recorded it cannot be changed or erased. Critical for investigations is that most blockchains have an associated public ledger. This means the complete history of every transaction is publicly accessible. Websites called blockchain explorers, make these public ledgers easily accessible and searchable.Blockchain analytics software leverages this public transactional history further to understand trends, define relationships, assign attributions, and ultimately identify key information about the real-world users or services behind the addresses. There are several commercial companies such as Chainalysis, Elliptic and TRM Labs are experts in Blockchain analysis whilst free and open-source tools can be used to trace ﬂows of potentially illicit funds.The investigative goal of “blockchain tracing,” generally, is to identify the actual controller of an otherwise pseudo-anonymous address.

THEMATIC AREAS

To do so, an investigator may be able to trace blockchain transactions and ﬁnd counterparty exposure with an entity or individual that can provide the identity of the beneﬁcial controller of an address. More simply, an investigator should follow the money to or from an entity that can provide real-world identity. One primary strategy for identifying the beneﬁcial controller of an address is to ﬁnd exposure to a Virtual Asset Service Provider (VASP), website, commercial or retail entity, or other third party that may require KYC information to use a platform. For example, a VASP usually requires a customer to provide personally identifying information to use the exchange. If an investigator traces the ﬂow of illicit assets to or from an address held at a VASP, the investigator may be able to secure the KYC documents from the exchange in order to identify the beneﬁcial controller of the illicit assets. The investigator should request not only KYC documents, but also: Account balances, Subscriber information, Email address association, IP address information, IMEI, Full transaction history, Device ID information, Identiﬁcation of associated accounts together with an omnibus “all records associated with the account and registrant including Fiat payment methods.

THEMATIC AREAS

Once an investigator has secured these records, the investigator may be able to pursue leads based on what was received from the VASP (e.g., email search warrants, IP lookups and seizure potential). Keep in mind that while the controller of the account may be the main subject, the named account holder could be a straw identity, a stolen identity, or a professional money launderer. After an investigator performs an initial query, they may be able to prioritize or deprioritize an investigation based upon several characteristics which become evident even in a preliminary search (e.g., number of associated entities, aggregate dollar amount, connections to compliant VASPs). The investigator can use a screenshot of the initial query results to explain the investigation’s potential to a supervising manager or prosecutor. When an investigator plots a transaction or entity into a blockchain investigation tool, the investigator should ﬁrst endeavour to understand the basic details of the transaction. The investigator will want to know:

How many transactions was the address involved in?

When were the most recent transactions?

How much value is held in the address?

Is the address part of a larger network of addresses?

Does the address have attribution as risk?

Does the address have exposure to a third party that keeps records or assets (either beneﬁciary, or sender)?

THEMATIC AREAS

By answering these typical questions, the investigator is trying to determine where in a potential network of transactions this transaction is afﬁliated and what the potential disruption measures are potentially available.Government agencies are split on the procedures and guidelines for restraining assets, holding assets, and disposing of assets. Prior to undertaking seizure and conﬁscation, it is advisable that the seizing agency consider:

What type of facility the government agency will use to custody the seized asset?

Who at the agency will have access to the value underlying the seized asset?

What form the agency will accept the seized asset?

What contingencies the agency will have if/when there are assets that present unique issues?

When/how/if the government will liquidate the asset prior to its ﬁnal disposition?

The type of custodianship of a seized virtual asset varies by venue and jurisdiction. Some agencies take immediate custody of an asset using an electronic wallet, some agencies take custody of an asset using a “hardware” wallet, some agencies use existing accounts at reputable VASPs, some agencies open new accounts at VASPs where funds are seized, while some agencies immediately send a seized asset to third party agencies that maintain the asset on behalf of the seizing agency.

THEMATIC AREAS

Each strategy has positives and negatives that an agency must weigh prior to engaging in seizures and conﬁscations. For example,

Oline wallet software generally allows for quicker, cheaper seizures and an ability to hold a wider variety of assets, including thinly traded virtual currencies. However, using online wallets creates a greater risk of having funds stolen by intrusions into the wallet software.

A hardware wallet is more secure than an online wallet, but it does have an initial upfront cost to purchase the hardware and may not custody certain assets (particularly those that are thinly traded).

Using a VASP to custody assets can be very efﬁcient for transferring assets, particularly when seizing from that VASP. However, assets held in VASPs are often commingled, not segregated and have previously been stolen from VASPs It is important for the seizing agency to work with the VASP to ensure conﬁdentiality, ensuring that data pertaining to the case, especially the defendant, is securely managed.

Using a third-party agency with expertise in safeguarding assets can be advantageous to ensure security; however, transferring to and from agencies can become monotonous, particularly if the safeguarding agency itself has limits.

Each of the available strategies can be successful and safe provided the agencies have procedures for mitigating risk.

THEMATIC AREAS

One general guideline is to identify who at the seizing agency will have access to the funds and what steps the agency will take to limit and track who at the agency can access the assets whilst not having a single point of failure and ensuring business continuity plans. Some agencies will only accept custody of assets as they were seized (e.g., if the agency seized Bitcoin, it would take custody of the Bitcoin). However, because some agencies lack capacity to eventually conﬁscate virtual assets, some agencies prefer to take custody of the ﬁat equivalent of an asset. A seizing agency should consider what the effects of price ﬂuctuation would have on an asset and subsequent ability to conﬁscate an asset (e.g., a very thinly traded virtual currency may be difﬁcult to liquidate) prior to deciding how the agency will take custody of an asset. Because virtual currencies are in a nascent stage, an agency should consider developing the ability to quickly modify procedures and policies for seizing and conﬁscating virtual currency assets. Software becomes obsolete, VASPs are hacked or liquidated, new virtual currencies are created, some virtual currencies fork. Therefore, it is prudent to have a “living document” controlling how to seize and conﬁscate virtual currency assets.

THEMATIC AREAS

Once the government secures authorization to conﬁscate and liquidate an asset, the seizing agency must plan how the assets will be liquidated (or returned as-is). If the seizing agency plans to liquidate, will it use a VASP, third party, or perform an auction-style sale of the asset. Each of these plans comes with inherent advantages and risks. Using a reputable VASP ensures securing “market rate” for the sale of an asset but may demand bureaucratic hurdles for choosing and supporting a VASP partner. Providing an auction can present its own bureaucratic hurdles as the agency must arrange and provide security for the virtual assets.Risks emerging from new technologies - good practices identified:

As part of pre-arrest research some key points for the investigator/prosecutor to consider are things such as - has the suspect ever used cryptocurrency, has the suspect talked about cryptocurrency, are you expecting to find evidence of the use of cryptocurrency in one form or another.

As part of the search and arrest preparation early consultation with the prosecutor and cyber-crime unit is essential to understand the relevant legislation, how to deal with cryptocurrency identified at a scene and how to seize and manage these assets.

THEMATIC AREAS

There is no central register of cryptocurrency wallets, so it is very difficult to state with certainty the owner of a cryptocurrency address. When utilising blockchain analysis, investigators, prosecutors or Asset Recovery Office (ARO) practitioners are recommended to concentrate their efforts on identifying a VASP that the suspect has transacted with to identify the beneficial owner of the wallet in question. The VASP usually incorporates KYC procedures and requires a customer to provide personally identifying information to use the exchange.

5. Use of informal banking systems – Hawala Hawala is generally described as an alternative remittance or informal value transfer system. Hawaladars’ is the term used for hawala operators. Hawala is the dominant financial service provider in conflict areas where the regulated financial sector is non-existent. In a more developed western economy, such hawala services are less in demand. Hawala is a community-based financial system operating through a network to partners in key towns and cities where individuals from their community are pre-eminent. Hawala networks working in parallel with conventional banking systems in the West tend to be used mainly for migrant remittances and small-scale business deals.

THEMATIC AREAS

Their services also tend to be limited to narrow markets servicing migrant remittance corridors. Additionally, individual transactions tend to be small for individuals extending to a few larger transactions linked to the import and export of goods linked to the home region of the hawaladar. One of the most common descriptions of hawala is that it is a trust-based service. This is no truer than saying that Western banking is trust based. Each stage of a transaction involves entrusting money to another party, but this is the same with any remittance process. Selection of a hawaladar is most often based on a combination of accessibility and reputation—in turn, based on performance and feedback. Bad performance becomes known in the community and leads to the choice to go elsewhere. It is purely their performance as a hawaladar that counts most, and the movement of value within a hawala network is based on accountability through good record keeping and the need to maintain relationships and future profit sharing rather than trust.Hawala is regarded by some as a paperless system but relies on detailed records. These records are designed and maintained to ensure that funds are properly accounted for, both to preserve the reputation of the business and to ensure the hawaladar does not overpay. At a minimum, hawaladars record the money they have received, who it is to be remitted to, and the amount in currency at each end of the transaction.

THEMATIC AREAS

The hawaladar also needs to send details of the transaction to the opposite hawaladar or agent making the payment on his behalf and record any balance that is altered by the transaction. Money received is given a unique transaction number (e.g., one half of a bank note serial number) to identify it and identify the transaction as it is posted to the account of the agent making the payment or to the journal account to facilitate settlement. Incoming remittances either carry or are given unique transaction numbers in a different series. Journals are also used to record money that is held on account for other hawaladar or for customers. A hawala ‘account’ does not come with regular statements, but the hawaladar can always provide a customer with details of how much money is held on account, or whether instructions to make a payment have been sent. They will also use the records when investigating any delay or failure in the system. Hawaladar do not normally operate a system of issuing receipts, but they will use telephone numbers or identification documents to ensure that they make remote payments to the right customer. This is a form of self-protection which becomes routine only when a hawaladar is regularly receiving remittance payments for occasional customers. Hawala is far from being a paperless system but tracing a transaction can only be done with access and interpretation of the hawaladars records.

THEMATIC AREAS

An oversimplified hawala transaction is described as follows:

A customer in Country A sends instructions plus password or code to a customer in Country B.

The customer in Country A visits the Hawaladar in Country A, provides the password or code and the details required of the customer in Country B and deposits the money for the transfer.

The Hawaladar in Country A provides the password or code and the details of the customer in Country B together with the payout amount to the Hawaladar in Country B.

The customer in Country A provides the customer in Country B the details of the Hawaladar in Country B,

The customer in Country B visits the Hawaladar in Country B, provides the password or code and collects the money remitted.

Use of Hawala - good practices identified: Investigators should consider identifying the communities within their country who may make use of the Hawala system of value transfer and build a strong partnership to gain an understanding of who the Hawaladars are, how their system works and how they can assist with law enforcement enquiries.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Developing and delivering a CTF course in phases Generally developing and delivering a CTF course involves several phases: Inception Phase, Pre-Course Phase - Independent Learning Phase, Contact Phase – Experiential Learning Phase (Onsite), Assessment, Feedback and Conclusions and Post-Course Phase. Each training course is unique, therefore their curriculum, content, and delivery method should all be tailored to the target group’s needs. Moreover, the curriculum presented here is based on the good practices identified throughout the workshops implemented by CEPOL in the WB PaCT project and only covers the contact phase. The course content should be engaging and interactive, designed to facilitate active, experiential learning. The delivery method, whether it is online, on-site, or hybrid, should be selected based on what would best serve the targeted audience. Learning Outcomes Learning outcomes are clear, concise statements that describe what learners should know, understand, or be able to do by the end of the training. The curriculum should not only describe the learning outcomes but provide a detailed timeline mapping the distribution of topics and activities across the course (the learning objectives). This not only ensures all necessary content is covered but also helps manage the pace of the course, allowing sufficient time for deeper understanding and practice.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Learning objectives are statements that describe what the instructor intends to teach in a particular learning activity or course. They are typically written from the instructor's perspective and focus on the content that will be covered. Learning outcomes serve as clear benchmarks for both the learners and the trainers. They provide learners with a clear understanding of what they are expected to achieve and allow trainers to focus their instruction and assess learner performance effectively. These learning outcomes should be SMART - Specific, Measurable, Achievable, Relevant, and Time-bound. They should clearly articulate what the learner will be able to do upon completion of the course and should align with the overall objectives of the training. From adopting this guideline, reflected across all the thematic areas, the learning outcomes can include: Understanding the Importance of FlexibilityLearn the importance of being adaptable and flexible, as the nature of intelligence can change rapidly. This requires the participants to constantly reassess their strategies and approaches. Improved and Enhanced Decision-Making Skills Improve their decision-making skills as investigators must decide how to adjust their strategies based on new intelligence.

TRAINING AND DEVELOPMENT OF A CURRICULUM

The process of converting intelligence/information into evidence requires making important decisions, which can improve investigators’ decision-making skills. Improved Analytical Skills Interpret the constantly evolving and changing intelligence picture can enhance the investigator’s analytical skills. Review the aims and objectives of the investigation as the intelligence picture changes can enhance investigators’ analytical skills, as they need to critically evaluate the information and determine its relevance and applicability to their case. Analyse information provided by the FIU who have access to a variety of databases that can enhance investigators’ analytical skills. Make clear the acquired data and understand its implications for their investigations. Enhanced Problem-Solving Skills Explain that working in a multi-agency team can enhance problem-solving skills, as participants must work together to address complex issues. By involving representatives from various agencies, participants can gain a broader perspective on the issues at hand. This can lead to a more holistic approach to problem solving producing innovative and effective solutions.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Understanding the Role of the Prosecutor Understand the role of the prosecutor in the criminal justice system, including their responsibilities and ethical obligations. Through early engagement with the prosecutor, investigators gain insight into the judicial process, including how decisions are made and the factors that influence these decisions. Early consultation with the prosecutor can help investigators develop effective strategies for gathering and presenting evidence. This can make the investigation more efficient and successful. Legal and Ethical Understanding Understand the legal and ethical considerations involved in TF investigations, including respect for human rights and the rule of law. Explain the legal requirements and specific elements for proving a TF offence. Improved Communication Enhance communication skills in terms of communicating with individuals from different professional backgrounds, particularly in terms of communicating complex legal concepts and requirements. Interagency Collaboration Learn the importance of collaboration across different agencies and departments leading to a better understanding of the roles

TRAINING AND DEVELOPMENT OF A CURRICULUM

and responsibilities of different agencies and departments within the criminal justice system. If the investigation has adopted a multi-agency approach, members can learn to work together more effectively, sharing intelligence and aligning their objectives as the situation evolves. Understanding of FIU Resources Understand the roles and responsibilities of the FIU in providing valuable information for TF investigations. Learn the resources available through the FIU, including various domestic and international databases. By utilising these resources, investigators can enhance their research skills, learning how to effectively gather and analyse information from a variety of sources efficiently and quickly. Appreciate the legal and ethical considerations involved in accessing and using these resources, including respect for privacy rights and data protection laws. Enhance the knowledge regarding the importance of international cooperation in TF investigations, particularly through channels like the Egmont Group. Understanding Evidence Conversion Demonstrate how to make the most of the information provided by the FIU, using it to advance their investigations more efficiently. Explain the legal requirements for gathering evidence, including what constitutes admissible evidence in court.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Learn how to effectively convert raw information into evidence that will be admissible in court proceedings.Understanding the Importance of Public Private Partnerships Explain the importance of building strong partnerships with external entities like financial institutions and the private sector. These partnerships can provide valuable resources and expertise for investigations. Demonstrate an understanding of financial systems and how they can be exploited for illegal activities. This knowledge can be invaluable in future investigations. Show their communication skills, particularly in terms of effectively briefing partners and providing feedback, this can help build trust between law enforcement agencies and the private sector, which can lead to more effective cooperation in the future. Building these partnerships can also expand participants’ professional networks, which can be beneficial for their career development and future collaborations. Describe the importance of collaborating with different entities, such as a company’s law enforcement liaison officer, to gather necessary information and can gain a deeper understanding of the legal requirements and procedures for obtaining financial transaction information. Efficient Use of Resources Demonstrate that by working together, agencies can more efficiently utilise resources, avoiding duplication of efforts and making the most of each agency’s unique capabilities.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Through public private partnerships, law enforcement agencies can leverage the resources and expertise of the private sector, leading to more efficient and effective investigations. Explain how resources can be used more efficiently, choosing the most effective techniques for each situation. Comprehensive Investigation Describe various global financial systems and how they can be exploited for illegal activities. Illustrate the importance of conducting a comprehensive investigation that looks at all transactions linked to a suspect, not just a single transaction. By obtaining all transactions linked to a suspect, investigators can make more efficient use of their resources, potentially saving time and effort in the long run and providing a more complete picture of the suspect’s activities and associates. Understanding International Cooperation Display the importance of fostering international cooperation in investigations leading to more effective and efficient investigations. Developing and enhancing their communication skills and effectively communicating with international partners will lead to an efficient and timely exchange of information thereby speeding up the investigation process. Establishing these communication channels can also expand participants’ professional networks, which can be beneficial for their career development and future collaborations.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Demonstrate cultural awareness and cross-cultural communication skills to facilitate effective collaboration in an international context and the ability to navigate international cooperation frameworks will lead to establishing effective partnerships with foreign counterparts. Knowledge of International Legal Systems Demonstrate an understanding of different legal systems and how they handle terrorism financing investigations. This knowledge can be invaluable in future investigations. Establishing international relationships will facilitate the leveraging of mutual legal assistance (MLA) mechanisms (informal and formal) to exchange information trace cross-border transactions, and seize assets associated with terrorism financing. Explain the role of MLA in international investigations and the importance of submitting formal MLA requests to acquire evidence. Understanding Special Investigation Techniques Explain the variety of special investigation techniques available to law enforcement, such as surveillance, undercover operations, and financial analysis. Participants can gain experience in applying these techniques to real cases, understanding when and how to use each technique effectively.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Demonstrate an understanding of the legal and ethical considerations involved in using special investigation techniques, including respect for privacy rights and the rule of law.Use of OSINT Effectively cooperate and coordinate with cyber experts so that they can utilise digital tools and platforms to support the investigation into counter terrorism financing. Curriculum of the CTF Course A training curriculum ensures the course content is organised, comprehensive, and aligns with the pre-defined learning objectives and learning outcomes. It is, basically, a blueprint for the course, describing what content should be delivered, how it should be delivered, and how participants’ progress should be assessed. Learning outcomes are key elements of the curriculum, the whole curriculum development process heavily relies on the pre-defined learning outcomes. When developing the curriculum, trainers should apply Bloom’s Taxonomy, which is a hierarchical model that classifies learning objectives into levels of complexity and specificity.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Bloom’s Taxonomy covers the learning objectives in cognitive, affective, and psychomotor domains. The cognitive domain is frequently used to structure curriculum learning objectives, assessments and activities and includes:Remembering: This involves recalling or recognising information. In a CTF course, this might involve remembering or recapping key concepts or terminology, such as the definition of TF offences and the points to prove to support a successful investigation and prosecution. Understanding: This is about understanding the meaning, translation, interpolation, and interpretation of instructions and problems. In the context of CTF trainings, participants might demonstrate this by explaining how a specific special investigative technique can support a TF investigation. Applying: At this level, students use a concept in a new situation or unprompted use of an abstraction. In CTF investigations, this might be applying a learned technique in a new or unique scenario, like using private sector methodologies to collect evidence in a simulated investigation. Analysing: Analysing involves the ability to differentiate, organize, and attribute. Participants can be asked to analyse a case study, identifying the financial investigation techniques used, their effectiveness, and suggesting improvements.

TRAINING AND DEVELOPMENT OF A CURRICULUM

Evaluating: This level is about making judgments based on criteria and standards. For example, a participant could be asked to evaluate the effectiveness of different methods of obtaining financial information or the legal and ethical considerations of specific investigative actions. Creating: The highest level involves producing new or original work. In the context of a CFT course, this might mean developing and presenting a new case study highlighting the investigative approach, detailing challenges and passing on good practices identified. During discussions the participants stated that the future trainers should have the flexibility and discretion to include matters of interest/importance within the main topic heading and determine how much time should be spent on each particular topic. Incorporating the lessons learned where appropriate by adopting this guide a suggested Counter Terrorism Financing Course programme could include the following topics:Domestic Legislation

Difference between ML and TF

TF offences

Points to prove

TRAINING AND DEVELOPMENT OF A CURRICULUM

Roles and Responsibilities of the FIU:

STRs and SARs;
Use of information by LEAs (Different types of information held by the FIU and access to various databases);
Feedback (to and from the FIU);
UN domestic designation lists.

Public Private Partnerships:

Legal responsibilities of the private sector
Benefits of Public Private Partnership
Vulnerabilities of financial products
Risk profiles and typologies (Red flags)
Procedures for data exchange
Improving cooperation (MoUs and PoCs).

TF Typologies:

National, regional and international threat;
How terrorists raise funds;
How terrorists move funds;
Requirements of terrorist organisations.

Abuse and Exploitation of NPOS

FATF Recommendation 8
Legal framework and obligations

TRAINING AND DEVELOPMENT OF A CURRICULUM

Working with the NPO sector and supervisors
Risk and threat assessment
Terrorist abuse and exploitation of NPOs

Cryptocurrency investigations:

Legislation relevant to virtual assets
How VASPs use their resources to provide support to LEA
Publicly available tools to analyse transactions
Publicly available tools to analyse transactions
Ways to identify and preserve evidence in relation to virtual assets
Procedures for the seizing, administration, conversion and confiscation of virtual assets.
OSINT tools
Practical case studies

Hawala

Understanding the informal banking systems
Adopting a risk based approach
How to apply methods of investigations
How to recognise evidence of existence of Hawala transactions and reconciliation methods
Communication, interception and the importance of unofficial transaction reports

International Enquiries

Informal methods of obtaining information
Mutual Legal Assistance Requests

TRAINING AND DEVELOPMENT OF A CURRICULUM

Working with the NPO sector and supervisors
Risk and threat assessment
Terrorist abuse and exploitation of NPOs

Cryptocurrency investigations:

Legislation relevant to virtual assets
How VASPs use their resources to provide support to LEA
Publicly available tools to analyse transactions
Publicly available tools to analyse transactions
Ways to identify and preserve evidence in relation to virtual assets
Procedures for the seizing, administration, conversion and confiscation of virtual assets.
OSINT tools
Practical case studies

Hawala

Understanding the informal banking systems
Adopting a risk based approach
How to apply methods of investigations
How to recognise evidence of existence of Hawala transactions and reconciliation methods
Communication, interception and the importance of unofficial transaction reports

International Enquiries

Informal methods of obtaining information
Mutual Legal Assistance Requests

CONCLUSIONS

The existence of terrorism is inextricably linked to the availability of financial resources. However, it is not always feasible to prosecute individuals for offences related to terrorist financing. The use of financial investigations and financial intelligence serves as a potent tool in counter-terrorism efforts, offering invaluable insights that can lead to further investigative leads and disruption of terrorist activities. The importance of employing financial intelligence in all counter-terrorism investigations cannot be overstated. However, the complexity and global nature of these issues mean that they cannot be tackled by any single agency, department, or organisation in isolation. Inter-agency cooperation is, therefore, a critical component in effectively combating terrorist financing. This necessitates a collaborative approach that leverages the strengths and capabilities of various entities to achieve a common objective. Transactions related to terrorist financing are often difficult to identify due to their covert nature and the sophisticated methods employed by terrorists. This underscores the importance of public-private partnerships in counter-terrorism efforts. The private sector often possesses crucial information that can significantly aid in the successful investigation and prosecution of terrorist financing. However, they may not always be aware of the significance of this information unless it is highlighted by law enforcement agencies, FIUs, or prosecutors. Therefore, it is essential to keep the private sector informed about emerging trends and typologies in terrorist financing.

CONCLUSIONS

They should also be provided with feedback following counter-terrorism or terrorist financing investigations. This will enable them to understand the context and relevance of the information they possess, thereby enhancing their ability to contribute effectively to counter-terrorism efforts. In conclusion, a multi-faceted and collaborative approach that involves both public and private sector entities is key to successfully combating terrorist financing.

another try by Flo

More creations to inspire you

BEYONCÉ

DEMOCRATIC CANDIDATES NOV DEBATE

ONE MINUTE ON THE INTERNET

SITTING BULL

RUGBY WORLD CUP 2019

GRETA THUNBERG

FIRE FIGHTER

Transcript